Neonbrownie

is this one right? Malwarebytes still hates me... same thing, freezing up completely after the first 10-50k files are scanned. Rkill.txt

Malwarebytes is still freezing up very quickly after i start a quick scan +++++ PhysicalDrive0: Hitachi HDT725032VLA380 ATA Device +++++ --- User --- [MBR] 91391958f5c7f391dfbc71051d84a654 [bSP] 2552b2d2227b2ea2b3c92a526a1a6f5d : MBR Code unknown Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 295978 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 606164580 | Size: 9264 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: Hitachi HDT725032VLA380 ATA Device +++++ --- User --- [MBR] 9b4723ee49a02855032f34349a1fed7e [bSP] 15bfa7208b69fa7369545c4b6121896c : MBR Code unknown Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[0]_S_07162013_174735.txt >> RKreport[0]_S_07162013_152314.txt ____________________________________________________________________________ All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{937C650B-D097-4782-B5A2-F3E4E94BA9DE}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{937C650B-D097-4782-B5A2-F3E4E94BA9DE}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cca2e567-1987-4100-a3c6-5b4267084510}\ not found. Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\URLSearchHooks\\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}\ not found. Registry key HKEY_USERS\S-1-5-21-1776157465-2995741927-3370165431-1001\Software\Microsoft\Internet Explorer\SearchScopes\{cca2e567-1987-4100-a3c6-5b4267084510}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cca2e567-1987-4100-a3c6-5b4267084510}\ not found. Registry key HKEY_USERS\S-1-5-21-1776157465-2995741927-3370165431-1001\Software\Microsoft\Internet Explorer\SearchScopes\{E9FFE915-1B88-4B17-9B09-DF748F691CAB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E9FFE915-1B88-4B17-9B09-DF748F691CAB}\ not found. C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3}\skin folder moved successfully. C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome\content folder moved successfully. C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3}\chrome folder moved successfully. C:\Users\owner\AppData\Roaming\mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3} folder moved successfully. Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}\ not found. C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk moved successfully. C:\FRST\Quarantine\MyPC Backup.exe moved successfully. ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully. ADS C:\ProgramData\TEMP:DEE7A5E5 deleted successfully. ADS C:\ProgramData\TEMP:687E6626 deleted successfully. ADS C:\ProgramData\TEMP:6B803FAA deleted successfully. File ptytemp] not found. File EATERESTOREPOINT] not found. OTL by OldTimer - Version 3.2.69.0 log created on 07162013_175041 Files\Folders moved on Reboot... PendingFileRenameOperations files... Registry entries deleted on Reboot...

RogueKiller V8.6.2 [Jul 5 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.adlice.com/forum/ Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version Started in : Normal mode User : owner [Admin rights] Mode : Scan -- Date : 07/16/2013 15:23:14 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 9 ¤¤¤ [HJ POL] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND [HJ SMENU] HKCU\[...]\Advanced : Start_ShowPrinters (0) -> FOUND [HJ SMENU] HKCU\[...]\Advanced : Start_ShowRun (0) -> FOUND [HJ SMENU] HKCU\[...]\Advanced : Start_TrackProgs (0) -> FOUND [HJ DESK] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND [HJ DESK] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND [sCREENSVR][sUSP PATH] HKCU\[...]\Desktop : SCRNSAVE.EXE (C:\Windows\es.scr [-]) -> FOUND ¤¤¤ Scheduled tasks : 1 ¤¤¤ [V2][sUSP PATH] TopArcadeHits : C:\Users\owner\AppData\Local\TopArcadeHits\updater.exe [x] -> FOUND ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [LOADED] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: Hitachi HDT725032VLA380 ATA Device +++++ --- User --- [MBR] 91391958f5c7f391dfbc71051d84a654 [bSP] 2552b2d2227b2ea2b3c92a526a1a6f5d : MBR Code unknown Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 295978 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 606164580 | Size: 9264 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: Hitachi HDT725032VLA380 ATA Device +++++ --- User --- [MBR] 9b4723ee49a02855032f34349a1fed7e [bSP] 15bfa7208b69fa7369545c4b6121896c : MBR Code unknown Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 63 | Size: 305242 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[0]_S_07162013_152314.txt >> OTL.Txt Extras.Txt

here is the log for OTM.. the links that you have for rouge killer are bad. I stopped there because I don't know if the order matters or not... All processes killed ========== FILES ========== C:\Program Files\Mozilla Firefox\browser\nsprotector.js moved successfully. C:\Program Files\True Sword 4\backuped\9 folder moved successfully. C:\Program Files\True Sword 4\backuped\8 folder moved successfully. C:\Program Files\True Sword 4\backuped\7 folder moved successfully. C:\Program Files\True Sword 4\backuped\6 folder moved successfully. C:\Program Files\True Sword 4\backuped\5\Bin\2.5.0 folder moved successfully. C:\Program Files\True Sword 4\backuped\5\Bin folder moved successfully. C:\Program Files\True Sword 4\backuped\5 folder moved successfully. C:\Program Files\True Sword 4\backuped\4 folder moved successfully. C:\Program Files\True Sword 4\backuped\3 folder moved successfully. C:\Program Files\True Sword 4\backuped\2 folder moved successfully. C:\Program Files\True Sword 4\backuped\13 folder moved successfully. C:\Program Files\True Sword 4\backuped\12 folder moved successfully. C:\Program Files\True Sword 4\backuped\11 folder moved successfully. C:\Program Files\True Sword 4\backuped\10 folder moved successfully. C:\Program Files\True Sword 4\backuped\1 folder moved successfully. C:\Program Files\True Sword 4\backuped\0 folder moved successfully. C:\Program Files\True Sword 4\backuped folder moved successfully. C:\Program Files\True Sword 4 folder moved successfully. C:\Users\owner\AppData\Roaming\FrostWire\.AppSpecialShare\frostwire-5.3.3.windows.exe moved successfully. C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js moved successfully. C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js.BAK moved successfully. C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js.new moved successfully. C:\Users\owner\Downloads\Player_Setup.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: IUSR_NMPR ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Mcx1 ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: owner ->Temp folder emptied: 3094333 bytes ->Temporary Internet Files folder emptied: 36841871 bytes ->Java cache emptied: 61681235 bytes ->FireFox cache emptied: 115899442 bytes ->Google Chrome cache emptied: 23807509 bytes ->Flash cache emptied: 3602 bytes User: Public ->Temp folder emptied: 0 bytes User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes %systemdrive% .tmp files removed: 8607860 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 400007846 bytes %systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 2332763 bytes %systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 25426867 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 646.00 mb OTM by OldTimer - Version 3.1.21.0 log created on 07162013_145147 Files moved on Reboot... Registry entries deleted on Reboot...

Malwarebyte ran for about 5 minutes then froze up with a white screen and said no responding for about an hour and a half, then this txt log popped up.. Malwarebytes is still not responding but heres what the log says.. Malwarebytes Anti-Malware (Trial) 1.75.0.1300 www.malwarebytes.org Database version: v2013.07.16.05 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 7.0.6002.18005 owner :: OWNER-PC [administrator] Protection: Enabled 7/16/2013 11:21:02 AM mbam-log-2013-07-16 (11-21-02).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 288433 Time elapsed: 1 hour(s), 29 minute(s), 49 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) ___________________________________________ Ive attached the ESET scan results as well as some screenshots of whats going on incase that helps ESET SCAN.txt

Rkill is too long therefore it is attached in notepad Rkill.txt

So I did everything I was supposed too... it was fine, i re-downloaded mbam from your link and updated it ect... everytime i try to run a scan it stops responding halfway through and always at different points... but, i cannot get it to finish a scan and i never had that issue with malware bytes before... here is all of the other logs FIXLOG Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 14-07-2013 Ran by owner at 2013-07-15 18:19:42 Run:1 Running from C:\Users\owner\Desktop Boot Mode: Normal ============================================== HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\SearchProtect] - C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe [2852640 2013-05-08 => Value not found. HKU\Mcx1\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully. C:\Program Files\MyPC Backup\MyPC Backup.exe => Moved successfully. BackupStack => Service deleted successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe => Moved successfully. Could not move "C:\Windows\eHome\McrMgr.exe" => Scheduled to move on reboot. C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup => Moved successfully. C:\Program Files\SearchProtect => Moved successfully. "C:\Users\owner\AppData\Roaming\SearchProtect" directory move: C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\abstraction.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\application.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\nsprotector.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\popupTransparent.xul => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\EN => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\searchProtectorData => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\dialogsApi.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\main.html => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\SearchProtector.css => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\settings.