Jump to content

brando223

Honorary Members
 View Profile  See their activity

  • Posts

    52

  • Joined

  • Last visited

 Content Type 

Posts posted by brando223

    Infected with viruses

    in Resolved Malware Removal Logs

    Posted

    FixLog:

     

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-11-2013 01
    Ran by Brandon at 2013-11-11 14:46:58 Run:1
    Running from C:\Users\Brandon\Desktop
    Boot Mode: Normal
    ==============================================

    Content of fixlist:
    *****************
    Start
    MountPoints2: {7d6312d7-5b28-11e2-a35b-c485087b4d81} - F:\MotoCastSetup.exe -a
    MountPoints2: {a99f57c0-1250-11e2-a8eb-806e6f6e6963} - E:\autorun.exe
    SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
    SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
    SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
    C:\Users\Brandon\AppData\Roaming\Camdata.ini
    C:\Users\Brandon\AppData\Roaming\CamLayout.ini
    C:\Users\Brandon\AppData\Roaming\CamShapes.ini
    C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat
    C:\Users\Brandon\jagex_cl_runescape_LIVE.dat
    C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat
    C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat
    C:\Users\Brandon\random.dat
    2009-07-13 21:34 - 2013-11-02 19:54 - 00000986 ____A C:\Windows\system32\Drivers\etc\hosts
    End



    *****************

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d6312d7-5b28-11e2-a35b-c485087b4d81} => Key deleted successfully.
    HKCR\CLSID\{7d6312d7-5b28-11e2-a35b-c485087b4d81} => Key not found.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a99f57c0-1250-11e2-a8eb-806e6f6e6963} => Key deleted successfully.
    HKCR\CLSID\{a99f57c0-1250-11e2-a8eb-806e6f6e6963} => Key not found.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully.
    HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found.
    HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully.
    HKCR\Wow6432Node\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found.
    HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully.
    HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found.
    C:\Users\Brandon\AppData\Roaming\Camdata.ini => Moved successfully.
    C:\Users\Brandon\AppData\Roaming\CamLayout.ini => Moved successfully.
    C:\Users\Brandon\AppData\Roaming\CamShapes.ini => Moved successfully.
    C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat => Moved successfully.
    C:\Users\Brandon\jagex_cl_runescape_LIVE.dat => Moved successfully.
    C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat => Moved successfully.
    C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat => Moved successfully.
    C:\Users\Brandon\random.dat => Moved successfully.
    C:\Windows\system32\Drivers\etc\hosts => Moved successfully.

    ==== End of Fixlog ====

     

    ADW CLEANER:

     

    # AdwCleaner v3.012 - Report created 11/11/2013 at 14:52:36
    # Updated 11/11/2013 by Xplode
    # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
    # Username : Brandon - BRANDON-HP
    # Running from : C:\Users\Brandon\Desktop\AdwCleaner.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****

    Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search

    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
    Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
    Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220222622276}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660266626676}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
    Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660266626676}
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
    Key Deleted : HKCU\Software\APN PIP
    Key Deleted : HKCU\Software\Cr_Installer
    Key Deleted : HKCU\Software\installedbrowserextensions
    Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
    Key Deleted : HKLM\Software\PIP

    ***** [ Browsers ] *****

    -\\ Internet Explorer v0.0.0.0


    -\\ Mozilla Firefox v25.0 (en-US)

    [ File : C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\prefs.js ]

    Line Deleted : user_pref("extensions.crossrider.bic", "13dc8d8943234a7ac588a42349ce30a7");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationThankYouPage", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationTime", 1364874243);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.searchUserConifrmation", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setHomepage", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setNewTab", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setSearch", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.active", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.addressbar", "NA");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.addressbarenhanced", "");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncdb_dbWasSet", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncdb_dbWasSet_FF25_FIX", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncinternaldb_dbWasSet", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncinternaldb_dbWasSet_FF25_FIX", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.backgroundjs", "\n\n//\n");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.backgroundver", 11);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.can_run_bg_code", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.certdomaininstaller", "");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.changeprevious", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallationTime.value", "1364874243");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_aoi.value", "1364874243");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_arbitrary_code.expiration", "Mon Nov 11 2013 14:52:14 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_arbitrary_code.value", "%22%28function%28%29%7B_GPL_PLUGIN.st%3D%7B%5C%2274052%26pid%3D1269%5C%22%3A%7Bs%3A%5B%5C%2274052%26pid%3D1695%5C%22%[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_blocklist.expiration", "Mon Nov 11 2013 14:52:14 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_blocklist.value", "%22bing.com%2Cfacebook.com%2Cnonexistantdomain.com%22");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_country_code.expiration", "Wed Nov 13 2013 22:27:05 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_country_code.value", "%22US%22");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_crr.value", "1384199238");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_currenttime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_currenttime.value", "%221383332399%22");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_hotfix20111102645.value", "%221%22");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_delay.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_delay.value", "24");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_disclosure.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_disclosure.value", "1367856897");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_list.expiration", "Mon Nov 11 2013 16:18:39 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_list.value", "%7B%22f7610cf2b37067876b694a05c56f32e2%22%3A%7B%22p%22%3A%22/%22%7D%2C%22d763717b4b2e0a17a877cc642fb80ee4%22%3A%7B%22p%22%3A[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_t.expiration", "Mon Nov 11 2013 20:14:40 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_t.value", "%22hxxp%3A//download.bleepingcomputer.com/dl/166f9bbb082732c4270bfb13eac5f7d1/52802f7c/windows/security/security-utilities/f/fa[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installer_params.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installer_params.value", "%7B%22source_id%22%3A%22142732%22%2C%22sub_id%22%3A%22default%22%2C%22uzid%22%3A%22142732%26subid%3D%26pid%3D1384%2[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installtime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installtime.value", "%221364833255%22");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_parent_zoneid.value", "%2214019%22");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_pc_20120828.value", "1364874491204");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_product_id.value", "%221347%22");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_zoneid.value", "%22165991%22");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.dbtest.value", "1364874380692");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.description", "Deal Spy");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.domain", "");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.enablesearch", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.homepage", "");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.iframe", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3A%2236DB0BA830CC42F2AEA6A0310D105C93IE%22%2C%22installer_verifier%22%3A%2214a03f09cabe5b[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_appVer.value", "17");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_lastVersion.value", "1");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_meta.value", "%7B%7D");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_nextCheck.expiration", "Mon Nov 11 2013 16:18:29 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_nextCheck.value", "true");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_queue.value", "%7B%7D");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_remote_resources.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_remote_resources.value", "%7B%22remoteId%22%3A0%7D");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.SoftwareDetected.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.SoftwareDetected.value", "%7B%22AnySoftware%22%3Afalse%2C%22Wireshark%22%3Afalse%2C%22VirtualBox%22%3Afalse%2C%22VMWare%22%3Afalse%2C%22Inside[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GPL_=function(){_GPL_PLUGIN.started||_GPL_PLUGIN.prepare({pid:1347,baseCDN:\"dealspy-a.akamaihd.net\[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.lastDailyReport", "1384183109255");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.lastUpdate", "1384183108690");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.manifesturl", "");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.name", "Deal Spy");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.newtab", "");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.opensearch", "");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.code", "appAPI._cr_config={appID:function(){var a=appAPI.appInfo;if(a){return appAPI.appInfo.id;}else{return appAPI.appID;}}};$jquery.ex[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.name", "base");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.ver", 6);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.code", "Array.prototype.indexOf||(Array.prototype.indexOf=function(b){if(void 0===this||null===this)throw new TypeError;var c=Obje[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.ver", 16);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.code", "var a=appAPI.db.getList(),cf_ran=!1,_GPL_BG={vars:{},rules:{},started:!1,allowed:!1,log:function(b){console.log(b)},factor[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.name", "GPL Background (BG)");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.ver", 39);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.code", "(function(a){a.selectedText=function(e,c){function d(){if(window.getSelection){return window.getSelection();}else{if(document.g[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.name", "CrossriderAppUtils");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.ver", 3);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefined\"){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==\"undefined\"&&typeof window.navigat[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.name", "CrossriderUtils");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.ver", 8);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.code", "if((typeof isBackground===\"undefined\"||isBackground!==true)&&(typeof _firefoxVersion!==\"undefined\"&&_firefoxVersion>14)&&ty[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.name", "FFAppAPIWrapper");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.ver", 9);

    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_17.name", "jQuery");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_17.ver", 4);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.code", "var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.debug_app};return h.Class.[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.name", "debug");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.ver", 4);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=function(c,b){a.when.apply(n[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.name", "resources");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.ver", 4);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.code", "var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_config.appID()},b,g=new e.Deferred(),f;return e.Class.exte[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.name", "initializer");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.ver", 3);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.code", "var jQuery = $jquery_171 = $jquery = null;\n\nif (document && typeof document.getElementById !== \"undefined\") {\n\n/*! jQuery [...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.name", "jquery_1_7_1");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.ver", 4);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.code", "(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.name", "resources_background");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.ver", 3);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPTY_CHANNEL__\";var d=function(j){return(typeof j===\"object\"&&j!==null);};var b=function(j){return[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.name", "appApiMessage");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.ver", 2);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.code", "if(appAPI.__should_activate_validation__===true){(function(){var k={};var f=appAPI.appInfo.name;var l=function(s,r,t){var q=\"[[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.name", "appApiValidation");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.ver", 3);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.code", "if(typeof jQuery!==\"undefined\"&&(jQuery)&&typeof navigator!==\"undefined\"&&typeof navigator.userAgent!==\"undefined\"){(func[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.name", "CrossriderInfo");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.ver", 3);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.code", "(function(){var b=\"cr_\"+appAPI.appID+\"internalMessage\";var a=function(){var d=function(g){if(g===true){unsafeWindow.appAPI=[...]
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.name", "omniCommands");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.ver", 2);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_0", "4,14,78,16,64,47,72,98,1000015");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_1", "17,14,78,13,16,64,4,1,21,22,72,98,1000014,28");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_5", "4,14,78,13,16,64,47,72");

    Line Deleted : user_pref("extensions.crossriderapp26276.26276.pluginsversion", 15);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.publisher", "Innovative Apps");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.searchstatus", 0);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.setnewtab", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.thankyou", "");
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.updateinterval", 360);
    Line Deleted : user_pref("extensions.crossriderapp26276.26276.ver", 17);
    Line Deleted : user_pref("extensions.crossriderapp26276.adsOldValue", -1);
    Line Deleted : user_pref("extensions.crossriderapp26276.apps", "26276");
    Line Deleted : user_pref("extensions.crossriderapp26276.bic", "13dc8d8943234a7ac588a42349ce30a7");
    Line Deleted : user_pref("extensions.crossriderapp26276.cid", 26276);
    Line Deleted : user_pref("extensions.crossriderapp26276.firstrun", false);
    Line Deleted : user_pref("extensions.crossriderapp26276.hadappinstalled", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.installationdate", 1364874270);
    Line Deleted : user_pref("extensions.crossriderapp26276.lastcheck", 23062968);
    Line Deleted : user_pref("extensions.crossriderapp26276.lastcheckitem", 23063233);
    Line Deleted : user_pref("extensions.crossriderapp26276.modetype", "production");
    Line Deleted : user_pref("extensions.crossriderapp26276.reportInstall", true);
    Line Deleted : user_pref("extensions.crossriderapp26276.statsDailyCounter", 473);

    -\\ Google Chrome v30.0.1599.101

    [ File : C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\preferences ]


    *************************

    AdwCleaner[R0].txt - [21769 octets] - [11/11/2013 14:48:20]
    AdwCleaner[s0].txt - [22348 octets] - [11/11/2013 14:52:36]

    ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [22409 octets] ##########
     

     

    The Malwarebytes log file did not display any threats.

     

     

    ESET Online Scan log:

     

    C:\Program Files (x86)\Deal Spy\ButtonUtil.dll    a variant of Win32/Toolbar.CrossRider.G application
    C:\Program Files (x86)\Deal Spy\Deal Spy-bg.exe    a variant of Win32/Toolbar.CrossRider.E application
    C:\Program Files (x86)\Deal Spy\Deal Spy.exe    a variant of Win32/Toolbar.CrossRider.E application
    C:\Program Files (x86)\Deal Spy\Uninstall.exe    multiple threats
    C:\Users\Brandon\.frostwire5\updates\frostwire-5.6.6.windows.exe    multiple threats
    C:\Users\Brandon\Downloads\cbsidlm-cbsi5_3_0_96-Free_RAR_Extract_Frog-SEO-10804840.exe    probably a variant of Win32/CNETInstaller.A application
    C:\Users\Brandon\Downloads\cbsidlm-tr1_11-Text_To_Wav-SEO-10788300.exe    Win32/DownloadAdmin.G application

     

     

     

    Checkup log:

     

     Results of screen317's Security Check version 0.99.77  
     Windows 7 Service Pack 1 x64 (UAC is enabled)  
     Internet Explorer 11  
    ``````````````Antivirus/Firewall Check:``````````````
     Windows Firewall Enabled!  
    Norton 360    
     WMI entry may not exist for antivirus; attempting automatic update.
    `````````Anti-malware/Other Utilities Check:`````````
     Deal Spy    
     Malwarebytes Anti-Malware version 1.75.0.1300  
     Java 7 Update 25  
     Java version out of Date!
     Adobe Flash Player 11.9.900.117  
     Adobe Reader 10.1.2 Adobe Reader out of Date!  
     Mozilla Firefox (25.0)
     Google Chrome 30.0.1599.101  
     Google Chrome 30.0.1599.69  
    ````````Process Check: objlist.exe by Laurent````````  
     Norton ccSvcHst.exe
    `````````````````System Health check`````````````````
     Total Fragmentation on Drive C: 1%
    ````````````````````End of Log``````````````````````

     

    Infected with viruses

    in Resolved Malware Removal Logs

    Posted

    Thank you!

     

    FRST log

     

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
    Ran by Brandon (administrator) on BRANDON-HP on 10-11-2013 20:25:35
    Running from C:\Users\Brandon\Desktop
    Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
    Internet Explorer Version 9
    Boot Mode: Normal

    ==================== Processes (Whitelisted) =================

    (AMD) C:\Windows\system32\atiesrxx.exe
    (IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
    (Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
    (AMD) C:\Windows\system32\atieclxx.exe
    (Microsoft Corporation) C:\Windows\system32\WLANExt.exe
    (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
    (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
    (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
    (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Proximity Sensor\HPPRXSVC.exe
    (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
    (Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
    () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
    (Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe
    (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
    (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
    (Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
    (Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
    (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
    (Microsoft Corporation) C:\Users\Brandon\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
    (Hewlett Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Audio\HPWA.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    (CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
    (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
    (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
    (SecureW2 B.V.) C:\Program Files (x86)\SecureW2\sw2_tray.exe
    (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
    (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    (Microsoft Corp.) C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe
    (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
    (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
    (Intel® Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
    (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
    (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
    (Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
    (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    (Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
    (Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
    (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
    (Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
    (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
    (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
    (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
    (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    (Aestan Software) C:\wamp\wampmanager.exe
    (Apache Software Foundation) c:\wamp\bin\apache\apache2.4.4\bin\httpd.exe
    () c:\wamp\bin\mysql\mysql5.6.12\bin\mysqld.exe
    (Apache Software Foundation) C:\wamp\bin\apache\apache2.4.4\bin\httpd.exe
    (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
    (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
    (Google) C:\Users\Brandon\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
    (Microsoft Corporation) C:\Windows\system32\msiexec.exe

    ==================== Registry (Whitelisted) ==================

    HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
    HKLM\...\Run: [bLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)
    HKLM\...\Run: [bTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
    HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-02-23] (Synaptics Incorporated)
    HKLM\...\Run: [sysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-01-04] (IDT, Inc.)
    HKLM\...\Run: [setDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.)
    HKLM\...\Run: [intelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4123 2012-05-30] ()
    HKLM\...\RunOnce: [NCPluginUpdater] - "c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe" Update [21720 2013-11-05] (Hewlett-Packard)
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKCU\...\Run: [steam] - C:\Program Files (x86)\Steam\Steam.exe [1635752 2013-05-03] (Valve Corporation)
    HKCU\...\Run: [Google Update] - C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-18] (Google Inc.)
    HKCU\...\Run: [skyDrive] - C:\Users\Brandon\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257136 2013-10-11] (Microsoft Corporation)
    MountPoints2: {7d6312d7-5b28-11e2-a35b-c485087b4d81} - F:\MotoCastSetup.exe -a
    MountPoints2: {a99f57c0-1250-11e2-a8eb-806e6f6e6963} - E:\autorun.exe
    HKLM-x32\...\Run: [uSB3MON] - C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-26] (Intel Corporation)
    HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636032 2012-03-26] (Advanced Micro Devices, Inc.)
    HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-01-31] ()
    HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-30] (CyberLink Corp.)
    HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
    HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
    HKLM-x32\...\Run: [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2011-08-26] (Hewlett-Packard Development Company, L.P.)
    HKLM-x32\...\Run: [secureW2 Tray] - C:\Program Files (x86)\SecureW2\sw2_tray.exe [287112 2012-02-22] (SecureW2 B.V.)
    HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
    HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [151952 2012-11-29] (Apple Inc.)
    HKLM-x32\...\Run: [bCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
    HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard)
    HKLM-x32\...\Run: [] - [x]
    HKLM-x32\...\Run: [MSN Toolbar] - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe [240992 2009-11-16] (Microsoft Corp.)
    HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288080 2009-07-17] (Microsoft Corporation)
    HKLM-x32\...\Run: [hpqSRMon] - C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe [150528 2008-07-22] (Hewlett-Packard)
    HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
    Startup: C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel® Turbo Boost Technology Monitor 2.6.lnk
    ShortcutTarget: Intel® Turbo Boost Technology Monitor 2.6.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)

    ==================== Internet (Whitelisted) ====================

    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
    HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
    HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
    SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
    SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
    SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
    SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
    SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
    SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
    SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
    SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
    SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
    SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
    BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
    BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
    BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
    BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
    BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
    BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
    BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
    BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: MSN Toolbar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)
    BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
    BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
    Toolbar: HKLM-x32 - MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)
    Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

    FireFox:
    ========
    FF ProfilePath: C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default
    FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
    FF Plugin: @java.com/DTPlugin,version=10.6.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.6.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin: @microsoft.com/GENUINE - disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
    FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
    FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
    FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin-x32: @Microsoft.com/NpWinExt,version=4.0 - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
    FF Plugin HKCU: @stonetrip.com/ShiVaWebPlayer,version=1.8.0.0 - C:\Users\Brandon\AppData\Roaming\..\LocalLow\StoneTrip\Web Player\npShiVa3D.dll (StoneTrip)
    FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
    FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
    FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
    FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Brandon\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Brandon\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Brandon\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
    FF SearchPlugin: C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\searchplugins\safeguard-secure-search.xml
    FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
    FF Extension: Deal Spy - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\cca2b8f2-77b0-4282-9533-b31982107a80@ef5174e8-db70-4d61-88df-24b975460bd0.com
    FF Extension: WOT - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
    FF Extension: HP Detect - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}
    FF Extension: noscript - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
    FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\coFFPlgn\
    FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\coFFPlgn\
    FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\Firefox
    FF Extension: MSN Toolbar - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\Firefox
    FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\
    FF Extension: Search Helper Extension - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\
    FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\IPSFF
    FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\IPSFF
    FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
    FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

    Chrome:
    =======
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
    CHR Plugin: (Norton Identity Safe) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.2.1.36_0\npcoplgn.dll No File
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll No File
    CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
    CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
    CHR Plugin: (Java Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
    CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
    CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
    CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll No File
    CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
    CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
    CHR Extension: (Google Docs) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
    CHR Extension: (Google Drive) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
    CHR Extension: (YouTube) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
    CHR Extension: (Google Search) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
    CHR Extension: (Deal Spy) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\dieckmbeafcedhihaiadnaanclccfihd\1.25.16_0
    CHR Extension: (Norton Identity Protection) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.3.4_0
    CHR Extension: (Google Wallet) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
    CHR Extension: (Gmail) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
    CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\Exts\Chrome.crx

    ==================== Services (Whitelisted) =================

    R2 HPPRXSVC; C:\Program Files (x86)\Hewlett-Packard\HP Proximity Sensor\HPPRXSVC.exe [37432 2012-03-06] (Hewlett-Packard Development Company, L.P.)
    R2 ISCTAgent; C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
    R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
    S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
    R2 N360; C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
    R3 wampapache; c:\wamp\bin\apache\apache2.4.4\bin\httpd.exe [24576 2013-06-23] (Apache Software Foundation)
    R3 wampmysqld; c:\wamp\bin\mysql\mysql5.6.12\bin\mysqld.exe [12867584 2013-06-23] ()
    R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)

