sean1604

Sorry, didn't attach it here it is now. GMER.log

5. GMER Too big to post, please find attached

Hi Blackbird, thanks for the help. Logs below; 1 (DeFogger): defogger_disable by jpshortstuff (23.02.10.1) Log created at 13:46 on 03/01/2015 (Sean) Checking for autostart values... HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. HKCU:DAEMON Tools Lite -> Removed Checking for services/drivers... -=E.O.F=- 2. (AdwCleaner) # AdwCleaner v4.106 - Report created 03/01/2015 at 13:48:49 # Updated 21/12/2014 by Xplode # Database : 2015-01-03.1 [Live] # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Sean - SEAN-PC # Running from : C:\Users\Sean\Desktop\adwcleaner_4.106.exe # Option : Scan ***** [ Services ] ***** Service Found : HssSrv Service Found : hsswd ***** [ Files / Folders ] ***** Folder Found : C:\hotspot shield Folder Found : C:\Program Files (x86)\hotspot shield Folder Found : C:\ProgramData\Ask Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\hotspot shield Folder Found : C:\ProgramData\StarApp Folder Found : C:\Users\Sean\AppData\Local\Bundled software uninstaller Folder Found : C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpckgflgdapkpabemgkielbefdildaio Folder Found : C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\4fba2f0a1f13d@4fba2f0a1f178.info ***** [ Scheduled Tasks ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKCU\Software\APN PIP Key Found : HKCU\Software\AVG Nation toolbar Key Found : HKCU\Software\BI Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Google\Chrome\Extensions\kpckgflgdapkpabemgkielbefdildaio Key Found : HKCU\Software\hotspotshield Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{BA14329E-9550-4989-B3F2-9732E92D17CC} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BA14329E-9550-4989-B3F2-9732E92D17CC} Key Found : HKCU\Software\Myfree Codec Key Found : HKCU\Software\OCS Key Found : [x64] HKCU\Software\APN PIP Key Found : [x64] HKCU\Software\AVG Nation toolbar Key Found : [x64] HKCU\Software\BI Key Found : [x64] HKCU\Software\Conduit Key Found : [x64] HKCU\Software\hotspotshield Key Found : [x64] HKCU\Software\Myfree Codec Key Found : [x64] HKCU\Software\OCS Key Found : HKLM\SOFTWARE\AVG Nation toolbar Key Found : HKLM\SOFTWARE\AVG Security Toolbar Key Found : HKLM\SOFTWARE\Classes\AppID\{4D076AB4-7562-427A-B5D2-BD96E19DEE56} Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Found : HKLM\SOFTWARE\Classes\AppID\secman.DLL Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556} Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE} Key Found : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager Key Found : HKLM\SOFTWARE\Classes\secman.OutlookSecurityManager.1 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{11549FE4-7C5A-4C17-9FC3-56FC5162A994} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{E69D4A59-73DE-4E38-9FB3-740EC4D9060D} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Steam App 228200 Key Found : HKLM\SOFTWARE\Myfree Codec Key Found : HKLM\SOFTWARE\PIP Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE} Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8FFE} Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{BA14329E-9550-4989-B3F2-9732E92D17CC}] Value Found : HKCU\Software\Mozilla\Firefox\Extensions [magicplayer@torrentstream.org] ***** [ Browsers ] ***** -\\ Internet Explorer v0.0.0.0 -\\ Mozilla Firefox v34.0.5 (x86 en-US) [7r92u0ic.default] - Line Found : user_pref("extensions.4fba2f0a1f1ed.scode", "(function(){try{if('aol.com,mail.google.com,mystart.incredibar.com,premiumreports.info,search.babylon.com,search.funmoods.com,search.gboxapp.com,search.swe[...] -\\ Google Chrome v39.0.2171.95 [C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://uk.ask.com/web?q={searchTerms} [C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\preferences] - Found [Extension] : kpckgflgdapkpabemgkielbefdildaio -\\ Chromium v -\\ Comodo Dragon v15.0 ************************* AdwCleaner[R0].txt - [4203 octets] - [03/01/2015 13:48:49] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [4263 octets] ########## 3. (MBAM) The log didn't seem to save and was blank, there was 6 PUP's as show in this picture: 4 a. (FRST) Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-01-2015 02 Ran by Sean (administrator) on SEAN-PC on 03-01-2015 15:43:27 Running from C:\Users\Sean\Desktop Loaded Profile: Sean (Available profiles: Sean) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 8 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe (AMD) C:\Windows\System32\atiesrxx.exe (AMD) C:\Windows\System32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AnchorFree Inc.) C:\Program Files (x86)\Hotspot Shield\HssWPR\hsssrv.exe () C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe () C:\Windows\SysWOW64\PnkBstrA.exe (Gigabyte Technology CO., LTD.) C:\Program Files (x86)\GIGABYTE\smart6\timelock\TimeMgmtDaemon.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE () C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (COMODO) C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe () C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe (InstallShield Software Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Disc Soft Ltd) C:\Program Files (x86)\DAEMON Tools Lite\DTShellHlp.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Samsung Electronics Co., Ltd.) D:\Programme Folder (2)\Kies\Kies\KiesTrayAgent.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Spotify Ltd) C:\Users\Sean\AppData\Roaming\Spotify\spotify.exe () C:\Users\Sean\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Sean\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Sean\AppData\Roaming\Spotify\Data\SpotifyHelper.exe () C:\Users\Sean\AppData\Roaming\Spotify\Data\SpotifyHelper.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe () C:\Users\Sean\AppData\Roaming\Spotify\Data\SpotifyHelper.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11776104 2011-02-11] (Realtek Semiconductor) HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-07] (COMODO) HKLM\...\Run: [intelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation) HKLM-x32\...\Run: [iSUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-17] (InstallShield Software Corporation) HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-11-06] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [atr.exe] => [X] HKLM-x32\...\Run: [AnySync] => D:\Programme Folder (2)\AnyTime Organizer\SyncLauncher.exe [41984 2011-03-21] (iAnywhere Solutions, Inc.) HKLM-x32\...\Run: [KiesTrayAgent] => D:\Programme Folder (2)\Kies\Kies\KiesTrayAgent.exe [311616 2014-12-16] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-08] (AVAST Software) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation) HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] => C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe [54072 2014-11-21] (Malwarebytes Corporation) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [steam] => D:\Programme Folder (2)\Steam\steam.exe [1939136 2014-08-28] (Valve Corporation) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [EADM] => D:\Programme Folder (2)\Origin\Origin.exe [3588952 2014-03-11] (Electronic Arts) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [] => D:\Programme Folder (2)\Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-12-16] (Samsung) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [spotify Web Helper] => C:\Users\Sean\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1676344 2015-01-03] (Spotify Ltd) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\MountPoints2: {2fbc33c5-49de-11e1-b3ac-806e6f6e6963} - D:\Launch.exe AppInit_DLLs: C:\Windows\system32\guard64.dll => C:\Windows\system32\guard64.dll [390392 2012-11-07] (COMODO) AppInit_DLLs-x32: C:\Windows\SysWOW64\guard32.dll => C:\Windows\SysWOW64\guard32.dll [301264 2012-11-07] (COMODO) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100 Genie.lnk ShortcutTarget: NETGEAR WNA3100 Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe () ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers: [iDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll (Tonec Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) AutoConfigURL: [s-1-5-21-3921608650-3821936656-1871749345-1000] => http://clientconfig.immunicity.org/pacs/all.pac HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/ HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.co.uk/ SearchScopes: HKLM -> DefaultScope value is missing. SearchScopes: HKLM-x32 -> DefaultScope value is missing. BHO: GBHO.BHO -> {45d30484-7ded-43d9-957a-d2fd1f046511} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Smart Recovery 2 - {1d09c093-f71e-43c3-b948-19316cbd695e} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKU\S-1-5-21-3921608650-3821936656-1871749345-1000 -> No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{911C9907-5394-4444-B1EB-A6DB89251C9C}: [NameServer] 192.168.0.1,192.168.0.2 FireFox: ======== FF ProfilePath: C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default FF Homepage: hxxp://www.google.co.uk/ FF NetworkProxy: "autoconfig_url", "http://clientconfig.immunicity.org/pacs/all.pac" FF NetworkProxy: "type", 2 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL No File FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.) FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> D:\Programme Folder (2)\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> D:\Programme Folder (2)\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-3921608650-3821936656-1871749345-1000: @acestream.net/acestreamplugin,version=2.1.7.2 -> C:\Users\Sean\AppData\Roaming\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies) FF Plugin HKU\S-1-5-21-3921608650-3821936656-1871749345-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Sean\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-3921608650-3821936656-1871749345-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File FF SearchPlugin: C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\searchplugins\firefox-add-ons.xml FF SearchPlugin: C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\searchplugins\talktalk-search.xml FF Extension: wxDfast - C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\4fba2f0a1f13d@4fba2f0a1f178.info [2012-05-21] FF Extension: DownloadHelper - C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06] FF Extension: Add Google Search To New Tab Page - C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\newtabgoogle@graememcc.co.uk.xpi [2013-05-06] FF Extension: Adblock Plus - C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-18] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-02-13] FF HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Sean\AppData\Roaming\IDM\idmmzcc5 FF Extension: IDM CC - C:\Users\Sean\AppData\Roaming\IDM\idmmzcc5 [2012-01-30] FF HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Firefox\Extensions: [magicplayer@torrentstream.org] - C:\Users\Sean\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org FF Extension: TS Magic Player - C:\Users\Sean\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org [2013-10-19] FF HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Sean\AppData\Roaming\IDM\idmmzcc5 Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.co.uk/" CHR Profile: C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27] CHR Extension: (Magic Player) - C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpckgflgdapkpabemgkielbefdildaio [2013-12-26] CHR Extension: (Google Wallet) - C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-26] CHR HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Chrome\Extension: [kpckgflgdapkpabemgkielbefdildaio] - C:\Users\Sean\AppData\Roaming\ACEStream\extensions\chrome_new\magicplayer.crx [2013-10-10] CHR HKLM-x32\...\Chrome\Extension: [fgnbbmjplnjojimmnihieecplmnhgfem] - C:\ProgramData\wxDfast\fgnbbmjplnjojimmnihieecplmnhgfem.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-06-16] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] () R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-16] (AVAST Software) R2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-07] (COMODO) R2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [329544 2012-01-04] () R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed] R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-31] () R2 Smart TimeLock; C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [114688 2009-10-13] (Gigabyte Technology CO., LTD.) [File not signed] R2 WSWNA3100; C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [307928 2013-11-11] () S2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [X] S2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21104 2011-01-10] () R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-16] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-16] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-16] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-16] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-16] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-16] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-16] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-16] () R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-08] (Avira GmbH) R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-08] (Avira GmbH) R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-15] (Avira GmbH) R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-07] (COMODO) R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-07] (COMODO) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-09-02] (Disc Soft Ltd) S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2014-10-29] () R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-07] (COMODO) U0 ljvhffru; C:\Windows\System32\drivers\mjlr.sys [79064 2015-01-03] (Malwarebytes Corporation) R0 MBAMSwissArmy; C:\Windows\System32\drivers\MBAMSwissArmy.sys [129752 2015-01-03] (Malwarebytes Corporation) S3 NPF; C:\Windows\System32\DRIVERS\npf.sys [47632 2010-02-03] (CACE Technologies, Inc.) S3 EtronHub3; System32\Drivers\EtronHub3.sys [X] S3 EtronXHCI; System32\Drivers\EtronXHCI.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-03 15:43 - 2015-01-03 15:43 - 00020086 _____ () C:\Users\Sean\Desktop\FRST.txt 2015-01-03 15:40 - 2015-01-03 15:40 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mjlr.sys 2015-01-03 13:50 - 2015-01-03 13:50 - 00004379 _____ () C:\Users\Sean\Desktop\AdwCleaner[R0].txt 2015-01-03 13:48 - 2015-01-03 13:49 - 00000000 ____D () C:\AdwCleaner 2015-01-03 13:47 - 2015-01-03 13:47 - 02173952 _____ () C:\Users\Sean\Desktop\adwcleaner_4.106.exe 2015-01-03 13:46 - 2015-01-03 13:46 - 00000540 _____ () C:\Users\Sean\Desktop\defogger_disable.log 2015-01-03 13:46 - 2015-01-03 13:46 - 00000168 _____ () C:\Users\Sean\defogger_reenable 2015-01-03 13:45 - 2015-01-03 13:45 - 00050477 _____ () C:\Users\Sean\Desktop\Defogger.exe 2015-01-03 11:04 - 2015-01-03 15:43 - 00000000 ____D () C:\FRST 2015-01-03 10:59 - 2015-01-03 15:43 - 02123776 _____ (Farbar) C:\Users\Sean\Desktop\FRST64.exe 2015-01-03 10:54 - 2015-01-03 11:11 - 00001988 _____ () C:\Windows\PFRO.log 2015-01-03 00:30 - 2015-01-03 11:11 - 00000168 _____ () C:\Windows\setupact.log 2015-01-03 00:30 - 2015-01-03 00:30 - 00000000 _____ () C:\Windows\setuperr.log 2015-01-02 19:10 - 2015-01-02 19:10 - 00000000 ____D () C:\Users\Sean\Documents\SelfMV 2015-01-02 19:09 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll 2015-01-02 18:42 - 2015-01-02 18:42 - 00000000 ____D () C:\Users\Sean\Desktop\Odin307 2015-01-02 18:41 - 2015-01-02 18:41 - 01207012 _____ () C:\Users\Sean\Downloads\Odin307.zip 2015-01-02 16:17 - 2015-01-02 16:17 - 00974821 _____ () C:\Users\Sean\Downloads\Odin-3.10.0.zip 2015-01-02 15:42 - 2015-01-02 15:43 - 00000000 ____D () C:\Users\Sean\Documents\carbon 2015-01-02 13:54 - 2015-01-02 13:54 - 00000000 ____D () C:\Users\Sean\.android 2015-01-02 13:53 - 2015-01-02 13:53 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ClockworkMod 2015-01-02 13:53 - 2015-01-02 13:53 - 00000000 ____D () C:\Program Files (x86)\ClockworkMod 2015-01-02 13:51 - 2015-01-02 13:51 - 11060224 _____ () C:\Users\Sean\Downloads\CarbonSetup.msi 2014-12-21 15:00 - 2014-12-21 15:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-12-14 16:42 - 2014-10-18 02:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-14 16:42 - 2014-10-18 01:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-14 16:42 - 2014-07-07 02:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2014-12-14 16:42 - 2014-07-07 02:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2014-12-14 16:42 - 2014-07-07 02:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2014-12-14 16:42 - 2014-07-07 02:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2014-12-14 16:42 - 2014-07-07 01:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2014-12-14 16:42 - 2014-07-07 01:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2014-12-14 16:42 - 2014-07-07 01:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2014-12-14 16:42 - 2014-07-07 01:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2014-12-14 16:00 - 2014-11-11 03:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-14 16:00 - 2014-11-11 02:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-14 16:00 - 2014-11-11 01:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-14 16:00 - 2014-11-08 03:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-14 16:00 - 2014-11-08 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-14 16:00 - 2014-10-30 02:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-14 16:00 - 2014-10-30 01:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-14 16:00 - 2014-10-03 02:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-14 16:00 - 2014-10-03 02:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-14 16:00 - 2014-10-03 02:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-14 16:00 - 2014-10-03 02:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-14 16:00 - 2014-10-03 02:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-14 16:00 - 2014-10-03 01:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-14 16:00 - 2014-10-03 01:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-14 16:00 - 2014-10-03 01:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-14 16:00 - 2014-10-03 01:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-14 16:00 - 2014-10-03 01:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-08 22:39 - 2014-06-16 06:01 - 00206080 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-03 15:43 - 2012-08-08 16:14 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-03 15:42 - 2013-04-15 19:19 - 00000000 ____D () C:\Users\Sean\AppData\Local\CrashDumps 2015-01-03 15:40 - 2012-03-31 23:11 - 00000000 ____D () C:\Program Files (x86)\Vuze 2015-01-03 15:40 - 2009-07-14 03:20 - 00000000 __RSD () C:\Windows\Media 2015-01-03 15:38 - 2012-03-26 08:47 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\Spotify 2015-01-03 14:49 - 2014-11-22 00:18 - 00000000 ____D () C:\Users\Sean\Desktop\Football Manager 2015 2015-01-03 14:38 - 2014-11-10 23:10 - 01598868 _____ () C:\Windows\WindowsUpdate.log 2015-01-03 14:35 - 2013-09-02 20:50 - 00000266 _____ () C:\Windows\Tasks\AutoKMS.job 2015-01-03 13:51 - 2014-09-22 21:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-03 13:46 - 2012-01-28 18:35 - 00000000 ____D () C:\Users\Sean 2015-01-03 11:46 - 2012-01-28 20:29 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\vlc 2015-01-03 11:18 - 2009-07-14 04:45 - 00029136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-03 11:18 - 2009-07-14 04:45 - 00029136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-03 11:15 - 2009-07-14 05:13 - 00786622 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-03 11:11 - 2013-12-26 13:21 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-03 11:11 - 2009-07-14 05:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-03 10:58 - 2014-09-22 21:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2015-01-03 10:58 - 2014-09-22 21:46 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2015-01-03 00:42 - 2012-03-31 23:11 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\Azureus 2015-01-03 00:30 - 2014-02-13 00:19 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-01-02 20:03 - 2012-02-05 19:45 - 00000000 ____D () C:\Users\Sean\Documents\Sports Interactive 2015-01-02 19:11 - 2013-07-07 10:23 - 00000000 ____D () C:\Users\Sean\Documents\samsung 2015-01-02 19:10 - 2013-07-07 10:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung 2015-01-02 19:09 - 2013-10-06 17:44 - 00000000 ____D () C:\Program Files (x86)\Samsung 2015-01-02 19:09 - 2013-07-07 10:23 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\Samsung 2015-01-02 19:09 - 2012-01-28 18:43 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-01-02 15:13 - 2013-10-06 16:07 - 00000000 ____D () C:\Users\Sean\Documents\Mobile Phone Back up 2015-01-02 13:49 - 2012-03-26 08:48 - 00000000 ____D () C:\Users\Sean\AppData\Local\Spotify 2015-01-02 02:19 - 2009-07-14 03:20 - 00000000 ____D () C:\Windows\rescache 2015-01-02 01:11 - 2012-05-24 15:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-01 21:34 - 2012-08-08 16:14 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-01 21:34 - 2012-04-12 17:54 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-01-01 21:34 - 2012-01-29 17:45 - 00000000 ____D () C:\Users\Sean\AppData\Local\Adobe 2015-01-01 21:34 - 2012-01-28 23:17 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-14 16:45 - 2012-06-07 18:24 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-14 16:44 - 2013-08-21 19:58 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-14 16:42 - 2012-01-28 20:40 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe Files to move or delete: ==================== C:\Users\Sean\jagex_cl_runescape_LIVE.dat C:\Users\Sean\random.dat Some content of TEMP: ==================== C:\Users\Sean\AppData\Local\Temp\bccabfcbcej.