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\ok-button.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\separation-line.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spsd\images\warning.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\bubble.css => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\bubble.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\main.html => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\information.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-LTR.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-default-RTL.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-LTR.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\spbd\images\x-mouseover-RTL.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib\jquery.min.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\ffprotect\Dialogs\lib\json2.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\dialogsApi.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\main.html => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\SearchProtector.css => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\settings.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\images\ok-button.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\images\separation-line.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spsd\images\warning.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\bubble.css => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\bubble.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\main.html => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\information.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-default-LTR.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-default-RTL.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-mouseover-LTR.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\spbd\images\x-mouseover-RTL.png => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\lib\jquery.min.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\Dialogs\lib\json2.js => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\ChromeModule.dll => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\CltMngSvc.exe => Moved successfully. Could not move "C:\Users\owner\AppData\Roaming\SearchProtect\bin\FirefoxModule.dll" => Scheduled to move on reboot. C:\Users\owner\AppData\Roaming\SearchProtect\bin\InternetExplorerModule.dll => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\msvcp100.dll => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\msvcr100.dll => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\rep.dat => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\SPHook32.dll => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\SPRunner.exe => Moved successfully. Could not move "C:\Users\owner\AppData\Roaming\SearchProtect" directory. => Scheduled to move on reboot. C:\Windows\Tasks\TopArcadeHits.job => Moved successfully. C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TopArcadeHits => Moved successfully. C:\Users\owner\AppData\Local\TopArcadeHits => Moved successfully. "C:\Program Files\MyPC Backup" directory move: C:\Program Files\MyPC Backup\AWSSDK.dll => Moved successfully. C:\Program Files\MyPC Backup\GetText.dll => Moved successfully. C:\Program Files\MyPC Backup\MPCBClient.dll => Moved successfully. C:\Program Files\MyPC Backup\Shared Stack.dll => Moved successfully. C:\Program Files\MyPC Backup\x86\System.Data.SQLite.dll => Moved successfully. C:\Program Files\MyPC Backup\log\APPLICATION.log => Moved successfully. C:\Program Files\MyPC Backup\Database\mpcb_backup_conf.db => Moved successfully. C:\Program Files\MyPC Backup\Database\mpcb_file_cache.db => Moved successfully. C:\Program Files\MyPC Backup\Database\mpcb_queues.db => Moved successfully. Could not move "C:\Program Files\MyPC Backup\Database\mpcb_settings.db" => Scheduled to move on reboot. C:\Program Files\MyPC Backup\Database\mpcb_sig_cache.db => Moved successfully. Could not move "C:\Program Files\MyPC Backup" directory. => Scheduled to move on reboot. C:\Users\owner\Desktop\MyPC Backup.lnk => Moved successfully. =========== Result of Scheduled Files to move =========== C:\Windows\eHome\McrMgr.exe => File moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect\bin\FirefoxModule.dll => Moved successfully. C:\Users\owner\AppData\Roaming\SearchProtect => Moved successfully. C:\Program Files\MyPC Backup\Database\mpcb_settings.db => Moved successfully. "C:\Program Files\MyPC Backup" => Directory could not move. ==== End of Fixlog ==== _______________________________________________________________________________________________ AdwCleaner # AdwCleaner v2.305 - Logfile created 07/15/2013 at 18:29:40 # Updated 11/07/2013 by Xplode # Operating system : Windows Vista Home Premium Service Pack 2 (32 bits) # User : owner - OWNER-PC # Boot Mode : Normal # Running from : C:\Users\owner\Downloads\AdwCleaner.exe # Option [Delete] ***** [services] ***** Stopped & Deleted : CltMngSvc ***** [Files / Folders] ***** File Deleted : C:\END File Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\eBay.lnk File Deleted : C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\alot-search.xml File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\Ask.xml File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\Askcom.xml File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\Conduit.xml File Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\search.xml Folder Deleted : C:\Program Files\Free Offers from Freeze.com Folder Deleted : C:\Program Files\Freeze.com Folder Deleted : C:\ProgramData\Ask Folder Deleted : C:\ProgramData\AVG Security Toolbar Folder Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\optimizer pro Folder Deleted : C:\ProgramData\Tarma Installer Folder Deleted : C:\Users\owner\AppData\Local\AVG Security Toolbar Folder Deleted : C:\Users\owner\AppData\Local\Conduit Folder Deleted : C:\Users\owner\AppData\Local\iac Folder Deleted : C:\Users\owner\AppData\Local\Ilivid Folder Deleted : C:\Users\owner\AppData\LocalLow\Conduit Folder Deleted : C:\Users\owner\AppData\LocalLow\MixiDJ_V34 Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\alot-appbar Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\CT3298570 Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\extensions\{55b95864-3251-45e9-bb30-1a82589aaff1} Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\extensions\appbar@alot.com Folder Deleted : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\StumbleUpon Folder Deleted : C:\Users\owner\AppData\Roaming\optimizer pro Folder Deleted : C:\Users\owner\Desktop\Save Folder Deleted : C:\Windows\Installer\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF} ***** [Registry] ***** Key Deleted : HKCU\Software\AppDataLow\Software\AVG Security Toolbar Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Key Deleted : HKCU\Software\AppDataLow\Software\MixiDJ_V34 Key Deleted : HKCU\Software\AppDataLow\Software\ShoppingReport Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\ilivid Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40B7-AC73-056A5EBA4A7E} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{79A765E1-C399-405B-85AF-466F52E918B0} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\ilivid Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\MixiDJ_V34 Toolbar Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\App Management\ARPCache\SearchProtect Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKCU\Software\Optimizer Pro Key Deleted : HKCU\Software\SearchProtect Key Deleted : HKCU\Software\Softonic Key Deleted : HKCU\Software\YahooPartnerToolbar Key Deleted : HKLM\Software\AVG Security Toolbar Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{12C9B011-2C73-45B7-9BAA-443D31B5502E} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{50F4B09B-DCDB-4292-A257-0EE136120D8E} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Key Deleted : HKLM\Software\Classes\Installer\Features\0C776EBEBCBCFBE408892EE7B12517FC Key Deleted : HKLM\Software\Classes\Installer\Products\0C776EBEBCBCFBE408892EE7B12517FC Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3298570 Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\Freeze.com Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{18B78798-92B2-4767-9B6F-0DCDF6046C0F} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B047C614-72D0-4CFE-9020-687D0104828B} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{12C9B011-2C73-45B7-9BAA-443D31B5502E} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{FD79F359-E577-46DB-AA74-D6E6B8B45BA8} Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0C776EBEBCBCFBE408892EE7B12517FC Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0FF2AEFF45EEA0A48A4B33C1973B6094 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\305B09CE8C53A214DB58887F62F25536 Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\0C776EBEBCBCFBE408892EE7B12517FC Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EBE677C0-CBCB-4EBF-8098-E27E1B5271CF} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ilivid Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect Key Deleted : HKLM\Software\MixiDJ_V34 Key Deleted : HKLM\Software\SearchProtect Key Deleted : HKLM\SOFTWARE\Software Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [searchprotect] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{55B95864-3251-45E9-BB30-1A82589AAFF1}] Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [searchProtectAll] Value Deleted : HKLM\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist [1] ***** [internet Browsers] ***** -\\ Internet Explorer v7.0.6002.18005 -\\ Mozilla Firefox v22.0 (en-US) File : C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\prefs.js C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\user.js ... Deleted ! Deleted : user_pref("CT3298570.FF19Solved", "true"); Deleted : user_pref("CT3298570.UserID", "UN26981634552045028"); Deleted : user_pref("CT3298570.browser.search.defaultthis.engineName", "true"); Deleted : user_pref("CT3298570.fullUserID", "UN26981634552045028.IN.20130713235243"); Deleted : user_pref("CT3298570.installDate", "13/07/2013 23:52:43"); Deleted : user_pref("CT3298570.installSessionId", "{01C7A2AD-4A28-4957-B371-59489627FF20}"); Deleted : user_pref("CT3298570.installSp", "TRUE"); Deleted : user_pref("CT3298570.installerVersion", "1.5.4.4"); Deleted : user_pref("CT3298570.keyword", "true"); Deleted : user_pref("CT3298570.originalSearchEngine", "Google"); Deleted : user_pref("CT3298570.originalSearchEngineName", "Ask"); Deleted : user_pref("CT3298570.searchRevert", "false"); Deleted : user_pref("CT3298570.searchUserMode", "2"); Deleted : user_pref("CT3298570.smartbar.homepage", "true"); Deleted : user_pref("CT3298570.versionFromInstaller", "10.16.4.19"); Deleted : user_pref("CT3298570.xpeMode", "0"); Deleted : user_pref("browser.search.defaultengine", "Ask.com"); Deleted : user_pref("browser.search.defaultthis.engineName", "MixiDJ V34 Customized Web Search"); Deleted : user_pref("browser.search.order.1", "Ask.com"); Deleted : user_pref("extensions.mywebsearch.prevDefaultEngine", "Google"); Deleted : user_pref("extensions.mywebsearch.prevKwdEnabled", true); Deleted : user_pref("extensions.mywebsearch.prevSelectedEngine", "Google"); Deleted : user_pref("smartbar.addressBarOwnerCTID", "CT3298570"); Deleted : user_pref("smartbar.defaultSearchOwnerCTID", "CT3298570"); Deleted : user_pref("smartbar.homePageOwnerCTID", "CT3298570"); Deleted : user_pref("smartbar.machineId", "N39IKIBBUDXIONNKHS9CYDC3E966HXEVG9G1J1ZH/XOQBDEKWMDBZO0U9UJARL1HV0U[...] -\\ Google Chrome v28.0.1500.72 File : C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Preferences Deleted [l.1] : icon_url ={"browser":{"window_placement":{"bottom":734,"left":20,"maximized":false,"right":1070,"top":20,"work[...] ************************* AdwCleaner[s1].txt - [12519 octets] - [15/07/2013 18:29:40] ########## EOF - C:\AdwCleaner[s1].txt - [12580 octets] ########## _________________________________________________________________________________________________

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 14-07-2013 Ran by owner (administrator) on 15-07-2013 17:50:06 Running from C:\Users\owner\Downloads Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English(US) Internet Explorer Version 7 Boot Mode: Normal ==================== Processes (Whitelisted) =================== (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (Microsoft Corporation) C:\Windows\system32\SLsvc.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe (NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgwdsvc.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Conduit) C:\Program Files\SearchProtect\bin\CltMngSvc.exe (Eastman Kodak Company) C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company) C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe (Realtek Semiconductor) C:\Windows\RtHDVCpl.exe (Microsoft Corporation) C:\Windows\system32\schtasks.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgtray.exe (Microsoft Corporation) C:\Windows\vVX3000.exe (Eastman Kodak Company) C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe (Microsoft Corporation) C:\Windows\ehome\ehtray.exe (Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe (Conduit) C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe (Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (MyPCBackup.com) C:\Program Files\MyPC Backup\MyPC Backup.exe (Microsoft Corporation) C:\Windows\ehome\ehmsas.exe (Hewlett-Packard Company) C:\hp\kbd\kbd.exe (NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (AVG Technologies CZ, s.r.o.) C:\Program Files\AVG\AVG2012\avgcfgex.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe (Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2007-04-18] (Hewlett-Packard Company) HKLM\...\Run: [KBD] - C:\HP\KBD\KbdStub.EXE [65536 2006-12-08] () HKLM\...\Run: [RtHDVCpl] - RtHDVCpl.exe [x] HKLM\...\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [71176 2007-05-24] (Hewlett-Packard) HKLM\...\Run: [sunJavaUpdateReg] - "C:\Windows\system32\jureg.exe" [54936 2007-04-07] (Sun Microsystems, Inc.) HKLM\...\Run: [AVG_TRAY] - "C:\Program Files\AVG\AVG2012\avgtray.exe" [2598520 2012-11-19] (AVG Technologies CZ, s.r.o.) HKLM\...\Run: [VX3000] - C:\Windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation) HKLM\...\Run: [Conime] - %windir%\system32\conime.exe [69120 2009-04-11] (Microsoft Corporation) HKLM\...\Run: [LifeCam] - "C:\Program Files\Microsoft LifeCam\LifeExp.exe" [119152 2010-05-20] (Microsoft Corporation) HKLM\...\Run: [Adobe ARM] - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated) HKLM\...\Run: [EKStatusMonitor] - C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-01-15] (Eastman Kodak Company) HKLM\...\Run: [sunJavaUpdateSched] - "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [253816 2013-03-12] (Oracle Corporation) HKLM\...\Run: [searchProtectAll] - C:\Program Files\SearchProtect\bin\cltmng.exe [2852640 2013-05-08] (Conduit) HKCU\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation) HKCU\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation) HKCU\...\Run: [searchProtect] - C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe [2852640 2013-05-08] (Conduit) HKCU\...\Policies\system: [LogonHoursAction] 2 HKCU\...\Policies\system: [DontDisplayLogonHoursWarnings] 1 HKU\Default\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x] HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x] HKU\Mcx1\...\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun [x] HKU\Mcx1\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [ 2008-01-19] (Microsoft Corporation) HKU\Mcx1\...\Winlogon: [shell] C:\Windows\eHome\McrMgr.exe [ 2009-04-11] (Microsoft Corporation) <==== ATTENTION Startup: C:\ProgramData\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MyPC Backup.lnk ShortcutTarget: MyPC Backup.lnk -> C:\Program Files\MyPC Backup\MyPC Backup.exe (MyPCBackup.com) BootExecute: autocheck autochk * C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&CUI=UN62004788929862104&UM=2&ctid=CT3298570 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=74&bd=Pavilion&pf=desktop HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm StartMenuInternet: IEXPLORE.EXE - "C:\Program Files\Internet Explorer\IEXPLORE.EXE" HKLM SearchScopes: DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298570&CUI=UN62004788929862104&UM=2 SearchScopes: HKLM - {937C650B-D097-4782-B5A2-F3E4E94BA9DE} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd SearchScopes: HKLM - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298570&CUI=UN62004788929862104&UM=2 SearchScopes: HKLM - {cca2e567-1987-4100-a3c6-5b4267084510} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^YK^xdm209^S05797^us&si=CNDirNC34bcCFac7MgoduRIATg&ptb=61CBB1CA-4ED9-4966-9A8E-712785ED9FD4&psa=&ind=2013061515&st=sb&n=77fce18b&searchfor={searchTerms} SearchScopes: HKLM - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://us.yhs.search.yahoo.com/avg/search?fr=yhs-avg-chrome&type=yahoo_avg_hs2-tb-web_chrome_us&p={searchTerms} SearchScopes: HKLM - {E071FE95-EA7A-4AB8-BA93-B1911E9C90B4} URL = http://search.live.com/results.aspx?q={searchTerms}&entrypoint={referrer:source?}&FORM=HVDUS7 SearchScopes: HKLM - {F75DDF04-551F-482A-9028-3E4144A76CDF} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=hp-pvdt HKCU SearchScopes: DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298570&CUI=UN62004788929862104&UM=2 SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=01E61C81-3FAC-4929-A477-B9CDD39384C3&apn_sauid=3C8FE59A-08BB-4A79-B5DB-20433B2B03F1 SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298570&CUI=UN62004788929862104&UM=2 SearchScopes: HKCU - {cca2e567-1987-4100-a3c6-5b4267084510} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^YK^xdm209^S05797^us&si=CNDirNC34bcCFac7MgoduRIATg&ptb=61CBB1CA-4ED9-4966-9A8E-712785ED9FD4&psa=&ind=2013061515&st=sb&n=77fce18b&searchfor={searchTerms} SearchScopes: HKCU - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} URL = http://search.avg.com/route/?d=4d916062&v=6.11.25.1&i=26&tp=chrome&q={searchTerms}&lng={language}&iy=&ychte=us SearchScopes: HKCU - {E9FFE915-1B88-4B17-9B09-DF748F691CAB} URL = http://internetsearchservice.com/search?q={searchTerms} BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO: AVG Do Not Track - {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - C:\Program Files\AVG\AVG2012\avgdtiex.dll (AVG Technologies CZ, s.r.o.) BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.) BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab DPF: {CAFEEFAC-0017-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_21-windows-i586.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.) ShellExecuteHooks: - {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No File [ ] Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.) Winsock: Catalog9 01 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Winsock: Catalog9 02 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Winsock: Catalog9 03 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Winsock: Catalog9 04 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Winsock: Catalog9 05 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Winsock: Catalog9 06 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Winsock: Catalog9 07 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Winsock: Catalog9 08 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Winsock: Catalog9 19 C:\Windows\system32\wpclsp.dll [72192] (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 FireFox: ======== FF ProfilePath: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default FF user.js: detected! => C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\user.js FF SelectedSearchEngine: Google FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll () FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin: @real.com/RhapsodyPlayerEngine,version=1.0 - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll (RealNetworks, Inc.) FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @videolan.org/vlc;version=0.8.6d - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN Team) FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\alot-search.xml FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\ask.xml FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\conduit.xml FF SearchPlugin: C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\searchplugins\search.