justime

July 24, 2013

thank you so much for helping me with my computer

July 24, 2013

thank you it is working now 1

July 23, 2013

that is all good but i did forget about this

("Combofix acidentally took out your audio service. We´ll fix this.

Please post up C:\qoobox\ComboFix-quarantined-files.txt ") and have already uninstalled combofix

July 22, 2013

# AdwCleaner v2.306 - Logfile created 07/22/2013 at 09:16:12

# Updated 19/07/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Administrator - JUSTINSMITH

# Boot Mode : Normal

# Running from : C:\Users\Administrator\Desktop\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

Deleted on reboot : C:\ProgramData\Browser Manager

File Deleted : C:\END

File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk

File Deleted : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\searchplugins\Search_Results.xml

File Deleted : C:\Users\Nyamuoch\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage

File Deleted : C:\Users\Nyamuoch\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_search.conduit.com_0.localstorage-journal

Folder Deleted : C:\Program Files (x86)\Conduit

Folder Deleted : C:\ProgramData\Ask

Folder Deleted : C:\Users\Administrator\AppData\LocalLow\AskToolbar

Folder Deleted : C:\Users\Administrator\AppData\LocalLow\boost_interprocess

Folder Deleted : C:\Users\Administrator\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Nyamuoch\AppData\Local\Conduit

Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\AVG Secure Search

Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\boost_interprocess

Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\Conduit

Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\PriceGong

Folder Deleted : C:\Users\Nyamuoch\AppData\LocalLow\Smartbar

Folder Deleted : C:\Users\Nyamuoch\AppData\Roaming\iWin

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\MyWebSearch

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\grusskartencenter.com

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\grusskartencenter.com

Key Deleted : HKCU\Software\SearchProtect

Key Deleted : HKLM\SOFTWARE\Classes\Conduit.Engine

Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0026278.BHO

Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0026278.BHO.1

Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0026278.Sandbox

Key Deleted : HKLM\SOFTWARE\Classes\CrossriderApp0026278.Sandbox.1

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT2612669

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3284668

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\Software\InstallIQ

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll

Key Deleted : HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajam_install_RASMANCS

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3B7599DF-3D5D-4EF5-BF51-9C2EDA788E83}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7C3B01BC-53A5-48A0-A43B-0C67731134B9}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\Software\SearchProtect

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{0974BA1E-64EC-11DE-B2A5-E43756D89593}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0ABE0FED-50E7-4E42-A125-57C0A11DBCDE}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{819FFE21-35C7-4925-8CDA-4E0E2DB94302}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8E9CF769-3D3B-40EB-9E2D-76E7A205E4D2}

Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [10]

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16635

[OK] Registry is clean.

-\\ Mozilla Firefox v22.0 (en-US)

File : C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\prefs.js

Deleted : user_pref("browser.search.defaultenginename", "Search Results");

Deleted : user_pref("browser.search.order.1", "Search Results");

-\\ Google Chrome v28.0.1500.72

File : C:\Users\Nyamuoch\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.25] : keyword = "search.snap.do",

File : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Preferences

Deleted [l.34] : keyword = "search.conduit.com",

*************************

AdwCleaner[s1].txt - [7272 octets] - [22/07/2013 09:16:12]

########## EOF - C:\AdwCleaner[s1].txt - [7332 octets] ##########

Results of screen317's Security Check version 0.99.70

Windows 7 Service Pack 1 x64 (UAC is enabled)

Internet Explorer 10

``````````````Antivirus/Firewall Check:``````````````

Windows Firewall Enabled!

WMI entry may not exist for antivirus; attempting automatic update.

`````````Anti-malware/Other Utilities Check:`````````

Malwarebytes Anti-Malware version 1.75.0.1300

Java 7 Update 21

Java version out of Date!

Adobe Flash Player 11.7.700.224

Adobe Reader 9 Adobe Reader out of Date!

Mozilla Firefox (22.0)

Google Chrome 28.0.1500.71

Google Chrome 28.0.1500.72

````````Process Check: objlist.exe by Laurent````````