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-02 02:11 ==================== End Of Log ============================ 4. b (Additional) Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-01-2015 02 Ran by Sean at 2015-01-03 15:44:00 Running from C:\Users\Sean\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: COMODO Defense+ (Enabled - Up to date) {FEEA52D5-051E-08DD-07EF-2F009097607D} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} FW: COMODO Firewall (Enabled) {7DB03214-694B-060B-1600-BD4715C36DBB} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) @BIOS (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.12 - GIGABYTE) 3TB+Unlock B11.0511.1 (HKLM-x32\...\{17630FD1-B14A-4CA5-A627-B6B5F7DD41CF}) (Version: 1.00.0001 - GIGABYTE) 64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden 7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov) Ace Stream Media 2.1.7.2 (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\AceStream) (Version: 2.1.7.2 - Ace Stream Media) Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated) Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated) Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated) Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.7.637 - Adobe Systems, Inc.) AMD Catalyst Install Manager (HKLM\...\{16D0F693-C066-7E30-854B-CADCFEFF9BE4}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.) AnySync (HKLM-x32\...\{8E2BC848-4490-4A19-8304-5A9D79DD33FA}) (Version: 7.1 - Sybase iAnywhere) AnyTime Organizer (HKLM-x32\...\AnyTime Organizer) (Version: 14.1 - Individual Software, Inc) avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software) Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.3.8518 - ) Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.0.0.1 - Electronic Arts) Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.2 - EA Digital Illusions CE AB) BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games) Bitcoin (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Bitcoin) (Version: 0.8.1 - Bitcoin project) Camtasia Studio 7 (HKLM-x32\...\{C0E8FE43-C35B-451D-B35F-D4BD056D70E7}) (Version: 7.1.1 - TechSmith Corporation) Camtasia Studio 8 (HKLM-x32\...\{72144B9D-58C4-4C09-A5CF-C6A914B912E8}) (Version: 8.0.0.878 - TechSmith Corporation) CCleaner (HKLM\...\CCleaner) (Version: 4.00 - Piriform) Chivalry: Medieval Warfare (HKLM-x32\...\Steam App 219640) (Version: - ) Cloud OC (HKLM-x32\...\{65B8A697-C77C-473E-8CE5-1FC5D4917C14}) (Version: 1.00.0000 - GIGABYTE) COMODO Internet Security (HKLM\...\{D6AB1F5B-FED6-49A9-9747-327BD28FB3C7}) (Version: 5.9.25057.2197 - COMODO Security Solutions Inc.) Company of Heroes (New Steam Version) (HKLM-x32\...\Steam App 228200) (Version: - ) Company of Heroes: Tales of Valor (HKLM-x32\...\Steam App 20540) (Version: - Relic) Crysis®3 (HKLM-x32\...\{4198AE83-A3C6-4C41-85C8-EC63E990696E}) (Version: 1.0.0.0 - Electronic Arts) CrystalDiskInfo 6.0.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.1 - Crystal Dew World) DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0337 - Disc Soft Ltd) DJ_AIO_06_F4500_SW_MIN (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden DMIView B8.0717.01 (HKLM-x32\...\{3EE1008C-11A1-4F4F-8DB7-27573924DE78}) (Version: 1.4 - Gigabyte) Easy Tune 6 B11.0512.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE) Easy Tune 6 B11.0512.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB) Face_Wizard B10.1230.01 (HKLM-x32\...\{E76FCE6B-9999-4250-8C75-B2DA4AD41268}) (Version: 1.00.0000 - Gigabyte) Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.01 - Ubisoft) FileBot (HKLM\...\{501B62C1-B2B6-472F-A1CC-850E2C34FB50}) (Version: 3.8 - Reinhard Pointner) Football Manager 2012 (HKLM-x32\...\Football Manager 2012_is1) (Version: - ) Football Manager 2013 (HKLM-x32\...\Steam App 207890) (Version: - Sports Interactive) Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - ) Game Dev Tycoon version 1.3.4 (HKLM-x32\...\{5BBB8682-1335-410F-A79F-8E5611A54BD0}_is1) (Version: 1.3.4 - Greenheart Games Pty. Ltd.) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.) Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Grand Theft Auto Vice City (HKLM-x32\...\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}) (Version: 1.00.000 - ) Helium (HKLM-x32\...\{9A781940-AC41-4D5E-8E1E-76A04B916FB9}) (Version: 1.0.0 - ClockworkMod) HP Deskjet F4500 All-in-One Driver 14.0 Rel. 6 (HKLM\...\{0AFFEA39-60AF-4C4F-BB47-4A1F7CB12129}) (Version: 14.0 - HP) Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle) Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle) Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve) MailWasher (HKLM-x32\...\{4E0B9AF0-5729-4638-AD62-3916F1890631}) (Version: 7.3.0 - Firetrust) Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) MediaInfo 0.7.65 (HKLM\...\MediaInfo) (Version: 0.7.65 - MediaArea.net) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation) Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation) Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation) Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.469.0 - Microsoft Corporation) Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation) MKVToolNix 7.1.0 (64bit) (HKLM-x32\...\MKVToolNix) (Version: 7.1.0 - Moritz Bunkus) Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) MyFreeCodec (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\MyFreeCodec) (Version: - ) NETGEAR WNA3100 wireless USB 2.0 adapter (HKLM-x32\...\{C2425F91-1F7B-4037-9A05-9F290184798D}) (Version: 2.2.0.2 - NETGEAR) Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden ON_OFF Charge B11.0110.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE) Origin (HKLM-x32\...\Origin) (Version: 9.1.15.109 - Electronic Arts, Inc.) PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.38.113.2011 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6307 - Realtek Semiconductor Corp.) Recover My Files (HKLM-x32\...\Recover My Files_is1) (Version: 4.9.4.1343 - GetData Pty Ltd) RuneScape Launcher 1.2 (HKLM-x32\...\{5D87C09F-512F-474A-A306-0FE3B89C396F}) (Version: 1.2.0 - Jagex Ltd) Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.3.13052_10 - Samsung Electronics Co., Ltd.) Samsung Kies (x32 Version: 2.5.3.13052_10 - Samsung Electronics Co., Ltd.) Hidden Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.) Samsung Kies3 (x32 Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.) Hidden Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.) Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Sky Go Desktop (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\295487528.go.sky.com) (Version: - go.sky.com) Smart 6 B11.0512.1 (HKLM-x32\...\{3B35725F-C623-4A1E-B5CC-99C0868679E3}) (Version: 1.00.0000 - GIGABYTE) Source SDK Base 2007 (HKLM-x32\...\Steam App 218) (Version: - Valve) Spotify (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Spotify) (Version: 0.9.15.27.g87efe634 - Spotify AB) Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden The TVDB XML Fetcher for the WDTV Live Hub (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\124d7bfeeda3fda0) (Version: 1.7.1.3 - TVDB XML Fetcher) Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden Total War ROME II (HKLM-x32\...\VG90YWxXYXJST01FSUk=_is1) (Version: 1 - ) TouchBIOS B11.1201.1 (HKLM-x32\...\{A2EBACDD-09BB-4894-AE25-7168DB3BFA7F}) (Version: 1.00.0000 - GIGABYTE) TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation) Unity Web Player (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\UnityWebPlayer) (Version: 4.5.4f1 - Unity Technologies ApS) Update Manager B10.0728.1 (HKLM-x32\...\{2913C8E7-612B-47DA-B18D-A23E1A1B16E3}) (Version: 1.00.0000 - Gigabyte) Virtua Tennis 4™ (HKLM-x32\...\GFWL_{53450FA2-E900-456E-9715-501000008200}) (Version: 1.0.0000.130 - SEGA) Virtua Tennis 4™ (x32 Version: 1.0.0000.130 - SEGA) Hidden Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies) Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies) Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.) VLC media player 2.1.1 (HKLM-x32\...\VLC media player) (Version: 2.1.1 - VideoLAN) VSO ConvertXToDVD (HKLM-x32\...\{CE1F93C0-4353-4C9D-84DA-AB4E7C63ED32}_is1) (Version: 5.0.0.45 - VSO-Software SARL) Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) WinRAR 4.20 (HKLM-x32\...\WinRAR 4.20) (Version: 4.20 - akhilesh910) WinZip 15.0 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}) (Version: 15.0.9411 - WinZip Computing, S.L. ) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 08-12-2014 22:47:52 Windows Update 14-12-2014 16:00:36 Windows Update 14-12-2014 16:41:23 Windows Update 21-12-2014 14:52:27 Windows Update 01-01-2015 21:27:26 Windows Update 02-01-2015 13:53:42 Installed Helium 02-01-2015 19:09:33 Installed Samsung Kies3 03-01-2015 14:36:54 Windows Update 03-01-2015 14:37:22 Windows Update 03-01-2015 14:37:45 Windows Update ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 02:34 - 2009-06-10 21:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {03A2A692-2CBD-44A4-87E0-155BF1B7118D} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation) Task: {25619A79-3877-40BE-8C91-AFE18BF16A16} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-26] (Google Inc.) Task: {2B2FB2BE-54B5-4859-B606-04D3ACDF97FC} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => C:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-10] (Microsoft Corporation) Task: {31C0C6AE-8639-4DCE-8A72-E0E7D15D0F24} - System32\Tasks\CCleanerSkipUAC => D:\Programme Folder (2)\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd) Task: {478EAE79-617A-444E-A355-DB31EAD37025} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-01] (Adobe Systems Incorporated) Task: {8E84773F-E5D1-4CAC-98FA-919BBCD15D76} - System32\Tasks\{F579B0C2-090B-4A66-890C-21B1544A1D1A} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/207890 Task: {92C39818-9E82-4166-9C65-03A7641A7FB5} - System32\Tasks\{9711EFC7-69B1-48A0-963E-F7717AFDB806} => pcalua.exe -a E:\Setup.exe -d E:\ Task: {9552ED31-E773-4037-97CF-F221A8780760} - System32\Tasks\AutoKMS => C:\WINDOWS\AutoKMS\AutoKMS.exe Task: {DB0895D6-5883-458F-85F0-5E8BD6355330} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-26] (Google Inc.) Task: {F362CC32-4732-4905-91A6-7D11FFE3F6B5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {F496804D-7789-4588-A106-5E41D182FBFD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-06-16] (AVAST Software) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\AutoKMS.job => C:\WINDOWS\AutoKMS\AutoKMS.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2012-01-04 23:02 - 2012-01-04 23:02 - 00329544 _____ () C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe 2013-03-30 22:50 - 2013-10-31 20:19 - 00076888 _____ () C:\Windows\SysWOW64\PnkBstrA.exe 2014-05-26 16:46 - 2013-11-11 14:10 - 00307928 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe 2013-02-27 21:45 - 2013-11-22 18:34 - 08266456 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe 2013-12-25 22:05 - 2015-01-03 11:33 - 00374840 _____ () C:\Users\Sean\AppData\Roaming\Spotify\Data\SpotifyHelper.exe 2015-01-03 00:31 - 2015-01-03 00:31 - 02909696 _____ () C:\Program Files\AVAST Software\Avast\defs\15010201\algo.dll 2009-03-30 02:34 - 2009-03-30 02:34 - 00280143 _____ () C:\Program Files (x86)\Hotspot Shield\bin\libidn-11.dll 2009-03-27 20:02 - 2009-03-27 20:02 - 01554920 _____ () C:\Program Files (x86)\Hotspot Shield\bin\libeay32.dll 2009-03-27 20:02 - 2009-03-27 20:02 - 00332254 _____ () C:\Program Files (x86)\Hotspot Shield\bin\libssl32.dll 2014-05-26 16:46 - 2013-10-30 18:06 - 00380928 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiLib.dll 2013-02-27 21:45 - 2013-11-01 16:31 - 00278528 _____ () C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvcLib.dll 2014-02-13 00:19 - 2014-02-13 00:19 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll 2012-03-26 08:48 - 2015-01-03 11:33 - 36966968 _____ () C:\Users\Sean\AppData\Roaming\Spotify\Data\libcef.dll 2014-07-21 21:49 - 2015-01-03 11:33 - 00867896 _____ () C:\Users\Sean\AppData\Roaming\Spotify\Data\ffmpegsumo.dll 2013-12-25 22:05 - 2015-01-03 11:33 - 00886840 _____ () C:\Users\Sean\AppData\Roaming\Spotify\Data\libglesv2.dll 2013-12-25 22:05 - 2015-01-03 11:33 - 00108600 _____ () C:\Users\Sean\AppData\Roaming\Spotify\Data\libegl.dll 2014-12-21 15:00 - 2014-12-21 15:00 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^Users^Sean^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^AnyTime.lnk => C:\Windows\pss\AnyTime.lnk.Startup MSCONFIG\startupreg: Spotify => "C:\Users\Sean\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart ========================= Accounts: ========================== Administrator (S-1-5-21-3921608650-3821936656-1871749345-500 - Administrator - Disabled) Guest (S-1-5-21-3921608650-3821936656-1871749345-501 - Limited - Enabled) HomeGroupUser$ (S-1-5-21-3921608650-3821936656-1871749345-1002 - Limited - Enabled) Sean (S-1-5-21-3921608650-3821936656-1871749345-1000 - Administrator - Enabled) => C:\Users\Sean WDTV Live (S-1-5-21-3921608650-3821936656-1871749345-1003 - Limited - Enabled) ==================== Faulty Device Manager Devices ============= Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Universal Serial Bus (USB) Controller Description: Universal Serial Bus (USB) Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Universal Serial Bus (USB) Controller Description: Universal Serial Bus (USB) Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (01/03/2015 03:42:45 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: fm.exe, version: 15.1.3.0, time stamp: 0x545f6b97 Faulting module name: fm.exe, version: 15.1.3.0, time stamp: 0x545f6b97 Exception code: 0xc0000005 Fault offset: 0x00e7fd96 Faulting process id: 0x1538 Faulting application start time: 0xfm.exe0 Faulting application path: fm.exe1 Faulting module path: fm.exe2 Report Id: fm.exe3 Error: (01/03/2015 01:46:48 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: fm.exe, version: 15.1.3.0, time stamp: 0x545f6b97 Faulting module name: fm.exe, version: 15.1.3.0, time stamp: 0x545f6b97 Exception code: 0xc0000005 Fault offset: 0x00e7fd96 Faulting process id: 0x7a0 Faulting application start time: 0xfm.exe0 Faulting application path: fm.exe1 Faulting module path: fm.exe2 Report Id: fm.exe3 Error: (01/03/2015 11:11:39 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/03/2015 10:56:35 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/03/2015 00:30:57 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/02/2015 06:41:52 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program bccabfcbcej.exe version 23.23.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 18d0 Start Time: 01d026bb7d29ad3c Termination Time: 3 Application Path: C:\Users\Sean\AppData\Local\Temp\bccabfcbcej.exe Report Id: Error: (01/02/2015 06:41:35 PM) (Source: Windows Search Service) (EventID: 1019) (User: ) Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-3921608650-3821936656-1871749345-1000}/">. Error: (01/02/2015 04:10:45 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: ) Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: D:\Programme Folder (2)\Kies\Kies\Kies.exe . Error code = 0x80131f07 Error: (01/02/2015 04:10:44 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: ) Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: D:\Programme Folder (2)\Kies\Kies\Kies.exe . Error code = 0x80131f07 Error: (01/02/2015 01:46:46 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (01/03/2015 02:37:43 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x800f020b: SAMSUNG Electronics Co., Ltd. - Other hardware - SAMSUNG Mobile MTP Device. Error: (01/03/2015 02:37:21 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY) Description: Installation Failure: Windows failed to install the following update with error 0x800f020b: SAMSUNG Electronics Co., Ltd. - Other hardware - SAMSUNG Mobile MTP Device. Error: (01/03/2015 11:11:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Avira Realtime Protection service failed to start due to the following error: %%2 Error: (01/03/2015 11:11:28 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Avira Scheduler service failed to start due to the following error: %%2 Error: (01/03/2015 10:59:52 AM) (Source: DCOM) (EventID: 10005) (User: ) Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F} Error: (01/03/2015 10:59:52 AM) (Source: DCOM) (EventID: 10005) (User: ) Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF} Error: (01/03/2015 10:56:50 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:01 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:01 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:01 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Microsoft Office Sessions: ========================= Error: (01/03/2015 03:42:45 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: fm.exe15.1.3.0545f6b97fm.exe15.1.3.0545f6b97c000000500e7fd96153801d027648432c0d7C:\Users\Sean\Desktop\Football Manager 2015\fm.exeC:\Users\Sean\Desktop\Football Manager 2015\fm.exe291ee66b-935f-11e4-86aa-1c6f65cdbbf0 Error: (01/03/2015 01:46:48 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: fm.exe15.1.3.0545f6b97fm.exe15.1.3.0545f6b97c000000500e7fd967a001d0274ad4c3c070C:\Users\Sean\Desktop\Football Manager 2015\fm.exeC:\Users\Sean\Desktop\Football Manager 2015\fm.exef6649094-934e-11e4-86aa-1c6f65cdbbf0 Error: (01/03/2015 11:11:39 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/03/2015 10:56:35 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/03/2015 00:30:57 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/02/2015 06:41:52 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: bccabfcbcej.exe23.23.0.018d001d026bb7d29ad3c3C:\Users\Sean\AppData\Local\Temp\bccabfcbcej.exe Error: (01/02/2015 06:41:35 PM) (Source: Windows Search Service) (EventID: 1019) (User: ) Description: 300x80040d07iehistory://{S-1-5-21-3921608650-3821936656-1871749345-1000}/ Error: (01/02/2015 04:10:45 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: ) Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: D:\Programme Folder (2)\Kies\Kies\Kies.exe . Error code = 0x80131f07 D:\Programme Folder (2)\Kies\Kies\Kies.exe Error: (01/02/2015 04:10:44 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: ) Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: D:\Programme Folder (2)\Kies\Kies\Kies.exe . Error code = 0x80131f07 D:\Programme Folder (2)\Kies\Kies\Kies.exe Error: (01/02/2015 01:46:46 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2013-06-29 10:48:22.510 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.822 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.791 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.744 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.713 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.682 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.635 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.604 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2012-09-29 20:29:23.089 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\_Genie Timeline\0\C\Windows.old\Windows\winsxs\x86_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_6.0.6001.18000_none_6f8d0e60c043c672\Win32_Tpm.dll because the set of per-page image hashes could not be found on the system. Date: 2012-09-29 20:29:23.058 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\_Genie Timeline\0\C\Windows.old\Windows\winsxs\x86_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_6.0.6001.18000_none_6f8d0e60c043c672\Win32_Tpm.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Intel® Core i5-2500K CPU @ 3.30GHz Percentage of memory in use: 41% Total physical RAM: 8175.12 MB Available physical RAM: 4785.54 MB Total Pagefile: 16348.41 MB Available Pagefile: 12529.28 MB Total Virtual: 8192 MB Available Virtual: 8191.84 MB ==================== Drives ================================ Drive c: (SSD Drive) (Fixed) (Total:119.14 GB) (Free:14.15 GB) NTFS Drive d: (Storage Drive) (Fixed) (Total:586.17 GB) (Free:96.47 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 85801FD9) Partition 1: (Not Active) - (Size=10 GB) - (Type=27) Partition 2: (Active) - (Size=586.2 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: E7F573FB) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS) ==================== End Of Log ============================