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\answers.xml FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\creativecommons.xml FF Extension: No Name - C:\Users\owner\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} FF Extension: ALOT Appbar - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\appbar@alot.com FF Extension: Cooliris - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\piclens@cooliris(15).com FF Extension: TopArcadeHits - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{0113D088-8ED1-468C-B225-585A9C53B5E3} FF Extension: Vista-aero - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{07b2a769-ed19-4483-87ce-c643914c81bb} FF Extension: Microsoft .NET Framework Assistant - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} FF Extension: MixiDJ V34 - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{55b95864-3251-45e9-bb30-1a82589aaff1} FF Extension: Clear Cache Button - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{563e4790-7e70-11da-a72b-0800200c9a66} FF Extension: No Name - C:\Users\owner\AppData\Roaming\Mozilla\Firefox\Profiles\33a6f8sf.default\Extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696}(17) FF Extension: No Name - C:\Program Files\Mozilla Firefox\extensions\inspector@mozilla.org FF Extension: Sotfone Tracker - C:\Program Files\Mozilla Firefox\extensions\sotfone-tracker@sotfone.ru FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF HKLM\...\Firefox\Extensions: [{1E73965B-8B48-48be-9C8D-68B920ABC1C4}] C:\Program Files\AVG\AVG2012\Firefox4\ FF Extension: AVG Safe Search - C:\Program Files\AVG\AVG2012\Firefox4\ FF HKLM\...\Firefox\Extensions: [{F53C93F1-07D5-430c-86D4-C9531B27DFAF}] C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ FF Extension: AVG Do Not Track - C:\Program Files\AVG\AVG2012\Firefox\DoNotTrack\ FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 Chrome: ======= CHR Extension: (Docs) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0 CHR Extension: (Google Drive) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0 CHR Extension: (YouTube) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0 CHR Extension: (Google Search) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0 CHR Extension: () - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdgdlcjhlbaphcjmagicjhhgfnkiihp\1.0.0_0 CHR Extension: (Gmail) - C:\Users\owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0 ========================== Services (Whitelisted) ================= S4 AlertService; C:\Program Files\Intel\IntelDH\CCU\AlertService.exe [188416 2006-09-11] (Intel® Corporation) S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] () S2 AVGIDSAgent; C:\Program Files\AVG\AVG2012\avgidsagent.exe [5174392 2012-11-02] (AVG Technologies CZ, s.r.o.) R2 avgwd; C:\Program Files\AVG\AVG2012\avgwdsvc.exe [193288 2012-02-14] (AVG Technologies CZ, s.r.o.) R2 CltMngSvc; C:\Program Files\SearchProtect\bin\CltMngSvc.exe [97056 2013-05-08] (Conduit) S4 DQLWinService; C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [208896 2006-09-03] () S4 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [61440 2007-05-24] (Hewlett-Packard) S4 HPBtnSrv; c:\hp\HPEZBTN\HPBtnSrv.exe [198240 2007-05-29] () S4 IntelDHSvcConf; C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [29696 2006-05-10] (Intel® Corporation) S4 ISSM; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe [75264 2006-09-11] (Intel® Corporation) R2 Kodak AiO Network Discovery Service; C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe [395640 2013-03-15] (Eastman Kodak Company) R2 Kodak AiO Status Monitor Service; C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [780152 2013-01-15] (Eastman Kodak Company) S4 M1 Server; C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe [26624 2006-09-01] () S4 MCLServiceATL; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe [167936 2006-09-11] (Intel® Corporation) S4 Remote UI Service; C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe [544256 2006-09-11] (Intel® Corporation) S2 BackupStack; C:\Program Files\MyPC Backup\BackupStack.exe [x] ==================== Drivers (Whitelisted) ==================== R3 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [142176 2012-12-10] (AVG Technologies CZ, s.r.o. ) R3 AVGIDSFilter; C:\Windows\System32\DRIVERS\avgidsfilterx.sys [24144 2011-12-23] (AVG Technologies CZ, s.r.o. ) R0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [24896 2012-04-19] (AVG Technologies CZ, s.r.o. ) R3 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [17232 2011-12-23] (AVG Technologies CZ, s.r.o. ) R1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [250080 2012-11-08] (AVG Technologies CZ, s.r.o.) R1 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [41040 2011-12-23] (AVG Technologies CZ, s.r.o.) R0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [31952 2012-01-31] (AVG Technologies CZ, s.r.o.) R1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [302368 2013-04-11] (AVG Technologies CZ, s.r.o.) S3 FETNDIS; C:\Windows\System32\DRIVERS\fetnd5.sys [45568 2006-11-02] (VIA Technologies, Inc. ) S3 KMWDFILTER; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [17408 2008-10-09] (Windows ® Codename Longhorn DDK provider) R3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-07-15] (Malwarebytes Corporation) R3 slnt; C:\Windows\System32\DRIVERS\slnt.sys [17999 2007-03-10] (Silan Micro-Electronics Inc.) S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [x] S3 catchme; \??\C:\Users\owner\AppData\Local\Temp\catchme.sys [x] S3 IpInIp; system32\DRIVERS\ipinip.sys [x] S0 is3srv; system32\drivers\is3srv.sys [x] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x] S1 SASKUTIL; \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys [x] S0 szkg5; system32\DRIVERS\szkg.sys [x] S0 szkgfs; system32\drivers\szkgfs.sys [x] S3 USBAAPL; System32\Drivers\usbaapl.sys [x] U3 mbr; \??\C:\Users\owner\AppData\Local\Temp\mbr.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-07-15 17:50 - 2013-07-15 17:50 - 00000000 ___DC C:\FRST 2013-07-15 17:49 - 2013-07-15 17:49 - 01218214 _____ (Farbar) C:\Users\owner\Downloads\FRST.exe 2013-07-15 17:31 - 2013-07-15 17:31 - 00018696 _____ C:\Users\owner\Desktop\dds.txt 2013-07-15 17:31 - 2013-07-15 17:31 - 00016144 _____ C:\Users\owner\Desktop\attach.txt 2013-07-15 17:16 - 2013-07-15 17:16 - 00688992 ____R (Swearware) C:\Users\owner\Downloads\dds.scr 2013-07-15 17:09 - 2013-07-15 17:09 - 00000045 _____ C:\Users\owner\Desktop\Malwarebytes key.txt 2013-07-15 16:12 - 2013-07-15 16:12 - 520832733 _____ C:\Windows\MEMORY.DMP 2013-07-15 16:12 - 2013-07-15 16:12 - 00157016 _____ C:\Windows\Minidump\Mini071513-01.dmp 2013-07-14 00:32 - 2013-07-14 00:32 - 00016688 ____C C:\ComboFix.txt 2013-07-14 00:14 - 2011-06-26 01:45 - 00256000 _____ C:\Windows\PEV.exe 2013-07-14 00:14 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2013-07-14 00:14 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2013-07-14 00:14 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2013-07-14 00:11 - 2013-07-14 00:12 - 05088600 ____R (Swearware) C:\Users\owner\Downloads\ComboFix.exe 2013-07-14 00:10 - 2013-07-14 00:11 - 04745728 _____ (AVAST Software) C:\Users\owner\Downloads\aswMBR.exe 2013-07-14 00:04 - 2013-07-14 00:04 - 00001906 _____ C:\Users\Public\Desktop\VAFPlayer.lnk 2013-07-14 00:04 - 2013-07-14 00:04 - 00000000 ____D C:\Users\owner\AppData\Roaming\player 2013-07-14 00:01 - 2013-07-14 00:01 - 00000541 _____ C:\Windows\KB893803v2.log 2013-07-13 23:55 - 2013-07-13 23:55 - 00000000 ____D C:\Users\owner\AppData\Local\Conduit 2013-07-13 23:54 - 2013-07-15 15:16 - 00000000 ____D C:\Program Files\MyPC Backup 2013-07-13 23:54 - 2013-07-13 23:55 - 00000000 ____D C:\Users\owner\AppData\Local\CRE 2013-07-13 23:54 - 2013-07-13 23:54 - 00000886 _____ C:\Users\owner\Desktop\MyPC Backup.lnk 2013-07-13 23:54 - 2013-07-13 23:54 - 00000000 ____D C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup 2013-07-13 23:53 - 2013-07-13 23:53 - 00000000 ____D C:\Program Files\SearchProtect 2013-07-13 23:52 - 2013-07-13 23:58 - 00000000 ____D C:\Users\owner\AppData\Roaming\SearchProtect 2013-07-13 23:52 - 2013-07-13 23:52 - 00000000 ____D C:\Users\owner\AppData\Roaming\Optimizer Pro 2013-07-13 23:51 - 2013-07-15 16:53 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys 2013-07-13 23:49 - 2013-07-14 17:54 - 00000264 _____ C:\Windows\Tasks\TopArcadeHits.job 2013-07-13 23:49 - 2013-07-13 23:56 - 00000009 ____C C:\END 2013-07-13 23:49 - 2013-07-13 23:49 - 00000000 ____D C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TopArcadeHits 2013-07-13 23:49 - 2013-07-13 23:49 - 00000000 ____D C:\Users\owner\AppData\Local\TopArcadeHits 2013-07-13 23:48 - 2013-07-13 23:48 - 00525432 _____ C:\Users\owner\Downloads\Player_Setup.exe 2013-07-12 10:21 - 2013-07-12 10:28 - 00045173 _____ C:\Users\Public\A & D Agent 8300 Spreadsheet 7.ods 2013-07-12 10:21 - 2013-07-12 10:21 - 00000631 _____ C:\Users\owner\Desktop\A & D Agent 8300 Spreadsheet 1 - Shortcut.lnk 2013-07-11 03:56 - 2013-06-03 20:50 - 02049024 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-07-11 03:52 - 2013-04-17 06:28 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll 2013-07-11 03:52 - 2013-04-17 06:28 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll 2013-07-11 03:52 - 2013-04-17 06:28 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll 2013-07-11 03:52 - 2013-04-17 06:28 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll 2013-07-11 03:52 - 2013-04-17 05:34 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2013-07-11 03:52 - 2013-04-17 05:33 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2013-07-11 03:52 - 2013-04-17 05:14 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2013-07-11 03:52 - 2013-04-17 05:10 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2013-07-11 03:52 - 2013-04-17 05:10 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2013-07-11 03:51 - 2013-05-31 23:06 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2013-07-11 03:50 - 2013-05-07 23:04 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-07-11 03:49 - 2013-06-03 23:19 - 01176576 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-07-11 03:49 - 2013-06-03 23:19 - 00834048 