Jump to content

lobro

Members
 View Profile  See their activity

  • Posts

    12

  • Joined

  • Last visited

 Content Type 

Everything posted by lobro

  1. lobro
    You were, of course, absolutely right; (even though I kind of wish you weren't as I'm now stuck with a nonfunctional key on my laptop). Thanks so much for your time and help!I really appreciate it.
  2. lobro
    Okay. I'll check back with you
  3. lobro
    I flipped up the q key and its completely clean. I cleaned it anyway but no dice. One of he scans did get rid of the string of Qs that was being typed but the q key itself is still not functional. Also I noticed that when the string of qs were coming up, they usually only showed when I was typing a known word but if I was typing some nonsensical letters it generally wasnt a problem. Another strange thing that's been happening is that most of the time on startup, the cursor won't move until I press a key. Not sure if that's a sign of the problem being a process and not a keyboard issue. Using the OSK, I can type the q, but I didn't think to try it early on so I don't know if it would have solved the problem before. Could I updating the keyboard driver help? Or uninstalling it to see if I can at least perform the disk check?
  4. lobro
    I did that but when it restarts I get this message Checking file type on system C: The type the of file system is NTFS A disk check has been scheduled Disk checking has been canceled
  5. lobro
    I tried it both ways and neither works. When I did it the way you instructed the message that showed, when it didn't go straight into startup was: Checking file type on system C: The type the of file system is NTFS A disk check has been scheduled Disk checking has been canceled I am not pressing anything when it reboots. If its relevant, when I try the command in cmd.exe I get the message: The type of the file system is NTFS. Cannot lock current drive
  6. lobro
    Leaving both of these boxes unchecked, it took under a minute. Is there some combination of boxes that I should leave checked?" Automatically fix file system errors box. Check the Scan for and attempt recovery of bad sectors box."
  7. lobro
    JavaRa 1.16 Removal Log. Report follows after line. ------------------------------------ The JavaRa removal process was started on Wed Jul 02 12:13:09 2014 Found and removed: Software\Classes\JavaPlugin.160_32 Found and removed: SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501} Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-DEC7-0000-0001-ABCDEFFEDCBA} Found and removed: SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} Found and removed: SOFTWARE\Classes\MIME\Database\Content Type\application/java-deployment-toolkit Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.7.0.0 Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects Found and removed: SOFTWARE\JavaSoft Found and removed: SOFTWARE\JreMetrics Found and removed: SOFTWARE\MozillaPlugins ------------------------------------ Finished reporting. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-07-2014 Ran by Lolo (administrator) on LOLO-PC on 02-07-2014 12:29:16 Running from C:\Users\Lolo\Desktop Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Microsoft Corporation) C:\Windows\vVX3000.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe () C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Spotify Ltd) C:\Users\Lolo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Google Inc.) C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\MusicManager.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Lenovo) C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe (Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (Dropbox, Inc.) C:\Users\Lolo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe () C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe () C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\OFFICEVIRT.EXE (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-26] (Realtek Semiconductor) HKLM\...\Run: [intelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-15] (Intel® Corporation) HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2771240 2011-04-21] (Synaptics Incorporated) HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2014-05-31] (Lenovo) HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2012-01-03] (Lenovo) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9745312 2012-01-03] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5374880 2012-01-03] (Lenovo(beijing) Limited) HKLM\...\Run: [VX3000] => C:\windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [MuteSync] => C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe [336384 2009-12-28] (Lenovo) HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2010-12-04] (CyberLink) HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [224352 2010-12-04] (CyberLink Corp.) HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-01-03] (Lenovo) HKLM-x32\...\Run: [updateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.) HKLM-x32\...\Run: [updatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.) HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] () HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.) HKLM-x32\...\Run: [avast] => C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software) HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.) HKLM-x32\...\Run: [sDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-01-03] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [spotify Web Helper] => C:\Users\Lolo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [MusicManager] => C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7631872 2014-04-23] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [GoogleChromeAutoLaunch_A9AECA91371A37F0FDB4C908F31716C4] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [sUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6564120 2014-06-04] (SUPERAntiSpyware) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Lolo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe () ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: GDriveBlacklistedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedEditOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedViewOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSyncedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSyncingOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: VeriFace Enc -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll () ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - DefaultScope value is missing. BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 10.0.1.1 Tcpip\..\Interfaces\{0C1C8453-36F5-450F-AAD8-DDAD2D50C2B8}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{3972253B-B859-4651-BA6E-948C826CD575}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{746F43E9-4DE2-4D4B-B00B-BF43A7383BD5}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{D3A96F26-BF9E-4818-AD4C-F4359FAB3A49}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92}: [NameServer]208.67.220.220,4.2.2.1,10.0.1.1 FireFox: ======== FF ProfilePath: C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", ""); FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", ""); FF SelectedSearchEngine: Google FF Homepage: https://www.google.com/ FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin HKCU: @doubletwist.com/NPPodcast - C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Lolo\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Lolo\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Extension: Bitdefender QuickScan - C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-06-22] FF Extension: Adblock Plus - C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-21] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-02-05] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-07-03] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-27] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-02-05] Chrome: ======= CHR HomePage: CHR StartupUrls: "https://www.google.com/" CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Java Platform SE 6 U32) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll No File CHR Plugin: (Java Deployment Toolkit 6.0.320.5) - C:\windows\SysWOW64\npdeployJava1.dll (Oracle Corporation) CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave for Director) - C:\windows\system32\Adobe\Director\np32dsw.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (Duolingo) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiahmijlpehemcpleichkcokhegllfjl [2013-08-09] CHR Extension: (Missing e) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjbagclppcgdbpobcpoojdjdmcjhpid [2014-02-02] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24] CHR Extension: (Google Wallet) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21] CHR Extension: (Youtube Video Downloader) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\obmbipnhbnpicpechoajlkjfdiopnoki [2013-04-17] CHR Extension: (Tumblr Savior) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\oefddkjnflmjbclpnnoegglmmdfkidip [2014-02-02] CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12] ==================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-10] (SUPERAntiSpyware.com) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software) R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [953632 2010-12-14] (Broadcom Corporation.) R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-15] () R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-04] (Hewlett-Packard) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-04] (Hewlett-Packard) [File not signed] R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [36256 2009-11-14] (Google Inc) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation) R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software) R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] () R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software) R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] () R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-02] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) R3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8200552 2010-09-27] (Realtek Semiconductor Corp.) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.) U3 BcmSqlStartupSvc; S3 catchme; \??\C:\ComboFix\catchme.sys [X] U2 CLKMSVC10_3A60B698; U2 CLKMSVC10_C3B3B687; U2 DriverService; U2 IAStorDataMgrSvc; U2 iATAgentService; U2 idealife Update Service; U3 IGRS; S2 iPodDrv; \??\C:\windows\system32\drivers\iPodDrv.sys [X] U2 IviRegMgr; U2 nvUpdatusService; U2 Oasis2Service; U2 PCCarerService; U2 ReadyComm.DirectRouter; U2 RichVideo; U2 RtLedService; U2 SoftwareService; U3 SQLWriter; U2 Stereo Service; U2 TMAgent; ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-02 12:29 - 2014-07-02 12:30 - 00025736 _____ () C:\Users\Lolo\Desktop\FRST.txt 2014-07-02 12:29 - 2014-07-02 12:29 - 00000000 ____D () C:\Users\Lolo\Desktop\FRST-OlderVersion 2014-07-02 12:14 - 2014-07-02 12:14 - 00448512 _____ (OldTimer Tools) C:\Users\Lolo\Desktop\TFC.exe 2014-07-02 12:13 - 2014-07-02 12:13 - 00000926 _____ () C:\Users\Lolo\Desktop\JavaRa.log 2014-07-02 12:13 - 2014-07-02 12:13 - 00000926 _____ () C:\JavaRa.log 2014-07-02 12:10 - 2014-07-02 12:10 - 00165483 _____ () C:\Users\Lolo\Downloads\JavaRa-1.16-28-5-13.zip 2014-07-02 12:08 - 2014-07-02 12:11 - 00000000 ____D () C:\Users\Lolo\Desktop\RemoveJava 2014-07-01 18:49 - 2014-07-01 18:49 - 00028433 _____ () C:\ComboFix.txt 2014-07-01 18:27 - 2011-06-26 02:45 - 00256000 _____ () C:\windows\PEV.exe 2014-07-01 18:27 - 2010-11-07 13:20 - 00208896 _____ () C:\windows\MBR.exe 2014-07-01 18:27 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe 2014-07-01 18:27 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe 2014-07-01 18:27 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe 2014-07-01 18:27 - 2000-08-30 20:00 - 00098816 _____ () C:\windows\sed.exe 2014-07-01 18:27 - 2000-08-30 20:00 - 00080412 _____ () C:\windows\grep.exe 2014-07-01 18:27 - 2000-08-30 20:00 - 00068096 _____ () C:\windows\zip.exe 2014-06-28 22:17 - 2014-06-28 22:17 - 00000000 ____D () C:\Users\Lolo\Documents\ProcAlyzer Dumps 2014-06-28 22:11 - 2014-07-01 18:49 - 00000000 ____D () C:\Qoobox 2014-06-28 22:09 - 2014-06-28 22:10 - 05212118 ____R (Swearware) C:\Users\Lolo\Desktop\ComboFix.exe 2014-06-27 17:05 - 2014-06-27 17:05 - 02083328 _____ (Farbar) C:\Users\Lolo\Downloads\FRST64(1).exe 2014-06-27 17:05 - 2014-06-27 17:05 - 00000490 _____ () C:\Users\Lolo\Desktop\found.txt 2014-06-27 15:15 - 2014-06-27 15:15 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-06-27 14:55 - 2014-06-27 14:55 - 00000000 __SHD () C:\Users\Lolo\AppData\Local\EmieUserList 2014-06-27 14:55 - 2014-06-27 14:55 - 00000000 __SHD () C:\Users\Lolo\AppData\Local\EmieSiteList 2014-06-27 14:53 - 2014-07-02 12:11 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-06-27 14:01 - 2014-06-27 14:12 - 00000000 ____D () C:\AdwCleaner 2014-06-27 14:00 - 2014-06-27 14:00 - 01342659 _____ () C:\Users\Lolo\Downloads\AdwCleaner.exe 2014-06-27 13:58 - 2014-06-27 13:59 - 00012929 _____ () C:\Users\Lolo\Desktop\JRT.txt 2014-06-27 13:33 - 2014-06-27 13:33 - 00000000 ____D () C:\windows\ERUNT 2014-06-27 13:31 - 2014-06-27 13:31 - 01016261 _____ (Thisisu) C:\Users\Lolo\Downloads\JRT.exe 2014-06-26 11:15 - 2014-06-26 11:15 - 00000000 ____D () C:\ProgramData\RogueKiller 2014-06-26 10:54 - 2014-06-26 10:54 - 05283416 _____ () C:\Users\Lolo\Downloads\RogueKillerX64.exe 2014-06-26 10:25 - 2014-07-01 18:45 - 00000000 ____D () C:\windows\ERDNT 2014-06-26 10:24 - 2014-06-26 10:25 - 00000000 ____D () C:\Program Files (x86)\ERUNT 2014-06-26 10:24 - 2014-06-26 10:24 - 00000869 _____ () C:\Users\Lolo\Desktop\ERUNT.lnk 2014-06-26 10:24 - 2014-06-26 10:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT 2014-06-26 10:23 - 2014-06-26 10:23 - 00791393 _____ (Lars Hederer ) C:\Users\Lolo\Downloads\erunt-setup.exe 2014-06-26 10:13 - 2014-06-26 10:27 - 00002040 _____ () C:\Users\Lolo\Desktop\Rkill.txt 2014-06-26 10:13 - 2014-06-26 10:13 - 01062136 _____ (Bleeping Computer, LLC) C:\Users\Lolo\Desktop\rkill64.exe 2014-06-26 10:02 - 2014-06-26 10:04 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\Lolo\Downloads\rkill.exe 2014-06-22 15:35 - 2014-06-22 15:35 - 00039847 _____ () C:\Users\Lolo\Downloads\Addition.txt 2014-06-22 15:34 - 2014-06-27 17:09 - 00062527 _____ () C:\Users\Lolo\Downloads\FRST.txt 2014-06-22 15:33 - 2014-07-02 12:29 - 00000000 ____D () C:\FRST 2014-06-22 15:29 - 2014-07-02 12:29 - 02083840 _____ (Farbar) C:\Users\Lolo\Desktop\FRST64.exe 2014-06-22 13:45 - 2014-06-22 13:45 - 00000000 ____D () C:\SUPERDelete 2014-06-22 13:20 - 2014-06-22 13:20 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-06-22 13:18 - 2014-06-22 13:19 - 19776448 _____ (SUPERAntiSpyware) C:\Users\Lolo\Downloads\SUPERAntiSpyware.exe 2014-06-22 13:16 - 2014-06-22 13:17 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\QuickScan 2014-06-22 11:14 - 2014-07-02 12:28 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-22 11:13 - 2014-06-22 11:13 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-22 11:13 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-22 11:11 - 2014-06-22 11:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lolo\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-16 20:04 - 2014-06-16 20:04 - 00354032 _____ () C:\windows\Minidump\061614-46004-01.dmp 2014-06-16 18:44 - 2014-06-16 18:44 - 00354032 _____ () C:\windows\Minidump\061614-35802-01.dmp 2014-06-16 15:40 - 2014-06-16 15:41 - 00354032 _____ () C:\windows\Minidump\061614-35895-01.dmp 2014-06-15 19:35 - 2014-06-15 19:35 - 00354032 _____ () C:\windows\Minidump\061514-25724-01.dmp 2014-06-14 22:02 - 2014-06-14 22:02 - 00354032 _____ () C:\windows\Minidump\061414-28345-01.dmp 2014-06-11 14:24 - 2014-04-24 22:34 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll 2014-06-11 14:24 - 2014-04-24 22:06 - 00626688 _____ (Microsoft Corporation) C:\windows\SysWOW64\usp10.dll 2014-06-11 14:23 - 2014-05-30 06:21 - 23414784 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-06-11 14:23 - 2014-05-30 06:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-06-11 14:23 - 2014-05-30 06:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-06-11 14:23 - 2014-05-30 05:45 - 02768384 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-06-11 14:23 - 2014-05-30 05:39 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-06-11 14:23 - 2014-05-30 05:39 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-06-11 14:23 - 2014-05-30 05:38 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-06-11 14:23 - 2014-05-30 05:28 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-06-11 14:23 - 2014-05-30 05:27 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-06-11 14:23 - 2014-05-30 05:24 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-06-11 14:23 - 2014-05-30 05:21 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-06-11 14:23 - 2014-05-30 05:21 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-06-11 14:23 - 2014-05-30 05:20 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-06-11 14:23 - 2014-05-30 05:18 - 17271296 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2014-06-11 14:23 - 2014-05-30 05:11 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-06-11 14:23 - 2014-05-30 05:08 - 05782528 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-06-11 14:23 - 2014-05-30 05:06 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-06-11 14:23 - 2014-05-30 05:02 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2014-06-11 14:23 - 2014-05-30 04:55 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-06-11 14:23 - 2014-05-30 04:49 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-06-11 14:23 - 2014-05-30 04:46 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-06-11 14:23 - 2014-05-30 04:44 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll 2014-06-11 14:23 - 2014-05-30 04:44 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-06-11 14:23 - 2014-05-30 04:43 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2014-06-11 14:23 - 2014-05-30 04:42 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll 2014-06-11 14:23 - 2014-05-30 04:38 - 02179072 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2014-06-11 14:23 - 2014-05-30 04:35 - 00608768 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-06-11 14:23 - 2014-05-30 04:34 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2014-06-11 14:23 - 2014-05-30 04:33 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2014-06-11 14:23 - 2014-05-30 04:30 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2014-06-11 14:23 - 2014-05-30 04:29 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-06-11 14:23 - 2014-05-30 04:28 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe 2014-06-11 14:23 - 2014-05-30 04:27 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll 2014-06-11 14:23 - 2014-05-30 04:24 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-06-11 14:23 - 2014-05-30 04:23 - 02040832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-06-11 14:23 - 2014-05-30 04:16 - 00368128 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll 2014-06-11 14:23 - 2014-05-30 04:10 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-06-11 14:23 - 2014-05-30 04:06 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll 2014-06-11 14:23 - 2014-05-30 04:04 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll 2014-06-11 14:23 - 2014-05-30 04:02 - 00242688 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll 2014-06-11 14:23 - 2014-05-30 03:56 - 04244992 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2014-06-11 14:23 - 2014-05-30 03:56 - 02266112 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-06-11 14:23 - 2014-05-30 03:54 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2014-06-11 14:23 - 2014-05-30 03:50 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll 2014-06-11 14:23 - 2014-05-30 03:49 - 01964544 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl 2014-06-11 14:23 - 2014-05-30 03:43 - 13522944 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-06-11 14:23 - 2014-05-30 03:40 - 11725312 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2014-06-11 14:23 - 2014-05-30 03:30 - 01398272 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-06-11 14:23 - 2014-05-30 03:21 - 01790976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2014-06-11 14:23 - 2014-05-30 03:15 - 01143296 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2014-06-11 14:23 - 2014-05-30 03:13 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-06-11 14:23 - 2014-05-30 03:13 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll 2014-06-11 14:23 - 2014-04-04 22:47 - 01903552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys 2014-06-11 14:23 - 2014-04-04 22:47 - 00288192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS 2014-06-11 14:23 - 2014-03-26 10:44 - 02002432 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll 2014-06-11 14:23 - 2014-03-26 10:44 - 01882112 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll 2014-06-11 14:23 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll 2014-06-11 14:23 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll 2014-06-11 14:23 - 2014-03-26 10:27 - 01389056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll 2014-06-11 14:23 - 2014-03-26 10:27 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll 2014-06-11 14:23 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll 2014-06-11 14:23 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll 2014-06-11 14:22 - 2014-06-08 05:13 - 00506368 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-11 14:22 - 2014-06-08 05:08 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-09 21:29 - 2014-06-09 21:31 - 38157960 _____ (Amazon.com) C:\Users\Lolo\Downloads\KindleForPC-installer(1).exe 2014-06-08 11:01 - 2014-06-08 11:01 - 00354032 _____ () C:\windows\Minidump\060814-27346-01.dmp 2014-06-04 17:49 - 2014-06-04 17:49 - 00354032 _____ () C:\windows\Minidump\060414-32978-01.dmp ==================== One Month Modified Files and Folders ======= 2014-07-02 12:30 - 2014-07-02 12:29 - 00025736 _____ () C:\Users\Lolo\Desktop\FRST.txt 2014-07-02 12:29 - 2014-07-02 12:29 - 00000000 ____D () C:\Users\Lolo\Desktop\FRST-OlderVersion 2014-07-02 12:29 - 2014-06-22 15:33 - 00000000 ____D () C:\FRST 2014-07-02 12:29 - 2014-06-22 15:29 - 02083840 _____ (Farbar) C:\Users\Lolo\Desktop\FRST64.exe 2014-07-02 12:28 - 2014-06-22 11:14 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-07-02 12:27 - 2014-04-01 13:43 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\DropboxMaster 2014-07-02 12:27 - 2012-09-09 15:53 - 00000000 ___RD () C:\Users\Lolo\Dropbox 2014-07-02 12:27 - 2012-09-09 15:50 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Dropbox 2014-07-02 12:26 - 2012-01-03 22:03 - 00000000 ____D () C:\ProgramData\VeriFace 2014-07-02 12:26 - 2012-01-03 21:56 - 00133719 _____ () C:\windows\system32\fastboot.set 2014-07-02 12:25 - 2014-05-30 18:07 - 00003808 _____ () C:\windows\setupact.log 2014-07-02 12:25 - 2012-01-03 22:03 - 04949411 _____ () C:\FaceProv.log 