    ==================== Drivers (Whitelisted) ====================

    R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
    R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [1524824 2013-10-22] (Symantec Corporation)
    R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
    R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-02] (Symantec Corporation)
    R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-10-28] (Symantec Corporation)
    R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\IPSDefs\20131110.002\IDSvia64.sys [521816 2013-10-25] (Symantec Corporation)
    R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()
    R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()
    R2 IntelHaxm; C:\Windows\System32\DRIVERS\IntelHaxm.sys [85008 2012-05-22] ()
    R3 ISCT; C:\Windows\system32\drivers\ISCTD64.sys [44992 2012-02-09] ()
    R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\VirusDefs\20131109.006\ENG64.SYS [126040 2013-11-04] (Symantec Corporation)
    R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\VirusDefs\20131109.006\EX64.SYS [2099288 2013-11-04] (Symantec Corporation)
    S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [260712 2012-01-30] (Realtek Semiconductor Corp.)
    S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
    R3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-02-23] (Synaptics Incorporated)
    R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
    R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
    R0 SymDS; C:\Windows\System32\drivers\N360x64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
    R0 SymEFA; C:\Windows\System32\drivers\N360x64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
    R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-17] (Symantec Corporation)
    R1 SymIRON; C:\Windows\system32\drivers\N360x64\1404000.028\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation)
    R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
    S3 uxddrv; C:\nbutils\QuickT\wow64\uxddrv64.sys [7256 2009-05-14] ()
    R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2013-11-08] ()

    ==================== NetSvcs (Whitelisted) ===================


    ==================== One Month Created Files and Folders ========

    2013-11-10 20:23 - 2013-11-10 20:23 - 00000000 ____D C:\Users\Brandon\Desktop\Torrent Data
    2013-11-10 20:14 - 2013-11-10 20:14 - 01957590 _____ (Farbar) C:\Users\Brandon\Desktop\FRST64.exe
    2013-11-10 20:14 - 2013-11-10 20:14 - 00000000 ____D C:\FRST
    2013-11-08 18:20 - 2013-11-08 18:43 - 00000053 _____ C:\Users\Brandon\Desktop\VGD.txt
    2013-11-08 11:47 - 2013-11-08 11:47 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
    2013-11-07 22:54 - 2013-11-07 22:54 - 00975932 _____ C:\Users\Brandon\Downloads\AMIDST-3.4.exe
    2013-11-06 10:00 - 2013-11-06 10:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
    2013-11-05 16:26 - 2013-11-05 16:26 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Brandon\Downloads\mbam-setup-1.75.0.1300.exe
    2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Malwarebytes
    2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-11-05 16:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2013-11-03 14:43 - 2013-11-03 17:39 - 00000000 ____D C:\Users\Brandon\Desktop\export2
    2013-11-03 12:34 - 2013-11-03 12:43 - 704643072 _____ C:\Users\Brandon\Desktop\ubuntu-13.10-server-amd64.iso
    2013-11-03 11:18 - 2013-11-03 12:32 - 00000000 ____D C:\Users\Brandon\VirtualBox VMs
    2013-11-03 11:17 - 2013-11-10 16:35 - 00000000 ____D C:\Users\Brandon\.VirtualBox
    2013-11-03 11:16 - 2013-11-03 11:16 - 00001076 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
    2013-11-03 11:16 - 2013-11-03 11:16 - 00000000 ____D C:\Program Files\Oracle
    2013-11-03 11:16 - 2013-11-01 15:13 - 00252688 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
    2013-11-03 11:16 - 2013-11-01 15:10 - 00126736 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
    2013-11-03 11:14 - 2013-11-03 11:15 - 106230544 _____ (Oracle Corporation) C:\Users\Brandon\Downloads\VirtualBox-4.3.2-90405-Win.exe
    2013-11-03 08:59 - 2013-11-03 08:59 - 00000018 _____ C:\Users\Brandon\Desktop\New Text Document.txt
    2013-11-02 20:45 - 2013-11-03 14:38 - 00000000 ____D C:\Users\Brandon\Desktop\export
    2013-11-02 20:21 - 2013-11-03 17:39 - 00000000 ____D C:\Users\Brandon\Desktop\backup
    2013-11-02 19:53 - 2013-11-02 19:54 - 00000000 ____D C:\wamp
    2013-11-02 19:40 - 2013-11-02 19:40 - 00001639 _____ C:\Users\Brandon\Desktop\register.php
    2013-11-02 19:39 - 2013-11-02 19:39 - 00000000 _____ C:\Users\Brandon\Desktop\default_position.php
    2013-11-02 19:13 - 2013-11-02 19:14 - 40603386 _____ (Hervé Leclerc (HeL)                                         ) C:\Users\Brandon\Downloads\Wampserver2.4-x64(1).exe
    2013-11-02 17:42 - 2013-11-02 17:42 - 04812567 _____ (Tim Kosse) C:\Users\Brandon\Downloads\FileZilla_3.7.3_win32-setup.exe
    2013-11-02 16:08 - 2013-11-02 20:12 - 00000000 ____D C:\Users\Brandon\Desktop\MultiplayerTechTest
    2013-11-02 14:50 - 2013-11-02 16:00 - 00177290 _____ C:\Users\Brandon\Desktop\TEST.capx
    2013-11-02 14:50 - 2013-11-02 15:56 - 00177286 _____ C:\Users\Brandon\Desktop\TEST.capx.backup1
    2013-11-02 14:42 - 2013-11-02 14:50 - 862987318 _____ C:\Users\Brandon\Desktop\TechTest.capx.backup1
    2013-11-02 14:18 - 2013-11-02 14:48 - 00000973 _____ C:\Users\Brandon\Desktop\TechTest.uistate.xml
    2013-11-02 14:18 - 2013-11-02 14:18 - 00003884 _____ C:\Users\Brandon\Desktop\TechTest.caproj
    2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Layouts
    2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Event sheets
    2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Animations
    2013-11-01 15:10 - 2013-11-01 15:10 - 00154896 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
    2013-11-01 15:10 - 2013-11-01 15:10 - 00140560 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
    2013-11-01 15:07 - 2013-11-01 15:07 - 00204048 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
    2013-11-01 10:26 - 2013-11-01 10:26 - 00000000 ____D C:\Users\Brandon\Desktop\rex_date
    2013-10-31 19:56 - 2013-10-31 19:57 - 128683080 _____ (Scirra                                                      ) C:\Users\Brandon\Downloads\construct2-r148-setup_18543583.exe
    2013-10-31 19:55 - 2013-10-31 19:55 - 00000000 ____D C:\Users\Brandon\Desktop\7_Textbox_addon
    2013-10-30 22:40 - 2013-10-30 22:40 - 02769432 _____ C:\Users\Brandon\Desktop\Ride.3gp.mp4
    2013-10-30 22:29 - 2013-10-30 22:29 - 02803140 _____ C:\Users\Brandon\Desktop\Ride.mp4
    2013-10-30 15:04 - 2013-10-30 15:04 - 01058176 _____ (PassMark Software                                           ) C:\Users\Brandon\Downloads\diskcheckup.exe
    2013-10-30 15:04 - 2013-10-30 15:04 - 00000000 ____D C:\Program Files (x86)\DiskCheckup
    2013-10-30 12:17 - 2013-10-30 12:17 - 04668633 _____ C:\Users\Brandon\Downloads\p95v279.win64.zip
    2013-10-30 12:16 - 2013-10-30 12:16 - 00425667 _____ C:\Users\Brandon\Downloads\memtest86-iso.zip
    2013-10-29 09:57 - 2013-10-31 16:12 - 00000061 _____ C:\Users\Brandon\Desktop\COLLEGEWORK.txt
    2013-10-23 16:34 - 2013-10-28 22:46 - 00000000 ____D C:\Users\Brandon\Documents\javascript-sdk-template
    2013-10-20 15:35 - 2013-10-20 15:35 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem (1).zip
    2013-10-20 15:33 - 2013-10-20 15:33 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(3).zip
    2013-10-20 15:31 - 2013-10-20 15:31 - 00000000 ____D C:\Users\Brandon\Desktop\Truth is - Copy
    2013-10-20 15:26 - 2013-10-20 15:26 - 00025270 _____ C:\Users\Brandon\Downloads\login_error(1).zip
    2013-10-20 15:03 - 2013-10-20 15:03 - 00000000 ____D C:\Users\Brandon\Documents\Add-in Express
    2013-10-20 14:50 - 2013-10-20 20:45 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar
    2013-10-20 14:50 - 2013-10-20 20:45 - 00000000 ____D C:\Program Files (x86)\AVG SafeGuard toolbar
    2013-10-20 14:50 - 2013-10-20 14:50 - 00003746 _____ C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
    2013-10-20 14:50 - 2013-10-20 14:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\AVG SafeGuard toolbar
    2013-10-19 21:47 - 2013-10-19 21:47 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(2).zip
    2013-10-19 21:37 - 2013-10-19 21:37 - 00045129 _____ C:\Users\Brandon\Downloads\RegistrationForm.zip
    2013-10-19 21:12 - 2013-10-19 21:12 - 00130763 _____ C:\Users\Brandon\Downloads\logintest(1).zip
    2013-10-19 21:10 - 2013-10-19 21:10 - 00018387 _____ C:\Users\Brandon\Downloads\loginsystem(1).zip
    2013-10-19 21:04 - 2013-10-19 21:04 - 00002553 _____ C:\Users\Brandon\Downloads\login_error.zip
    2013-10-19 20:45 - 2013-10-19 20:45 - 00130763 _____ C:\Users\Brandon\Downloads\logintest.zip
    2013-10-19 20:37 - 2013-10-19 20:37 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem.zip
    2013-10-14 19:02 - 2013-10-14 19:04 - 176553561 _____ C:\Users\Brandon\Downloads\6043 - Pokemon - White 2 (v01)(DSi Enhanced) (J).zip
    2013-10-14 13:58 - 2013-10-14 13:59 - 00000000 ____D C:\Program Files (x86)\SpeedFan
    2013-10-14 13:58 - 2013-10-14 13:58 - 00001007 _____ C:\Users\Brandon\Desktop\SpeedFan.lnk
    2013-10-14 13:58 - 2013-10-14 13:58 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo
    2013-10-14 13:57 - 2013-10-14 13:57 - 02143832 _____ C:\Users\Brandon\Downloads\instsf449.exe
    2013-10-11 16:34 - 2013-11-08 11:48 - 00000000 ___RD C:\Users\Brandon\Documents\SkyDrive
    2013-10-11 16:26 - 2013-10-11 16:34 - 00000000 ___RD C:\Users\Brandon\SkyDrive
    2013-10-11 16:26 - 2013-10-11 16:26 - 00002164 _____ C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
    2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
    2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
    2013-10-11 16:26 - 2013-10-11 16:26 - 00000000 ____D C:\Program Files (x86)\Microsoft SkyDrive
    2013-10-11 16:26 - 2013-10-11 16:25 - 06040688 _____ (Microsoft Corporation) C:\Users\Brandon\Downloads\SkyDriveSetup.exe
    2013-10-11 16:25 - 2013-10-11 16:25 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
    2013-10-11 12:17 - 2013-10-11 12:17 - 00000065 _____ C:\Users\Brandon\Documents\PWOOptions.ini
    2013-10-11 11:57 - 2013-10-11 11:58 - 33405439 _____ C:\Users\Brandon\Downloads\PWO181.zip

    ==================== One Month Modified Files and Folders =======

    2013-11-10 20:24 - 2013-04-28 13:42 - 00000000 ____D C:\Users\Brandon\stuff
    2013-11-10 20:23 - 2013-11-10 20:23 - 00000000 ____D C:\Users\Brandon\Desktop\Torrent Data
    2013-11-10 20:23 - 2012-12-06 11:56 - 00000000 ____D C:\Users\Brandon
    2013-11-10 20:21 - 2009-07-13 21:34 - 00000438 _____ C:\Windows\win.ini
    2013-11-10 20:14 - 2013-11-10 20:14 - 01957590 _____ (Farbar) C:\Users\Brandon\Desktop\FRST64.exe
    2013-11-10 20:14 - 2013-11-10 20:14 - 00000000 ____D C:\FRST
    2013-11-10 20:00 - 2012-10-09 17:14 - 01581865 _____ C:\Windows\WindowsUpdate.log
    2013-11-10 19:48 - 2013-04-01 15:14 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA.job
    2013-11-10 19:30 - 2013-02-18 13:22 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2013-11-10 19:29 - 2013-09-19 17:11 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
    2013-11-10 18:32 - 2012-12-09 12:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\CrashDumps
    2013-11-10 16:48 - 2013-04-01 15:14 - 00000864 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core.job
    2013-11-10 16:35 - 2013-11-03 11:17 - 00000000 ____D C:\Users\Brandon\.VirtualBox
    2013-11-10 12:02 - 2013-04-12 18:25 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\.minecraft
    2013-11-10 01:39 - 2013-02-18 13:22 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2013-11-09 00:49 - 2012-12-06 12:19 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Mozilla
    2013-11-08 20:13 - 2013-06-07 19:29 - 00003198 _____ C:\Windows\System32\Tasks\HPCeeScheduleForBrandon
    2013-11-08 20:13 - 2013-06-07 19:29 - 00000340 _____ C:\Windows\Tasks\HPCeeScheduleForBrandon.job
    2013-11-08 20:13 - 2013-04-05 19:14 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
    2013-11-08 20:13 - 2012-12-06 21:47 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
    2013-11-08 18:43 - 2013-11-08 18:20 - 00000053 _____ C:\Users\Brandon\Desktop\VGD.txt
    2013-11-08 17:20 - 2012-12-06 11:56 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F38B13B5-4481-4906-A8A1-35CBF3A4D70B}
    2013-11-08 11:54 - 2009-07-13 23:45 - 00031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2013-11-08 11:54 - 2009-07-13 23:45 - 00031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2013-11-08 11:53 - 2009-07-14 00:13 - 00779724 _____ C:\Windows\system32\PerfStringBackup.INI
    2013-11-08 11:48 - 2013-10-11 16:34 - 00000000 ___RD C:\Users\Brandon\Documents\SkyDrive
    2013-11-08 11:48 - 2012-12-15 22:38 - 00000000 ____D C:\Program Files (x86)\Steam
    2013-11-08 11:47 - 2013-11-08 11:47 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
    2013-11-08 11:47 - 2012-10-09 14:48 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys
    2013-11-08 11:47 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2013-11-08 11:47 - 2009-07-13 23:51 - 00057233 _____ C:\Windows\setupact.log
    2013-11-08 11:46 - 2012-12-06 12:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
    2013-11-08 11:46 - 2010-11-20 22:47 - 00700692 _____ C:\Windows\PFRO.log
    2013-11-08 11:45 - 2013-04-01 22:44 - 00000000 ____D C:\Program Files (x86)\Deal Spy
    2013-11-07 22:54 - 2013-11-07 22:54 - 00975932 _____ C:\Users\Brandon\Downloads\AMIDST-3.4.exe
    2013-11-06 10:00 - 2013-11-06 10:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
    2013-11-05 16:26 - 2013-11-05 16:26 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Brandon\Downloads\mbam-setup-1.75.0.1300.exe
    2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Malwarebytes
    2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-11-03 21:07 - 2013-01-02 13:42 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\FileZilla
    2013-11-03 18:54 - 2013-04-28 13:42 - 00000000 ____D C:\Users\Brandon\.frostwire5
    2013-11-03 17:39 - 2013-11-03 14:43 - 00000000 ____D C:\Users\Brandon\Desktop\export2
    2013-11-03 17:39 - 2013-11-02 20:21 - 00000000 ____D C:\Users\Brandon\Desktop\backup
    2013-11-03 14:38 - 2013-11-02 20:45 - 00000000 ____D C:\Users\Brandon\Desktop\export
    2013-11-03 12:43 - 2013-11-03 12:34 - 704643072 _____ C:\Users\Brandon\Desktop\ubuntu-13.10-server-amd64.iso
    2013-11-03 12:32 - 2013-11-03 11:18 - 00000000 ____D C:\Users\Brandon\VirtualBox VMs
    2013-11-03 11:16 - 2013-11-03 11:16 - 00001076 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
    2013-11-03 11:16 - 2013-11-03 11:16 - 00000000 ____D C:\Program Files\Oracle
    2013-11-03 11:15 - 2013-11-03 11:14 - 106230544 _____ (Oracle Corporation) C:\Users\Brandon\Downloads\VirtualBox-4.3.2-90405-Win.exe
    2013-11-03 11:15 - 2013-10-02 23:19 - 00000000 ____D C:\Users\Brandon\Downloads\Windows Server 2008 R2 Standard, Enterprise, Datacenter, and Web (x64) - DVD (English)
    2013-11-03 08:59 - 2013-11-03 08:59 - 00000018 _____ C:\Users\Brandon\Desktop\New Text Document.txt
    2013-11-02 20:12 - 2013-11-02 16:08 - 00000000 ____D C:\Users\Brandon\Desktop\MultiplayerTechTest
    2013-11-02 19:54 - 2013-11-02 19:53 - 00000000 ____D C:\wamp
    2013-11-02 19:40 - 2013-11-02 19:40 - 00001639 _____ C:\Users\Brandon\Desktop\register.php
    2013-11-02 19:39 - 2013-11-02 19:39 - 00000000 _____ C:\Users\Brandon\Desktop\default_position.php
    2013-11-02 19:14 - 2013-11-02 19:13 - 40603386 _____ (Hervé Leclerc (HeL)                                         ) C:\Users\Brandon\Downloads\Wampserver2.4-x64(1).exe
    2013-11-02 17:43 - 2013-03-06 22:53 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
    2013-11-02 17:42 - 2013-11-02 17:42 - 04812567 _____ (Tim Kosse) C:\Users\Brandon\Downloads\FileZilla_3.7.3_win32-setup.exe
    2013-11-02 16:00 - 2013-11-02 14:50 - 00177290 _____ C:\Users\Brandon\Desktop\TEST.capx
    2013-11-02 15:56 - 2013-11-02 14:50 - 00177286 _____ C:\Users\Brandon\Desktop\TEST.capx.backup1
    2013-11-02 14:50 - 2013-11-02 14:42 - 862987318 _____ C:\Users\Brandon\Desktop\TechTest.capx.backup1
    2013-11-02 14:48 - 2013-11-02 14:18 - 00000973 _____ C:\Users\Brandon\Desktop\TechTest.uistate.xml
    2013-11-02 14:18 - 2013-11-02 14:18 - 00003884 _____ C:\Users\Brandon\Desktop\TechTest.caproj
    2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Layouts
    2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Event sheets
    2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Animations
    2013-11-01 15:13 - 2013-11-03 11:16 - 00252688 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
    2013-11-01 15:10 - 2013-11-03 11:16 - 00126736 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
    2013-11-01 15:10 - 2013-11-01 15:10 - 00154896 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
    2013-11-01 15:10 - 2013-11-01 15:10 - 00140560 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
    2013-11-01 15:07 - 2013-11-01 15:07 - 00204048 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
    2013-11-01 10:26 - 2013-11-01 10:26 - 00000000 ____D C:\Users\Brandon\Desktop\rex_date
    2013-10-31 19:58 - 2013-10-07 15:23 - 00000843 _____ C:\Users\Public\Desktop\Construct 2.lnk
    2013-10-31 19:58 - 2012-12-07 20:12 - 00000000 ____D C:\Program Files\Construct 2
    2013-10-31 19:57 - 2013-10-31 19:56 - 128683080 _____ (Scirra                                                      ) C:\Users\Brandon\Downloads\construct2-r148-setup_18543583.exe
    2013-10-31 19:55 - 2013-10-31 19:55 - 00000000 ____D C:\Users\Brandon\Desktop\7_Textbox_addon
    2013-10-31 16:12 - 2013-10-29 09:57 - 00000061 _____ C:\Users\Brandon\Desktop\COLLEGEWORK.txt
    2013-10-30 22:40 - 2013-10-30 22:40 - 02769432 _____ C:\Users\Brandon\Desktop\Ride.3gp.mp4
    2013-10-30 22:29 - 2013-10-30 22:29 - 02803140 _____ C:\Users\Brandon\Desktop\Ride.mp4
    2013-10-30 15:04 - 2013-10-30 15:04 - 01058176 _____ (PassMark Software                                           ) C:\Users\Brandon\Downloads\diskcheckup.exe
    2013-10-30 15:04 - 2013-10-30 15:04 - 00000000 ____D C:\Program Files (x86)\DiskCheckup
    2013-10-30 12:17 - 2013-10-30 12:17 - 04668633 _____ C:\Users\Brandon\Downloads\p95v279.win64.zip
    2013-10-30 12:16 - 2013-10-30 12:16 - 00425667 _____ C:\Users\Brandon\Downloads\memtest86-iso.zip
    2013-10-29 21:15 - 2013-08-27 13:39 - 00000000 ____D C:\Users\Brandon\Desktop\New folder (2)
    2013-10-28 22:47 - 2012-12-06 11:56 - 00000000 ____D C:\Users\Brandon\AppData\Local\VirtualStore
    2013-10-28 22:46 - 2013-10-23 16:34 - 00000000 ____D C:\Users\Brandon\Documents\javascript-sdk-template
    2013-10-28 22:46 - 2013-09-15 21:15 - 00000000 ____D C:\Users\Brandon\Desktop\osx
    2013-10-28 22:46 - 2012-12-06 14:23 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\SoftGrid Client
    2013-10-28 22:46 - 2012-12-06 12:18 - 00000000 ____D C:\.jagex_cache_32
    2013-10-28 22:46 - 2012-12-06 11:57 - 00000000 ____D C:\Users\Brandon\AppData\Local\Hewlett-Packard
    2013-10-28 22:46 - 2012-10-09 14:54 - 00000000 ____D C:\ProgramData\Norton
    2013-10-28 22:46 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
    2013-10-28 22:46 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\AppCompat
    2013-10-28 22:45 - 2012-12-06 14:28 - 00000000 __RHD C:\MSOCache
    2013-10-20 20:45 - 2013-10-20 14:50 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar
    2013-10-20 20:45 - 2013-10-20 14:50 - 00000000 ____D C:\Program Files (x86)\AVG SafeGuard toolbar
    2013-10-20 15:35 - 2013-10-20 15:35 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem (1).zip
    2013-10-20 15:33 - 2013-10-20 15:33 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(3).zip
    2013-10-20 15:31 - 2013-10-20 15:31 - 00000000 ____D C:\Users\Brandon\Desktop\Truth is - Copy
    2013-10-20 15:26 - 2013-10-20 15:26 - 00025270 _____ C:\Users\Brandon\Downloads\login_error(1).zip
    2013-10-20 15:03 - 2013-10-20 15:03 - 00000000 ____D C:\Users\Brandon\Documents\Add-in Express
    2013-10-20 14:50 - 2013-10-20 14:50 - 00003746 _____ C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
    2013-10-20 14:50 - 2013-10-20 14:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\AVG SafeGuard toolbar
    2013-10-19 21:47 - 2013-10-19 21:47 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(2).zip
    2013-10-19 21:37 - 2013-10-19 21:37 - 00045129 _____ C:\Users\Brandon\Downloads\RegistrationForm.zip
    2013-10-19 21:12 - 2013-10-19 21:12 - 00130763 _____ C:\Users\Brandon\Downloads\logintest(1).zip
    2013-10-19 21:10 - 2013-10-19 21:10 - 00018387 _____ C:\Users\Brandon\Downloads\loginsystem(1).zip
    2013-10-19 21:04 - 2013-10-19 21:04 - 00002553 _____ C:\Users\Brandon\Downloads\login_error.zip
    2013-10-19 20:45 - 2013-10-19 20:45 - 00130763 _____ C:\Users\Brandon\Downloads\logintest.zip
    2013-10-19 20:37 - 2013-10-19 20:37 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem.zip
    2013-10-19 20:26 - 2012-12-06 12:18 - 00000024 _____ C:\Users\Brandon\random.dat
    2013-10-19 18:46 - 2012-12-06 12:18 - 00000024 _____ C:\Users\Brandon\jagexappletviewer.preferences
    2013-10-19 18:45 - 2012-12-06 12:18 - 00000046 _____ C:\Users\Brandon\jagex_cl_runescape_LIVE.dat
    2013-10-14 21:45 - 2013-01-27 18:16 - 00002004 ____H C:\Users\Brandon\Documents\Default.rdp
    2013-10-14 19:04 - 2013-10-14 19:02 - 176553561 _____ C:\Users\Brandon\Downloads\6043 - Pokemon - White 2 (v01)(DSi Enhanced) (J).zip
    2013-10-14 13:59 - 2013-10-14 13:58 - 00000000 ____D C:\Program Files (x86)\SpeedFan
    2013-10-14 13:58 - 2013-10-14 13:58 - 00001007 _____ C:\Users\Brandon\Desktop\SpeedFan.lnk
    2013-10-14 13:58 - 2013-10-14 13:58 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo
    2013-10-14 13:57 - 2013-10-14 13:57 - 02143832 _____ C:\Users\Brandon\Downloads\instsf449.exe
    2013-10-12 00:39 - 2013-01-02 12:20 - 00000000 ____D C:\Users\Brandon\.gimp-2.8
    2013-10-11 16:34 - 2013-10-11 16:26 - 00000000 ___RD C:\Users\Brandon\SkyDrive
    2013-10-11 16:26 - 2013-10-11 16:26 - 00002164 _____ C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
    2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
    2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
    2013-10-11 16:26 - 2013-10-11 16:26 - 00000000 ____D C:\Program Files (x86)\Microsoft SkyDrive
    2013-10-11 16:25 - 2013-10-11 16:26 - 06040688 _____ (Microsoft Corporation) C:\Users\Brandon\Downloads\SkyDriveSetup.exe
    2013-10-11 16:25 - 2013-10-11 16:25 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
    2013-10-11 12:17 - 2013-10-11 12:17 - 00000065 _____ C:\Users\Brandon\Documents\PWOOptions.ini
    2013-10-11 11:58 - 2013-10-11 11:57 - 33405439 _____ C:\Users\Brandon\Downloads\PWO181.zip