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-07-11 03:49 - 2013-06-03 23:19 - 00106496 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-07-11 03:49 - 2013-06-03 23:18 - 03625472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-07-11 03:49 - 2013-06-03 23:18 - 00671232 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll 2013-07-11 03:49 - 2013-06-03 23:18 - 00479744 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-07-11 03:49 - 2013-06-03 23:17 - 06118400 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-07-11 03:49 - 2013-06-03 23:17 - 00498688 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-07-11 03:49 - 2013-06-03 23:17 - 00380928 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2013-07-11 03:49 - 2013-06-03 23:17 - 00270336 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-07-11 03:49 - 2013-06-03 23:17 - 00193024 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2013-07-11 03:49 - 2013-06-03 23:17 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-07-11 03:49 - 2013-06-03 23:17 - 00027648 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-07-11 03:49 - 2013-06-03 21:32 - 00389632 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2013-07-11 03:49 - 2013-06-03 21:04 - 01383424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-07-08 09:44 - 2013-07-08 09:44 - 00047110 _____ C:\Users\owner\Downloads\prodrivf.exe 2013-07-05 16:24 - 2013-07-06 02:08 - 00000000 ____D C:\Users\owner\Desktop\Save 2013-07-05 16:24 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll 2013-07-05 16:24 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll 2013-07-05 16:24 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll 2013-07-05 16:24 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll 2013-07-05 16:24 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll 2013-07-05 16:24 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll 2013-07-05 16:24 - 2010-02-04 10:01 - 00528216 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_6.dll 2013-07-05 16:24 - 2010-02-04 10:01 - 00238936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_6.dll 2013-07-05 16:24 - 2010-02-04 10:01 - 00074072 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_4.dll 2013-07-05 16:24 - 2010-02-04 10:01 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_7.dll 2013-07-05 16:24 - 2009-09-04 17:44 - 00238936 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_5.dll 2013-07-05 16:24 - 2009-09-04 17:29 - 05501792 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_42.dll 2013-07-05 16:24 - 2009-09-04 17:29 - 00235344 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_42.dll 2013-07-05 16:24 - 2009-03-16 14:18 - 00517448 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_4.dll 2013-07-05 16:24 - 2009-03-16 14:18 - 00235352 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_4.dll 2013-07-05 16:24 - 2009-03-16 14:18 - 00022360 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_6.dll 2013-07-05 16:24 - 2009-03-09 15:27 - 04178264 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_41.dll 2013-07-05 16:24 - 2008-10-27 10:04 - 00514384 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_3.dll 2013-07-05 16:24 - 2008-10-27 10:04 - 00235856 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_3.dll 2013-07-05 16:24 - 2008-10-27 10:04 - 00070992 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_2.dll 2013-07-05 16:24 - 2008-10-27 10:04 - 00023376 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_5.dll 2013-07-05 16:24 - 2008-10-10 04:52 - 04379984 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_40.dll 2013-07-05 16:24 - 2008-10-10 04:52 - 02036576 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_40.dll 2013-07-05 16:24 - 2008-10-10 04:52 - 00452440 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_40.dll 2013-07-05 16:24 - 2008-07-31 10:41 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_2.dll 2013-07-05 16:24 - 2008-07-31 10:41 - 00068616 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_1.dll 2013-07-05 16:24 - 2008-07-31 10:40 - 00509448 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_2.dll 2013-07-05 16:24 - 2008-07-10 11:01 - 00467984 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_39.dll 2013-07-05 16:24 - 2008-07-10 11:00 - 03851784 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_39.dll 2013-07-05 16:24 - 2008-07-10 11:00 - 01493528 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_39.dll 2013-07-05 16:24 - 2008-05-30 14:19 - 00507400 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_1.dll 2013-07-05 16:24 - 2008-05-30 14:18 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_1.dll 2013-07-05 16:24 - 2008-05-30 14:17 - 00065032 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_0.dll 2013-07-05 16:24 - 2008-05-30 14:17 - 00025608 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_4.dll 2013-07-05 16:24 - 2008-05-30 14:11 - 03850760 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_38.dll 2013-07-05 16:24 - 2008-05-30 14:11 - 01491992 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_38.dll 2013-07-05 16:24 - 2008-05-30 14:11 - 00467984 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_38.dll 2013-07-05 16:24 - 2008-03-05 16:03 - 00479752 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_0.dll 2013-07-05 16:24 - 2008-03-05 16:03 - 00238088 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_0.dll 2013-07-05 16:24 - 2008-03-05 16:00 - 00025608 _____ (Microsoft Corporation) C:\Windows\system32\X3DAudio1_3.dll 2013-07-05 16:24 - 2008-03-05 15:56 - 03786760 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_37.dll 2013-07-05 16:24 - 2008-03-05 15:56 - 01420824 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_37.dll 2013-07-05 16:24 - 2008-02-05 23:07 - 00462864 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_37.dll 2013-07-05 16:18 - 2013-07-05 16:18 - 00292184 _____ (Microsoft Corporation) C:\Users\owner\Downloads\dxwebsetup.exe 2013-07-05 16:07 - 2013-07-05 16:11 - 33172507 _____ C:\Users\owner\Downloads\cw.rar 2013-07-05 16:06 - 2013-07-05 16:06 - 00000841 _____ C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk 2013-07-05 15:56 - 2013-07-05 15:59 - 00000000 ____D C:\Users\owner\AppData\Local\iLivid 2013-07-05 15:56 - 2013-07-05 15:56 - 01624112 _____ (Bandoo Media Inc) C:\Users\owner\Downloads\iLividSetup-r362-n-bf.exe 2013-07-04 20:26 - 2013-07-04 20:26 - 00800208 _____ (Google Inc.) C:\Users\owner\Downloads\ChromeSetup.exe 2013-07-04 20:13 - 2013-07-04 20:13 - 00000049 _____ C:\Users\owner\jagex_cl_runescape_LIVE_BETA.dat 2013-07-02 23:11 - 2013-07-02 23:11 - 00000000 ____D C:\Users\owner\AppData\Roaming\NVIDIA 2013-07-02 22:50 - 2013-07-15 01:54 - 00000024 _____ C:\Users\owner\random.dat 2013-07-02 22:50 - 2013-07-15 00:28 - 00000044 _____ C:\Users\owner\jagex_cl_oldschool_LIVE.dat 2013-07-02 22:50 - 2013-07-04 20:13 - 00000000 ____D C:\Users\owner\jagexcache 2013-07-02 22:19 - 2013-07-15 00:26 - 00000032 _____ C:\Users\owner\jagex_cl_runescape_LIVE.dat 2013-07-02 22:18 - 2013-07-02 22:17 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-07-02 22:18 - 2013-07-02 22:17 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-07-02 22:18 - 2013-07-02 22:17 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-07-02 22:18 - 2013-07-02 22:17 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2013-07-02 22:07 - 2013-07-02 22:08 - 00903080 _____ (Oracle Corporation) C:\Users\owner\Downloads\jre-7u25-windows-i586-iftw.exe 2013-07-02 22:05 - 2013-07-02 22:11 - 41404760 _____ (Apple Inc.) C:\Users\owner\Downloads\QuickTimeInstaller(1).exe 2013-07-01 20:52 - 2013-07-08 02:50 - 00001618 _____ C:\Windows\setupact.log 2013-07-01 20:52 - 2013-07-01 20:52 - 00000000 _____ C:\Windows\setuperr.log 2013-06-30 12:00 - 2013-06-30 12:06 - 41404760 _____ (Apple Inc.) C:\Users\owner\Downloads\QuickTimeInstaller.exe 2013-06-24 23:26 - 2013-06-24 23:28 - 00229888 ___SH C:\Users\Public\Thumbs.db 2013-06-23 13:57 - 2013-06-23 14:51 - 00000000 ____D C:\ProgramData\ElectricSheep 2013-06-23 13:57 - 2013-06-23 14:08 - 00000000 ____D C:\Program Files\Electric Sheep 2013-06-23 13:57 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll 2013-06-23 13:57 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll 2013-06-23 13:51 - 2013-06-23 13:53 - 19980474 _____ C:\Users\owner\Downloads\electricsheep-2.7b34c.exe 2013-06-15 14:48 - 2013-06-15 14:48 - 00000000 ____D C:\Users\owner\Documents\My muvees 2013-06-15 14:34 - 2013-06-15 14:34 - 00000000 ____D C:\Users\owner\Documents\Poetry 2013-06-15 14:26 - 2013-06-15 14:26 - 00000000 ____D C:\Users\owner\AppData\Local\IAC 2013-06-15 14:09 - 2013-06-15 14:09 - 00000610 _____ C:\Users\owner\Desktop\Public - Shortcut.lnk ==================== One Month Modified Files and Folders ======= 2013-07-15 17:50 - 2013-07-15 17:50 - 00000000 ___DC C:\FRST 2013-07-15 17:49 - 2013-07-15 17:49 - 01218214 _____ (Farbar) C:\Users\owner\Downloads\FRST.exe 2013-07-15 17:48 - 2006-11-02 07:47 - 00003696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2013-07-15 17:48 - 2006-11-02 07:47 - 00003696 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2013-07-15 17:41 - 2013-03-14 21:42 - 00000884 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-07-15 17:36 - 2013-06-13 14:13 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-07-15 17:31 - 2013-07-15 17:31 - 00018696 _____ C:\Users\owner\Desktop\dds.txt 2013-07-15 17:31 - 2013-07-15 17:31 - 00016144 _____ C:\Users\owner\Desktop\attach.txt 2013-07-15 17:31 - 2007-10-15 19:55 - 00000000 ___RD C:\Users\owner\Desktop 2013-07-15 17:27 - 2007-09-05 03:42 - 01559368 _____ C:\Windows\WindowsUpdate.log 2013-07-15 17:16 - 2013-07-15 17:16 - 00688992 ____R (Swearware) C:\Users\owner\Downloads\dds.scr 2013-07-15 17:09 - 2013-07-15 17:09 - 00000045 _____ C:\Users\owner\Desktop\Malwarebytes key.txt 2013-07-15 16:53 - 2013-07-13 23:51 - 00040776 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamswissarmy.sys 2013-07-15 16:13 - 2013-03-14 21:42 - 00000880 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-07-15 16:12 - 2013-07-15 16:12 - 520832733 _____ C:\Windows\MEMORY.DMP 2013-07-15 16:12 - 2013-07-15 16:12 - 00157016 _____ C:\Windows\Minidump\Mini071513-01.dmp 2013-07-15 16:12 - 2012-06-14 