`````````````````System Health check`````````````````

Total Fragmentation on Drive C: 0%

````````````````````End of Log``````````````````````

July 22, 2013

i have two other logs to post but have to shut everything off to do them so in a few minutes i will post them

ComboFix.txt

July 22, 2013

C:\FRST\Quarantine\SearchProtect\bin\ChromeModule.dll a variant of Win32/Conduit.SearchProtect.C application

C:\FRST\Quarantine\SearchProtect\bin\SPHook32.dll probably a variant of Win32/Conduit.SearchProtect.C application

C:\Program Files (x86)\Mozilla Firefox\browser\nsprotector.js Win32/Conduit.SearchProtect.A application

C:\Program Files (x86)\Solid Savings\Uninstall.exe multiple threats

C:\ProgramData\Spybot - Search & Destroy\Recovery\OptimumInstaller3.zip Win32/Bagle.gen.zip worm

C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\ChromeModule.dll.vir a variant of Win32/Conduit.SearchProtect.C application

C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\cltmng.exe.vir a variant of Win32/Conduit.SearchProtect.B application

C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\FirefoxModule.dll.vir a variant of Win32/Conduit.SearchProtect.C application

C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\InternetExplorerModule.dll.vir a variant of Win32/Conduit.SearchProtect.C application

C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\bin\SPHook32.dll.vir probably a variant of Win32/Conduit.SearchProtect.C application

C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\ffprotect\application.js.vir Win32/Conduit.SearchProtect.A application

C:\Qoobox\Quarantine\C\Program Files (x86)\SearchProtect\ffprotect\nsprotector.js.vir Win32/Conduit.SearchProtect.A application

C:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\ChromeModule.dll.vir a variant of Win32/Conduit.SearchProtect.C application

C:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\cltmng.exe.vir a variant of Win32/Conduit.SearchProtect.B application

C:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\FirefoxModule.dll.vir a variant of Win32/Conduit.SearchProtect.C application

C:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\InternetExplorerModule.dll.vir a variant of Win32/Conduit.SearchProtect.C application

C:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\bin\SPHook32.dll.vir probably a variant of Win32/Conduit.SearchProtect.C application

C:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\ffprotect\application.js.vir Win32/Conduit.SearchProtect.A application

C:\Qoobox\Quarantine\C\Users\Administrator\AppData\Roaming\SearchProtect\ffprotect\nsprotector.js.vir Win32/Conduit.SearchProtect.A application

C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3DZX06W6\SPSetup[1].exe multiple threats

C:\Users\Administrator\Downloads\7zip_freely_d2320532.exe a variant of Win32/InstallIQ.A application

C:\Users\Administrator\Downloads\BearShareSetup-r0-n-bc.exe Win32/Toolbar.SearchSuite application

C:\Users\Administrator\Downloads\BearShareSetup-r717-n-bf.exe Win32/Toolbar.SearchSuite application

C:\Users\Administrator\Downloads\musicoasis.exe a variant of Win32/InstallIQ.A application

C:\Users\Administrator\Downloads\backups\backup-20130512-121837-370.dll a variant of Win32/Toolbar.CrossRider.A application

C:\Users\All Users\Spybot - Search & Destroy\Recovery\OptimumInstaller3.zip Win32/Bagle.gen.zip worm

C:\Users\Nyamuoch\AppData\Roaming\Apple Computer\MobileSync\Backup\0f64c4ac547dfc239fef1a6d73dcb92a87584ede\5a39be90c1d47a707ca4808a667904cfd3d834ca Win32/Toolbar.Widgi application

July 22, 2013

system volume information, recovery, MSOCache, found.000, documents and settings

July 22, 2013

yes but i still have other folders that are locked if i could give yo a screenshot you could see what i am looking at

July 22, 2013

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-07-2013

Ran by Administrator at 2013-07-21 22:12:21 Run:1

Running from C:\Users\Administrator\Desktop

Boot Mode: Normal

==============================================

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtect => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\Run\\Browser Infrastructure Helper => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB9942 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9035 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB385 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD4923 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2016 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD6263 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1652 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2709 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1493 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD5378 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB8669 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD7274 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2841 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD3157 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1756 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2867 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB7186 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD3373 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1289 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD5433 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1967 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2396 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB8238 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9476 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1143 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD3218 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2923 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2411 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB5054 