    Files to move or delete:
    ====================
    C:\Users\Brandon\AppData\Roaming\Camdata.ini
    C:\Users\Brandon\AppData\Roaming\CamLayout.ini
    C:\Users\Brandon\AppData\Roaming\CamShapes.ini
    C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat
    C:\Users\Brandon\jagex_cl_runescape_LIVE.dat
    C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat
    C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat
    C:\Users\Brandon\random.dat


    ==================== Bamital & volsnap Check =================

    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


    LastRegBack: 2013-11-10 04:16

    ==================== End Of Log ============================

     

     

    Addition.txt:

     

     

    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2013 01
    Ran by Brandon at 2013-11-10 20:26:08
    Running from C:\Users\Brandon\Desktop
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    AV: Norton 360 (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
    AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: Norton 360 (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
    FW: Norton 360 (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

    ==================== Installed Programs ======================

    64 Bit HP CIO Components Installer (Version: 7.2.4)
    7-Zip 9.22beta (x32)
    Adobe AIR (x32 Version: 2.6.0.19140)
    Adobe Community Help (x32 Version: 3.5.23)
    Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
    Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
    Adobe Reader X (10.1.2) MUI (x32 Version: 10.1.2)
    Adobe Shockwave Player 11.6 (x32 Version: 11.6.3.633)
    Age of Empires III (x32 Version: 1.00.0000)
    AIO_Scan (x32 Version: 130.0.365.000)
    AMD Accelerated Video Transcoding (Version: 2.00.0002)
    AMD APP SDK Runtime (Version: 10.0.898.1)
    AMD Catalyst Install Manager (Version: 3.0.868.0)
    Apple Application Support (x32 Version: 2.3.2)
    Apple Mobile Device Support (Version: 6.0.1.3)
    Apple Software Update (x32 Version: 2.1.3.127)
    Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.12.13)
    Audacity 2.0.3 (x32 Version: 2.0.3)
    BioShock Infinite (x32)
    Bonjour (Version: 3.0.0.10)
    BufferChm (x32 Version: 140.0.212.000)
    C310 (x32 Version: 140.0.304.000)
    C4200 (x32 Version: 130.0.365.000)
    c4200_Help (x32 Version: 82.0.210.000)
    CamStudio version 2.7 (x32 Version: 2.7)
    Catalyst Control Center - Branding (x32 Version: 1.00.0000)
    Catalyst Control Center (x32 Version: 2012.0326.310.3601)
    Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0326.310.3601)
    Catalyst Control Center InstallProxy (x32 Version: 2012.0326.310.3601)
    Catalyst Control Center Localization All (x32 Version: 2012.0326.310.3601)
    Catalyst Control Center Profiles Mobile (x32 Version: 2012.0326.310.3601)
    CCC Help Chinese Standard (x32 Version: 2012.0326.0309.3601)
    CCC Help Chinese Traditional (x32 Version: 2012.0326.0309.3601)
    CCC Help Czech (x32 Version: 2012.0326.0309.3601)
    CCC Help Danish (x32 Version: 2012.0326.0309.3601)
    CCC Help Dutch (x32 Version: 2012.0326.0309.3601)
    CCC Help English (x32 Version: 2012.0326.0309.3601)
    CCC Help Finnish (x32 Version: 2012.0326.0309.3601)
    CCC Help French (x32 Version: 2012.0326.0309.3601)
    CCC Help German (x32 Version: 2012.0326.0309.3601)
    CCC Help Greek (x32 Version: 2012.0326.0309.3601)
    CCC Help Hungarian (x32 Version: 2012.0326.0309.3601)
    CCC Help Italian (x32 Version: 2012.0326.0309.3601)
    CCC Help Japanese (x32 Version: 2012.0326.0309.3601)
    CCC Help Korean (x32 Version: 2012.0326.0309.3601)
    CCC Help Norwegian (x32 Version: 2012.0326.0309.3601)
    CCC Help Polish (x32 Version: 2012.0326.0309.3601)
    CCC Help Portuguese (x32 Version: 2012.0326.0309.3601)
    CCC Help Russian (x32 Version: 2012.0326.0309.3601)
    CCC Help Spanish (x32 Version: 2012.0326.0309.3601)
    CCC Help Swedish (x32 Version: 2012.0326.0309.3601)
    CCC Help Thai (x32 Version: 2012.0326.0309.3601)
    CCC Help Turkish (x32 Version: 2012.0326.0309.3601)
    ccc-utility64 (Version: 2012.0326.310.3601)
    Chivalry: Medieval Warfare (x32)
    Cisco Connect (x32 Version: 1.4.12284.0)
    Construct 2 r148 (Version: 1.0.148.0)
    Copy (x32 Version: 130.0.428.000)
    Counter-Strike: Global Offensive (x32)
    Coupon Printer for Windows (x32 Version: 5.0.0.0)
    CyberLink PowerDVD (x32 Version: 10.0.5.3817)
    CyberLink YouCam (x32 Version: 3.5.3.5018)
    D3DX10 (x32 Version: 15.4.2368.0902)
    Deal Spy (x32 Version: 1.26.153.1)
    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
    Destinations (x32 Version: 140.0.77.000)
    DeviceDiscovery (x32 Version: 140.0.212.000)
    DiskCheckup v3.1 (x32 Version: 3.1.1007)
    DocProc (x32 Version: 13.0.0.0)
    Empires Dawn of the Modern World (x32)
    ESU for Microsoft Windows 7 SP1 (x32 Version: 5.1.4)
    FileZilla Client 3.7.3 (x32 Version: 3.7.3)
    Free RAR Extract Frog (x32 Version: 4.70)
    GameSpy Arcade (x32)
    GIMP 2.8.2 (Version: 2.8.2)
    Google Chrome (x32 Version: 30.0.1599.101)
    Google Talk Plugin (x32 Version: 4.9.1.16010)
    Google Update Helper (x32 Version: 1.3.21.165)
    GPBaseService2 (x32 Version: 140.0.211.000)
    Grand Theft Auto (x32)
    Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
    HP 3D DriveGuard (Version: 4.1.12.1)
    HP CoolSense (x32 Version: 2.10.3)
    HP Customer Experience Enhancements (x32 Version: 6.0.1.8)
    HP Customer Participation Program 14.0 (Version: 14.0)
    HP Documentation (x32 Version: 1.1.0.0)
    HP Imaging Device Functions 14.0 (Version: 14.0)
    HP Launch Box (Version: 1.1.5)
    HP On Screen Display (x32 Version: 1.3.5)
    HP Photo Creations (x32 Version: 1.0.0.2024)
    HP Photosmart C4200 All-In-One Driver Software 13.0 Rel. 1 (Version: 13.0)
    HP Photosmart Essential 3.5 (Version: 3.5)
    HP Photosmart Prem C310 All-In-One Driver Software 14.0 Rel. 7 (Version: 14.0)
    HP Power Manager (x32 Version: 1.4.8)
    HP Product Detection (x32 Version: 11.14.0004)
    HP Proximity Sensor Utility (x32 Version: 1.0.19)
    HP Quick Launch (x32 Version: 2.7.2)
    HP Recovery Manager (x32 Version: 2.0.0)
    HP Setup (x32 Version: 8.7.4751.3798)
    HP Smart Web Printing 4.60 (Version: 4.60)
    HP Software Framework (x32 Version: 4.5.6.1)
    HP Solution Center 14.0 (Version: 14.0)
    HP Support Assistant (x32 Version: 7.0.39.15)
    HP Update (x32 Version: 5.002.002.002)
    HP Wireless Audio Manager 1.1.4 (x32 Version: 1.1.4)
    HPAppStudio (x32 Version: 140.0.95.000)
    HPPhotoGadget (x32 Version: 140.0.524.000)
    HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000)
    HPPhotosmartEssential (x32 Version: 2.04.0000)
    HPProductAssistant (x32 Version: 140.0.212.000)
    HPSSupply (x32 Version: 140.0.211.000)
    IDT Audio (x32 Version: 1.0.6381.0)
    Inkscape 0.48.4 (x32 Version: 0.48.4)
    Intel PROSet Wireless
    Intel® Control Center (x32 Version: 1.2.1.1007)
    Intel® Display Audio Driver (x32 Version: 6.14.00.3090)
    Intel® Management Engine Components (x32 Version: 8.0.0.1351)
    Intel® PROSet/Wireless for Bluetooth® + High Speed (Version: 15.1.0.0096)
    Intel® PROSet/Wireless Software for Bluetooth® Technology (Version: 2.1.0.0140)
    Intel® Rapid Storage Technology (x32 Version: 11.0.0.1032)
    Intel® Smart Connect Technology 2.0 x64 (Version: 2.0.1083.0)
    Intel® Turbo Boost Technology Monitor 2.6 (Version: 2.6.2.0)
    Intel® USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.225)
    Intel® WiDi (x32 Version: 3.0.13.0)
    Intel® Wireless Display
    Intel® Hardware Accelerated Execution Manager (Version: 1.0.1)
    Intel® PROSet/Wireless WiFi Software (Version: 15.01.0500.0903)
    Intel® Trusted Connect Service Client (Version: 1.23.216.0)
    ISO to USB (x32)
    iTunes (Version: 11.0.0.163)
    Java 7 Update 25 (x32 Version: 7.0.250)
    Java 7 Update 6 (64-bit) (Version: 7.0.60)
    Java Auto Updater (x32 Version: 2.1.9.5)
    Left 4 Dead 2 (x32)
    Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300)
    MarketResearch (x32 Version: 140.0.212.000)
    Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
    Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
    Microsoft Access 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Application Error Reporting (Version: 12.0.6015.5000)
    Microsoft Default Manager (x32 Version: 2.1.54.0)
    Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
    Microsoft Office 2010 Language Pack Service Pack 1 (SP1) (x32)
    Microsoft Office 2010 Service Pack 1 (SP1) (x32)
    Microsoft Office Access 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000)
    Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000)
    Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
    Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000)
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000)
    Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Starter 2010 - English (x32 Version: 14.0.5139.5005)
    Microsoft Office Visio 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Visio MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Rise Of Nations (x32)
    Microsoft Search Enhancement Pack (x32 Version: 3.0.126.0)
    Microsoft Silverlight (Version: 5.1.20913.0)
    Microsoft SkyDrive (HKCU Version: 17.0.2015.0811)
    Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
    Microsoft Visio 2010 Service Pack 1 (SP1) (x32)
    Microsoft Visio Professional 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
    Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
    Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
    Microsoft Visual Studio 6.0 Professional Edition (x32)
    Microsoft Web Publishing Wizard 1.53 (x32)
    Movie Maker (x32 Version: 16.4.3505.0912)
    Mozilla Firefox 25.0 (x86 en-US) (x32 Version: 25.0)
    Mozilla Maintenance Service (x32 Version: 25.0)
    MSN Toolbar (x32 Version: 4.0.0357.1)
    MSN Toolbar Platform (x32 Version: 4.0.0357.1)
    MSVCRT (x32 Version: 15.4.2862.0708)
    MSVCRT110 (x32 Version: 16.4.1108.0727)
    MSVCRT110_amd64 (Version: 16.4.1109.0912)
    MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
    MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
    MSXML4 Parser (x32 Version: 1.0.0)
    MX Simulator Demo (x32)
    Network64 (Version: 140.0.215.000)
    NOOK Study (x32 Version: 2.1.2.28770)
    Norton 360 (x32 Version: 20.4.0.40)
    Notepad++ (x32 Version: 6.2.2)
    OCR Software by I.R.I.S. 13.0 (Version: 13.0)
    Opera Mobile Emulator (x32)
    Oracle VM VirtualBox 4.3.2 (Version: 4.3.2)
    Paint.NET v3.5.10 (Version: 3.60.0)
    Photo Gallery (x32 Version: 16.4.3505.0912)
    Power2Go (x32 Version: 6.1.6224)
    Project64 1.6 (x32 Version: 1.6)
    PS_AIO_07_C310_SW_Min (x32 Version: 140.0.304.000)
    PS_AIO_Software_min (x32 Version: 130.0.365.000)
    PX Profile Update (x32 Version: 1.00.1.)
    QuickTransfer (x32 Version: 140.0.98.000)
    Realtek PCIE Card Reader (x32 Version: 6.1.7601.29011)
    RuneScape Launcher 1.2.3 (x32 Version: 1.2.3)
    S3D Web Player (Version: 1.8.0.1)
    Scan (x32 Version: 140.0.80.000)
    Secure Download Manager (x32 Version: 3.1.10)
    SecureW2 Enterprise Client 3.5.7 (x32)
    Shop for HP Supplies (Version: 14.0)
    SketchUp 8 (x32 Version: 3.0.16846)
    Skype™ 6.7 (x32 Version: 6.7.102)
    SmartWebPrinting (x32 Version: 140.0.186.000)
    SolutionCenter (x32 Version: 140.0.214.000)
    SpeedFan (remove only) (x32)
    SSH Secure Shell (x32)
    Status (x32 Version: 140.0.256.000)
    Steam (x32 Version: 1.0.0.0)
    swMSM (x32 Version: 12.0.0.1)
    Synaptics Pointing Device Driver (Version: 16.0.1.0)
    Team Fortress 2 (x32)
    TheHunt  (x32 Version: TheHunt)
    Toolbox (x32 Version: 140.0.428.000)
    TrayApp (x32 Version: 140.0.212.000)
    Unity Web Player (HKCU Version: )
    UnloadSupport (x32 Version: 11.0.0)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
    Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
    Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
    Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2566458) (x32)
    Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
    Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
    Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
    WampServer 2.4 (x32)
    WebReg (x32 Version: 140.0.212.017)
    Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
    Windows Live Essentials (x32 Version: 16.4.3505.0912)
    Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
    Windows Live Installer (x32 Version: 16.4.3505.0912)
    Windows Live Photo Common (x32 Version: 16.4.3505.0912)
    Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
    Windows Live SOXE (x32 Version: 16.4.3505.0912)
    Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
    Windows Live UX Platform (x32 Version: 16.4.3505.0912)
    Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)

    ==================== Restore Points  =========================

    17-10-2013 10:20:11 Scheduled Checkpoint
    20-10-2013 20:02:44 Removed WinZip 17.5
    21-10-2013 01:43:02 Restore Operation
    21-10-2013 02:45:51 HOTLLAMA Media Player Installation
    29-10-2013 03:42:01 Restore Operation
    03-11-2013 16:16:04 Installed Oracle VM VirtualBox 4.3.2
    11-11-2013 01:21:36 Removed Microsoft Device Emulator (64 bit) version 3.0 - ENU

    ==================== Hosts content: ==========================

    2009-07-13 21:34 - 2013-11-02 19:54 - 00000986 ____A C:\Windows\system32\Drivers\etc\hosts
    127.0.0.1       localhost
    127.0.0.1       localhost
    127.0.0.1       localhost
    127.0.0.1       localhost
    127.0.0.1       localhost
    127.0.0.1       localhost