13:07 - 00000000 ____D C:\ProgramData\Kodak 2013-07-15 16:12 - 2008-08-13 14:01 - 00065536 _____ C:\Windows\system32\Ikeext.etl 2013-07-15 16:12 - 2008-08-11 19:16 - 00000000 ____D C:\Windows\Minidump 2013-07-15 16:12 - 2006-11-02 08:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-07-15 15:19 - 2011-03-28 23:28 - 00000000 ____D C:\Windows\system32\Drivers\AVG 2013-07-15 15:16 - 2013-07-13 23:54 - 00000000 ____D C:\Program Files\MyPC Backup 2013-07-15 15:15 - 2007-10-16 21:09 - 00000418 ____H C:\Windows\Tasks\User_Feed_Synchronization-{C19F805A-6953-4FE1-8FB9-206C6F3EEC50}.job 2013-07-15 15:14 - 2011-04-26 18:28 - 00104506 _____ C:\Windows\PFRO.log 2013-07-15 07:23 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\tracing 2013-07-15 03:11 - 2006-11-02 06:18 - 00000000 ____D C:\Windows\Microsoft.NET 2013-07-15 03:07 - 2006-11-02 05:33 - 00750960 _____ C:\Windows\system32\PerfStringBackup.INI 2013-07-15 01:54 - 2013-07-02 22:50 - 00000024 _____ C:\Users\owner\random.dat 2013-07-15 00:28 - 2013-07-02 22:50 - 00000044 _____ C:\Users\owner\jagex_cl_oldschool_LIVE.dat 2013-07-15 00:28 - 2013-01-11 03:14 - 00000000 ____D C:\Program Files\Mozilla Firefox 2013-07-15 00:26 - 2013-07-02 22:19 - 00000032 _____ C:\Users\owner\jagex_cl_runescape_LIVE.dat 2013-07-14 17:54 - 2013-07-13 23:49 - 00000264 _____ C:\Windows\Tasks\TopArcadeHits.job 2013-07-14 03:03 - 2006-11-02 07:37 - 00000000 ____D C:\Windows\system32\XPSViewer 2013-07-14 00:32 - 2013-07-14 00:32 - 00016688 ____C C:\ComboFix.txt 2013-07-14 00:32 - 2009-10-26 18:51 - 00000000 ____D C:\Qoobox 2013-07-14 00:28 - 2006-11-02 05:23 - 00000215 ____C C:\Windows\system.ini 2013-07-14 00:12 - 2013-07-14 00:11 - 05088600 ____R (Swearware) C:\Users\owner\Downloads\ComboFix.exe 2013-07-14 00:11 - 2013-07-14 00:10 - 04745728 _____ (AVAST Software) C:\Users\owner\Downloads\aswMBR.exe 2013-07-14 00:04 - 2013-07-14 00:04 - 00001906 _____ C:\Users\Public\Desktop\VAFPlayer.lnk 2013-07-14 00:04 - 2013-07-14 00:04 - 00000000 ____D C:\Users\owner\AppData\Roaming\player 2013-07-14 00:04 - 2006-11-02 06:18 - 00000000 __RHD C:\Users\Public\Desktop 2013-07-14 00:01 - 2013-07-14 00:01 - 00000541 _____ C:\Windows\KB893803v2.log 2013-07-13 23:58 - 2013-07-13 23:52 - 00000000 ____D C:\Users\owner\AppData\Roaming\SearchProtect 2013-07-13 23:56 - 2013-07-13 23:49 - 00000009 ____C C:\END 2013-07-13 23:55 - 2013-07-13 23:55 - 00000000 ____D C:\Users\owner\AppData\Local\Conduit 2013-07-13 23:55 - 2013-07-13 23:54 - 00000000 ____D C:\Users\owner\AppData\Local\CRE 2013-07-13 23:54 - 2013-07-13 23:54 - 00000886 _____ C:\Users\owner\Desktop\MyPC Backup.lnk 2013-07-13 23:54 - 2013-07-13 23:54 - 00000000 ____D C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyPC Backup 2013-07-13 23:53 - 2013-07-13 23:53 - 00000000 ____D C:\Program Files\SearchProtect 2013-07-13 23:52 - 2013-07-13 23:52 - 00000000 ____D C:\Users\owner\AppData\Roaming\Optimizer Pro 2013-07-13 23:49 - 2013-07-13 23:49 - 00000000 ____D C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TopArcadeHits 2013-07-13 23:49 - 2013-07-13 23:49 - 00000000 ____D C:\Users\owner\AppData\Local\TopArcadeHits 2013-07-13 23:48 - 2013-07-13 23:48 - 00525432 _____ C:\Users\owner\Downloads\Player_Setup.exe 2013-07-13 03:21 - 2006-11-02 08:01 - 00032642 _____ C:\Windows\Tasks\SCHEDLGU.TXT 2013-07-12 20:12 - 2006-11-02 07:47 - 00305176 _____ C:\Windows\system32\FNTCACHE.DAT 2013-07-12 20:10 - 2009-07-25 22:25 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-07-12 10:28 - 2013-07-12 10:21 - 00045173 _____ C:\Users\Public\A & D Agent 8300 Spreadsheet 7.ods 2013-07-12 10:28 - 2006-11-02 06:18 - 00000000 ___RD C:\Users\Public 2013-07-12 10:21 - 2013-07-12 10:21 - 00000631 _____ C:\Users\owner\Desktop\A & D Agent 8300 Spreadsheet 1 - Shortcut.lnk 2013-07-12 03:03 - 2006-11-02 07:37 - 00000000 ____D C:\Program Files\Windows Journal 2013-07-08 19:07 - 2013-04-07 20:58 - 00000000 ____D C:\Users\Public\Documents\Work 2013-07-08 09:44 - 2013-07-08 09:44 - 00047110 _____ C:\Users\owner\Downloads\prodrivf.exe 2013-07-08 02:50 - 2013-07-01 20:52 - 00001618 _____ C:\Windows\setupact.log 2013-07-06 02:08 - 2013-07-05 16:24 - 00000000 ____D C:\Users\owner\Desktop\Save 2013-07-05 16:24 - 2008-08-19 00:19 - 00000000 ____D C:\Windows\system32\directx 2013-07-05 16:18 - 2013-07-05 16:18 - 00292184 _____ (Microsoft Corporation) C:\Users\owner\Downloads\dxwebsetup.exe 2013-07-05 16:11 - 2013-07-05 16:07 - 33172507 _____ C:\Users\owner\Downloads\cw.rar 2013-07-05 16:06 - 2013-07-05 16:06 - 00000841 _____ C:\Users\owner\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\iLivid.lnk 2013-07-05 15:59 - 2013-07-05 15:56 - 00000000 ____D C:\Users\owner\AppData\Local\iLivid 2013-07-05 15:56 - 2013-07-05 15:56 - 01624112 _____ (Bandoo Media Inc) C:\Users\owner\Downloads\iLividSetup-r362-n-bf.exe 2013-07-04 20:31 - 2007-10-27 08:22 - 00000000 ____D C:\Users\owner\AppData\Local\Google 2013-07-04 20:31 - 2007-10-16 16:06 - 00000000 ____D C:\Program Files\Google 2013-07-04 20:26 - 2013-07-04 20:26 - 00800208 _____ (Google Inc.) C:\Users\owner\Downloads\ChromeSetup.exe 2013-07-04 20:13 - 2013-07-04 20:13 - 00000049 _____ C:\Users\owner\jagex_cl_runescape_LIVE_BETA.dat 2013-07-04 20:13 - 2013-07-02 22:50 - 00000000 ____D C:\Users\owner\jagexcache 2013-07-04 20:13 - 2007-10-15 19:55 - 00000000 ____D C:\Users\owner 2013-07-03 16:22 - 2012-12-19 13:59 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service 2013-07-02 23:11 - 2013-07-02 23:11 - 00000000 ____D C:\Users\owner\AppData\Roaming\NVIDIA 2013-07-02 22:17 - 2013-07-02 22:18 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe 2013-07-02 22:17 - 2013-07-02 22:18 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe 2013-07-02 22:17 - 2013-07-02 22:18 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe 2013-07-02 22:17 - 2013-07-02 22:18 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll 2013-07-02 22:17 - 2012-08-15 11:02 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll 2013-07-02 22:17 - 2012-04-03 03:18 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll 2013-07-02 22:17 - 2007-08-23 08:03 - 00000000 ____D C:\Program Files\Java 2013-07-02 22:11 - 2013-07-02 22:05 - 41404760 _____ (Apple Inc.) C:\Users\owner\Downloads\QuickTimeInstaller(1).exe 2013-07-02 22:08 - 2013-07-02 22:07 - 00903080 _____ (Oracle Corporation) C:\Users\owner\Downloads\jre-7u25-windows-i586-iftw.exe 2013-07-01 20:52 - 2013-07-01 20:52 - 00000000 _____ C:\Windows\setuperr.log 2013-07-01 17:18 - 2013-04-07 20:59 - 00000000 ____D C:\Users\owner\Documents\sissy 2013-06-30 12:06 - 2013-06-30 12:00 - 41404760 _____ (Apple Inc.) C:\Users\owner\Downloads\QuickTimeInstaller.exe 2013-06-24 23:28 - 2013-06-24 23:26 - 00229888 ___SH C:\Users\Public\Thumbs.db 2013-06-23 14:51 - 2013-06-23 13:57 - 00000000 ____D C:\ProgramData\ElectricSheep 2013-06-23 14:08 - 2013-06-23 13:57 - 00000000 ____D C:\Program Files\Electric Sheep 2013-06-23 13:53 - 2013-06-23 13:51 - 19980474 _____ C:\Users\owner\Downloads\electricsheep-2.7b34c.exe 2013-06-15 16:14 - 2007-12-02 21:04 - 00173568 _____ C:\Users\owner\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2013-06-15 14:49 - 2007-12-09 11:08 - 00000000 ____D C:\Users\owner\AppData\Roaming\muvee Technologies 2013-06-15 14:48 - 2013-06-15 14:48 - 00000000 ____D C:\Users\owner\Documents\My muvees 2013-06-15 14:38 - 2008-03-14 10:48 - 00000000 ___RD C:\Users\owner\Documents\Notes 2013-06-15 14:37 - 2008-02-28 08:36 - 00000000 ____D C:\Users\owner\Documents\My Scans 2013-06-15 14:34 - 2013-06-15 14:34 - 00000000 ____D C:\Users\owner\Documents\Poetry 2013-06-15 14:26 - 2013-06-15 14:26 - 00000000 ____D C:\Users\owner\AppData\Local\IAC 2013-06-15 14:09 - 2013-06-15 14:09 - 00000610 _____ C:\Users\owner\Desktop\Public - Shortcut.lnk ==================== Bamital & volsnap Check ================= C:\Windows\explorer.exe => MD5 is legit C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-15 16:24 ==================== End Of Log ============================ Addition.txt

I hope I'm in the right spot because I couldn't follow the link in the sticky.... but anyway.. my brother was trying to download a game and now I've got AT LEAST a MyPC Backup and VAFPlayer virus that i cannot remove. This computer had malware bytes registered on it, now it shows it unregistered and says my key is wrong (it is not) and when i try to scan with it it freezes up and stops responding. My browzer gets hijacked, with a new toolbar everytime its opened and i get pop ups from the MyPC Backup saying my computer is infected and needs to back up (I havn't touched these) Here are the logs...not sure if you wanted them copied and pasted or attached so i did both... DDS DDS (Ver_2012-11-20.01) - NTFS_x86 Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 10.25.2 Run by owner at 17:26:31 on 2013-07-15 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3071.1562 [GMT -5:00] . AV: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0} SP: AVG Anti-Virus Free Edition 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: AVG Internet Security 2012 *Disabled* {621CC794-9486-F902-D092-0484E8EA828B} . ============== Running Processes ================ . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\SLsvc.exe C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe C:\Windows\system32\nvvsvc.exe C:\Windows\System32\spoolsv.exe C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files\AVG\AVG2012\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\SearchProtect\bin\CltMngSvc.exe C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe C:\Program Files\Microsoft LifeCam\MSCamS32.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Windows\system32\SearchIndexer.exe C:\Windows\System32\WUDFHost.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\system32\taskeng.exe C:\hp\support\hpsysdrv.exe C:\Program Files\NVIDIA Corporation\Display\nvtray.exe C:\Windows\RtHDVCpl.exe C:\Windows\system32\schtasks.exe C:\Program Files\AVG\AVG2012\avgtray.exe C:\Windows\vVX3000.exe C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Users\owner\AppData\Roaming\SearchProtect\bin\cltmng.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\MyPC Backup\MyPC Backup.