2014-07-02 12:25 - 2012-01-03 21:51 - 00000908 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-02 12:25 - 2009-07-14 01:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-07-02 12:24 - 2012-01-03 21:27 - 01465859 _____ () C:\windows\WindowsUpdate.log 2014-07-02 12:23 - 2012-04-27 08:43 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-07-02 12:14 - 2014-07-02 12:14 - 00448512 _____ (OldTimer Tools) C:\Users\Lolo\Desktop\TFC.exe 2014-07-02 12:13 - 2014-07-02 12:13 - 00000926 _____ () C:\Users\Lolo\Desktop\JavaRa.log 2014-07-02 12:13 - 2014-07-02 12:13 - 00000926 _____ () C:\JavaRa.log 2014-07-02 12:11 - 2014-07-02 12:08 - 00000000 ____D () C:\Users\Lolo\Desktop\RemoveJava 2014-07-02 12:11 - 2014-06-27 14:53 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-07-02 12:11 - 2012-05-06 17:07 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-02 12:10 - 2014-07-02 12:10 - 00165483 _____ () C:\Users\Lolo\Downloads\JavaRa-1.16-28-5-13.zip 2014-07-02 12:06 - 2009-07-14 00:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-07-02 12:06 - 2009-07-14 00:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-07-02 12:03 - 2009-07-14 01:13 - 00006486 _____ () C:\windows\system32\PerfStringBackup.INI 2014-07-02 12:01 - 2012-09-20 13:24 - 00000254 _____ () C:\windows\Tasks\HP Photo Creations Messager.job 2014-07-02 11:59 - 2012-01-03 21:51 - 00000912 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-02 11:57 - 2013-06-27 18:01 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update 2014-07-02 11:55 - 2010-11-20 23:47 - 00846454 _____ () C:\windows\PFRO.log 2014-07-01 18:49 - 2014-07-01 18:49 - 00028433 _____ () C:\ComboFix.txt 2014-07-01 18:49 - 2014-06-28 22:11 - 00000000 ____D () C:\Qoobox 2014-07-01 18:45 - 2014-06-26 10:25 - 00000000 ____D () C:\windows\ERDNT 2014-07-01 18:44 - 2009-07-13 22:34 - 00000215 _____ () C:\windows\system.ini 2014-07-01 18:38 - 2013-02-21 09:25 - 00000904 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA.job 2014-07-01 18:01 - 2012-04-27 19:26 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service 2014-06-28 22:17 - 2014-06-28 22:17 - 00000000 ____D () C:\Users\Lolo\Documents\ProcAlyzer Dumps 2014-06-28 22:17 - 2014-01-31 09:16 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy 2014-06-28 22:10 - 2014-06-28 22:09 - 05212118 ____R (Swearware) C:\Users\Lolo\Desktop\ComboFix.exe 2014-06-27 17:09 - 2014-06-22 15:34 - 00062527 _____ () C:\Users\Lolo\Downloads\FRST.txt 2014-06-27 17:05 - 2014-06-27 17:05 - 02083328 _____ (Farbar) C:\Users\Lolo\Downloads\FRST64(1).exe 2014-06-27 17:05 - 2014-06-27 17:05 - 00000490 _____ () C:\Users\Lolo\Desktop\found.txt 2014-06-27 15:15 - 2014-06-27 15:15 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-06-27 14:55 - 2014-06-27 14:55 - 00000000 __SHD () C:\Users\Lolo\AppData\Local\EmieUserList 2014-06-27 14:55 - 2014-06-27 14:55 - 00000000 __SHD () C:\Users\Lolo\AppData\Local\EmieSiteList 2014-06-27 14:55 - 2012-02-05 03:30 - 00000000 ____D () C:\Users\Lolo\AppData\Local\Google 2014-06-27 14:12 - 2014-06-27 14:01 - 00000000 ____D () C:\AdwCleaner 2014-06-27 14:00 - 2014-06-27 14:00 - 01342659 _____ () C:\Users\Lolo\Downloads\AdwCleaner.exe 2014-06-27 13:59 - 2014-06-27 13:58 - 00012929 _____ () C:\Users\Lolo\Desktop\JRT.txt 2014-06-27 13:33 - 2014-06-27 13:33 - 00000000 ____D () C:\windows\ERUNT 2014-06-27 13:31 - 2014-06-27 13:31 - 01016261 _____ (Thisisu) C:\Users\Lolo\Downloads\JRT.exe 2014-06-26 20:03 - 2013-05-28 14:42 - 00000000 ____D () C:\Users\Lolo\AppData\Local\CrashDumps 2014-06-26 11:15 - 2014-06-26 11:15 - 00000000 ____D () C:\ProgramData\RogueKiller 2014-06-26 10:54 - 2014-06-26 10:54 - 05283416 _____ () C:\Users\Lolo\Downloads\RogueKillerX64.exe 2014-06-26 10:51 - 2012-01-03 21:51 - 00003908 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-06-26 10:51 - 2012-01-03 21:51 - 00003656 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-06-26 10:37 - 2013-02-21 09:25 - 00000852 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core.job 2014-06-26 10:32 - 2013-02-21 09:25 - 00003872 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA 2014-06-26 10:32 - 2013-02-21 09:25 - 00003476 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core 2014-06-26 10:27 - 2014-06-26 10:13 - 00002040 _____ () C:\Users\Lolo\Desktop\Rkill.txt 2014-06-26 10:25 - 2014-06-26 10:24 - 00000000 ____D () C:\Program Files (x86)\ERUNT 2014-06-26 10:24 - 2014-06-26 10:24 - 00000869 _____ () C:\Users\Lolo\Desktop\ERUNT.lnk 2014-06-26 10:24 - 2014-06-26 10:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT 2014-06-26 10:23 - 2014-06-26 10:23 - 00791393 _____ (Lars Hederer ) C:\Users\Lolo\Downloads\erunt-setup.exe 2014-06-26 10:13 - 2014-06-26 10:13 - 01062136 _____ (Bleeping Computer, LLC) C:\Users\Lolo\Desktop\rkill64.exe 2014-06-26 10:04 - 2014-06-26 10:02 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\Lolo\Downloads\rkill.exe 2014-06-22 15:35 - 2014-06-22 15:35 - 00039847 _____ () C:\Users\Lolo\Downloads\Addition.txt 2014-06-22 14:47 - 2012-02-05 03:25 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo 2014-06-22 14:47 - 2011-09-28 23:37 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-06-22 14:47 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\registration 2014-06-22 13:52 - 2013-06-27 18:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2014-06-22 13:45 - 2014-06-22 13:45 - 00000000 ____D () C:\SUPERDelete 2014-06-22 13:20 - 2014-06-22 13:20 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-06-22 13:19 - 2014-06-22 13:18 - 19776448 _____ (SUPERAntiSpyware) C:\Users\Lolo\Downloads\SUPERAntiSpyware.exe 2014-06-22 13:17 - 2014-06-22 13:16 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\QuickScan 2014-06-22 11:13 - 2014-06-22 11:13 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2012-02-05 03:48 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Malwarebytes 2014-06-22 11:13 - 2012-02-05 03:48 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-22 11:12 - 2014-06-22 11:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lolo\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-22 10:49 - 2012-02-05 03:25 - 00000000 ____D () C:\Users\Lolo 2014-06-21 20:51 - 2012-07-02 16:42 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Spotify 2014-06-16 23:09 - 2012-02-05 04:02 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SoftGrid Client 2014-06-16 21:58 - 2012-07-02 16:42 - 00000000 ____D () C:\Users\Lolo\AppData\Local\Spotify 2014-06-16 20:04 - 2014-06-16 20:04 - 00354032 _____ () C:\windows\Minidump\061614-46004-01.dmp 2014-06-16 20:04 - 2014-05-30 19:43 - 522870382 _____ () C:\windows\MEMORY.DMP 2014-06-16 20:04 - 2012-02-09 01:32 - 00000000 ____D () C:\windows\Minidump 2014-06-16 18:44 - 2014-06-16 18:44 - 00354032 _____ () C:\windows\Minidump\061614-35802-01.dmp 2014-06-16 15:41 - 2014-06-16 15:40 - 00354032 _____ () C:\windows\Minidump\061614-35895-01.dmp 2014-06-15 19:35 - 2014-06-15 19:35 - 00354032 _____ () C:\windows\Minidump\061514-25724-01.dmp 2014-06-15 15:13 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\rescache 2014-06-14 23:16 - 2013-08-02 14:45 - 00000000 ____D () C:\windows\system32\MRT 2014-06-14 23:13 - 2013-05-17 23:23 - 95414520 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-06-14 23:10 - 2014-05-04 19:57 - 00000000 ___SD () C:\windows\system32\CompatTel 2014-06-14 22:02 - 2014-06-14 22:02 - 00354032 _____ () C:\windows\Minidump\061414-28345-01.dmp 2014-06-09 21:31 - 2014-06-09 21:29 - 38157960 _____ (Amazon.com) C:\Users\Lolo\Downloads\KindleForPC-installer(1).exe 2014-06-08 11:01 - 2014-06-08 11:01 - 00354032 _____ () C:\windows\Minidump\060814-27346-01.dmp 2014-06-08 05:13 - 2014-06-11 14:22 - 00506368 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-08 05:08 - 2014-06-11 14:22 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-04 17:49 - 2014-06-04 17:49 - 00354032 _____ () C:\windows\Minidump\060414-32978-01.dmp Some content of TEMP: ==================== C:\Users\Lolo\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppaq2wi.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-21 20:04 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-07-2014 Ran by Lolo at 2014-07-02 12:31:15 Running from C:\Users\Lolo\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C} AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} ==================== Installed Programs ====================== 64 Bit HP CIO Components Installer (Version: 6.2.1 - Hewlett-Packard) Hidden Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 3.1.0.4880 - Adobe Systems Incorporated) Hidden Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Reader X (10.1.6) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.6 - Adobe Systems Incorporated) Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.4.634 - Adobe Systems, Inc.) AIO_Scan (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden AirPort (HKLM-x32\...\{AA68AAAE-41F0-40B5-8896-5947F5FD6889}) (Version: 5.6.1.2 - Apple Inc.) AirPort (HKLM-x32\...\InstallShield_{48A8ADFF-D6E4-409D-B2BA-5CABB7FE5A84}) (Version: 4.2.0.11 - Apple Computer, Inc.) AirPort (x32 Version: 4.2.0.11 - Apple Computer, Inc.) Hidden Apple Application Support (HKLM-x32\...\{CCE825DB-347A-4004-A186-5F4A6FDD8547}) (Version: 2.3.2 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}) (Version: 6.0.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) avast! Free Antivirus (HKLM-x32\...\avast) (Version: 8.0.1489.0 - AVAST Software) AVS Image Converter 2.3.2.248 (HKLM-x32\...\AVS Image Converter_is1) (Version: 2.3.2.248 - Online Media Technologies Ltd.) BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden C7200 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden C7200_Help (x32 Version: 100.0.206.000 - Hewlett-Packard) Hidden Canon DIGITAL CAMERA Solution Disk Software Guide (HKLM-x32\...\Software Guide) (Version: 1.4.0.1 - Canon Inc.) CANON iMAGE GATEWAY MyCamera Download Plugin (HKLM-x32\...\MyCamera Download Plugin) (Version: 3.1.1.2 - Canon Inc.) CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM-x32\...\CANON iMAGE GATEWAY Task) (Version: 1.9.0.9 - Canon Inc.) Canon MOV Decoder (HKLM-x32\...\Canon MOV Decoder) (Version: 1.8.0.7 - Canon Inc.) Canon MOV Encoder (HKLM-x32\...\Canon MOV Encoder) (Version: 1.6.0.1 - Canon Inc.) Canon MovieEdit Task for ZoomBrowser EX (HKLM-x32\...\MovieEditTask) (Version: 3.7.0.4 - Canon Inc.) Canon PowerShot ELPH 100 HS_IXUS 115 HS Camera User Guide (HKLM-x32\...\CameraUserGuide-PSELPH100HS_IXUS115HS) (Version: 1.0.1.2 - Canon Inc.) Canon Utilities CameraWindow DC 8 (HKLM-x32\...\CameraWindowDC8) (Version: 8.4.0.3 - Canon Inc.) Canon Utilities CameraWindow Launcher (HKLM-x32\...\CameraWindowLauncher) (Version: 7.5.0.2 - Canon Inc.) Canon Utilities Movie Uploader for YouTube (HKLM-x32\...\MovieUploaderForYouTube) (Version: 1.2.0.7 - Canon Inc.) Canon Utilities MyCamera (HKLM-x32\...\MyCamera) (Version: 7.4.0.2 - Canon Inc.) Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.) Canon Utilities ZoomBrowser EX (HKLM-x32\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.) Canon ZoomBrowser EX Memory Card Utility (HKLM-x32\...\ZoomBrowser EX Memory Card Utility) (Version: 1.5.0.9 - Canon Inc.) Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.9 - DivX, LLC) DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version: - Softland) Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.) Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 6.0.1.6 - Lenovo) Energy Management (x32 Version: 6.0.1.6 - Lenovo) Hidden ERUNT 1.1j (HKLM-x32\...\ERUNT_is1) (Version: - Lars Hederer) ESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - ) Evernote v. 5.2 (HKLM-x32\...\{090931D6-A2F4-11E3-AD9C-00163E98E7D0}) (Version: 5.2.0.2946 - Evernote Corp.) Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden ffdshow [rev 2527] [2008-12-19] (HKLM-x32\...\ffdshow_is1) (Version: 1.0 - ) Free FLV Converter (HKLM-x32\...\Free FLV Converter_is1) (Version: - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.) Google Drive (HKLM-x32\...\{D9F75285-4864-461D-83DA-8D056BAC44D1}) (Version: 1.16.6866.4367 - Google, Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP) HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP) HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.5192 - HP Photo Creations) HP Photosmart 7510 series Basic Device Software (HKLM\...\{0446B95B-C0FD-4DE9-BD8E-76015D05E4F3}) (Version: 25.0.617.0 - Hewlett-Packard Co.) HP Photosmart 7510 series Help (HKLM-x32\...\{6357D25F-A9C9-4CC7-A1FB-0DCF344E7C40}) (Version: 140.0.2.2 - Hewlett Packard) HP Photosmart 7510 series Product Improvement Study (HKLM\...\{D9F55AA1-FD3E-47FF-A385-72ED53666D3F}) (Version: 25.0.617.0 - Hewlett-Packard Co.) HP Photosmart All-In-One Driver Software 13.0 Rel. 2 (HKLM\...\{988329F4-A1A1-4D51-803C-EF2725A97627}) (Version: 13.0 - HP) HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP) HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP) HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP) HP Update (HKLM-x32\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard) HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden Intel PROSet Wireless (Version: - ) Hidden Intel PROSet Wireless (x32 Version: - ) Hidden Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation) Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation) Intel® PROSet/Wireless WiFi Software (HKLM\...\{295AEB79-B53A-4F1B-860F-7800BB7E3681}) (Version: 14.2.1000 - Intel Corporation) Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.5.1001 - Intel Corporation) Intel® Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - ) Intel® Wireless Display (HKLM-x32\...\{F84906ED-BB54-4889-B131-FED9C9056FC8}) (Version: 2.0.27.0 - Intel Corporation) iSyncr (HKLM-x32\...\{6DA071E1-F0CB-4560-843A-D9B4441F8506}) (Version: 4.0.8 - JRT Studio) iTunes (HKLM\...\{0E5D76AD-A3FB-48D5-8400-8903B10317D3}) (Version: 11.0.1.12 - Apple Inc.) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden KakaoTalk (HKLM-x32\...\KakaoTalk) (Version: 1.2.0.587 - Kakao) Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.7400 - Broadcom Corporation) Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.1.7600.0083 - Realtek Semiconductor Corp.) Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.5 - Lenovo) Lenovo Games Console (HKLM-x32\...\Lenovo Games Console) (Version: 1.2.6.436 - Oberon Media Inc.) Lenovo MuteSync (HKLM-x32\...\InstallShield_{C39EF9B4-0C4F-4D48-8665-8FD45BFF3961}) (Version: 1.0.0.3 - Lenovo) Lenovo MuteSync (x32 Version: 1.0.0.3 - Lenovo) Hidden Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1628 - CyberLink Corp.) Lenovo OneKey Recovery (Version: 7.0.1628 - CyberLink Corp.) Hidden Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3603 - CyberLink Corp.) Lenovo YouCam (x32 Version: 3.1.3603 - CyberLink Corp.) Hidden Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden Microsoft Corporation (x32 Version: 9.1.0.0 - Microsoft Corporation) Hidden Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation) Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft VC9 runtime libraries (x32 Version: 2.0.0 - AOL Inc.) Hidden Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Mozilla Firefox 30.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 en-US)) (Version: 30.0 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Music Manager (HKCU\...\MusicManager) (Version: - Google, Inc.) Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP) Onekey Theater (HKLM-x32\...\InstallShield_{D4B060B9-AD4A-4152-9D99-28B93C615AFE}) (Version: 2.0.2.8 - Lenovo) Onekey Theater (x32 Version: 2.0.2.8 - Lenovo) Hidden ooVoo (HKLM-x32\...\{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}) (Version: 3.5.8022 - ooVoo LLC.) OpenOffice.org 3.3 (HKLM-x32\...\{3E171899-0175-47CC-84C4-562ACDD4C021}) (Version: 3.3.9567 - OpenOffice.org) PdaNet+ for Android 4.15 (HKLM-x32\...\PdaNet_is1) (Version: - June Fabrics Technology Inc) PhotoScape (HKLM-x32\...\PhotoScape) (Version: - ) Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.7303 - CyberLink Corp.) PS_AIO_02_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden PS_AIO_02_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden PS_AIO_02_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.) Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.23.623.2010 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6301 - Realtek Semiconductor Corp.) Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7601.39015 - Realtek Semiconductor Corp.) SaveTheChildren Reminder by We-Care.com v4.0.20.4 (HKLM-x32\...\{EE88303A-4DBB-4EC1-8C63-26EC1CAB599B}) (Version: 4.0.20.4 - We-Care.com) Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP) Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.) SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.) SRS Premium Sound Control Panel (HKLM\...\{F3C66EC8-2F33-452D-9CFF-E8C886B3ECC4}) (Version: 1.11.0000 - SRS Labs, Inc.) Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1026 - SUPERAntiSpyware.com) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.2.0 - Synaptics Incorporated) Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden TuneSync Server 2.0.28 (HKLM-x32\...\TuneSync Server) (Version: 2.0.28 - Fireleap Software LLC) UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo) UserGuide (x32 Version: 1.0.0.6 - Lenovo) Hidden VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.1.0126 - Lenovo) WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden Windows Driver Package - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (HKLM\...\EA12B1FB53CE4E387C31A85236C41EF559B5E392) (Version: 12/02/2010 6.1.0.1 - Lenovo) Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version: - ) ==================== Restore Points ========================= 03-06-2014 21:44:26 Windows Update 08-06-2014 13:57:09 Windows Update 11-06-2014 18:17:25 Windows Update 15-06-2014 03:10:32 Windows Update 22-06-2014 00:52:03 Windows Update 26-06-2014 14:13:54 Windows Update 01-07-2014 22:27:30 ComboFix created restore point 02-07-2014 16:03:22 Removed Java 7 Update 17 02-07-2014 16:06:27 Removed Java 6 Update 32 ==================== Hosts content: ========================== 2009-07-13 22:34 - 2014-07-01 18:43 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {0B56884A-A10B-45A4-9340-FF4B2EB99F4B} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software) Task: {1382782B-B440-46CC-98D9-8F4814069A96} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.6.0.27\SymErr.exe Task: {16FDAC17-4432-4FC8-9098-9A078815B95A} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.6.0.27\SymErr.exe Task: {243FF09F-1AB6-4D12-BAC3-5D14C42F460D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {2AAF0488-3DA8-4726-96D0-1AD91C83ADC1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-03] (Google Inc.) Task: {46F0BF2A-B26C-46F9-A08A-5299EBC04527} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-21] (Google Inc.) Task: {60112546-4AF3-4E98-ABAD-F143585C819C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-13] (Adobe Systems Incorporated) Task: {78A70E3A-7C60-4B87-843B-BC5C1599F23F} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2010-12-04] (CyberLink) Task: {8BAB6788-F351-4040-976F-53F23D7AF595} - System32\Tasks\RunAsStdUser Task for VeohWebPlayer => C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe Task: {BE87F4CE-8144-4754-8F7C-F64FA7F375CA} - System32\Tasks\HPCustParticipation HP Photosmart 7510 series => C:\Program Files\HP\HP Photosmart 7510 series\Bin\HPCustPartic.exe [2011-08-31] (Hewlett-Packard Co.) Task: {CE6C356F-BCA5-4B90-8BF4-4B328EEBF104} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-03] (Google Inc.) Task: {D4CC685B-FEB4-4595-B86F-685AFBB17C13} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {D969E974-9122-486D-BB27-772C68E70CF2} - System32\Tasks\HP Photo Creations Messager => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2011-02-15] () Task: {F4F3546E-A34F-4F1A-AB8D-AF5629DC7D75} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {F77788C8-82C9-4679-9107-BE354884D1D7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-21] (Google Inc.) Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core.job => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA.job => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe Task: C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Task: C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe ==================== Loaded Modules (whitelisted) ============= 2011-09-15 13:46 - 2011-09-15 13:46 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll 2011-02-16 13:56 - 2011-02-16 13:56 - 00202144 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect64.dll 2011-02-16 14:01 - 2011-02-16 14:01 - 00156576 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll64.dll 2012-01-03 22:03 - 2012-01-03 22:03 - 00628064 _____ () C:\windows\system32\SimpleExt.dll 2011-09-15 13:46 - 2011-09-15 13:46 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll 2008-12-19 23:20 - 2012-01-03 22:13 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\HookLib.dll 2008-12-19 23:20 - 2012-01-03 22:13 - 00054088 _____ () C:\Program Files (x86)\Lenovo\Energy Management\kbdhook.dll 2012-01-03 22:01 - 2012-01-03 22:01 - 00100256 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe 2011-11-03 01:32 - 2011-09-25 12:36 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2011-07-28 19:08 - 2011-07-28 19:08 - 01259376 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe 2014-02-23 15:18 - 2014-01-07 17:30 - 01054432 _____ () C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe 2010-02-28 06:33 - 2010-02-28 06:33 - 00077664 _____ () C:\Program Files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe 2014-07-02 11:59 - 2014-07-02 06:07 - 02816512 _____ () C:\Program Files\AVAST Software\Avast\defs\14070200\algo.dll 2014-01-31 09:16 - 2012-08-23 11:38 - 00574840 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\sqlite3.dll 2014-01-31 09:16 - 2013-05-16 11:55 - 00113496 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl 2014-01-31 09:16 - 2013-05-16 11:55 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl 2014-01-31 09:16 - 2013-05-16 11:55 - 00161112 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl 2014-01-31 09:16 - 2012-04-03 18:06 - 00565640 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\av\BDSmartDB.dll 2011-02-16 13:51 - 2011-02-16 13:51 - 00161696 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll 2011-02-16 13:53 - 2011-02-16 13:53 - 00133024 _____ () C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll 2013-12-10 17:06 - 2013-12-10 17:06 - 10683392 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\QtWebKit4.dll 2013-12-10 17:06 - 2013-12-10 17:06 - 07741952 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\QtGui4.dll 2013-12-10 17:06 - 2013-12-10 17:06 - 02248192 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\QtCore4.dll 2013-12-10 17:06 - 2013-12-10 17:06 - 01681408 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\QtNetwork4.dll 2014-04-23 18:38 - 2014-04-23 18:38 - 00117248 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\libaacdec.dll 2014-04-23 18:39 - 2014-04-23 18:39 - 00231936 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\libmpgdec.dll 2014-04-23 18:40 - 2014-04-23 18:40 - 00253440 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\libid3tag.dll 2014-04-23 18:38 - 2014-04-23 18:38 - 00344064 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\libaudioenc.dll 2013-12-10 17:06 - 2013-12-10 17:06 - 00026624 _____ () C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\imageformats\qgif4.dll 2012-01-03 22:03 - 2012-01-03 22:03 - 00013664 _____ () C:\Program Files (x86)\Lenovo\VeriFace\ChooseLang.dll 2014-07-02 12:26 - 2014-07-02 12:26 - 00043008 _____ () c:\users\lolo\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmppaq2wi.dll 2013-08-23 15:01 - 2013-08-23 15:01 - 25100288 _____ () C:\Users\Lolo\AppData\Roaming\Dropbox\bin\libcef.dll 2014-02-24 16:56 - 2014-02-24 16:56 - 00433664 _____ () C:\Program Files (x86)\Evernote\Evernote\libxml2.dll 2014-02-24 16:56 - 2014-02-24 16:56 - 00315392 _____ () C:\Program Files (x86)\Evernote\Evernote\libtidy.dll 2011-07-28 19:09 - 2011-07-28 19:09 - 00096112 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll 2014-06-10 14:54 - 2014-06-05 09:58 - 00716616 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libglesv2.dll 2014-06-10 14:54 - 2014-06-05 09:58 - 00126280 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\libegl.dll 2011-11-02 03:26 - 2011-11-02 03:26 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2011-11-02 03:26 - 2011-11-02 03:26 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-06-10 14:54 - 2014-06-05 09:58 - 04217672 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll 2014-06-10 14:54 - 2014-06-05 09:58 - 00414536 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll 2014-06-10 14:54 - 2014-06-05 09:58 - 01732424 _____ () C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== MSCONFIG/TASK MANAGER disabled items ========= MSCONFIG\startupreg: ooVoo.exe => C:\program files (x86)\oovoo\oovoo.exe /minimized MSCONFIG\startupreg: Spotify => "C:\Users\Lolo\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart ==================== Faulty Device Manager Devices ============= Name: Photosmart C7200 series Description: Photosmart C7200 series Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: iPodDrv Description: iPodDrv Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: iPodDrv Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Photosmart C7200 series Description: Photosmart C7200 series Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f} Manufacturer: HP Service: StillCam Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (07/02/2014 00:26:52 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/02/2014 00:08:14 PM) (Source: CVHSVC) (EventID: 100) (User: ) Description: Information only. (Stream product id=0x0066): Streaming Failed Error: (07/02/2014 00:06:27 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object. Details: AddCoreCsiFiles : GetNextFileMapContent() failed. System Error: The parameter is incorrect. . Error: (07/02/2014 00:06:26 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object. Details: AddCoreCsiFiles : GetNextFileMapContent() failed. System Error: The parameter is incorrect. . Error: (07/02/2014 00:05:12 PM) (Source: CVHSVC) (EventID: 100) (User: ) Description: Information only. Too many failures while downloading ranges: 2 Error: (07/02/2014 00:03:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object. Details: AddCoreCsiFiles : GetNextFileMapContent() failed. System Error: The parameter is incorrect. . Error: (07/02/2014 00:03:20 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Cryptographic Services failed while processing the OnIdentity() call in the System Writer Object. Details: AddCoreCsiFiles : GetNextFileMapContent() failed. System Error: The parameter is incorrect. . Error: (07/02/2014 00:02:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY) Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code. Error: (07/02/2014 00:02:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY) Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section. Error: (07/02/2014 11:56:46 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (07/02/2014 00:28:31 PM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC) Error: (07/02/2014 00:27:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Spybot-S&D 2 Updating Service service failed to start due to the following error: %%1053 Error: (07/02/2014 00:27:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Spybot-S&D 2 Updating Service service to connect. Error: (07/02/2014 00:25:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The iPodDrv service failed to start due to the following error: %%2 Error: (07/02/2014 00:25:55 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Apple Mobile Device service failed to start due to the following error: %%1053 Error: (07/02/2014 00:25:55 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the Apple Mobile Device service to connect. Error: (07/02/2014 00:15:58 PM) (Source: Service Control Manager) (EventID: 7034) (User: ) Description: The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s). Error: (07/02/2014 00:00:11 PM) (Source: Service Control Manager) (EventID: 7031) (User: ) Description: The avast! Antivirus service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 5000 milliseconds: Restart the service. Error: (07/02/2014 11:57:30 AM) (Source: DCOM) (EventID: 10016) (User: NT AUTHORITY) Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC) Error: (07/02/2014 11:57:00 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The Spybot-S&D 2 Updating Service service failed to start due to the following error: %%1053 Microsoft Office Sessions: ========================= Error: (07/02/2014 00:26:52 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (07/02/2014 00:08:14 PM) (Source: CVHSVC) (EventID: 100) (User: ) Description: (Stream product id=0x0066): Streaming Failed Error: (07/02/2014 00:06:27 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Details: AddCoreCsiFiles : GetNextFileMapContent() failed. System Error: The parameter is incorrect. Error: (07/02/2014 00:06:26 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Details: AddCoreCsiFiles : GetNextFileMapContent() failed. System Error: The parameter is incorrect. Error: (07/02/2014 00:05:12 PM) (Source: CVHSVC) (EventID: 100) (User: ) Description: Too many failures while downloading ranges: 2 Error: (07/02/2014 00:03:22 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Details: AddCoreCsiFiles : GetNextFileMapContent() failed. System Error: The parameter is incorrect. Error: (07/02/2014 00:03:20 PM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: ) Description: Details: AddCoreCsiFiles : GetNextFileMapContent() failed. System Error: The parameter is incorrect. Error: (07/02/2014 00:02:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY) Description: WmiApRplWmiApRpl8F20300004D070000 Error: (07/02/2014 00:02:59 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY) Description: Performance1637070000000000000000000009030000 Error: (07/02/2014 11:56:46 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 CodeIntegrity Errors: =================================== Date: 2014-07-01 18:42:23.872 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-07-01 18:42:23.775 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 23:02:05.034 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 23:02:04.961 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:59:28.617 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:59:28.518 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:57:22.474 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:57:22.355 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:56:47.887 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:56:47.821 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. ==================== Memory info =========================== Percentage of memory in use: 51% Total physical RAM: 4000.58 MB Available physical RAM: 1945.17 MB Total Pagefile: 7999.34 MB Available Pagefile: 5624.4 MB Total Virtual: 8192 MB Available Virtual: 8191.85 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:420.33 GB) (Free:322.94 GB) NTFS Drive d: (LENOVO) (Fixed) (Total:30.48 GB) (Free:27.55 GB) NTFS Drive i: (Karch) (CDROM) (Total:1.11 GB) (Free:0 GB) CDFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 2F57148F) Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=420 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=30 GB) - (Type=OF Extended) Partition 4: (Not Active) - (Size=15 GB) - (Type=12) ==================== End Of Log ============================
  8. lobro
    ComboFix 14-06-27.01 - Lolo 07/01/2014 18:31:01.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4001.2377 [GMT -4:00] Running from: c:\users\Lolo\Desktop\ComboFix.exe AV: avast! Antivirus *Disabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C} SP: avast! Antivirus *Disabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681} SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\programdata\Roaming c:\users\Lolo\Documents\~WRL0003.tmp c:\users\Lolo\Documents\~WRL0004.tmp c:\users\Lolo\Documents\~WRL0456.tmp c:\users\Lolo\Documents\~WRL0904.tmp c:\users\Lolo\Documents\~WRL1296.tmp c:\users\Lolo\Documents\~WRL2209.tmp c:\users\Lolo\Documents\~WRL2647.tmp c:\users\Lolo\Documents\~WRL3193.tmp c:\users\Lolo\Documents\~WRL3465.tmp c:\windows\s.bat c:\windows\SysWow64\sqlite3.dll . . ((((((((((((((((((((((((( Files Created from 2014-06-01 to 2014-07-01 ))))))))))))))))))))))))))))))) . . 2014-07-01 22:43 . 2014-07-01 22:43 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-06-27 19:15 . 2014-06-27 19:15 -------- d-----w- c:\program files (x86)\ESET 2014-06-27 19:14 . 2014-06-27 19:14 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7F099E07-83A3-40A5-9CDA-8B25F1D38E75}\offreg.dll 2014-06-27 18:55 . 2014-06-27 18:55 -------- d-sh--w- c:\users\Lolo\AppData\Local\EmieUserList 2014-06-27 18:55 . 2014-06-27 18:55 -------- d-sh--w- c:\users\Lolo\AppData\Local\EmieSiteList 2014-06-27 18:01 . 2014-06-27 18:12 -------- d-----w- C:\AdwCleaner 2014-06-27 17:38 . 2014-06-05 10:54 10779000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{7F099E07-83A3-40A5-9CDA-8B25F1D38E75}\mpengine.dll 2014-06-27 17:33 . 2014-06-27 17:33 -------- d-----w- c:\windows\ERUNT 2014-06-26 15:15 . 2014-06-26 15:15 -------- d-----w- c:\programdata\RogueKiller 2014-06-26 14:24 . 2014-06-26 14:25 -------- d-----w- c:\program files (x86)\ERUNT 2014-06-22 19:33 . 2014-06-27 21:09 -------- d-----w- C:\FRST 2014-06-22 17:45 . 2014-06-22 17:45 -------- d-----w- C:\SUPERDelete 2014-06-22 17:20 . 2014-06-22 17:20 -------- d-----w- c:\users\Lolo\AppData\Roaming\SUPERAntiSpyware.com 2014-06-22 17:20 . 2014-06-22 17:20 -------- d-----w- c:\program files\SUPERAntiSpyware 2014-06-22 17:20 . 2014-06-22 17:20 -------- d-----w- c:\programdata\SUPERAntiSpyware.com 2014-06-22 17:16 . 2014-06-22 17:17 -------- d-----w- c:\users\Lolo\AppData\Roaming\QuickScan 2014-06-22 15:14 . 2014-07-01 22:07 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-06-22 15:13 . 2014-06-22 15:13 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware 2014-06-22 15:13 . 2014-05-12 11:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys 2014-06-22 15:13 . 2014-05-12 11:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2014-06-11 18:24 . 2014-04-25 02:34 801280 ----a-w- c:\windows\system32\usp10.dll 2014-06-11 18:24 . 2014-04-25 02:06 626688 ----a-w- c:\windows\SysWow64\usp10.dll 2014-06-11 18:22 . 2014-06-08 09:13 506368 ----a-w- c:\windows\system32\aepdu.dll 2014-06-11 18:22 . 2014-06-08 09:08 424448 ----a-w- c:\windows\system32\aeinv.dll . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-06-15 03:13 . 2013-05-18 03:23 95414520 ----a-w- c:\windows\system32\MRT.exe 2014-05-31 20:50 . 2012-01-04 01:56 57952 ----a-w- c:\windows\system32\drivers\fbfmon.sys 2014-05-31 20:50 . 2012-01-04 01:56 46176 ----a-w- c:\windows\system32\FbDefrag.exe 2014-05-31 20:50 . 2012-01-04 01:56 15968 ----a-w- c:\windows\system32\NFbfmon.dll 2014-05-31 20:50 . 2012-01-04 01:56 13408 ----a-w- c:\windows\system32\drivers\BPntDrv.sys 2014-05-14 00:23 . 2012-04-27 12:43 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-05-14 00:23 . 2012-03-03 23:56 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-05-12 11:25 . 2012-02-05 07:48 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-04-12 02:22 . 2014-05-14 20:19 155072 ----a-w- c:\windows\system32\drivers\ksecpkg.sys 2014-04-12 02:22 . 2014-05-14 20:19 95680 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2014-04-12 02:19 . 2014-05-14 20:19 136192 ----a-w- c:\windows\system32\sspicli.dll 2014-04-12 02:19 . 2014-05-14 20:19 29184 ----a-w- c:\windows\system32\sspisrv.dll 2014-04-12 02:19 . 2014-05-14 20:19 28160 ----a-w- c:\windows\system32\secur32.dll 2014-04-12 02:19 . 2014-05-14 20:19 1460736 ----a-w- c:\windows\system32\lsasrv.dll 2014-04-12 02:19 . 2014-05-14 20:19 31232 ----a-w- c:\windows\system32\lsass.exe 2014-04-12 02:12 . 2014-05-14 20:19 22016 ----a-w- c:\windows\SysWow64\secur32.dll 2014-04-12 02:10 . 2014-05-14 20:19 96768 ----a-w- c:\windows\SysWow64\sspicli.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Lolo\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Lolo\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Lolo\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2012-01-04 39408] "Spotify Web Helper"="c:\users\Lolo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-05-15 1176632] "MusicManager"="c:\users\Lolo\AppData\Local\Programs\Google\MusicManager\MusicManager.exe" [2014-04-23 7631872] "GoogleChromeAutoLaunch_A9AECA91371A37F0FDB4C908F31716C4"="c:\program files (x86)\Google\Chrome\Application\chrome.exe" [2014-06-05 860488] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2014-06-04 6564120] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "MuteSync"="c:\progra~2\Lenovo\LENOVO~1\MuteSync.exe" [2009-12-28 336384] "YouCam Mirage"="c:\program files (x86)\Lenovo\YouCam\YCMMirage.exe" [2010-12-05 136488] "YouCam Tray"="c:\program files (x86)\Lenovo\YouCam\YouCam.exe" [2010-12-05 224352] "VeriFaceManager"="c:\program files (x86)\Lenovo\VeriFace\PManage.exe" [2012-01-04 329056] "UpdateP2GShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2010-07-26 222504] "UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe" [2009-05-13 222504] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280] "hpqSRMon"="c:\program files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-07-23 150528] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "LifeCam"="c:\program files (x86)\Microsoft LifeCam\LifeExp.exe" [2010-05-20 119152] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848] "avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2013-05-09 4858968] "AirPort Base Station Agent"="c:\program files (x86)\AirPort\APAgent.exe" [2009-11-11 771360] "SDTray"="c:\program files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784] . c:\users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Lolo\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-19 33322312] EvernoteClipper.lnk - c:\program files (x86)\Evernote\Evernote\EvernoteClipper.exe [2014-3-3 1106784] PdaNet Desktop.lnk - c:\program files (x86)\PdaNet for Android\PdaNetPC.exe [2014-2-23 1054432] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-20 270336] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32] "mixer3"=wdmaud.drv . [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager] BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE] @="" . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 iPodDrv;iPodDrv;c:\windows\system32\drivers\iPodDrv.sys;c:\windows\SYSNATIVE\drivers\iPodDrv.sys [x] R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [x] R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys;c:\windows\SYSNATIVE\DRIVERS\amppal.sys [x] R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys;c:\windows\SYSNATIVE\Drivers\androidusb.sys [x] R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x] R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x] R3 RSUSBVSTOR;RtsUVStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUVStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUVStor.sys [x] R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssadbus.sys [x] R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdfl.sys [x] R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssadmdm.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S0 aswRvrt;aswRvrt; [x] S0 aswVmm;aswVmm; [x] S0 fbfmon;fbfmon;c:\windows\system32\drivers\fbfmon.sys;c:\windows\SYSNATIVE\drivers\fbfmon.sys [x] S0 LHDmgr;LHDmgr;c:\windows\System32\DRIVERS\LhdX64.sys;c:\windows\SYSNATIVE\DRIVERS\LhdX64.sys [x] S1 aswSnx;aswSnx; [x] S1 aswSP;aswSP; [x] S1 BPntDrv;BPntDrv;c:\windows\system32\drivers\BPntDrv.sys;c:\windows\SYSNATIVE\drivers\BPntDrv.sys [x] S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [x] S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [x] S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [x] S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [x] S2 aswFsBlk;aswFsBlk; [x] S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x] S2 BTHSSecurityMgr;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [x] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x] S3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\DRIVERS\AcpiVpc.sys;c:\windows\SYSNATIVE\DRIVERS\AcpiVpc.sys [x] S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys;c:\windows\SYSNATIVE\DRIVERS\AMPPAL.sys [x] S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x] S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x] S3 pneteth;PdaNet Broadband;c:\windows\system32\DRIVERS\pneteth.sys;c:\windows\SYSNATIVE\DRIVERS\pneteth.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 rtsuvc;Lenovo EasyCamera;c:\windows\system32\DRIVERS\rtsuvc.sys;c:\windows\SYSNATIVE\DRIVERS\rtsuvc.sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x] S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - MBAMSWISSARMY . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-06-10 18:50 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2014-07-01 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-27 00:23] . 2014-07-01 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-04 01:51] . 2014-06-27 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-01-04 01:51] . 2014-06-26 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core.job - c:\users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-21 13:25] . 2014-07-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA.job - c:\users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-21 13:25] . 2014-06-29 c:\windows\Tasks\HP Photo Creations Messager.job - c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11] . 2014-06-22 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job - c:\program files\SUPERAntiSpyware\SASTask.exe [2013-11-07 20:08] . 2014-06-22 c:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job - c:\program files\SUPERAntiSpyware\SASTask.exe [2013-11-07 20:08] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast] @="{472083B0-C522-11CF-8763-00608CC02F24}" [HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}] 2013-05-09 08:58 133840 ----a-w- c:\program files\AVAST Software\Avast\ashShA64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Lolo\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Lolo\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Lolo\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Lolo\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2014-06-05 21:46 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2014-06-05 21:46 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}] 2014-06-05 21:46 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2014-06-05 21:46 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2014-06-05 21:46 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc] @="{771C7324-DA80-49D3-8017-753B0AF60951}" [HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}] 2012-01-04 02:03 1508192 ----a-w- c:\windows\System32\IcnOvrly.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-01-26 11775592] "IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-09-15 1935120] "Lenovo EE Boot Optimizer"="c:\program files (x86)\Lenovo\Boot Optimizer\PopWnd.exe" [2014-05-31 114688] "OnekeyStudio"="c:\program files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe" [2012-01-04 789920] "Energy Management"="c:\program files (x86)\Lenovo\Energy Management\Energy Management.exe" [2012-01-04 9745312] "EnergyUtility"="c:\program files (x86)\Lenovo\Energy Management\Utility.exe" [2012-01-04 5374880] "VX3000"="c:\windows\vVX3000.exe" [2010-05-20 762736] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2014-01-30 171992] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2014-01-30 399832] "Persistence"="c:\windows\system32\igfxpers.exe" [2014-01-30 442328] . ------- Supplementary Scan ------- . uStart Page = uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: Clip image - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4 IE: Clip selection - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3 IE: Clip this page - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1 IE: Clip URL - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0 IE: New note - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html IE: Send image to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm IE: Send page to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm TCP: DhcpNameServer = 10.0.1.1 TCP: Interfaces\{0C1C8453-36F5-450F-AAD8-DDAD2D50C2B8}: NameServer = 208.67.220.220,4.2.2.1 TCP: Interfaces\{3972253B-B859-4651-BA6E-948C826CD575}: NameServer = 208.67.220.220,4.2.2.1 TCP: Interfaces\{746F43E9-4DE2-4D4B-B00B-BF43A7383BD5}: NameServer = 208.67.220.220,4.2.2.1 TCP: Interfaces\{D3A96F26-BF9E-4818-AD4C-F4359FAB3A49}: NameServer = 208.67.220.220,4.2.2.1 TCP: Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92}: NameServer = 208.67.220.220,4.2.2.1,10.0.1.1 FF - ProfilePath - c:\users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/ FF - ExtSQL: !HIDDEN! 2012-02-05 15:32; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKLM-Run-ROC_ROC_NT - c:\program files (x86)\AVG Secure Search\ROC_ROC_NT.exe Notify-SDWinLogon - SDWinLogon.dll HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start Toolbar-Locked - (no file) HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.10" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\windows\\SysWow64\\Macromed\\Flash\\Flash10h.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2014-07-01 18:49:16 ComboFix-quarantined-files.txt 2014-07-01 22:49 . Pre-Run: 344,460,500,992 bytes free Post-Run: 345,408,610,304 bytes free . - - End Of File - - 1F375E2297E38D17793BC2D7C34A4A7B
  9. lobro
    So, I've just realized as I went to run combofix that I've had spybot and super anti spyware still enabled. I was disabling Avast the whole time but I didn't realize the others needed to be disabled as well. I can't seem to manage turning the spybot off even after reading the page on disabling virus protection, so could I just uninstall it then proceed?