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9492 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB5856 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD8643 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB189 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2232 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB9810 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD7203 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB3460 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9781 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB1259 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD4346 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB9842 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD4782 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2748 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD5256 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB4961 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD5315 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB3015 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD715 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB3417 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2847 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB8331 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9701 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB7873 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9634 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2485 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD1385 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB4803 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD1363 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB8985 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD9048 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB2371 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD2533 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB3073 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD7775 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingB6311 => Value deleted successfully.

HKU\Nyamuoch\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SpybotDeletingD6558 => Value deleted successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0E2443F9-9665-467A-B335-E8D803135D83} => Key deleted successfully.

HKCR\CLSID\{0E2443F9-9665-467A-B335-E8D803135D83} => Key not found.

HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key deleted successfully.

HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0E2443F9-9665-467A-B335-E8D803135D83} => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{0E2443F9-9665-467A-B335-E8D803135D83} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} => Key not found.

HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key deleted successfully.

HKCR\Wow6432Node\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b} => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\\DefaultScope => Value was restored successfully.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0E2443F9-9665-467A-B335-E8D803135D83} => Key deleted successfully.

HKCR\CLSID\{0E2443F9-9665-467A-B335-E8D803135D83} => Key not found.

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key deleted successfully.

HKCR\CLSID\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} => Key not found.

C:\Users\Nyamuoch\AppData\Roaming\SearchProtect => Moved successfully.

C:\Users\Nyamuoch\AppData\Local\Smartbar => Moved successfully.

C:\ProgramData\ntuser.dat => Moved successfully.

permissions for "C:\users\administrator\documents\my music" were reset successfully

==== End of Fixlog ====

July 22, 2013

i have saved fixlist.txt to my desktop and frst64.exe is also saved to my desktop but i am not sure what you mean by

" Save it to the same direction as frst.exe (or frst64.exe) as fixlist.txt "

please clarify

July 19, 2013

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-07-2013

Ran by Administrator (administrator) on 18-07-2013 22:25:55

Running from C:\Users\Administrator\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\WLANExt.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe

(Conexant Systems, Inc.) C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe

( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe

() C:\Program Files (x86)\Hewlett-Packard\Shared\hpqToaster.exe

(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jucheck.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1808168 2009-06-18] (Synaptics Incorporated)

HKLM\...\Run: [sunJavaUpdateSched] - C:\Program Files\Java\jre6\bin\jusched.exe [171520 2009-11-01] (Sun Microsystems, Inc.)

HKLM\...\Run: [cAudioFilterAgent] - C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [495104 2009-07-14] (Conexant Systems, Inc.)

HKLM-x32\...\Run: [QlbCtrl.exe] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start [323640 2010-02-25] ( Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [WirelessAssistant] - C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [500792 2010-03-23] (Hewlett-Packard Company)

HKLM-x32\...\Run: [APSDaemon] - "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [QuickTime Task] - "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2013-05-01] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-31] (Apple Inc.)

HKLM-x32\...\Run: [AppleSyncNotifier] - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [47904 2010-09-21] (Apple Inc.)

HKU\Guest\...\RunOnce: [FlashPlayerUpdate] - C:\Windows\SysWow64\Macromed\Flash\FlashUtil10e.exe [x]

HKU\music\...\RunOnce: [Application Restart #0] - C:\Program Files (x86)\Internet Explorer\iexplore.exe -restart /WERRESTART [770648 2013-06-11] (Microsoft Corporation)

HKU\Nyamuoch\...\Run: [msnmsgr] - "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background [3883856 2009-07-26] (Microsoft Corporation)