    ==================== Scheduled Tasks (whitelisted) =============

    Task: {11A89BD3-98EC-4CC7-A45C-94281112FD8F} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Cyberlink\YouCam\YCMMirage.exe [2012-02-21] (CyberLink)
    Task: {2189B92C-2E1B-4B40-99DD-A36E670F2334} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\wscstub.exe [2013-06-03] (Symantec Corporation)
    Task: {336628F0-5EC6-4B35-9AEE-CB9C10D33C57} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
    Task: {4ADA26AE-C183-43D8-8397-A7AA74C9DEDC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)
    Task: {53D42EB3-6919-41A6-84FE-478B5B7B08E8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard)
    Task: {6B62729E-FE48-4BB0-9A9C-B79D6E808767} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation)
    Task: {6C4AE5B8-3192-42F7-B629-ABDE6A9C9408} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation)
    Task: {8D6311F2-6070-4BEB-88DC-D6C89CD7E415} - System32\Tasks\SecureW2 Task => C:\Program Files (x86)\SecureW2\sw2_tray.exe [2012-02-22] (SecureW2 B.V.)
    Task: {91F54832-1A12-4D5A-8EC7-F2C0B685D930} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
    Task: {BA9611FB-6F29-42DE-9D8E-C324967EE4CA} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-27] ()
    Task: {BDD1F95D-D7C0-4159-8531-760290E4C0AB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
    Task: {BFA5D592-7014-4B47-9D82-0FA2F23434EB} - System32\Tasks\HPCeeScheduleForBrandon => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
    Task: {C627FC5B-851F-4F0B-8866-510ED592FF86} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
    Task: {D94F17DB-1C5F-4957-B1A5-E74738BD9288} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
    Task: {E0E8A6F7-2A5C-4EF4-AEE6-4923D85E62B4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
    Task: {F06FF55F-8619-4CE2-BDEA-0F60D3639353} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
    Task: {F6A98AC2-4397-4C9C-9FBE-D5C9326BD33A} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core.job => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA.job => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\HPCeeScheduleForBrandon.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

    ==================== Loaded Modules (whitelisted) =============

    2012-02-09 18:26 - 2012-02-09 18:26 - 00048128 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\NetworkHeuristic.dll
    2012-02-09 18:26 - 2012-02-09 18:26 - 00036864 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\ISCTNetDetect.dll
    2010-01-02 09:42 - 2010-01-02 09:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
    2012-02-28 02:07 - 2012-02-28 02:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
    2012-02-03 15:33 - 2012-02-03 15:33 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
    2012-03-26 05:03 - 2012-03-26 05:03 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
    2013-11-02 19:53 - 2013-06-23 10:09 - 00131072 _____ () c:\wamp\bin\apache\apache2.4.4\bin\pcre.dll
    2013-11-02 19:53 - 2013-06-23 10:09 - 00131072 _____ () C:\wamp\bin\apache\apache2.4.4\bin\pcre.dll
    2012-11-28 14:13 - 2012-11-28 14:13 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
    2012-11-28 14:13 - 2012-11-28 14:13 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
    2013-08-07 14:25 - 2013-08-07 14:25 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
    2013-06-17 18:39 - 2012-05-30 09:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON 360\ENGINE\20.4.0.40\wincfi39.dll
    2012-02-26 22:39 - 2012-02-26 22:39 - 00025608 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Wireless Audio\CustomControls.dll
    2013-03-12 16:10 - 2013-04-23 21:30 - 00652800 _____ () C:\Program Files (x86)\Steam\SDL2.dll
    2012-12-15 22:39 - 2013-05-03 18:35 - 01114536 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
    2012-12-15 22:39 - 2013-03-26 19:16 - 20341672 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
    2012-12-15 22:39 - 2012-12-11 12:51 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll
    2012-12-15 22:39 - 2012-12-11 12:51 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll
    2012-12-15 22:39 - 2012-12-11 12:51 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll
    2013-08-14 02:32 - 2013-08-14 02:32 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\991a8d378a3e64b31c0f4770ba9ae071\IsdiInterop.ni.dll
    2012-10-09 14:43 - 2011-11-29 22:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
    2012-10-09 14:43 - 2011-12-16 13:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
    2013-11-06 10:00 - 2013-11-06 10:00 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
    2013-10-09 09:29 - 2013-10-09 09:29 - 16233864 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll

    ==================== Alternate Data Streams (whitelisted) =========


    ==================== Safe Mode (whitelisted) ===================


    ==================== Faulty Device Manager Devices =============

    Name: Microsoft Virtual WiFi Miniport Adapter #2
    Description: Microsoft Virtual WiFi Miniport Adapter
    Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
    Manufacturer: Microsoft
    Service: vwifimp
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

    Name: Photosmart Prem C310 series
    Description: Photosmart Prem C310 series
    Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
    Manufacturer: HP
    Service:
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

    Name: Photosmart Prem C310 series
    Description: Photosmart Prem C310 series
    Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
    Manufacturer: HP
    Service: StillCam
    Problem: : This device is disabled. (Code 22)
    Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (11/10/2013 06:32:00 PM) (Source: Application Error) (User: )
    Description: Windows cannot access the file  for one of the following reasons:
    there is a problem with the network connection, the disk that the file is stored on, or the storage
    drivers installed on this computer; or the disk is missing.
    Windows closed the program Protection Stub because of this error.

    Program: Protection Stub
    File:

    The error value is listed in the Additional Data section.
    User Action
    1. Open the file again.
    This situation might be a temporary problem that corrects itself when the program runs again.
    2.
    If the file still cannot be accessed and
        - It is on the network,
    your network administrator should verify that there is not a problem with the network and that the server can be contacted.
        - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
    3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
    4. If the problem persists, restore the file from a backup copy.
    5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
    further assistance.

    Additional Data
    Error value: 00000000
    Disk type: 0

    Error: (11/10/2013 06:32:00 PM) (Source: Application Error) (User: )
    Description: Faulting application name: ins5FD8.tmp, version: 3.0.0.0, time stamp: 0x40daa4fa
    Faulting module name: ins5FD8.tmp, version: 3.0.0.0, time stamp: 0x40daa4fa
    Exception code: 0xc000001d
    Fault offset: 0x00058b94
    Faulting process id: 0x25c8
    Faulting application start time: 0xins5FD8.tmp0
    Faulting application path: ins5FD8.tmp1
    Faulting module path: ins5FD8.tmp2
    Report Id: ins5FD8.tmp3

    Error: (11/10/2013 06:21:36 PM) (Source: Application Error) (User: )
    Description: Faulting application name: Power2Go.exe, version: 6.1.0.6224, time stamp: 0x4d8c05b5
    Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
    Exception code: 0xc0000008
    Fault offset: 0x00082808
    Faulting process id: 0x228c
    Faulting application start time: 0xPower2Go.exe0
    Faulting application path: Power2Go.exe1
    Faulting module path: Power2Go.exe2
    Report Id: Power2Go.exe3

    Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 998

    Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 998

    Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 2012

    Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 2012

    Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (11/09/2013 10:40:45 AM) (Source: Bonjour Service) (User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 1014


    System errors:
    =============
    Error: (11/08/2013 11:46:10 AM) (Source: DCOM) (User: )
    Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

    Error: (11/03/2013 10:51:25 AM) (Source: DCOM) (User: )
    Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

    Error: (11/03/2013 10:27:47 AM) (Source: DCOM) (User: )
    Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

    Error: (11/03/2013 10:16:24 AM) (Source: DCOM) (User: )
    Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

    Error: (11/03/2013 09:59:18 AM) (Source: DCOM) (User: )
    Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

    Error: (11/03/2013 09:23:27 AM) (Source: DCOM) (User: )
    Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

    Error: (11/03/2013 09:15:44 AM) (Source: DCOM) (User: )
    Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

    Error: (11/03/2013 08:59:40 AM) (Source: DCOM) (User: )
    Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

    Error: (11/02/2013 08:30:06 PM) (Source: EventLog) (User: )
    Description: The previous system shutdown at 9:26:38 PM on ‎11/‎2/‎2013 was unexpected.

    Error: (11/02/2013 07:51:05 PM) (Source: Service Control Manager) (User: )
    Description: The wampapache service terminated with service-specific error %%1.


    Microsoft Office Sessions:
    =========================
    Error: (11/10/2013 06:32:00 PM) (Source: Application Error)(User: )
    Description: Protection Stub000000000

    Error: (11/10/2013 06:32:00 PM) (Source: Application Error)(User: )
    Description: ins5FD8.tmp3.0.0.040daa4fains5FD8.tmp3.0.0.040daa4fac000001d00058b9425c801cede6cfe4cce22C:\Users\Brandon\AppData\Local\Temp\ins5FD8.tmpC:\Users\Brandon\AppData\Local\Temp\ins5FD8.tmp4b49016f-4a60-11e3-9362-949ec074d51b

    Error: (11/10/2013 06:21:36 PM) (Source: Application Error)(User: )
    Description: Power2Go.exe6.1.0.62244d8c05b5ntdll.dll6.1.7601.18247521ea8e7c000000800082808228c01cede6b6ae2ec65C:\Program Files (x86)\CyberLink\Power2Go\Power2Go.exeC:\Windows\SysWOW64\ntdll.dlld79ce4ce-4a5e-11e3-9362-949ec074d51b

    Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 998

    Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 998

    Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 2012

    Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledEvent 2012

    Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: Continuously busy for more than a second

    Error: (11/09/2013 10:40:45 AM) (Source: Bonjour Service)(User: )
    Description: Task Scheduling Error: m->NextScheduledSPRetry 1014


    ==================== Memory info ===========================

    Percentage of memory in use: 27%
    Total physical RAM: 16286.36 MB
    Available physical RAM: 11796.82 MB
    Total Pagefile: 32570.89 MB
    Available Pagefile: 27807.62 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.8 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:677.52 GB) (Free:430.31 GB) NTFS ==>[system with boot components (obtained from reading drive)]
    Drive d: (Recovery) (Fixed) (Total:20.82 GB) (Free:2.53 GB) NTFS ==>[system with boot components (obtained from reading drive)]
    Drive e: (AOE III DISC 1) (CDROM) (Total:0.59 GB) (Free:0 GB) CDFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 00815C00)
    Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=678 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=21 GB) - (Type=07 NTFS)
    Partition 4: (Not Active) - (Size=102 MB) - (Type=0C)

    ==================== End Of Log ============================

    Infected with viruses

    in Resolved Malware Removal Logs

    Posted

    Hello! I have reently been infected by a number of viruses. Here is my Malwarebytes log:

     

    I appreciate any help I can get!

     

    -Brandon

     

     

     

     

    Malwarebytes Anti-Malware 1.75.0.1300
    www.malwarebytes.org

    Database version: v2013.11.05.06

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 9.0.8112.16421
    Brandon :: BRANDON-HP [administrator]

    11/5/2013 4:27:30 PM
    MBAM-log-2013-11-05 (17-20-58).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 208765
    Time elapsed: 5 minute(s), 5 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 11
    HKCR\CrossriderApp0026276.BHO (PUP.Optional.CrossRider.A) -> No action taken.
    HKCR\CrossriderApp0026276.BHO.1 (PUP.Optional.CrossRider.A) -> No action taken.
    HKCR\CrossriderApp0026276.Sandbox (PUP.Optional.CrossRider.A) -> No action taken.
    HKCR\CrossriderApp0026276.Sandbox.1 (PUP.Optional.CrossRider.A) -> No action taken.
    HKCU\Software\Cr_Installer\26276 (PUP.Optional.CrossRider.A) -> No action taken.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken.
    HKCR\CLSID\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken.
    HKCR\TypeLib\{44444444-4444-4444-4444-440244624476} (PUP.Optional.CrossRider.M) -> No action taken.
    HKCR\Interface\{55555555-5555-5555-5555-550255625576} (PUP.Optional.CrossRider.M) -> No action taken.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken.

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 2
    C:\Users\Brandon\Downloads\frostwire-5.5.6.windows.exe (PUP.Optional.OpenCandy) -> No action taken.
    C:\Program Files (x86)\Deal Spy\Deal Spy.dll (PUP.Optional.CrossRider.M) -> No action taken.

    (end)
     

    Computer Infected with Numerous Viruses

    in Resolved Malware Removal Logs

    Posted

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Junkware Removal Tool (JRT) by Thisisu

    Version: 4.9.4 (05.06.2013:1)

    OS: Windows 7 Home Premium x64

    Ran by peg on Thu 05/16/2013 at 13:55:56.98

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    ~~~ Services

    ~~~ Registry Values

    ~~~ Registry Keys

    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit

    Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\Software\smartbar

    ~~~ Files

    ~~~ Folders

    Successfully deleted: [Folder] "C:\Users\peg\appdata\local\strongvault online backup"

    Failed to delete: [Folder] "C:\Program Files (x86)\recipehub_2j"

    Failed to delete: [Folder] "C:\Program Files (x86)\strongvault online backup"

    ~~~ FireFox

    Successfully deleted: [Folder] C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\smartbar

    Successfully deleted: [Folder] C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\extensions\staged

    Successfully deleted the following from C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\prefs.js

    user_pref("CT3277370.1000234.weatherData", "{\"icon\":\"34.png\",\"temperature\":\"75°F\",\"temperatureClear\":\"75°F\",\"highTemperature\":\"80°F\",\"lowTemperature\":\"51

    user_pref("CT3277370.embeddedsData", "[{\"appId\":\"130021582164426878\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get

    user_pref("CT3277370.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3277370&octid=CT3277370&SearchSource=15&CUI=UN2743726527155421

    user_pref("CT3277370.search.searchAppId", "130021582164426878");

    user_pref("CT3277370.search.searchCount", "0");

    user_pref("CT3277370.smartbar.CTID", "CT3277370");

    user_pref("CT3277370.smartbar.Uninstall", "0");

    user_pref("CT3277370.smartbar.toolbarName", "InternetHelper3 ");

    user_pref("CT3289847.embeddedsData", "[{\"appId\":\"130068661007799818\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get

    user_pref("CT3289847.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3289847&octid=CT3289847&SearchSource=15&CUI=UN2447261197201281

    user_pref("CT3289847.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fforums.malwarebytes.org%2Findex.php%3Fshowtopic%3D125897\",\"EB_MAIN_FRAME_TITLE\":\"I%20th

    user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://WhiteSmokeNew.OurToolbar.com//xpi\"}");

    user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"WhiteSmoke New\"}");

    user_pref("extensions.crossriderapp19962.19962.backgroundjs", "\n\n//\n");

    user_pref("extensions.crossriderapp19962.19962.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GPL_=function(){_GPL_PLUGIN.started||_GPL_PLUGIN.prepare({pid:1340,baseCDN:

    user_pref("extensions.crossriderapp19962.19962.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefined\"){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==\"undefined

    user_pref("extensions.crossriderapp19962.19962.plugins.plugin_16.code", "if((typeof isBackground===\"undefined\"||isBackground!==true)&&(typeof _firefoxVersion!==\"undefined\"

    user_pref("extensions.crossriderapp19962.19962.plugins.plugin_17.code", "if(typeof window!==\"undefined\"){\n/*!\n * jQuery JavaScript Library v1.4.2\n * hxxp://jquery.com/\n

    user_pref("extensions.crossriderapp19962.19962.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=fun

    user_pref("extensions.crossriderapp19962.19962.plugins.plugin_4.code", "var jQuery = $jquery_171 = $jquery = null;\n\nif (document && typeof document.getElementById !== \"unde

    user_pref("extensions.crossriderapp19962.19962.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPTY_CHANNEL__\";var d=function(j){return(typeof j===\"object\"&&j!==null);}

    user_pref("extensions.crossriderapp19962.19962.plugins.plugin_78.code", "if(typeof jQuery!==\"undefined\"&&(jQuery)&&typeof navigator!==\"undefined\"&&typeof navigator.userAge

    user_pref("extensions.crossriderapp19962.19962.plugins.plugin_98.code", "(function(){var b=\"cr_\"+appAPI.appID+\"internalMessage\";var a=function(){var d=function(g){if(g===t

    user_pref("smartbar.machineId", "UHZACU7OVIWN/S30C/HX5TS0QUERFH6SHSTWCQHOZVZ4Q4JMDZ0QXR3GODXE7PIUYJQYDVWQ46Q9F2STYBDXZW");

    user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");

    user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");

    user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engine=\"hxxp://*google.*\" param=\"q=\" /><EXTERNAL_SEARCH engine=\"hxxp://sear

    user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_whiteList", "{\"search.babylon.com\":\"q\",\"search.imesh.net\":\"q\",\"www.search-results.com\":\"q\",\"home.

    Emptied folder: C:\Users\peg\AppData\Roaming\mozilla\firefox\profiles\w8013kzv.default\minidumps [4 files]

    ~~~ Event Viewer Logs were cleared

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Scan was completed on Thu 05/16/2013 at 14:01:21.19

    End of JRT log

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    Malwarebytes Anti-Malware (Trial) 1.75.0.1300

    www.malwarebytes.org

    Database version: v2013.05.15.11

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 10.0.9200.16540

    peg :: PEG-PC [administrator]

    Protection: Enabled

    5/15/2013 5:20:20 PM

    MBAM-log-2013-05-15 (17-37-01).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 222007

    Time elapsed: 16 minute(s), 20 second(s)

    Memory Processes Detected: 2

    C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 2804 -> No action taken.

    C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 3620 -> No action taken.

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 4

    HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> No action taken.

    HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> No action taken.

    HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> No action taken.

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> No action taken.

    Registry Values Detected: 1

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ctfmon.exe (Trojan.Agent.Gen) -> Data: C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00 -> No action taken.

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 6

    C:\ProgramData\43d3.dat (Trojan.FakeMS) -> No action taken.

    C:\ProgramData\39ri.dat (Trojan.FakeMS) -> No action taken.

    C:\Users\peg\AppData\Local\Temp\ofi3jZF.exe (Trojan.FakeMS) -> No action taken.

    C:\Users\peg\AppData\Local\Temp\DIQ\FlashPlayer_151\software\SupremeSavings.exe (Heuristics.Shuriken) -> No action taken.

    C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> No action taken.

    C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> No action taken.

    (end)

    # AdwCleaner v2.300 - Logfile created 05/16/2013 at 14:54:05

    # Updated 28/04/2013 by Xplode

    # Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

    # User : peg - PEG-PC

    # Boot Mode : Normal

    # Running from : C:\Users\peg\Desktop\adwcleaner.exe

    # Option [search]

    ***** [services] *****

    ***** [Files / Folders] *****

    Folder Found : C:\Program Files\DomaIQ Uninstaller

    Folder Found : C:\Users\peg\AppData\Local\APN

    Folder Found : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihkeoookbpemkdccdccdmacnidhooohk

    Folder Found : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

    Folder Found : C:\Users\peg\AppData\Local\Temp\CT3277370

    Folder Found : C:\Users\peg\AppData\Local\Updater19962

    Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\CT3277370

    Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}

    Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\Smartbar

    Folder Found : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\SweetPacksToolbarData

    ***** [Registry] *****

    Key Found : HKCU\Software\AppDataLow\Software\SmartBar

    Key Found : HKCU\Software\AppDataLow\Software\Supreme Savings

    Key Found : HKCU\Software\Conduit

    Key Found : HKCU\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0}

    Key Found : HKCU\Software\SearchProtect

    Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}

    Key Found : HKLM\Software\Classes\Installer\Features\90C64EA18BA25EE488BF80DCF07F2FFD

    Key Found : HKLM\Software\Classes\Installer\Products\90C64EA18BA25EE488BF80DCF07F2FFD

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{03119103-0854-469D-807A-171568457991}

    Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}

    Key Found : HKLM\Software\GamesBarSetup

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Found : HKLM\Software\SearchProtect

    Key Found : HKLM\Software\Supreme Savings

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{13119113-0854-469D-807A-171568457991}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{33119133-0854-469D-807A-171568457991}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{23119123-0854-469D-807A-171568457991}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{628F3201-34D0-49C0-BB9A-82A26AEFB291}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE}

    Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\DomaIQ Uninstaller

    Key Found : HKLM\SOFTWARE\Classes\Interface\{23119123-0854-469D-807A-171568457991}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}

    Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}

    Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\A28B4D68DEBAA244EB686953B7074FEF

    Key Found : HKLM\SOFTWARE\Tarma Installer

    Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{EEE6C35B-6118-11DC-9C72-001320C79847}]

    Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}]

    ***** [internet Browsers] *****

    -\\ Internet Explorer v10.0.9200.16576

    [OK] Registry is clean.

    -\\ Mozilla Firefox v20.0.1 (en-US)

    File : C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\prefs.js

    Found : user_pref("CT3277370.1000082.isPlayDisplay", "true");

    Found : user_pref("CT3277370.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description[...]

    Found : user_pref("CT3277370.1000234.TWC_TMP_city", "ALLENTOWN");

    Found : user_pref("CT3277370.1000234.TWC_TMP_country", "US");

    Found : user_pref("CT3277370.1000234.TWC_country", "UNITED STATES");

    Found : user_pref("CT3277370.1000234.TWC_locId", "USPA0025");

    Found : user_pref("CT3277370.1000234.TWC_location", "Allentown, PA");

    Found : user_pref("CT3277370.1000234.TWC_region", "US");

    Found : user_pref("CT3277370.1000234.TWC_temp_dis", "f");

    Found : user_pref("CT3277370.1000234.TWC_wind_dis", "mph");

    Found : user_pref("CT3277370.1000234.weatherData", "{\"icon\":\"34.png\",\"temperature\":\"79°F\",\"temperat[...]