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wbem\wmiprvse.exe C:\hp\kbd\kbd.exe C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe C:\Windows\system32\NOTEPAD.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_224.exe C:\Program Files\AVG\AVG2012\avgcfgex.exe C:\Windows\System32\WUDFHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\svchost.exe -k hpdevmgmt C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\svchost.exe -k HPService C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation . ============== Pseudo HJT Report =============== . mURLSearchHooks: {55b95864-3251-45e9-bb30-1a82589aaff1} - <orphaned> dURLSearchHooks: {A3BC75A2-1F87-4686-AA43-5347D756017C} - <orphaned> BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll BHO: AVG Do Not Track: {31332EEF-CB9F-458F-AFEB-D30E9A66B6BA} - c:\program files\avg\avg2012\avgdtiex.dll BHO: AVG Safe Search: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - c:\program files\avg\avg2012\avgssie.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Windows Live Messenger Companion Helper: {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - c:\program files\windows live\companion\companioncore.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe uRun: [searchProtect] c:\users\owner\appdata\roaming\searchprotect\bin\cltmng.exe mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe mRun: [KBD] c:\hp\kbd\KbdStub.EXE mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe mRun: [sunJavaUpdateReg] "c:\windows\system32\jureg.exe" mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe" mRun: [VX3000] c:\windows\vVX3000.exe mRun: [Conime] c:\windows\system32\conime.exe mRun: [LifeCam] "c:\program files\microsoft lifecam\LifeExp.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [EKStatusMonitor] c:\program files\kodak\aio\statusmonitor\EKStatusMonitor.exe mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe" mRun: [searchProtectAll] c:\program files\searchprotect\bin\cltmng.exe dRunOnce: [KodakHomeCenter] "c:\program files\kodak\aio\center\AiOHomeCenter.exe" StartupFolder: c:\users\owner\appdata\roaming\micros~1\windows\startm~1\programs\startup\mypcba~1.lnk - c:\program files\mypc backup\MyPC Backup.exe StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe uPolicies-Explorer: NoDrives = dword:0 uPolicies-Explorer: NoDriveTypeAutoRun = dword:145 mPolicies-Explorer: BindDirectlyToPropertySetStorage = dword:0 mPolicies-Explorer: NoDrives = dword:0 mPolicies-Explorer: NoDriveTypeAutoRun = dword:255 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\avg\avg2012\avgdtiex.dll IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll LSP: c:\windows\system32\wpclsp.dll TCP: NameServer = 192.168.1.254 TCP: Interfaces\{28FEDA5C-1BDF-412A-BBD2-0DF6BD1A3B06} : DHCPNameServer = 192.168.1.254 Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll LSA: Security Packages = kerberos msv1_0 schannel wdigest tspkg mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\28.0.1500.72\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome . ================= FIREFOX =================== . FF - ProfilePath - c:\users\owner\appdata\roaming\mozilla\firefox\profiles\33a6f8sf.default\ FF - prefs.js: browser.search.selectedEngine - MixiDJ V34 Customized Web Search FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll FF - plugin: c:\program files\google\update\1.3.21.153\npGoogleUpdate3.dll FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll FF - plugin: c:\program files\microsoft silverlight\5.1.20513.0\npctrlui.dll FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_224.dll FF - plugin: c:\windows\system32\npDeployJava1.dll FF - plugin: c:\windows\system32\npmproxy.dll FF - ExtSQL: 2013-07-13 23:52; {55b95864-3251-45e9-bb30-1a82589aaff1}; c:\users\owner\appdata\roaming\mozilla\firefox\profiles\33a6f8sf.default\extensions\{55b95864-3251-45e9-bb30-1a82589aaff1} FF - ExtSQL: !HIDDEN! 2009-10-24 14:48; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension FF - ExtSQL: !HIDDEN! 2010-10-06 14:43; smartwebprinting@hp.com; c:\program files\hp\digital imaging\smart web printing\MozillaAddOn3 . ---- FIREFOX POLICIES ---- FF - user.js: network.cookie.cookieBehavior - 0 FF - user.js: privacy.clearOnShutdown.cookies - false FF - user.js: security.warn_viewing_mixed - false FF - user.js: security.warn_viewing_mixed.show_once - false FF - user.js: security.warn_submit_insecure - false FF - user.js: security.warn_submit_insecure.show_once - false . ============= SERVICES / DRIVERS =============== . R0 AVGIDSHX;AVGIDSHX;c:\windows\system32\drivers\avgidshx.sys [2012-4-19 24896] R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2012-1-31 31952] R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2012-11-8 250080] R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-12-23 41040] R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2013-4-11 302368] R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2012-2-14 193288] R2 CltMngSvc;Search Protect by Conduit Updater;c:\program files\searchprotect\bin\CltMngSvc.exe [2013-5-8 97056] R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-6-2 21504] R2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\kodak\aio\center\EKAiOHostService.exe [2013-3-15 395640] R2 Kodak AiO Status Monitor Service;Kodak AiO Status Monitor Service;c:\program files\kodak\aio\statusmonitor\EKPrinterSDK.exe [2013-1-15 780152] R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\avgidsdriverx.sys [2012-12-10 142176] R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\avgidsfilterx.sys [2011-12-23 24144] R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\avgidsshimx.sys [2011-12-23 17232] R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2009-7-14 1443584] R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2013-7-13 40776] R3 netr73;USB Wireless 802.11 b/g Adaptor Driver for Vista;c:\windows\system32\drivers\netr73.sys [2009-5-24 501248] R3 slnt;Realtek RTL8139 PCI Fast Ethernet Adapter;c:\windows\system32\drivers\slnt.sys [2009-8-10 17999] S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\avgidsagent.exe [2012-11-2 5174392] S2 BackupStack;Computer Backup (MyPC Backup);c:\program files\mypc backup\backupstack.exe --> c:\program files\mypc backup\BackupStack.exe [?] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files\avg\avg10\toolbar\ToolbarBroker.exe [2011-8-26 167264] S3 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2011-3-29 39272] S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352] S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2013-4-18 754856] S4 DQLWinService;DQLWinService;c:\program files\common files\intel\inteldh\nms\adpplugins\DQLWinService.exe [2006-9-3 208896] S4 HPBtnSrv;HP Chasis Button Service;c:\hp\hpezbtn\HPBtnSrv.exe [2007-8-23 198240] S4 IntelDHSvcConf;Intel DH Service;c:\program files\intel\inteldh\intel media server\tools\IntelDHSvcConf.exe [2006-5-10 29696] S4 MCLServiceATL;Intel® Application Tracker;c:\program files\intel\inteldh\intel media server\shells\MCLServiceATL.exe [2006-9-11 167936] S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040] . =============== Created Last 30 ================ . 2013-07-14 05:32:42 -------- dcsh--w- C:\$RECYCLE.BIN 2013-07-14 05:32:41 -------- d-----w- c:\users\owner\appdata\local\temp 2013-07-14 05:14:26 256000 ----a-w- c:\windows\PEV.exe 2013-07-14 05:04:56 -------- d-----w- c:\users\owner\appdata\roaming\player 2013-07-14 04:55:57 -------- d-----w- c:\users\owner\appdata\local\Conduit 2013-07-14 04:54:52 -------- d-----w- c:\users\owner\appdata\local\CRE 2013-07-14 04:54:15 -------- d-----w- c:\program files\MyPC Backup 2013-07-14 04:53:32 -------- d-----w- c:\program files\SearchProtect 2013-07-14 04:52:45 -------- d-----w- c:\users\owner\appdata\roaming\SearchProtect 2013-07-14 04:52:18 -------- d-----w- c:\users\owner\appdata\roaming\Optimizer Pro 2013-07-14 04:51:36 40776 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2013-07-14 04:49:53 -------- d-----w- c:\users\owner\appdata\local\TopArcadeHits 2013-07-14 04:49:37 -------- d-----w- c:\programdata\Tarma Installer 2013-07-11 08:56:27 2049024 ----a-w- c:\windows\system32\win32k.sys 2013-07-11 08:52:50 798208 ----a-w- c:\windows\system32\FntCache.dll 2013-07-11 08:52:50 486400 ----a-w- c:\windows\system32\d3d10level9.dll 2013-07-11 08:52:50 219648 ----a-w- c:\windows\system32\d3d10_1core.dll 2013-07-11 08:52:50 189952 ----a-w- c:\windows\system32\d3d10core.dll 2013-07-11 08:52:50 1069056 ----a-w- c:\windows\system32\DWrite.dll 2013-07-11 08:52:50 1029120 ----a-w- c:\windows\system32\d3d10.dll 2013-07-11 08:52:49 683008 ----a-w- c:\windows\system32\d2d1.dll 2013-07-11 08:52:49 160768 ----a-w- c:\windows\system32\d3d10_1.dll 2013-07-11 08:52:49 1172480 ----a-w- c:\windows\system32\d3d10warp.dll 2013-07-11 08:51:44 505344 ----a-w- c:\windows\system32\qedit.dll 2013-07-11 08:50:41 1548288 ----a-w- c:\windows\system32\WMVDECOD.DLL 2013-07-11 08:48:31 983552 ----a-w- c:\program files\windows journal\JNTFiltr.dll 2013-07-11 08:48:31 964608 ----a-w- c:\program files\windows journal\JNWDRV.dll 2013-07-11 08:48:31 936960 ----a-w- c:\program files\common files\microsoft shared\ink\journal.dll 2013-07-11 08:48:31 1218048 ----a-w- c:\program files\windows journal\NBDoc.DLL 2013-07-05 20:56:43 -------- d-----w- c:\users\owner\appdata\local\iLivid 2013-07-03 04:11:33 -------- d-----w- c:\users\owner\appdata\roaming\NVIDIA 2013-07-03 03:50:44 -------- d-----w- c:\users\owner\jagexcache 2013-07-03 03:18:06 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll 2013-06-23 18:57:11 -------- d-----w- c:\programdata\ElectricSheep 2013-06-23 18:57:11 -------- d-----w- c:\program files\Electric Sheep 2013-06-23 18:57:10 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll 2013-06-23 18:57:09 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll . ==================== Find3M ==================== . 