HKU\Nyamuoch\...\Run: [smartAudio] - C:\Program Files\CONEXANT\SAII\SAIICpl.exe /c [307768 2010-06-22] ()

HKU\Nyamuoch\...\Run: [skype] - "C:\Program Files (x86)\Skype\Phone\Skype.exe" /nosplash /minimized [17418928 2012-07-13] (Skype Technologies S.A.)

HKU\Nyamuoch\...\Run: [Google Update] - "C:\Users\Nyamuoch\AppData\Local\Google\Update\GoogleUpdate.exe" /c [116648 2012-09-15] (Google Inc.)

HKU\Nyamuoch\...\Run: [DW6] - "C:\Program Files (x86)\The Weather Channel FW\Desktop\DesktopWeather.exe" [x]

HKU\Nyamuoch\...\Run: [DW7] - "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe" [x]

HKU\Nyamuoch\...\Run: [searchProtect] - C:\Users\Nyamuoch\AppData\Roaming\SearchProtect\bin\cltmng.exe [x]

HKU\Nyamuoch\...\Run: [browser Infrastructure Helper] - C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\QuickShare.exe startup [x]

HKU\Nyamuoch\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] - "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe" /PROMPT /CMPID=JUNE2013_TB [x]

HKU\Nyamuoch\...\Run: [AVG-Secure-Search-Update_JUNE2013_HP] - "C:\Program Files (x86)\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_HP.exe" /PROMPT /CMPID=JUNE2013_HP [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB9942] - command.com /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\F3EZSETP.DLL" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9035] - cmd.exe /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\F3EZSETP.DLL" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB385] - command.com /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\F3PLUGIN.DLL" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD4923] - cmd.exe /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\F3PLUGIN.DLL" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2016] - command.com /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\NPFUNWEB.DLL" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD6263] - cmd.exe /c del "C:\Program Files (x86)\FunWebProducts\Installr\1.bin\NPFUNWEB.DLL" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1652] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\1Extension.crx" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2709] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\1Extension.crx" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1493] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\BrowserHelper.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD5378] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\BrowserHelper.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB8669] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD7274] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\ProductsRemovalTool.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2841] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\RegAsm.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD3157] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\RegAsm.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1756] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.PersonalizationSettingsManager.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2867] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.PersonalizationSettingsManager.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB7186] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.UserSettingsManager.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD3373] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Personalization.Settings.UserSettingsManager.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1289] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.AutomaticUpdates.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD5433] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.AutomaticUpdates.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1967] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.BrowserHelperUtils.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2396] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.BrowserHelperUtils.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB8238] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9476] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.HistoryAndStatsWrapper.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1143] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD3218] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.LanguageSettings.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2923] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProcessDownMonitor.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2411] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProcessDownMonitor.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB5054] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductsRemovalLibary.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9492] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductsRemovalLibary.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB5856] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductUninstaller.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD8643] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ProductUninstaller.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB189] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettings.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2232] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettings.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB9810] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettingsAutoUpdater.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD7203] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SetBrowsersSettingsAutoUpdater.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB3460] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ShortcutsLibrary.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9781] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.ShortcutsLibrary.