Hi This morning when I started up my pc it cut out several times when trying to load the BIOS. I eventually managed to get in after about 5 times of trying. I am unsure if this is a hardware issue or possibly malware. I've copied to logs below if someone could please take a look, thanks! FRST: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-01-2015 Ran by Sean (administrator) on SEAN-PC on 03-01-2015 11:04:24 Running from C:\Users\Sean\Desktop Loaded Profile: Sean (Available profiles: Sean) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 8 (Default browser: FF) Boot Mode: Safe Mode (with Networking) Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11776104 2011-02-11] (Realtek Semiconductor) HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cfp.exe [9577680 2012-11-07] (COMODO) HKLM\...\Run: [intelliPoint] => C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2417032 2011-08-01] (Microsoft Corporation) HKLM\...\Run: [itype] => C:\Program Files\Microsoft IntelliType Pro\itype.exe [1873256 2011-08-10] (Microsoft Corporation) HKLM-x32\...\Run: [iSUSScheduler] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe [81920 2005-02-17] (InstallShield Software Corporation) HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-11-06] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [atr.exe] => [X] HKLM-x32\...\Run: [AnySync] => D:\Programme Folder (2)\AnyTime Organizer\SyncLauncher.exe [41984 2011-03-21] (iAnywhere Solutions, Inc.) HKLM-x32\...\Run: [KiesTrayAgent] => D:\Programme Folder (2)\Kies\Kies\KiesTrayAgent.exe [311616 2014-12-16] (Samsung Electronics Co., Ltd.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-08-08] (AVAST Software) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [steam] => D:\Programme Folder (2)\Steam\steam.exe [1939136 2014-08-28] (Valve Corporation) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [EADM] => D:\Programme Folder (2)\Origin\Origin.exe [3588952 2014-03-11] (Electronic Arts) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [] => D:\Programme Folder (2)\Kies\Kies\External\FirmwareUpdate\KiesPDLR.exe [845120 2014-12-16] (Samsung) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [spotify Web Helper] => C:\Users\Sean\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-11] (Spotify Ltd) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3673696 2013-08-01] (Disc Soft Ltd) HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\MountPoints2: {2fbc33c5-49de-11e1-b3ac-806e6f6e6963} - D:\Launch.exe AppInit_DLLs: C:\Windows\system32\guard64.dll => C:\Windows\system32\guard64.dll [390392 2012-11-07] (COMODO) AppInit_DLLs-x32: C:\Windows\SysWOW64\guard32.dll => C:\Windows\SysWOW64\guard32.dll [301264 2012-11-07] (COMODO) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WNA3100 Genie.lnk ShortcutTarget: NETGEAR WNA3100 Genie.lnk -> C:\Program Files (x86)\NETGEAR\WNA3100\WNA3100.exe () ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers: [iDM Shell Extension] -> {CDC95B92-E27C-4745-A8C5-64A52A78855D} => C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll (Tonec Inc.) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) AutoConfigURL: [s-1-5-21-3921608650-3821936656-1871749345-1000] => http://clientconfig.immunicity.org/pacs/all.pac HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/ HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.co.uk/ SearchScopes: HKLM -> DefaultScope value is missing. SearchScopes: HKLM-x32 -> DefaultScope value is missing. BHO: GBHO.BHO -> {45d30484-7ded-43d9-957a-d2fd1f046511} -> C:\Windows\system32\mscoree.dll (Microsoft Corporation) BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: No Name -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> No File BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Smart Recovery 2 - {1d09c093-f71e-43c3-b948-19316cbd695e} - C:\Windows\system32\mscoree.dll (Microsoft Corporation) Toolbar: HKLM - No Name - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - No File Toolbar: HKU\S-1-5-21-3921608650-3821936656-1871749345-1000 -> No Name - {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File Toolbar: HKU\S-1-5-21-3921608650-3821936656-1871749345-1000 -> No Name - {BA14329E-9550-4989-B3F2-9732E92D17CC} - No File DPF: HKLM-x32 {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/_layouts/ClientBin/ieawsdc32.cab DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Tcpip\..\Interfaces\{911C9907-5394-4444-B1EB-A6DB89251C9C}: [NameServer] 192.168.0.1,192.168.0.2 FireFox: ======== FF ProfilePath: C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default FF Homepage: hxxp://www.google.co.uk/ FF NetworkProxy: "autoconfig_url", "http://clientconfig.immunicity.org/pacs/all.pac" FF NetworkProxy: "type", 2 FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_235.dll () FF Plugin: @java.com/DTPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.55.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @microsoft.com/GENUINE -> disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL No File FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_235.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1167637.dll (Adobe Systems, Inc.) FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 -> C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF Plugin-x32: @esn/npbattlelog,version=2.3.1 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.1\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @esn/npbattlelog,version=2.3.2 -> C:\Program Files (x86)\Battlelog Web Plugins\2.3.2\npbattlelog.dll (EA Digital Illusions CE AB) FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File FF Plugin-x32: @videolan.org/vlc,version=2.0.6 -> D:\Programme Folder (2)\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: @videolan.org/vlc,version=2.1.1 -> D:\Programme Folder (2)\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKU\S-1-5-21-3921608650-3821936656-1871749345-1000: @acestream.net/acestreamplugin,version=2.1.7.2 -> C:\Users\Sean\AppData\Roaming\ACEStream\player\npace_plugin.dll (Innovative Digital Technologies) FF Plugin HKU\S-1-5-21-3921608650-3821936656-1871749345-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Sean\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKU\S-1-5-21-3921608650-3821936656-1871749345-1000: ubisoft.com/uplaypc -> C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File FF SearchPlugin: C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\searchplugins\firefox-add-ons.xml FF SearchPlugin: C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\searchplugins\talktalk-search.xml FF Extension: wxDfast - C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\4fba2f0a1f13d@4fba2f0a1f178.info [2012-05-21] FF Extension: DownloadHelper - C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d} [2014-09-06] FF Extension: Add Google Search To New Tab Page - C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\newtabgoogle@graememcc.co.uk.xpi [2013-05-06] FF Extension: Adblock Plus - C:\Users\Sean\AppData\Roaming\Mozilla\Firefox\Profiles\7r92u0ic.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2012-02-18] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-02-13] FF HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Sean\AppData\Roaming\IDM\idmmzcc5 FF Extension: IDM CC - C:\Users\Sean\AppData\Roaming\IDM\idmmzcc5 [2012-01-30] FF HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Firefox\Extensions: [magicplayer@torrentstream.org] - C:\Users\Sean\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org FF Extension: TS Magic Player - C:\Users\Sean\AppData\Roaming\ACEStream\extensions\firefox\magicplayer@torrentstream.org [2013-10-19] FF HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\Sean\AppData\Roaming\IDM\idmmzcc5 Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.co.uk/" CHR Profile: C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-27] CHR Extension: (Magic Player) - C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\Extensions\kpckgflgdapkpabemgkielbefdildaio [2013-12-26] CHR Extension: (Google Wallet) - C:\Users\Sean\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-26] CHR HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Chrome\Extension: [kpckgflgdapkpabemgkielbefdildaio] - C:\Users\Sean\AppData\Roaming\ACEStream\extensions\chrome_new\magicplayer.crx [2013-10-10] CHR HKLM-x32\...\Chrome\Extension: [fgnbbmjplnjojimmnihieecplmnhgfem] - C:\ProgramData\wxDfast\fgnbbmjplnjojimmnihieecplmnhgfem.crx [Not Found] CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-06-16] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] () S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-06-16] (AVAST Software) S2 cmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [2828408 2012-11-07] (COMODO) S2 HssWd; C:\Program Files (x86)\Hotspot Shield\bin\hsswd.exe [329544 2012-01-04] () S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2009-05-14] (Hewlett-Packard) [File not signed] S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2009-05-14] (Hewlett-Packard) [File not signed] S2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-10-31] () S2 Smart TimeLock; C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe [114688 2009-10-13] (Gigabyte Technology CO., LTD.) [File not signed] S2 WSWNA3100; C:\Program Files (x86)\NETGEAR\WNA3100\WifiSvc.exe [307928 2013-11-11] () S2 AntiVirSchedulerService; "C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe" [X] S2 AntiVirService; "C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) S1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [21104 2011-01-10] () S2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-06-16] () S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-06-16] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-06-16] (AVAST Software) S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-06-16] () S1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-06-16] (AVAST Software) S1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-06-16] (AVAST Software) S2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-06-16] (AVAST Software) S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-06-16] () S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [98848 2012-05-08] (Avira GmbH) S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132832 2012-05-08] (Avira GmbH) S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [27760 2011-09-15] (Avira GmbH) S1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [584056 2012-11-07] (COMODO) R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [38144 2012-11-07] (COMODO) R3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2013-09-02] (Disc Soft Ltd) S3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2014-10-29] () R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [94288 2012-11-07] (COMODO) S3 NPF; C:\Windows\System32\DRIVERS\npf.sys [47632 2010-02-03] (CACE Technologies, Inc.) S3 EtronHub3; System32\Drivers\EtronHub3.sys [X] S3 EtronXHCI; System32\Drivers\EtronXHCI.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-03 11:04 - 2015-01-03 11:04 - 00017758 _____ () C:\Users\Sean\Desktop\FRST.txt 2015-01-03 11:04 - 2015-01-03 11:04 - 00000000 ____D () C:\FRST 2015-01-03 10:59 - 2015-01-03 10:59 - 02123264 _____ (Farbar) C:\Users\Sean\Desktop\FRST64.exe 2015-01-03 10:54 - 2015-01-03 10:54 - 00000332 _____ () C:\Windows\PFRO.log 2015-01-03 00:30 - 2015-01-03 10:27 - 00000112 _____ () C:\Windows\setupact.log 2015-01-03 00:30 - 2015-01-03 00:30 - 00000000 _____ () C:\Windows\setuperr.log 2015-01-02 19:10 - 2015-01-02 19:10 - 00000000 ____D () C:\Users\Sean\Documents\SelfMV 2015-01-02 19:09 - 2014-05-07 17:42 - 00144664 _____ (MAPILab Ltd. & Add-in Express Ltd.) C:\Windows\SysWOW64\secman.dll 2015-01-02 18:42 - 2015-01-02 18:42 - 00000000 ____D () C:\Users\Sean\Desktop\Odin307 2015-01-02 18:41 - 2015-01-02 18:41 - 01207012 _____ () C:\Users\Sean\Downloads\Odin307.zip 2015-01-02 16:17 - 2015-01-02 16:17 - 00974821 _____ () C:\Users\Sean\Downloads\Odin-3.10.0.zip 2015-01-02 15:42 - 2015-01-02 15:43 - 00000000 ____D () C:\Users\Sean\Documents\carbon 2015-01-02 13:54 - 2015-01-02 13:54 - 00000000 ____D () C:\Users\Sean\.android 2015-01-02 13:53 - 2015-01-02 13:53 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ClockworkMod 2015-01-02 13:53 - 2015-01-02 13:53 - 00000000 ____D () C:\Program Files (x86)\ClockworkMod 2015-01-02 13:51 - 2015-01-02 13:51 - 11060224 _____ () C:\Users\Sean\Downloads\CarbonSetup.msi 2014-12-21 15:00 - 2014-12-21 15:00 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-12-14 16:42 - 2014-10-18 02:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-14 16:42 - 2014-10-18 01:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-14 16:42 - 2014-07-07 02:06 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll 2014-12-14 16:42 - 2014-07-07 02:06 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe 2014-12-14 16:42 - 2014-07-07 02:06 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe 2014-12-14 16:42 - 2014-07-07 02:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll 2014-12-14 16:42 - 2014-07-07 01:40 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll 2014-12-14 16:42 - 2014-07-07 01:39 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe 2014-12-14 16:42 - 2014-07-07 01:39 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe 2014-12-14 16:42 - 2014-07-07 01:37 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll 2014-12-14 16:00 - 2014-11-11 03:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-14 16:00 - 2014-11-11 02:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-14 16:00 - 2014-11-11 01:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-14 16:00 - 2014-11-08 03:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-14 16:00 - 2014-11-08 02:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-14 16:00 - 2014-10-30 02:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-14 16:00 - 2014-10-30 01:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-14 16:00 - 2014-10-03 02:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-14 16:00 - 2014-10-03 02:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-14 16:00 - 2014-10-03 02:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-14 16:00 - 2014-10-03 02:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-14 16:00 - 2014-10-03 02:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-14 16:00 - 2014-10-03 01:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-14 16:00 - 2014-10-03 01:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-14 16:00 - 2014-10-03 01:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-14 16:00 - 2014-10-03 01:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-14 16:00 - 2014-10-03 01:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-08 22:39 - 2014-06-16 06:01 - 00206080 _____ (DEVGURU Co., LTD.(www.devguru.co.kr)) C:\Windows\system32\Drivers\ssudmdm.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2015-01-03 10:59 - 2009-07-14 05:13 - 00786622 _____ () C:\Windows\system32\PerfStringBackup.INI 2015-01-03 10:58 - 2014-09-22 21:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2015-01-03 10:58 - 2014-09-22 21:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2015-01-03 10:58 - 2014-09-22 21:46 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2015-01-03 10:55 - 2012-03-31 23:11 - 00000000 ____D () C:\Program Files (x86)\Vuze 2015-01-03 10:27 - 2013-12-26 13:21 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2015-01-03 10:27 - 2013-09-02 20:50 - 00000266 _____ () C:\Windows\Tasks\AutoKMS.job 2015-01-03 10:27 - 2009-07-14 05:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2015-01-03 01:12 - 2014-11-10 23:10 - 01528487 _____ () C:\Windows\WindowsUpdate.log 2015-01-03 00:43 - 2012-08-08 16:14 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2015-01-03 00:42 - 2012-03-31 23:11 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\Azureus 2015-01-03 00:37 - 2009-07-14 04:45 - 00029136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2015-01-03 00:37 - 2009-07-14 04:45 - 00029136 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2015-01-03 00:30 - 2014-02-13 00:19 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2015-01-02 20:03 - 2012-02-05 19:45 - 00000000 ____D () C:\Users\Sean\Documents\Sports Interactive 2015-01-02 19:54 - 2012-03-26 08:47 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\Spotify 2015-01-02 19:11 - 2013-07-07 10:23 - 00000000 ____D () C:\Users\Sean\Documents\samsung 2015-01-02 19:10 - 2013-07-07 10:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Samsung 2015-01-02 19:09 - 2013-10-06 17:44 - 00000000 ____D () C:\Program Files (x86)\Samsung 2015-01-02 19:09 - 2013-07-07 10:23 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\Samsung 2015-01-02 19:09 - 2012-01-28 18:43 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information 2015-01-02 15:34 - 2012-01-28 20:29 - 00000000 ____D () C:\Users\Sean\AppData\Roaming\vlc 2015-01-02 15:13 - 2013-10-06 16:07 - 00000000 ____D () C:\Users\Sean\Documents\Mobile Phone Back up 2015-01-02 13:54 - 2012-01-28 18:35 - 00000000 ____D () C:\Users\Sean 2015-01-02 13:49 - 2012-03-26 08:48 - 00000000 ____D () C:\Users\Sean\AppData\Local\Spotify 2015-01-02 02:19 - 2009-07-14 03:20 - 00000000 ____D () C:\Windows\rescache 2015-01-02 01:11 - 2012-05-24 15:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2015-01-01 21:34 - 2012-08-08 16:14 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2015-01-01 21:34 - 2012-04-12 17:54 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2015-01-01 21:34 - 2012-01-29 17:45 - 00000000 ____D () C:\Users\Sean\AppData\Local\Adobe 2015-01-01 21:34 - 2012-01-28 23:17 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-14 16:45 - 2012-06-07 18:24 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-14 16:44 - 2013-08-21 19:58 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-14 16:42 - 2012-01-28 20:40 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe Files to move or delete: ==================== C:\Users\Sean\jagex_cl_runescape_LIVE.dat C:\Users\Sean\random.dat Some content of TEMP: ==================== C:\Users\Sean\AppData\Local\Temp\bccabfcbcej.exe C:\Users\Sean\AppData\Local\Temp\i4jdel0.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2015-01-02 02:11 ==================== End Of Log ============================ ADDITION: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-01-2015 Ran by Sean at 2015-01-03 11:04:38 Running from C:\Users\Sean\Desktop Boot Mode: Safe Mode (with Networking) ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: COMODO Defense+ (Enabled - Up to date) {FEEA52D5-051E-08DD-07EF-2F009097607D} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} FW: COMODO Firewall (Enabled) {7DB03214-694B-060B-1600-BD4715C36DBB} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) @BIOS (HKLM-x32\...\{B2DC3F08-2EB2-49A5-AA24-15DFC8B1CB83}) (Version: 2.12 - GIGABYTE) 3TB+Unlock B11.0511.1 (HKLM-x32\...\{17630FD1-B14A-4CA5-A627-B6B5F7DD41CF}) (Version: 1.00.0001 - GIGABYTE) 64 Bit HP CIO Components Installer (Version: 6.2.2 - Hewlett-Packard) Hidden 7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov) Ace Stream Media 2.1.7.2 (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\AceStream) (Version: 2.1.7.2 - Ace Stream Media) Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.246 - Adobe Systems Incorporated) Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.235 - Adobe Systems Incorporated) Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated) Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.7.637 - Adobe Systems, Inc.) AMD Catalyst Install Manager (HKLM\...\{16D0F693-C066-7E30-854B-CADCFEFF9BE4}) (Version: 8.0.903.0 - Advanced Micro Devices, Inc.) AnySync (HKLM-x32\...\{8E2BC848-4490-4A19-8304-5A9D79DD33FA}) (Version: 7.1 - Sybase iAnywhere) AnyTime Organizer (HKLM-x32\...\AnyTime Organizer) (Version: 14.1 - Individual Software, Inc) avast! Free Antivirus (HKLM-x32\...\Avast) (Version: 9.0.2018 - Avast Software) Avidemux 2.6 (32-bit) (HKLM-x32\...\Avidemux 2.6) (Version: 2.6.3.8518 - ) Battlefield 4™ (HKLM-x32\...\{ABADE36E-EC37-413B-8179-B432AD3FACE7}) (Version: 1.0.0.1 - Electronic Arts) Battlelog Web Plugins (HKLM-x32\...\Battlelog Web Plugins) (Version: 2.3.2 - EA Digital Illusions CE AB) BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games) Bitcoin (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Bitcoin) (Version: 0.8.1 - Bitcoin project) Camtasia Studio 7 (HKLM-x32\...\{C0E8FE43-C35B-451D-B35F-D4BD056D70E7}) (Version: 7.1.1 - TechSmith Corporation) Camtasia Studio 8 (HKLM-x32\...\{72144B9D-58C4-4C09-A5CF-C6A914B912E8}) (Version: 8.0.0.878 - TechSmith Corporation) CCleaner (HKLM\...\CCleaner) (Version: 4.00 - Piriform) Chivalry: Medieval Warfare (HKLM-x32\...\Steam App 219640) (Version: - ) Cloud OC (HKLM-x32\...\{65B8A697-C77C-473E-8CE5-1FC5D4917C14}) (Version: 1.00.0000 - GIGABYTE) COMODO Internet Security (HKLM\...\{D6AB1F5B-FED6-49A9-9747-327BD28FB3C7}) (Version: 5.9.25057.2197 - COMODO Security Solutions Inc.) Company of Heroes (New Steam Version) (HKLM-x32\...\Steam App 228200) (Version: - ) Company of Heroes: Tales of Valor (HKLM-x32\...\Steam App 20540) (Version: - Relic) Crysis®3 (HKLM-x32\...\{4198AE83-A3C6-4C41-85C8-EC63E990696E}) (Version: 1.0.0.0 - Electronic Arts) CrystalDiskInfo 6.0.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.0.1 - Crystal Dew World) DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.47.1.0337 - Disc Soft Ltd) DJ_AIO_06_F4500_SW_MIN (x32 Version: 140.0.690.000 - Hewlett-Packard) Hidden DMIView B8.0717.01 (HKLM-x32\...\{3EE1008C-11A1-4F4F-8DB7-27573924DE78}) (Version: 1.4 - Gigabyte) Easy Tune 6 B11.0512.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE) Easy Tune 6 B11.0512.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden ESN Sonar (HKLM-x32\...\ESN Sonar-0.70.4) (Version: 0.70.4 - ESN Social Software AB) Face_Wizard B10.1230.01 (HKLM-x32\...\{E76FCE6B-9999-4250-8C75-B2DA4AD41268}) (Version: 1.00.0000 - Gigabyte) Far Cry 3 (HKLM-x32\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.01 - Ubisoft) FileBot (HKLM\...\{501B62C1-B2B6-472F-A1CC-850E2C34FB50}) (Version: 3.8 - Reinhard Pointner) Football Manager 2012 (HKLM-x32\...\Football Manager 2012_is1) (Version: - ) Football Manager 2013 (HKLM-x32\...\Steam App 207890) (Version: - Sports Interactive) Fraps (remove only) (HKLM-x32\...\Fraps) (Version: - ) Game Dev Tycoon version 1.3.4 (HKLM-x32\...\{5BBB8682-1335-410F-A79F-8E5611A54BD0}_is1) (Version: 1.3.4 - Greenheart Games Pty. Ltd.) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.) Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Grand Theft Auto Vice City (HKLM-x32\...\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}) (Version: 1.00.000 - ) Helium (HKLM-x32\...\{9A781940-AC41-4D5E-8E1E-76A04B916FB9}) (Version: 1.0.0 - ClockworkMod) HP Deskjet F4500 All-in-One Driver 14.0 Rel. 6 (HKLM\...\{0AFFEA39-60AF-4C4F-BB47-4A1F7CB12129}) (Version: 14.0 - HP) Java 7 Update 55 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417055FF}) (Version: 7.0.550 - Oracle) Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle) Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve) MailWasher (HKLM-x32\...\{4E0B9AF0-5729-4638-AD62-3916F1890631}) (Version: 7.3.0 - Firetrust) Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation) MediaInfo 0.7.65 (HKLM\...\MediaInfo) (Version: 0.7.65 - MediaArea.net) Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation) Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation) Microsoft IntelliPoint 8.2 (HKLM\...\Microsoft IntelliPoint 8.2) (Version: 8.20.468.0 - Microsoft Corporation) Microsoft IntelliType Pro 8.2 (HKLM\...\Microsoft IntelliType Pro 8.2) (Version: 8.20.469.0 - Microsoft Corporation) Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610 (HKLM-x32\...\{a1909659-0a08-4554-8af1-2175904903a1}) (Version: 11.0.60610.1 - Microsoft Corporation) MKVToolNix 7.1.0 (64bit) (HKLM-x32\...\MKVToolNix) (Version: 7.1.0 - Moritz Bunkus) Mozilla Firefox 34.0.5 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 34.0.5 (x86 en-US)) (Version: 34.0.5 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) MyFreeCodec (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\MyFreeCodec) (Version: - ) NETGEAR WNA3100 wireless USB 2.0 adapter (HKLM-x32\...\{C2425F91-1F7B-4037-9A05-9F290184798D}) (Version: 2.2.0.2 - NETGEAR) Network64 (Version: 140.0.215.000 - Hewlett-Packard) Hidden ON_OFF Charge B11.0110.1 (HKLM-x32\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE) Origin (HKLM-x32\...\Origin) (Version: 9.1.15.109 - Electronic Arts, Inc.) PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.993 - Even Balance, Inc.) Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.38.113.2011 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6307 - Realtek Semiconductor Corp.) Recover My Files (HKLM-x32\...\Recover My Files_is1) (Version: 4.9.4.1343 - GetData Pty Ltd) RuneScape Launcher 1.2 (HKLM-x32\...\{5D87C09F-512F-474A-A306-0FE3B89C396F}) (Version: 1.2.0 - Jagex Ltd) Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.3.13052_10 - Samsung Electronics Co., Ltd.) Samsung Kies (x32 Version: 2.5.3.13052_10 - Samsung Electronics Co., Ltd.) Hidden Samsung Kies3 (HKLM-x32\...\InstallShield_{88547073-C566-4895-9005-EBE98EA3F7C7}) (Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.) Samsung Kies3 (x32 Version: 3.2.14113.3 - Samsung Electronics Co., Ltd.) Hidden Samsung Story Album Viewer (HKLM-x32\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Samsung Story Album Viewer (x32 Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.49.0 - SAMSUNG Electronics Co., Ltd.) Scan (x32 Version: 140.0.80.000 - Hewlett-Packard) Hidden Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft) Sky Go Desktop (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\295487528.go.sky.com) (Version: - go.sky.com) Smart 6 B11.0512.1 (HKLM-x32\...\{3B35725F-C623-4A1E-B5CC-99C0868679E3}) (Version: 1.00.0000 - GIGABYTE) Source SDK Base 2007 (HKLM-x32\...\Steam App 218) (Version: - Valve) Spotify (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB) Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden The TVDB XML Fetcher for the WDTV Live Hub (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\124d7bfeeda3fda0) (Version: 1.7.1.3 - TVDB XML Fetcher) Toolbox (x32 Version: 140.0.428.000 - Hewlett-Packard) Hidden Total War ROME II (HKLM-x32\...\VG90YWxXYXJST01FSUk=_is1) (Version: 1 - ) TouchBIOS B11.1201.1 (HKLM-x32\...\{A2EBACDD-09BB-4894-AE25-7168DB3BFA7F}) (Version: 1.00.0000 - GIGABYTE) TrueCrypt (HKLM-x32\...\TrueCrypt) (Version: 7.1a - TrueCrypt Foundation) Unity Web Player (HKU\S-1-5-21-3921608650-3821936656-1871749345-1000\...\UnityWebPlayer) (Version: 4.5.4f1 - Unity Technologies ApS) Update Manager B10.0728.1 (HKLM-x32\...\{2913C8E7-612B-47DA-B18D-A23E1A1B16E3}) (Version: 1.00.0000 - Gigabyte) Virtua Tennis 4™ (HKLM-x32\...\GFWL_{53450FA2-E900-456E-9715-501000008200}) (Version: 1.0.0000.130 - SEGA) Virtua Tennis 4™ (x32 Version: 1.0.0000.130 - SEGA) Hidden Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies) Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies) Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.) VLC media player 2.1.1 (HKLM-x32\...\VLC media player) (Version: 2.1.1 - VideoLAN) VSO ConvertXToDVD (HKLM-x32\...\{CE1F93C0-4353-4C9D-84DA-AB4E7C63ED32}_is1) (Version: 5.0.0.45 - VSO-Software SARL) Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation) WinRAR 4.20 (HKLM-x32\...\WinRAR 4.20) (Version: 4.20 - akhilesh910) WinZip 15.0 (HKLM-x32\...\{CD95F661-A5C4-44F5-A6AA-ECDD91C240C1}) (Version: 15.0.9411 - WinZip Computing, S.L. ) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) ==================== Restore Points ========================= 28-11-2014 22:48:48 Windows Update 03-12-2014 23:32:35 Windows Update 08-12-2014 22:47:52 Windows Update 14-12-2014 16:00:36 Windows Update 14-12-2014 16:41:23 Windows Update 21-12-2014 14:52:27 Windows Update 01-01-2015 21:27:26 Windows Update 02-01-2015 13:53:42 Installed Helium 02-01-2015 19:09:33 Installed Samsung Kies3 ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 02:34 - 2009-06-10 21:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {03A2A692-2CBD-44A4-87E0-155BF1B7118D} - System32\Tasks\Microsoft_Hardware_Launch_IPoint_exe => C:\Program Files\Microsoft IntelliPoint\IPoint.exe [2011-08-01] (Microsoft Corporation) Task: {25619A79-3877-40BE-8C91-AFE18BF16A16} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-26] (Google Inc.) Task: {2B2FB2BE-54B5-4859-B606-04D3ACDF97FC} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => C:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-08-10] (Microsoft Corporation) Task: {31C0C6AE-8639-4DCE-8A72-E0E7D15D0F24} - System32\Tasks\CCleanerSkipUAC => D:\Programme Folder (2)\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd) Task: {478EAE79-617A-444E-A355-DB31EAD37025} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-01] (Adobe Systems Incorporated) Task: {8E84773F-E5D1-4CAC-98FA-919BBCD15D76} - System32\Tasks\{F579B0C2-090B-4A66-890C-21B1544A1D1A} => pcalua.exe -a "C:\Program Files (x86)\Steam\steam.exe" -c steam://uninstall/207890 Task: {92C39818-9E82-4166-9C65-03A7641A7FB5} - System32\Tasks\{9711EFC7-69B1-48A0-963E-F7717AFDB806} => pcalua.exe -a E:\Setup.exe -d E:\ Task: {9552ED31-E773-4037-97CF-F221A8780760} - System32\Tasks\AutoKMS => C:\WINDOWS\AutoKMS\AutoKMS.exe Task: {DB0895D6-5883-458F-85F0-5E8BD6355330} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-26] (Google Inc.) Task: {F362CC32-4732-4905-91A6-7D11FFE3F6B5} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {F496804D-7789-4588-A106-5E41D182FBFD} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2014-06-16] (AVAST Software) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\AutoKMS.job => C:\WINDOWS\AutoKMS\AutoKMS.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-12-21 15:00 - 2014-12-21 15:00 - 03758192 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2" ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^Users^Sean^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^AnyTime.lnk => C:\Windows\pss\AnyTime.lnk.Startup MSCONFIG\startupreg: Spotify => "C:\Users\Sean\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart ========================= Accounts: ========================== Administrator (S-1-5-21-3921608650-3821936656-1871749345-500 - Administrator - Disabled) Guest (S-1-5-21-3921608650-3821936656-1871749345-501 - Limited - Enabled) HomeGroupUser$ (S-1-5-21-3921608650-3821936656-1871749345-1002 - Limited - Enabled) Sean (S-1-5-21-3921608650-3821936656-1871749345-1000 - Administrator - Enabled) => C:\Users\Sean WDTV Live (S-1-5-21-3921608650-3821936656-1871749345-1003 - Limited - Enabled) ==================== Faulty Device Manager Devices ============= Name: avast! Revert Description: avast! Revert Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: aswRvrt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: avast! VM Monitor Description: avast! VM Monitor Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: aswVmm Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Description: Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Security Processor Loader Driver Description: Security Processor Loader Driver Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: spldr Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Universal Serial Bus (USB) Controller Description: Universal Serial Bus (USB) Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: Universal Serial Bus (USB) Controller Description: Universal Serial Bus (USB) Controller Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. ==================== Event log errors: ========================= Application errors: ================== Error: (01/03/2015 10:56:35 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/03/2015 00:30:57 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/02/2015 06:41:52 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program bccabfcbcej.exe version 23.23.0.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel. Process ID: 18d0 Start Time: 01d026bb7d29ad3c Termination Time: 3 Application Path: C:\Users\Sean\AppData\Local\Temp\bccabfcbcej.exe Report Id: Error: (01/02/2015 06:41:35 PM) (Source: Windows Search Service) (EventID: 1019) (User: ) Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-3921608650-3821936656-1871749345-1000}/">. Error: (01/02/2015 04:10:45 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: ) Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: D:\Programme Folder (2)\Kies\Kies\Kies.exe . Error code = 0x80131f07 Error: (01/02/2015 04:10:44 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: ) Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: D:\Programme Folder (2)\Kies\Kies\Kies.exe . Error code = 0x80131f07 Error: (01/02/2015 01:46:46 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/02/2015 01:42:29 AM) (Source: Windows Search Service) (EventID: 1019) (User: ) Description: Windows Search Service failed to process the list of included and excluded locations with the error <30, 0x80040d07, "iehistory://{S-1-5-21-3921608650-3821936656-1871749345-1000}/">. Error: (01/02/2015 01:12:44 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/01/2015 09:23:39 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (01/03/2015 10:59:52 AM) (Source: DCOM) (EventID: 10005) (User: ) Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F} Error: (01/03/2015 10:59:52 AM) (Source: DCOM) (EventID: 10005) (User: ) Description: 1068fdPHost{145B4335-FE2A-4927-A040-7C35AD3180EF} Error: (01/03/2015 10:56:50 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:01 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:01 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:01 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:01 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:00 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:00 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (01/03/2015 10:55:00 AM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Microsoft Office Sessions: ========================= Error: (01/03/2015 10:56:35 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/03/2015 00:30:57 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/02/2015 06:41:52 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: bccabfcbcej.exe23.23.0.018d001d026bb7d29ad3c3C:\Users\Sean\AppData\Local\Temp\bccabfcbcej.exe Error: (01/02/2015 06:41:35 PM) (Source: Windows Search Service) (EventID: 1019) (User: ) Description: 300x80040d07iehistory://{S-1-5-21-3921608650-3821936656-1871749345-1000}/ Error: (01/02/2015 04:10:45 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: ) Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: D:\Programme Folder (2)\Kies\Kies\Kies.exe . Error code = 0x80131f07 D:\Programme Folder (2)\Kies\Kies\Kies.exe Error: (01/02/2015 04:10:44 PM) (Source: .NET Runtime Optimization Service) (EventID: 1101) (User: ) Description: .NET Runtime Optimization Service (clr_optimization_v4.0.30319_64) - 1>Failed to compile: D:\Programme Folder (2)\Kies\Kies\Kies.exe . Error code = 0x80131f07 D:\Programme Folder (2)\Kies\Kies\Kies.exe Error: (01/02/2015 01:46:46 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/02/2015 01:42:29 AM) (Source: Windows Search Service) (EventID: 1019) (User: ) Description: 300x80040d07iehistory://{S-1-5-21-3921608650-3821936656-1871749345-1000}/ Error: (01/02/2015 01:12:44 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/01/2015 09:23:39 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2013-06-29 10:48:22.510 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.822 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.791 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.744 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.713 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.682 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.635 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2013-06-29 10:42:07.604 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume4\Users\Sean\Desktop\testdisk-6.14-WIP\recup_dir.1\f7025816.exe because the set of per-page image hashes could not be found on the system. Date: 2012-09-29 20:29:23.089 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\_Genie Timeline\0\C\Windows.old\Windows\winsxs\x86_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_6.0.6001.18000_none_6f8d0e60c043c672\Win32_Tpm.dll because the set of per-page image hashes could not be found on the system. Date: 2012-09-29 20:29:23.058 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume5\_Genie Timeline\0\C\Windows.old\Windows\winsxs\x86_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_6.0.6001.18000_none_6f8d0e60c043c672\Win32_Tpm.dll because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Processor: Intel® Core i5-2500K CPU @ 3.30GHz Percentage of memory in use: 16% Total physical RAM: 8175.12 MB Available physical RAM: 6865.99 MB Total Pagefile: 16348.41 MB Available Pagefile: 15103.12 MB Total Virtual: 8192 MB Available Virtual: 8191.81 MB ==================== Drives ================================ Drive c: (SSD Drive) (Fixed) (Total:119.14 GB) (Free:15.33 GB) NTFS Drive d: (Storage Drive) (Fixed) (Total:586.17 GB) (Free:96.47 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 596.2 GB) (Disk ID: 85801FD9) Partition 1: (Not Active) - (Size=10 GB) - (Type=27) Partition 2: (Active) - (Size=586.2 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (MBR Code: Windows 7 or 8) (Size: 119.2 GB) (Disk ID: E7F573FB) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=119.1 GB) - (Type=07 NTFS) ==================== End Of Log ============================