  10. lobro
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.1.4 (04.06.2014:1) OS: Windows 7 Home Premium x64 Ran by Lolo on Fri 06/27/2014 at 13:33:22.46 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\protector_dll.protectorbho.1 Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{4FBBF769-ECEB-420A-B536-133B1D505C36} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\iehelperv2.5.0.dll Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{E46C8196-B634-44A1-AF6E-957C64278AB1} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\ilivid Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\wecarereminder Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduit Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduitsearchscopes Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2EECD738-5844-4A99-B4B6-146BF802613B} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{97F2FF5B-260C-4CCF-834A-2DDA4E29E39E} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{2EECD738-5844-4A99-B4B6-146BF802613B} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3378580329-3139310990-1513726972-1001\Software\sweetim Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\babylon Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\applications\ilividsetup.exe Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\applications\ilividsetupv1.exe Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bbylntlbr.bbylntlbrhlpr Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\bbylntlbr.bbylntlbrhlpr.1 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\prod.cap Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\apnstub_rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\askpartnercobrandingtool_rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ilividsetup_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ilividsetup_rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ilividsetupv1_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\ilividsetupv1_rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\mybabylontb_rasapi32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\mybabylontb_rasmancs Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\sp global Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\sprotector Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3289847 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3298566 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\AskSLib_RASMANCS Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\aol_pricecheck_fx_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\aol_pricecheck_fx_RASMANCS Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\aol_pricecheck_ie_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\aol_pricecheck_ie_RASMANCS Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\AskSLib_RASMANCS Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\aol_pricecheck_fx_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\aol_pricecheck_fx_RASMANCS Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\aol_pricecheck_ie_RASAPI32 Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Tracing\aol_pricecheck_ie_RASMANCS Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{4F183FC7-D685-477F-B7BA-2245F2F4FC16} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{443789B7-F39C-4b5c-9287-DA72D38F4FE6} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{40C78C4E-5AE5-4762-9B7D-D2DE31B03B77} ~~~ Files Successfully deleted: [File] "C:\end" Successfully deleted: [File] C:\windows\syswow64\sho742F.tmp Successfully deleted: [File] "C:\windows\syswow64\yealt.dll" ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\partner" Successfully deleted: [Folder] "C:\ProgramData\premium" Successfully deleted: [Folder] "C:\ProgramData\softsafe" Successfully deleted: [Folder] "C:\ProgramData\visualbee" Successfully deleted: [Folder] "C:\ProgramData\wecarereminder" Successfully deleted: [Folder] "C:\Users\Lolo\appdata\locallow\babylontoolbar" Successfully deleted: [Folder] "C:\Users\Lolo\appdata\locallow\boost_interprocess" Successfully deleted: [Folder] "C:\Users\Lolo\appdata\locallow\conduit" Successfully deleted: [Folder] "C:\Program Files (x86)\conduit" Successfully deleted: [Folder] "C:\Program Files (x86)\vaudix" ~~~ FireFox Successfully deleted: [File] C:\user.js Successfully deleted: [File] C:\Users\Lolo\AppData\Roaming\mozilla\firefox\profiles\nbnlwtc6.default\user.js Successfully deleted: [Folder] C:\Users\Lolo\AppData\Roaming\mozilla\firefox\profiles\nbnlwtc6.default\smartbar Successfully deleted the following from C:\Users\Lolo\AppData\Roaming\mozilla\firefox\profiles\nbnlwtc6.default\prefs.js user_pref("CT3298566.installType", "conduitnsisintegration"); user_pref("CT3298566.mam_gk_appState_PiclickV2-WebSearch.enc", "b2Zm"); user_pref("CT3298566.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsIm9wdGlvbnN user_pref("CT3298566.originalHomepage", "hxxp://search.conduit.com/?ctid=CT3289847&CUI=UN21806218723095110&UM=2&SearchSource=13"); user_pref("CT3298566.originalSearchAddressUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN21806218723095110&UM=2&q="); user_pref("CT3298566.originalSearchEngine", "WhiteSmoke New Customized Web Search"); user_pref("CT3298566.search.searchAppId", "130110228003246321"); user_pref("CT3298566.search.searchCount", "0"); user_pref("CT3298566.smartbar.CTID", "CT3298566"); user_pref("CT3298566.smartbar.Uninstall", "0"); user_pref("CT3298566.smartbar.homepage", "true"); user_pref("CT3298566.smartbar.isHidden", true); user_pref("CT3298566.smartbar.toolbarName", "MixiDJ V30 "); user_pref("Smartbar.ConduitHomepagesList", ""); user_pref("Smartbar.ConduitSearchEngineList", ""); user_pref("Smartbar.ConduitSearchUrlList", ""); user_pref("Smartbar.SearchFromAddressBarSavedUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN21806218723095110&UM=2&q="); user_pref("Smartbar.keywordURLSelectedCTID", "CT3289847"); user_pref("browser.search.defaultthis.engineName", "MixiDJ V30 Customized Web Search"); user_pref("extensions.visualbee.tlbrId", "vdelta"); user_pref("plugin.state.npconduitfirefoxplugin", 2); user_pref("smartbar.addressBarOwnerCTID", "CT3289847"); user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3289847&CUI=UN21806218723095110&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3298566&CUI user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3289847&SearchSource=2&CUI=UN21806218723095110&UM=2&q=,hxxp://search.condui user_pref("smartbar.defaultSearchOwnerCTID", "CT3289847"); user_pref("smartbar.homePageOwnerCTID", "CT3289847"); user_pref("smartbar.machineId", "J/GAU9MKBVHSOCDUP9RSGFEBHXBXGVZX4ULR6BBNN0NUFZBLD4H7KDFKQU64D3DXFKM6JFGPI5SFEI/W4ZO2SG"); user_pref("sweetim.toolbar.previous.browser.search.defaultenginename", ""); user_pref("sweetim.toolbar.previous.browser.search.selectedEngine", ""); user_pref("sweetim.toolbar.previous.browser.startup.homepage", ""); user_pref("sweetim.toolbar.previous.keyword.URL", ""); user_pref("sweetim.toolbar.scripts.1.domain-blacklist", ".*"); user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_DS", "1"); user_pref("sweetim.toolbar.searchguard.UserRejectedGuard_HP", "1"); user_pref("sweetim.toolbar.searchguard.enable", "false"); Emptied folder: C:\Users\Lolo\AppData\Roaming\mozilla\firefox\profiles\nbnlwtc6.default\minidumps [204 files] ~~~ Chrome Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\dednnpigldgdbpgcdpfppmlcnnbjciel Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Google\Chrome\Extensions\gelpfbcidpeeelkmkjbofkcpihkcachn Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\lpmkgpnbiojfaoklbkpfneikocaobfai ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Fri 06/27/2014 at 13:58:20.13 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ # AdwCleaner v3.213 - Report created 27/06/2014 at 14:11:54 # Updated 23/06/2014 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Lolo - LOLO-PC # Running from : C:\Users\Lolo\Downloads\AdwCleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Users\Lolo\AppData\Local\apn Folder Deleted : C:\Users\Lolo\AppData\Local\Conduit Folder Deleted : C:\Users\Lolo\AppData\Local\SwvUpdater File Deleted : C:\ProgramData\uninstaller.exe ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKCU\Software\Google\Chrome\Extensions\fdkednngfjmpnljkolbapdednncafhen Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\fdkednngfjmpnljkolbapdednncafhen Key Deleted : HKCU\Software\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\klibnahbojhkanfgaglnlalfkgpcppfi Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\babylon.com Key Deleted : HKCU\Software\5a4dfdee668ec41 Key Deleted : HKLM\SOFTWARE\5a4dfdee668ec41 Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SP_09de8db5 Key Deleted : HKLM\SOFTWARE\Classes\AppID\{5B1881D1-D9C7-46DF-B041-1E593282C7D0} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{40C78C4E-5AE5-4762-9B7D-D2DE31B03B77} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{40C78C4E-5AE5-4762-9B7D-D2DE31B03B77} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{40C78C4E-5AE5-4762-9B7D-D2DE31B03B77} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{AC5B6CDA-8F90-4740-9A8C-28AC5D3C73FE} Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{EF99BD32-C1FB-11D2-892F-0090271D4F88}] Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\Software\InfoAtoms Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BabylonToolbar ***** [ Browsers ] ***** -\\ Internet Explorer v11.0.9600.17126 -\\ Mozilla Firefox v29.0.1 (en-US) [ File : C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\prefs.js ] Line Deleted : user_pref("CT3289847_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1391484665159,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]"); Line Deleted : user_pref("CT3298566.1000082.isPlayDisplay", "true"); Line Deleted : user_pref("CT3298566.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock - Rock\",\"url\":\"hxxp://www.feedlive.net/california.asx\"}"); Line Deleted : user_pref("CT3298566.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3298566.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3298566.FF19Solved", "true"); Line Deleted : user_pref("CT3298566.FirstTime", "true"); Line Deleted : user_pref("CT3298566.FirstTimeFF3", "true"); Line Deleted : user_pref("CT3298566.PG_ENABLE", "dHJ1ZQ=="); Line Deleted : user_pref("CT3298566.SF_JUST_INSTALLED.enc", "RkFMU0U="); Line Deleted : user_pref("CT3298566.SF_STATUS.enc", "RU5BQkxFRA=="); Line Deleted : user_pref("CT3298566.TopHitsConfig.enc", "ew0KICAgICJzcHJpdGVVcmwiOiAiaHR0cDovL3N0b3JhZ2UuY29uZHVpdC5jb20vcHMvVG9wSGl0c0dlbmVyaWNBcHAvY29uZmlncy9VUy1VSy1EYW5jZS1Sb2NrLVJhcC9zcHJpdGUucG5nIiwNCiAgICAiaX[...] Line Deleted : user_pref("CT3298566.UserID", "UN50175283513869268"); Line Deleted : user_pref("CT3298566.YTbyClickFavorites.enc", "W10="); Line Deleted : user_pref("CT3298566.YTbyClickRecent.enc", "W10="); Line Deleted : user_pref("CT3298566.addressBarTakeOverEnabledInHidden", "true"); Line Deleted : user_pref("CT3298566.browser.search.defaultthis.engineName", "true"); Line Deleted : user_pref("CT3298566.countryCode", "US"); Line Deleted : user_pref("CT3298566.defaultSearch", "true"); Line Deleted : user_pref("CT3298566.enableAlerts", "true"); Line Deleted : user_pref("CT3298566.enableFix404ByUser", "TRUE"); Line Deleted : user_pref("CT3298566.enableSearchFromAddressBar", "true"); Line Deleted : user_pref("CT3298566.enlargeSearchBox", "{\"enabled\":true,\"maxWidth\":1000,\"minWidth\":250,\"width\":500}"); Line Deleted : user_pref("CT3298566.firstTimeDialogOpened", "true"); Line Deleted : user_pref("CT3298566.fixPageNotFoundError", "true"); Line Deleted : user_pref("CT3298566.fixPageNotFoundErrorByUser", "true"); Line Deleted : user_pref("CT3298566.fixPageNotFoundErrorInHidden", "true"); Line Deleted : user_pref("CT3298566.fixUrls", true); Line Deleted : user_pref("CT3298566.fullUserID", "UN50175283513869268.IN.20130625165624"); Line Deleted : user_pref("CT3298566.homepageuserchanged", true); Line Deleted : user_pref("CT3298566.installDate", "25/06/2013 16:56:21"); Line Deleted : user_pref("CT3298566.installId", "cid111"); Line Deleted : user_pref("CT3298566.installSessionId", "{750D507D-78E6-461D-8875-385BAC38BABE}"); Line Deleted : user_pref("CT3298566.installSp", "TRUE"); Line Deleted : user_pref("CT3298566.installUsage", "2013-06-26T04:00:24.7998115+03:00"); Line Deleted : user_pref("CT3298566.installUsageEarly", "2013-06-26T04:00:23.1618535+03:00"); Line Deleted : user_pref("CT3298566.installerVersion", "1.5.4.1"); Line Deleted : user_pref("CT3298566.isCheckedStartAsHidden", true); Line Deleted : user_pref("CT3298566.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3298566.isFirstTimeToolbarLoading", "false"); Line Deleted : user_pref("CT3298566.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Line Deleted : user_pref("CT3298566.keyword", "true"); Line Deleted : user_pref("CT3298566.lastVersion", "10.23.0.822"); Line Deleted : user_pref("CT3298566.mam_gk_appStateReportTime.enc", "MTM3MjIwODQzMzUzNA=="); Line Deleted : user_pref("CT3298566.mam_gk_appState_CouponBuddy.enc", "b2Zm"); Line Deleted : user_pref("CT3298566.mam_gk_appState_Discover.enc", "b2Zm"); Line Deleted : user_pref("CT3298566.mam_gk_appState_Easytobook.enc", "b2Zm"); Line Deleted : user_pref("CT3298566.mam_gk_appState_Easytobook_targeted.enc", "b2Zm"); Line Deleted : user_pref("CT3298566.mam_gk_appState_Find-a-Pro.enc", "b2Zm"); Line Deleted : user_pref("CT3298566.mam_gk_appState_PriceGong.enc", "b2Zm"); Line Deleted : user_pref("CT3298566.mam_gk_appState_WindowShopper.enc", "b2Zm"); Line Deleted : user_pref("CT3298566.mam_gk_appsDefaultEnabled.enc", "ZmFsc2U="); Line Deleted : user_pref("CT3298566.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IlBpY2xpY2tWMi1XZWJTZWFyY2giLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiIwODAzYmU0Yi1hMDkzLTQ4ODQtYTNlNi04MTEwMmQyZWQ2NGIiLCJ[...] Line Deleted : user_pref("CT3298566.mam_gk_currentVersion.enc", "MS44LjAuNA=="); Line Deleted : user_pref("CT3298566.mam_gk_eventsCache.enc", "eyJkNTdlMTBhOC1lMzkxLTQ0ZTUtYTEwMy1kNDFhZTBjMTBmYjkiOnsidG9waWMiOiJzZW5kVXNhZ2UiLCJkYXRhIjp7ImNhdGVnb3J5IjoiV2VsY29tZSIsImFjdGlvbiI6IlZpZXcifSwidW5pcXVlS[...] Line Deleted : user_pref("CT3298566.mam_gk_first_time.enc", "MQ=="); Line Deleted : user_pref("CT3298566.mam_gk_gadgetOpen.enc", "MA=="); Line Deleted : user_pref("CT3298566.mam_gk_lastLoginTime.enc", "MTM3MjIwODQzMjAzMQ=="); Line Deleted : user_pref("CT3298566.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50IFBvbGljeSJ9LCJnYWRnZXREZXNjcmlwdGlvblByaW1hcnkiOnsiVGV4dCI6IlZhbHVlIEFwcHMgZW5yaWNoZXMgeW91ciB3ZWIg[...] Line Deleted : user_pref("CT3298566.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ=="); Line Deleted : user_pref("CT3298566.mam_gk_settings1.8.0.4.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNTFfMCIsImlzVGVzdCI6dHJ1ZSwiVXNlckNvdW50cnlDb2RlIjoiVVMiLCJpc1dlbGNvbWVFeHBlc[...] Line Deleted : user_pref("CT3298566.mam_gk_showCloseButton.enc", "dHJ1ZQ=="); Line Deleted : user_pref("CT3298566.mam_gk_showWelcomeGadget.enc", "dHJ1ZQ=="); Line Deleted : user_pref("CT3298566.mam_gk_userId.enc", "OTY1NjA0NzAtZGIyMy00ZWU4LWEyODQtNDBhODYyZGQ0ZmE0"); Line Deleted : user_pref("CT3298566.mam_gk_user_approval_interacted.enc", "MQ=="); Line Deleted : user_pref("CT3298566.migrateAppsAndComponents", true); Line Deleted : user_pref("CT3298566.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxps%3A%2F%2Fwww.google.com%2F\",\"EB_MAIN_FRAME_TITLE\":\"Google\",\"EB_SEARCH_TERM\":\"\",\"EB_TOOLBAR_SUB_DOMAIN\":\"hxxp://M[...] Line Deleted : user_pref("CT3298566.newSettings", "{\"dataType\":\"boolean\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3298566.openThankYouPage", "false"); Line Deleted : user_pref("CT3298566.openUninstallPage", "true"); Line Deleted : user_pref("CT3298566.revertSettingsEnabled", "false"); Line Deleted : user_pref("CT3298566.searchFromAddressBarEnabledByUser", "true"); Line Deleted : user_pref("CT3298566.searchInNewTabEnabledByUser", "true"); Line Deleted : user_pref("CT3298566.searchInNewTabEnabledInHidden", "true"); Line Deleted : user_pref("CT3298566.searchRevert", "false"); Line Deleted : user_pref("CT3298566.searchSuggestEnabledByUser", "true"); Line Deleted : user_pref("CT3298566.searchUserMode", "2"); Line Deleted : user_pref("CT3298566.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3298566.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3298566.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}"); Line Deleted : user_pref("CT3298566.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3298566\"}"); Line Deleted : user_pref("CT3298566.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://MixiDJV30.OurToolbar.com//xpi\"}"); Line Deleted : user_pref("CT3298566.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"MixiDJ V30 \"}"); Line Deleted : user_pref("CT3298566.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3298566.serviceLayer_service_usage_toolbarUsageCount", "{\"dataType\":\"number\",\"data\":\"2\"}"); Line Deleted : user_pref("CT3298566.serviceLayer_services_Configuration_lastUpdate", "1391006609298"); Line Deleted : user_pref("CT3298566.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1372208421519"); Line Deleted : user_pref("CT3298566.serviceLayer_services_appsMetadata_lastUpdate", "1372208421509"); Line Deleted : user_pref("CT3298566.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1372208421438"); Line Deleted : user_pref("CT3298566.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1372208420522"); Line Deleted : user_pref("CT3298566.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1372208422165"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.16.4.711_lastUpdate", "1373508512618"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.16.7.524_lastUpdate", "1375151747866"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.16.70.505_lastUpdate", "1377302377958"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.19.2.505_lastUpdate", "1378860047333"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.20.0.513_lastUpdate", "1379015986682"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.20.1.508_lastUpdate", "1382202854990"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.21.1.507_lastUpdate", "1384059384126"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.22.2.530_lastUpdate", "1384555785476"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.22.3.518_lastUpdate", "1386447864217"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.22.5.510_lastUpdate", "1387576344621"); Line Deleted : user_pref("CT3298566.serviceLayer_services_login_10.23.0.822_lastUpdate", "1391037124551"); Line Deleted : user_pref("CT3298566.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1372208421527"); Line Deleted : user_pref("CT3298566.serviceLayer_services_searchAPI_lastUpdate", "1391006609131"); Line Deleted : user_pref("CT3298566.serviceLayer_services_serviceMap_lastUpdate", "1391006592853"); Line Deleted : user_pref("CT3298566.serviceLayer_services_toolbarContextMenu_lastUpdate", "1372208421352"); Line Deleted : user_pref("CT3298566.serviceLayer_services_toolbarSettings_lastUpdate", "1391037124993"); Line Deleted : user_pref("CT3298566.serviceLayer_services_translation_lastUpdate", "1391006608083"); Line Deleted : user_pref("CT3298566.settingsINI", true); Line Deleted : user_pref("CT3298566.shouldFirstTimeDialog", "false"); Line Deleted : user_pref("CT3298566.showToolbarPermission", "false"); Line Deleted : user_pref("CT3298566.startPage", "true"); Line Deleted : user_pref("CT3298566.toolbarBornServerTime", "26-6-2013"); Line Deleted : user_pref("CT3298566.toolbarCurrentServerTime", "30-1-2014"); Line Deleted : user_pref("CT3298566.toolbarDisabled", "true"); Line Deleted : user_pref("CT3298566.toolbarLoginClientTime", "Tue Jun 25 2013 21:00:21 GMT-0400 (Eastern Standard Time)"); Line Deleted : user_pref("CT3298566.versionFromInstaller", "10.16.4.711"); Line Deleted : user_pref("CT3298566_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1391037103407,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]"); Line Deleted : user_pref("aol_toolbar.default.homepage.check", false); Line Deleted : user_pref("aol_toolbar.default.search.check", false); Line Deleted : user_pref("extensions.gencrawler@some.com.install-event-fired", true); Line Deleted : user_pref("extentions.y2layers.defaultEnableAppsList", "bestvideodownloader,ezLooker,pagerage,buzzdock,toprelatedtopics,twittube"); Line Deleted : user_pref("extentions.y2layers.installId", "bfa2b7eb-f038-40d4-82ad-d0e19100fae3"); Line Deleted : user_pref("valueApps.CT3298566.mam_gk_currentVersion", "312E31322E302E35"); Line Deleted : user_pref("valueApps.CT3298566.mam_gk_currentVersion.storedInFile", false); Line Deleted : user_pref("valueApps.CT3298566.mam_gk_migrated_from_ls", "31"); Line Deleted : user_pref("valueApps.CT3298566.mam_gk_migrated_from_ls.storedInFile", false); -\\ Google Chrome v35.0.1916.153 [ File : C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\preferences ] Deleted [Extension] : dednnpigldgdbpgcdpfppmlcnnbjciel Deleted [Extension] : fdkednngfjmpnljkolbapdednncafhen Deleted [Extension] : gelpfbcidpeeelkmkjbofkcpihkcachn Deleted [Extension] : ippkomaaonokjnfjoikaemidanojkfmm Deleted [Extension] : klibnahbojhkanfgaglnlalfkgpcppfi Deleted [Extension] : niapdbllcanepiiimjjndipklodoedlc ************************* AdwCleaner[R0].txt - [15709 octets] - [27/06/2014 14:02:03] AdwCleaner[s0].txt - [15929 octets] - [27/06/2014 14:11:54] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [15990 octets] ########## Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 6/27/2014 Scan Time: 2:20:03 PM Logfile: Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.06.27.07 Rootkit Database: v2014.06.23.02 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Lolo Scan Type: Threat Scan Result: Completed Objects Scanned: 291788 Time Elapsed: 23 min, 45 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) Threats from ESET C:\$Recycle.Bin\S-1-5-21-3378580329-3139310990-1513726972-1001\$RWDBM8Y.exe a variant of Win32/Hao123.A potentially unwanted application C:\Users\Lolo\Downloads\cbsidlm-tr1_13-Dirty_Split-ORG-10858933.exe Win32/DownloadAdmin.G potentially unwanted application C:\Users\Lolo\Downloads\FLV_installer.exe a variant of Win32/SquareNet.A potentially unwanted application C:\Users\Lolo\Downloads\FoxitReader605.0618_enu_Setup.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-06-2014 Ran by Lolo (administrator) on LOLO-PC on 27-06-2014 17:08:05 Running from C:\Users\Lolo\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Lenovo) C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe (Microsoft Corporation) C:\Windows\vVX3000.exe (CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Spotify Ltd) C:\Users\Lolo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Google Inc.) C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\MusicManager.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Lenovo) C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe (Lenovo) C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Dropbox, Inc.) C:\Users\Lolo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe () C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Sun Microsystems, Inc.) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe () C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeySupport.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe (Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE (Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Google Inc.) C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbarUser_32.exe (Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_clipbook.exe () C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunes.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceHelper.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Apple Application Support\distnoted.exe (Farbar) C:\Users\Lolo\Downloads\FRST64(1).exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-26] (Realtek Semiconductor) HKLM\...