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB1259] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SideBySide.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD4346] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SideBySide.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB9842] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD4782] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2748] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD5256] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.SocialNetsSharer.XmlSerializers.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB4961] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.Translations.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD5315] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.Translations.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB3015] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.UninstallScreen.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD715] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.UninstallScreen.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB3417] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.UrlHistorySupplier.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2847] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.UrlHistorySupplier.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB8331] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.Utilities.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9701] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\Smartbar.Resources.Utilities.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB7873] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9634] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarInternetExplorerBHO.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2485] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD1385] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarInternetExplorerExtension.dll" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB4803] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD1363] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Smartbar\Application\SmartbarVersionsHelper.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB8985] - command.com /c del "C:\Users\Nyamuoch\AppData\Local\Wajam\Chrome\wajam.crx" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD9048] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Local\Wajam\Chrome\wajam.crx" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB2371] - command.com /c del "C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD2533] - cmd.exe /c del "C:\Program Files (x86)\Wajam\Updater\WajamUpdater.exe" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB3073] - command.com /c del "C:\Users\Nyamuoch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD7775] - cmd.exe /c del "C:\Users\Nyamuoch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wajam\uninstall.lnk" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingB6311] - command.com /c del "C:\Program Files (x86)\Wajam\IE\favicon.ico" [x]

HKU\Nyamuoch\...\RunOnce: [spybotDeletingD6558] - cmd.exe /c del "C:\Program Files (x86)\Wajam\IE\favicon.ico" [x]

Startup: C:\Users\Nyamuoch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMVU.lnk

ShortcutTarget: IMVU.lnk -> C:\Users\Administrator\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe (No File)

Startup: C:\Users\Nyamuoch\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZooskMessenger.lnk

ShortcutTarget: ZooskMessenger.lnk -> C:\Program Files (x86)\ZooskMessenger\ZooskMessenger.exe (No File)

BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

ProxyServer: :0

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - "C:\Program Files (x86)\Internet Explorer\iexplore.exe"

SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms}

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM - {0E2443F9-9665-467A-B335-E8D803135D83} URL = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscql

SearchScopes: HKLM - {2CC18F59-43CB-417F-B4B0-9DE87E158C04} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox

SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms}

SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms}

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM-x32 - {0E2443F9-9665-467A-B335-E8D803135D83} URL = http://www.ask.com/web?q={searchTerms}&l=dis&o=uscql

SearchScopes: HKLM-x32 - {2CC18F59-43CB-417F-B4B0-9DE87E158C04} URL = http://www.bing.com/search?q={searchTerms}&form=CPNTDF&pc=CPNTDF&src=IE-SearchBox

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms}

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69} URL = http://search.bearshare.com/web?src=ieb&q={searchTerms}

SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2612669

SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms}

SearchScopes: HKCU - {0E2443F9-9665-467A-B335-E8D803135D83} URL =

SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2002} URL = http://dts.search-results.com/sr?src=ieb&gct=ds&appid=717&systemid=2&apn_uid=0243580197474874&apn_dtid=IME002&o=APN10641&apn_ptnrs=AG2&q={searchTerms}

BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO-x32: Microsoft Live Search Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)

DPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab

DPF: HKLM-x32 {24DCAB5D-AB40-440F-9CF8-DF2F406FD3DD} http://www.stcloudstate.edu/XpressConnect/tools/xc_loader_activex.ocx

DPF: HKLM-x32 {67DABFBF-D0AB-41FA-9C46-CC0F21721616} http://download.divx.com/player/DivXBrowserPlugin.cab

DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect1262.cab

DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:

========