I have had to give the pc back to my girlfriends dad so we did as much as we could. Feel free to close the topic now

Progress with what how its running? Seems to be running ok apart from it still won't boot first time on a restart, only after a full shutdown. Also the fact OTL and FRST won't run from the desktop. If these are ok then I think we're all good?

Never mind I managed to do it haha: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 18-11-2013 Ran by Gaitens at 2013-11-21 20:05:54 Run:1 Running from C:\Documents and Settings\Gaitens\Local Settings\Temporary Internet Files\Content.IE5\7CHD5C1M Boot Mode: Normal ============================================== Content of fixlist: ***************** C:\Documents and Settings\Gaitens\Local Settings\temp\ntdll_dump.dll ***************** C:\Documents and Settings\Gaitens\Local Settings\temp\ntdll_dump.dll => Moved successfully. ==== End of Fixlog ====

Any idea how to do this as I'm not running it off the desktop as I said before i'm running it from the temp folder through Internet explorer so i'm unsure where i would save the fixlist to?!

As above changing the name of the file didn't do anything however; I was able to run FRST through the temp folder i.e clicking on run instead of saving it to the desktop so I will post the log of this below and attach the additional log. I was unable to do the same for the OTL scan as it comes up with an error message saying it cannot be run from the temp folder. **PLEASE NOTE** The delta application you asked me uninstall at the begining has reappeared due to me re-installing a driver that was needed for an additional sound card that is attached to this machine which was not being recongnized. When I click on more info on the add/remove programms page it does said for more info see M-Audio which is the driver that is required for the sound card so it appears this is ok ? FRST log: Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 18-11-2013 Ran by Gaitens (administrator) on GAITENS-PC on 21-11-2013 00:49:29 Running from C:\Documents and Settings\Gaitens\Local Settings\Temporary Internet Files\Content.IE5\7CHD5C1M Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: English(US) Internet Explorer Version 8 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe (ATI Technologies Inc.) C:\WINDOWS\system32\Ati2evxx.exe (Atheros) C:\WINDOWS\system32\acs.exe (Lavasoft Limited) C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.3.107.0\BBSvc.exe (Oracle Corporation) C:\Program Files\Java\jre7\bin\jqs.exe (Alcatel-Lucent) C:\Program Files\Common Files\Motive\McciCMService.exe (Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE () C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe (HP) C:\WINDOWS\system32\HPZipm12.exe (GFI Software) C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe () C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe (Motive Communications, Inc.) C:\Program Files\btbb_wcm\McciTrayApp.exe (Yahoo! Inc.) C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe (Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe () C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe (Yahoo!, Inc.) C:\PROGRA~1\Yahoo!\browser\ycommon.exe (Realtek Semiconductor Corp.) C:\WINDOWS\SOUNDMAN.EXE (Adobe Systems Incorporated) C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Lavasoft) C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe (Avid Technology, Inc.) C:\WINDOWS\System32\M-AudioTaskBarIcon.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (Logitech) C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Spotify Ltd) C:\Program Files\Spotify\Data\SpotifyWebHelper.exe (Logitech Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe (Lavasoft Limited) C:\PROGRA~1\AD-AWA~1\AdAware.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe () C:\Program Files\NETGEAR\WNA1100\WNA1100.exe () C:\Program Files\NETGEAR\WNA3100\WNA3100.exe (Logitech Inc.) C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Microsoft Corporation) C:\Program Files\internet explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\internet explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\internet explorer\iexplore.exe (Microsoft Corporation.) C:\Program Files\Microsoft\BingBar\7.3.107.0\SeaPort.exe (Farbar) C:\Documents and Settings\Gaitens\Local Settings\Temporary Internet Files\Content.IE5\7CHD5C1M\FRST[2].exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [HotKeysCmds] - C:\WINDOWS\system32\hkcmd.exe [ ] () HKLM\...\Run: [Logitech Hardware Abstraction Layer] - C:\WINDOWS\KHALMNPR.Exe [94208 2006-05-10] (Logitech Inc.) HKLM\...\Run: [btbb_wcm_McciTrayApp] - C:\Program Files\btbb_wcm\McciTrayApp.exe [935936 2006-12-07] (Motive Communications, Inc.) HKLM\...\Run: [btbb_McciTrayApp] - C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe [1584640 2009-09-14] (Alcatel-Lucent) HKLM\...\Run: [YBrowser] - C:\Program Files\Yahoo!\browser\ybrwicon.exe [129536 2006-07-21] (Yahoo! Inc.) HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2011-11-01] (Apple Inc.) HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421736 2012-01-16] (Apple Inc.) HKLM\...\Run: [HTC Sync Loader] - C:\Program Files\HTC\HTC Sync 3.0\htcUPCTLoader.exe [634880 2012-04-01] () HKLM\...\Run: [RTHDCPL] - C:\WINDOWS\RTHDCPL.exe [16855552 2007-10-25] (Realtek Semiconductor Corp.) HKLM\...\Run: [skyTel] - C:\WINDOWS\SkyTel.exe [1826816 2007-10-11] (Realtek Semiconductor Corp.) HKLM\...\Run: [soundMan] - C:\WINDOWS\SoundMan.exe [86016 2006-07-21] (Realtek Semiconductor Corp.) HKLM\...\Run: [AlcWzrd] - C:\WINDOWS\alcwzrd.exe [2808832 2006-05-04] (RealTek Semicoductor Corp.) HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe [37296 2012-03-27] (Adobe Systems Incorporated) HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM\...\Run: [Ad-Aware Antivirus] - "C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher" --windows-run HKLM\...\Run: [Ad-Aware Browsing Protection] - C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe [198032 2011-10-21] (Lavasoft) HKLM\...\Run: [M-Audio Taskbar Icon] - C:\WINDOWS\system32\M-AudioTaskBarIcon.exe [154112 2007-01-25] (Avid Technology, Inc.) HKLM\...\Run: [sunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) Winlogon\Notify\AtiExtEvent: C:\Windows\system32\Ati2evxx.dll (ATI Technologies Inc.) HKCU\...\Run: [LDM] - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [32768 2009-09-21] (Logitech) HKCU\...\Run: [spotify Web Helper] - C:\Program Files\Spotify\Data\SpotifyWebHelper.exe [1140736 2007-12-10] (Spotify Ltd) HKU\Guest\...\Run: [LDM] - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [ 2009-09-21] (Logitech) HKU\Guest\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" HKU\Guest\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [ 2009-07-26] (Microsoft Corporation) Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk ShortcutTarget: Logitech Desktop Messenger.lnk -> C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech) Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech Inc.) Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe (McAfee, Inc.) Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WNA1100 Smart Wizard.lnk ShortcutTarget: NETGEAR WNA1100 Smart Wizard.lnk -> C:\Program Files\NETGEAR\WNA1100\WNA1100.exe () Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\NETGEAR WNA3100 Genie.lnk ShortcutTarget: NETGEAR WNA3100 Genie.lnk -> C:\Program Files\NETGEAR\WNA3100\WNA3100.exe () ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://uk.msn.com/?pc=WLEM&ocid=bb7hp HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {930CFB87-EA72-48FF-B187-FF85EB22B758} URL = http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry={searchTerms}&type=Web&orig=IMC-IE SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?FORM=WLETDF&PC=WLEM&q={searchTerms}&src=IE-SearchBox SearchScopes: HKCU - {1AB07DA3-B035-43A9-AB32-D5615B313E2B} URL = http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry={searchTerms}&type=Web&orig=IMC-IE SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = SearchScopes: HKCU - {930CFB87-EA72-48FF-B187-FF85EB22B758} URL = BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program Files\Microsoft\BingBar\7.3.107.0\BingExt.dll (Microsoft Corporation.) Toolbar: HKCU - &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation) Toolbar: HKCU - &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation) DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} http://www.bebo.com/files/BeboUploader.5.8.05.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253294945875 DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://go.divx.com/plugin/DivXBrowserPlugin.cab DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-1_5_0_17-windows-i586.cab DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} http://lads.myspace.com/upload/MySpaceUploader2.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab Handler: bw+0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw+0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw-0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw-0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw00 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw00s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw10 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw10s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw20 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw20s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw30 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw30s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw40 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw40s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw50 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw50s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw60 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw60s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw70 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw70s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw80 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw80s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw90 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bw90s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwa0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwa0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwb0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwb0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwc0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwc0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwd0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwd0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwe0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwe0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwf0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwf0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwg0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwg0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwh0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwh0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwi0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwi0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwj0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwj0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwk0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwk0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwl0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwl0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwm0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwm0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwn0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwn0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwo0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwo0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwp0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwp0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwq0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwq0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwr0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwr0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bws0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bws0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwt0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwt0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwu0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwu0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwv0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwv0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bww0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bww0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwx0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwx0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwy0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwy0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwz0 - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: bwz0s - {461a0983-eca8-4bcd-ae42-7eaa2440940f} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: offline-8876480 - {461A0983-ECA8-4BCD-AE42-7EAA2440940F} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (BackWeb Technologies Inc. ) Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 Chrome: ======= CHR Plugin: (Shockwave Flash) - C:\Documents and Settings\Gaitens\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.79\PepperFlash\pepflashplayer.dll No File CHR Plugin: (Shockwave Flash) - C:\Documents and Settings\Gaitens\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\gcswf32.dll No File CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Documents and Settings\Gaitens\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Documents and Settings\Gaitens\Local Settings\Application Data\Google\Chrome\Application\30.0.1599.101\pdf.dll () CHR Plugin: (Injovo Extension Plugin) - C:\Documents and Settings\Gaitens\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.444_0\npbrowserext.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npdrmv2.dll (Microsoft Corporation) CHR Plugin: (Microsoft\u00AE DRM) - C:\Program Files\Windows Media Player\npwmsdrm.dll (Microsoft Corporation) CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program Files\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.)) CHR Plugin: (Google Update) - C:\Documents and Settings\Gaitens\Local Settings\Application Data\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File CHR Plugin: (Motive Plugin) - C:\Program Files\Common Files\Motive\npMotive.dll (Motive, Inc.) CHR Plugin: (DivX Web Player) - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.) CHR Plugin: (Google Earth Plugin) - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) CHR Plugin: (Java Platform SE 6 U24) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll No File CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Windows Presentation Foundation) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) ========================== Services (Whitelisted) ================= R2 ACS; C:\WINDOWS\system32\acs.exe [495700 2009-02-20] (Atheros) R2 Ad-Aware Service; C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe [1239952 2012-07-12] (Lavasoft Limited) S3 jswpsapi; C:\Program Files\NETGEAR\WNA1100\jswpsapi.exe [360529 2009-11-05] (Atheros Communications, Inc.) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.) R2 PassThru Service; C:\Program Files\HTC\Internet Pass-Through\PassThruSvr.exe [88576 2011-09-15] () R2 SBAMSvc; C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe [3289032 2011-12-19] (GFI Software) R2 WSWNA1100; C:\Program Files\NETGEAR\WNA1100\WifiSvc.exe [266240 2010-08-04] () S2 WSWNA3100; C:\Program Files\NETGEAR\WNA3100\WifiSvc.exe [303360 2011-12-07] () S3 YPCService; C:\WINDOWS\system32\YPCSER~1.EXE [86016 2003-05-19] (Yahoo! Inc.) R2 JavaQuickStarterService; "C:\Program Files\Java\jre7\bin\jqs.exe" -service -config "C:\Program Files\Java\jre7\lib\deploy\jqs\jqs.conf" ==================== Drivers (Whitelisted) ==================== S3 AR9271; C:\Windows\System32\DRIVERS\athuw.sys [1759584 2010-09-30] (Atheros Communications, Inc.) R3 BCMH43XX; C:\Windows\System32\DRIVERS\bcmwlhigh5.sys [1034240 2011-12-12] (Broadcom Corporation) S3 CCDECODE; C:\Windows\System32\DRIVERS\CCDECODE.sys [17024 2008-04-13] (Microsoft Corporation) R3 DELTA; C:\Windows\System32\DRIVERS\delta.sys [302336 2007-01-25] (Midiman/M-Audio) R2 fssfltr; C:\Windows\System32\DRIVERS\fssfltr_tdi.sys [54752 2009-08-05] (Microsoft Corporation) S3 HCF_MSFT; C:\Windows\System32\DRIVERS\HCF_MSFT.sys [907456 2001-08-17] (Conexant) S3 HPZid412; C:\Windows\System32\DRIVERS\HPZid412.sys [51120 2005-03-08] (HP) S3 HPZipr12; C:\Windows\System32\DRIVERS\HPZipr12.sys [16496 2005-03-08] (HP) S3 HPZius12; C:\Windows\System32\DRIVERS\HPZius12.sys [21744 2005-03-08] (HP) S3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [18688 2001-08-17] (Microsoft Corporation) R3 JSWSCIMD; C:\Windows\System32\DRIVERS\jswscimd.sys [57440 2008-09-25] (Atheros Communications, Inc.) S3 LVUSBSta; C:\Windows\System32\DRIVERS\LVUSBSta.sys [41888 2007-05-09] (Logitech Inc.) S3 MREMP50; C:\Program Files\Common Files\Motive\MREMP50.sys [21248 2009-09-14] (Printing Communications Assoc., Inc. (PCAUSA)) S3 MREMPR5; C:\Program Files\Common Files\Motive\MREMPR5.sys [19345 2006-05-04] (Motive, Inc.) S3 MRENDIS5; C:\Program Files\Common Files\Motive\MRENDIS5.sys [18003 2006-05-29] (Motive, Inc.) R3 MRESP50; C:\Program Files\Common Files\Motive\MRESP50.sys [20096 2009-09-14] (Printing Communications Assoc., Inc. (PCAUSA)) S3 NdisIP; C:\Windows\System32\DRIVERS\NdisIP.sys [10880 2008-04-13] (Microsoft Corporation) R3 NuidFltr; C:\Windows\System32\DRIVERS\NuidFltr.sys [14736 2009-05-09] (Microsoft Corporation) S3 PID_PEPI; C:\Windows\System32\DRIVERS\LV302V32.SYS [1276832 2007-05-09] (Logitech Inc.) R3 Rasirda; C:\Windows\System32\DRIVERS\rasirda.sys [19584 2001-08-17] (Microsoft Corporation) S3 RDID1061; C:\Windows\System32\Drivers\rdwm1061.sys [140672 2009-02-18] (Roland Corporation) S3 rtl8139; C:\Windows\System32\DRIVERS\RTL8139.SYS [20992 2008-04-13] (Realtek Semiconductor Corporation) R1 sbaphd; C:\Windows\System32\drivers\sbaphd.sys [21240 2011-11-29] (GFI Software) R2 sbapifs; C:\Windows\System32\drivers\sbapifs.sys [77816 2011-11-29] (GFI Software) R1 SBRE; C:\WINDOWS\system32\drivers\SBREdrv.sys [101112 2011-10-26] (GFI Software) R3 WSIMD; C:\Windows\System32\DRIVERS\wsimd.sys [58208 2009-01-30] (Atheros Communications, Inc.) S3 catchme; \??\C:\ComboFix\catchme.sys [x] S3 DELTAII; system32\DRIVERS\deltaII.sys [x] S4 IntelIde; No ImagePath S3 Profos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\profos.sys [x] S3 Trufos; \??\C:\Program Files\BullGuard Ltd\BullGuard\antirootkit\trufos.