\Run: [intelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-15] (Intel® Corporation) HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2771240 2011-04-21] (Synaptics Incorporated) HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2014-05-31] (Lenovo) HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2012-01-03] (Lenovo) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9745312 2012-01-03] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5374880 2012-01-03] (Lenovo(beijing) Limited) HKLM\...\Run: [VX3000] => C:\windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [MuteSync] => C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe [336384 2009-12-28] (Lenovo) HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2010-12-04] (CyberLink) HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [224352 2010-12-04] (CyberLink Corp.) HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-01-03] (Lenovo) HKLM-x32\...\Run: [updateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.) HKLM-x32\...\Run: [updatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.) HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] () HKLM-x32\...\Run: [ROC_ROC_NT] => "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [avast] => C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software) HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.) HKLM-x32\...\Run: [sDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-01-03] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [spotify Web Helper] => C:\Users\Lolo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [Google Update] => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-21] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [MusicManager] => C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7631872 2014-04-23] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [GoogleChromeAutoLaunch_A9AECA91371A37F0FDB4C908F31716C4] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [sUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6564120 2014-06-04] (SUPERAntiSpyware) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\RunOnce: [FlashPlayerUpdate] - C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_13_0_0_214_Plugin.exe [847536 2014-05-13] (Adobe Systems Incorporated) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\MountPoints2: {966558a8-3674-11e1-9f4b-806e6f6e6963} - I:\Start.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Lolo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe () ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: GDriveBlacklistedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedEditOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedViewOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSyncedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSyncingOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: VeriFace Enc -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll () ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ SearchScopes: HKLM-x32 - DefaultScope value is missing. BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc) BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 10.0.1.1 Tcpip\..\Interfaces\{0C1C8453-36F5-450F-AAD8-DDAD2D50C2B8}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{3972253B-B859-4651-BA6E-948C826CD575}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{746F43E9-4DE2-4D4B-B00B-BF43A7383BD5}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{D3A96F26-BF9E-4818-AD4C-F4359FAB3A49}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92}: [NameServer]208.67.220.220,4.2.2.1,10.0.1.1 FireFox: ======== FF ProfilePath: C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", ""); FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", ""); FF SelectedSearchEngine: Google FF Homepage: https://www.google.com/ FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw.dll No File FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @doubletwist.com/NPPodcast - C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Lolo\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Lolo\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Extension: Bitdefender QuickScan - C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-06-22] FF Extension: Adblock Plus - C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-21] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-02-05] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-07-03] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-27] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-02-05] Chrome: ======= CHR HomePage: CHR StartupUrls: "https://www.google.com/" CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Java Platform SE 6 U32) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Java Deployment Toolkit 6.0.320.5) - C:\windows\SysWOW64\npdeployJava1.dll (Oracle Corporation) CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave for Director) - C:\windows\system32\Adobe\Director\np32dsw.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (Duolingo) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiahmijlpehemcpleichkcokhegllfjl [2013-08-09] CHR Extension: (Missing e) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjbagclppcgdbpobcpoojdjdmcjhpid [2014-02-02] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24] CHR Extension: (Google Wallet) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21] CHR Extension: (Youtube Video Downloader) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\obmbipnhbnpicpechoajlkjfdiopnoki [2013-04-17] CHR Extension: (Tumblr Savior) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\oefddkjnflmjbclpnnoegglmmdfkidip [2014-02-02] CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12] ==================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-10] (SUPERAntiSpyware.com) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software) R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [953632 2010-12-14] (Broadcom Corporation.) R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-15] () R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-04] (Hewlett-Packard) [File not signed] R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-04] (Hewlett-Packard) [File not signed] R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [36256 2009-11-14] (Google Inc) R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software) R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] () R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software) R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] () R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-27] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8200552 2010-09-27] (Realtek Semiconductor Corp.) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.) U3 BcmSqlStartupSvc; U2 CLKMSVC10_3A60B698; U2 CLKMSVC10_C3B3B687; U2 DriverService; U2 IAStorDataMgrSvc; U2 iATAgentService; U2 idealife Update Service; U3 IGRS; S2 iPodDrv; \??\C:\windows\system32\drivers\iPodDrv.sys [X] U2 IviRegMgr; U2 nvUpdatusService; U2 Oasis2Service; U2 PCCarerService; U2 ReadyComm.DirectRouter; U2 RichVideo; U2 RtLedService; U2 SoftwareService; U3 SQLWriter; U2 Stereo Service; U2 TMAgent; ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-27 17:05 - 2014-06-27 17:05 - 02083328 _____ (Farbar) C:\Users\Lolo\Downloads\FRST64(1).exe 2014-06-27 17:05 - 2014-06-27 17:05 - 00000490 _____ () C:\Users\Lolo\Desktop\found.txt 2014-06-27 15:15 - 2014-06-27 15:15 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-06-27 14:55 - 2014-06-27 14:55 - 00000000 __SHD () C:\Users\Lolo\AppData\Local\EmieUserList 2014-06-27 14:55 - 2014-06-27 14:55 - 00000000 __SHD () C:\Users\Lolo\AppData\Local\EmieSiteList 2014-06-27 14:02 - 2010-08-30 08:34 - 00506880 _____ () C:\windows\SysWOW64\sqlite3.dll 2014-06-27 14:01 - 2014-06-27 14:12 - 00000000 ____D () C:\AdwCleaner 2014-06-27 14:00 - 2014-06-27 14:00 - 01342659 _____ () C:\Users\Lolo\Downloads\AdwCleaner.exe 2014-06-27 13:58 - 2014-06-27 13:59 - 00012929 _____ () C:\Users\Lolo\Desktop\JRT.txt 2014-06-27 13:33 - 2014-06-27 13:33 - 00000000 ____D () C:\windows\ERUNT 2014-06-27 13:31 - 2014-06-27 13:31 - 01016261 _____ (Thisisu) C:\Users\Lolo\Downloads\JRT.exe 2014-06-26 11:15 - 2014-06-26 11:15 - 00000000 ____D () C:\ProgramData\RogueKiller 2014-06-26 10:54 - 2014-06-26 10:54 - 05283416 _____ () C:\Users\Lolo\Downloads\RogueKillerX64.exe 2014-06-26 10:25 - 2014-06-26 10:25 - 00000000 ____D () C:\windows\ERDNT 2014-06-26 10:24 - 2014-06-26 10:25 - 00000000 ____D () C:\Program Files (x86)\ERUNT 2014-06-26 10:24 - 2014-06-26 10:24 - 00000869 _____ () C:\Users\Lolo\Desktop\ERUNT.lnk 2014-06-26 10:24 - 2014-06-26 10:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT 2014-06-26 10:23 - 2014-06-26 10:23 - 00791393 _____ (Lars Hederer ) C:\Users\Lolo\Downloads\erunt-setup.exe 2014-06-26 10:13 - 2014-06-26 10:27 - 00002040 _____ () C:\Users\Lolo\Desktop\Rkill.txt 2014-06-26 10:13 - 2014-06-26 10:13 - 01062136 _____ (Bleeping Computer, LLC) C:\Users\Lolo\Desktop\rkill64.exe 2014-06-26 10:02 - 2014-06-26 10:04 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\Lolo\Downloads\rkill.exe 2014-06-22 15:35 - 2014-06-22 15:35 - 00039847 _____ () C:\Users\Lolo\Downloads\Addition.txt 2014-06-22 15:34 - 2014-06-27 17:08 - 00031092 _____ () C:\Users\Lolo\Downloads\FRST.txt 2014-06-22 15:33 - 2014-06-27 17:08 - 00000000 ____D () C:\FRST 2014-06-22 15:29 - 2014-06-22 15:30 - 02083328 _____ (Farbar) C:\Users\Lolo\Downloads\FRST64.exe 2014-06-22 13:45 - 2014-06-22 13:45 - 00000000 ____D () C:\SUPERDelete 2014-06-22 13:20 - 2014-06-22 13:20 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-06-22 13:18 - 2014-06-22 13:19 - 19776448 _____ (SUPERAntiSpyware) C:\Users\Lolo\Downloads\SUPERAntiSpyware.exe 2014-06-22 13:16 - 2014-06-22 13:17 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\QuickScan 2014-06-22 11:14 - 2014-06-27 14:49 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-22 11:13 - 2014-06-22 11:13 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-22 11:13 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-22 11:11 - 2014-06-22 11:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lolo\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-16 20:04 - 2014-06-16 20:04 - 00354032 _____ () C:\windows\Minidump\061614-46004-01.dmp 2014-06-16 18:44 - 2014-06-16 18:44 - 00354032 _____ () C:\windows\Minidump\061614-35802-01.dmp 2014-06-16 15:40 - 2014-06-16 15:41 - 00354032 _____ () C:\windows\Minidump\061614-35895-01.dmp 2014-06-15 19:35 - 2014-06-15 19:35 - 00354032 _____ () C:\windows\Minidump\061514-25724-01.dmp 2014-06-14 22:02 - 2014-06-14 22:02 - 00354032 _____ () C:\windows\Minidump\061414-28345-01.dmp 2014-06-11 14:24 - 2014-04-24 22:34 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll 2014-06-11 14:24 - 2014-04-24 22:06 - 00626688 _____ (Microsoft Corporation) C:\windows\SysWOW64\usp10.dll 2014-06-11 14:23 - 2014-05-30 06:21 - 23414784 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-06-11 14:23 - 2014-05-30 06:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-06-11 14:23 - 2014-05-30 06:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-06-11 14:23 - 2014-05-30 05:45 - 02768384 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-06-11 14:23 - 2014-05-30 05:39 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-06-11 14:23 - 2014-05-30 05:39 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-06-11 14:23 - 2014-05-30 05:38 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-06-11 14:23 - 2014-05-30 05:28 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-06-11 14:23 - 2014-05-30 05:27 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-06-11 14:23 - 2014-05-30 05:24 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-06-11 14:23 - 2014-05-30 05:21 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-06-11 14:23 - 2014-05-30 05:21 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-06-11 14:23 - 2014-05-30 05:20 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-06-11 14:23 - 2014-05-30 05:18 - 17271296 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2014-06-11 14:23 - 2014-05-30 05:11 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-06-11 14:23 - 2014-05-30 05:08 - 05782528 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-06-11 14:23 - 2014-05-30 05:06 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-06-11 14:23 - 2014-05-30 05:02 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2014-06-11 14:23 - 2014-05-30 04:55 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-06-11 14:23 - 2014-05-30 04:49 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-06-11 14:23 - 2014-05-30 04:46 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-06-11 14:23 - 2014-05-30 04:44 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll 2014-06-11 14:23 - 2014-05-30 04:44 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-06-11 14:23 - 2014-05-30 04:43 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2014-06-11 14:23 - 2014-05-30 04:42 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll 2014-06-11 14:23 - 2014-05-30 04:38 - 02179072 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2014-06-11 14:23 - 2014-05-30 04:35 - 00608768 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-06-11 14:23 - 2014-05-30 04:34 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2014-06-11 14:23 - 2014-05-30 04:33 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2014-06-11 14:23 - 2014-05-30 04:30 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2014-06-11 14:23 - 2014-05-30 04:29 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-06-11 14:23 - 2014-05-30 04:28 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe 2014-06-11 14:23 - 2014-05-30 04:27 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll 2014-06-11 14:23 - 2014-05-30 04:24 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-06-11 14:23 - 2014-05-30 04:23 - 02040832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-06-11 14:23 - 2014-05-30 04:16 - 00368128 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll 2014-06-11 14:23 - 2014-05-30 04:10 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-06-11 14:23 - 2014-05-30 04:06 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll 2014-06-11 14:23 - 2014-05-30 04:04 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll 2014-06-11 14:23 - 2014-05-30 04:02 - 00242688 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll 2014-06-11 14:23 - 2014-05-30 03:56 - 04244992 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2014-06-11 14:23 - 2014-05-30 03:56 - 02266112 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-06-11 14:23 - 2014-05-30 03:54 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2014-06-11 14:23 - 2014-05-30 03:50 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll 2014-06-11 14:23 - 2014-05-30 03:49 - 01964544 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl 2014-06-11 14:23 - 2014-05-30 03:43 - 13522944 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-06-11 14:23 - 2014-05-30 03:40 - 11725312 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2014-06-11 14:23 - 2014-05-30 03:30 - 01398272 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-06-11 14:23 - 2014-05-30 03:21 - 01790976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2014-06-11 14:23 - 2014-05-30 03:15 - 01143296 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2014-06-11 14:23 - 2014-05-30 03:13 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-06-11 14:23 - 2014-05-30 03:13 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll 2014-06-11 14:23 - 2014-04-04 22:47 - 01903552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys 2014-06-11 14:23 - 2014-04-04 22:47 - 00288192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS 2014-06-11 14:23 - 2014-03-26 10:44 - 02002432 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll 2014-06-11 14:23 - 2014-03-26 10:44 - 01882112 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll 2014-06-11 14:23 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll 2014-06-11 14:23 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll 2014-06-11 14:23 - 2014-03-26 10:27 - 01389056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll 2014-06-11 14:23 - 2014-03-26 10:27 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll 2014-06-11 14:23 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll 2014-06-11 14:23 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll 2014-06-11 14:22 - 2014-06-08 05:13 - 00506368 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-11 14:22 - 2014-06-08 05:08 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-09 21:29 - 2014-06-09 21:31 - 38157960 _____ (Amazon.com) C:\Users\Lolo\Downloads\KindleForPC-installer(1).exe 2014-06-08 11:01 - 2014-06-08 11:01 - 00354032 _____ () C:\windows\Minidump\060814-27346-01.dmp 2014-06-04 17:49 - 2014-06-04 17:49 - 00354032 _____ () C:\windows\Minidump\060414-32978-01.dmp 2014-06-01 14:21 - 2014-06-01 14:21 - 00354032 _____ () C:\windows\Minidump\060114-27331-01.dmp 2014-05-31 16:50 - 2014-05-31 16:50 - 13337712 _____ (Lenovo Group ) C:\Users\Lolo\Downloads\IN12STW96WW5.exe 2014-05-30 19:43 - 2014-06-16 20:04 - 522870382 _____ () C:\windows\MEMORY.DMP 2014-05-30 19:43 - 2014-05-30 19:43 - 00354032 _____ () C:\windows\Minidump\053014-28672-01.dmp 2014-05-30 18:07 - 2014-06-27 14:14 - 00003584 _____ () C:\windows\setupact.log 2014-05-30 18:07 - 2014-05-30 18:07 - 00000000 _____ () C:\windows\setuperr.log ==================== One Month Modified Files and Folders ======= 2014-06-27 17:08 - 2014-06-22 15:34 - 00031092 _____ () C:\Users\Lolo\Downloads\FRST.txt 2014-06-27 17:08 - 2014-06-22 15:33 - 00000000 ____D () C:\FRST 2014-06-27 17:05 - 2014-06-27 17:05 - 02083328 _____ (Farbar) C:\Users\Lolo\Downloads\FRST64(1).exe 2014-06-27 17:05 - 2014-06-27 17:05 - 00000490 _____ () C:\Users\Lolo\Desktop\found.txt 2014-06-27 17:04 - 2012-09-09 15:50 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Dropbox 2014-06-27 17:01 - 2012-09-20 13:24 - 00000254 _____ () C:\windows\Tasks\HP Photo Creations Messager.job 2014-06-27 16:56 - 2012-01-03 21:51 - 00000912 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-27 16:37 - 2013-02-21 09:25 - 00000904 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA.job 2014-06-27 16:23 - 2012-04-27 08:43 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-27 15:58 - 2012-01-03 21:27 - 01393697 _____ () C:\windows\WindowsUpdate.log 2014-06-27 15:15 - 2014-06-27 15:15 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-06-27 14:55 - 2014-06-27 14:55 - 00000000 __SHD () C:\Users\Lolo\AppData\Local\EmieUserList 2014-06-27 14:55 - 2014-06-27 14:55 - 00000000 __SHD () C:\Users\Lolo\AppData\Local\EmieSiteList 2014-06-27 14:55 - 2012-02-05 03:30 - 00000000 ____D () C:\Users\Lolo\AppData\Local\Google 2014-06-27 14:53 - 2014-05-18 18:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox 2014-06-27 14:49 - 2014-06-22 11:14 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-27 14:24 - 2009-07-14 00:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-27 14:24 - 2009-07-14 00:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-27 14:23 - 2009-07-14 01:13 - 00006486 _____ () C:\windows\system32\PerfStringBackup.INI 2014-06-27 14:16 - 2014-04-01 13:43 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\DropboxMaster 2014-06-27 14:16 - 2012-09-09 15:53 - 00000000 ___RD () C:\Users\Lolo\Dropbox 2014-06-27 14:16 - 2012-01-03 22:03 - 00000000 ____D () C:\ProgramData\VeriFace 2014-06-27 14:15 - 2013-06-27 18:01 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update 2014-06-27 14:15 - 2012-01-03 22:03 - 04939735 _____ () C:\FaceProv.log 2014-06-27 14:15 - 2012-01-03 21:56 - 00135705 _____ () C:\windows\system32\fastboot.set 2014-06-27 14:15 - 2012-01-03 21:51 - 00000908 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-27 14:14 - 2014-05-30 18:07 - 00003584 _____ () C:\windows\setupact.log 2014-06-27 14:14 - 2010-11-20 23:47 - 00845908 _____ () C:\windows\PFRO.log 2014-06-27 14:14 - 2009-07-14 01:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-27 14:12 - 2014-06-27 14:01 - 00000000 ____D () C:\AdwCleaner 2014-06-27 14:00 - 2014-06-27 14:00 - 01342659 _____ () C:\Users\Lolo\Downloads\AdwCleaner.exe 2014-06-27 13:59 - 2014-06-27 13:58 - 00012929 _____ () C:\Users\Lolo\Desktop\JRT.txt 2014-06-27 13:33 - 2014-06-27 13:33 - 00000000 ____D () C:\windows\ERUNT 2014-06-27 13:31 - 2014-06-27 13:31 - 01016261 _____ (Thisisu) C:\Users\Lolo\Downloads\JRT.exe 2014-06-26 20:03 - 2013-05-28 14:42 - 00000000 ____D () C:\Users\Lolo\AppData\Local\CrashDumps 2014-06-26 11:15 - 2014-06-26 11:15 - 00000000 ____D () C:\ProgramData\RogueKiller 2014-06-26 10:54 - 2014-06-26 10:54 - 05283416 _____ () C:\Users\Lolo\Downloads\RogueKillerX64.exe 2014-06-26 10:51 - 2012-01-03 21:51 - 00003908 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-06-26 10:51 - 2012-01-03 21:51 - 00003656 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-06-26 10:37 - 2013-02-21 09:25 - 00000852 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core.job 2014-06-26 10:32 - 2013-02-21 09:25 - 00003872 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA 2014-06-26 10:32 - 2013-02-21 09:25 - 00003476 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core 2014-06-26 10:27 - 2014-06-26 10:13 - 00002040 _____ () C:\Users\Lolo\Desktop\Rkill.txt 2014-06-26 10:25 - 2014-06-26 10:25 - 00000000 ____D () C:\windows\ERDNT 2014-06-26 10:25 - 2014-06-26 10:24 - 00000000 ____D () C:\Program Files (x86)\ERUNT 2014-06-26 10:24 - 2014-06-26 10:24 - 00000869 _____ () C:\Users\Lolo\Desktop\ERUNT.lnk 2014-06-26 10:24 - 2014-06-26 10:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT 2014-06-26 10:23 - 2014-06-26 10:23 - 00791393 _____ (Lars Hederer ) C:\Users\Lolo\Downloads\erunt-setup.exe 2014-06-26 10:13 - 2014-06-26 10:13 - 01062136 _____ (Bleeping Computer, LLC) C:\Users\Lolo\Desktop\rkill64.exe 2014-06-26 10:04 - 2014-06-26 10:02 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\Lolo\Downloads\rkill.exe 2014-06-22 15:35 - 2014-06-22 15:35 - 00039847 _____ () C:\Users\Lolo\Downloads\Addition.txt 2014-06-22 15:30 - 2014-06-22 15:29 - 02083328 _____ (Farbar) C:\Users\Lolo\Downloads\FRST64.exe 2014-06-22 14:47 - 2012-02-05 03:25 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo 2014-06-22 14:47 - 2011-09-28 23:37 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-06-22 14:47 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\registration 2014-06-22 13:52 - 2013-06-27 18:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2014-06-22 13:45 - 2014-06-22 13:45 - 00000000 ____D () C:\SUPERDelete 2014-06-22 13:20 - 2014-06-22 13:20 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-06-22 13:19 - 2014-06-22 13:18 - 19776448 _____ (SUPERAntiSpyware) C:\Users\Lolo\Downloads\SUPERAntiSpyware.exe 2014-06-22 13:17 - 2014-06-22 13:16 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\QuickScan 2014-06-22 11:13 - 2014-06-22 11:13 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2012-02-05 03:48 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Malwarebytes 2014-06-22 11:13 - 2012-02-05 03:48 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-22 11:12 - 2014-06-22 11:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lolo\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-22 10:49 - 2012-02-05 03:25 - 00000000 ____D () C:\Users\Lolo 2014-06-21 20:51 - 2012-07-02 16:42 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Spotify 2014-06-16 23:09 - 2012-02-05 04:02 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SoftGrid Client 2014-06-16 21:58 - 2012-07-02 16:42 - 00000000 ____D () C:\Users\Lolo\AppData\Local\Spotify 2014-06-16 20:04 - 2014-06-16 20:04 - 00354032 _____ () C:\windows\Minidump\061614-46004-01.dmp 2014-06-16 20:04 - 2014-05-30 19:43 - 522870382 _____ () C:\windows\MEMORY.DMP 2014-06-16 20:04 - 2012-02-09 01:32 - 00000000 ____D () C:\windows\Minidump 2014-06-16 18:44 - 2014-06-16 18:44 - 00354032 _____ () C:\windows\Minidump\061614-35802-01.dmp 2014-06-16 15:41 - 2014-06-16 15:40 - 00354032 _____ () C:\windows\Minidump\061614-35895-01.dmp 2014-06-15 19:35 - 2014-06-15 19:35 - 00354032 _____ () C:\windows\Minidump\061514-25724-01.dmp 2014-06-15 15:13 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\rescache 2014-06-14 23:16 - 2013-08-02 14:45 - 00000000 ____D () C:\windows\system32\MRT 2014-06-14 23:13 - 2013-05-17 23:23 - 95414520 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-06-14 23:10 - 2014-05-04 19:57 - 00000000 ___SD () C:\windows\system32\CompatTel 2014-06-14 22:02 - 2014-06-14 22:02 - 00354032 _____ () C:\windows\Minidump\061414-28345-01.dmp 2014-06-09 21:31 - 2014-06-09 21:29 - 38157960 _____ (Amazon.com) C:\Users\Lolo\Downloads\KindleForPC-installer(1).exe 2014-06-08 11:01 - 2014-06-08 11:01 - 00354032 _____ () C:\windows\Minidump\060814-27346-01.dmp 2014-06-08 05:13 - 2014-06-11 14:22 - 00506368 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-08 05:08 - 2014-06-11 14:22 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-04 17:49 - 2014-06-04 17:49 - 00354032 _____ () C:\windows\Minidump\060414-32978-01.dmp 2014-06-01 14:21 - 2014-06-01 14:21 - 00354032 _____ () C:\windows\Minidump\060114-27331-01.dmp 2014-06-01 11:45 - 2014-02-01 13:20 - 00000000 ____D () C:\Users\Lolo\Documents\women's health 2014-06-01 11:45 - 2012-04-02 13:14 - 00000000 ____D () C:\Users\Lolo\Documents\lab report 2014-06-01 11:31 - 2012-02-05 16:45 - 00000000 ____D () C:\Users\Lolo\Documents\My Scans 2014-06-01 11:30 - 2014-02-15 18:48 - 00000000 ____D () C:\Users\Lolo\Documents\knitting 2014-06-01 11:24 - 2013-07-06 21:14 - 00000000 ____D () C:\Program Files (x86)\Dreamagination 2014-06-01 11:16 - 2012-09-11 22:23 - 00000000 ____D () C:\Program Files (x86)\ffdshow 2014-05-31 17:54 - 2012-02-12 12:35 - 18984590 _____ () C:\windows\system32\PsBoot.log 2014-05-31 17:54 - 2012-02-12 12:35 - 00561990 _____ () C:\windows\system32\defragLog.log 2014-05-31 17:42 - 2009-07-14 01:08 - 00032620 _____ () C:\windows\Tasks\SCHEDLGU.TXT 2014-05-31 16:50 - 2014-05-31 16:50 - 13337712 _____ (Lenovo Group ) C:\Users\Lolo\Downloads\IN12STW96WW5.exe 2014-05-31 16:50 - 2012-01-03 21:56 - 00203000 _____ () C:\windows\system32\LsDefrag.bmp 2014-05-31 16:50 - 2012-01-03 21:56 - 00057952 _____ (Lenovo) C:\windows\system32\Drivers\fbfmon.sys 2014-05-31 16:50 - 2012-01-03 21:56 - 00046176 _____ (Lenovo) C:\windows\system32\FbDefrag.exe 2014-05-31 16:50 - 2012-01-03 21:56 - 00015968 _____ (Lenovo) C:\windows\system32\NFbfmon.dll 2014-05-31 16:50 - 2012-01-03 21:56 - 00013408 _____ (Lenovo) C:\windows\system32\Drivers\BPntDrv.sys 2014-05-31 16:50 - 2012-01-03 21:56 - 00002047 _____ () C:\Users\Public\Desktop\Lenovo EE Boot Optimizer.lnk 2014-05-31 16:50 - 2012-01-03 21:56 - 00000064 _____ () C:\Lenovo EE Boot Optimizer.log 2014-05-30 19:43 - 2014-05-30 19:43 - 00354032 _____ () C:\windows\Minidump\053014-28672-01.dmp 2014-05-30 18:07 - 2014-05-30 18:07 - 00000000 _____ () C:\windows\setuperr.log 2014-05-30 06:21 - 2014-06-11 14:23 - 23414784 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-05-30 06:02 - 2014-06-11 14:23 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-05-30 06:02 - 2014-06-11 14:23 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-05-30 05:45 - 2014-06-11 14:23 - 02768384 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-05-30 05:39 - 2014-06-11 14:23 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-05-30 05:39 - 2014-06-11 14:23 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-05-30 05:38 - 2014-06-11 14:23 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-05-30 05:28 - 2014-06-11 14:23 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-05-30 05:27 - 2014-06-11 14:23 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-05-30 05:24 - 2014-06-11 14:23 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-05-30 05:21 - 2014-06-11 14:23 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-05-30 05:21 - 2014-06-11 14:23 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-05-30 05:20 - 2014-06-11 14:23 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-05-30 05:18 - 2014-06-11 14:23 - 17271296 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2014-05-30 05:11 - 2014-06-11 14:23 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-05-30 05:08 - 2014-06-11 14:23 - 05782528 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-05-30 05:06 - 2014-06-11 14:23 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-05-30 05:02 - 2014-06-11 14:23 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2014-05-30 04:55 - 2014-06-11 14:23 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-05-30 04:49 - 2014-06-11 14:23 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-05-30 04:46 - 2014-06-11 14:23 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-05-30 04:44 - 2014-06-11 14:23 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll 2014-05-30 04:44 - 2014-06-11 14:23 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-05-30 04:43 - 2014-06-11 14:23 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2014-05-30 04:42 - 2014-06-11 14:23 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll 2014-05-30 04:38 - 2014-06-11 14:23 - 02179072 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2014-05-30 04:35 - 2014-06-11 14:23 - 00608768 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-05-30 04:34 - 2014-06-11 14:23 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2014-05-30 04:33 - 2014-06-11 14:23 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2014-05-30 04:30 - 2014-06-11 14:23 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2014-05-30 04:29 - 2014-06-11 14:23 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-05-30 04:28 - 2014-06-11 14:23 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe 2014-05-30 04:27 - 2014-06-11 14:23 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll 2014-05-30 04:24 - 2014-06-11 14:23 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-05-30 04:23 - 2014-06-11 14:23 - 02040832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-05-30 04:16 - 2014-06-11 14:23 - 00368128 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll 2014-05-30 04:10 - 2014-06-11 14:23 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-05-30 04:06 - 2014-06-11 14:23 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll 2014-05-30 04:04 - 2014-06-11 14:23 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll 2014-05-30 04:02 - 2014-06-11 14:23 - 00242688 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll 2014-05-30 03:56 - 2014-06-11 14:23 - 04244992 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2014-05-30 03:56 - 2014-06-11 14:23 - 02266112 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-05-30 03:54 - 2014-06-11 14:23 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2014-05-30 03:50 - 2014-06-11 14:23 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll 2014-05-30 03:49 - 2014-06-11 14:23 - 01964544 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl 2014-05-30 03:43 - 2014-06-11 14:23 - 13522944 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-05-30 03:40 - 2014-06-11 14:23 - 11725312 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2014-05-30 03:30 - 2014-06-11 14:23 - 01398272 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-05-30 03:21 - 2014-06-11 14:23 - 01790976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2014-05-30 03:15 - 2014-06-11 14:23 - 01143296 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2014-05-30 03:13 - 2014-06-11 14:23 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-05-30 03:13 - 2014-06-11 14:23 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll Some content of TEMP: ==================== C:\Users\Lolo\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpl1sdgi.dll C:\Users\Lolo\AppData\Local\Temp\VP6Install.exe C:\Users\Lolo\AppData\Local\Temp\VP6VFW.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-21 20:04 ==================== End Of Log ============================
  11. lobro
    sorry i missed your reply and thanks for the fast reply. Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 6/26/2014 Scan Time: 10:33:49 AM Logfile: Administrator: Yes Version: 2.00.2.1012 Malware Database: v2014.06.26.05 Rootkit Database: v2014.06.23.02 License: Trial Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Disabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Lolo Scan Type: Threat Scan Result: Completed Objects Scanned: 291128 Time Elapsed: 25 min, 35 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end) RogueKiller V9.1.0.0 (x64) [Jun 23 2014] by Adlice Software mail : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Lolo [Admin rights] Mode : Scan -- Date : 06/26/2014 11:46:08 ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 16 ¤¤¤ [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters | DhcpNameServer : 10.0.1.1 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters | DhcpNameServer : 10.0.1.1 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters | DhcpNameServer : 10.0.1.1 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3972253B-B859-4651-BA6E-948C826CD575} | DhcpNameServer : 167.206.13.180 167.206.13.181 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92} | NameServer : 208.67.220.220,4.2.2.1,10.0.1.1 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92} | DhcpNameServer : 10.0.1.1 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{3972253B-B859-4651-BA6E-948C826CD575} | DhcpNameServer : 167.206.13.180 167.206.13.181 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92} | NameServer : 208.67.220.220,4.2.2.1,10.0.1.1 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Tcpip\Parameters\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92} | DhcpNameServer : 10.0.1.1 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{3972253B-B859-4651-BA6E-948C826CD575} | DhcpNameServer : 167.206.13.180 167.206.13.181 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92} | NameServer : 208.67.220.220,4.2.2.1,10.0.1.1 -> FOUND [PUM.Dns] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Tcpip\Parameters\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92} | DhcpNameServer : 10.0.1.1 -> FOUND [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND [PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> FOUND [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND [PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> FOUND ¤¤¤ Scheduled tasks : 2 ¤¤¤ [suspicious.Path] \\{D96445C1-F043-4CFF-9049-30FA31A34BD3} -- C:\windows\system32\pcalua.exe (-a C:\Users\Lolo\Desktop\pdfprinter2009.exe -d C:\Users\Lolo\Desktop) -> FOUND [suspicious.Path] \\{E11F937B-81B2-4E90-81C2-7054503D80C4} -- C:\windows\system32\pcalua.exe (-a C:\Users\Lolo\Downloads\Sims3_1.19.44.010017_from_1.18.9.009017.exe -d C:\Users\Lolo\Downloads) -> FOUND ¤¤¤ Files : 0 ¤¤¤ ¤¤¤ HOSTS File : 0 ¤¤¤ ¤¤¤ Antirootkit : 18 ¤¤¤ [EAT:Addr] (explorer.exe) wbemprox.dll - BeginFileMapEnumeration : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04cc0 [EAT:Addr] (explorer.exe) wbemprox.dll - CloseFileMapEnumeration : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04dd8 [EAT:Addr] (explorer.exe) wbemprox.dll - GetNextFileMapContent : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04d1c [EAT:Addr] (explorer.exe) wbemprox.dll - SRSetRestorePointA : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04e3c [EAT:Addr] (explorer.exe) wbemprox.dll - SRSetRestorePointW : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04ecc [EAT:Addr] (explorer.exe) wbemprox.dll - SfcClose : C:\windows\system32\sfc_os.DLL @ 0x7fef4e0331c [EAT:Addr] (explorer.exe) wbemprox.dll - SfcConnectToServer : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04f5c [EAT:Addr] (explorer.exe) wbemprox.dll - SfcFileException : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04f5c [EAT:Addr] (explorer.exe) wbemprox.dll - SfcGetNextProtectedFile : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04c40 [EAT:Addr] (explorer.exe) wbemprox.dll - SfcInitProt : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04e08 [EAT:Addr] (explorer.exe) wbemprox.dll - SfcInitiateScan : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04f5c [EAT:Addr] (explorer.exe) wbemprox.dll - SfcInstallProtectedFiles : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04f5c [EAT:Addr] (explorer.exe) wbemprox.dll - SfcIsFileProtected : C:\windows\system32\sfc_os.DLL @ 0x7fef4e016f0 [EAT:Addr] (explorer.exe) wbemprox.dll - SfcIsKeyProtected : C:\windows\system32\sfc_os.DLL @ 0x7fef4e01110 [EAT:Addr] (explorer.exe) wbemprox.dll - SfcTerminateWatcherThread : C:\windows\system32\sfc_os.DLL @ 0x7fef4e0331c [EAT:Addr] (explorer.exe) wbemprox.dll - SfpDeleteCatalog : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04e08 [EAT:Addr] (explorer.exe) wbemprox.dll - SfpInstallCatalog : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04e08 [EAT:Addr] (explorer.exe) wbemprox.dll - SfpVerifyFile : C:\windows\system32\sfc_os.DLL @ 0x7fef4e04e20 ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ MBR Check : ¤¤¤ +++++ PhysicalDrive0: ST9500325AS +++++ --- User --- [MBR] eb90fa5f4c6dd9633a078519c52ab7d4 [bSP] 7ce8c07bfa428a01f11310e08c53184a : Windows Vista/7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 200 MB 1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 411648 | Size: 430420 MB 2 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 881911808 | Size: 31210 MB 3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 945829888 | Size: 15109 MB User = LL1 ... OK User = LL2 ... OK
  12. lobro
    Hello, Some process is inserting qqqqqqqqqqqqqqqqqq's when i type unless i press the actual letter q, in which case i can't get q to appear at all. There are also sometimes random "ding" sounds. Not sure if this is related but i also get a message that says something like "dnssd.dll missing from the computer" on startup and my mouse won't move until i hit "ok". i have tried running multiple scans with this, superspyware and avast in and out of safe modeqq. They all discover something but leave the problem behind. Thank you in advance for your help, Lo Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-06-2014 01 Ran by Lolo (administrator) on LOLO-PC on 22-06-2014 15:34:02 Running from C:\Users\Lolo\Downloads Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Safe Mode (with Networking) The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCore64.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-26] (Realtek Semiconductor) HKLM\...\Run: [intelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-09-15] (Intel® Corporation) HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2771240 2011-04-21] (Synaptics Incorporated) HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2014-05-31] (Lenovo) HKLM\...\Run: [OnekeyStudio] => C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe [789920 2012-01-03] (Lenovo) HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9745312 2012-01-03] (Lenovo (Beijing) Limited) HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5374880 2012-01-03] (Lenovo(beijing) Limited) HKLM\...\Run: [VX3000] => C:\windows\vVX3000.exe [762736 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [MuteSync] => C:\Program Files (x86)\Lenovo\Lenovo MuteSync\MuteSync.exe [336384 2009-12-28] (Lenovo) HKLM-x32\...\Run: [YouCam Mirage] => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [136488 2010-12-04] (CyberLink) HKLM-x32\...\Run: [YouCam Tray] => C:\Program Files (x86)\Lenovo\YouCam\YouCam.exe [224352 2010-12-04] (CyberLink Corp.) HKLM-x32\...\Run: [VeriFaceManager] => C:\Program Files (x86)\Lenovo\VeriFace\PManage.exe [329056 2012-01-03] (Lenovo) HKLM-x32\...\Run: [updateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.) HKLM-x32\...\Run: [updatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.) HKLM-x32\...\Run: [hpqSRMon] => C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [946352 2012-12-03] (Adobe Systems Incorporated) HKLM-x32\...\Run: [LifeCam] => C:\Program Files (x86)\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation) HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] () HKLM-x32\...\Run: [ROC_ROC_NT] => "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_NT.exe" / /PROMPT /CMPID=ROC_NT HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard) HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152544 2012-12-12] (Apple Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.) HKLM-x32\...\Run: [avast] => C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-05-09] (AVAST Software) HKLM-x32\...\Run: [AirPort Base Station Agent] => C:\Program Files (x86)\AirPort\APAgent.exe [771360 2009-11-11] (Apple Inc.) HKLM-x32\...\Run: [sDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.) Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation) Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X] HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2012-01-03] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [spotify Web Helper] => C:\Users\Lolo\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1176632 2014-05-15] (Spotify Ltd) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [Google Update] => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-21] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [MusicManager] => C:\Users\Lolo\AppData\Local\Programs\Google\MusicManager\MusicManager.exe [7631872 2014-04-23] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [GoogleChromeAutoLaunch_A9AECA91371A37F0FDB4C908F31716C4] => C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\Run: [sUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6564120 2014-06-04] (SUPERAntiSpyware) HKU\S-1-5-21-3378580329-3139310990-1513726972-1001\...\MountPoints2: {966558a8-3674-11e1-9f4b-806e6f6e6963} - I:\Start.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Lolo\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) Startup: C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PdaNet Desktop.lnk ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe () ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: DropboxExt4 -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers: GDriveBlacklistedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedEditOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSharedViewOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSyncedOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: GDriveSyncingOverlay -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll (Google) ShellIconOverlayIdentifiers: VeriFace Enc -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll () ShellIconOverlayIdentifiers-x32: DropboxExt1 -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt2 -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => No File ShellIconOverlayIdentifiers-x32: DropboxExt3 -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => No File BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENN&bmod=LENN HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/ URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.) SearchScopes: HKLM-x32 - DefaultScope {4F183FC7-D685-477F-B7BA-2245F2F4FC16} URL = SearchScopes: HKLM-x32 - {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={searchTerms}&s_it=webpickaol-ie&s_qt=sb&tb_uuid=0255E0BEF5CB45E28EAC277B9FF6C8AD&tb_oid=25-03-2013&tb_mrud=25-03-2013 SearchScopes: HKCU - DefaultScope {4F183FC7-D685-477F-B7BA-2245F2F4FC16} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298566&CUI=UN36472332023230919&UM=2 SearchScopes: HKCU - {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={searchTerms}&s_it=webpickaol-ie&s_qt=sb&tb_uuid=0255E0BEF5CB45E28EAC277B9FF6C8AD&tb_oid=25-03-2013&tb_mrud=25-03-2013 SearchScopes: HKCU - {4F183FC7-D685-477F-B7BA-2245F2F4FC16} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298566&CUI=UN36472332023230919&UM=2 BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO-x32: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.) BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC) BHO-x32: Yealt Class - {40C78C4E-5AE5-4762-9B7D-D2DE31B03B77} - C:\windows\SysWow64\yealt.dll (Yealt) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Evernote extension - {92EF2EAD-A7CE-4424-B0DB-499CF856608E} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc) BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.) Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKCU - No Name - {A13C2648-91D4-4BF3-BC6D-0079707C4389} - No File Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) Tcpip\Parameters: [DhcpNameServer] 10.0.1.1 Tcpip\..\Interfaces\{0C1C8453-36F5-450F-AAD8-DDAD2D50C2B8}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{3972253B-B859-4651-BA6E-948C826CD575}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{746F43E9-4DE2-4D4B-B00B-BF43A7383BD5}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{D3A96F26-BF9E-4818-AD4C-F4359FAB3A49}: [NameServer]208.67.220.220,4.2.2.1 Tcpip\..\Interfaces\{F6533B7D-BD59-4BBB-924C-3F7B4257FB92}: [NameServer]208.67.220.220,4.2.2.1,10.0.1.1 FireFox: ======== FF ProfilePath: C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", ""); FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", ""); FF SelectedSearchEngine: Google FF Homepage: https://www.google.com/ FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll () FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\system32\Adobe\Director\np32dsw.dll No File FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.) FF Plugin-x32: @java.com/DTPlugin,version=10.17.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @doubletwist.com/NPPodcast - C:\Program Files (x86)\Common Files\doubleTwist\NPPodcast.dll No File FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Lolo\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Lolo\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF user.js: detected! => C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\user.js FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.) FF Extension: Bitdefender QuickScan - C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\Extensions\{e001c731-5e37-4538-a5cb-8168736a2360} [2014-06-22] FF Extension: Adblock Plus - C:\Users\Lolo\AppData\Roaming\Mozilla\Firefox\Profiles\nbnlwtc6.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-05-21] FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-02-05] FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012-07-03] FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-06-27] FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-02-05] Chrome: ======= CHR StartupUrls: "https://www.google.com/" CHR Plugin: (Remoting Viewer) - internal-remoting-viewer CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll () CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll () CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\gcswf32.dll No File CHR Plugin: (Shockwave Flash) - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll No File CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.) CHR Plugin: (QuickTime Plug-in 7.6.6) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll (Apple Inc.) CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File CHR Plugin: (Java Platform SE 6 U32) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) CHR Plugin: (Java Deployment Toolkit 6.0.320.5) - C:\windows\SysWOW64\npdeployJava1.dll (Oracle Corporation) CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () CHR Plugin: (Shockwave for Director) - C:\windows\system32\Adobe\Director\np32dsw.dll No File CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File CHR Extension: (Duolingo) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\aiahmijlpehemcpleichkcokhegllfjl [2013-08-09] CHR Extension: (Missing e) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjbagclppcgdbpobcpoojdjdmcjhpid [2014-02-02] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24] CHR Extension: (Google Wallet) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21] CHR Extension: (Youtube Video Downloader) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\obmbipnhbnpicpechoajlkjfdiopnoki [2013-04-17] CHR Extension: (Tumblr Savior) - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\oefddkjnflmjbclpnnoegglmmdfkidip [2014-02-02] CHR HKCU\...