2013-07-03 03:17:51 867240 ----a-w- c:\windows\system32\npDeployJava1.dll 2013-07-03 03:17:51 789416 ----a-w- c:\windows\system32\deployJava1.dll 2013-06-13 19:13:45 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl 2013-06-13 19:13:45 692104 ----a-w- c:\windows\system32\FlashPlayerApp.exe 2013-06-04 04:19:50 834048 ----a-w- c:\windows\system32\wininet.dll 2013-06-04 04:17:26 52736 ----a-w- c:\windows\apppatch\iebrshim.dll 2013-06-04 02:32:34 389632 ----a-w- c:\windows\system32\html.iec 2013-06-04 02:04:03 1383424 ----a-w- c:\windows\system32\mshtml.tlb 2013-05-08 06:10:12 770384 ----a-w- c:\windows\system32\msvcr100.dll 2013-05-08 06:10:12 421200 ----a-w- c:\windows\system32\msvcp100.dll 2013-05-08 04:37:21 905576 ----a-w- c:\windows\system32\drivers\tcpip.sys 2013-05-02 22:03:36 3603832 ----a-w- c:\windows\system32\ntkrnlpa.exe 2013-05-02 22:03:36 3551096 ----a-w- c:\windows\system32\ntoskrnl.exe 2013-05-02 04:04:25 443904 ----a-w- c:\windows\system32\win32spl.dll 2013-05-02 04:03:42 37376 ----a-w- c:\windows\system32\printcom.dll 2013-04-24 04:00:30 985600 ----a-w- c:\windows\system32\crypt32.dll 2013-04-24 04:00:30 98304 ----a-w- c:\windows\system32\cryptnet.dll 2013-04-24 04:00:30 133120 ----a-w- c:\windows\system32\cryptsvc.dll 2013-04-24 04:00:24 41984 ----a-w- c:\windows\system32\certenc.dll 2013-04-24 01:46:29 812544 ----a-w- c:\windows\system32\certutil.exe 2013-04-17 12:30:06 24576 ----a-w- c:\windows\system32\cryptdlg.dll . ============= FINISH: 17:31:41.45 =============== Attach DDS (Ver_2012-11-20.01) . Microsoft® Windows Vista™ Home Premium Boot Device: \Device\HarddiskVolume1 Install Date: 9/5/2007 3:45:06 AM System Uptime: 7/15/2013 4:11:27 PM (1 hours ago) . Motherboard: ASUSTeK Computer INC. | | Berkeley Processor: Intel® Core2 Quad CPU Q6600 @ 2.40GHz | CPU 1 | 2394/267mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 289 GiB total, 55.336 GiB free. D: is FIXED (NTFS) - 9 GiB total, 0.278 GiB free. E: is FIXED (NTFS) - 298 GiB total, 61.156 GiB free. F: is CDROM () G: is Removable H: is Removable I: is Removable J: is Removable . ==== Disabled Device Manager Items ============= . Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318} Description: Officejet 4500 G510n-z Device ID: ROOT\MULTIFUNCTION\0000 Manufacturer: HP Name: Officejet 4500 G510n-z PNP Device ID: ROOT\MULTIFUNCTION\0000 Service: . ==== System Restore Points =================== . RP4594: 7/3/2013 5:43:43 PM - Scheduled Checkpoint RP4596: 7/4/2013 3:00:26 AM - Windows Update RP4598: 7/5/2013 3:01:51 AM - Windows Update RP4600: 7/5/2013 4:23:36 PM - Installed DirectX RP4602: 7/6/2013 3:05:45 AM - Windows Update RP4604: 7/7/2013 3:01:39 AM - Windows Update RP4606: 7/8/2013 3:00:23 AM - Windows Update RP4608: 7/9/2013 3:03:01 AM - Windows Update RP4610: 7/11/2013 10:20:45 PM - Scheduled Checkpoint RP4612: 7/12/2013 3:02:54 AM - Windows Update RP4614: 7/12/2013 7:35:09 PM - Windows Modules Installer RP4616: 7/13/2013 3:00:28 AM - Windows Update RP4618: 7/14/2013 12:08:03 AM - Quitado VAFPlayer RP4620: 7/14/2013 12:09:06 AM - Quitado VAFPlayer RP4622: 7/14/2013 3:03:13 AM - Windows Update RP4624: 7/15/2013 3:01:39 AM - Windows Update . ==== Installed Programs ====================== . 32 Bit HP CIO Components Installer 4500_G510nz_Help 4500G510nz 4500G510nz_Software_Min 5600 5600_Help 5600Trb ABBYY FineReader 6.0 Sprint Adobe Flash Player 11 Plugin Adobe Photoshop Lightroom 2.4 Adobe Reader X (10.1.7) AIO_CDB_ProductContext AIO_CDB_Software AIO_Scan aioscnnr AVG 2012 AVG PC Tuneup 2011 AviSynth 2.5 Bonjour BufferChm C4USelfUpdater CamStudio center ConvertXtoDVD 2.99.9.500 Copy CoreAVC Pro (remove only) CustomerResearchQFolder D3DX10 Destinations DeviceDiscovery DeviceManagementQFolder DivX 4.12 Codec DocMgr DocProc DVD Shrink 3.2 Electric Sheep 2.7b34c Enhanced Multimedia Keyboard Solution ERUNT 1.1j essentials eSupportQFolder FastStone Capture 5.3 Fax Google Chrome Google Update Helper GPBaseService2 Haali Media Splitter Hardware Diagnostic Tools Hewlett-Packard Active Check for Health Check Hewlett-Packard Asset Agent for Health Check Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) HP Active Support Library HP Active Support Library 32 bit components HP Customer Experience Enhancements HP Customer Feedback HP Customer Participation Program 13.0 HP Document Manager 2.0 HP Easy Setup - Frontend HP Imaging Device Functions 13.0 HP Officejet 4500 G510n-z HP Photosmart Essential 2.01 HP Photosmart Essential2.01 HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B HP Picasso Media Center Add-In HP Smart Web Printing 4.5 HP Solution Center 13.0 HP Update HPProductAssistant iLivid Intel® Network Connections Drivers Intel® Viiv™ Software IZArc 3.81 Java 7 Update 25 Java Auto Updater Junk Mail filter update Kodak AIO Printer KODAK AiO Software LEGO Digital Designer LightScribe 1.6.45.1 Malwarebytes Anti-Malware version 1.75.0.1300 MarketResearch Mesh Runtime Messenger Companion Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4 Client Profile Microsoft .NET Framework 4 Extended Microsoft Application Error Reporting Microsoft Corporation Microsoft LifeCam Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 22.0 (x86 en-US) Mozilla Maintenance Service MSVCRT MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 (KB941833) MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) MSXML 4.0 SP2 Parser and SDK muvee autoProducer 6.0 Network NVIDIA Control Panel 307.83 NVIDIA Graphics Driver 307.83 NVIDIA Install Application NVIDIA Update 1.10.8 NVIDIA Update Components NVIDIA WDM Drivers ocr OCR Software by I.R.I.S. 13.0 OLYMPUS Master 2 OpenOffice.org 3.0 PowerISO PreReq PrintProjects PSSWCORE Python 2.5 QuickTime Realtek High Definition Audio Driver Rhapsody Player Engine Roxio Activation Module Scan Search Protect by conduit Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629) Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708) Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576) Security Update for Microsoft .NET Framework 4 Client Profile (KB2832407) Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628) Security Update for Microsoft .NET Framework 4 Extended (KB2487367) Security Update for Microsoft .NET Framework 4 Extended (KB2736428) Segoe UI SmartWebPrinting Soft Data Fax Modem with SmartCP SolutionCenter Status The Playa Toolbox TopArcadeHits TrayApp Truck 3D UnloadSupport Update for Microsoft .NET Framework 3.5 SP1 (KB963707) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) VAFPlayer VideoLAN VLC media player 0.8.6d VideoToolkit01 WeatherBug Gadget WebReg What's Running 2.2 Windows Live Communications Platform Windows Live Essentials Windows Live Family Safety Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live Messenger Windows Live Messenger Companion Core Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live Remote Client Windows Live Remote Client Resources Windows Live Remote Service Windows Live Remote Service Resources Windows Live SOXE Windows Live SOXE Definitions Windows Live Sync Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources YouTube Downloader App 3.00 . ==== Event Viewer Messages From Past Week ======== . 7/15/2013 4:13:46 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: i8042prt is3srv SASKUTIL szkg5 szkgfs 7/15/2013 4:13:46 PM, Error: Service Control Manager [7000] - The Computer Backup (MyPC Backup) service failed to start due to the following error: The system cannot find the file specified. 7/15/2013 4:12:20 PM, Error: EventLog [6008] - The previous system shutdown at 4:08:37 PM on 7/15/2013 was unexpected. 7/15/2013 3:14:50 PM, Error: EventLog [6008] - The previous system shutdown at 1:47:56 PM on 7/15/2013 was unexpected. 7/14/2013 12:28:40 AM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly. 7/13/2013 3:00:48 AM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x8024200d: Security Update for Microsoft .NET Framework 3.0 SP2 on Windows Vista SP2 and Windows Server 2008 SP2 x86 (KB2832412). 7/13/2013 3:00:43 AM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package KB2832412 (Security Update) into Staging(Staging) state 7/13/2013 3:00:43 AM, Error: Microsoft-Windows-Servicing [4375] - Windows Servicing failed to complete the process of setting package KB2832412 (Security Update) into Resolved(Resolved) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-9_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-8_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-7_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-6_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-5_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-4_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-3_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-22_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-21_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-20_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-2_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-19_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-18_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-17_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-16_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-15_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-14_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-13_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-12_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-11_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-10_neutral_GDR from package KB2832412(Security Update) into Staging(Staging) state 7/13/2013 3:00:37 AM, Error: Microsoft-Windows-Servicing [4385] - Windows Servicing failed to complete the process of changing update 2832412-1_neutral_LDR from package KB2832412(Security Update) into Staging(Staging) state 7/12/2013 8:03:05 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Windows 7, Server 2008 x86 (KB2835393). 7/12/2013 7:40:14 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80070643: Security Update for Microsoft .NET Framework 3.5 SP1 on Windows XP, Server 2003, Vista, Server 2008 x86 (KB2840629). 7/12/2013 7:38:58 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x800736cc: Security Update for Microsoft .NET Framework 3.0 SP2 on Windows Vista SP2 and Windows Server 2008 SP2 x86 (KB2832412). 7/12/2013 7:34:28 PM, Error: Microsoft-Windows-WindowsUpdateClient [20] - Installation Failure: Windows failed to install the following update with error 0x80242007: Security Update for Microsoft .NET Framework 4 on XP, Server 2003, Vista, Server 2008 x86 (KB2832407). . ==== End Of File =========================== dds.txtattach.txt