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-11-21 00:48 - 2013-11-21 00:48 - 00000000 ____D C:\FRST 2013-11-20 19:55 - 2013-11-20 19:55 - 00001446 _____ C:\WINDOWS\COM+.log 2013-11-20 19:50 - 2013-11-20 19:50 - 00000000 ____D C:\Documents and Settings\LocalService\Start Menu\Programs\Accessories 2013-11-20 19:44 - 2013-11-20 19:52 - 00007514 _____ C:\WINDOWS\bitssetup.log 2013-11-20 19:44 - 2013-11-20 19:45 - 00000558 _____ C:\WINDOWS\Windows Update.log 2013-11-20 19:27 - 2013-11-20 19:54 - 00181064 _____ (Sysinternals) C:\WINDOWS\PSEXESVC.EXE 2013-11-20 19:25 - 2013-11-20 19:25 - 00000000 ____D C:\RegBackup 2013-11-20 19:23 - 2013-11-20 19:23 - 00000000 ____D C:\Program Files\Tweaking.com 2013-11-20 19:23 - 2013-11-20 19:23 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com 2013-11-20 19:22 - 2013-11-20 19:22 - 05045639 _____ C:\Documents and Settings\Gaitens\Desktop\tweaking.com_windows_repair_aio_setup.exe 2013-11-18 20:44 - 2013-11-18 21:21 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable) 2013-11-18 20:44 - 2013-11-18 20:44 - 00105176 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2013-11-18 20:43 - 2013-11-18 21:21 - 00000000 ____D C:\Documents and Settings\Gaitens\Desktop\mbar 2013-11-18 20:43 - 2013-11-18 20:43 - 12576792 _____ (Malwarebytes Corp.) C:\Documents and Settings\Gaitens\Desktop\mbar-1.07.0.1007.exe 2013-11-18 20:43 - 2013-11-18 20:43 - 00047064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2013-11-18 01:17 - 2013-11-18 01:17 - 00001504 _____ C:\Documents and Settings\Gaitens\Desktop\RKreport[0]_S_11182013_011718.txt 2013-11-18 01:15 - 2013-11-18 01:17 - 00000000 ____D C:\Documents and Settings\Gaitens\Desktop\RK_Quarantine 2013-11-18 01:14 - 2013-11-18 01:14 - 03679744 _____ C:\Documents and Settings\Gaitens\Desktop\RogueKiller.exe 2013-11-18 00:59 - 2013-11-18 01:00 - 04121440 _____ (Kaspersky Lab ZAO) C:\Documents and Settings\Gaitens\Desktop\TDSSKiller.exe 2013-11-17 20:58 - 2013-11-17 21:52 - 00065536 _____ C:\WINDOWS\system32\config\Doctor Web.evt 2013-11-17 20:58 - 2013-11-17 21:49 - 00000000 ____D C:\Documents and Settings\Gaitens\Doctor Web 2013-11-17 20:56 - 2013-11-17 20:56 - 135713120 _____ C:\Documents and Settings\Gaitens\Desktop\drweb-cureit.exe 2013-11-17 13:52 - 2013-11-17 13:52 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Java 2013-11-17 13:52 - 2013-11-17 13:51 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe 2013-11-17 13:52 - 2013-11-17 13:51 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe 2013-11-17 13:52 - 2013-11-17 13:51 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe 2013-11-17 13:52 - 2013-11-17 13:51 - 00094632 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll 2013-11-16 17:07 - 2013-11-16 17:07 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2013-11-16 16:51 - 2013-11-16 16:51 - 00000000 ____D C:\Program Files\M-Audio 2013-11-16 16:51 - 2013-11-16 16:51 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\M-Audio 2013-11-16 16:51 - 2007-01-25 11:12 - 00302336 _____ (Midiman/M-Audio) C:\WINDOWS\system32\Drivers\delta.sys 2013-11-16 16:51 - 2007-01-25 11:12 - 00022528 _____ (Avid Technology, Inc.) C:\WINDOWS\system32\deltasio.dll 2013-11-16 16:51 - 2007-01-25 11:12 - 00019456 _____ (M-Audio) C:\WINDOWS\system32\DeltaCPL.cpl 2013-11-16 16:51 - 2007-01-25 11:11 - 01122304 _____ (M-Audio) C:\WINDOWS\system32\deltapnl.exe 2013-11-16 16:51 - 2007-01-25 11:11 - 00046592 _____ (M-Audio) C:\WINDOWS\system32\deltapnl.dll 2013-11-16 16:51 - 2007-01-25 10:54 - 00154112 _____ (Avid Technology, Inc.) C:\WINDOWS\system32\M-AudioTaskBarIcon.exe 2013-11-16 16:51 - 2007-01-24 17:15 - 02502633 _____ (Avid Technology, Inc.) C:\WINDOWS\system32\pcifmdio.dll 2013-11-16 16:48 - 2013-11-16 16:48 - 00000601 _____ C:\Documents and Settings\Gaitens\Desktop\eset scan.txt 2013-11-16 14:56 - 2013-11-16 14:57 - 02347384 _____ (ESET) C:\Documents and Settings\Gaitens\Desktop\esetsmartinstaller_enu.exe 2013-11-16 14:45 - 2013-11-16 14:45 - 00008942 _____ C:\WINDOWS\KB2900986.log 2013-11-16 14:45 - 2013-11-16 14:45 - 00000000 ___DC C:\WINDOWS\$NtUninstallKB2900986$ 2013-11-16 14:45 - 2013-11-16 14:45 - 00000000 ___DC C:\WINDOWS\$NtUninstallKB2868626$ 2013-11-16 14:44 - 2013-11-16 14:44 - 00000000 ___DC C:\WINDOWS\$NtUninstallKB2862152$ 2013-11-16 14:42 - 2013-11-16 14:42 - 00000000 ___DC C:\WINDOWS\$NtUninstallKB2876331$ 2013-11-16 14:41 - 2013-11-16 14:42 - 00011121 _____ C:\WINDOWS\KB2888505-IE8.log 2013-11-16 14:41 - 2013-11-16 14:41 - 00000000 _____ C:\WINDOWS\system32\Drivers\Msft_Kernel_NuidFltr_01005.Wdf 2013-11-16 14:41 - 2008-04-14 05:41 - 00021504 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hidserv.dll 2013-11-16 14:36 - 2013-11-16 14:45 - 00014617 _____ C:\WINDOWS\KB2868626.log 2013-11-16 14:35 - 2013-11-16 14:44 - 00013605 _____ C:\WINDOWS\KB2862152.log 2013-11-16 14:35 - 2013-11-16 14:43 - 00013168 _____ C:\WINDOWS\KB2876331.log 2013-11-16 14:27 - 2013-11-16 14:27 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Ad-Aware Antivirus 2013-11-16 13:17 - 2008-04-14 04:42 - 00146432 _____ (Microsoft Corporation) C:\WINDOWS\regedit.com 2013-11-15 18:27 - 2013-11-15 18:27 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Ad-Aware Antivirus 2013-11-15 18:24 - 2013-11-15 18:24 - 00000000 ____D C:\WINDOWS\pss 2013-11-14 23:42 - 2013-11-21 00:42 - 00602112 _____ C:\Documents and Settings\Gaitens\Desktop\OTLs.exe 2013-11-14 23:32 - 2013-11-14 23:21 - 01090529 _____ C:\Documents and Settings\Gaitens\Desktop\FRSTs.exe 2013-11-12 23:57 - 2013-11-12 23:57 - 00000000 ____D C:\Program Files\ESET 2013-11-12 19:34 - 2013-11-12 19:34 - 00012955 _____ C:\ComboFix.txt 2013-11-12 19:26 - 2013-11-12 19:26 - 00008192 _____ C:\WINDOWS\system32\config\SECURITY.tmp.LOG 2013-11-12 19:26 - 2013-11-12 19:26 - 00000000 _____ C:\WINDOWS\system32\config\system.tmp.LOG 2013-11-12 19:26 - 2013-11-12 19:26 - 00000000 _____ C:\WINDOWS\system32\config\software.tmp.LOG 2013-11-12 19:26 - 2013-11-12 19:26 - 00000000 _____ C:\WINDOWS\system32\config\SAM.tmp.LOG 2013-11-12 19:26 - 2013-11-12 19:26 - 00000000 _____ C:\WINDOWS\system32\config\default.tmp.LOG 2013-11-12 17:41 - 2013-11-12 19:34 - 00000000 ____D C:\ComboFix 2013-11-12 17:41 - 2011-06-26 06:45 - 00256000 _____ C:\WINDOWS\PEV.exe 2013-11-12 17:41 - 2010-11-07 17:20 - 00208896 _____ C:\WINDOWS\MBR.exe 2013-11-12 17:41 - 2009-04-20 04:56 - 00060416 _____ (NirSoft) C:\WINDOWS\NIRCMD.exe 2013-11-12 17:41 - 2000-08-31 00:00 - 00518144 _____ (SteelWerX) C:\WINDOWS\SWREG.exe 2013-11-12 17:41 - 2000-08-31 00:00 - 00406528 _____ (SteelWerX) C:\WINDOWS\SWSC.exe 2013-11-12 17:41 - 2000-08-31 00:00 - 00212480 _____ (SteelWerX) C:\WINDOWS\SWXCACLS.exe 2013-11-12 17:41 - 2000-08-31 00:00 - 00098816 _____ C:\WINDOWS\sed.exe 2013-11-12 17:41 - 2000-08-31 00:00 - 00080412 _____ C:\WINDOWS\grep.exe 2013-11-12 17:41 - 2000-08-31 00:00 - 00068096 _____ C:\WINDOWS\zip.exe 2013-11-12 17:39 - 2013-11-12 17:39 - 05145576 ____R (Swearware) C:\Documents and Settings\Gaitens\Desktop\ComboFix.exe 2013-11-10 15:36 - 2013-11-10 15:36 - 01073262 _____ C:\Documents and Settings\Gaitens\Desktop\AdwCleaner.exe 2013-11-10 15:36 - 2013-11-10 15:36 - 01034531 _____ (Thisisu) C:\Documents and Settings\Gaitens\Desktop\JRT.exe 2013-11-10 15:36 - 2013-11-10 15:35 - 01898232 _____ (Bleeping Computer, LLC) C:\Documents and Settings\Gaitens\Desktop\rkill.exe ==================== One Month Modified Files and Folders ======= 2013-11-21 00:48 - 2013-11-21 00:48 - 00000000 ____D C:\FRST 2013-11-21 00:47 - 2009-10-13 23:02 - 00000888 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2013-11-21 00:42 - 2013-11-14 23:42 - 00602112 _____ C:\Documents and Settings\Gaitens\Desktop\OTLs.exe 2013-11-21 00:42 - 2009-09-18 11:03 - 00513916 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2013-11-21 00:42 - 2006-02-28 12:00 - 00000451 _____ C:\WINDOWS\system.ini 2013-11-21 00:38 - 2012-08-29 17:26 - 00001615 _____ C:\Documents and Settings\All Users\Desktop\Ad-Aware Antivirus.lnk 2013-11-21 00:38 - 2012-03-15 19:45 - 00000000 ____D C:\Documents and Settings\Gaitens\Local Settings\Application Data\Htc 2013-11-21 00:38 - 2009-10-13 23:02 - 00000884 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2013-11-21 00:38 - 2009-09-18 11:05 - 00000159 _____ C:\WINDOWS\wiadebug.log 2013-11-21 00:38 - 2009-09-18 11:05 - 00000050 _____ C:\WINDOWS\wiaservc.log 2013-11-21 00:38 - 2009-09-18 11:05 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2013-11-21 00:38 - 2009-09-18 10:56 - 01293238 _____ C:\WINDOWS\WindowsUpdate.log 2013-11-21 00:38 - 2006-02-28 12:00 - 00001374 _____ C:\WINDOWS\system32\wpa.dbl 2013-11-20 20:29 - 2012-09-13 18:55 - 00524288 _____ C:\WINDOWS\system32\config\ACS.evt 2013-11-20 20:29 - 2009-09-18 11:07 - 00000278 ___SH C:\Documents and Settings\Gaitens\ntuser.ini 2013-11-20 20:29 - 2009-09-18 11:05 - 00032390 _____ C:\WINDOWS\SchedLgU.Txt 2013-11-20 20:19 - 2012-08-17 10:48 - 00000986 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1303643608-1417001333-1003UA.job 2013-11-20 20:19 - 2012-08-17 10:48 - 00000934 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-746137067-1303643608-1417001333-1003Core.job 2013-11-20 20:16 - 2009-09-18 17:41 - 00100480 _____ C:\Documents and Settings\Gaitens\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2013-11-20 20:16 - 2009-09-18 11:01 - 00348992 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2013-11-20 19:55 - 2013-11-20 19:55 - 00001446 _____ C:\WINDOWS\COM+.log 2013-11-20 19:54 - 2013-11-20 19:27 - 00181064 _____ (Sysinternals) C:\WINDOWS\PSEXESVC.EXE 2013-11-20 19:52 - 2013-11-20 19:44 - 00007514 _____ C:\WINDOWS\bitssetup.log 2013-11-20 19:52 - 2009-09-18 10:54 - 00000000 ____D C:\WINDOWS\Registration 2013-11-20 19:50 - 2013-11-20 19:50 - 00000000 ____D C:\Documents and Settings\LocalService\Start Menu\Programs\Accessories 2013-11-20 19:50 - 2009-09-18 10:57 - 00023392 _____ C:\WINDOWS\system32\nscompat.tlb 2013-11-20 19:50 - 2009-09-18 10:57 - 00016832 _____ C:\WINDOWS\system32\amcompat.tlb 2013-11-20 19:45 - 2013-11-20 19:44 - 00000558 _____ C:\WINDOWS\Windows Update.log 2013-11-20 19:26 - 2012-10-04 19:44 - 00242499 _____ C:\WINDOWS\setupapi.log 2013-11-20 19:26 - 2009-09-18 10:54 - 00000000 ____D C:\WINDOWS\repair 2013-11-20 19:25 - 2013-11-20 19:25 - 00000000 ____D C:\RegBackup 2013-11-20 19:23 - 2013-11-20 19:23 - 00000000 ____D C:\Program Files\Tweaking.com 2013-11-20 19:23 - 2013-11-20 19:23 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Tweaking.com 2013-11-20 19:22 - 2013-11-20 19:22 - 05045639 _____ C:\Documents and Settings\Gaitens\Desktop\tweaking.com_windows_repair_aio_setup.exe 2013-11-18 21:21 - 2013-11-18 20:44 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable) 2013-11-18 21:21 - 2013-11-18 20:43 - 00000000 ____D C:\Documents and Settings\Gaitens\Desktop\mbar 2013-11-18 20:44 - 2013-11-18 20:44 - 00105176 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2013-11-18 20:43 - 2013-11-18 20:43 - 12576792 _____ (Malwarebytes Corp.) C:\Documents and Settings\Gaitens\Desktop\mbar-1.07.0.1007.exe 2013-11-18 20:43 - 2013-11-18 20:43 - 00047064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2013-11-18 01:17 - 2013-11-18 01:17 - 00001504 _____ C:\Documents and Settings\Gaitens\Desktop\RKreport[0]_S_11182013_011718.txt 2013-11-18 01:17 - 2013-11-18 01:15 - 00000000 ____D C:\Documents and Settings\Gaitens\Desktop\RK_Quarantine 2013-11-18 01:14 - 2013-11-18 01:14 - 03679744 _____ C:\Documents and Settings\Gaitens\Desktop\RogueKiller.exe 2013-11-18 01:00 - 2013-11-18 00:59 - 04121440 _____ (Kaspersky Lab ZAO) C:\Documents and Settings\Gaitens\Desktop\TDSSKiller.exe 2013-11-17 21:52 - 2013-11-17 20:58 - 00065536 _____ C:\WINDOWS\system32\config\Doctor Web.evt 2013-11-17 21:49 - 2013-11-17 20:58 - 00000000 ____D C:\Documents and Settings\Gaitens\Doctor Web 2013-11-17 21:49 - 2008-04-13 23:06 - 00187776 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\acpi.sys 2013-11-17 21:20 - 2012-08-17 10:49 - 00002300 _____ C:\Documents and Settings\Gaitens\Desktop\Google Chrome.lnk 2013-11-17 20:58 - 2009-09-18 11:06 - 00000000 ____D C:\Documents and Settings\Gaitens 2013-11-17 20:56 - 2013-11-17 20:56 - 135713120 _____ C:\Documents and Settings\Gaitens\Desktop\drweb-cureit.exe 2013-11-17 13:52 - 2013-11-17 13:52 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\Java 2013-11-17 13:52 - 2009-12-28 10:36 - 00000000 ____D C:\Program Files\Common Files\Java 2013-11-17 13:51 - 2013-11-17 13:52 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\system32\javaws.exe 2013-11-17 13:51 - 2013-11-17 13:52 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\system32\javaw.exe 2013-11-17 13:51 - 2013-11-17 13:52 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\system32\java.exe 2013-11-17 13:51 - 2013-11-17 13:52 - 00094632 _____ (Oracle Corporation) C:\WINDOWS\system32\WindowsAccessBridge.dll 2013-11-17 13:51 - 2009-12-28 10:36 - 00000000 ____D C:\Program Files\Java 2013-11-17 13:51 - 2009-09-18 11:02 - 00185990 _____ C:\WINDOWS\setupact.log 2013-11-17 13:51 - 2007-12-10 01:26 - 00145408 _____ (Oracle Corporation) C:\WINDOWS\system32\javacpl.cpl 2013-11-16 17:07 - 2013-11-16 17:07 - 00692616 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerApp.exe 2013-11-16 17:07 - 2012-02-22 19:39 - 00071048 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\FlashPlayerCPLApp.cpl 2013-11-16 16:51 - 2013-11-16 16:51 - 00000000 ____D C:\Program Files\M-Audio 2013-11-16 16:51 - 2013-11-16 16:51 - 00000000 ____D C:\Documents and Settings\All Users\Start Menu\Programs\M-Audio 2013-11-16 16:51 - 2012-08-29 16:51 - 00000349 _____ C:\WINDOWS\Q813347.log 2013-11-16 16:51 - 2009-09-18 17:22 - 00000000 ____D C:\Program Files\InstallShield Installation Information 2013-11-16 16:48 - 2013-11-16 16:48 - 00000601 _____ C:\Documents and Settings\Gaitens\Desktop\eset scan.txt 2013-11-16 14:57 - 2013-11-16 14:56 - 02347384 _____ (ESET) C:\Documents and Settings\Gaitens\Desktop\esetsmartinstaller_enu.exe 2013-11-16 14:45 - 2013-11-16 14:45 - 00008942 _____ C:\WINDOWS\KB2900986.log 2013-11-16 14:45 - 2013-11-16 14:45 - 00000000 ___DC C:\WINDOWS\$NtUninstallKB2900986$ 2013-11-16 14:45 - 2013-11-16 14:45 - 00000000 ___DC C:\WINDOWS\$NtUninstallKB2868626$ 2013-11-16 14:45 - 2013-11-16 14:36 - 00014617 _____ C:\WINDOWS\KB2868626.log 2013-11-16 14:45 - 2009-09-18 18:01 - 00397220 _____ C:\WINDOWS\updspapi.log 2013-11-16 14:45 - 2009-09-18 11:03 - 01864547 _____ C:\WINDOWS\iis6.log 2013-11-16 14:45 - 2009-09-18 11:03 - 01693853 _____ C:\WINDOWS\FaxSetup.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00874159 _____ C:\WINDOWS\ocgen.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00779918 _____ C:\WINDOWS\tsoc.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00573364 _____ C:\WINDOWS\comsetup.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00522864 _____ C:\WINDOWS\msmqinst.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00346547 _____ C:\WINDOWS\ntdtcsetup.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00297875 _____ C:\WINDOWS\netfxocm.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00117392 _____ C:\WINDOWS\MedCtrOC.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00094036 _____ C:\WINDOWS\ocmsn.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00085886 _____ C:\WINDOWS\tabletoc.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00085089 _____ C:\WINDOWS\msgsocm.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00001393 _____ C:\WINDOWS\imsins.log 2013-11-16 14:45 - 2009-09-18 11:03 - 00001393 _____ C:\WINDOWS\imsins.BAK 2013-11-16 14:44 - 2013-11-16 14:44 - 00000000 ___DC C:\WINDOWS\$NtUninstallKB2862152$ 2013-11-16 14:44 - 2013-11-16 14:35 - 00013605 _____ C:\WINDOWS\KB2862152.log 2013-11-16 14:43 - 2013-11-16 14:35 - 00013168 _____ C:\WINDOWS\KB2876331.log 2013-11-16 14:43 - 2009-09-18 17:23 - 00000000 ____D C:\WINDOWS\system32\ReinstallBackups 2013-11-16 14:42 - 2013-11-16 14:42 - 00000000 ___DC C:\WINDOWS\$NtUninstallKB2876331$ 2013-11-16 14:42 - 2013-11-16 14:41 - 00011121 _____ C:\WINDOWS\KB2888505-IE8.log 2013-11-16 14:42 - 2009-09-18 18:31 - 00000000 ____D C:\WINDOWS\ie8updates 2013-11-16 14:41 - 2013-11-16 14:41 - 00000000 _____ C:\WINDOWS\system32\Drivers\Msft_Kernel_NuidFltr_01005.Wdf 2013-11-16 14:41 - 2007-12-10 01:30 - 00000000 ____D C:\WINDOWS\system32\MRT 2013-11-16 14:37 - 2009-09-18 18:29 - 80340640 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2013-11-16 14:27 - 2013-11-16 14:27 - 00000000 ____D C:\Documents and Settings\All Users\Application Data\Ad-Aware Antivirus 2013-11-16 13:54 - 2009-09-18 11:00 - 00000211 ___SH C:\boot.ini 2013-11-16 13:54 - 2006-02-28 12:00 - 00000688 _____ C:\WINDOWS\win.ini 2013-11-16 13:53 - 2009-09-18 10:54 - 00000000 ____D C:\WINDOWS\system32\Restore 2013-11-15 18:27 - 2013-11-15 18:27 - 00000000 ____D C:\Documents and Settings\NetworkService\Application Data\Ad-Aware Antivirus 2013-11-15 18:24 - 2013-11-15 18:24 - 00000000 ____D C:\WINDOWS\pss 2013-11-14 23:21 - 2013-11-14 23:32 - 01090529 _____ C:\Documents and Settings\Gaitens\Desktop\FRSTs.exe 2013-11-12 23:57 - 2013-11-12 23:57 - 00000000 ____D C:\Program Files\ESET 2013-11-12 20:28 - 2009-09-18 11:00 - 00000000 __SHD C:\Documents and Settings\NetworkService 2013-11-12 19:34 - 2013-11-12 19:34 - 00012955 _____ C:\ComboFix.txt 2013-11-12 19:34 - 2013-11-12 17:41 - 00000000 ____D C:\ComboFix 2013-11-12 19:34 - 2007-12-12 22:21 - 00000000 ____D C:\Qoobox 2013-11-12 19:33 - 2007-12-12 22:21 - 00000000 ____D C:\WINDOWS\erdnt 2013-11-12 19:30 - 2006-02-28 12:00 - 00000027 _____ C:\WINDOWS\system32\Drivers\etc\hosts_bak_578 2013-11-12 19:27 - 2009-09-18 11:01 - 00262144 _____ C:\WINDOWS\system32\config\SECURITY.bak 2013-11-12 19:27 - 2009-09-18 11:01 - 00262144 _____ C:\WINDOWS\system32\config\SAM.bak 2013-11-12 19:27 - 2009-09-18 11:00 - 38273024 _____ C:\WINDOWS\system32\config\software.bak 2013-11-12 19:27 - 2009-09-18 11:00 - 09437184 _____ C:\WINDOWS\system32\config\system.bak 2013-11-12 19:27 - 2009-09-18 11:00 - 00524288 _____ C:\WINDOWS\system32\config\default.bak 2013-11-12 19:26 - 2013-11-12 19:26 - 00008192 _____ C:\WINDOWS\system32\config\SECURITY.tmp.LOG 2013-11-12 19:26 - 2013-11-12 19:26 - 00000000 _____ C:\WINDOWS\system32\config\system.tmp.LOG 2013-11-12 19:26 - 2013-11-12 19:26 - 00000000 _____ C:\WINDOWS\system32\config\software.tmp.LOG 2013-11-12 19:26 - 2013-11-12 19:26 - 00000000 _____ C:\WINDOWS\system32\config\SAM.tmp.LOG 2013-11-12 19:26 - 2013-11-12 19:26 - 00000000 _____ C:\WINDOWS\system32\config\default.tmp.LOG 2013-11-12 17:39 - 2013-11-12 17:39 - 05145576 ____R (Swearware) C:\Documents and Settings\Gaitens\Desktop\ComboFix.exe 2013-11-10 15:36 - 2013-11-10 15:36 - 01073262 _____ C:\Documents and Settings\Gaitens\Desktop\AdwCleaner.exe 2013-11-10 15:36 - 2013-11-10 15:36 - 01034531 _____ (Thisisu) C:\Documents and Settings\Gaitens\Desktop\JRT.exe 2013-11-10 15:35 - 2013-11-10 15:36 - 01898232 _____ (Bleeping Computer, LLC) C:\Documents and Settings\Gaitens\Desktop\rkill.exe Some content of TEMP: ==================== C:\Documents and Settings\Gaitens\Local Settings\temp\IadHide5.dll C:\Documents and Settings\Gaitens\Local Settings\temp\jre-7u45-windows-i586-iftw.exe C:\Documents and Settings\Gaitens\Local Settings\temp\ntdll_dump.dll ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== End Of Log ============================ Addition.txt