\Chrome\Extension: [fdkednngfjmpnljkolbapdednncafhen] - C:\Users\Lolo\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx [2013-06-25] CHR HKCU\...\Chrome\Extension: [gelpfbcidpeeelkmkjbofkcpihkcachn] - C:\Users\Lolo\AppData\Local\Google\Chrome\User Data\Default\Extensions\yealt.crx [2013-04-10] CHR HKCU\...\Chrome\Extension: [klibnahbojhkanfgaglnlalfkgpcppfi] - C:\Users\Lolo\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx [2013-06-06] CHR HKLM-x32\...\Chrome\Extension: [dednnpigldgdbpgcdpfppmlcnnbjciel] - C:\Users\Lolo\AppData\Roaming\Media Finder\Extensions\gencrawler_gc.crx [2013-06-06] CHR HKLM-x32\...\Chrome\Extension: [fdkednngfjmpnljkolbapdednncafhen] - C:\Users\Lolo\AppData\Local\CRE\fdkednngfjmpnljkolbapdednncafhen.crx [2013-06-25] CHR HKLM-x32\...\Chrome\Extension: [klibnahbojhkanfgaglnlalfkgpcppfi] - C:\Users\Lolo\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx [2013-06-06] CHR HKLM-x32\...\Chrome\Extension: [lpmkgpnbiojfaoklbkpfneikocaobfai] - C:\Users\Lolo\AppData\Roaming\Media Finder\Extensions\mf_plugin_gc.crx [2013-06-06] CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2011-12-12] ==================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-10] (SUPERAntiSpyware.com) S2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-05-09] (AVAST Software) S2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [953632 2010-12-14] (Broadcom Corporation.) S3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [249344 2009-09-20] (Hewlett-Packard Co.) [File not signed] S2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-09-20] (Hewlett-Packard Co.) [File not signed] S2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1037824 2009-09-20] (Hewlett-Packard Co.) [File not signed] S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-09-15] () S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2008-12-04] (Hewlett-Packard) [File not signed] S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2008-12-04] (Hewlett-Packard) [File not signed] S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [3921880 2013-10-15] (Safer-Networking Ltd.) S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1042272 2013-09-20] (Safer-Networking Ltd.) S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171416 2013-09-13] (Safer-Networking Ltd.) ==================== Drivers (Whitelisted) ==================== S3 androidusb; C:\Windows\System32\Drivers\androidusb.sys [36256 2009-11-14] (Google Inc) S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software) S2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software) S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] () S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-06-27] (AVAST Software) S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-06-27] (AVAST Software) S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software) S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-06-27] () S3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-22] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation) S3 rtsuvc; C:\Windows\System32\DRIVERS\rtsuvc.sys [8200552 2010-09-27] (Realtek Semiconductor Corp.) S1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) U3 BcmSqlStartupSvc; U2 CLKMSVC10_3A60B698; U2 CLKMSVC10_C3B3B687; U2 DriverService; U2 IAStorDataMgrSvc; U2 iATAgentService; U2 idealife Update Service; U3 IGRS; S2 iPodDrv; \??\C:\windows\system32\drivers\iPodDrv.sys [X] U2 IviRegMgr; U2 nvUpdatusService; U2 Oasis2Service; U2 PCCarerService; U2 ReadyComm.DirectRouter; U2 RichVideo; U2 RtLedService; U2 SoftwareService; U3 SQLWriter; U2 Stereo Service; U2 TMAgent; ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-22 15:34 - 2014-06-22 15:34 - 00028473 _____ () C:\Users\Lolo\Downloads\FRST.txt 2014-06-22 15:33 - 2014-06-22 15:34 - 00000000 ____D () C:\FRST 2014-06-22 15:29 - 2014-06-22 15:30 - 02083328 _____ (Farbar) C:\Users\Lolo\Downloads\FRST64.exe 2014-06-22 13:45 - 2014-06-22 13:45 - 00000000 ____D () C:\SUPERDelete 2014-06-22 13:20 - 2014-06-22 13:20 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-06-22 13:18 - 2014-06-22 13:19 - 19776448 _____ (SUPERAntiSpyware) C:\Users\Lolo\Downloads\SUPERAntiSpyware.exe 2014-06-22 13:16 - 2014-06-22 13:17 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\QuickScan 2014-06-22 11:14 - 2014-06-22 15:15 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-22 11:13 - 2014-06-22 11:13 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamchameleon.sys 2014-06-22 11:13 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mwac.sys 2014-06-22 11:11 - 2014-06-22 11:12 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lolo\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-16 20:04 - 2014-06-16 20:04 - 00354032 _____ () C:\windows\Minidump\061614-46004-01.dmp 2014-06-16 18:44 - 2014-06-16 18:44 - 00354032 _____ () C:\windows\Minidump\061614-35802-01.dmp 2014-06-16 15:40 - 2014-06-16 15:41 - 00354032 _____ () C:\windows\Minidump\061614-35895-01.dmp 2014-06-15 19:35 - 2014-06-15 19:35 - 00354032 _____ () C:\windows\Minidump\061514-25724-01.dmp 2014-06-14 22:02 - 2014-06-14 22:02 - 00354032 _____ () C:\windows\Minidump\061414-28345-01.dmp 2014-06-11 14:24 - 2014-04-24 22:34 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll 2014-06-11 14:24 - 2014-04-24 22:06 - 00626688 _____ (Microsoft Corporation) C:\windows\SysWOW64\usp10.dll 2014-06-11 14:23 - 2014-05-30 06:21 - 23414784 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-06-11 14:23 - 2014-05-30 06:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-06-11 14:23 - 2014-05-30 06:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-06-11 14:23 - 2014-05-30 05:45 - 02768384 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-06-11 14:23 - 2014-05-30 05:39 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-06-11 14:23 - 2014-05-30 05:39 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-06-11 14:23 - 2014-05-30 05:38 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-06-11 14:23 - 2014-05-30 05:28 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-06-11 14:23 - 2014-05-30 05:27 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-06-11 14:23 - 2014-05-30 05:24 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-06-11 14:23 - 2014-05-30 05:21 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-06-11 14:23 - 2014-05-30 05:21 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-06-11 14:23 - 2014-05-30 05:20 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-06-11 14:23 - 2014-05-30 05:18 - 17271296 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2014-06-11 14:23 - 2014-05-30 05:11 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-06-11 14:23 - 2014-05-30 05:08 - 05782528 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-06-11 14:23 - 2014-05-30 05:06 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-06-11 14:23 - 2014-05-30 05:02 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2014-06-11 14:23 - 2014-05-30 04:55 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-06-11 14:23 - 2014-05-30 04:49 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-06-11 14:23 - 2014-05-30 04:46 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-06-11 14:23 - 2014-05-30 04:44 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll 2014-06-11 14:23 - 2014-05-30 04:44 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-06-11 14:23 - 2014-05-30 04:43 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2014-06-11 14:23 - 2014-05-30 04:42 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll 2014-06-11 14:23 - 2014-05-30 04:38 - 02179072 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2014-06-11 14:23 - 2014-05-30 04:35 - 00608768 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-06-11 14:23 - 2014-05-30 04:34 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2014-06-11 14:23 - 2014-05-30 04:33 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2014-06-11 14:23 - 2014-05-30 04:30 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2014-06-11 14:23 - 2014-05-30 04:29 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-06-11 14:23 - 2014-05-30 04:28 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe 2014-06-11 14:23 - 2014-05-30 04:27 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll 2014-06-11 14:23 - 2014-05-30 04:24 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-06-11 14:23 - 2014-05-30 04:23 - 02040832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-06-11 14:23 - 2014-05-30 04:16 - 00368128 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll 2014-06-11 14:23 - 2014-05-30 04:10 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-06-11 14:23 - 2014-05-30 04:06 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll 2014-06-11 14:23 - 2014-05-30 04:04 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll 2014-06-11 14:23 - 2014-05-30 04:02 - 00242688 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll 2014-06-11 14:23 - 2014-05-30 03:56 - 04244992 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2014-06-11 14:23 - 2014-05-30 03:56 - 02266112 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-06-11 14:23 - 2014-05-30 03:54 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2014-06-11 14:23 - 2014-05-30 03:50 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll 2014-06-11 14:23 - 2014-05-30 03:49 - 01964544 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl 2014-06-11 14:23 - 2014-05-30 03:43 - 13522944 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-06-11 14:23 - 2014-05-30 03:40 - 11725312 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2014-06-11 14:23 - 2014-05-30 03:30 - 01398272 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-06-11 14:23 - 2014-05-30 03:21 - 01790976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2014-06-11 14:23 - 2014-05-30 03:15 - 01143296 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2014-06-11 14:23 - 2014-05-30 03:13 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-06-11 14:23 - 2014-05-30 03:13 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll 2014-06-11 14:23 - 2014-04-04 22:47 - 01903552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys 2014-06-11 14:23 - 2014-04-04 22:47 - 00288192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS 2014-06-11 14:23 - 2014-03-26 10:44 - 02002432 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll 2014-06-11 14:23 - 2014-03-26 10:44 - 01882112 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll 2014-06-11 14:23 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll 2014-06-11 14:23 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll 2014-06-11 14:23 - 2014-03-26 10:27 - 01389056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll 2014-06-11 14:23 - 2014-03-26 10:27 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll 2014-06-11 14:23 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll 2014-06-11 14:23 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll 2014-06-11 14:22 - 2014-06-08 05:13 - 00506368 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-11 14:22 - 2014-06-08 05:08 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-09 21:29 - 2014-06-09 21:31 - 38157960 _____ (Amazon.com) C:\Users\Lolo\Downloads\KindleForPC-installer(1).exe 2014-06-08 11:01 - 2014-06-08 11:01 - 00354032 _____ () C:\windows\Minidump\060814-27346-01.dmp 2014-06-04 17:49 - 2014-06-04 17:49 - 00354032 _____ () C:\windows\Minidump\060414-32978-01.dmp 2014-06-01 14:21 - 2014-06-01 14:21 - 00354032 _____ () C:\windows\Minidump\060114-27331-01.dmp 2014-05-31 16:50 - 2014-05-31 16:50 - 13337712 _____ (Lenovo Group ) C:\Users\Lolo\Downloads\IN12STW96WW5.exe 2014-05-30 19:43 - 2014-06-16 20:04 - 522870382 _____ () C:\windows\MEMORY.DMP 2014-05-30 19:43 - 2014-05-30 19:43 - 00354032 _____ () C:\windows\Minidump\053014-28672-01.dmp 2014-05-30 18:07 - 2014-06-22 15:00 - 00003360 _____ () C:\windows\setupact.log 2014-05-30 18:07 - 2014-05-30 18:07 - 00000000 _____ () C:\windows\setuperr.log ==================== One Month Modified Files and Folders ======= 2014-06-22 15:34 - 2014-06-22 15:34 - 00028473 _____ () C:\Users\Lolo\Downloads\FRST.txt 2014-06-22 15:34 - 2014-06-22 15:33 - 00000000 ____D () C:\FRST 2014-06-22 15:30 - 2014-06-22 15:29 - 02083328 _____ (Farbar) C:\Users\Lolo\Downloads\FRST64.exe 2014-06-22 15:15 - 2014-06-22 11:14 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys 2014-06-22 15:12 - 2009-07-14 01:13 - 00006486 _____ () C:\windows\system32\PerfStringBackup.INI 2014-06-22 15:07 - 2012-01-03 21:56 - 00133715 _____ () C:\windows\system32\fastboot.set 2014-06-22 15:03 - 2014-04-01 13:43 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\DropboxMaster 2014-06-22 15:03 - 2012-09-09 15:50 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Dropbox 2014-06-22 15:02 - 2013-06-27 18:01 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update 2014-06-22 15:02 - 2012-01-03 22:03 - 00000000 ____D () C:\ProgramData\VeriFace 2014-06-22 15:01 - 2012-09-20 13:24 - 00000254 _____ () C:\windows\Tasks\HP Photo Creations Messager.job 2014-06-22 15:01 - 2012-01-03 22:03 - 04930669 _____ () C:\FaceProv.log 2014-06-22 15:01 - 2012-01-03 21:51 - 00000908 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-22 15:00 - 2014-05-30 18:07 - 00003360 _____ () C:\windows\setupact.log 2014-06-22 15:00 - 2010-11-20 23:47 - 00845594 _____ () C:\windows\PFRO.log 2014-06-22 15:00 - 2009-07-14 01:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-22 14:59 - 2012-09-09 15:53 - 00000000 ___RD () C:\Users\Lolo\Dropbox 2014-06-22 14:59 - 2012-01-03 21:27 - 01315019 _____ () C:\windows\WindowsUpdate.log 2014-06-22 14:49 - 2012-01-03 21:51 - 00000912 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-22 14:47 - 2012-02-05 03:25 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Lenovo 2014-06-22 14:47 - 2011-09-28 23:37 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-06-22 14:47 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\registration 2014-06-22 14:29 - 2013-02-21 09:25 - 00000904 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA.job 2014-06-22 14:23 - 2012-04-27 08:43 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-22 13:52 - 2013-06-27 18:02 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive 2014-06-22 13:52 - 2009-07-14 00:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-22 13:52 - 2009-07-14 00:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-22 13:45 - 2014-06-22 13:45 - 00000000 ____D () C:\SUPERDelete 2014-06-22 13:20 - 2014-06-22 13:20 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Professional.lnk 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000508 _____ () C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SUPERAntiSpyware 2014-06-22 13:20 - 2014-06-22 13:20 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware 2014-06-22 13:19 - 2014-06-22 13:18 - 19776448 _____ (SUPERAntiSpyware) C:\Users\Lolo\Downloads\SUPERAntiSpyware.exe 2014-06-22 13:17 - 2014-06-22 13:16 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\QuickScan 2014-06-22 11:13 - 2014-06-22 11:13 - 00001066 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2014-06-22 11:13 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-06-22 11:13 - 2012-02-05 03:48 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Malwarebytes 2014-06-22 11:13 - 2012-02-05 03:48 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-06-22 11:12 - 2014-06-22 11:11 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Lolo\Downloads\mbam-setup-2.0.2.1012.exe 2014-06-22 10:49 - 2012-02-05 03:25 - 00000000 ____D () C:\Users\Lolo 2014-06-21 20:51 - 2012-07-02 16:42 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Spotify 2014-06-21 20:29 - 2013-02-21 09:25 - 00000852 _____ () C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core.job 2014-06-21 18:15 - 2013-05-28 14:42 - 00000000 ____D () C:\Users\Lolo\AppData\Local\CrashDumps 2014-06-16 23:09 - 2012-02-05 04:02 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\SoftGrid Client 2014-06-16 21:58 - 2012-07-02 16:42 - 00000000 ____D () C:\Users\Lolo\AppData\Local\Spotify 2014-06-16 20:04 - 2014-06-16 20:04 - 00354032 _____ () C:\windows\Minidump\061614-46004-01.dmp 2014-06-16 20:04 - 2014-05-30 19:43 - 522870382 _____ () C:\windows\MEMORY.DMP 2014-06-16 20:04 - 2012-02-09 01:32 - 00000000 ____D () C:\windows\Minidump 2014-06-16 18:44 - 2014-06-16 18:44 - 00354032 _____ () C:\windows\Minidump\061614-35802-01.dmp 2014-06-16 15:41 - 2014-06-16 15:40 - 00354032 _____ () C:\windows\Minidump\061614-35895-01.dmp 2014-06-15 19:35 - 2014-06-15 19:35 - 00354032 _____ () C:\windows\Minidump\061514-25724-01.dmp 2014-06-15 15:13 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\rescache 2014-06-14 23:16 - 2013-08-02 14:45 - 00000000 ____D () C:\windows\system32\MRT 2014-06-14 23:13 - 2013-05-17 23:23 - 95414520 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-06-14 23:10 - 2014-05-04 19:57 - 00000000 ___SD () C:\windows\system32\CompatTel 2014-06-14 22:02 - 2014-06-14 22:02 - 00354032 _____ () C:\windows\Minidump\061414-28345-01.dmp 2014-06-09 21:31 - 2014-06-09 21:29 - 38157960 _____ (Amazon.com) C:\Users\Lolo\Downloads\KindleForPC-installer(1).exe 2014-06-08 11:01 - 2014-06-08 11:01 - 00354032 _____ () C:\windows\Minidump\060814-27346-01.dmp 2014-06-08 05:13 - 2014-06-11 14:22 - 00506368 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-08 05:08 - 2014-06-11 14:22 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-04 17:49 - 2014-06-04 17:49 - 00354032 _____ () C:\windows\Minidump\060414-32978-01.dmp 2014-06-01 14:21 - 2014-06-01 14:21 - 00354032 _____ () C:\windows\Minidump\060114-27331-01.dmp 2014-06-01 11:45 - 2014-02-01 13:20 - 00000000 ____D () C:\Users\Lolo\Documents\women's health 2014-06-01 11:45 - 2012-04-02 13:14 - 00000000 ____D () C:\Users\Lolo\Documents\lab report 2014-06-01 11:31 - 2012-02-05 16:45 - 00000000 ____D () C:\Users\Lolo\Documents\My Scans 2014-06-01 11:30 - 2014-02-15 18:48 - 00000000 ____D () C:\Users\Lolo\Documents\knitting 2014-06-01 11:24 - 2013-07-06 21:14 - 00000000 ____D () C:\Program Files (x86)\Dreamagination 2014-06-01 11:16 - 2012-09-11 22:23 - 00000000 ____D () C:\Program Files (x86)\ffdshow 2014-05-31 17:54 - 2012-02-12 12:35 - 18984590 _____ () C:\windows\system32\PsBoot.log 2014-05-31 17:54 - 2012-02-12 12:35 - 00561990 _____ () C:\windows\system32\defragLog.log 2014-05-31 17:42 - 2009-07-14 01:08 - 00032620 _____ () C:\windows\Tasks\SCHEDLGU.TXT 2014-05-31 16:50 - 2014-05-31 16:50 - 13337712 _____ (Lenovo Group ) C:\Users\Lolo\Downloads\IN12STW96WW5.exe 2014-05-31 16:50 - 2012-01-03 21:56 - 00203000 _____ () C:\windows\system32\LsDefrag.bmp 2014-05-31 16:50 - 2012-01-03 21:56 - 00057952 _____ (Lenovo) C:\windows\system32\Drivers\fbfmon.sys 2014-05-31 16:50 - 2012-01-03 21:56 - 00046176 _____ (Lenovo) C:\windows\system32\FbDefrag.exe 2014-05-31 16:50 - 2012-01-03 21:56 - 00015968 _____ (Lenovo) C:\windows\system32\NFbfmon.dll 2014-05-31 16:50 - 2012-01-03 21:56 - 00013408 _____ (Lenovo) C:\windows\system32\Drivers\BPntDrv.sys 2014-05-31 16:50 - 2012-01-03 21:56 - 00002047 _____ () C:\Users\Public\Desktop\Lenovo EE Boot Optimizer.lnk 2014-05-31 16:50 - 2012-01-03 21:56 - 00000064 _____ () C:\Lenovo EE Boot Optimizer.log 2014-05-30 19:43 - 2014-05-30 19:43 - 00354032 _____ () C:\windows\Minidump\053014-28672-01.dmp 2014-05-30 18:07 - 2014-05-30 18:07 - 00000000 _____ () C:\windows\setuperr.log 2014-05-30 06:21 - 2014-06-11 14:23 - 23414784 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-05-30 06:02 - 2014-06-11 14:23 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-05-30 06:02 - 2014-06-11 14:23 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-05-30 05:45 - 2014-06-11 14:23 - 02768384 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-05-30 05:39 - 2014-06-11 14:23 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-05-30 05:39 - 2014-06-11 14:23 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-05-30 05:38 - 2014-06-11 14:23 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-05-30 05:28 - 2014-06-11 14:23 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-05-30 05:27 - 2014-06-11 14:23 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-05-30 05:24 - 2014-06-11 14:23 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-05-30 05:21 - 2014-06-11 14:23 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-05-30 05:21 - 2014-06-11 14:23 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-05-30 05:20 - 2014-06-11 14:23 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-05-30 05:18 - 2014-06-11 14:23 - 17271296 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2014-05-30 05:11 - 2014-06-11 14:23 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-05-30 05:08 - 2014-06-11 14:23 - 05782528 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-05-30 05:06 - 2014-06-11 14:23 - 00452096 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-05-30 05:02 - 2014-06-11 14:23 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2014-05-30 04:55 - 2014-06-11 14:23 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-05-30 04:49 - 2014-06-11 14:23 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-05-30 04:46 - 2014-06-11 14:23 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-05-30 04:44 - 2014-06-11 14:23 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll 2014-05-30 04:44 - 2014-06-11 14:23 - 00295424 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-05-30 04:43 - 2014-06-11 14:23 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2014-05-30 04:42 - 2014-06-11 14:23 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll 2014-05-30 04:38 - 2014-06-11 14:23 - 02179072 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2014-05-30 04:35 - 2014-06-11 14:23 - 00608768 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-05-30 04:34 - 2014-06-11 14:23 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2014-05-30 04:33 - 2014-06-11 14:23 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2014-05-30 04:30 - 2014-06-11 14:23 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2014-05-30 04:29 - 2014-06-11 14:23 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-05-30 04:28 - 2014-06-11 14:23 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe 2014-05-30 04:27 - 2014-06-11 14:23 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll 2014-05-30 04:24 - 2014-06-11 14:23 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-05-30 04:23 - 2014-06-11 14:23 - 02040832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-05-30 04:16 - 2014-06-11 14:23 - 00368128 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll 2014-05-30 04:10 - 2014-06-11 14:23 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-05-30 04:06 - 2014-06-11 14:23 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll 2014-05-30 04:04 - 2014-06-11 14:23 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll 2014-05-30 04:02 - 2014-06-11 14:23 - 00242688 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll 2014-05-30 03:56 - 2014-06-11 14:23 - 04244992 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2014-05-30 03:56 - 2014-06-11 14:23 - 02266112 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-05-30 03:54 - 2014-06-11 14:23 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2014-05-30 03:50 - 2014-06-11 14:23 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll 2014-05-30 03:49 - 2014-06-11 14:23 - 01964544 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl 2014-05-30 03:43 - 2014-06-11 14:23 - 13522944 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-05-30 03:40 - 2014-06-11 14:23 - 11725312 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2014-05-30 03:30 - 2014-06-11 14:23 - 01398272 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-05-30 03:21 - 2014-06-11 14:23 - 01790976 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2014-05-30 03:15 - 2014-06-11 14:23 - 01143296 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2014-05-30 03:13 - 2014-06-11 14:23 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-05-30 03:13 - 2014-06-11 14:23 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll 2014-05-25 18:16 - 2012-09-09 15:51 - 00000000 ____D () C:\Users\Lolo\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox Files to move or delete: ==================== C:\ProgramData\uninstaller.exe Some content of TEMP: ==================== C:\Users\Lolo\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoivdxo.dll C:\Users\Lolo\AppData\Local\Temp\VP6Install.exe C:\Users\Lolo\AppData\Local\Temp\VP6VFW.