    Found : user_pref("CT3277370.CT3277370ads1.enc", "JTdCJTIyYWRzJTIyJTNBJTVCJTdCJTIyYWlkJTIyJTNBJTIyNDQ5NzAlMj[...]

    Found : user_pref("CT3277370.CT3277370current_term.enc", "");

    Found : user_pref("CT3277370.CT3277370sdate.enc", "MTY=");

    Found : user_pref("CT3277370.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3277370.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

    Found : user_pref("CT3277370.FF19Solved", "true");

    Found : user_pref("CT3277370.FirstTime", "true");

    Found : user_pref("CT3277370.FirstTimeFF3", "true");

    Found : user_pref("CT3277370.UserID", "UN27437265271554213");

    Found : user_pref("CT3277370.addressBarTakeOverEnabledInHidden", "true");

    Found : user_pref("CT3277370.autoDisableScopes", -1);

    Found : user_pref("CT3277370.browser.search.defaultthis.engineName", "true");

    Found : user_pref("CT3277370.defaultSearch", "true");

    Found : user_pref("CT3277370.embeddedsData", "[{\"appId\":\"130021582164426878\",\"apiPermissions\":{\"cross[...]

    Found : user_pref("CT3277370.enableAlerts", "true");

    Found : user_pref("CT3277370.enableFix404ByUser", "FALSE");

    Found : user_pref("CT3277370.enableSearchFromAddressBar", "true");

    Found : user_pref("CT3277370.firstTimeDialogOpened", "true");

    Found : user_pref("CT3277370.fixPageNotFoundError", "true");

    Found : user_pref("CT3277370.fixPageNotFoundErrorByUser", "true");

    Found : user_pref("CT3277370.fixPageNotFoundErrorInHidden", "true");

    Found : user_pref("CT3277370.fixUrls", true);

    Found : user_pref("CT3277370.hxxp___pinterest_aot_im.isEnabled.enc", "WQ==");

    Found : user_pref("CT3277370.installDate", "21/4/2013 18:47:25");

    Found : user_pref("CT3277370.installId", "stub.exe");

    Found : user_pref("CT3277370.installSessionId", "{2860EC0F-FF88-4E1B-893F-82C19D399F3A}");

    Found : user_pref("CT3277370.installSp", "TRUE");

    Found : user_pref("CT3277370.installUsage", "2013-04-22T02:10:33.3749993+03:00");

    Found : user_pref("CT3277370.installUsageEarly", "2013-04-22T02:10:30.2237589+03:00");

    Found : user_pref("CT3277370.installerVersion", "1.4.1.3");

    Found : user_pref("CT3277370.isCheckedStartAsHidden", true);

    Found : user_pref("CT3277370.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3277370.isFirstTimeToolbarLoading", "false");

    Found : user_pref("CT3277370.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

    Found : user_pref("CT3277370.keyword", "true");

    Found : user_pref("CT3277370.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]

    Found : user_pref("CT3277370.lastVersion", "10.16.1.521");

    Found : user_pref("CT3277370.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

    Found : user_pref("CT3277370.migrateAppsAndComponents", true);

    Found : user_pref("CT3277370.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"\",\"[...]

    Found : user_pref("CT3277370.openThankYouPage", "false");

    Found : user_pref("CT3277370.openUninstallPage", "true");

    Found : user_pref("CT3277370.revertSettingsEnabled", "false");

    Found : user_pref("CT3277370.search.searchAppId", "130021582164426878");

    Found : user_pref("CT3277370.search.searchCount", "0");

    Found : user_pref("CT3277370.searchFromAddressBarEnabledByUser", "true");

    Found : user_pref("CT3277370.searchInNewTabEnabledByUser", "true");

    Found : user_pref("CT3277370.searchInNewTabEnabledInHidden", "true");

    Found : user_pref("CT3277370.searchRevert", "false");

    Found : user_pref("CT3277370.searchUserMode", "2");

    Found : user_pref("CT3277370.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3277370.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

    Found : user_pref("CT3277370.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

    Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

    Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

    Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

    Found : user_pref("CT3277370.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

    Found : user_pref("CT3277370.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1368652166791");

    Found : user_pref("CT3277370.serviceLayer_services_appsMetadata_lastUpdate", "1368729106334");

    Found : user_pref("CT3277370.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1367897403133");

    Found : user_pref("CT3277370.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1366585829[...]

    Found : user_pref("CT3277370.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1366585833392")[...]

    Found : user_pref("CT3277370.serviceLayer_services_location_lastUpdate", "1368652166571");

    Found : user_pref("CT3277370.serviceLayer_services_login_10.15.2.23_lastUpdate", "1366838100366");

    Found : user_pref("CT3277370.serviceLayer_services_login_10.15.2.523_lastUpdate", "1368233827490");

    Found : user_pref("CT3277370.serviceLayer_services_login_10.16.1.521_lastUpdate", "1368729223368");

    Found : user_pref("CT3277370.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1367897387442");

    Found : user_pref("CT3277370.serviceLayer_services_searchAPI_lastUpdate", "1368652166605");

    Found : user_pref("CT3277370.serviceLayer_services_serviceMap_lastUpdate", "1368652166391");

    Found : user_pref("CT3277370.serviceLayer_services_toolbarContextMenu_lastUpdate", "1367897392177");

    Found : user_pref("CT3277370.serviceLayer_services_toolbarSettings_lastUpdate", "1368729106171");

    Found : user_pref("CT3277370.serviceLayer_services_translation_lastUpdate", "1368652166783");

    Found : user_pref("CT3277370.settingsINI", true);

    Found : user_pref("CT3277370.shouldFirstTimeDialog", "false");

    Found : user_pref("CT3277370.showToolbarPermission", "false");

    Found : user_pref("CT3277370.smartbar.CTID", "CT3277370");

    Found : user_pref("CT3277370.smartbar.Uninstall", "0");

    Found : user_pref("CT3277370.smartbar.toolbarName", "InternetHelper3 ");

    Found : user_pref("CT3277370.startPage", "true");

    Found : user_pref("CT3277370.toolbarBornServerTime", "22-4-2013");

    Found : user_pref("CT3277370.toolbarCurrentServerTime", "16-5-2013");

    Found : user_pref("CT3277370.toolbarLoginClientTime", "Sun Apr 21 2013 19:10:34 GMT-0400 (Eastern Daylight T[...]

    Found : user_pref("CT3277370.versionFromInstaller", "10.15.2.23");

    Found : user_pref("CT3277370_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

    Found : user_pref("CT3289847.1000082.isPlayDisplay", "true");

    Found : user_pref("CT3289847.1000082.state", "{\"state\":\"stopped\",\"text\":\"1.FM (Cou...\",\"description[...]

    Found : user_pref("CT3289847.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3289847.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"tru[...]

    Found : user_pref("CT3289847.FF19Solved", "true");

    Found : user_pref("CT3289847.FirstTime", "true");

    Found : user_pref("CT3289847.FirstTimeFF3", "true");

    Found : user_pref("CT3289847.PG_ENABLE", "dHJ1ZQ==");

    Found : user_pref("CT3289847.PG_ENABLE.enc", "dHJ1ZQ==");

    Found : user_pref("CT3289847.SF_JUST_INSTALLED.enc", "RkFMU0U=");

    Found : user_pref("CT3289847.SF_STATUS.enc", "RU5BQkxFRA==");

    Found : user_pref("CT3289847.SF_USER_ID.enc", "Y2lkXzI4NDIwMTMxMDE2NzUwODU0ODQ=");

    Found : user_pref("CT3289847.UserID", "UN24472611972012819");

    Found : user_pref("CT3289847.addressBarTakeOverEnabledInHidden", "true");

    Found : user_pref("CT3289847.browser.search.defaultthis.engineName", "true");

    Found : user_pref("CT3289847.cb_experience_000.enc", "NA==");

    Found : user_pref("CT3289847.cb_firstuse0100.enc", "MQ==");

    Found : user_pref("CT3289847.cb_user_id_000.enc", "Q0I2Mjc0OTIwNTY4ODVfMTM2ODM5MDQwMTA1M19GaXJlZm94");

    Found : user_pref("CT3289847.cbfirsttime.enc", "U3VuIE1heSAxMiAyMDEzIDE2OjI2OjQxIEdNVC0wNDAwIChFYXN0ZXJuIERh[...]

    Found : user_pref("CT3289847.defaultSearch", "true");

    Found : user_pref("CT3289847.embeddedsData", "[{\"appId\":\"130068661007799818\",\"apiPermissions\":{\"cross[...]

    Found : user_pref("CT3289847.enableAlerts", "true");

    Found : user_pref("CT3289847.enableFix404ByUser", "TRUE");

    Found : user_pref("CT3289847.enableSearchFromAddressBar", "true");

    Found : user_pref("CT3289847.firstTimeDialogOpened", "true");

    Found : user_pref("CT3289847.first_time_search.enc", "MQ==");

    Found : user_pref("CT3289847.fixPageNotFoundError", "true");

    Found : user_pref("CT3289847.fixPageNotFoundErrorByUser", "true");

    Found : user_pref("CT3289847.fixPageNotFoundErrorInHidden", "true");

    Found : user_pref("CT3289847.fixUrls", true);

    Found : user_pref("CT3289847.hxxp___api16_similarsites_com.pid2.enc", "OTllYjk1OWRkZTk5YmFjOQ==");

    Found : user_pref("CT3289847.hxxp___api18_similarsites_com.pid2.enc", "OTllYjk1OWRkZTk5YmFjOQ==");

    Found : user_pref("CT3289847.hxxp___api28_starwebnet_com.pid2.enc", "NzZlOTUzYTMtN2Q5Zi1jY2YzLTcxZTktZDI1ZDV[...]

    Found : user_pref("CT3289847.hxxp___api29_starwebnet_com.pid2.enc", "YmI3MGRlODYtM2Q5Yy1mNDJkLWRjYjYtMWMxYTc[...]

    Found : user_pref("CT3289847.hxxp___api30_starwebnet_com.pid2.enc", "NGYxNTJlNTAtN2M4My1kM2I5LWJlZGMtNWU4YTl[...]

    Found : user_pref("CT3289847.hxxp___api31_starwebnet_com.pid2.enc", "ODMxNzM1MTEtYzNlNS1lODY0LTBjMjQtMmQ1NDg[...]

    Found : user_pref("CT3289847.hxxp___api32_starwebnet_com.pid2.enc", "MWU0NjIyYjgtYWFkOS05MTA5LTU0OTUtOGZiMDJ[...]

    Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_defaultGui.enc", "eyJndWkiOltdLC[...]

    Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.Affiliate_settings.enc", "eyJpbml0VXJsIjoi[...]

    Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.jw_token.enc", "ZTc3MDExY2UtYmI1MS1lNDA0LT[...]

    Found : user_pref("CT3289847.hxxp___toolbar_jollywallet_com_tlb_2.key_list_id.enc", "MjAxMjA4MDItMDAw");

    Found : user_pref("CT3289847.installDate", "14/4/2013 0:31:48");

    Found : user_pref("CT3289847.installId", "9818");

    Found : user_pref("CT3289847.installerVersion", "1.3.7.3");

    Found : user_pref("CT3289847.isCheckedStartAsHidden", true);

    Found : user_pref("CT3289847.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3289847.isFirstTimeToolbarLoading", "false");

    Found : user_pref("CT3289847.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

    Found : user_pref("CT3289847.keyword", "true");

    Found : user_pref("CT3289847.lastNewTabSettings", "{\"isEnabled\":true,\"newTabUrl\":\"hxxp://search.conduit[...]

    Found : user_pref("CT3289847.lastVersion", "10.15.0.562");

    Found : user_pref("CT3289847.mam_gk_appStateReportTime.enc", "MTM2ODM5MDM0NjMzMA==");

    Found : user_pref("CT3289847.mam_gk_appState_CouponBuddy.enc", "b24=");

    Found : user_pref("CT3289847.mam_gk_appState_PriceGong.enc", "b24=");

    Found : user_pref("CT3289847.mam_gk_appsDefaultEnabled.enc", "bnVsbA==");

    Found : user_pref("CT3289847.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IkNvdXBvbkJ1ZGR5Iiw[...]

    Found : user_pref("CT3289847.mam_gk_currentVersion.enc", "MS40LjQuNg==");

    Found : user_pref("CT3289847.mam_gk_eventsCache.enc", "eyJjMDVhNTk2NS1iM2JkLTQyOTYtOTFjZC01NjNkYzczMDc3YjIiO[...]

    Found : user_pref("CT3289847.mam_gk_first_time.enc", "MQ==");

    Found : user_pref("CT3289847.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");

    Found : user_pref("CT3289847.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

    Found : user_pref("CT3289847.mam_gk_lastLoginTime.enc", "MTM2ODM5MDM0MjMyMw==");

    Found : user_pref("CT3289847.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50[...]

    Found : user_pref("CT3289847.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ==");

    Found : user_pref("CT3289847.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVyd[...]

    Found : user_pref("CT3289847.mam_gk_showCloseButton.enc", "dHJ1ZQ==");

    Found : user_pref("CT3289847.mam_gk_showWelcomeGadget.enc", "ZmFsc2U=");

    Found : user_pref("CT3289847.mam_gk_userId.enc", "YTkxNWMzN2QtNzNhNy00MmNhLTg0NzYtMmNhMWIxMzQxMWZh");

    Found : user_pref("CT3289847.migrateAppsAndComponents", true);

    Found : user_pref("CT3289847.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fforums.malwareby[...]

    Found : user_pref("CT3289847.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}");

    Found : user_pref("CT3289847.openThankYouPage", "false");

    Found : user_pref("CT3289847.openUninstallPage", "true");

    Found : user_pref("CT3289847.price-gong.isManagedApp", "true");

    Found : user_pref("CT3289847.revertSettingsEnabled", "true");

    Found : user_pref("CT3289847.searchFromAddressBarEnabledByUser", "true");

    Found : user_pref("CT3289847.searchInNewTabEnabledByUser", "true");

    Found : user_pref("CT3289847.searchInNewTabEnabledInHidden", "true");

    Found : user_pref("CT3289847.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

    Found : user_pref("CT3289847.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"d[...]

    Found : user_pref("CT3289847.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\[...]

    Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"d[...]

    Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"strin[...]

    Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"strin[...]

    Found : user_pref("CT3289847.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data[...]

    Found : user_pref("CT3289847.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1367779252531");

    Found : user_pref("CT3289847.serviceLayer_services_appsMetadata_lastUpdate", "1368372970736");

    Found : user_pref("CT3289847.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1368372970418");

    Found : user_pref("CT3289847.serviceLayer_services_location_lastUpdate", "1368372983417");

    Found : user_pref("CT3289847.serviceLayer_services_login_10.14.380.14_lastUpdate", "1366065463117");

    Found : user_pref("CT3289847.serviceLayer_services_login_10.15.0.562_lastUpdate", "1368390457264");

    Found : user_pref("CT3289847.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1368372970744");

    Found : user_pref("CT3289847.serviceLayer_services_searchAPI_lastUpdate", "1368372983453");

    Found : user_pref("CT3289847.serviceLayer_services_serviceMap_lastUpdate", "1368372970725");

    Found : user_pref("CT3289847.serviceLayer_services_setupAPI_lastUpdate", "1365939823647");

    Found : user_pref("CT3289847.serviceLayer_services_toolbarContextMenu_lastUpdate", "1368372970199");

    Found : user_pref("CT3289847.serviceLayer_services_toolbarSettings_lastUpdate", "1368390456864");

    Found : user_pref("CT3289847.serviceLayer_services_translation_lastUpdate", "1368372970948");

    Found : user_pref("CT3289847.settingsINI", true);

    Found : user_pref("CT3289847.shouldFirstTimeDialog", "false");

    Found : user_pref("CT3289847.showToolbarPermission", "false");

    Found : user_pref("CT3289847.startPage", "true");

    Found : user_pref("CT3289847.toolbarBornServerTime", "14-4-2013");

    Found : user_pref("CT3289847.toolbarCurrentServerTime", "12-5-2013");

    Found : user_pref("CT3289847.toolbarLoginClientTime", "Mon Apr 15 2013 18:39:13 GMT-0400 (Eastern Daylight T[...]

    Found : user_pref("CT3289847.url_history0001.enc", "aHR0cDovL2NsYXNzaWZpZWRzLnBlbm5zd29vZHMubmV0L2NsYXNzaWZp[...]

    Found : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\"[...]

    Found : user_pref("extensions.asktb.ff-original-keyword-url", "");

    Found : user_pref("extensions.crossriderapp19962.19962.backgroundjs", "\n\n//\n");

    Found : user_pref("extensions.crossriderapp19962.19962.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _[...]

    Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_14.code", "if(typeof(appAPI)===\"undef[...]

    Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_16.code", "if((typeof isBackground===\[...]

    Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_17.code", "if(typeof window!==\"undefi[...]

    Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_22.code", "(function(a){appAPI.queueMa[...]

    Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_4.code", "var jQuery = $jquery_171 = $[...]

    Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_64.code", "(function(){var h=\"__CR_EM[...]

    Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_78.code", "if(typeof jQuery!==\"undefi[...]

    Found : user_pref("extensions.crossriderapp19962.19962.plugins.plugin_98.code", "(function(){var b=\"cr_\"+a[...]

    Found : user_pref("smartbar.machineId", "UHZACU7OVIWN/S30C/HX5TS0QUERFH6SHSTWCQHOZVZ4Q4JMDZ0QXR3GODXE7PIUYJQ[...]

    Found : user_pref("sweetim.toolbar.scripts.0.domain-whitelist", "hxxp://(www.|apps.)?facebook\\.com.*");

    Found : user_pref("sweetim.toolbar.scripts.1.domain-whitelist", "hxxps://(www.|apps.)?facebook\\.com.*");

    Found : user_pref("sweetim.toolbar.search.external", "<?xml version=\"1.0\"?><TOOLBAR><EXTERNAL_SEARCH engin[...]

    Found : user_pref("{C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD}.ScriptData_WSG_whiteList", "{\"search.babylon.com\[...]

    -\\ Google Chrome v26.0.1410.64

    File : C:\Users\peg\AppData\Local\Google\Chrome\User Data\Default\Preferences

    [OK] File is clean.

    *************************

    AdwCleaner[R1].txt - [25279 octets] - [12/05/2013 17:26:52]

    AdwCleaner[R2].txt - [24260 octets] - [16/05/2013 14:34:47]

    AdwCleaner[R3].txt - [24321 octets] - [16/05/2013 14:53:36]

    AdwCleaner[R4].txt - [24265 octets] - [16/05/2013 14:54:05]

    ########## EOF - C:\AdwCleaner[R4].txt - [24326 octets] ##########

    RogueKiller V8.5.4 _x64_ [Mar 18 2013] by Tigzy

    mail : tigzyRK<at>gmail<dot>com

    Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

    Website : http://tigzy.geekstogo.com/roguekiller.php

    Blog : http://tigzyrk.blogspot.com/

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

    Started in : Normal mode

    User : peg [Admin rights]

    Mode : Scan -- Date : 05/16/2013 14:44:43

    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 5 ¤¤¤

    [TASK][sUSP PATH] Updater19962.exe : C:\Users\peg\AppData\Local\Updater19962\Updater19962.exe /extensionid=19962 /extensionname="Supreme Savings" /chromeid=ihkeoookbpemkdccdccdmacnidhooohk [7] -> FOUND

    [HJPOL] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

    [HJPOL] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

    [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

    ¤¤¤ Particular Files / Folders: ¤¤¤

    [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\@ [-] --> FOUND

    [ZeroAccess][FILE] @ : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\@ [-] --> FOUND

    [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\U --> FOUND

    [ZeroAccess][FOLDER] U : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\U --> FOUND

    [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-18\$3c42eb883e76c42fe757e3ec8d556822\L --> FOUND

    [ZeroAccess][FOLDER] L : C:\$recycle.bin\S-1-5-21-1531084523-3685658873-1988755905-1000\$3c42eb883e76c42fe757e3ec8d556822\L --> FOUND

    ¤¤¤ Driver : [NOT LOADED] ¤¤¤

    ¤¤¤ Infection : ZeroAccess ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤

    --> C:\Windows\system32\drivers\etc\hosts

    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: WDC WD3200BPVT-80JJ5T0 +++++

    --- User ---

    [MBR] 2d7d94ba8776bd501073fc5c5b67dc55

    [bSP] 6038da5abdb86a32e945c2c6aa172f56 : Windows 7/8 MBR Code

    Partition table:

    0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 25600 Mo

    1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 52430848 | Size: 122098 Mo

    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 302487552 | Size: 157545 Mo

    User = LL1 ... OK!