I assume you mean left click and wait to rename as with any other file.. Well i done this and changed it to OTLs and this didn't change anything.

Ran the above, unsure if you want to see any of the logs in this folder: C:\Program Files\Tweaking.com\Windows Repair (All in One)\Logs There are a fair amount of them. Computer still did not boot first time on restart and I'm still unable to run FRST or OTL.

virus total 0/47: https://www.virustotal.com/en-gb/file/9b6e8158e581500c5c417f6453a6414901020123d34fdbc04289750e8b072538/analysis/

Only one thing found but it couldn't be deleted apparently: Infected file C:\WINDOWS\system32\comres.dll could not be remediated because backup file is not available Logs below: mbar log: Malwarebytes Anti-Rootkit BETA 1.07.0.1007 www.malwarebytes.org Database version: v2013.11.18.07 Windows XP Service Pack 3 x86 NTFS Internet Explorer 8.0.6001.18702 Gaitens :: GAITENS-PC [administrator] 18/11/2013 20:45:03 mbar-log-2013-11-18 (20-45-03).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: Objects scanned: 249586 Time elapsed: 36 minute(s), 38 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 0 (No malicious items detected) (end) system log: --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.07.0.1007 © Malwarebytes Corporation 2011-2012 OS version: 5.1.2600 Windows XP Service Pack 3 x86 Account is Administrative Internet Explorer version: 8.0.6001.18702 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED CPU speed: 1.795000 GHz Memory total: 2146676736, free: 1209090048 Downloaded database version: v2013.11.18.07 Downloaded database version: v2013.10.11.02 Initializing... ====================== ------------ Kernel report ------------ 11/18/2013 20:44:55 ------------ Loaded modules ----------- \WINDOWS\system32\ntoskrnl.exe \WINDOWS\system32\hal.dll \WINDOWS\system32\KDCOM.DLL \WINDOWS\system32\BOOTVID.dll ACPI.sys \WINDOWS\system32\DRIVERS\WMILIB.SYS pci.sys isapnp.sys pciide.sys \WINDOWS\system32\DRIVERS\PCIIDEX.SYS MountMgr.sys ftdisk.sys dmload.sys dmio.sys PartMgr.sys VolSnap.sys atapi.sys disk.sys \WINDOWS\system32\DRIVERS\CLASSPNP.SYS fltMgr.sys sr.sys KSecDD.sys Ntfs.sys NDIS.sys sisagp.sys ohci1394.sys \WINDOWS\system32\DRIVERS\1394BUS.SYS Mup.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\ati2mtag.sys \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS \SystemRoot\system32\DRIVERS\Rtenicxp.sys \SystemRoot\system32\DRIVERS\usbuhci.sys \SystemRoot\system32\DRIVERS\USBPORT.SYS \SystemRoot\system32\DRIVERS\usbehci.sys \SystemRoot\system32\DRIVERS\delta.sys \SystemRoot\system32\DRIVERS\portcls.sys \SystemRoot\system32\DRIVERS\drmk.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\DRIVERS\fdc.sys \SystemRoot\system32\DRIVERS\parport.sys \SystemRoot\system32\DRIVERS\serial.sys \SystemRoot\system32\DRIVERS\serenum.sys \SystemRoot\system32\DRIVERS\imapi.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\system32\DRIVERS\redbook.sys \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys \SystemRoot\system32\DRIVERS\serscan.sys \SystemRoot\system32\DRIVERS\jswscimd.sys \SystemRoot\system32\DRIVERS\audstub.sys \SystemRoot\system32\DRIVERS\rasirda.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\psched.sys \SystemRoot\system32\DRIVERS\msgpc.sys \SystemRoot\system32\DRIVERS\ptilink.sys \SystemRoot\system32\DRIVERS\raspti.sys \SystemRoot\system32\DRIVERS\rdpdr.sys \SystemRoot\system32\DRIVERS\termdd.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\swenum.sys \SystemRoot\system32\DRIVERS\update.sys \SystemRoot\system32\DRIVERS\mssmbios.sys \SystemRoot\system32\DRIVERS\wsimd.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\flpydisk.sys \SystemRoot\System32\Drivers\Fs_Rec.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \??\C:\WINDOWS\system32\drivers\SBREdrv.sys \SystemRoot\system32\DRIVERS\HIDPARSE.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\Drivers\mnmdd.SYS \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\rasacd.sys \SystemRoot\system32\DRIVERS\ipsec.sys \SystemRoot\system32\DRIVERS\tcpip.sys \SystemRoot\system32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\ipnat.sys \SystemRoot\System32\drivers\ws2ifsl.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\System32\drivers\afd.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\drivers\sbaphd.sys \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\System32\Drivers\Fips.SYS \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\system32\DRIVERS\hidusb.sys \SystemRoot\system32\DRIVERS\HIDCLASS.SYS \SystemRoot\System32\Drivers\Cdfs.SYS \SystemRoot\system32\DRIVERS\bcmwlhigh5.sys \SystemRoot\system32\DRIVERS\mouhid.sys \SystemRoot\system32\DRIVERS\kbdhid.sys \SystemRoot\system32\DRIVERS\NuidFltr.sys \SystemRoot\system32\DRIVERS\WDFLDR.SYS \SystemRoot\System32\Drivers\wdf01000.sys \SystemRoot\System32\Drivers\dump_atapi.sys \SystemRoot\System32\Drivers\dump_WMILIB.SYS \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\watchdog.sys \SystemRoot\System32\drivers\dxg.sys \SystemRoot\System32\drivers\dxgthk.sys \SystemRoot\System32\ati2dvag.dll \SystemRoot\System32\ati2cqag.dll \SystemRoot\System32\atikvmag.dll \SystemRoot\System32\atiok3x2.dll \SystemRoot\System32\ati3duag.dll \SystemRoot\System32\ativvaxx.dll \SystemRoot\System32\ATMFD.DLL \SystemRoot\system32\drivers\sbapifs.sys \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys \SystemRoot\system32\DRIVERS\irda.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\drivers\wdmaud.sys \SystemRoot\system32\DRIVERS\mrxdav.sys \SystemRoot\system32\drivers\sysaudio.sys \SystemRoot\System32\Drivers\ParVdm.SYS \SystemRoot\System32\Drivers\LBeepKE.sys \SystemRoot\system32\DRIVERS\srv.sys \SystemRoot\System32\Drivers\HTTP.sys \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS \SystemRoot\System32\Drivers\Fastfat.SYS \SystemRoot\system32\drivers\kmixer.sys \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys \WINDOWS\system32\ntdll.dll ----------- End ----------- Done! <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xffffffff8a88cab8 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IdeDeviceP0T0L0-4\ Lower Device Object: 0xffffffff8a919030 Lower Device Driver Name: \Driver\atapi\ <<<2>>> Physical Sector Size: 512 Drive: 0, DevicePointer: 0xffffffff8a88cab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xffffffff8a907e08, DeviceName: Unknown, DriverName: \Driver\PartMgr\ DevicePointer: 0xffffffff8a88cab8, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xffffffff8a8b55a0, DeviceName: \Device\00000072\, DriverName: \Driver\ACPI\ DevicePointer: 0xffffffff8a919030, DeviceName: \Device\Ide\IdeDeviceP0T0L0-4\, DriverName: \Driver\atapi\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0x0, 0x0, 0x0 Lower DeviceData: 0x0, 0x0, 0x0 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes <<<2>>> <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers... <<<2>>> <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: EDA9EDA9 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 63 Numsec = 176506092 Partition file system is NTFS Partition is bootable Partition 1 type is Extended with LBA (0xf) Partition is NOT ACTIVE. Partition starts at LBA: 176506155 Numsec = 409593240 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Disk Size: 300090728448 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-62-586094704-586114704)... Done! Infected file C:\WINDOWS\system32\comres.dll could not be remediated because backup file is not available Scan finished ======================================= Removal queue found; removal started Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam... Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_63_i.mbam... Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam... Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\comres.dll_k.mbam... Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\comres.dll_u.mbam... Removing C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)\comres.dll_r.mbam... Removal finished

RK Log: RogueKiller V8.7.8 [Nov 14 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.adlice.com/forum/ Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ Operating System : Windows XP (5.1.2600 Service Pack 3) 32 bits version Started in : Normal mode User : Gaitens [Admin rights] Mode : Scan -- Date : 11/18/2013 01:17:18 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 2 ¤¤¤ [HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [LOADED] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Maxtor 6L300R0 +++++ --- User --- [MBR] daef3885c3f5e5be5b6123fc841739e0 [bSP] eabd19050fc8e131129dcc55bc431920 : Windows XP MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 86184 Mo 1 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 176506155 | Size: 199996 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[0]_S_11182013_011718.txt >>