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-06-21 20:04 ==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-06-2014 01 Ran by Lolo at 2014-06-22 15:35:18 Running from C:\Users\Lolo\Downloads Boot Mode: Safe Mode (with Networking) ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C} AS: avast! Antivirus (Enabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Spybot - Search and Destroy (Enabled - Out of date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0} ==================== Installed Programs ====================== 64 Bit HP CIO Components Installer (Version: 6.2.1 - Hewlett-Packard) Hidden Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 3.1.0.4880 - Adobe Systems Incorporated) Hidden Adobe Flash Player 13 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated) Adobe Reader X (10.1.6) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.6 - Adobe Systems Incorporated) Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.4.634 - Adobe Systems, Inc.) AIO_Scan (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden AirPort (HKLM-x32\...\{AA68AAAE-41F0-40B5-8896-5947F5FD6889}) (Version: 5.6.1.2 - Apple Inc.) AirPort (HKLM-x32\...\InstallShield_{48A8ADFF-D6E4-409D-B2BA-5CABB7FE5A84}) (Version: 4.2.0.11 - Apple Computer, Inc.) AirPort (x32 Version: 4.2.0.11 - Apple Computer, Inc.) Hidden Apple Application Support (HKLM-x32\...\{CCE825DB-347A-4004-A186-5F4A6FDD8547}) (Version: 2.3.2 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{D70884EA-E2CE-4539-91DB-4766CC1E5F5F}) (Version: 6.0.1.3 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) avast! Free Antivirus (HKLM-x32\...\avast) (Version: 8.0.1489.0 - AVAST Software) AVS Image Converter 2.3.2.248 (HKLM-x32\...\AVS Image Converter_is1) (Version: 2.3.2.248 - Online Media Technologies Ltd.) BufferChm (x32 Version: 130.0.331.000 - Hewlett-Packard) Hidden C7200 (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden C7200_Help (x32 Version: 100.0.206.000 - Hewlett-Packard) Hidden Canon DIGITAL CAMERA Solution Disk Software Guide (HKLM-x32\...\Software Guide) (Version: 1.4.0.1 - Canon Inc.) CANON iMAGE GATEWAY MyCamera Download Plugin (HKLM-x32\...\MyCamera Download Plugin) (Version: 3.1.1.2 - Canon Inc.) CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM-x32\...\CANON iMAGE GATEWAY Task) (Version: 1.9.0.9 - Canon Inc.) Canon MOV Decoder (HKLM-x32\...\Canon MOV Decoder) (Version: 1.8.0.7 - Canon Inc.) Canon MOV Encoder (HKLM-x32\...\Canon MOV Encoder) (Version: 1.6.0.1 - Canon Inc.) Canon MovieEdit Task for ZoomBrowser EX (HKLM-x32\...\MovieEditTask) (Version: 3.7.0.4 - Canon Inc.) Canon PowerShot ELPH 100 HS_IXUS 115 HS Camera User Guide (HKLM-x32\...\CameraUserGuide-PSELPH100HS_IXUS115HS) (Version: 1.0.1.2 - Canon Inc.) Canon Utilities CameraWindow DC 8 (HKLM-x32\...\CameraWindowDC8) (Version: 8.4.0.3 - Canon Inc.) Canon Utilities CameraWindow Launcher (HKLM-x32\...\CameraWindowLauncher) (Version: 7.5.0.2 - Canon Inc.) Canon Utilities Movie Uploader for YouTube (HKLM-x32\...\MovieUploaderForYouTube) (Version: 1.2.0.7 - Canon Inc.) Canon Utilities MyCamera (HKLM-x32\...\MyCamera) (Version: 7.4.0.2 - Canon Inc.) Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.) Canon Utilities ZoomBrowser EX (HKLM-x32\...\ZoomBrowser EX) (Version: 6.7.0.24 - Canon Inc.) Canon ZoomBrowser EX Memory Card Utility (HKLM-x32\...\ZoomBrowser EX Memory Card Utility) (Version: 1.5.0.9 - Canon Inc.) Copy (x32 Version: 130.0.428.000 - Hewlett-Packard) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Destinations (x32 Version: 130.0.0.0 - Hewlett-Packard) Hidden DeviceDiscovery (x32 Version: 130.0.465.000 - Hewlett-Packard) Hidden DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.9 - DivX, LLC) DocProc (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden doPDF 7.3 printer (HKLM\...\doPDF 7 printer_is1) (Version: - Softland) Dropbox (HKCU\...\Dropbox) (Version: 2.8.2 - Dropbox, Inc.) Energy Management (HKLM-x32\...\InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}) (Version: 6.0.1.6 - Lenovo) Energy Management (x32 Version: 6.0.1.6 - Lenovo) Hidden Evernote v. 5.2 (HKLM-x32\...\{090931D6-A2F4-11E3-AD9C-00163E98E7D0}) (Version: 5.2.0.2946 - Evernote Corp.) Fax (x32 Version: 130.0.418.000 - Hewlett-Packard) Hidden ffdshow [rev 2527] [2008-12-19] (HKLM-x32\...\ffdshow_is1) (Version: 1.0 - ) Free FLV Converter (HKLM-x32\...\Free FLV Converter_is1) (Version: - ) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.) Google Drive (HKLM-x32\...\{D9F75285-4864-461D-83DA-8D056BAC44D1}) (Version: 1.16.6866.4367 - Google, Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.24.7 - Google Inc.) Hidden GPBaseService2 (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden HP Customer Participation Program 13.0 (HKLM\...\HPExtendedCapabilities) (Version: 13.0 - HP) HP Imaging Device Functions 13.0 (HKLM\...\HP Imaging Device Functions) (Version: 13.0 - HP) HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.5192 - HP Photo Creations) HP Photosmart 7510 series Basic Device Software (HKLM\...\{0446B95B-C0FD-4DE9-BD8E-76015D05E4F3}) (Version: 25.0.617.0 - Hewlett-Packard Co.) HP Photosmart 7510 series Help (HKLM-x32\...\{6357D25F-A9C9-4CC7-A1FB-0DCF344E7C40}) (Version: 140.0.2.2 - Hewlett Packard) HP Photosmart 7510 series Product Improvement Study (HKLM\...\{D9F55AA1-FD3E-47FF-A385-72ED53666D3F}) (Version: 25.0.617.0 - Hewlett-Packard Co.) HP Photosmart All-In-One Driver Software 13.0 Rel. 2 (HKLM\...\{988329F4-A1A1-4D51-803C-EF2725A97627}) (Version: 13.0 - HP) HP Photosmart Essential 3.5 (HKLM\...\HP Photosmart Essential) (Version: 3.5 - HP) HP Smart Web Printing 4.51 (HKLM\...\HP Smart Web Printing) (Version: 4.51 - HP) HP Solution Center 13.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 13.0 - HP) HP Update (HKLM-x32\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard) HPPhotoGadget (x32 Version: 130.0.282.000 - Hewlett-Packard) Hidden HPPhotoSmartDiscLabel_PaperLabel (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPPhotoSmartDiscLabel_PrintOnDisc (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden hpphotosmartdisclabelplugin (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPPhotosmartEssential (x32 Version: 2.04.0000 - Hewlett-Packard) Hidden HPProductAssistant (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden HPSSupply (x32 Version: 130.0.371.000 - Hewlett-Packard) Hidden Intel PROSet Wireless (Version: - ) Hidden Intel PROSet Wireless (x32 Version: - ) Hidden Intel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation) Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation) Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.3347 - Intel Corporation) Intel® PROSet/Wireless WiFi Software (HKLM\...\{295AEB79-B53A-4F1B-860F-7800BB7E3681}) (Version: 14.2.1000 - Intel Corporation) Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.1.5.1001 - Intel Corporation) Intel® Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - ) Intel® Wireless Display (HKLM-x32\...\{F84906ED-BB54-4889-B131-FED9C9056FC8}) (Version: 2.0.27.0 - Intel Corporation) iSyncr (HKLM-x32\...\{6DA071E1-F0CB-4560-843A-D9B4441F8506}) (Version: 4.0.8 - JRT Studio) iTunes (HKLM\...\{0E5D76AD-A3FB-48D5-8400-8903B10317D3}) (Version: 11.0.1.12 - Apple Inc.) Java 7 Update 17 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle) Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden Java 6 Update 32 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216032FF}) (Version: 6.0.320 - Oracle) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden KakaoTalk (HKLM-x32\...\KakaoTalk) (Version: 1.2.0.587 - Kakao) Lenovo Bluetooth with Enhanced Data Rate Software (HKLM\...\{436E0B79-2CFB-4E5F-9380-E17C1B25D0C5}) (Version: 6.3.0.7400 - Broadcom Corporation) Lenovo EasyCamera (HKLM-x32\...\{E0A7ED39-8CD6-4351-93C3-69CCA00D12B4}) (Version: 6.1.7600.0083 - Realtek Semiconductor Corp.) Lenovo EE Boot Optimizer (HKLM\...\Lenovo EE Boot Optimizer) (Version: 0.0.1.5 - Lenovo) Lenovo Games Console (HKLM-x32\...\Lenovo Games Console) (Version: 1.2.6.436 - Oberon Media Inc.) Lenovo MuteSync (HKLM-x32\...\InstallShield_{C39EF9B4-0C4F-4D48-8665-8FD45BFF3961}) (Version: 1.0.0.3 - Lenovo) Lenovo MuteSync (x32 Version: 1.0.0.3 - Lenovo) Hidden Lenovo OneKey Recovery (HKLM-x32\...\InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}) (Version: 7.0.1628 - CyberLink Corp.) Lenovo OneKey Recovery (Version: 7.0.1628 - CyberLink Corp.) Hidden Lenovo YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.1.3603 - CyberLink Corp.) Lenovo YouCam (x32 Version: 3.1.3603 - CyberLink Corp.) Hidden Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) Hidden Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Corporation (Version: 9.1.0.0 - Microsoft Corporation) Hidden Microsoft Corporation (x32 Version: 9.1.0.0 - Microsoft Corporation) Hidden Microsoft LifeCam (HKLM\...\{6965A8D2-465D-4F98-9FAA-0E9E2348F329}) (Version: 3.22.270.0 - Microsoft Corporation) Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation) Microsoft PowerPoint Viewer (HKLM-x32\...\{95140000-00AF-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft VC9 runtime libraries (x32 Version: 2.0.0 - AOL Inc.) Hidden Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Mozilla Firefox 29.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 29.0.1 (x86 en-US)) (Version: 29.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) Music Manager (HKCU\...\MusicManager) (Version: - Google, Inc.) Network64 (Version: 130.0.572.000 - Hewlett-Packard) Hidden OCR Software by I.R.I.S. 13.0 (HKLM\...\HPOCR) (Version: 13.0 - HP) Onekey Theater (HKLM-x32\...\InstallShield_{D4B060B9-AD4A-4152-9D99-28B93C615AFE}) (Version: 2.0.2.8 - Lenovo) Onekey Theater (x32 Version: 2.0.2.8 - Lenovo) Hidden ooVoo (HKLM-x32\...\{FAA7F8FF-3C05-4A61-8F14-D8A6E9ED6623}) (Version: 3.5.8022 - ooVoo LLC.) OpenOffice.org 3.3 (HKLM-x32\...\{3E171899-0175-47CC-84C4-562ACDD4C021}) (Version: 3.3.9567 - OpenOffice.org) PdaNet+ for Android 4.15 (HKLM-x32\...\PdaNet_is1) (Version: - June Fabrics Technology Inc) PhotoScape (HKLM-x32\...\PhotoScape) (Version: - ) Power2Go (HKLM-x32\...\{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 5.6.0.7303 - CyberLink Corp.) PS_AIO_02_ProductContext (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden PS_AIO_02_Software (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden PS_AIO_02_Software_Min (x32 Version: 130.0.365.000 - Hewlett-Packard) Hidden QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.) Realtek Ethernet Controller Driver For Windows 7 (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.23.623.2010 - Realtek) Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6301 - Realtek Semiconductor Corp.) Realtek USB 2.0 Reader Driver (HKLM-x32\...\{62BBB2F0-E220-4821-A564-730807D2C34D}) (Version: 6.1.7601.39015 - Realtek Semiconductor Corp.) SaveTheChildren Reminder by We-Care.com v4.0.20.4 (HKLM-x32\...\{EE88303A-4DBB-4EC1-8C63-26EC1CAB599B}) (Version: 4.0.20.4 - We-Care.com) Scan (x32 Version: 13.0.0.0 - Hewlett-Packard) Hidden Shop for HP Supplies (HKLM\...\Shop for HP Supplies) (Version: 13.0 - HP) Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.) SmartWebPrinting (x32 Version: 130.0.457.000 - Hewlett-Packard) Hidden SolutionCenter (x32 Version: 130.0.373.000 - Hewlett-Packard) Hidden Spotify (HKCU\...\Spotify) (Version: 0.9.10.14.g578d350b - Spotify AB) Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.2.25 - Safer-Networking Ltd.) SRS Premium Sound Control Panel (HKLM\...\{F3C66EC8-2F33-452D-9CFF-E8C886B3ECC4}) (Version: 1.11.0000 - SRS Labs, Inc.) Status (x32 Version: 130.0.469.000 - Hewlett-Packard) Hidden SUPERAntiSpyware (HKLM\...\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}) (Version: 5.7.1026 - SUPERAntiSpyware.com) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 15.3.2.0 - Synaptics Incorporated) Toolbox (x32 Version: 130.0.648.000 - Hewlett-Packard) Hidden TrayApp (x32 Version: 130.0.422.000 - Hewlett-Packard) Hidden TuneSync Server 2.0.28 (HKLM-x32\...\TuneSync Server) (Version: 2.0.28 - Fireleap Software LLC) UnloadSupport (x32 Version: 11.0.0 - Hewlett-Packard) Hidden UserGuide (HKLM-x32\...\InstallShield_{F07C2CF8-4C53-4EC3-8162-A6221E36EB88}) (Version: 1.0.0.6 - Lenovo) UserGuide (x32 Version: 1.0.0.6 - Lenovo) Hidden VaudiX 1.74 (HKLM-x32\...\SP_09de8db5) (Version: - ) VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) Hidden VeriFace (HKLM-x32\...\VeriFace) (Version: 4.0.1.0126 - Lenovo) WebReg (x32 Version: 130.0.132.017 - Hewlett-Packard) Hidden Windows Driver Package - Lenovo (ACPIVPC) System (12/02/2010 6.1.0.1) (HKLM\...\EA12B1FB53CE4E387C31A85236C41EF559B5E392) (Version: 12/02/2010 6.1.0.1 - Lenovo) Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation) Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden WinRAR 4.20 (32-bit) (HKLM-x32\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH) Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version: - ) ==================== Restore Points ========================= 01-06-2014 15:16:05 Removed Bonjour 01-06-2014 15:17:58 Removed inSSIDer 3 01-06-2014 15:18:37 Removed iSyncr 03-06-2014 21:44:26 Windows Update 08-06-2014 13:57:09 Windows Update 11-06-2014 18:17:25 Windows Update 15-06-2014 03:10:32 Windows Update 22-06-2014 00:52:03 Windows Update ==================== Hosts content: ========================== 2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {0B56884A-A10B-45A4-9340-FF4B2EB99F4B} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-05-09] (AVAST Software) Task: {1382782B-B440-46CC-98D9-8F4814069A96} - System32\Tasks\Norton Identity Safe\Norton Error Processor => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.6.0.27\SymErr.exe Task: {16FDAC17-4432-4FC8-9098-9A078815B95A} - System32\Tasks\Norton Identity Safe\Norton Error Analyzer => C:\Program Files (x86)\Norton Identity Safe\Engine\2014.6.0.27\SymErr.exe Task: {243FF09F-1AB6-4D12-BAC3-5D14C42F460D} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Check for updates => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe Task: {2AAF0488-3DA8-4726-96D0-1AD91C83ADC1} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-03] (Google Inc.) Task: {46F0BF2A-B26C-46F9-A08A-5299EBC04527} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-21] (Google Inc.) Task: {60112546-4AF3-4E98-ABAD-F143585C819C} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-05-13] (Adobe Systems Incorporated) Task: {78A70E3A-7C60-4B87-843B-BC5C1599F23F} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe [2010-12-04] (CyberLink) Task: {8BAB6788-F351-4040-976F-53F23D7AF595} - System32\Tasks\RunAsStdUser Task for VeohWebPlayer => C:\Program Files (x86)\Veoh Networks\VeohWebPlayer\veohwebplayer.exe Task: {BE87F4CE-8144-4754-8F7C-F64FA7F375CA} - System32\Tasks\HPCustParticipation HP Photosmart 7510 series => C:\Program Files\HP\HP Photosmart 7510 series\Bin\HPCustPartic.exe [2011-08-31] (Hewlett-Packard Co.) Task: {CE6C356F-BCA5-4B90-8BF4-4B328EEBF104} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-01-03] (Google Inc.) Task: {D4CC685B-FEB4-4595-B86F-685AFBB17C13} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Refresh immunization => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe Task: {D969E974-9122-486D-BB27-772C68E70CF2} - System32\Tasks\HP Photo Creations Messager => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2011-02-15] () Task: {F4F3546E-A34F-4F1A-AB8D-AF5629DC7D75} - System32\Tasks\Safer-Networking\Spybot - Search and Destroy\Scan the system => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe Task: {F77788C8-82C9-4679-9107-BE354884D1D7} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-21] (Google Inc.) Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001Core.job => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3378580329-3139310990-1513726972-1001UA.job => C:\Users\Lolo\AppData\Local\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe Task: C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 1f56f37f-83d7-4281-a21b-c509be6e1a10.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Task: C:\windows\Tasks\SUPERAntiSpyware Scheduled Task 7d0e1d70-755a-47d9-8337-8a4fd6c1d51e.job => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe ==================== Loaded Modules (whitelisted) ============= 2014-05-18 18:58 - 2014-05-18 18:58 - 03839088 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MBAMSwissArmy => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MBAMSwissArmy => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option => "OptionValue"="2" ==================== EXE Association (whitelisted) ============= ==================== MSCONFIG/TASK MANAGER disabled items ========= MSCONFIG\startupreg: ooVoo.exe => C:\program files (x86)\oovoo\oovoo.exe /minimized MSCONFIG\startupreg: Spotify => "C:\Users\Lolo\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart ==================== Faulty Device Manager Devices ============= Name: Photosmart C7200 series Description: Photosmart C7200 series Class Guid: Manufacturer: Service: Problem: : The drivers for this device are not installed. (Code 28) Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard. Name: aswRvrt Description: aswRvrt Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: aswRvrt Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: avast! Network Shield Support Description: avast! Network Shield Support Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: aswTdi Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: aswVmm Description: aswVmm Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: aswVmm Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Security Processor Loader Driver Description: Security Processor Loader Driver Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1} Manufacturer: Service: spldr Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24) Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed. Devices stay in this state if they have been prepared for removal. After you remove the device, this error disappears.Remove the device, and this error should be resolved. Name: Photosmart C7200 series Description: Photosmart C7200 series Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f} Manufacturer: HP Service: StillCam Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (06/22/2014 03:12:13 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY) Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code. Error: (06/22/2014 03:12:13 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY) Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section. Error: (06/22/2014 03:08:19 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/22/2014 03:02:59 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/22/2014 01:53:42 PM) (Source: CVHSVC) (EventID: 100) (User: ) Description: Information only. (Stream product id=0x0066): Streaming Failed Error: (06/22/2014 01:50:29 PM) (Source: CVHSVC) (EventID: 100) (User: ) Description: Information only. Too many failures while downloading ranges: 2 Error: (06/22/2014 01:49:29 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY) Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code. Error: (06/22/2014 01:49:29 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY) Description: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section. Error: (06/22/2014 01:43:01 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/22/2014 01:15:40 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY) Description: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code. System errors: ============= Error: (06/22/2014 03:35:02 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:35:02 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:35:02 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:33:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:33:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:33:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:33:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:33:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:33:24 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Error: (06/22/2014 03:30:57 PM) (Source: Service Control Manager) (EventID: 7001) (User: ) Description: The Computer Browser service depends on the Server service which failed to start because of the following error: %%1068 Microsoft Office Sessions: ========================= Error: (06/22/2014 03:12:13 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY) Description: WmiApRplWmiApRpl8F20300004D070000 Error: (06/22/2014 03:12:13 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY) Description: Performance1637070000000000000000000009030000 Error: (06/22/2014 03:08:19 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/22/2014 03:02:59 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/22/2014 01:53:42 PM) (Source: CVHSVC) (EventID: 100) (User: ) Description: (Stream product id=0x0066): Streaming Failed Error: (06/22/2014 01:50:29 PM) (Source: CVHSVC) (EventID: 100) (User: ) Description: Too many failures while downloading ranges: 2 Error: (06/22/2014 01:49:29 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY) Description: WmiApRplWmiApRpl8F20300004D070000 Error: (06/22/2014 01:49:29 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT AUTHORITY) Description: Performance1637070000000000000000000009030000 Error: (06/22/2014 01:43:01 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (06/22/2014 01:15:40 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT AUTHORITY) Description: WmiApRplWmiApRpl8F20300004D070000 CodeIntegrity Errors: =================================== Date: 2013-02-18 23:02:05.034 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 23:02:04.961 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:59:28.617 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:59:28.518 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:57:22.474 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:57:22.355 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:56:47.887 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:56:47.821 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:56:17.688 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2013-02-18 22:56:17.612 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\usbaapl64.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. ==================== Memory info =========================== Percentage of memory in use: 28% Total physical RAM: 4000.58 MB Available physical RAM: 2855.65 MB Total Pagefile: 7999.34 MB Available Pagefile: 6713.67 MB Total Virtual: 8192 MB Available Virtual: 8191.83 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:420.33 GB) (Free:323.5 GB) NTFS Drive d: (LENOVO) (Fixed) (Total:30.48 GB) (Free:27.55 GB) NTFS Drive i: (Karch) (CDROM) (Total:1.11 GB) (Free:0 GB) CDFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 2F57148F) Partition 1: (Active) - (Size=200 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=420 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=30 GB) - (Type=OF Extended) Partition 4: (Not Active) - (Size=15 GB) - (Type=12) ==================== End Of Log ============================
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.