    User = LL2 ... OK!

    Finished : << RKreport[1]_S_05162013_02d1444.txt >>

    RKreport[1]_S_05162013_02d1444.txt

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2012-11-20.01)

    .

    Microsoft Windows 7 Home Premium

    Boot Device: \Device\HarddiskVolume2

    Install Date: 1/17/2012 2:14:02 AM

    System Uptime: 5/16/2013 2:26:51 PM (0 hours ago)

    .

    Motherboard: ASUSTeK Computer Inc. | | K54C

    Processor: Intel® Core i3-2350M CPU @ 2.30GHz | CPU 1 | 2300/100mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 119 GiB total, 76.408 GiB free.

    D: is FIXED (NTFS) - 154 GiB total, 153.759 GiB free.

    E: is CDROM ()

    .

    ==== Disabled Device Manager Items =============

    .

    ==== System Restore Points ===================

    .

    RP110: 5/10/2013 5:30:02 PM - Removed Internet Explorer Toolbar 4.7 by SweetPacks

    RP111: 5/10/2013 5:31:13 PM - Removed Internet Explorer Toolbar 4.7 by SweetPacks

    RP112: 5/12/2013 4:27:52 PM - Installed HiJackThis

    RP113: 5/16/2013 10:26:57 AM - Windows Update

    .

    ==== Installed Programs ======================

    .

    ??????? Windows Live Mesh ActiveX ??(????)

    ??????? Windows Live Mesh ActiveX ???

    Adobe Flash Player 11 ActiveX

    Adobe Flash Player 11 Plugin

    Adobe Reader XI (11.0.03)

    Alcor Micro USB Card Reader

    Ask Toolbar

    Ask Toolbar Updater

    Asmedia ASM104x USB 3.0 Host Controller Driver

    ASUS AI Recovery

    ASUS FaceLogon

    ASUS FancyStart

    ASUS LifeFrame3

    ASUS Live Update

    ASUS Power4Gear Hybrid

    ASUS Virtual Camera

    ASUS WebStorage

    ASUS_Screensaver

    AsusVibe2.0

    ATK Package

    Bejeweled 2 Deluxe

    Bing Bar

    Contrôle ActiveX Windows Live Mesh pour connexions à distance

    Control ActiveX de Windows Live Mesh para conexiones remotas

    Controlo ActiveX do Windows Live Mesh para Ligações Remotas

    CyberLink LabelPrint

    CyberLink Media Suite

    CyberLink Power2Go

    D3DX10

    DomaIQ

    Driver Pro v3.0

    Facebook Video Calling 1.2.0.287

    Fast Boot

    Galeria de Fotografias do Windows Live

    Galerie de photos Windows Live

    Galería fotográfica de Windows Live

    Google Chrome

    Google Update Helper

    HiJackThis

    InstantOn for NB

    Intel® Control Center

    Intel® Management Engine Components

    Intel® Processor Graphics

    Java 7 Update 17

    Java Auto Updater

    JavaFX 2.1.1

    Junk Mail filter update

    Malwarebytes Anti-Malware version 1.75.0.1300

    Mesh Runtime

    Microsoft .NET Framework 4 Client Profile

    Microsoft .NET Framework 4 Extended

    Microsoft Application Error Reporting

    Microsoft Office 2010

    Microsoft Office Click-to-Run 2010

    Microsoft Office Starter 2010 - English

    Microsoft Silverlight

    Microsoft SQL Server 2005 Compact Edition [ENU]

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2005 Redistributable (x64)

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    Mozilla Firefox 20.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MSVCRT

    MSVCRT_amd64

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    Norton AntiVirus

    Norton Identity Safe

    Nuance PDF Reader

    Optimizer Pro v3.0

    PC Health Kit v3.2

    Qualcomm Atheros WiFi Driver Installation

    Realtek High Definition Audio Driver

    Recipe Hub toolbar

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)

    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

    Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

    Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

    Sonic Focus

    Strongvault Online Backup

    Synaptics Pointing Device Driver

    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

    Update for Microsoft .NET Framework 4 Extended (KB2468871)

    Update for Microsoft .NET Framework 4 Extended (KB2533523)

    Update for Microsoft .NET Framework 4 Extended (KB2600217)

    VAFPlayer

    Windows Live

    Windows Live ???

    Windows Live ????

    Windows Live Communications Platform

    Windows Live Essentials

    Windows Live Family Safety

    Windows Live ID Sign-in Assistant

    Windows Live Installer

    Windows Live Language Selector

    Windows Live Mail

    Windows Live Mesh

    Windows Live Mesh ActiveX Control for Remote Connections

    Windows Live Messenger

    Windows Live MIME IFilter

    Windows Live Movie Maker

    Windows Live Photo Common

    Windows Live Photo Gallery

    Windows Live PIMT Platform

    Windows Live Remote Client

    Windows Live Remote Client Resources

    Windows Live Remote Service

    Windows Live Remote Service Resources

    Windows Live SOXE

    Windows Live SOXE Definitions

    Windows Live UX Platform

    Windows Live UX Platform Language Pack

    Windows Live Writer

    Windows Live Writer Resources

    WinFlash

    Wireless Console 3

    Yahoo! Software Update

    Yahoo! Toolbar

    .

    ==== Event Viewer Messages From Past Week ========

    .

    5/16/2013 2:29:55 PM, Error: Service Control Manager [7024] - The HomeGroup Listener service terminated with service-specific error %%-2147023143.

    5/16/2013 2:28:27 PM, Error: Service Control Manager [7024] - The Windows Firewall service terminated with service-specific error Access is denied..

    .

    ==== End Of File ===========================

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 10.0.9200.16576 BrowserJavaVersion: 10.17.2

    Run by peg at 14:56:02 on 2013-05-16

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4000.2030 [GMT -4:00]

    .

    AV: Norton AntiVirus *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\system32\FBAgent.exe

    C:\Windows\system32\WLANExt.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe

    C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

    C:\Windows\system32\svchost.exe -k imgsvc

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

    C:\Windows\system32\Dwm.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Windows\Explorer.EXE

    C:\Windows\system32\taskhost.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

    C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

    C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files\ASUS\P4G\BatteryLife.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

    C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

    C:\Windows\System32\igfxtray.exe

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    C:\Windows\System32\igfxpers.exe

    C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

    C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Windows\System32\svchost.exe -k LocalServicePeerNet

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

    C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

    C:\Windows\AsScrPro.exe

    C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

    C:\Windows\system32\SearchIndexer.exe

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Windows\system32\consent.exe

    C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe

    C:\Users\peg\Desktop\RogueKillerX64.exe

    C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://www.yahoo.com/?fr=fp-yie10

    uWindow Title = Windows Internet Explorer provided by Yahoo!

    uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie10

    mStart Page = hxxp://www.google.com

    uProxyOverride = <local>

    uURLSearchHooks: <No Name>: {cc8ae5b8-005b-4b1a-a27d-307eddffe5c8} -

    uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll

    BHO: Toolbar BHO: {06e3475c-5521-4de8-bb12-50720f21631c} -

    BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\IPS\IPSBHO.dll

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: Norton Identity Protection: {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

    BHO: Search Assistant BHO: {b7acdf9c-c4f9-4d5d-998e-b147866b4d4c} -

    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4BF3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -

    TB: Recipe Hub: {cf51de5b-eb36-4114-bb69-84df63fbadb4} -

    TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll

    TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

    uRun: [Facebook Update] "C:\Users\peg\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

    uRun: [backupAgent] C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

    uRun: [Driver Pro] C:\Program Files (x86)\Driver Pro\DPLauncher.exe

    mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"

    mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"

    mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S

    mRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

    mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

    mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

    mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

    mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRun: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe

    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    TCP: NameServer = 192.168.0.1

    TCP: Interfaces\{E4EE1EFE-5953-489B-9C59-8FD50AAFCDA2} : DHCPNameServer = 192.168.0.1

    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    SSODL: WebCheck - <orphaned>

    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

    mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - C:\Windows\System32\rundll32.exe C:\Windows\System32\advpack.dll,LaunchINFSectionEx C:\Program Files (x86)\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12

    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

    x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

    x64-Run: [synAsusAcpi] C:\Program Files (x86)\Synaptics\SynTP\SynAsusAcpi.exe

    x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3

    x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

    x64-Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

    x64-Notify: igfxcui - igfxdev.dll

    x64-SSODL: WebCheck - <orphaned>

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\

    FF - prefs.js: browser.search.selectedEngine - Norton Safe Search

    FF - prefs.js: network.proxy.type - 0

    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

    FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\Users\peg\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

    FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\np-mswmp.dll

    FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\npConduitFirefoxPlugin.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_202.dll

    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

    FF - ExtSQL: 2013-04-21 18:47; {b920380d-fbe7-45c7-96ab-37e9870a566c}; C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}

    FF - ExtSQL: 2013-05-06 21:20; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\IPSFFPlgn

    FF - ExtSQL: 2013-05-06 21:54; {F04D2D30-776C-4d02-8627-8E4385ECA58D}; C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys [2013-5-6 493656]

    R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys [2013-5-6 1139800]

    R1 ATKWMIACPIIO_;ATKWMIACPI Driver_;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-9-7 17536]

    R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\BASHDefs\20130502.001\BHDrvx64.sys [2013-5-7 1390680]

    R1 ccSet_NAV;Norton AntiVirus Settings Manager;C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys [2013-5-6 168096]

    R1 ccSet_NST;Norton Identity Safe Settings Manager;C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys [2013-5-6 168096]

    R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\IPSDefs\20130515.001\IDSviA64.sys [2013-5-15 513184]

    R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys [2013-5-6 224416]

    R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys [2013-5-6 432800]

    R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-12-10 379520]

    R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]

    R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [2012-2-16 277120]

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-5-15 418376]

    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-5-15 701512]

    R2 NAV;Norton AntiVirus;C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe [2013-5-6 144520]

    R2 NCO;Norton Identity Safe;C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe [2013-5-6 144520]

    R2 RecipeHub_2jService;Recipe HubService;C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe [2013-3-16 42504]

    R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

    R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-12-10 2656280]

    R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-11-22 130024]

    R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-11-22 395752]

    R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208]

    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-5-7 138912]

    R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-11-3 317440]

    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-10-17 76912]

    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-5-15 25928]

    R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]

    R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]

    R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]

    R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]

    R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

    S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616]

    S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-10-18 48488]

    S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]

    S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392]

    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-20 1255736]

    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

    .

    =============== Created Last 30 ================

    .

    2013-05-15 21:17:44 -------- d-----w- C:\Users\peg\AppData\Roaming\Malwarebytes

    2013-05-15 21:17:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2013-05-15 21:17:32 -------- d-----w- C:\ProgramData\Malwarebytes

    2013-05-15 21:17:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

    2013-05-12 21:17:30 -------- d-----w- C:\Users\peg\AppData\Local\ Online Backup

    2013-05-12 20:30:28 -------- d-----w- C:\Windows\ERUNT

    2013-05-12 20:30:22 -------- d-----w- C:\JRT

    2013-05-12 20:29:22 388096 ----a-r- C:\Users\peg\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

    2013-05-12 20:29:22 -------- d-----w- C:\Program Files (x86)\Trend Micro

    2013-05-07 21:01:19 -------- d-----w- C:\Users\peg\AppData\Local\NPE

    2013-05-07 01:54:11 168096 ----a-r- C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys

    2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64\7DD03030.013

    2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64

    2013-05-07 01:54:02 -------- d-----w- C:\Program Files (x86)\Norton Identity Safe

    2013-05-07 01:53:55 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

    2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Symantec

    2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Common Files\Symantec Shared

    2013-05-07 01:52:57 432800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys

    2013-05-07 01:52:57 23448 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymELAM.sys

    2013-05-07 01:52:57 1139800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys

    2013-05-07 01:52:56 796248 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtsp64.sys

    2013-05-07 01:52:56 493656 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys

    2013-05-07 01:52:56 36952 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtspx64.sys

    2013-05-07 01:52:56 224416 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys

    2013-05-07 01:52:56 168096 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys

    2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64\1403010.016

    2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64

    2013-05-07 01:52:22 -------- d-----w- C:\Program Files (x86)\Norton AntiVirus

    2013-05-07 01:46:35 -------- d-----w- C:\ProgramData\PCSettings

    2013-05-07 01:22:26 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared

    2013-05-07 01:15:55 -------- d-----w- C:\ProgramData\NortonInstaller

    2013-05-07 01:15:55 -------- d-----w- C:\Program Files (x86)\NortonInstaller

    2013-05-07 00:32:41 -------- d-----w- C:\ProgramData\Norton

    2013-04-23 23:23:34 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

    2013-04-22 23:12:40 -------- d-----w- C:\Windows\pss

    2013-04-21 22:49:21 -------- d-----w- C:\Users\peg\AppData\Roaming\PC Health Kit

    2013-04-21 22:49:17 -------- d-----w- C:\Program Files (x86)\PC Health Kit

    .

    ==================== Find3M ====================

    .

    2013-05-15 23:31:12 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-05-15 23:31:12 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2013-04-13 05:49:23 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

    2013-04-13 05:49:19 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

    2013-04-13 05:49:19 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll

    2013-04-13 05:49:19 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll

    2013-04-13 04:45:16 474624 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

    2013-04-13 04:45:15 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll

    2013-04-11 14:22:56 770384 ----a-w- C:\Windows\SysWow64\msvcr100.dll

    2013-04-11 14:22:56 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll

    2013-04-10 06:01:54 265064 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys

    2013-04-10 06:01:53 983400 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys

    2013-04-10 03:30:50 3153920 ----a-w- C:\Windows\System32\win32k.sys

    2013-04-05 06:52:14 2242048 ----a-w- C:\Windows\System32\wininet.dll

    2013-04-05 06:50:36 3958784 ----a-w- C:\Windows\System32\jscript9.dll

    2013-04-05 06:50:31 67072 ----a-w- C:\Windows\System32\iesetup.dll

    2013-04-05 06:50:31 136704 ----a-w- C:\Windows\System32\iesysprep.dll

    2013-04-05 05:28:24 1767424 ----a-w- C:\Windows\SysWow64\wininet.dll

    2013-04-05 05:26:26 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2013-04-05 05:26:21 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

    2013-04-05 05:26:21 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

    2013-04-05 04:43:00 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

    2013-04-05 04:29:45 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2013-04-05 03:51:11 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

    2013-04-05 03:38:25 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

    2013-03-29 22:57:50 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

    2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

    2013-03-19 05:53:58 48640 ----a-w- C:\Windows\System32\wwanprotdim.dll

    2013-03-19 05:53:58 230400 ----a-w- C:\Windows\System32\wwansvc.dll

    2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll

    2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

    2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

    2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

    2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe

    2013-03-17 17:42:31 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

    2013-03-17 17:42:31 861088 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

    2013-03-17 17:42:31 782240 ----a-w- C:\Windows\SysWow64\deployJava1.dll

    2013-02-27 06:02:44 111448 ----a-w- C:\Windows\System32\consent.exe

    2013-02-27 05:48:00 1930752 ----a-w- C:\Windows\System32\authui.dll

    2013-02-27 05:47:10 70144 ----a-w- C:\Windows\System32\appinfo.dll

    2013-02-27 04:49:24 1796096 ----a-w- C:\Windows\SysWow64\authui.dll

    .

    ============= FINISH: 14:58:05.67 ===============

    Computer Infected with Numerous Viruses

    in Resolved Malware Removal Logs

    Posted

    Thanks for the help!

    Here is DDS Attach:

    .

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

    IF REQUESTED, ZIP IT UP & ATTACH IT

    .

    DDS (Ver_2012-11-20.01)

    .

    Microsoft Windows 7 Home Premium

    Boot Device: \Device\HarddiskVolume2

    Install Date: 1/17/2012 2:14:02 AM

    System Uptime: 5/15/2013 2:03:45 PM (3 hours ago)

    .

    Motherboard: ASUSTeK Computer Inc. | | K54C

    Processor: Intel® Core i3-2350M CPU @ 2.30GHz | CPU 1 | 782/100mhz

    .

    ==== Disk Partitions =========================

    .

    C: is FIXED (NTFS) - 119 GiB total, 75.749 GiB free.

    D: is FIXED (NTFS) - 154 GiB total, 153.759 GiB free.

    E: is CDROM ()

    .

    ==== Disabled Device Manager Items =============

    .

    ==== System Restore Points ===================

    .

    .

    ==== Installed Programs ======================

    .

    ??????? Windows Live Mesh ActiveX ??(????)

    ??????? Windows Live Mesh ActiveX ???

    Adobe Flash Player 11 ActiveX

    Adobe Flash Player 11 Plugin

    Adobe Reader XI (11.0.02)

    Alcor Micro USB Card Reader

    Ask Toolbar

    Ask Toolbar Updater

    Asmedia ASM104x USB 3.0 Host Controller Driver

    ASUS AI Recovery

    ASUS FaceLogon

    ASUS FancyStart

    ASUS LifeFrame3

    ASUS Live Update

    ASUS Power4Gear Hybrid

    ASUS Virtual Camera

    ASUS WebStorage

    ASUS_Screensaver

    AsusVibe2.0

    ATK Package

    Bejeweled 2 Deluxe

    Bing Bar

    Contrôle ActiveX Windows Live Mesh pour connexions à distance

    Control ActiveX de Windows Live Mesh para conexiones remotas

    Controlo ActiveX do Windows Live Mesh para Ligações Remotas

    CyberLink LabelPrint

    CyberLink Media Suite

    CyberLink Power2Go

    D3DX10

    DomaIQ

    Driver Pro v3.0

    Facebook Video Calling 1.2.0.287

    Fast Boot

    Galeria de Fotografias do Windows Live

    Galerie de photos Windows Live

    Galería fotográfica de Windows Live

    Google Chrome

    Google Update Helper

    HiJackThis

    InstantOn for NB

    Intel® Control Center

    Intel® Management Engine Components

    Intel® Processor Graphics

    InternetHelper3 Firefox Toolbar

    Java 7 Update 17

    Java Auto Updater

    JavaFX 2.1.1

    Junk Mail filter update

    Malwarebytes Anti-Malware version 1.75.0.1300

    Mesh Runtime

    Microsoft .NET Framework 4 Client Profile

    Microsoft .NET Framework 4 Extended

    Microsoft Application Error Reporting

    Microsoft Office 2010

    Microsoft Office Click-to-Run 2010

    Microsoft Office Starter 2010 - English

    Microsoft Silverlight

    Microsoft SQL Server 2005 Compact Edition [ENU]

    Microsoft Visual C++ 2005 Redistributable

    Microsoft Visual C++ 2005 Redistributable (x64)

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

    Mozilla Firefox 20.0.1 (x86 en-US)

    Mozilla Maintenance Service

    MSVCRT

    MSVCRT_amd64

    MSXML 4.0 SP2 (KB954430)

    MSXML 4.0 SP2 (KB973688)

    Norton AntiVirus

    Norton Identity Safe

    Nuance PDF Reader

    Optimizer Pro v3.0

    PC Health Kit v3.2

    Qualcomm Atheros WiFi Driver Installation

    Realtek High Definition Audio Driver

    Recipe Hub toolbar

    Search Protect by conduit

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)

    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)

    Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

    Security Update for Microsoft .NET Framework 4 Extended (KB2656351)

    Security Update for Microsoft .NET Framework 4 Extended (KB2736428)

    Security Update for Microsoft .NET Framework 4 Extended (KB2742595)

    Software Version Updater

    Sonic Focus

    Strongvault Online Backup

    Supreme Savings

    Synaptics Pointing Device Driver

    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)

    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)

    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)

    Update for Microsoft .NET Framework 4 Extended (KB2468871)

    Update for Microsoft .NET Framework 4 Extended (KB2533523)

    Update for Microsoft .NET Framework 4 Extended (KB2600217)

    Updater By SweetPacks 2.0.0.566

    VAFPlayer

    Windows Live

    Windows Live ???

    Windows Live ????

    Windows Live Communications Platform

    Windows Live Essentials

    Windows Live Family Safety

    Windows Live ID Sign-in Assistant

    Windows Live Installer

    Windows Live Language Selector

    Windows Live Mail

    Windows Live Mesh

    Windows Live Mesh ActiveX Control for Remote Connections

    Windows Live Messenger

    Windows Live MIME IFilter

    Windows Live Movie Maker

    Windows Live Photo Common

    Windows Live Photo Gallery

    Windows Live PIMT Platform

    Windows Live Remote Client

    Windows Live Remote Client Resources

    Windows Live Remote Service

    Windows Live Remote Service Resources

    Windows Live SOXE

    Windows Live SOXE Definitions

    Windows Live UX Platform

    Windows Live UX Platform Language Pack

    Windows Live Writer

    Windows Live Writer Resources

    WinFlash

    Wireless Console 3

    Yahoo! Software Update

    Yahoo! Toolbar

    Yontoo 2.051

    .

    ==== End Of File ===========================

    Here is the other log:

    DDS (Ver_2012-11-20.01) - NTFS_AMD64

    Internet Explorer: 10.0.9200.16537 BrowserJavaVersion: 10.17.2

    Run by peg at 17:22:03 on 2013-05-15

    Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4000.1059 [GMT -4:00]

    .

    AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

    SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

    SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

    .

    ============== Running Processes ===============

    .

    C:\Windows\system32\lsm.exe

    C:\Windows\system32\svchost.exe -k DcomLaunch

    C:\Windows\system32\svchost.exe -k RPCSS

    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

    C:\Windows\system32\svchost.exe -k LocalService

    C:\Windows\system32\svchost.exe -k netsvcs

    C:\Windows\system32\svchost.exe -k NetworkService

    C:\Windows\system32\FBAgent.exe

    C:\Windows\system32\WLANExt.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe

    C:\Windows\System32\spoolsv.exe

    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe

    C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe

    C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

    C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

    C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

    C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

    C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

    C:\Windows\system32\SearchIndexer.exe

    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

    C:\Program Files\Windows Media Player\wmpnetwk.exe

    C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

    C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe

    C:\Windows\system32\taskhost.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe

    C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe

    C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

    C:\Windows\system32\taskeng.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

    C:\Windows\system32\taskeng.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Program Files\ASUS\P4G\BatteryLife.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe

    C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe

    C:\Windows\system32\Dwm.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe

    C:\Windows\Explorer.EXE

    C:\Windows\AsScrPro.exe

    C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe

    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

    C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

    C:\Windows\System32\igfxtray.exe

    C:\Windows\System32\hkcmd.exe

    C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe

    C:\Windows\System32\igfxpers.exe

    C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

    C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

    C:\Windows\System32\rundll32.exe

    C:\Windows\SysWOW64\rundll32.exe

    C:\PROGRA~3\rundll32.exe

    C:\PROGRA~3\rundll32.exe

    C:\Windows\SysWOW64\rundll32.exe

    C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

    C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

    C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

    C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe

    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

    C:\Windows\system32\ctfmon.exe

    C:\Windows\System32\svchost.exe -k LocalServicePeerNet

    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

    C:\Program Files (x86)\Trend Micro\HiJackThis\HiJackThis.exe

    C:\Program Files (x86)\Mozilla Firefox\firefox.exe

    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe

    C:\Windows\servicing\TrustedInstaller.exe

    C:\Windows\system32\wuauclt.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

    C:\Windows\System32\svchost.exe -k WerSvcGroup

    C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe

    C:\Windows\system32\wbem\wmiprvse.exe

    C:\Windows\System32\cscript.exe

    .

    ============== Pseudo HJT Report ===============

    .

    uStart Page = hxxp://www.yahoo.com/?fr=fp-yie10

    uWindow Title = Windows Internet Explorer provided by Yahoo!

    uDefault_Page_URL = hxxp://www.yahoo.com/?fr=fp-yie10

    mStart Page = hxxp://www.google.com

    uProxyOverride = <local>

    uURLSearchHooks: <No Name>: {cc8ae5b8-005b-4b1a-a27d-307eddffe5c8} -

    uURLSearchHooks: YTNavAssistPlugin Class: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll

    mWinlogon: Userinit = C:\Windows\System32\userinit.exe

    BHO: Toolbar BHO: {06e3475c-5521-4de8-bb12-50720f21631c} -

    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

    BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\IPS\IPSBHO.dll

    BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

    BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    BHO: Norton Identity Protection: {AB4C7833-A6EC-433f-B9FE-6B14B1A2F836} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

    BHO: Search Assistant BHO: {b7acdf9c-c4f9-4d5d-998e-b147866b4d4c} -

    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BingExt.dll

    BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

    TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4BF3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -

    TB: Recipe Hub: {cf51de5b-eb36-4114-bb69-84df63fbadb4} -

    TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll

    TB: Norton Identity Safe Toolbar: {A13C2648-91D4-4bf3-BC6D-0079707C4389} - C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\CoIEPlg.dll

    uRun: [Facebook Update] "C:\Users\peg\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver

    uRun: [backupAgent] C:\Program Files (x86)\Strongvault Online Backup\BackupAgent.exe

    uRun: [Driver Pro] C:\Program Files (x86)\Driver Pro\DPLauncher.exe

    uRun: [ctfmon.exe] C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00

    mRun: [Nuance PDF Reader-reminder] "C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe" -r "C:\ProgramData\Nuance\PDF Reader\Ereg\Ereg.ini"

    mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"

    mRun: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe /S

    mRun: [sonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe

    mRun: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe

    mRun: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe

    mRun: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe

    mRun: [Wireless Console 3] C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe

    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

    mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

    mRun: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

    mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

    StartupFolder: C:\Users\peg\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\msconfig.lnk - C:\Windows\System32\rundll32.exe

    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\ASUSVI~1.LNK - C:\Program Files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe

    StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\FANCYS~1.LNK - C:\Windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe

    mPolicies-Explorer: NoActiveDesktop = dword:1

    mPolicies-Explorer: NoActiveDesktopChanges = dword:1

    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

    mPolicies-System: ConsentPromptBehaviorUser = dword:3

    mPolicies-System: EnableUIADesktopToggle = dword:0

    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

    TCP: NameServer = 192.168.0.1

    TCP: Interfaces\{E4EE1EFE-5953-489B-9C59-8FD50AAFCDA2} : DHCPNameServer = 192.168.0.1

    Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

    SSODL: WebCheck - <orphaned>

    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

    mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - C:\Windows\System32\rundll32.exe C:\Windows\System32\advpack.dll,LaunchINFSectionEx C:\Program Files (x86)\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12

    x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

    x64-BHO: Updater By SweetPacks: {C4CFC0DE-134F-4466-B2A2-FF7C59A8BFAD} - C:\Program Files\Updater By SweetPacks\Extension64.dll

    x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

    x64-Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe

    x64-Run: [synAsusAcpi] C:\Program Files (x86)\Synaptics\SynTP\SynAsusAcpi.exe

    x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /SF3

    x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

    x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

    x64-Run: [EKIJ5000StatusMonitor] C:\Windows\System32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe

    x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

    x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

    x64-Notify: igfxcui - igfxdev.dll

    x64-SSODL: WebCheck - <orphaned>

    .

    ================= FIREFOX ===================

    .

    FF - ProfilePath - C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\

    FF - prefs.js: browser.search.selectedEngine - Norton Safe Search

    FF - prefs.js: network.proxy.type - 0

    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL

    FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll

    FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.8\npapicomadapter.dll

    FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll

    FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

    FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrlui.dll

    FF - plugin: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll

    FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

    FF - plugin: C:\Users\peg\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll

    FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\np-mswmp.dll

    FF - plugin: C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}\plugins\npConduitFirefoxPlugin.dll

    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll

    FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

    FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

    FF - ExtSQL: 2013-04-21 18:47; {b920380d-fbe7-45c7-96ab-37e9870a566c}; C:\Users\peg\AppData\Roaming\Mozilla\Firefox\Profiles\w8013kzv.default\extensions\{b920380d-fbe7-45c7-96ab-37e9870a566c}

    FF - ExtSQL: 2013-05-06 21:20; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\IPSFFPlgn

    FF - ExtSQL: 2013-05-06 21:54; {F04D2D30-776C-4d02-8627-8E4385ECA58D}; C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.3.19\coFFPlgn

    .

    ============= SERVICES / DRIVERS ===============

    .

    R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys [2013-5-6 493656]

    R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys [2013-5-6 1139800]

    R1 ATKWMIACPIIO_;ATKWMIACPI Driver_;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-9-7 17536]

    R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\BASHDefs\20130502.001\BHDrvx64.sys [2013-5-7 1390680]

    R1 ccSet_NAV;Norton AntiVirus Settings Manager;C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys [2013-5-6 168096]

    R1 ccSet_NST;Norton Identity Safe Settings Manager;C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys [2013-5-6 168096]

    R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_20.3.1.22\Definitions\IPSDefs\20130514.001\IDSviA64.sys [2013-5-15 513184]

    R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys [2013-5-6 224416]

    R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys [2013-5-6 432800]

    R2 AFBAgent;AFBAgent;C:\Windows\System32\FBAgent.exe [2011-12-10 379520]

    R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]

    R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe [2012-2-16 277120]

    R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]

    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-5-15 418376]

    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-5-15 701512]

    R2 NAV;Norton AntiVirus;C:\Program Files (x86)\Norton AntiVirus\Engine\20.3.1.22\ccSvcHst.exe [2013-5-6 144520]

    R2 NCO;Norton Identity Safe;C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe [2013-5-6 144520]

    R2 RecipeHub_2jService;Recipe HubService;C:\PROGRA~2\RECIPE~2\bar\1.bin\2jbarsvc.exe [2013-3-16 42504]

    R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]

    R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2011-12-10 2656280]

    R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-11-22 130024]

    R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-11-22 395752]

    R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.EXE [2012-6-11 240208]

    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-5-7 138912]

    R3 IntcDAud;Intel® Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-11-3 317440]

    R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-10-17 76912]

    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-5-15 25928]

    R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]

    R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]

    R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]

    R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]

    R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]

    S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.EXE [2012-6-11 193616]

    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]

    S3 fssfltr;fssfltr;C:\Windows\System32\drivers\fssfltr.sys [2011-10-18 48488]

    S3 fsssvc;Windows Live Family Safety Service;C:\Program Files (x86)\Windows Live\Family Safety\fsssvc.exe [2011-5-13 1492840]

    S3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;C:\Windows\System32\drivers\SiSG664.sys [2009-6-10 56832]

    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-2-18 59392]

    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2011-2-18 31232]

    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-20 1255736]

    S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

    .

    =============== Created Last 30 ================

    .

    2013-05-15 21:17:44 -------- d-----w- C:\Users\peg\AppData\Roaming\Malwarebytes

    2013-05-15 21:17:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

    2013-05-15 21:17:32 -------- d-----w- C:\ProgramData\Malwarebytes

    2013-05-15 21:17:31 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware

    2013-05-12 21:17:30 -------- d-----w- C:\Users\peg\AppData\Local\ Online Backup

    2013-05-12 20:30:28 -------- d-----w- C:\Windows\ERUNT

    2013-05-12 20:30:22 -------- d-----w- C:\JRT

    2013-05-12 20:29:22 388096 ----a-r- C:\Users\peg\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

    2013-05-12 20:29:22 -------- d-----w- C:\Program Files (x86)\Trend Micro

    2013-05-07 21:01:19 -------- d-----w- C:\Users\peg\AppData\Local\NPE

    2013-05-07 01:54:11 168096 ----a-r- C:\Windows\System32\drivers\NSTx64\7DD03030.013\ccSetx64.sys

    2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64\7DD03030.013

    2013-05-07 01:54:03 -------- d-----w- C:\Windows\System32\drivers\NSTx64

    2013-05-07 01:54:02 -------- d-----w- C:\Program Files (x86)\Norton Identity Safe

    2013-05-07 01:53:55 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

    2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Symantec

    2013-05-07 01:53:54 -------- d-----w- C:\Program Files\Common Files\Symantec Shared

    2013-05-07 01:52:57 432800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\symnets.sys

    2013-05-07 01:52:57 23448 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymELAM.sys

    2013-05-07 01:52:57 1139800 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymEFA64.sys

    2013-05-07 01:52:56 796248 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtsp64.sys

    2013-05-07 01:52:56 493656 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\SymDS64.sys

    2013-05-07 01:52:56 36952 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\srtspx64.sys

    2013-05-07 01:52:56 224416 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\Ironx64.sys

    2013-05-07 01:52:56 168096 ----a-r- C:\Windows\System32\drivers\NAVx64\1403010.016\ccSetx64.sys

    2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64\1403010.016

    2013-05-07 01:52:23 -------- d-----w- C:\Windows\System32\drivers\NAVx64

    2013-05-07 01:52:22 -------- d-----w- C:\Program Files (x86)\Norton AntiVirus

    2013-05-07 01:46:35 -------- d-----w- C:\ProgramData\PCSettings

    2013-05-07 01:22:26 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared

    2013-05-07 01:15:55 -------- d-----w- C:\ProgramData\NortonInstaller

    2013-05-07 01:15:55 -------- d-----w- C:\Program Files (x86)\NortonInstaller

    2013-05-07 00:32:41 -------- d-----w- C:\ProgramData\Norton

    2013-05-01 00:58:15 140800 ----a-w- C:\ProgramData\39ri.dat

    2013-05-01 00:58:12 44544 ----a-w- C:\ProgramData\rundll32.exe

    2013-05-01 00:58:12 140800 ----a-w- C:\ProgramData\43d3.dat

    2013-04-23 23:23:34 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

    2013-04-22 23:12:40 -------- d-----w- C:\Windows\pss

    2013-04-21 22:49:21 -------- d-----w- C:\Users\peg\AppData\Roaming\PC Health Kit

    2013-04-21 22:49:17 -------- d-----w- C:\Program Files (x86)\PC Health Kit

    2013-04-15 22:38:16 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

    .

    ==================== Find3M ====================

    .

    2013-04-21 22:51:30 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

    2013-04-21 22:51:30 691592 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

    2013-04-11 14:22:56 770384 ----a-w- C:\Windows\SysWow64\msvcr100.dll

    2013-04-11 14:22:56 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll

    2013-03-29 22:57:50 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll

    2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

    2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll

    2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

    2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

    2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

    2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe

    2013-03-17 17:42:31 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

    2013-03-17 17:42:31 861088 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

    2013-03-17 17:42:31 782240 ----a-w- C:\Windows\SysWow64\deployJava1.dll

    2013-03-01 03:36:04 3153408 ----a-w- C:\Windows\System32\win32k.sys

    2013-02-21 10:30:16 1766912 ----a-w- C:\Windows\SysWow64\wininet.dll

    2013-02-21 10:29:39 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll

    2013-02-21 10:29:37 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

    2013-02-21 10:29:37 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

    2013-02-21 10:15:07 2240512 ----a-w- C:\Windows\System32\wininet.dll

    2013-02-21 10:14:09 3958784 ----a-w- C:\Windows\System32\jscript9.dll

    2013-02-21 10:14:05 67072 ----a-w- C:\Windows\System32\iesetup.dll

    2013-02-21 10:14:05 136704 ----a-w- C:\Windows\System32\iesysprep.dll

    2013-02-19 12:01:03 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

    2013-02-19 11:42:14 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

    2013-02-19 11:10:53 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

    2013-02-19 10:51:18 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

    2013-02-15 06:08:40 44032 ----a-w- C:\Windows\System32\tsgqec.dll

    2013-02-15 06:06:11 3717632 ----a-w- C:\Windows\System32\mstscax.dll

    2013-02-15 06:02:26 158720 ----a-w- C:\Windows\System32\aaclient.dll

    2013-02-15 04:37:10 3217408 ----a-w- C:\Windows\SysWow64\mstscax.dll

    2013-02-15 04:34:10 131584 ----a-w- C:\Windows\SysWow64\aaclient.dll

    2013-02-15 03:25:51 36864 ----a-w- C:\Windows\SysWow64\tsgqec.dll

    .

    ============= FINISH: 17:29:51.33 ===============

    Also here is MBam's log on quick scan:

    Malwarebytes Anti-Malware (Trial) 1.75.0.1300

    www.malwarebytes.org

    Database version: v2013.05.15.11

    Windows 7 Service Pack 1 x64 NTFS

    Internet Explorer 10.0.9200.16540

    peg :: PEG-PC [administrator]

    Protection: Enabled

    5/15/2013 5:20:20 PM

    MBAM-log-2013-05-15 (17-37-01).txt

    Scan type: Quick scan

    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

    Scan options disabled: P2P

    Objects scanned: 222007

    Time elapsed: 16 minute(s), 20 second(s)

    Memory Processes Detected: 2

    C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 2804 -> No action taken.

    C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> 3620 -> No action taken.

    Memory Modules Detected: 0

    (No malicious items detected)

    Registry Keys Detected: 4

    HKCR\CLSID\{67BD9EEB-AA06-4329-A940-D250019300C9} (PUP.Software.Updater) -> No action taken.

    HKCR\TypeLib\{A0EE0278-2986-4E5A-884E-A3BF0357E476} (PUP.Software.Updater) -> No action taken.

    HKCR\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67} (PUP.Software.Updater) -> No action taken.

    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{99C91FC5-DB5B-4AA0-BB70-5D89C5A4DF96} (PUP.Software.Updater) -> No action taken.

    Registry Values Detected: 1

    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|ctfmon.exe (Trojan.Agent.Gen) -> Data: C:\PROGRA~3\rundll32.exe C:\PROGRA~3\43d3.dat,FG00 -> No action taken.

    Registry Data Items Detected: 0

    (No malicious items detected)

    Folders Detected: 0

    (No malicious items detected)

    Files Detected: 6

    C:\ProgramData\43d3.dat (Trojan.FakeMS) -> No action taken.

    C:\ProgramData\39ri.dat (Trojan.FakeMS) -> No action taken.

    C:\Users\peg\AppData\Local\Temp\ofi3jZF.exe (Trojan.FakeMS) -> No action taken.

    C:\Users\peg\AppData\Local\Temp\DIQ\FlashPlayer_151\software\SupremeSavings.exe (Heuristics.Shuriken) -> No action taken.

    C:\Windows\Tasks\AmiUpdXp.job (PUP.Software.Updater) -> No action taken.

    C:\ProgramData\rundll32.exe (Trojan.Agent.Gen) -> No action taken.

    (end)

    Computer infected?

    in Resolved Malware Removal Logs

    Posted

    ComboFix 12-11-08.01 - Brandon 11/08/2012 10:16:35.12.2 - x64

    Running from: c:\users\Brandon\Desktop\ComboFix.exe

    * Created a new restore point

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-08 to 2012-11-08 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-08 15:28 . 2012-11-08 15:28 -------- d-----w- c:\users\Public\AppData\Local\temp

    2012-11-08 15:28 . 2012-11-08 15:28 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-11-08 02:42 . 2012-11-08 02:42 -------- d-----w- c:\program files (x86)\Common Files\Java

    2012-11-08 02:41 . 2012-11-08 02:39 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    2012-10-30 21:09 . 2012-10-30 21:09 -------- d-----w- c:\program files (x86)\Total Video Converter

    2012-10-16 07:09 . 2012-10-16 07:09 -------- d-----w- c:\program files (x86)\MSXML 4.0

    2012-10-15 17:23 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-10-15 17:23 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll

    2012-10-14 23:52 . 2012-11-08 15:15 -------- d-----w- C:\32788R22FWJFW

    2012-10-14 18:49 . 2012-10-14 18:48 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2012-10-14 18:48 . 2012-10-14 18:48 -------- d-----w- c:\programdata\McAfee

    2012-10-12 13:41 . 2012-10-12 13:41 -------- d-----w- c:\program files\Penn State Wireless v2

    2012-10-09 19:00 . 2012-10-09 19:03 -------- d-----w- c:\users\Brandon\AppData\Roaming\mIRC

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-11-08 02:38 . 2010-07-28 00:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-10-17 16:46 . 2009-01-03 12:24 45056 ----a-w- c:\windows\system32\acovcnt.exe

    2012-10-08 21:40 . 2012-07-12 02:32 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-10-08 21:40 . 2012-07-06 18:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-09-30 00:54 . 2011-08-08 19:48 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]

    "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

    "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-31 1353080]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]

    "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]

    "HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304]

    "ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328]

    "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744]

    "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792]

    "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-01 273544]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

    "iTunesHelper"="D:\iTunesHelper.exe" [2012-06-07 421776]

    "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "mixer5"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804]

    IME File REG_SZ IMSC12.IME

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - 35718442

    *Deregistered* - 35718442

    *Deregistered* - aswMBR

    .

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

    Themes

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

    2008-06-09 17:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-08 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:40]

    .

    2012-11-07 c:\windows\Tasks\ReclaimerUpdateFiles_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    2012-11-07 c:\windows\Tasks\ReclaimerUpdateXML_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    2012-11-07 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6342688]

    "Skytel"="Skytel.exe" [2007-11-20 1826816]

    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://oc-startpage.aol.com/

    mLocal Page = c:\windows\SysWOW64\blank.htm

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

    TCP: DhcpNameServer = 192.168.0.1

    CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll

    FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\g6jhj5ri.default\

    FF - prefs.js: browser.startup.homepage - google.com

    FF - prefs.js: network.proxy.type - 0

    FF - ExtSQL: 2012-09-10 13:08; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

    FF - ExtSQL: !HIDDEN! 2009-06-24 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true

    .