and again: 01:10:01.0546 0x060c C:\Program Files\HTC\HTC Sync 3.0\PIMAccess.dll - ok 01:10:01.0546 0x060c [ E7BE61EB1BDE3921FF0CDD24F1535332, C52BD14070E16BC837A9C44FE7FE10E27033BE0F4B0A831F0389B4A2B2D86B35 ] C:\Program Files\iTunes\iTunesHelper.Resources\en.lproj\iTunesHelperLocalized.dll 01:10:01.0546 0x060c C:\Program Files\iTunes\iTunesHelper.Resources\en.lproj\iTunesHelperLocalized.dll - ok 01:10:01.0562 0x060c [ 0B467F470CC9918FDCEEDCFD7DC4D697, 87C8BCC4DFF318FC393A8C0FB0B82CCC9DA83EC0F5811CF303F3AC265A575578 ] C:\WINDOWS\system32\oledlg.dll 01:10:01.0562 0x060c C:\WINDOWS\system32\oledlg.dll - ok 01:10:01.0562 0x060c [ 3CB07566302BCEEB898DE270A0BEC175, B234D1044D8702A0929BB48F729EB5078B44AA7CD574B6482633B51289E70200 ] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe 01:10:01.0562 0x060c C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe - ok 01:10:01.0562 0x060c [ 93A67AD03FD9C2286A4A5AD9A67F381A, C24EFF10B543D9340DB952B91F80880B93C9EA58FD22E1829875BE844F7334BC ] C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.dll 01:10:01.0562 0x060c C:\Program Files\iTunes\iTunesHelper.Resources\iTunesHelper.dll - ok 01:10:01.0578 0x060c [ 1E114E34D8C1F6C0C061EAECCC2B7848, C0EB1C5092CD7F1BF691CF401A47D1EA5A902686EA99E52C64542F1D18A7CE5B ] C:\Program Files\HTC\HTC Sync 3.0\UpdateHelper.dll 01:10:01.0578 0x060c C:\Program Files\HTC\HTC Sync 3.0\UpdateHelper.dll - ok 01:10:01.0578 0x060c [ 22D71D1DB6FC789A1CE8AC6963580259, DD5307A108936AAE840F973F7F718A6954E173D4E210A375C75DB644B2162CFD ] C:\WINDOWS\system32\hhctrl.ocx 01:10:01.0578 0x060c C:\WINDOWS\system32\hhctrl.ocx - ok 01:10:01.0578 0x060c [ EEA46BF5D63A96B21E24FD0EFE4CAD56, 01E222D915460C857E19EE337D50A695972B0C690F9E196D3E2063DE0DDFB13A ] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon_main.dll 01:10:01.0578 0x060c C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon_main.dll - ok 01:10:01.0593 0x060c [ FD9BB1596433AE242DEF9320E4645BDC, 7E8F7F5D8A12CBDDFF31F3CDEA12A6078C845F3738FBB2F5A6A1A352B021EE1C ] C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher.exe 01:10:01.0593 0x060c C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher.exe - ok 01:10:01.0593 0x060c [ 3AF9BC6B8427923EF2D6E21A19861C58, 0ADE8D6DE6E601DAE00B1324ED64E5C521A9EF08D51FB4719631F8C07B0B48C5 ] C:\PROGRA~1\Yahoo!\browser\ycommon.dll 01:10:01.0593 0x060c C:\PROGRA~1\Yahoo!\browser\ycommon.dll - ok 01:10:01.0593 0x060c [ C5F1D82D9CC8979971CC748FCB2EE7CA, 7580FF135C12AAE5BE110A9949A842CFA4413C7E68186E81C8FF290E1C0EE26A ] C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe 01:10:01.0593 0x060c C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.exe - ok 01:10:01.0609 0x060c [ 314B4F7A8F49F056FF1DB8C4E6EB4B64, 3DB01A20C0243FA63E0C28E6147A1F650B17FD440477DFD1AE29D1F6DA36846F ] C:\Program Files\Yahoo!\browser\YCommonPS.dll 01:10:01.0609 0x060c C:\Program Files\Yahoo!\browser\YCommonPS.dll - ok 01:10:01.0609 0x060c [ 8A4D564076F8739C8C0C2B9A461F9408, 0731BDA5D90097D5BEEB8E6B1E3B290DD3820A0F5573A22BB8D5965B651F405B ] C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.dll 01:10:01.0609 0x060c C:\Documents and Settings\All Users\Application Data\Ad-Aware Browsing Protection\adawarebp.dll - ok 01:10:01.0609 0x060c [ 51201F338ABCB964F79BE0FAB97D4941, E4182F44349119E3A6270958563275A6A22DD995A97162BD0622961C0D159AF5 ] C:\Program Files\HTC\HTC Sync 3.0\fdHttpd.dll 01:10:01.0609 0x060c C:\Program Files\HTC\HTC Sync 3.0\fdHttpd.dll - ok 01:10:01.0625 0x060c [ 04EEF4FC747068490A993C6A95B5EA7A, BD8AC26FFF5DA66B8E98F600B3B98F4E8E2273111578701F18B309AA4B94261F ] C:\WINDOWS\system32\M-AudioTaskBarIcon.exe 01:10:01.0625 0x060c C:\WINDOWS\system32\M-AudioTaskBarIcon.exe - ok 01:10:01.0625 0x060c [ 06A4250C9E3606CAE3F68DA45702F342, AAC93069838640465D570D76A5E719E2695337CBB81A7D0849549B1EDCD60930 ] C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll 01:10:01.0625 0x060c C:\Program Files\Common Files\Apple\Mobile Device Support\iTunesMobileDevice.dll - ok 01:10:01.0625 0x060c [ 29ECDA17BA5E6D98430F698587569ACC, 9C37D92CCBED1F9ED4E585F98E7FB17C6AD083712B078ABCB40476310BCDB7F8 ] C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.23084_x-ww_f3f35550\GdiPlus.dll 01:10:01.0625 0x060c C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.6002.23084_x-ww_f3f35550\GdiPlus.dll - ok 01:10:01.0640 0x060c [ 5B6E8E09BE6401A7E022F52FDFCB2FF8, 471C556CF9405BBB380A8CEFE945C126B954B7C94F79CC72441B51F80141FC5E ] C:\Program Files\Common Files\Java\Java Update\jusched.exe 01:10:01.0640 0x060c C:\Program Files\Common Files\Java\Java Update\jusched.exe - ok 01:10:01.0640 0x060c [ 165AE7A443F2139DD2C078AD87699F91, 7DAA39FA20AA399548FE907B0614D9AA88A2FF9C0FA7E40F51BE7A0395AF31FB ] C:\Program Files\Microsoft Office\OFFICE11\MSOHEV.DLL 01:10:01.0640 0x060c C:\Program Files\Microsoft Office\OFFICE11\MSOHEV.DLL - ok 01:10:01.0640 0x060c [ 5588812731C64305F2579DD8215037E0, 0FA8D3DE660670125C203B96FDA4DDF7A88B66C37F66E5F183C4BC7983E55709 ] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe 01:10:01.0640 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe - ok 01:10:01.0656 0x060c [ 92F0C2F900FA70F2B614FEDCD59832DA, BACC12C88558EADECAE5541580A3DA601E9F186B650620A8A4AD1E9D98B3F267 ] C:\Program Files\Spotify\Data\SpotifyWebHelper.exe 01:10:01.0656 0x060c C:\Program Files\Spotify\Data\SpotifyWebHelper.exe - ok 01:10:01.0656 0x060c [ ADC90EBBE2823C23A0406ACD3D6E9312, 81134759A39C0191C72D6C0DEF72200FC9C117DB1FD56DC7465E5045F41AFE52 ] C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL 01:10:01.0656 0x060c C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL - ok 01:10:01.0656 0x060c [ 5F1D5F88303D4A4DBC8E5F97BA967CC3, 5FB24FC7916A6E6B3BE7D84CB1684215B266CD1495575C2E5672B8447932E5B1 ] C:\WINDOWS\system32\ctfmon.exe 01:10:01.0656 0x060c C:\WINDOWS\system32\ctfmon.exe - ok 01:10:01.0671 0x060c [ 5E57EAB47E565BF754BCF99A410C3354, 23E64DEDBD2546FD84A14EB533C059BEC21866B51C3FD186287894E590247F40 ] C:\PROGRA~1\AD-AWA~1\AdAware.exe 01:10:01.0671 0x060c C:\PROGRA~1\AD-AWA~1\AdAware.exe - ok 01:10:01.0671 0x060c [ 88BEEF09C654252F3E46B6167B7F4ECB, 94A78D2D709AEED74BA1C29D00CFD55EF68A95764C067B470E1C19C376F32478 ] C:\WINDOWS\system32\msisip.dll 01:10:01.0671 0x060c C:\WINDOWS\system32\msisip.dll - ok 01:10:01.0671 0x060c [ 6DEC53576FFD514FC1FE0688796370D5, 8B34F7E066B1764306DA29E6B586A8FB789E6056881E2556A4584F91808DED0C ] C:\Program Files\HTC\HTC Sync 3.0\htcDetect.dll 01:10:01.0671 0x060c C:\Program Files\HTC\HTC Sync 3.0\htcDetect.dll - ok 01:10:01.0687 0x060c [ 3A6D465F379E5C815F4AD565391E654C, EE40580ED71282B1D5D95752DD843DCC30689196B22051AF8CDF6127B985411E ] C:\WINDOWS\system32\wshext.dll 01:10:01.0687 0x060c C:\WINDOWS\system32\wshext.dll - ok 01:10:01.0687 0x060c [ A2D6B331E9AE6F0C998A14E2044D11D7, 774DFB70BFD5067FBD612337ED1CE98351ED1CB885A97A8A713B80104AB1A74C ] C:\Program Files\HTC\HTC Sync 3.0\htcDisk.dll 01:10:01.0687 0x060c C:\Program Files\HTC\HTC Sync 3.0\htcDisk.dll - ok 01:10:01.0687 0x060c [ B1609DCD4CFD1BC66DE4B1FA9FDA7FB4, 954BF508E1CF000E668048033B488135C979C46DB322308B5FC4D4A1B8568635 ] C:\Program Files\HTC\HTC Sync 3.0\AutoplayControl.dll 01:10:01.0687 0x060c C:\Program Files\HTC\HTC Sync 3.0\AutoplayControl.dll - ok 01:10:01.0703 0x060c [ 49918803B661367023BF325CF602AFDC, 2821451FD31EAFCB5D3081998756F7274B4C2594E9A378EEE5C1D5D92C1FC58C ] C:\Program Files\iPod\bin\iPodService.exe 01:10:01.0703 0x060c C:\Program Files\iPod\bin\iPodService.exe - ok 01:10:01.0703 0x060c [ 40FA2F035ED88108850757CA51DAD942, C892EDD33F20FED5E8BFDFAC9DC58799B3DBE82BA1ED191929BEBEC3B626B6B0 ] C:\PROGRA~1\MICROS~2\OFFICE11\MCPS.DLL 01:10:01.0703 0x060c C:\PROGRA~1\MICROS~2\OFFICE11\MCPS.DLL - ok 01:10:01.0703 0x060c [ 897CBB14ECD56948CF6A2564229C9126, 37E49379ED94994A08659C79B79415700D2A8AB617591F47E8A15B22A5EC2682 ] C:\Program Files\Microsoft Silverlight\xapauthenticodesip.dll 01:10:01.0703 0x060c C:\Program Files\Microsoft Silverlight\xapauthenticodesip.dll - ok 01:10:01.0718 0x060c [ E40FCF943127DDC8FD60554B722D762B, 2E7A7C08B56E07D69CB32F335D93F6D2C748EFA2CF4C41102A18C7761A4E9CF0 ] C:\WINDOWS\system32\MSCTF.dll 01:10:01.0718 0x060c C:\WINDOWS\system32\MSCTF.dll - ok 01:10:01.0718 0x060c [ 17AA58A54C00F1746B8654C050491F43, AADA0D527FB96852998073E58F93710C4B3A25D7D1414BA9F23A28DA3D06B4CD ] C:\WINDOWS\system32\msutb.dll 01:10:01.0718 0x060c C:\WINDOWS\system32\msutb.dll - ok 01:10:01.0718 0x060c [ 55CAB0C877337E9E546D45CEA669F5A5, AA90B8099187D3A1BFC9E64DF9E005D65B6976A6945F32E9764A03CC2646BC8B ] C:\Program Files\HTC\HTC Sync 3.0\htcDetectLegend.dll 01:10:01.0718 0x060c C:\Program Files\HTC\HTC Sync 3.0\htcDetectLegend.dll - ok 01:10:01.0734 0x060c [ FEBC6E4831E0A39DB34C69CBDE1B58BA, 8D9A99F222A7FBF5C689BC7B15F4248BABEAC9E33817F5C411D01D76448D2CAC ] C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\backweb.dll 01:10:01.0734 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\backweb.dll - ok 01:10:01.0734 0x060c [ 9C964C7C72FD732B1A0EEC80421EDAED, 3813EEBD2CA1ADF5C6545028F36333009D5A9F5ACC1B15100E3DED21DFDA033A ] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe 01:10:01.0734 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe - ok 01:10:01.0734 0x060c [ F6FAEC07446A78A9C5AF4558FF5BD118, 9291106F6666913DB6D18943D255D60F77CCDB5A46BD4C100A5E80D40D6927D9 ] C:\WINDOWS\ime\SPTIP.dll 01:10:01.0734 0x060c C:\WINDOWS\ime\SPTIP.dll - ok 01:10:01.0750 0x060c [ C87001CBC0E191A4D21D8ABDF966AD0F, 1CA7A41CAFADA493CA84D52DED15C6B3FF470F5C8E332773107499421C676DF5 ] C:\Program Files\HTC\HTC Sync 3.0\FileSyncEngine.dll 01:10:01.0750 0x060c C:\Program Files\HTC\HTC Sync 3.0\FileSyncEngine.dll - ok 01:10:01.0750 0x060c [ 10CCD6842CA0FF024FBC9EE4F9B369BD, AC122268DB69A1CC12E520384727E4B234C2E8CB5B08A9533BD1856938B1F7FC ] C:\Program Files\HTC\HTC Sync 3.0\Utility.dll 01:10:01.0750 0x060c C:\Program Files\HTC\HTC Sync 3.0\Utility.dll - ok 01:10:01.0750 0x060c [ 341357B3632C40D2945E2FB4842E2EF6, CC46077AFA367F6996A3EDF4528AD34D577B4C337D1D49430C4B3A3150D4CDB1 ] C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwsec.dll 01:10:01.0750 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwsec.dll - ok 01:10:01.0765 0x060c [ A0B7FC085B98DBBC995F6B35CB50280F, 9166DEFCF19A8AFEE3235ADD9931BFE5980C649965BCE452CBF83152A4F5F8E2 ] C:\Program Files\iPod\bin\iPodService.Resources\en.lproj\iPodServiceLocalized.dll 01:10:01.0765 0x060c C:\Program Files\iPod\bin\iPodService.Resources\en.lproj\iPodServiceLocalized.dll - ok 01:10:01.0765 0x060c [ 4D3189DAB4A3AC3FF4B41CC5536571CD, EA2A5CF3AA1C68F15140A5ABF915C7D017419AC8747794799F0C49152265E2AF ] C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\clntutil.dll 01:10:01.0765 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\clntutil.dll - ok 01:10:01.0765 0x060c [ 9B7C7A89C8BEC0A8DF3DBEF3291B2CF7, 494E2201D9E024665BC58799D61C009CF8C04F7502E8EEC80954982402BBBBD3 ] C:\Program Files\iPod\bin\iPodService.Resources\iPodService.dll 01:10:01.0765 0x060c C:\Program Files\iPod\bin\iPodService.Resources\iPodService.dll - ok 01:10:01.0781 0x060c [ 5C1F0537E61F87B435F56E00B4F20EE8, AA4BAD8612F45125421C13536D6E7FB4C85BA6DE7D61BDE19949286FB1910B3D ] C:\WINDOWS\system32\snmpapi.dll 01:10:01.0781 0x060c C:\WINDOWS\system32\snmpapi.dll - ok 01:10:01.0781 0x060c [ B2232D645FAD62FD49D7D3EFCB7B5FB4, E21C530B616C6B0E4AC7A42731DB1F289CE686D871977FBC2F4DAEBCC48A76B8 ] C:\Program Files\HTC\HTC Sync 3.0\sqlite3.7.dll 01:10:01.0781 0x060c C:\Program Files\HTC\HTC Sync 3.0\sqlite3.7.dll - ok 01:10:01.0781 0x060c [ D9F1B39D3CD78BFD6AFB70490099BDC1, 3B7D58DA911351789370DE14A46E856498172CDB85C24D268481C14B637A6D28 ] C:\PROGRA~1\Logitech\DESKTO~1\8876480\720~1.137\Program\EN\ClientRc.dll 01:10:01.0781 0x060c C:\PROGRA~1\Logitech\DESKTO~1\8876480\720~1.137\Program\EN\ClientRc.dll - ok 01:10:01.0796 0x060c [ DFFEC6479C5E00A103A44AC33A1058AA, 518C660B2F7FE29E21241780BA9C5DF2615A8F84B04D5FE500CD6BE6C1DE99A6 ] C:\WINDOWS\system32\wmvcore.dll 01:10:01.0796 0x060c C:\WINDOWS\system32\wmvcore.dll - ok 01:10:01.0796 0x060c [ 303A63F4B913AA5D8998161CB77A8CE7, 0CE864B852E32F803754DD8827120F717D55E531E4F2BC87ECEB005F30356333 ] C:\WINDOWS\system32\feclient.dll 01:10:01.0796 0x060c C:\WINDOWS\system32\feclient.dll - ok 01:10:01.0796 0x060c [ 7365B5CA9747C84178D42CCA72486277, C056EA9FCDA15964409DAAEB7B6FB2C21A306AA2744B1F1A19E6277A4351BD97 ] C:\WINDOWS\system32\wmasf.dll 01:10:01.0796 0x060c C:\WINDOWS\system32\wmasf.dll - ok 01:10:01.0812 0x060c [ A4E87B2BD2F7A31DBC8DE7C11F3CEE17, 25CC6A5949A304455BE746D0F0DC85D3F64B07E8FC452EF9F3B7D97724DA3BF4 ] C:\PROGRA~1\AD-AWA~1\htmlayout.dll 01:10:01.0812 0x060c C:\PROGRA~1\AD-AWA~1\htmlayout.dll - ok 01:10:01.0812 0x060c [ F7066900109916EE1D426BBD0A7B4DD1, 9A7BA22124974FD3782975EC9E7121029D6BA46FF88F1BA8F0812C4EDFE4AE3A ] C:\Program Files\HTC\HTC Sync 3.0\ItemSyncEngine.dll 01:10:01.0812 0x060c C:\Program Files\HTC\HTC Sync 3.0\ItemSyncEngine.dll - ok 01:10:01.0812 0x060c [ 08C2F2FF814C813DD5B68B313B8A1ABF, BDB2FE33545DA2BECF1B8E449DBDA1E5BA4790A7B4793C3389F01E7486D937F0 ] C:\Program Files\HTC\HTC Sync 3.0\MsgSyncEngine.dll 01:10:01.0812 0x060c C:\Program Files\HTC\HTC Sync 3.0\MsgSyncEngine.dll - ok 01:10:01.0828 0x060c [ F3196D214F08A910EFEB900D7AACD452, 17F97A8723D7732778411765CCCA2E9852B64A8BB99AE7310B489ECEB239D6E5 ] C:\Program Files\HTC\HTC Sync 3.0\Maps\R66Api.dll 01:10:01.0828 0x060c C:\Program Files\HTC\HTC Sync 3.0\Maps\R66Api.dll - ok 01:10:01.0828 0x060c [ 08A73B0E7EE6E32983B5F9E540A8E380, D9FC89B19C9131C2246D82942D5E6A09F20CB488C26EF007695F1CABB53C8F91 ] C:\WINDOWS\system32\mscoree.dll 01:10:01.0828 0x060c C:\WINDOWS\system32\mscoree.dll - ok 01:10:01.0828 0x060c [ A66A0D790D72E2898829A7B1C9FC61AD, 04ADC3273BBBDC7F57E09A1830BA7F9A881CB1692BBAB3BD6919E8B230CF46F4 ] C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\Cpuinf32.dll 01:10:01.0828 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\Cpuinf32.dll - ok 01:10:01.0843 0x060c [ 02E05F70A0862BABCB21A2C6569D4BF3, F13A8E54EF58BD87C3AD103E5EC4E6D24143D9514133068F5C4CAF247347CB50 ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll 01:10:01.0843 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll - ok 01:10:01.0843 0x060c [ AA9F767125592D07DB4A0BC841D96D35, 93CEA277D4DC533A2F16F0EBD4AF56838FC71F95DB4A2407A1EB4CA1AEBB2A3C ] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWfiles-8876480.dll 01:10:01.0843 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWfiles-8876480.dll - ok 01:10:01.0843 0x060c [ F11CA562270B3802DBCD51EA9F4731BA, 03A53BAF6780B062FE649490451C76EA6493A0F0583C537157CD1B9A7C010FDF ] C:\Program Files\Logitech\SetPoint\SetPoint.exe 01:10:01.0843 0x060c C:\Program Files\Logitech\SetPoint\SetPoint.exe - ok 01:10:01.0859 0x060c [ 914D283AD234F3AF95905AEB57A8454F, B1689805CD398EEF5E1797A945DB185600B859FA67F7F3D124B91E0A32739459 ] C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwfiles.dll 01:10:01.0859 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\bwfiles.dll - ok 01:10:01.0859 0x060c [ 4D674959EA3525ECEE4DC0358E3C4103, F2AB3D5F63F07ADACD4149E389DCCB62254A362FB324DF86093710CA7B27190B ] C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll 01:10:01.0859 0x060c C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\b14359470744c840c59fbe4e58034fd6\mscorlib.ni.dll - ok 01:10:01.0859 0x060c [ D3D4BD94434A9CB4B35E82283EAE8EFB, 0C1B38EC7235CB397238C4D52349F431F0DE9D15FF4A4C6B3244023A9930BBFC ] C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe 01:10:01.0859 0x060c C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe - ok 01:10:01.0875 0x060c [ 65675BF408B12FDD5E73F0996F149778, F0660DE91AC7819DEECC447B8698C5D7986AC8C4617B2001CDDAC22CA441B5EF ] C:\DOCUME~1\Gaitens\LOCALS~1\temp\IadHide5.dll 01:10:01.0875 0x060c C:\DOCUME~1\Gaitens\LOCALS~1\temp\IadHide5.dll - ok 01:10:01.0875 0x060c [ AA9F767125592D07DB4A0BC841D96D35, 93CEA277D4DC533A2F16F0EBD4AF56838FC71F95DB4A2407A1EB4CA1AEBB2A3C ] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWDocMapExt-8876480.dll 01:10:01.0875 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWDocMapExt-8876480.dll - ok 01:10:01.0875 0x060c [ FD20854BCA467C439A7A59DFABC6637A, B9DB0D5378853195CFCD84F9E76DB1B0D0471A9F312F44355557F505A5CC6F04 ] C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWDocMapExt.dll 01:10:01.0875 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWDocMapExt.dll - ok 01:10:01.0875 0x060c [ F69344D93E2BC1118F75D9B2776D2A8C, 0D0FA1BAABD04E340DB8E794D3FD3D303218AD4CB007A895A2C3EC535E37FED3 ] C:\WINDOWS\system32\KemUtil.dll 01:10:01.0875 0x060c C:\WINDOWS\system32\KemUtil.dll - ok 01:10:01.0890 0x060c [ 98E53CA00D3C0A2E9FAA4E59C101AEBA, 9A6F978C0F1907915309F29FC2404910C3C7E205040C2B108685429E69625BD2 ] C:\WINDOWS\system32\mslbui.dll 01:10:01.0890 0x060c C:\WINDOWS\system32\mslbui.dll - ok 01:10:01.0890 0x060c [ 63E8D944AFBEEBB243F25C4ED07E74C5, 848AEE9975218939F7EB2C3548EA6AE235C54B1B2E2AF6835A034976A0CFDD28 ] C:\WINDOWS\system32\inetmib1.dll 01:10:01.0890 0x060c C:\WINDOWS\system32\inetmib1.dll - ok 01:10:01.0890 0x060c [ 02CFE63C03799157894499A83227F69D, 2126BC4961CB1E967236802B7EB6EA83E0AEA0EDAD09E32ECA6CEB638EA89F17 ] C:\Program Files\Logitech\SetPoint\SetPointCOM.DLL 01:10:01.0890 0x060c C:\Program Files\Logitech\SetPoint\SetPointCOM.DLL - ok 01:10:01.0906 0x060c [ 1509D7459A7EBE9B674ADD4108B74526, 429EB0FBF645DD2F7637768EDC0828606D1FBB8F16853E1423BBF60F65502FC1 ] C:\WINDOWS\system32\kemutb.dll 01:10:01.0906 0x060c C:\WINDOWS\system32\kemutb.dll - ok 01:10:01.0906 0x060c [ 5FEDB5B37FCC11592750BFC7D2C597B3, 402131B918B4CFCF1DC3AA7D00E390025C4F50C8576CA7E73B0B7C41F4A2432B ] C:\WINDOWS\system32\KemWnd.dll 01:10:01.0906 0x060c C:\WINDOWS\system32\KemWnd.dll - ok 01:10:01.0906 0x060c [ 5FD3B02F81B0480D5D6B43EFA0ADD4AD, 1481369E99E82101E74BD6438888BB73DDFD3EB7C314ED78D491A4A3D943A669 ] C:\WINDOWS\system32\KemXML.dll 01:10:01.0906 0x060c C:\WINDOWS\system32\KemXML.dll - ok 01:10:01.0921 0x060c [ C3951FD7FC4AEEC96EC62856B17FA420, B04EEF85064F4D0854B128BEF60144CCEAA80915E6CBB16937697AD41332552C ] C:\Program Files\Logitech\SetPoint\lgscroll.dll 01:10:01.0921 0x060c C:\Program Files\Logitech\SetPoint\lgscroll.dll - ok 01:10:01.0921 0x060c [ 0794CD09BE3D1E7A966C95E76FC86F47, 5D08099504FBDC8601C635F4358272B6E2A4D60B6AA5C7CC750A7EB12C1C6D64 ] C:\WINDOWS\system32\mshtml.dll 01:10:01.0921 0x060c C:\WINDOWS\system32\mshtml.dll - ok 01:10:01.0921 0x060c [ 2ACCD352451EC0F99AF2AD9DB6DB4439, 7EFFA9D4561674633B2FFB35F629947B061AFE5DA756DA6D02E0584FCE221445 ] C:\WINDOWS\system32\msls31.dll 01:10:01.0921 0x060c C:\WINDOWS\system32\msls31.dll - ok 01:10:01.0937 0x060c [ 1781F55C5C237C9FBD2EB0092F777CD8, 764EADCC0EE6937957434E9B73BA3D45AF468A9E8B9EF070CA8451315F753A1B ] C:\Program Files\NETGEAR\WNA1100\WNA1100.exe 01:10:01.0937 0x060c C:\Program Files\NETGEAR\WNA1100\WNA1100.exe - ok 01:10:01.0937 0x060c [ 3B3835488C3B16127C365376E57CD0A3, 81B64D175D2205BAE4D7938FDC1771638154A5BB3C0C1791A012837B0481E8B3 ] C:\Program Files\Logitech\SetPoint\Macros\MacroCore.dll 01:10:01.0937 0x060c C:\Program Files\Logitech\SetPoint\Macros\MacroCore.dll - ok 01:10:01.0937 0x060c [ CB21D826D9C39AED19DD431C1880F5DE, F1FD0F1A54F196B19A6F21044092C89C02353DAD173C236D80F6474CB8A7EA7F ] C:\Program Files\HTC\HTC Sync 3.0\msvcp60.dll 01:10:01.0937 0x060c C:\Program Files\HTC\HTC Sync 3.0\msvcp60.dll - ok 01:10:01.0953 0x060c [ 5DA30E2C6D4CBEC3B5BD2ECF21FB7B14, 2750C2C61034C8A749788187DB45E7B7E613CFF0F2A36E0EA1BACBD54B87877B ] C:\Program Files\Logitech\SetPoint\IMHook.dll 01:10:01.0953 0x060c C:\Program Files\Logitech\SetPoint\IMHook.dll - ok 01:10:01.0953 0x060c [ 77D6AB8B4F27F1577BB11D77C87DD6AA, D23B048B58BA54AC521FA41834163D4C0F5A861AE77B4CD25164DFA99912E6EE ] C:\Program Files\Ad-Aware Antivirus\SBAMSvcPS.dll 01:10:01.0953 0x060c C:\Program Files\Ad-Aware Antivirus\SBAMSvcPS.dll - ok 01:10:01.0953 0x060c [ D5E459BED3DB9CF7FC6CC1455F177D2D, FCAB2130FAB57B6728C50D5B9E9924F001C43538DE4F675DE03537FF0D9B84BD ] C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa\ATL80.dll 01:10:01.0953 0x060c C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_a4c618fa\ATL80.dll - ok 01:10:01.0968 0x060c [ FC35D7D8D83B3F82A38D3F4FC1413510, 375D07A4C9C9866B3FC70841CD2D15DFC69995819206EC1CABF54B40ADCB4A86 ] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LiteInstActivator.dll 01:10:01.0968 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LiteInstActivator.dll - ok 01:10:01.0968 0x060c [ AA9F767125592D07DB4A0BC841D96D35, 93CEA277D4DC533A2F16F0EBD4AF56838FC71F95DB4A2407A1EB4CA1AEBB2A3C ] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bwscriptext-8876480.dll 01:10:01.0968 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\Program\bwscriptext-8876480.dll - ok 01:10:01.0968 0x060c [ ACA938A939E3279DE1D07FB33BC39D02, 21134453665DAF17C9ACF8C797E81C5152273F4E0F507D45DD4CB3413846D900 ] C:\Program Files\HTC\HTC Sync 3.0\Maps\SyncEngine.API.dll 01:10:01.0968 0x060c C:\Program Files\HTC\HTC Sync 3.0\Maps\SyncEngine.API.dll - ok 01:10:01.0984 0x060c [ C19552CDF948E69DB10500F36E395A6C, 6F642183680F99A5625344B938FE0601591AE624D50E9844D9DF31A3DEC44F15 ] C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWScriptExt.dll 01:10:01.0984 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\7.2.0.137-8876480SL\Program\BWScriptExt.dll - ok 01:10:01.0984 0x060c [ 31CF51DCDA1424B813CC97B20F71B431, E3DEE0EA503F5F84B65CFD2A5216EC609313F05616E5F66605E45BA866206D1A ] C:\WINDOWS\system32\vbscript.dll 01:10:01.0984 0x060c C:\WINDOWS\system32\vbscript.dll - ok 01:10:01.0984 0x060c [ 723528449ED0D1B0AD98AF3EDF23101D, 85E00BA1E553367859ED676E0C559A6A79CE296E4B8E2996A315AFACC3CBC393 ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll 01:10:01.0984 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll - ok 01:10:02.0000 0x060c [ 7686EF44D476926BAA3412EDA4D4DD70, 8A51DC9FDEB6D0B5D83FEFD2A10917A01B1E05CB029D6095C2CF38BCE0BB2DC1 ] C:\Program Files\NETGEAR\WNA1100\WifiSvcLib.dll 01:10:02.0000 0x060c C:\Program Files\NETGEAR\WNA1100\WifiSvcLib.dll - ok 01:10:02.0000 0x060c [ 35E91579B68832B93F08FB94E0C5F2F1, 45D4DA59FCE1C64040C53C8AF5BCE55BC369CC8066DE7D2E4A12F30604DD5AFB ] C:\Program Files\Common Files\Logitech\KhalShared\KHALAPI.DLL 01:10:02.0000 0x060c C:\Program Files\Common Files\Logitech\KhalShared\KHALAPI.DLL - ok 01:10:02.0000 0x060c [ F0A0EBF086597E645BC14B0D98F8BA58, CB09BDD064F8B07CB7D08340D7DC76DC067EB8692DF0DAE55491CFB3AC7B5E6F ] C:\WINDOWS\system32\scrrun.dll 01:10:02.0000 0x060c C:\WINDOWS\system32\scrrun.dll - ok 01:10:02.0015 0x060c [ 6472932F2B6084EA1FB3F7F9493AC640, B1C4103D2B594194CD9238587990D2A06EB4DF199208FC99D50066639CA89D43 ] C:\WINDOWS\system32\wshom.ocx 01:10:02.0015 0x060c C:\WINDOWS\system32\wshom.ocx - ok 01:10:02.0015 0x060c [ 5F30686DC1E9950F0C62AD7BAB4A2F3C, EB4DC6FDE28547168D0760FDC105829F3B8B2DFBB508004083D0665B7EC45089 ] C:\Program Files\NETGEAR\WNA3100\WNA3100.exe 01:10:02.0015 0x060c C:\Program Files\NETGEAR\WNA3100\WNA3100.exe - ok 01:10:02.0015 0x060c [ A22D2028ACB0504CE2F143042740B6ED, 32507C321F96F24697E9BC58A9E080261204098884226014C53B811D18F08FC5 ] C:\Program Files\Logitech\SetPoint\kgame.dll 01:10:02.0015 0x060c C:\Program Files\Logitech\SetPoint\kgame.dll - ok 01:10:02.0031 0x060c [ D4931277DF5393E84A48B27DF40914E3, 35B175E750B0EFE45ECBBB692561F8D56368ADF36FC7A61A2E9EB78FF8D649B9 ] C:\WINDOWS\system32\riched32.dll 01:10:02.0031 0x060c C:\WINDOWS\system32\riched32.dll - ok 01:10:02.0031 0x060c [ 314EAF513DFDDDD78CFF4DDAF2702727, 51C15E030440EF3100BFCA819E6CE4AA50BA24A5347C3C6F2F7A1AC49793DFF2 ] C:\Program Files\NETGEAR\WNA3100\WifiSvcLib.dll 01:10:02.0031 0x060c C:\Program Files\NETGEAR\WNA3100\WifiSvcLib.dll - ok 01:10:02.0031 0x060c [ 132847836165759E5948F01A0A9970D7, 655961A57703E0A32DADF178F480116416FBFE50EC3D13F6F514D59372A2A0A5 ] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\SyncExt.dll 01:10:02.0031 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\Program\SyncExt.dll - ok 01:10:02.0046 0x060c [ 3E6CCE1AE2F9BB87C186DADC462C271D, 7EFC64F697D9AD8D9D7154F59CB6B19003EDAF4A071E1705EF1FA56585905A00 ] C:\Program Files\Logitech\SetPoint\gamehook.dll 01:10:02.0046 0x060c C:\Program Files\Logitech\SetPoint\gamehook.dll - ok 01:10:02.0046 0x060c [ 5FA9B930E89B8CBBB51C4DAACC002207, 67728A5161A566BDB1E0B151AAD1CB88BE89859485F9977E559EFCC0AE69CD7F ] C:\Program Files\Ad-Aware Antivirus\oehook.dll 01:10:02.0046 0x060c C:\Program Files\Ad-Aware Antivirus\oehook.dll - ok 01:10:02.0046 0x060c [ 964EC91866D50FFD6A7F7CA7490227C1, A2BF014406CBD3C0661CAE4E2AEFF364CC8039CD7FA219E21CD6DAAAD44A1163 ] C:\Program Files\HTC\HTC Sync 3.0\Maps\SyncEngine.dll 01:10:02.0046 0x060c C:\Program Files\HTC\HTC Sync 3.0\Maps\SyncEngine.dll - ok 01:10:02.0062 0x060c [ 2A769418ED33AA3E702C7327A6699E17, 4F4348EB76FC78E4DA5B7F6F6A4284C75AF68036115E286EC9C761ECB45EFBD7 ] C:\Program Files\Ad-Aware Antivirus\oecom.dll 01:10:02.0062 0x060c C:\Program Files\Ad-Aware Antivirus\oecom.dll - ok 01:10:02.0062 0x060c [ 84F862608BAA7640576D5A073BF0EF12, A1D7C109596F08F7E4777E69A36C5A32768BA5ACF500E72051DE1BAF0AA17B1F ] C:\Program Files\HTC\HTC Sync 3.0\Maps\ApplicationUtils.dll 01:10:02.0062 0x060c C:\Program Files\HTC\HTC Sync 3.0\Maps\ApplicationUtils.dll - ok 01:10:02.0062 0x060c [ 89542A319D18140413D719615B5433B5, 11D48742AFD26EDB0057AB61CCC1E8F55C284D4437E682D37DB3D08D7B0BC854 ] C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll 01:10:02.0062 0x060c C:\WINDOWS\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll - ok 01:10:02.0078 0x060c [ F41EF9D55C52703AD25AB47C86BE4DF4, 65DA04503E15A3E771120FF002F0642DA048C6F8AC48E1707C2696005BD88031 ] C:\Program Files\Logitech\SetPoint\LogitechUpdate.exe 01:10:02.0078 0x060c C:\Program Files\Logitech\SetPoint\LogitechUpdate.exe - ok 01:10:02.0078 0x060c [ FFDE5245589FFA24C5075203D2A9C314, EA1D9D2FB101ECE560CD320696973A26F4867FD3BE1F8691B622E5F40D3FBFDC ] C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe 01:10:02.0078 0x060c C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe - ok 01:10:02.0078 0x060c [ 98E6D25747919451C67CB4BF517F33B4, E774CB944AD604B0E2EBDB4523804662931CD95341A7C33F6A1730E9D4FFB277 ] C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll 01:10:02.0078 0x060c C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\10df39542df7d48462451fc39bce8418\System.ni.dll - ok 01:10:02.0093 0x060c [ 1E74DFFD0C9C9CA885159FD1F0B2DD36, 47A6AE97FEEDDC562DBDA4ADF16025B1BE2DE76D3A625B7B89D078FD5ED4C2B9 ] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmW.dll 01:10:02.0093 0x060c C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogiLdmW.dll - ok 01:10:02.0093 0x060c [ CFF61A7F4FBD3F855B8F15BDCCDF0724, 63202146F60B2DDBADBE9600260256B83B465219E1A8049437911C8D6199B0E2 ] C:\Program Files\HTC\HTC Sync 3.0\Maps\DevicesCommon.dll 01:10:02.0093 0x060c C:\Program Files\HTC\HTC Sync 3.0\Maps\DevicesCommon.dll - ok 01:10:02.0093 0x060c [ 9F01035D09841E8247C039DDFC12BBF0, AB7CA03E08933ADDEE146C31CBBFADB76B3D6BDF2A0F334AFB32CC2DF4817051 ] C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll 01:10:02.0093 0x060c C:\WINDOWS\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll - ok 01:10:02.0109 0x060c [ D5158D252C15226D01A633E7240DF0BA, 682DBC1362E9712D00F58E4BB5171216B5BEABF31E750D62639B369901DC2467 ] C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll 01:10:02.0109 0x060c C:\WINDOWS\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll - ok 01:10:02.0109 0x060c [ E76C575AA4CB5DD2C1BD23D89AF9B662, F9B105A9E986B38F0771E4957C5B2639C15A0D355201605A29B4DF87A4FD3837 ] C:\Program Files\Common Files\Logitech\KhalShared\KHALITCH.dll 01:10:02.0109 0x060c C:\Program Files\Common Files\Logitech\KhalShared\KHALITCH.dll - ok 01:10:02.0109 0x060c [ 4947BE37C54DF7B9F4DA6AEB52BA9543, 0392AE6AAE898658B76938CF9F1F9CA51E9A160034EB2AEF2D16CB460A5AEFD4 ] C:\Program Files\Common Files\Logitech\KhalShared\KHALHPP.dll 01:10:02.0109 0x060c C:\Program Files\Common Files\Logitech\KhalShared\KHALHPP.dll - ok 01:10:02.0125 0x060c [ 540E133BB34B6E3380E3292282EE1B22, C6176CED123FF0473EEFEEA4106920D2A7F7342720B18DD038A60C96261D54EE ] C:\Program Files\Common Files\Logitech\KhalShared\KHALMW.dll 01:10:02.0125 0x060c C:\Program Files\Common Files\Logitech\KhalShared\KHALMW.dll - ok 01:10:02.0125 0x060c [ FBDB9D0935B9907B809B381FDDF1627F, 3DD8FE2C7EA108C22979968F5694BD56C35BEA0B63A55965BB16AE3E5C5348EB ] C:\WINDOWS\system32\regsvr32.exe 01:10:02.0125 0x060c C:\WINDOWS\system32\regsvr32.exe - ok 01:10:02.0125 0x060c [ 2DE1190196EE9555DB548A57622022EB, 89DBC777BE06D008AABEDAC61AFC11B4FF7ABCA86C205109ED9D34D21C0B5146 ] C:\WINDOWS\system32\drprov.dll 01:10:02.0125 0x060c C:\WINDOWS\system32\drprov.dll - ok 01:10:02.0140 0x060c [ 36468087E22C57A83DF758B3F90DF73F, F6898D07CEE4F528A9F17A231CCB5E38F826A0C1926EFBF35ECCA06E0E8EE565 ] C:\WINDOWS\system32\ntlanman.dll 01:10:02.0140 0x060c C:\WINDOWS\system32\ntlanman.dll - ok 01:10:02.0140 0x060c [ AC5DF42FE314C1446B1DAD237BFCFFE0, FD53D9BCC619ED7AE4B7C29B7D457A2F61D6D340841A4E030329D7032C306AB6 ] C:\WINDOWS\system32\netui0.dll 01:10:02.0140 0x060c C:\WINDOWS\system32\netui0.dll - ok 01:10:02.0140 0x060c [ ED5A816D8E11E03F1937AC3C56826EE4, D01525B5BD9F9DDF149B78706C6C2F5AE26F5337F897C1B8763DBC67AB64F875 ] C:\WINDOWS\system32\netui1.dll 01:10:02.0140 0x060c C:\WINDOWS\system32\netui1.dll - ok 01:10:02.0156 0x060c [ CA88007C86D0B753E0252DEF588C9AE5, E961A56E7BDECC92AED3BA737F35D5317706A19605F3D3BB3D66EC6ADD7B5C3A ] C:\Program Files\Logitech\SetPoint\SetPointCOMMM9.dll 01:10:02.0156 0x060c C:\Program Files\Logitech\SetPoint\SetPointCOMMM9.dll - ok 01:10:02.0156 0x060c [ A59775245C30B9CAC21248308C84E7F8, 74A9708A6366B8ADD6E032849252C2493AC498C4AB1C6CB834943E172BA80A31 ] C:\Program Files\Logitech\SetPoint\SetPointCOMWMP9.dll 01:10:02.0156 0x060c C:\Program Files\Logitech\SetPoint\SetPointCOMWMP9.dll - ok 01:10:02.0156 0x060c [ FB8F8EEC8D9C2157789472DD61CDC78B, D5306081621FFEFF585FAD292E60207E1BCB4EA67367E12872AF73C464110C68 ] C:\WINDOWS\system32\davclnt.dll 01:10:02.0156 0x060c C:\WINDOWS\system32\davclnt.dll - ok 01:10:02.0171 0x060c [ 219AF0F9A54EBEEB3E7E20025D801034, B1E5607C27A7475FFF843428F2FBFA85ACA9829D8AA218CB1AB7B8E108F74DD7 ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll 01:10:02.0171 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Culture.dll - ok 01:10:02.0171 0x060c [ 81D2A27C916C7830743E4AFA454099F7, 48E0860DE47517ADEF303E3F16BE11D8BAD13CC675FF3BEE7D81B567BFA59FFD ] C:\WINDOWS\system32\WpdShext.dll 01:10:02.0171 0x060c C:\WINDOWS\system32\WpdShext.dll - ok 01:10:02.0171 0x060c [ 4C48F1B30A82583CAEE0DA02DD7259EE, BAD65E874EF5ED0B1BC13224ECF1BF58CF4681EFC8AB5ED41BD20ABBE3F6C12A ] C:\WINDOWS\system32\audiodev.dll 01:10:02.0171 0x060c C:\WINDOWS\system32\audiodev.dll - ok 01:10:02.0187 0x060c [ 51301ACC5E5FDA65CFA1968395E5D951, 105C78CBA5EE7F4AFC1EA22599241C58B4AC1A7182A8506D80227D5F4D6D5DA3 ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe 01:10:02.0187 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\csc.exe - ok 01:10:02.0187 0x060c [ BF67AC2C1F41BE892B98E9B8E91C0CB8, 431B0C05C1243864CBECE189400EC8BE7C1ABEE37360C40FED40C66051D01F3D ] C:\WINDOWS\system32\wiashext.dll 01:10:02.0187 0x060c C:\WINDOWS\system32\wiashext.dll - ok 01:10:02.0187 0x060c [ 98B17BDA1D0BEA2FC8313DB218C0139F, 0BF678F7FA1A7878042BBF5BE22F798104C78238A879E1F0D488BD2D3561D893 ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll 01:10:02.0187 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cscomp.dll - ok 01:10:02.0203 0x060c [ 30B5A2254561E21CCC7BA21F80165D0B, 0D19E38BF7C94C3F5708F962C7D58EC7D000B91115EE37385492B60C0D83D5B8 ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll 01:10:02.0203 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\alink.dll - ok 01:10:02.0203 0x060c [ 44DE39CB56D1919346C09C92A4B57C69, BF19497908A0DE0D65FF95C1FA723101BBE9BCB91966B9894DB6AB0C7BE04CDB ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll 01:10:02.0203 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll - ok 01:10:02.0203 0x060c [ 88E05F3B2031980A48D458EB78C67659, 060A33F770835FA60172C4E02F4C1D3D19D643A2E915D478D07A01788AD5FDB2 ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe 01:10:02.0203 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\cvtres.exe - ok 01:10:02.0218 0x060c [ 38D332A6D56AF32635675F132548343E, E6909DB836AF679B4F4D62C7396D6C82769CC7ABB8C919C2AABFE934FCE268F6 ] C:\WINDOWS\system32\drivers\fastfat.sys 01:10:02.0218 0x060c C:\WINDOWS\system32\drivers\fastfat.sys - ok 01:10:02.0218 0x060c [ 16F96C1496CBD0965285AB19A9271D02, 14313A0EFD85CCBDE8D6084144DBADD68CFE38241F76F99C356F7BE7B8E93530 ] C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll 01:10:02.0218 0x060c C:\WINDOWS\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll - ok 01:10:02.0218 0x060c [ 38BAAD389B24454993AA78F70984DADE, 982A98A162DF957C7F63F49D49E11927ABA4461C6EEA9DA9F33ACC3F55521165 ] C:\Program Files\HTC\HTC Sync 3.0\Maps\DeviceScanning.dll 01:10:02.0218 0x060c C:\Program Files\HTC\HTC Sync 3.0\Maps\DeviceScanning.dll - ok 01:10:02.0234 0x060c [ 21AF83894420D47152A8F43C564A359E, 9259C8BA6854746B19E5A3FAC016FCEC322CDF61B008D94598A0A94E9E8F5D7B ] C:\Program Files\HTC\HTC Sync 3.0\HtcUpctApi.dll 01:10:02.0234 0x060c C:\Program Files\HTC\HTC Sync 3.0\HtcUpctApi.dll - ok 01:10:02.0234 0x060c [ 860FAD57B4668A9F5F350A9D5444AE89, 841D463DC71F4B9D511CE8335BDABE59FD4631D6FE6FF946CB4F286602338BE4 ] C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll 01:10:02.0234 0x060c C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll - ok 01:10:02.0234 0x060c [ A5B31A4397B880EF5A27544E14653DE3, 0693836DA4FDD2A4F2C955924F3ACACEB9D08D4FE922450A64CE941DD5A64FD1 ] C:\Program Files\NETGEAR\WNA3100\NtgrAdapterUpdate.dll 01:10:02.0234 0x060c C:\Program Files\NETGEAR\WNA3100\NtgrAdapterUpdate.dll - ok 01:10:02.0250 0x060c [ E11457C66FDD966EE415FBBC6D9BE643, 9CAF889C740D79F56F1CE817DA7C8F2BAEE740212B578DAC509EA2C8BA2D790E ] C:\WINDOWS\system32\MSIMTF.dll 01:10:02.0250 0x060c C:\WINDOWS\system32\MSIMTF.dll - ok 01:10:02.0250 0x060c [ D43637F8E835DDF2FE95FBE6242494B0, D9F6820E1C8BDB79A065367CFBD05531D47542E4F09A991C0A6CADD9CC19CB0D ] C:\WINDOWS\ime\SPGRMR.dll 01:10:02.0250 0x060c C:\WINDOWS\ime\SPGRMR.dll - ok 01:10:02.0250 0x060c [ A7E8525FA8788CA52F728414A65BA349, 6515D3DA08EBBD721433FDA0829E2A010E6D7DA574B3ACB72DA2C45016F9A579 ] C:\Program Files\Common Files\Microsoft Shared\INK\SKCHUI.DLL 01:10:02.0250 0x060c C:\Program Files\Common Files\Microsoft Shared\INK\SKCHUI.DLL - ok 01:10:02.0265 0x060c [ 0689622E6484934EB6E5F4D3A96311F9, A7D417556512F0FB129939F70835529F3EAC3D5ACBECE5B960A97C2605AF0833 ] C:\WINDOWS\system32\jscript.dll 01:10:02.0265 0x060c C:\WINDOWS\system32\jscript.dll - ok 01:10:02.0296 0x060c AV detected via SS1: Lavasoft Ad-Aware, 5.0.5116, disabled, updated 01:10:02.0296 0x060c FW detected via SS1: Lavasoft Ad-Aware, 5.0.5116, disabled 01:10:02.0296 0x060c Win FW state via NFM: enabled 01:10:02.0296 0x060c ============================================================ 01:10:02.0296 0x060c Scan finished 01:10:02.0296 0x060c ============================================================ 01:10:02.0312 0x0830 Detected object count: 15 01:10:02.0312 0x0830 Actual detected object count: 15 01:10:42.0359 0x0830 ACS ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0359 0x0830 ACS ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0359 0x0830 DELTA ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0359 0x0830 DELTA ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0375 0x0830 jswpsapi ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0375 0x0830 jswpsapi ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0375 0x0830 LBeepKE ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0375 0x0830 LBeepKE ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0375 0x0830 McciCMService ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0375 0x0830 McciCMService ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0375 0x0830 MREMP50 ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0375 0x0830 MREMP50 ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0375 0x0830 MREMPR5 ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0375 0x0830 MREMPR5 ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0375 0x0830 MRENDIS5 ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0375 0x0830 MRENDIS5 ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0375 0x0830 MRESP50 ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0375 0x0830 MRESP50 ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0390 0x0830 PassThru Service ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0390 0x0830 PassThru Service ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0390 0x0830 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0390 0x0830 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0390 0x0830 RDID1061 ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0390 0x0830 RDID1061 ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0390 0x0830 WSIMD ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0390 0x0830 WSIMD ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0390 0x0830 WSWNA1100 ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0390 0x0830 WSWNA1100 ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:10:42.0390 0x0830 YPCService ( UnsignedFile.Multi.Generic ) - skipped by user 01:10:42.0390 0x0830 YPCService ( UnsignedFile.Multi.Generic ) - User select action: Skip 01:12:03.0687 0x0174 Deinitialize success