FF ProfilePath: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @real.com/nppl3260;version=16.0.0.282 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.0 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=16.0.0.282 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\1\NP_wtapp.dll ()

FF SearchPlugin: C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\searchplugins\Search_Results.xml

FF Extension: Yahoo! Toolbar - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}

FF Extension: HP Detect - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}

FF Extension: No Name - C:\Users\Administrator\AppData\Roaming\Mozilla\Firefox\Profiles\mmj39qj7.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi

FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF HKLM-x32\...\Firefox\Extensions: [{34712C68-7391-4c47-94F3-8F88D49AD632}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome:

=======

CHR DefaultSearchURL: (Conduit) - http://search.conduit.com/Results.aspx?q={searchTerms}&SearchSource=49&CUI=UN42569107121326115&ctid=CT3297955&UM=2

CHR DefaultSuggestURL: (Conduit) - http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}&CUI=UN42569107121326115&UM=2

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\28.0.1500.72\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File

CHR Plugin: (AVG SiteSafety plugin) - C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll No File

CHR Plugin: (Picasa) - C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Plugin: (Java Platform SE 6 U35) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File

CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File

CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (RealNetworks RealDownloader Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)

CHR Plugin: (RealNetworks RealDownloader HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)

CHR Plugin: (RealNetworks RealDownloader PepperFlashVideoShim Plug-In (32-bit) ) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)

CHR Plugin: (RealDownloader Plugin) - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)

CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll No File

CHR Plugin: (Java Deployment Toolkit 6.0.350.10) - C:\Windows\SysWOW64\npdeployJava1.dll (Oracle Corporation)

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File

CHR Plugin: (RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer Download Plugin) - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

CHR Extension: (Google Docs) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Gmail) - C:\Users\ADMINI~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [38608 2012-11-29] ()

R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()

S2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]

==================== Drivers (Whitelisted) ====================

S3 massfilter_hs; C:\Windows\system32\drivers\massfilter_hs.sys [18456 2011-07-07] (HandSet Incorporated)

S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)

S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [15712 2013-05-27] ()

S3 catchme; \??\C:\ComboFix\catchme.sys [x]

U4 eabfiltr;

S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]

S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-07-18 22:25 - 2013-07-18 22:25 - 00000000 ____D C:\FRST

2013-07-18 22:19 - 2013-07-18 22:19 - 01778207 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe

2013-07-18 09:47 - 2013-07-18 10:23 - 00000000 ____D C:\Users\Administrator\Tracing

2013-07-18 02:11 - 2013-07-18 02:11 - 00034125 _____ C:\ComboFix.txt

2013-07-18 01:20 - 2013-07-18 01:20 - 05090256 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe

2013-07-17 23:19 - 2011-06-25 22:45 - 00256000 _____ C:\Windows\PEV.exe

2013-07-17 23:19 - 2010-11-07 09:20 - 00208896 _____ C:\Windows\MBR.exe

2013-07-17 23:19 - 2009-04-19 20:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2013-07-17 23:19 - 2000-08-30 16:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2013-07-17 23:19 - 2000-08-30 16:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2013-07-17 23:19 - 2000-08-30 16:00 - 00098816 _____ C:\Windows\sed.exe

2013-07-17 23:19 - 2000-08-30 16:00 - 00080412 _____ C:\Windows\grep.exe

2013-07-17 23:19 - 2000-08-30 16:00 - 00068096 _____ C:\Windows\zip.exe

2013-07-17 23:18 - 2013-07-18 02:11 - 00000000 ____D C:\Qoobox

2013-07-17 23:18 - 2013-07-18 02:03 - 00000000 ____D C:\Windows\erdnt

2013-07-17 23:17 - 2013-07-17 23:18 - 05090256 ____R (Swearware) C:\Users\Administrator\Downloads\ComboFix.exe

2013-07-16 11:17 - 2013-07-18 10:59 - 00003362 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-820292111-1869468108-3859774255-500

2013-07-16 10:45 - 2013-07-16 10:45 - 00007605 _____ C:\Users\ADMINI~1\AppData\Local\Resmon.ResmonCfg

2013-07-16 00:21 - 2013-07-16 00:21 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\RealNetworks

2013-07-10 22:53 - 2013-06-11 15:43 - 14329856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-07-10 22:53 - 2013-06-11 15:43 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-07-10 22:53 - 2013-06-11 15:43 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-07-10 22:53 - 2013-06-11 15:43 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-07-10 22:53 - 2013-06-11 15:43 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-07-10 22:53 - 2013-06-11 15:43 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-07-10 22:53 - 2013-06-11 15:43 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-07-10 22:53 - 2013-06-11 15:42 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-07-10 22:53 - 2013-06-11 15:42 - 02046976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-07-10 22:53 - 2013-06-11 15:42 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-07-10 22:53 - 2013-06-11 15:42 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-07-10 22:53 - 2013-06-11 15:42 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-07-10 22:53 - 2013-06-11 15:42 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-07-10 22:53 - 2013-06-11 15:26 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2013-07-10 22:53 - 2013-06-11 15:26 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2013-07-10 22:53 - 2013-06-11 15:26 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2013-07-10 22:53 - 2013-06-11 15:25 - 19238912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2013-07-10 22:53 - 2013-06-11 15:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2013-07-10 22:53 - 2013-06-11 14:51 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-07-10 22:53 - 2013-06-11 14:50 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe

2013-07-10 22:53 - 2013-06-06 19:22 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2013-07-10 22:53 - 2013-06-06 18:37 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-07-10 18:41 - 2013-06-04 19:34 - 03153920 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2013-07-10 18:41 - 2013-06-03 22:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2013-07-10 18:41 - 2013-06-03 20:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2013-07-10 18:41 - 2013-05-05 22:03 - 01887744 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL

2013-07-10 18:41 - 2013-05-05 20:56 - 01620480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL

2013-07-10 18:40 - 2013-04-09 15:34 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll

2013-07-10 18:40 - 2013-04-02 14:51 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll

2013-07-07 12:42 - 2013-07-07 12:42 - 01899088 _____ (InstallX, LLC) C:\Users\Administrator\Downloads\7zip_freely_d2320532.exe

2013-07-07 10:14 - 2013-07-07 10:15 - 00000000 ____D C:\Users\Administrator\Downloads\5r553 transmission xeploded view

2013-07-07 02:09 - 2013-07-07 02:09 - 03423200 _____ (Conduit) C:\Users\Administrator\Downloads\Produtools_Manuals_2_1_B2.exe

2013-07-07 02:09 - 2013-07-07 02:09 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\CRE

2013-07-06 23:19 - 2013-07-18 10:59 - 00003244 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-820292111-1869468108-3859774255-500

2013-07-06 14:33 - 2013-07-06 14:33 - 00000000 ____D C:\ProgramData\Mozilla

2013-07-06 14:33 - 2013-07-06 14:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-06 14:28 - 2013-07-06 14:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox

2013-07-06 14:18 - 2013-07-06 14:18 - 02013672 _____ (Driver Manager) C:\Users\Administrator\Downloads\DriverManager.exe

2013-07-06 14:16 - 2013-07-06 14:16 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\DriverTuner

2013-07-06 14:15 - 2013-07-06 14:15 - 02811856 _____ (LionSea SoftWare ) C:\Users\Administrator\Downloads\setup.exe

2013-07-06 13:30 - 2013-07-18 13:34 - 00003014 _____ C:\Windows\System32\Tasks\ReclaimerUpdateXML_Administrator

2013-07-06 13:30 - 2013-07-18 13:34 - 00000398 _____ C:\Windows\Tasks\ReclaimerUpdateXML_Administrator.job

2013-07-06 13:30 - 2013-07-18 10:59 - 00000408 _____ C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job

2013-07-06 13:30 - 2013-07-17 11:34 - 00003018 _____ C:\Windows\System32\Tasks\ReclaimerUpdateFiles_Administrator

2013-07-06 13:30 - 2013-07-17 11:34 - 00000402 _____ C:\Windows\Tasks\ReclaimerUpdateFiles_Administrator.job

2013-07-06 13:30 - 2013-07-06 13:30 - 00003650 _____ C:\Windows\System32\Tasks\RNUpgradeHelperResumePrompt_Administrator

2013-07-06 13:30 - 2013-07-06 13:30 - 00002722 _____ C:\Windows\System32\Tasks\RNUpgradeHelperLogonPrompt_Administrator

2013-07-06 13:09 - 2013-07-06 13:09 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\Cyberlink

2013-07-06 13:07 - 2013-07-06 13:07 - 00000000 ___HD C:\Users\Administrator\Documents\ShadowEditFiles

2013-07-06 13:07 - 2013-07-06 13:07 - 00000000 ____D C:\Users\Administrator\Documents\CyberLink

2013-07-03 05:52 - 2013-05-09 21:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll

2013-07-03 05:52 - 2013-05-09 19:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll

2013-07-03 05:52 - 2013-04-25 15:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll

2013-07-03 05:52 - 2013-04-16 23:02 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2013-07-03 05:52 - 2013-04-16 22:24 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2013-07-03 05:52 - 2013-03-31 14:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll

2013-07-03 05:52 - 2013-03-18 21:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2013-07-03 05:52 - 2013-03-18 21:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll

2013-06-30 20:18 - 2013-06-30 20:19 - 00000000 ____D C:\Users\Administrator\Documents\VIDEO_TS

2013-06-30 20:18 - 2003-11-06 15:38 - 00000000 ____D C:\Users\Administrator\Documents\AUDIO_TS

2013-06-30 19:58 - 2013-07-06 13:07 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\CyberLink

2013-06-22 20:51 - 2013-06-22 20:51 - 01879632 _____ (InstallX, LLC) C:\Users\Administrator\Downloads\musicoasis.exe

2013-06-20 20:08 - 2013-06-21 06:30 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-06-20 20:06 - 2013-06-20 20:07 - 00000000 ____D C:\Users\Administrator\Desktop\New folder (2)

2013-06-20 20:05 - 2013-06-20 20:05 - 13169742 _____ C:\Users\Administrator\Downloads\mbar-1.06.0.1003.zip

2013-06-19 21:05 - 2013-07-18 02:04 - 00005434 _____ C:\Windows\PFRO.log

2013-06-19 20:48 - 2013-06-19 20:48 - 00377856 _____ C:\Users\Administrator\Downloads\rxmikr9j.exe

2013-06-19 20:36 - 2013-06-19 21:51 - 00000000 ____D C:\Users\Administrator\Desktop\scans

2013-06-19 18:40 - 2013-06-19 18:40 - 00084696 _____ C:\Users\ADMINI~1\AppData\Local\GDIPFONTCACHEV1.DAT

2013-06-19 18:39 - 2013-07-18 10:52 - 00002296 _____ C:\Windows\setupact.log

2013-06-19 18:39 - 2013-06-19 18:39 - 00000000 _____ C:\Windows\setuperr.log

2013-06-19 18:38 - 2013-07-16 00:18 - 00354008 _____ C:\Windows\system32\FNTCACHE.DAT

2013-06-18 18:03 - 2013-06-18 18:03 - 00001895 _____ C:\Users\Public\Desktop\MGTEK dopisp.lnk

2013-06-18 18:03 - 2013-06-18 18:03 - 00000000 ____D C:\Program Files (x86)\MGTEK