    - - - - ORPHANS REMOVED - - - -

    .

    AddRemove-Adobe Shockwave Player - c:\windows\System32\Adobe\SHOCKW~1\UNWISE.EXE

    AddRemove-DVD Flick_is1 - c:\program files (x86)\DVD Flick\unins000.exe

    AddRemove-mIRC - c:\program files (x86)\mIRC\uninstall.exe

    AddRemove-SecureW2 Enterprise Client - c:\program files (x86)\SecureW2\Uninstall.exe

    AddRemove-Tiled - c:\program files (x86)\Tiled\uninstall.exe

    .

    .

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NAV]

    "ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\17.9.0.12\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\17.9.0.12\diMaster.dll\" /prefetch:1"

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    Completion time: 2012-11-08 10:32:13

    ComboFix-quarantined-files.txt 2012-11-08 15:32

    ComboFix2.txt 2012-11-08 14:48

    ComboFix3.txt 2012-11-07 21:17

    ComboFix4.txt 2012-11-07 18:59

    ComboFix5.txt 2012-11-08 15:15

    .

    Pre-Run: 544,768,000 bytes free

    Post-Run: 494,596,096 bytes free

    .

    - - End Of File - - F93023D4626450227C536BFCD2CF88EF

    Computer infected?

    in Resolved Malware Removal Logs

    Posted

    Looks like we have one that wants to hang around.....

    First open an elevated command prompt > Click Start and type cmd in Start Search.

    When cmd.exe populates above, right click it and select Run as Administrator to open an elevated command prompt.

    Copy the contents of the code box > right click in the command window and select paste >> Press Enter


    del c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat

    Close the Command Prompt box.

    -------

    Run a new scan with ComboFix and post the new log. :)

    With the last CFScript? Or run by itself?

    Computer infected?

    in Resolved Malware Removal Logs

    Posted

    ComboFix 12-11-08.01 - Brandon 11/08/2012 9:33.11.2 - x64

    Running from: c:\users\Brandon\Desktop\ComboFix.exe

    Command switches used :: c:\users\Brandon\Desktop\CFScript.txt

    * Created a new restore point

    .

    FILE ::

    "c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat"

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-08 to 2012-11-08 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-08 14:44 . 2012-11-08 14:44 -------- d-----w- c:\users\Public\AppData\Local\temp

    2012-11-08 14:44 . 2012-11-08 14:44 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-11-08 02:42 . 2012-11-08 02:42 -------- d-----w- c:\program files (x86)\Common Files\Java

    2012-11-08 02:41 . 2012-11-08 02:39 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    2012-10-30 21:09 . 2012-10-30 21:09 -------- d-----w- c:\program files (x86)\Total Video Converter

    2012-10-16 07:09 . 2012-10-16 07:09 -------- d-----w- c:\program files (x86)\MSXML 4.0

    2012-10-15 17:23 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-10-15 17:23 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll

    2012-10-14 23:52 . 2012-11-08 14:31 -------- d-----w- C:\32788R22FWJFW

    2012-10-14 18:49 . 2012-10-14 18:48 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2012-10-14 18:48 . 2012-10-14 18:48 -------- d-----w- c:\programdata\McAfee

    2012-10-12 13:41 . 2012-10-12 13:41 -------- d-----w- c:\program files\Penn State Wireless v2

    2012-10-09 19:00 . 2012-10-09 19:03 -------- d-----w- c:\users\Brandon\AppData\Roaming\mIRC

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-11-08 02:38 . 2010-07-28 00:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-10-17 16:46 . 2009-01-03 12:24 45056 ----a-w- c:\windows\system32\acovcnt.exe

    2012-10-08 21:40 . 2012-07-12 02:32 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-10-08 21:40 . 2012-07-06 18:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-10-07 19:03 . 2012-10-07 19:03 133120 ----a-w- c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat

    2012-09-30 00:54 . 2011-08-08 19:48 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]

    "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

    "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-31 1353080]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]

    "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]

    "HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304]

    "ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328]

    "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744]

    "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792]

    "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-01 273544]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

    "iTunesHelper"="D:\iTunesHelper.exe" [2012-06-07 421776]

    "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "mixer5"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804]

    IME File REG_SZ IMSC12.IME

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - 35718442

    *Deregistered* - 35718442

    *Deregistered* - aswMBR

    .

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

    Themes

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

    2008-06-09 17:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-08 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:40]

    .

    2012-11-07 c:\windows\Tasks\ReclaimerUpdateFiles_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    2012-11-07 c:\windows\Tasks\ReclaimerUpdateXML_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    2012-11-07 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6342688]

    "Skytel"="Skytel.exe" [2007-11-20 1826816]

    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://oc-startpage.aol.com/

    mLocal Page = c:\windows\SysWOW64\blank.htm

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

    TCP: DhcpNameServer = 192.168.0.1

    CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll

    FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\g6jhj5ri.default\

    FF - prefs.js: browser.startup.homepage - google.com

    FF - prefs.js: network.proxy.type - 0

    FF - ExtSQL: 2012-09-10 13:08; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

    FF - ExtSQL: !HIDDEN! 2009-06-24 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true

    .

    - - - - ORPHANS REMOVED - - - -

    .

    AddRemove-Adobe Shockwave Player - c:\windows\System32\Adobe\SHOCKW~1\UNWISE.EXE

    AddRemove-DVD Flick_is1 - c:\program files (x86)\DVD Flick\unins000.exe

    AddRemove-mIRC - c:\program files (x86)\mIRC\uninstall.exe

    AddRemove-SecureW2 Enterprise Client - c:\program files (x86)\SecureW2\Uninstall.exe

    AddRemove-Tiled - c:\program files (x86)\Tiled\uninstall.exe

    .

    .

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\NAV]

    "ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\17.9.0.12\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\17.9.0.12\diMaster.dll\" /prefetch:1"

    .

    --------------------- LOCKED REGISTRY KEYS ---------------------

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="FlashBroker"

    "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe,-101"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

    "Enabled"=dword:00000001

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

    @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_287_ActiveX.exe"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

    @Denied: (A 2) (Everyone)

    @="IFlashBroker5"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

    @="{00020424-0000-0000-C000-000000000046}"

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

    @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

    "Version"="1.0"

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]

    @Denied: (A) (Users)

    @Denied: (A) (Everyone)

    @Allowed: (B 1 2 3 4 5) (S-1-5-20)

    "BlindDial"=dword:00000000

    .

    Completion time: 2012-11-08 09:48:36

    ComboFix-quarantined-files.txt 2012-11-08 14:48

    ComboFix2.txt 2012-11-07 21:17

    ComboFix3.txt 2012-11-07 18:59

    ComboFix4.txt 2012-10-15 00:09

    .

    Pre-Run: 561,094,656 bytes free

    Post-Run: 497,094,656 bytes free

    .

    - - End Of File - - 18454213A365F90EC62C26F9784C3186

    Computer infected?

    in Resolved Malware Removal Logs

    Posted

    Computer runs fine, nothing has broke yet :)

    ComboFix 12-11-06.03 - Brandon 11/07/2012 16:03:02.10.2 - x64

    Running from: c:\users\Brandon\Desktop\ComboFix.exe

    Command switches used :: c:\users\Brandon\Desktop\CFScript.txt

    * Created a new restore point

    .

    FILE ::

    "c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat"

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-07 to 2012-11-07 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-07 21:14 . 2012-11-07 21:14 -------- d-----w- c:\users\Public\AppData\Local\temp

    2012-11-07 21:14 . 2012-11-07 21:14 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-10-30 21:09 . 2012-10-30 21:09 -------- d-----w- c:\program files (x86)\Total Video Converter

    2012-10-16 07:09 . 2012-10-16 07:09 -------- d-----w- c:\program files (x86)\MSXML 4.0

    2012-10-15 17:23 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-10-15 17:23 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll

    2012-10-14 23:52 . 2012-11-07 21:01 -------- d-----w- C:\32788R22FWJFW

    2012-10-14 18:49 . 2012-10-14 18:49 -------- d-----w- c:\program files (x86)\Common Files\Java

    2012-10-14 18:49 . 2012-10-14 18:48 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2012-10-14 18:49 . 2012-10-14 18:49 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    2012-10-14 18:48 . 2012-10-14 18:48 -------- d-----w- c:\programdata\McAfee

    2012-10-12 13:41 . 2012-10-12 13:41 -------- d-----w- c:\program files\Penn State Wireless v2

    2012-10-09 19:00 . 2012-10-09 19:03 -------- d-----w- c:\users\Brandon\AppData\Roaming\mIRC

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-10-17 16:46 . 2009-01-03 12:24 45056 ----a-w- c:\windows\system32\acovcnt.exe

    2012-10-14 18:48 . 2010-07-28 00:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-10-08 21:40 . 2012-07-12 02:32 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-10-08 21:40 . 2012-07-06 18:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-10-07 19:03 . 2012-10-07 19:03 133120 ----a-w- c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat

    2012-09-30 00:54 . 2011-08-08 19:48 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]

    "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

    "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-31 1353080]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]

    "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]

    "HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304]

    "ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328]

    "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744]

    "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792]

    "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-01 273544]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

    "iTunesHelper"="D:\iTunesHelper.exe" [2012-06-07 421776]

    "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "mixer5"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804]

    IME File REG_SZ IMSC12.IME

    .

    --- Other Services/Drivers In Memory ---

    .

    *NewlyCreated* - 35718442

    *Deregistered* - 35718442

    *Deregistered* - aswMBR

    .

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

    Themes

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

    2008-06-09 17:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-07 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:40]

    .

    2012-11-07 c:\windows\Tasks\ReclaimerUpdateFiles_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    2012-11-07 c:\windows\Tasks\ReclaimerUpdateXML_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    2012-11-07 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6342688]

    "Skytel"="Skytel.exe" [2007-11-20 1826816]

    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://oc-startpage.aol.com/

    mLocal Page = c:\windows\SysWOW64\blank.htm

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

    TCP: DhcpNameServer = 192.168.0.1

    CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll

    FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\g6jhj5ri.default\

    FF - prefs.js: browser.startup.homepage - google.com

    FF - prefs.js: network.proxy.type - 0

    FF - ExtSQL: 2012-09-10 13:08; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

    FF - ExtSQL: !HIDDEN! 2009-06-24 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true

    .

    - - - - ORPHANS REMOVED - - - -

    .

    AddRemove-Adobe Shockwave Player - c:\windows\System32\Adobe\SHOCKW~1\UNWISE.EXE

    AddRemove-DVD Flick_is1 - c:\program files (x86)\DVD Flick\unins000.exe

    AddRemove-mIRC - c:\program files (x86)\mIRC\uninstall.exe

    AddRemove-SecureW2 Enterprise Client - c:\program files (x86)\SecureW2\Uninstall.exe

    AddRemove-Tiled - c:\program files (x86)\Tiled\uninstall.exe

    .

    .

    .

    Completion time: 2012-11-07 16:17:00

    ComboFix-quarantined-files.txt 2012-11-07 21:17

    ComboFix2.txt 2012-11-07 18:59

    ComboFix3.txt 2012-10-15 00:09

    .

    Pre-Run: 210,878,464 bytes free

    Post-Run: 196,222,976 bytes free

    .

    - - End Of File - - 2486E8EC7EE9EDA073237DD4F5ED1D15

    Computer infected?

    in Resolved Malware Removal Logs

    Posted

    ComboFix 12-11-06.03 - Brandon 11/07/2012 13:45:02.9.2 - x64

    Running from: c:\users\Brandon\Desktop\ComboFix.exe

    * Created a new restore point

    .

    .

    ((((((((((((((((((((((((( Files Created from 2012-10-07 to 2012-11-07 )))))))))))))))))))))))))))))))

    .

    .

    2012-11-07 18:56 . 2012-11-07 18:56 -------- d-----w- c:\users\Public\AppData\Local\temp

    2012-11-07 18:56 . 2012-11-07 18:56 -------- d-----w- c:\users\Default\AppData\Local\temp

    2012-10-30 21:09 . 2012-10-30 21:09 -------- d-----w- c:\program files (x86)\Total Video Converter

    2012-10-16 07:09 . 2012-10-16 07:09 -------- d-----w- c:\program files (x86)\MSXML 4.0

    2012-10-15 17:23 . 2012-08-29 11:40 4699520 ----a-w- c:\windows\system32\ntoskrnl.exe

    2012-10-15 17:23 . 2012-06-29 16:20 648192 ----a-w- c:\windows\system32\netapi32.dll

    2012-10-14 23:52 . 2012-11-07 18:43 -------- d-----w- C:\32788R22FWJFW

    2012-10-14 18:49 . 2012-10-14 18:49 -------- d-----w- c:\program files (x86)\Common Files\Java

    2012-10-14 18:49 . 2012-10-14 18:48 821736 ----a-w- c:\windows\SysWow64\npDeployJava1.dll

    2012-10-14 18:49 . 2012-10-14 18:49 95208 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll

    2012-10-14 18:48 . 2012-10-14 18:48 -------- d-----w- c:\programdata\McAfee

    2012-10-12 13:41 . 2012-10-12 13:41 -------- d-----w- c:\program files\Penn State Wireless v2

    2012-10-09 19:00 . 2012-10-09 19:03 -------- d-----w- c:\users\Brandon\AppData\Roaming\mIRC

    .

    .

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2012-10-17 16:46 . 2009-01-03 12:24 45056 ----a-w- c:\windows\system32\acovcnt.exe

    2012-10-14 18:48 . 2010-07-28 00:42 746984 ----a-w- c:\windows\SysWow64\deployJava1.dll

    2012-10-08 21:40 . 2012-07-12 02:32 696760 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe

    2012-10-08 21:40 . 2012-07-06 18:03 73656 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl

    2012-10-07 19:03 . 2012-10-07 19:03 133120 ----a-w- c:\programdata\Microsoft\Windows\DRM\B82B.tmp.dat

    2012-09-30 00:54 . 2011-08-08 19:48 25928 ----a-w- c:\windows\system32\drivers\mbam.sys

    .

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    .

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]

    "LightScribe Control Panel"="c:\program files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]

    "Steam"="c:\program files (x86)\Steam\Steam.exe" [2012-08-31 1353080]

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

    "CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-19 104936]

    "P2Go_Menu"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-06-14 210216]

    "HControlUser"="c:\program files (x86)\ASUS\ATK Hotkey\HControlUser.exe" [2008-01-12 98304]

    "ATKOSD2"="c:\program files (x86)\ASUS\ATKOSD2\ATKOSD2.exe" [2008-07-15 7651328]

    "ATKMEDIA"="c:\program files (x86)\ASUS\ATK Media\DMedia.exe" [2008-06-25 159744]

    "GrooveMonitor"="c:\program files (x86)\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]

    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2009-11-11 417792]

    "TkBellExe"="c:\program files (x86)\Real\RealPlayer\Update\realsched.exe" [2011-04-01 273544]

    "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]

    "iTunesHelper"="D:\iTunesHelper.exe" [2012-06-07 421776]

    "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]

    "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]

    .

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

    "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1555968]

    .

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

    "EnableUIADesktopToggle"= 0 (0x0)

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]

    "mixer5"=wdmaud.drv

    .

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804]

    IME File REG_SZ IMSC12.IME

    .

    --- Other Services/Drivers In Memory ---

    .

    *Deregistered* - aswMBR

    .

    HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

    Themes

    .

    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]

    2008-06-09 17:14 451872 ----a-w- c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe

    .

    Contents of the 'Scheduled Tasks' folder

    .

    2012-11-07 c:\windows\Tasks\Adobe Flash Player Updater.job

    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-12 21:40]

    .

    2012-11-07 c:\windows\Tasks\ReclaimerUpdateFiles_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    2012-11-07 c:\windows\Tasks\ReclaimerUpdateXML_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    2012-11-07 c:\windows\Tasks\RNUpgradeHelperLogonPrompt_Brandon.job

    - c:\users\Brandon\AppData\Roaming\Real\Update\UpgradeHelper\RealPlayer\10.20\agent\rnupgagent.exe [2012-09-29 19:22]

    .

    .

    --------- X64 Entries -----------

    .

    .

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "RtHDVCpl"="RAVCpl64.exe" [2008-07-03 6342688]

    "Skytel"="Skytel.exe" [2007-11-20 1826816]

    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-12-06 1216808]

    .

    ------- Supplementary Scan -------

    .

    uLocal Page = c:\windows\system32\blank.htm

    uStart Page = hxxp://oc-startpage.aol.com/

    mLocal Page = c:\windows\SysWOW64\blank.htm

    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000

    TCP: DhcpNameServer = 192.168.0.1

    CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll

    FF - ProfilePath - c:\users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\g6jhj5ri.default\

    FF - prefs.js: browser.startup.homepage - google.com

    FF - prefs.js: network.proxy.type - 0

    FF - ExtSQL: 2012-09-10 13:08; {23fcfd51-4958-4f00-80a3-ae97e717ed8b}; c:\program files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5

    FF - ExtSQL: !HIDDEN! 2009-06-24 03:00; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

    FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true

    .

    - - - - ORPHANS REMOVED - - - -

    .

    AddRemove-Adobe Shockwave Player - c:\windows\System32\Adobe\SHOCKW~1\UNWISE.EXE

    AddRemove-DVD Flick_is1 - c:\program files (x86)\DVD Flick\unins000.exe

    AddRemove-mIRC - c:\program files (x86)\mIRC\uninstall.exe

    AddRemove-SecureW2 Enterprise Client - c:\program files (x86)\SecureW2\Uninstall.exe

    AddRemove-Tiled - c:\program files (x86)\Tiled\uninstall.exe

    .

    .

    .

    Completion time: 2012-11-07 13:59:31

    ComboFix-quarantined-files.txt 2012-11-07 18:59

    ComboFix2.txt 2012-10-15 00:09

    .

    Pre-Run: 99,586,048 bytes free

    Post-Run: 229,724,160 bytes free

    .

    - - End Of File - - FCE1889BE94CFBB0249135F5A27739F2

    Computer infected?

    in Resolved Malware Removal Logs

    Posted

    aswMBR version 0.9.9.1665 Copyright© 2011 AVAST Software

    Run date: 2012-11-06 21:03:37

    -----------------------------

    21:03:37.751 OS Version: Windows x64 6.0.6002 Service Pack 2

    21:03:37.752 Number of processors: 2 586 0xF0D

    21:03:37.753 ComputerName: BRANDON-PC UserName: Brandon

    21:03:39.208 Initialize success

    21:04:34.629 AVAST engine defs: 12110602

    21:04:45.441 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1

    21:04:45.443 Disk 0 Vendor: ST925082 3.AA Size: 238475MB BusType: 3

    21:04:45.465 Disk 0 MBR read successfully

    21:04:45.468 Disk 0 MBR scan

    21:04:45.484 Disk 0 unknown MBR code

    21:04:45.488 Disk 0 Partition 1 00 1C Hidd FAT32 LBA MSDOS5.0 10997 MB offset 63

    21:04:45.502 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 119232 MB offset 22523130

    21:04:45.509 Disk 0 Partition - 00 0F Extended LBA 108244 MB offset 266711280

    21:04:45.552 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 108244 MB offset 266711324

    21:04:45.651 Disk 0 scanning C:\Windows\system32\drivers

    21:05:07.480 Service scanning

    21:06:13.195 Modules scanning

    21:06:13.203 Disk 0 trace - called modules:

    21:06:13.557 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys iaStor.sys hal.dll

    21:06:13.562 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8006a33790]

    21:06:13.566 3 CLASSPNP.SYS[fffffa6000fc7c33] -> nt!IofCallDriver -> [0xfffffa8004bcc2d0]

    21:06:13.571 5 acpi.sys[fffffa6000901fde] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004bcf050]

    21:06:15.651 AVAST engine scan C:\Windows

    21:06:22.241 AVAST engine scan C:\Windows\system32

    21:14:45.357 AVAST engine scan C:\Windows\system32\drivers

    21:15:06.041 AVAST engine scan C:\Users\Brandon

    21:39:09.550 AVAST engine scan C:\ProgramData

    21:42:28.297 File: C:\ProgramData\Microsoft\Windows\DRM\B82B.tmp.dat **INFECTED** Win32:Dropper-gen [Drp]

    21:45:59.099 Scan finished successfully

    22:19:03.309 Disk 0 MBR has been saved successfully to "C:\Users\Brandon\Desktop\MBR.dat"

    22:19:03.314 The log file has been saved successfully to "C:\Users\Brandon\Desktop\aswMBR.txt"

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.