==================== One Month Modified Files and Folders =======

2013-07-18 22:25 - 2013-07-18 22:25 - 00000000 ____D C:\FRST

2013-07-18 22:19 - 2013-07-18 22:19 - 01778207 _____ (Farbar) C:\Users\Administrator\Desktop\FRST64.exe

2013-07-18 22:05 - 2010-05-24 03:59 - 00000902 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-07-18 21:57 - 2012-09-01 18:34 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-07-18 21:48 - 2012-10-13 12:37 - 00000920 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000UA.job

2013-07-18 13:34 - 2013-07-06 13:30 - 00003014 _____ C:\Windows\System32\Tasks\ReclaimerUpdateXML_Administrator

2013-07-18 13:34 - 2013-07-06 13:30 - 00000398 _____ C:\Windows\Tasks\ReclaimerUpdateXML_Administrator.job

2013-07-18 10:59 - 2013-07-16 11:17 - 00003362 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-820292111-1869468108-3859774255-500

2013-07-18 10:59 - 2013-07-06 23:19 - 00003244 _____ C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-820292111-1869468108-3859774255-500

2013-07-18 10:59 - 2013-07-06 13:30 - 00000408 _____ C:\Windows\Tasks\RNUpgradeHelperLogonPrompt_Administrator.job

2013-07-18 10:59 - 2010-05-24 03:59 - 00000898 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-07-18 10:59 - 2009-07-13 20:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-07-18 10:59 - 2009-07-13 20:45 - 00023248 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-07-18 10:52 - 2013-06-19 18:39 - 00002296 _____ C:\Windows\setupact.log

2013-07-18 10:52 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT

2013-07-18 10:49 - 2010-01-29 06:29 - 01570057 _____ C:\Windows\WindowsUpdate.log

2013-07-18 10:23 - 2013-07-18 09:47 - 00000000 ____D C:\Users\Administrator\Tracing

2013-07-18 09:49 - 2013-06-12 21:15 - 00000000 ____D C:\Users\Administrator\Desktop\New folder

2013-07-18 09:47 - 2012-08-31 11:18 - 00000000 ____D C:\Users\Administrator

2013-07-18 08:48 - 2012-10-13 12:37 - 00000868 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-820292111-1869468108-3859774255-1000Core.job

2013-07-18 02:11 - 2013-07-18 02:11 - 00034125 _____ C:\ComboFix.txt

2013-07-18 02:11 - 2013-07-17 23:18 - 00000000 ____D C:\Qoobox

2013-07-18 02:05 - 2009-07-13 18:34 - 00000215 _____ C:\Windows\system.ini

2013-07-18 02:04 - 2013-06-19 21:05 - 00005434 _____ C:\Windows\PFRO.log

2013-07-18 02:04 - 2009-07-13 18:34 - 86245376 _____ C:\Windows\system32\config\software.bak

2013-07-18 02:04 - 2009-07-13 18:34 - 15990784 _____ C:\Windows\system32\config\system.bak

2013-07-18 02:04 - 2009-07-13 18:34 - 04927488 _____ C:\Windows\system32\config\default.bak

2013-07-18 02:04 - 2009-07-13 18:34 - 00094208 _____ C:\Windows\system32\config\sam.bak

2013-07-18 02:04 - 2009-07-13 18:34 - 00028672 _____ C:\Windows\system32\config\security.bak

2013-07-18 02:03 - 2013-07-17 23:18 - 00000000 ____D C:\Windows\erdnt

2013-07-18 01:20 - 2013-07-18 01:20 - 05090256 ____R (Swearware) C:\Users\Administrator\Desktop\ComboFix.exe

2013-07-18 00:21 - 2009-07-13 19:20 - 00000000 __RHD C:\Users\Default

2013-07-17 23:18 - 2013-07-17 23:17 - 05090256 ____R (Swearware) C:\Users\Administrator\Downloads\ComboFix.exe

2013-07-17 15:49 - 2010-03-20 17:01 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log

2013-07-17 15:48 - 2012-12-05 19:40 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-07-17 11:34 - 2013-07-06 13:30 - 00003018 _____ C:\Windows\System32\Tasks\ReclaimerUpdateFiles_Administrator

2013-07-17 11:34 - 2013-07-06 13:30 - 00000402 _____ C:\Windows\Tasks\ReclaimerUpdateFiles_Administrator.job

2013-07-16 11:12 - 2013-05-08 04:11 - 00000000 ____D C:\Windows\pss

2013-07-16 10:45 - 2013-07-16 10:45 - 00007605 _____ C:\Users\ADMINI~1\AppData\Local\Resmon.ResmonCfg

2013-07-16 01:00 - 2010-05-24 03:59 - 00003898 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2013-07-16 01:00 - 2010-05-24 03:59 - 00003646 _____ C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2013-07-16 00:21 - 2013-07-16 00:21 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\RealNetworks

2013-07-16 00:21 - 2013-03-29 18:58 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\Real

2013-07-16 00:18 - 2013-06-19 18:38 - 00354008 _____ C:\Windows\system32\FNTCACHE.DAT

2013-07-16 00:18 - 2009-09-06 17:57 - 00000000 ____D C:\Windows\Panther

2013-07-16 00:16 - 2013-03-21 00:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight

2013-07-16 00:16 - 2013-03-21 00:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-07-16 00:16 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files\Windows Defender

2013-07-16 00:16 - 2009-07-13 21:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender

2013-07-10 22:55 - 2010-07-15 18:47 - 78185248 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2013-07-10 22:47 - 2009-10-31 23:03 - 00000000 ____D C:\ProgramData\Microsoft Help

2013-07-07 17:14 - 2013-04-03 16:11 - 00000364 _____ C:\Windows\Tasks\HPCeeScheduleForAdministrator.job

2013-07-07 12:42 - 2013-07-07 12:42 - 01899088 _____ (InstallX, LLC) C:\Users\Administrator\Downloads\7zip_freely_d2320532.exe

2013-07-07 10:15 - 2013-07-07 10:14 - 00000000 ____D C:\Users\Administrator\Downloads\5r553 transmission xeploded view

2013-07-07 04:10 - 2013-04-03 16:11 - 00003234 _____ C:\Windows\System32\Tasks\HPCeeScheduleForAdministrator

2013-07-07 02:09 - 2013-07-07 02:09 - 03423200 _____ (Conduit) C:\Users\Administrator\Downloads\Produtools_Manuals_2_1_B2.exe

2013-07-07 02:09 - 2013-07-07 02:09 - 00000000 ____D C:\Users\ADMINI~1\AppData\Local\CRE

2013-07-06 14:34 - 2013-05-10 06:01 - 00000000 ____D C:\Users\Administrator\AppData\Roaming\HpUpdate

2013-07-06 14:33 - 2013-07-06 14:33 - 00000000 ____D C:\ProgramData\Mozilla

2013-07-06 14:33 - 2013-07-06 14:33 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service

2013-07-06 14:33 - 2013-07-06 14:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox