Jump to content

Search the Community

Showing results for tags 'Trojan.Agent.ED'.

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Announcements
    • Malwarebytes News
    • Beta Testing Program
  • Malware Removal Help
    • Windows Malware Removal Help & Support
    • Mac Malware Removal Help & Support
    • Mobile Malware Removal Help & Support
    • Malware Removal Self-Help Guides
  • Malwarebytes for Home Support
    • Malwarebytes for Windows Support Forum
    • Malwarebytes for Mac Support Forum
    • Malwarebytes for Android Support Forum
    • Malwarebytes for iOS Support
    • Malwarebytes Privacy
    • Malwarebytes Browser Guard
    • False Positives
    • Comments and Suggestions
  • Malwarebytes for Business Support
    • Malwarebytes Endpoint Protection
    • Malwarebytes Incident Response (includes Breach Remediation)
    • Malwarebytes Endpoint Security
    • Malwarebytes Business Products Comments and Suggestions
  • Malwarebytes Tools and Other Products
    • Malwarebytes AdwCleaner
    • Malwarebytes Junkware Removal Tool Support
    • Malwarebytes Anti-Rootkit BETA Support
    • Malwarebytes Techbench USB (Legacy)
    • Malwarebytes Secure Backup discontinued
    • Other Tools
    • Malwarebytes Tools Comments and Suggestions
  • General Computer Help and Security Updates
    • BSOD, Crashes, Kernel Debugging
    • General Windows PC Help
  • Research Center
    • Newest Rogue-Ransomware Threats
    • Newest Malware Threats
    • Newest Mobile Threats
    • Newest IP or URL Threats
    • Newest Mac Threats
    • Report Scam Phone Numbers
  • General
    • General Chat
    • Forums Announcements & Feedback

Find results in...

Find results that contain...


Date Created

  • Start

    End


Last Updated

  • Start

    End


Filter by number of...

Joined

  • Start

    End


Group


AIM


MSN


Website URL


ICQ


Yahoo


Jabber


Location


Interests

Found 7 results

  1. Hi, I have scanned my computer with Malwarebytes Anti-Malware Home, and it detected the following items: Trojan.Agent.ED PUP.Optional.Yontoo (13 of these) PUP.Optional.OpenCandy PUP.Optional.BundleInstaller.DW PUP.Optional.Babylon I quarentined and then deleted all the files and then re-ran Malwarebytes twice. It is saying the computer is clean now, but can I be sure that it is? Many thanks! Caroline The FRST.txt and Addition.txt files are shown below: Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version:05-03-2016 01 Ran by Rosebud (administrator) on ROSEBUD-PC (07-04-2016 18:21:25) Running from C:\Users\Rosebud\Desktop Loaded Profiles: Rosebud (Available Profiles: Rosebud) Platform: Windows 10 Home (X64) Language: English (United States) Internet Explorer Version 11 (Default browser: FF) Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe (Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe (Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE (SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50STB.EXE () C:\ProgramData\DatacardService\DCService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (McAfee, Inc.) C:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe (SoftThinks) C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe () C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE (Microsoft Corporation) C:\Program Files\Windows Defender\MsMpEng.exe (Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\BCMWLTRY.EXE (Microsoft Corporation) C:\Program Files\Windows Defender\NisSrv.exe (Huawei Technologies Co., Ltd.) C:\ProgramData\DatacardService\DCSHelper.exe (Dell Inc.) C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE (Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Eastman Kodak Company) C:\Windows\System32\spool\drivers\x64\3\EKIJ5000MUI.exe (Huawei Technologies Co., Ltd.) C:\Users\Rosebud\AppData\Roaming\Telekom Internet Manager\ouc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe (McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (SourceForge.net) C:\Program Files (x86)\Password Safe\pwsafe.exe (IBM Corp.) C:\Program Files (x86)\Trusteer\Rapport\bin\RapportService.exe () C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_21_0_0_197.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_21_0_0_197.exe (Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) C:\Windows\SoftwareDistribution\Download\Install\AM_Delta_Patch_1.217.848.0.exe (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) =========================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Apoint] => C:\Program Files\DellTPad\Apoint.exe [305664 2009-01-23] (Alps Electric Co., Ltd.) HKLM\...\Run: [IgfxTray] => C:\Windows\system32\igfxtray.exe HKLM\...\Run: [HotKeysCmds] => C:\Windows\system32\hkcmd.exe HKLM\...\Run: [Persistence] => C:\Windows\system32\igfxpers.exe HKLM\...\Run: [Broadcom Wireless Manager UI] => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.exe [4968960 2009-07-17] (Dell Inc.) HKLM\...\Run: [QuickSet] => C:\Program Files\Dell\QuickSet\QuickSet.exe [3180624 2009-07-03] (Dell Inc.) HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-05] (Intel Corporation) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2009-11-07] (IDT, Inc.) HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\WINDOWS\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [3182080 2012-10-08] (Eastman Kodak Company) HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-12-17] (Apple Inc.) HKLM-x32\...\Run: [DellSupportCenter] => "C:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter HKLM-x32\...\Run: [Desktop Disc Tool] => C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-10-15] () HKLM-x32\...\Run: [PDVDDXSrv] => C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe [140520 2009-06-24] (CyberLink Corp.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-12-17] (Apple Inc.) HKLM-x32\...\Run: [EKStatusMonitor] => C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company) HKLM-x32\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe HKLM-x32\...\Run: [DataCardMonitor] => C:\Program Files (x86)\Telekom\InternetManager_H\DataCardMonitor.exe [253952 2015-05-28] (Huawei Technologies Co., Ltd.) HKLM-x32\...\Run: [ProductUpdater] => C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe [62464 2015-06-18] () HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.) HKLM-x32\...\Run: [Dropbox] => C:\Program Files (x86)\Dropbox\Client\Dropbox.exe [25577864 2016-03-12] (Dropbox, Inc.) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\Run: [HW_OPENEYE_OUC_Telekom Internet Manager] => C:\Program Files (x86)\Telekom\InternetManager_H\UpdateDog\ouc.exe [110592 2009-12-31] (Huawei Technologies Co., Ltd.) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIILE.EXE [283232 2014-12-12] (SEIKO EPSON CORPORATION) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [60688 2015-10-21] (Apple Inc.) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.5892.0626\amd64" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.5951.0827\amd64" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6201.1019\amd64" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6281.1202\amd64" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\RunOnce: [Uninstall C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64] => C:\WINDOWS\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6301.0127\amd64" ShellIconOverlayIdentifiers: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt64.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File ShellIconOverlayIdentifiers-x32: [ DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt3] -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt4] -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt5] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt6] -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt7] -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [ DropboxExt8] -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt1] -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt2] -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) ShellIconOverlayIdentifiers-x32: [DropboxExt3] -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Program Files (x86)\Dropbox\Client\DropboxExt.34.dll [2016-03-12] (Dropbox, Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk [2016-04-07] ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.11.309\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2009-12-08] ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk [2009-12-08] ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock.lnk [2016-04-07] ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk [2016-04-07] ShortcutTarget: Password Safe.lnk -> C:\Program Files (x86)\Password Safe\pwsafe.exe (SourceForge.net) ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.2.103 Tcpip\..\Interfaces\{2455368d-524a-4788-a794-ba4238c28828}: [DhcpNameServer] 192.168.2.1 Tcpip\..\Interfaces\{95c991db-a653-4c8b-a9a8-09112da49dd8}: [DhcpNameServer] 192.168.2.103 Internet Explorer: ================== HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/2 SearchScopes: HKLM -> DefaultScope {2F850598-E7CE-42F5-971C-87C6F2DFBFCC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKLM -> {2F850598-E7CE-42F5-971C-87C6F2DFBFCC} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKLM-x32 -> DefaultScope {BAF37197-DF5F-4C08-81F7-B56E6F93698F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKLM-x32 -> {BAF37197-DF5F-4C08-81F7-B56E6F93698F} URL = hxxp://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox SearchScopes: HKU\.DEFAULT -> DefaultScope {BAF37197-DF5F-4C08-81F7-B56E6F93698F} URL = SearchScopes: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> DefaultScope {2F850598-E7CE-42F5-971C-87C6F2DFBFCC} URL = SearchScopes: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> {2F850598-E7CE-42F5-971C-87C6F2DFBFCC} URL = SearchScopes: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = SearchScopes: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> {BAF37197-DF5F-4C08-81F7-B56E6F93698F} URL = BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll [2013-05-04] (Oracle Corporation) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-01-12] (Google Inc.) BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-05-14] (Skype Technologies S.A.) BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg64.dll [2010-01-12] (Google Inc.) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll [2013-05-04] (Oracle Corporation) BHO-x32: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2010-09-22] (Microsoft Corporation) BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-09-10] (Oracle Corporation) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-12] (Google Inc.) BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-05-14] (Skype Technologies S.A.) BHO-x32: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll [2010-01-12] (Google Inc.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-09-10] (Oracle Corporation) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-01-12] (Google Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll [2010-01-12] (Google Inc.) Toolbar: HKU\.DEFAULT -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-01-12] (Google Inc.) Toolbar: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File Toolbar: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll [2010-01-12] (Google Inc.) DPF: HKLM-x32 {1ABA5FAC-1417-422B-BA82-45C35E2C908B} hxxp://kitchenplanner.ikea.com/DE/Core/Player/2020PlayerAX_IKEA_Win32.cab DPF: HKLM-x32 {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} hxxps://support.dell.com/systemprofiler/SysProExe.CAB Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll [2013-05-14] (Skype Technologies S.A.) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll [2013-05-14] (Skype Technologies S.A.) FireFox: ======== FF ProfilePath: C:\Users\Rosebud\AppData\Roaming\Mozilla\Firefox\Profiles\nt45z5r6.default-1445328340479 FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF64_21_0_0_197.dll [2016-04-02] () FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll [2013-05-04] (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.21.2 -> C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll [2013-05-04] (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer -> C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_21_0_0_197.dll [2016-04-02] () FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-14] () FF Plugin-x32: @java.com/DTPlugin,version=10.5.1 -> C:\WINDOWS\SysWOW64\npDeployJava1.dll [2012-07-05] (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-09-10] (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.41212.0\npctrl.dll [2015-12-12] ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2010-11-10] (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-04] (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.29.5\npGoogleUpdate3.dll [2016-02-04] (Google Inc.) FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\plugins\npVeetle.dll [2010-10-16] (Veetle Inc) FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 -> C:\Program Files (x86)\Veetle\Player\npvlc.dll [2010-09-21] (Veetle Inc) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-12-18] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll [2015-12-18] (Adobe Systems Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll [2015-11-01] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll [2015-11-01] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll [2015-11-01] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll [2015-11-01] (Apple Inc.) FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll [2015-11-01] (Apple Inc.) FF Extension: 20-20 3D Viewer - IKEA - C:\Users\Rosebud\AppData\Roaming\Mozilla\Firefox\Profiles\nt45z5r6.default-1445328340479\extensions\2020Player_IKEA@2020Technologies.com [2016-03-04] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2016-04-07] [not signed] FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2016-04-07] [not signed] FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}.xpi [2016-04-07] [not signed] FF HKLM-x32\...\Firefox\Extensions: [litmus-ff@f-secure.com] - C:\Program Files (x86)\F-Secure\NRS\litmus-ff@f-secure.com => not found FF HKLM-x32\...\Firefox\Extensions: [ff-bmboc@bytemobile.com] - C:\Program Files\T-Mobile\InternetManager_H\OCx64\addon => not found Chrome: ======= CHR StartupUrls: Default -> "hxxp://www.google.com/ig" CHR Profile: C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Slides) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2015-03-03] CHR Extension: (Google Docs) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2015-03-03] CHR Extension: (Google Drive) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2015-12-07] CHR Extension: (Rapport) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\bbjllphbppobebmjpjcijfbakobcheof [2015-07-01] CHR Extension: (YouTube) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2015-09-24] CHR Extension: (Google Search) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2015-12-07] CHR Extension: (Google Sheets) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2015-03-03] CHR Extension: (Google Docs Offline) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi [2015-09-29] CHR Extension: (Pin It Button) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2015-09-24] CHR Extension: (Skype Click to Call) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2015-12-07] CHR Extension: (Chrome Web Store Payments) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2015-08-14] CHR Extension: (Gmail) - C:\Users\Rosebud\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2015-03-29] CHR HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [apdfllckaahabafndbhieahigkjlhalf] - <not found> CHR HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\SOFTWARE\Google\Chrome\Extensions\...\Chrome\Extension: [bbjllphbppobebmjpjcijfbakobcheof] - hxxps://clients2.google.com/service/update2/crx CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-05-14] ==================== Services (Whitelisted) ======================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.) S2 dbupdate; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-11-09] (Dropbox, Inc.) S3 dbupdatem; C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [136048 2015-11-09] (Dropbox, Inc.) R2 DCService.exe; C:\ProgramData\DatacardService\DCService.exe [229376 2010-08-19] () [File not signed] R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2009-06-09] (Stardock Corporation) [File not signed] S3 Garmin Device Interaction Service; C:\Program Files (x86)\Garmin\Device Interaction Service\GarminService.exe [708616 2015-04-08] (Garmin Ltd. or its subsidiaries) S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1514464 2016-03-10] (Malwarebytes) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [1136608 2016-03-10] (Malwarebytes) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.11.309\McCHSvc.exe [293128 2016-03-11] (McAfee, Inc.) R2 McProxy; C:\Program Files (x86)\Common Files\McAfee\McProxy\McProxy.exe [359952 2009-04-09] (McAfee, Inc.) S2 NPEService; C:\Users\Rosebud\Desktop\NPE.exe [3088296 2016-04-07] (Symantec Corporation) S3 OpenVPNService; C:\Program Files (x86)\OpenVPN\bin\openvpnserv.exe [14848 2011-12-15] () [File not signed] R2 RapportMgmtService; C:\Program Files (x86)\Trusteer\Rapport\bin\RapportMgmtService.exe [2372080 2016-03-23] (IBM Corp.) R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [362928 2015-07-10] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [24864 2015-07-10] (Microsoft Corporation) R2 wltrysvc; C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwltry.exe [3417088 2009-07-17] (Dell Inc.) [File not signed] ===================== Drivers (Whitelisted) ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) R3 BCM43XX; C:\Windows\System32\drivers\bcmwl63al.sys [5170176 2015-06-18] (Broadcom Corporation) S0 BMLoad; C:\Windows\System32\drivers\BMLoad.sys [16512 2009-12-15] (Bytemobile, Inc.) [File not signed] R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [27008 2016-03-10] (Malwarebytes) S3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [192216 2016-04-07] (Malwarebytes) S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [65408 2016-03-10] (Malwarebytes Corporation) R1 MPFP; C:\Windows\System32\Drivers\Mpfp.sys [176144 2009-04-09] (McAfee, Inc.) R1 RapportCerberus_1609035; C:\ProgramData\Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportCerberus64_1609035.sys [1156456 2016-04-07] (IBM Corp.) R1 RapportEI64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportEI64.sys [544360 2016-03-23] (IBM Corp.) R0 RapportHades64; C:\Windows\System32\Drivers\RapportHades64.sys [215560 2016-03-23] (IBM Corp.) S3 RapportKE64; C:\Windows\System32\Drivers\RapportKE64.sys [470056 2016-03-23] (IBM Corp.) R1 RapportPG64; C:\Program Files (x86)\Trusteer\Rapport\bin\x64\RapportPG64.sys [523432 2016-03-23] (IBM Corp.) S3 tapoas; C:\Windows\System32\DRIVERS\tapoas.sys [30720 2011-08-19] (The OpenVPN Project) R1 tcpipBM; C:\Windows\system32\drivers\tcpipBM.sys [39552 2009-12-15] (Bytemobile, Inc.) [File not signed] S3 UdeCx; C:\Windows\System32\drivers\udecx.sys [44032 2015-07-10] () S0 WdBoot; C:\Windows\System32\drivers\WdBoot.sys [44568 2015-07-10] (Microsoft Corporation) R0 WdFilter; C:\Windows\System32\drivers\WdFilter.sys [291680 2015-07-10] (Microsoft Corporation) R2 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [119648 2015-07-10] (Microsoft Corporation) R3 yukonw8; C:\Windows\System32\drivers\yk63x64.sys [295216 2015-06-18] (Marvell) U4 aspnet_state; no ImagePath S3 wfpcapture; \SystemRoot\System32\drivers\wfpcapture.sys [X] U3 wpcsvc; no ImagePath ==================== NetSvcs (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) ==================== One Month Created files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-04-07 18:18 - 2016-04-07 18:21 - 00029261 _____ C:\Users\Rosebud\Desktop\FRST.txt 2016-04-07 18:17 - 2016-04-07 18:21 - 00000000 ____D C:\FRST 2016-04-07 18:16 - 2016-04-07 18:17 - 02374144 _____ (Farbar) C:\Users\Rosebud\Desktop\FRST64.exe 2016-04-07 18:07 - 2016-04-07 18:07 - 00016148 _____ C:\WINDOWS\system32\ROSEBUD-PC_Rosebud_HistoryPrediction.bin 2016-04-07 15:10 - 2012-07-05 22:06 - 00772544 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\npDeployJava1.dll 2016-04-07 15:10 - 2012-07-05 22:06 - 00687544 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\deployJava1.dll 2016-04-07 14:38 - 2016-04-07 18:09 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2016-04-07 14:08 - 2016-04-07 14:08 - 00000000 ____D C:\NPE 2016-04-07 14:07 - 2016-04-07 18:14 - 00037942 _____ C:\WINDOWS\ntbtlog.txt 2016-04-07 13:57 - 2016-04-07 13:57 - 00000000 ____D C:\ProgramData\SMR501 2016-04-07 13:57 - 2015-08-30 17:02 - 00246772 _____ C:\WINDOWS\ntbtlog.txt.bak 2016-04-07 13:49 - 2016-04-07 13:49 - 00002011 _____ C:\Users\Public\Desktop\McAfee Security Scan Plus.lnk 2016-04-07 13:49 - 2016-04-07 13:49 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee Security Scan Plus 2016-04-07 13:48 - 2016-04-07 13:49 - 00000000 ____D C:\Program Files\McAfee Security Scan 2016-04-07 13:47 - 2016-04-07 13:47 - 08597336 _____ (McAfee, Inc.) C:\Users\Rosebud\Downloads\SecurityScan_Release.exe 2016-04-07 13:33 - 2016-04-07 14:05 - 00000000 ____D C:\Users\Rosebud\AppData\Local\NPE 2016-04-07 13:33 - 2016-04-07 13:33 - 00000000 ____D C:\ProgramData\Norton 2016-04-07 13:32 - 2016-04-07 13:33 - 03088296 _____ (Symantec Corporation) C:\Users\Rosebud\Desktop\NPE.exe 2016-04-07 11:53 - 2016-04-07 11:53 - 06516656 _____ (Tim Kosse) C:\Users\Rosebud\Downloads\FileZilla_3.16.1_win64-setup.exe 2016-04-07 11:10 - 2016-04-07 14:58 - 00192216 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2016-04-07 11:09 - 2016-04-07 12:37 - 00001177 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2016-04-07 11:09 - 2016-04-07 11:09 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2016-04-07 11:08 - 2016-04-07 11:09 - 00000000 ____D C:\Program Files (x86)\Malwarebytes Anti-Malware 2016-04-07 11:08 - 2016-04-07 11:08 - 00000000 ____D C:\ProgramData\Malwarebytes 2016-04-07 11:08 - 2016-03-10 14:09 - 00065408 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys 2016-04-07 11:08 - 2016-03-10 14:08 - 00140672 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbamchameleon.sys 2016-04-07 11:08 - 2016-03-10 14:08 - 00027008 _____ (Malwarebytes) C:\WINDOWS\system32\Drivers\mbam.sys 2016-04-07 11:07 - 2016-04-07 11:07 - 22851472 _____ (Malwarebytes ) C:\Users\Rosebud\Downloads\mbam-setup-2.2.1.1043.exe 2016-04-03 13:43 - 2016-04-03 13:43 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dropbox 2016-03-10 21:13 - 2016-03-10 21:14 - 00000000 ____D C:\Users\Rosebud\AppData\Local\Comms 2016-03-10 13:54 - 2016-02-23 16:41 - 00299600 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMASF.DLL 2016-03-10 13:54 - 2016-02-23 16:07 - 22322624 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll 2016-03-10 13:54 - 2016-02-23 13:55 - 24592896 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2016-03-10 13:54 - 2016-02-23 13:45 - 06788608 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Data.Pdf.dll 2016-03-10 13:54 - 2016-02-23 13:14 - 00841728 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll 2016-03-10 13:54 - 2016-02-23 12:55 - 14241792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wmp.dll 2016-03-10 13:54 - 2016-02-23 12:48 - 21859840 _____ (Microsoft Corporation) C:\WINDOWS\system32\edgehtml.dll 2016-03-10 13:54 - 2016-02-23 12:48 - 05157376 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Data.Pdf.dll 2016-03-10 13:54 - 2016-02-23 12:11 - 12589056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wmp.dll 2016-03-10 13:53 - 2016-02-23 16:53 - 01314496 _____ (Microsoft Corporation) C:\WINDOWS\system32\ole32.dll 2016-03-10 13:53 - 2016-02-23 16:52 - 00858408 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe 2016-03-10 13:53 - 2016-02-23 16:51 - 00633184 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\fvevol.sys 2016-03-10 13:53 - 2016-02-23 16:51 - 00146784 _____ (Microsoft Corporation) C:\WINDOWS\system32\wermgr.exe 2016-03-10 13:53 - 2016-02-23 16:50 - 00630160 _____ (Microsoft Corporation) C:\WINDOWS\system32\wer.dll 2016-03-10 13:53 - 2016-02-23 16:48 - 08022368 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe 2016-03-10 13:53 - 2016-02-23 16:48 - 01294352 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi 2016-03-10 13:53 - 2016-02-23 16:48 - 01123952 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe 2016-03-10 13:53 - 2016-02-23 16:41 - 01150816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2016-03-10 13:53 - 2016-02-23 16:41 - 00078040 _____ (Microsoft Corporation) C:\WINDOWS\system32\wkscli.dll 2016-03-10 13:53 - 2016-02-23 16:40 - 00110584 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvcli.dll 2016-03-10 13:53 - 2016-02-23 16:38 - 00272752 _____ (Microsoft Corporation) C:\WINDOWS\system32\sqmapi.dll 2016-03-10 13:53 - 2016-02-23 16:36 - 00080128 _____ (Microsoft Corporation) C:\WINDOWS\system32\netapi32.dll 2016-03-10 13:53 - 2016-02-23 16:11 - 00781984 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfds.dll 2016-03-10 13:53 - 2016-02-23 16:11 - 00658784 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupEngine.dll 2016-03-10 13:53 - 2016-02-23 16:11 - 00103776 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupApi.dll 2016-03-10 13:53 - 2016-02-23 16:08 - 03622272 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2016-03-10 13:53 - 2016-02-23 15:39 - 00607416 _____ (Microsoft Corporation) C:\WINDOWS\system32\fontdrvhost.exe 2016-03-10 13:53 - 2016-02-23 15:30 - 01643872 _____ (Microsoft Corporation) C:\WINDOWS\system32\diagtrack.dll 2016-03-10 13:53 - 2016-02-23 15:25 - 01085632 _____ (Microsoft Corporation) C:\WINDOWS\system32\appraiser.dll 2016-03-10 13:53 - 2016-02-23 15:23 - 00952968 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ole32.dll 2016-03-10 13:53 - 2016-02-23 15:21 - 00529456 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wer.dll 2016-03-10 13:53 - 2016-02-23 15:21 - 00141152 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wermgr.exe 2016-03-10 13:53 - 2016-02-23 15:11 - 00249976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMASF.DLL 2016-03-10 13:53 - 2016-02-23 15:11 - 00073360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\srvcli.dll 2016-03-10 13:53 - 2016-02-23 15:11 - 00055808 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wkscli.dll 2016-03-10 13:53 - 2016-02-23 15:09 - 00229352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sqmapi.dll 2016-03-10 13:53 - 2016-02-23 15:06 - 00069232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netapi32.dll 2016-03-10 13:53 - 2016-02-23 14:58 - 00150528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusNotification.exe 2016-03-10 13:53 - 2016-02-23 14:50 - 00395264 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupShim.dll 2016-03-10 13:53 - 2016-02-23 14:50 - 00075264 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetCfgNotifyObjectHost.exe 2016-03-10 13:53 - 2016-02-23 14:42 - 00658536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfds.dll 2016-03-10 13:53 - 2016-02-23 14:42 - 00467296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupEngine.dll 2016-03-10 13:53 - 2016-02-23 14:42 - 00078176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupApi.dll 2016-03-10 13:53 - 2016-02-23 14:39 - 02879024 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2016-03-10 13:53 - 2016-02-23 14:38 - 20858360 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll 2016-03-10 13:53 - 2016-02-23 14:35 - 00365568 _____ (Adobe Systems Incorporated) C:\WINDOWS\system32\atmfd.dll 2016-03-10 13:53 - 2016-02-23 14:20 - 00138240 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dfsc.sys 2016-03-10 13:53 - 2016-02-23 14:17 - 00333312 _____ (Microsoft Corporation) C:\WINDOWS\system32\MusUpdateHandlers.dll 2016-03-10 13:53 - 2016-02-23 14:16 - 02237952 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2016-03-10 13:53 - 2016-02-23 14:15 - 00539728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\fontdrvhost.exe 2016-03-10 13:53 - 2016-02-23 14:15 - 00033280 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll 2016-03-10 13:53 - 2016-02-23 13:59 - 00319488 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetworkBindingEngineMigPlugin.dll 2016-03-10 13:53 - 2016-02-23 13:59 - 00104960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rasl2tp.sys 2016-03-10 13:53 - 2016-02-23 13:57 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\system32\NetSetupSvc.dll 2016-03-10 13:53 - 2016-02-23 13:45 - 12504576 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2016-03-10 13:53 - 2016-02-23 13:42 - 00771072 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakradiag.dll 2016-03-10 13:53 - 2016-02-23 13:42 - 00091648 _____ (Microsoft Corporation) C:\WINDOWS\system32\asycfilt.dll 2016-03-10 13:53 - 2016-02-23 13:38 - 02663424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Logon.dll 2016-03-10 13:53 - 2016-02-23 13:37 - 00057344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetCfgNotifyObjectHost.exe 2016-03-10 13:53 - 2016-02-23 13:36 - 00281600 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\NetSetupShim.dll 2016-03-10 13:53 - 2016-02-23 13:25 - 00303104 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\atmfd.dll 2016-03-10 13:53 - 2016-02-23 13:18 - 00031232 _____ (Microsoft Corporation) C:\WINDOWS\system32\seclogon.dll 2016-03-10 13:53 - 2016-02-23 13:17 - 00133120 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser.dll 2016-03-10 13:53 - 2016-02-23 13:17 - 00058368 _____ (Microsoft Corporation) C:\WINDOWS\system32\browcli.dll 2016-03-10 13:53 - 2016-02-23 13:08 - 00081920 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll 2016-03-10 13:53 - 2016-02-23 13:04 - 00225792 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsqmcons.exe 2016-03-10 13:53 - 2016-02-23 13:03 - 00450560 _____ (Microsoft Corporation) C:\WINDOWS\system32\werui.dll 2016-03-10 13:53 - 2016-02-23 13:03 - 00045568 _____ (Adobe Systems) C:\WINDOWS\system32\atmlib.dll 2016-03-10 13:53 - 2016-02-23 13:02 - 03587584 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32kfull.sys 2016-03-10 13:53 - 2016-02-23 12:55 - 19326464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2016-03-10 13:53 - 2016-02-23 12:51 - 00915456 _____ (Microsoft Corporation) C:\WINDOWS\system32\configurationclient.dll 2016-03-10 13:53 - 2016-02-23 12:51 - 00678912 _____ (Microsoft Corporation) C:\WINDOWS\system32\scapi.dll 2016-03-10 13:53 - 2016-02-23 12:46 - 00400384 _____ (Microsoft Corporation) C:\WINDOWS\system32\sharemediacpl.dll 2016-03-10 13:53 - 2016-02-23 12:45 - 01844736 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMPDMC.exe 2016-03-10 13:53 - 2016-02-23 12:45 - 00574464 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakradiag.dll 2016-03-10 13:53 - 2016-02-23 12:45 - 00088576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\olepro32.dll 2016-03-10 13:53 - 2016-02-23 12:45 - 00078848 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\asycfilt.dll 2016-03-10 13:53 - 2016-02-23 12:44 - 01821696 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Logon.dll 2016-03-10 13:53 - 2016-02-23 12:38 - 07524864 _____ (Microsoft Corporation) C:\WINDOWS\system32\Chakra.dll 2016-03-10 13:53 - 2016-02-23 12:29 - 00043520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\browcli.dll 2016-03-10 13:53 - 2016-02-23 12:17 - 00393728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\werui.dll 2016-03-10 13:53 - 2016-02-23 12:17 - 00037376 _____ (Adobe Systems) C:\WINDOWS\SysWOW64\atmlib.dll 2016-03-10 13:53 - 2016-02-23 12:03 - 01495040 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMPDMC.exe 2016-03-10 13:53 - 2016-02-23 12:00 - 11263488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2016-03-10 13:53 - 2016-02-23 12:00 - 05457408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Chakra.dll 2016-03-10 13:53 - 2016-02-23 11:58 - 18800640 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\edgehtml.dll ==================== One Month Modified files and folders ======== (If an entry is included in the fixlist, the file/folder will be moved.) 2016-04-07 18:16 - 2016-03-05 14:35 - 00004162 _____ C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3A17DBC5-3320-4871-9CD1-52CC67C6B158} 2016-04-07 18:10 - 2013-01-29 23:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2016-04-07 18:09 - 2012-01-22 03:01 - 00000000 ____D C:\Users\Rosebud\AppData\Local\PasswordSafe 2016-04-07 18:09 - 2011-03-15 23:36 - 00000924 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2016-04-07 18:07 - 2015-11-09 14:37 - 00000928 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job 2016-04-07 18:07 - 2015-10-21 19:39 - 00000000 ____D C:\Users\Rosebud 2016-04-07 18:05 - 2010-01-12 22:50 - 00000000 ____D C:\ProgramData\Kodak 2016-04-07 18:04 - 2015-07-30 23:52 - 00000006 ____H C:\WINDOWS\Tasks\SA.DAT 2016-04-07 15:52 - 2012-05-04 06:22 - 00000830 _____ C:\WINDOWS\Tasks\Adobe Flash Player Updater.job 2016-04-07 15:47 - 2015-10-22 05:32 - 00000000 ___DC C:\WINDOWS\Panther 2016-04-07 15:42 - 2015-11-09 14:37 - 00000932 _____ C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job 2016-04-07 15:34 - 2011-03-15 23:36 - 00000928 _____ C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2016-04-07 15:27 - 2015-10-04 20:12 - 00000000 ____D C:\Users\Rosebud\AppData\Local\CrashDumps 2016-04-07 14:41 - 2012-07-08 20:08 - 00000000 ____D C:\Caroline 2016-04-07 14:06 - 2015-07-10 11:05 - 00262144 ___SH C:\WINDOWS\system32\config\BBI 2016-04-07 13:29 - 2010-03-06 12:58 - 00000000 ____D C:\Users\Rosebud\AppData\Roaming\Dropbox 2016-04-07 12:40 - 2015-10-21 20:03 - 00955156 _____ C:\WINDOWS\system32\PerfStringBackup.INI 2016-04-07 12:40 - 2015-07-31 00:40 - 00000000 ____D C:\WINDOWS\INF 2016-04-07 12:39 - 2013-08-02 14:06 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trusteer Endpoint Protection 2016-04-07 12:37 - 2016-03-01 22:18 - 00000966 _____ C:\Users\Public\Desktop\Inkscape 0.91.lnk 2016-04-07 12:37 - 2016-01-16 11:20 - 00001824 _____ C:\Users\Public\Desktop\iTunes.lnk 2016-04-07 12:37 - 2015-11-01 09:45 - 00001916 _____ C:\Users\Public\Desktop\QuickTime Player.lnk 2016-04-07 12:37 - 2015-10-21 21:08 - 00002417 _____ C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\OneDrive.lnk 2016-04-07 12:37 - 2015-10-21 21:04 - 00001053 _____ C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Optional Features.lnk 2016-04-07 12:37 - 2015-09-29 20:32 - 00002049 _____ C:\Users\Public\Desktop\Acrobat Reader DC.lnk 2016-04-07 12:37 - 2015-07-10 21:42 - 00001326 _____ C:\Users\Public\Desktop\Freemake Video Converter.lnk 2016-04-07 12:37 - 2015-05-28 12:20 - 00001278 _____ C:\Users\Public\Desktop\Telekom Internet Manager.lnk 2016-04-07 12:37 - 2015-04-10 11:51 - 00001892 _____ C:\Users\Public\Desktop\Garmin Express.lnk 2016-04-07 12:37 - 2015-02-06 15:44 - 00001146 _____ C:\Users\Public\Desktop\Icecream PDF Split and Merge.lnk 2016-04-07 12:37 - 2014-09-09 20:52 - 00001153 _____ C:\Users\Public\Desktop\Mozilla Firefox.lnk 2016-04-07 12:37 - 2014-08-30 14:31 - 00002158 _____ C:\Users\Public\Desktop\KODAK AiO Home Center.lnk 2016-04-07 12:37 - 2014-08-30 14:30 - 00002077 _____ C:\Users\Public\Desktop\Get CleanPrint.lnk 2016-04-07 12:37 - 2012-11-06 11:00 - 00001876 _____ C:\Users\Public\Desktop\PrintProjects.lnk 2016-04-07 12:37 - 2012-03-16 11:34 - 00001131 _____ C:\Users\Public\Desktop\OpenVPN GUI.lnk 2016-04-07 12:37 - 2012-01-23 16:43 - 00002491 _____ C:\Users\Public\Desktop\Safari.lnk 2016-04-07 12:37 - 2011-11-02 17:15 - 00002049 _____ C:\Users\Public\Desktop\TweakNow RegCleaner 2011.lnk 2016-04-07 12:37 - 2011-10-03 11:09 - 00001171 _____ C:\Users\Public\Desktop\WinEdt 6.lnk 2016-04-07 12:36 - 2015-10-06 12:02 - 00001063 _____ C:\Users\Rosebud\Desktop\Notepad++.lnk 2016-04-07 12:36 - 2015-05-28 12:33 - 00001278 _____ C:\Users\Rosebud\Desktop\Telekom Internet Manager.lnk 2016-04-07 12:36 - 2012-11-07 10:27 - 00001800 _____ C:\Users\Rosebud\Desktop\Google Drive.lnk 2016-04-07 12:36 - 2012-01-22 02:58 - 00001036 _____ C:\Users\Rosebud\Desktop\Password Safe.lnk 2016-04-07 12:34 - 2015-09-10 07:42 - 00000000 __RHD C:\Users\Public\AccountPictures 2016-04-07 12:30 - 2015-07-30 23:49 - 00361016 _____ C:\WINDOWS\system32\FNTCACHE.DAT 2016-04-07 12:25 - 2015-07-31 00:42 - 00000000 ____D C:\Program Files\Windows Portable Devices 2016-04-07 12:25 - 2015-07-31 00:42 - 00000000 ____D C:\Program Files\Windows Multimedia Platform 2016-04-07 12:25 - 2015-07-31 00:42 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices 2016-04-07 12:25 - 2015-07-31 00:42 - 00000000 ____D C:\Program Files (x86)\Windows Multimedia Platform 2016-04-07 12:20 - 2015-10-21 19:53 - 00001576 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2016-04-07 12:20 - 2015-09-29 20:32 - 00002457 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk 2016-04-07 12:20 - 2015-09-14 14:37 - 00001024 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla.lnk 2016-04-07 12:20 - 2014-09-02 21:41 - 00001231 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publish or Perish 4.lnk 2016-04-07 12:20 - 2014-02-18 10:34 - 00001104 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 8.lnk 2016-04-07 12:20 - 2012-01-23 16:43 - 00002503 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Safari.lnk 2016-04-07 12:20 - 2011-10-03 11:09 - 00001183 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinEdt 6.lnk 2016-04-07 12:20 - 2011-08-25 18:58 - 00001301 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MATLAB R2011a.lnk 2016-04-07 12:20 - 2011-05-07 12:04 - 00001165 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk 2016-04-07 12:20 - 2011-03-15 23:38 - 00002274 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.lnk 2016-04-07 12:20 - 2010-10-24 14:51 - 00001460 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Mail.lnk 2016-04-07 12:20 - 2010-10-24 14:51 - 00001376 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk 2016-04-07 12:20 - 2010-10-24 14:51 - 00001307 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk 2016-04-07 12:20 - 2010-10-24 14:50 - 00002488 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Messenger.lnk 2016-04-07 12:20 - 2010-01-22 21:22 - 00002535 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk 2016-04-07 12:20 - 2010-01-14 22:37 - 00002088 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PowerDVD DX.lnk 2016-04-07 12:20 - 2010-01-14 21:29 - 00002607 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office Communicator 2007.lnk 2016-04-07 12:20 - 2010-01-11 21:46 - 00001979 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dell Help Documentation.lnk 2016-04-07 12:20 - 2009-12-08 16:26 - 00002675 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Software Updates.lnk 2016-04-07 12:20 - 2009-12-08 16:14 - 00002557 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office PowerPoint Viewer 2007.lnk 2016-04-07 12:07 - 2015-09-14 14:41 - 00000000 ____D C:\Users\Rosebud\AppData\Roaming\FileZilla 2016-04-07 11:55 - 2015-09-14 14:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client 2016-04-07 11:55 - 2015-09-14 14:37 - 00000000 ____D C:\Program Files\FileZilla FTP Client 2016-04-07 11:55 - 2015-07-31 00:42 - 00000000 ____D C:\WINDOWS\AppReadiness 2016-04-07 11:47 - 2015-07-31 00:42 - 00000000 ___HD C:\Program Files\WindowsApps 2016-04-03 14:10 - 2015-07-31 00:42 - 00000000 ____D C:\WINDOWS\rescache 2016-04-03 13:43 - 2015-11-09 14:37 - 00000000 ____D C:\Program Files (x86)\Dropbox 2016-04-03 12:19 - 2015-07-31 00:25 - 00000000 ____D C:\WINDOWS\CbsTemp 2016-03-26 18:13 - 2014-09-09 21:00 - 00000000 __HDC C:\ProgramData\~0 2016-03-23 19:18 - 2015-06-10 21:06 - 00215560 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportHades64.sys 2016-03-23 19:18 - 2011-10-04 10:36 - 00470056 _____ (IBM Corp.) C:\WINDOWS\system32\Drivers\RapportKE64.sys 2016-03-11 08:30 - 2013-08-20 20:32 - 00000000 ____D C:\WINDOWS\system32\MRT 2016-03-10 22:12 - 2010-01-14 22:20 - 143659408 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2016-03-10 21:13 - 2015-10-21 21:00 - 00000000 ____D C:\Users\Rosebud\AppData\Local\Packages 2016-03-08 09:10 - 2015-07-31 00:43 - 00829944 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2016-03-08 09:10 - 2015-07-31 00:43 - 00176632 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl ==================== Files in the root of some directories ======= 2010-01-22 21:05 - 2015-07-16 21:59 - 0000035 _____ () C:\Users\Rosebud\AppData\Roaming\AVSMediaPlayer.m3u 2010-09-23 11:14 - 2010-09-23 11:14 - 0000118 _____ () C:\Users\Rosebud\AppData\Roaming\jahuwaldt.Digitizer.props 2011-10-08 13:03 - 2011-10-08 13:03 - 0000600 _____ () C:\Users\Rosebud\AppData\Roaming\winscp.rnd 2010-10-28 11:58 - 2011-04-03 13:04 - 0060068 _____ () C:\Users\Rosebud\AppData\Local\c4u.log 2010-01-17 22:19 - 2013-03-11 21:33 - 0026112 _____ () C:\Users\Rosebud\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2010-01-12 22:48 - 2011-04-03 13:03 - 0176334 _____ () C:\Users\Rosebud\AppData\Local\installer.log 2011-10-08 13:03 - 2011-10-08 14:21 - 0000600 _____ () C:\Users\Rosebud\AppData\Local\PUTTY.RND 2016-03-05 14:42 - 2016-03-05 14:42 - 0001218 _____ () C:\Users\Rosebud\AppData\Local\recently-used.xbel 2012-11-16 16:28 - 2014-01-29 22:53 - 0007601 _____ () C:\Users\Rosebud\AppData\Local\Resmon.ResmonCfg 2011-06-09 11:26 - 2011-06-09 11:26 - 0000000 _____ () C:\Users\Rosebud\AppData\Local\{6D9B0A85-4F09-49B7-961C-5A2590D2ED54} 2011-10-27 10:36 - 2011-10-27 10:38 - 0000000 _____ () C:\Users\Rosebud\AppData\Local\{C8106061-8F81-4F39-B245-E381C81629F2} 2011-10-05 08:48 - 2011-10-05 08:48 - 0000000 _____ () C:\Users\Rosebud\AppData\Local\{FDAAE0E8-FCCE-481A-878C-A292B2F1139F} 2010-11-15 15:08 - 2010-11-15 15:08 - 0000056 ____H () C:\ProgramData\ezsidmv.dat Some files in TEMP: ==================== C:\Users\Rosebud\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpunhl1_.dll C:\Users\Rosebud\AppData\Local\Temp\SkypeSetup.exe C:\Users\Rosebud\AppData\Local\Temp\VideoConverter.exe ==================== Bamital & volsnap ================= (There is no automatic fix for files that do not pass verification.) C:\WINDOWS\system32\winlogon.exe => File is digitally signed C:\WINDOWS\system32\wininit.exe => File is digitally signed C:\WINDOWS\explorer.exe => File is digitally signed C:\WINDOWS\SysWOW64\explorer.exe => File is digitally signed C:\WINDOWS\system32\svchost.exe => File is digitally signed C:\WINDOWS\SysWOW64\svchost.exe => File is digitally signed C:\WINDOWS\system32\services.exe => File is digitally signed C:\WINDOWS\system32\User32.dll => File is digitally signed C:\WINDOWS\SysWOW64\User32.dll => File is digitally signed C:\WINDOWS\system32\userinit.exe => File is digitally signed C:\WINDOWS\SysWOW64\userinit.exe => File is digitally signed C:\WINDOWS\system32\rpcss.dll => File is digitally signed C:\WINDOWS\system32\dnsapi.dll => File is digitally signed C:\WINDOWS\SysWOW64\dnsapi.dll => File is digitally signed C:\WINDOWS\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2016-04-02 21:51 ==================== End of FRST.txt ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version:05-03-2016 01 Ran by Rosebud (2016-04-07 18:25:29) Running from C:\Users\Rosebud\Desktop Windows 10 Home (X64) (2015-10-21 18:59:31) Boot Mode: Normal ========================================================== ==================== Accounts: ============================= Administrator (S-1-5-21-2778284475-3753871239-3632022125-500 - Administrator - Disabled) DefaultAccount (S-1-5-21-2778284475-3753871239-3632022125-503 - Limited - Disabled) Guest (S-1-5-21-2778284475-3753871239-3632022125-501 - Limited - Disabled) HomeGroupUser$ (S-1-5-21-2778284475-3753871239-3632022125-1002 - Limited - Enabled) Rosebud (S-1-5-21-2778284475-3753871239-3632022125-1000 - Administrator - Enabled) => C:\Users\Rosebud ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== (Only the adware programs with "Hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Adobe Acrobat Reader DC (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}) (Version: 15.010.20060 - Adobe Systems Incorporated) Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated) Adobe Flash Player 21 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 21.0.0.197 - Adobe Systems Incorporated) Advanced Audio FX Engine (HKLM-x32\...\Advanced Audio FX Engine) (Version: 1.12.05 - Creative Technology Ltd) aioprnt (Version: 5.3.1.0 - Eastman Kodak Company) Hidden aioscnnr (x32 Version: 6.2.3.10 - Your Company Name) Hidden aioscnnr (x32 Version: 7.6.13.10 - Your Company Name) Hidden ANT Drivers Installer x64 (Version: 2.3.4 - Garmin Ltd or its subsidiaries) Hidden Apple Application Support (32-bit) (HKLM-x32\...\{7FA9ECCF-A2DE-4DA1-BFF3-81260DBDA68F}) (Version: 4.1.2 - Apple Inc.) Apple Application Support (64-bit) (HKLM\...\{691F30EB-9009-475A-B8A9-E1BF39598FD5}) (Version: 4.1.2 - Apple Inc.) Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.) Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.) AVS Media Player 3.1 (HKLM-x32\...\AVS Media Player_is1) (Version: - Online Media Technologies Ltd.) AVS Update Manager 1.0 (HKLM-x32\...\AVS Update Manager_is1) (Version: - Online Media Technologies Ltd.) AVS Video Converter 6 (HKLM-x32\...\AVS4YOU Video Converter 6_is1) (Version: - Online Media Technologies Ltd.) AVS4YOU Software Navigator 1.3 (HKLM-x32\...\AVS4YOU Software Navigator_is1) (Version: - Online Media Technologies Ltd.) Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.) C4USelfUpdater (x32 Version: 1.00.0000 - Your Company Name) Hidden center (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden Cisco EAP-FAST Module (HKLM-x32\...\{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}) (Version: 2.2.14 - Cisco Systems, Inc.) Cisco LEAP Module (HKLM-x32\...\{51C7AD07-C3F6-4635-8E8A-231306D810FE}) (Version: 1.0.19 - Cisco Systems, Inc.) Cisco PEAP Module (HKLM-x32\...\{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}) (Version: 1.1.6 - Cisco Systems, Inc.) Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Dell DataSafe Local Backup - Support Software (HKLM-x32\...\{A9668246-FB70-4103-A1E3-66C9BC2EFB49}) (Version: 2.31 - Dell) Dell DataSafe Local Backup (HKLM-x32\...\{0ED7EE95-6A97-47AA-AD73-152C08A15B04}) (Version: 9.3.44 - Dell) Dell Dock (HKLM\...\{E60B7350-EA5F-41E0-9D6F-E508781E36D2}) (Version: 2.0.0 - Dell) Dell Driver Download Manager (HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\f031ef6ac137efc5) (Version: 2.1.0.0 - Dell Inc.) Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc) Dell Getting Started Guide (HKLM-x32\...\{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}) (Version: 1.00.0000 - Dell Inc.) Dell Touchpad (HKLM\...\{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}) (Version: 7.104.115.102 - Alps Electric) Dell Webcam Central (HKLM-x32\...\Dell Webcam Central) (Version: 1.40.05 - Creative Technology Ltd) Dell Wireless WLAN Card Utility (HKLM\...\Dell Wireless WLAN Card Utility) (Version: 5.30.21.0 - Dell Inc.) Dropbox (HKLM-x32\...\Dropbox) (Version: 3.16.1 - Dropbox, Inc.) Dropbox Update Helper (x32 Version: 1.3.27.37 - Dropbox, Inc.) Hidden Elevated Installer (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden EndNote X3 (HKLM-x32\...\{86B3F2D6-AC2B-4E88-8AE1-F2F77F781B0C}) (Version: 13.0.0.4094 - Thomson Reuters) EPSON XP-205 207 Series Printer Uninstall (HKLM\...\EPSON XP-205 207 Series) (Version: - SEIKO EPSON Corporation) essentials (x32 Version: 7.8.0.0 - Eastman Kodak Company) Hidden FileZilla Client 3.16.1 (HKLM-x32\...\FileZilla Client) (Version: 3.16.1 - Tim Kosse) FilmStar 32-bit (HKLM-x32\...\FilmStar 32-bit) (Version: - ) Freemake Video Converter version 4.1.6 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.6 - Ellora Assets Corporation) Garmin Express (HKLM-x32\...\{50755d67-ae60-4e47-b3d6-ce44d01b5a95}) (Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Garmin Express (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden Garmin Express Tray (x32 Version: 4.0.15.0 - Garmin Ltd or its subsidiaries) Hidden Google Chrome (HKLM-x32\...\Google Chrome) (Version: 49.0.2623.110 - Google Inc.) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.29.5 - Google Inc.) Hidden Icecream PDF Split and Merge version 1.07 (HKLM-x32\...\{95DC4DB4-99FB-4FB2-ADBD-97F194EDEB4D}_is1) (Version: 1.07 - Icecream Apps) iCloud (HKLM\...\{4B48E22A-2FB0-4EFA-B99E-954B1E50CD69}) (Version: 5.1.0.34 - Apple Inc.) IDT Audio (HKLM-x32\...\{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}) (Version: 1.0.6255.0 - IDT) ImageJ 1.44p (HKLM-x32\...\ImageJ_is1) (Version: - NIH) Inkscape 0.91 (HKLM\...\{81922150-317E-4BB0-A31D-FF1C14F707C5}) (Version: 0.91 - inkscape.org) Intel(R) Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation) Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 10.5.0.1029 - Intel Corporation) Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation) iTunes (HKLM\...\{FBEB98F8-64E4-4FA3-A15E-4A9F42FF962E}) (Version: 12.3.2.35 - Apple Inc.) Java 7 Update 21 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417021FF}) (Version: 7.0.210 - Oracle) Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle) Java(TM) 6 Update 14 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86416014FF}) (Version: 6.0.140 - Sun Microsystems, Inc.) Java(TM) 6 Update 29 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216014FF}) (Version: 6.0.290 - Sun Microsystems, Inc.) Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Kodak AIO Printer (Version: 7.8.1.0 - Eastman Kodak Company) Hidden KODAK AiO Software (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.8.5.2 - Eastman Kodak Company) ksDIP (x32 Version: 3.20.0000.0000 - Eastman Kodak Company) Hidden Live! Cam Avatar Creator (HKLM-x32\...\{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}) (Version: 4.6.3009.1 - Creative Technology Ltd) Malwarebytes Anti-Malware version 2.2.1.1043 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes) MATLAB R2011a (HKLM\...\MatlabR2011a) (Version: 7.12 - The MathWorks, Inc.) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.11.309.1 - McAfee, Inc.) Mendeley Desktop 1.0.1 (HKLM-x32\...\Mendeley Desktop) (Version: 1.0.1 - Mendeley Ltd.) Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office Communicator 2007 (HKLM-x32\...\{E5BA0430-919F-46DD-B656-0796F8A5ADFF}) (Version: 2.0.6362.0 - Microsoft Corporation) Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Professional Plus 2007 (HKLM-x32\...\PROPLUSR) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.41212.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.21005 (HKLM-x32\...\{ce085a78-074e-4823-8dc1-8a721b94b76d}) (Version: 12.0.21005.1 - Microsoft Corporation) Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.) MiKTeX 2.9 (HKLM-x32\...\MiKTeX 2.9) (Version: 2.9 - MiKTeX.org) Motorola Mobile Drivers Installation 5.4.0 (HKLM\...\{B0C6CCC9-0BAB-4636-A06F-B43B6FBC25DF}) (Version: 5.4.0 - Motorola Inc.) Mozilla Firefox 45.0.1 (x86 en-GB) (HKLM-x32\...\Mozilla Firefox 45.0.1 (x86 en-GB)) (Version: 45.0.1 - Mozilla) Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 45.0.1.5918 - Mozilla) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) My Dell (HKLM\...\PC-Doctor for Windows) (Version: 3.5.6426.22 - PC-Doctor, Inc.) Notepad++ (HKLM-x32\...\Notepad++) (Version: 6.8.3 - Notepad++ Team) ocr (x32 Version: 6.2.3.50 - Eastman Kodak Company) Hidden OpenVPN 2.2.2 (HKLM-x32\...\OpenVPN) (Version: 2.2.2 - ) Password Safe (HKLM-x32\...\Password Safe) (Version: - ) PowerDVD DX (HKLM-x32\...\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}) (Version: 8.3.5424 - CyberLink Corp.) PreReq (x32 Version: 6.2.4.0 - Eastman Kodak Company) Hidden PrimoPDF -- brought to you by Nitro PDF Software (HKLM-x32\...\PrimoPDF) (Version: 5 - Nitro PDF Software) PrintProjects (HKLM-x32\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.) Quickset64 (HKLM\...\{87CF757E-C1F1-4D22-865C-00C6950B5258}) (Version: 9.6.6 - Dell Inc.) QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.) Rapport (Version: 3.5.1205.12 - Trusteer) Hidden Rapport (x32 Version: 3.5.1609.47 - Trusteer) Hidden ResearchSoft Direct Export Helper (HKLM-x32\...\ResearchSoft Direct Export Helper) (Version: - ) Safari (HKLM-x32\...\{FA4C2D53-205F-4245-9717-F3761154824D}) (Version: 5.34.57.2 - Apple Inc.) SigmaPlot 8.0 (HKLM-x32\...\{7DA83DDA-0EB0-11D6-A937-00C04F091145}) (Version: - ) Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.9.12585 - Skype Technologies S.A.) Skype™ 7.0 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 7.0.102 - Skype Technologies S.A.) Software Updater (HKLM-x32\...\{8DBC5A0A-31C4-46C7-B252-6B593EA11A87}) (Version: 4.3.7 - SEIKO EPSON CORPORATION) TeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.26038 - TeamViewer) Telekom Internet Manager (HKLM-x32\...\Telekom Internet Manager) (Version: 11.301.05.05.748 - Huawei Technologies Co.,Ltd) Trusteer Endpoint Protection (HKLM-x32\...\Rapport_msi) (Version: 3.5.1609.47 - Trusteer) TweakNow RegCleaner 2011 (HKLM-x32\...\TweakNow RegCleaner 2011_is1) (Version: 6.4.5 - TweakNow.com) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-0011-0000-0000-0000000FF1CE}_PROPLUSR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Veetle TV 0.9.18 (HKLM-x32\...\Veetle TV) (Version: 0.9.18 - Veetle, Inc) Windows Driver Package - Dynastream Innovations, Inc. ANT LibUSB Drivers (04/11/2012 1.2.40.201) (HKLM\...\F9D2A789F9CFF8CEC36B544F53877C80F1F73C46) (Version: 04/11/2012 1.2.40.201 - Dynastream Innovations, Inc.) Windows Driver Package - Silicon Labs Software (DSI_SiUSBXp_3_1) USB (02/06/2007 3.1) (HKLM\...\D1506E0025B5A3F9EB8270FE81C1EEDD9388B8A2) (Version: 02/06/2007 3.1 - Silicon Labs Software) Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation) WinEdt 6 (HKLM-x32\...\WinEdt 6) (Version: 6.0 - WinEdt Team) WinRAR 4.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 4.01.0 - win.rar GmbH) ==================== Custom CLSID (Whitelisted): ========================== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) CustomCLSID: HKU\S-1-5-21-2778284475-3753871239-3632022125-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\localserver32 -> C:\Users\Rosebud\AppData\Local\Microsoft\OneDrive\17.3.6302.0225\FileCoAuth.exe (Microsoft Corporation) ==================== Scheduled Tasks (Whitelisted) ============= (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) Task: {0098B7F8-131A-4321-BA86-57C0AC9E8658} - System32\Tasks\Microsoft\Windows\Media Center\PeriodicScanRetry => C:\Windows\ehome\MCUpdate.exe Task: {034A6DFF-BD7F-42C9-A5CA-E14EF30F5954} - System32\Tasks\{A0F45334-1D54-40F7-BADB-FEB38722BCD6} => Firefox.exe hxxp://ui.skype.com/ui/0/6.0.0.126/en/go/help.faq.installer?LastError=1618 Task: {067CFB1F-D353-4626-8EE1-FF42FDB610B9} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW1 => C:\Windows\ehome\ehPrivJob.exe Task: {0796CC1F-4FE1-4D4C-B642-C7AA5EF9EEE7} - System32\Tasks\Microsoft\Windows\Media Center\OCURDiscovery => C:\Windows\ehome\ehPrivJob.exe Task: {08C05DCB-4577-49DE-BAC6-D30CCB68F23D} - \Microsoft\Windows\Setup\GWXTriggers\Time-5d -> No File <==== ATTENTION Task: {0EF1C7FB-AD58-4B17-8C17-048FF8221798} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-12-14] (Adobe Systems Incorporated) Task: {129CD992-5BBE-43F2-A1D5-12B939B14CD5} - System32\Tasks\Microsoft\Windows\Media Center\RegisterSearch => C:\Windows\ehome\ehPrivJob.exe Task: {13152401-706A-4512-A714-F92522D538F9} - System32\Tasks\DropboxUpdateTaskMachineCore => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-11-09] (Dropbox, Inc.) Task: {1A43BC67-DA8B-4215-804E-0883EE3CB754} - System32\Tasks\Microsoft\Windows\Media Center\ConfigureInternetTimeService => C:\Windows\ehome\ehPrivJob.exe Task: {2409048A-609D-483F-AE6E-87DD9D56A998} - System32\Tasks\Microsoft\Windows\Media Center\RecordingRestart => C:\Windows\ehome\ehrec.exe Task: {25AA35B0-17A6-4D53-9812-50CACBF1FE00} - \Microsoft\Windows\Setup\GWXTriggers\Logon-5d -> No File <==== ATTENTION Task: {26D035EA-1933-4C52-BCF0-FD0169C96F43} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-29] (Google Inc.) Task: {2805566E-76C0-4A30-BCF8-88EE0D83AF12} - System32\Tasks\Microsoft\Windows\Media Center\StartRecording => C:\Windows\ehome\ehrec.exe Task: {2C649B99-B92F-465E-84FC-B8517A2D33FD} - System32\Tasks\Microsoft\Windows\Media Center\ActivateWindowsSearch => C:\Windows\ehome\ehPrivJob.exe Task: {3A219264-7C8A-42DC-97FD-1A5571E20708} - \Microsoft\Windows\Setup\gwx\refreshgwxcontent -> No File <==== ATTENTION Task: {44D58D9F-EC2E-409C-9898-51504F07037B} - System32\Tasks\Microsoft\Windows\Media Center\SqlLiteRecoveryTask => C:\Windows\ehome\mcupdate.exe Task: {5097E0CA-BE41-496E-B6B4-E0F066CE750F} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscoveryW2 => C:\Windows\ehome\ehPrivJob.exe Task: {52C2CEBB-3590-408B-AA5E-38A1E6762845} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-29] (Google Inc.) Task: {53F9FA69-39AF-4436-95CF-3A3D09641323} - System32\Tasks\{B0A28BCF-105A-4BDC-B98B-846B2036152D} => C:\Program Files (x86)\Skype\\Phone\Skype.exe [2014-12-11] (Skype Technologies S.A.) Task: {5BE3B602-E01E-4B1B-8908-12E8A068F8D1} - \Microsoft\Windows\Setup\gwx\refreshgwxconfig -> No File <==== ATTENTION Task: {5D5C0AB1-AA2D-4F60-B6E5-5590AABEFA48} - System32\Tasks\Microsoft\Windows\Media Center\OCURActivate => C:\Windows\ehome\ehPrivJob.exe Task: {5F8CC3CE-B482-46A8-B4CE-C50D5D78DD6C} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2016-03-10] (Microsoft Corporation) Task: {60F50F98-9525-47BF-B2D8-9A3784441671} - System32\Tasks\{C810A043-8DDA-45EB-BECF-2A11FDB10552} => pcalua.exe -a "E:\COSMOS\Website\Offline Site Development\dsl-win-v380\Install DSL v380.exe" -d "E:\COSMOS\Website\Offline Site Development\dsl-win-v380" Task: {63FE4042-FEAD-4786-A623-B0245B2AFC44} - \Microsoft\Windows\Setup\gwx\launchtrayprocess -> No File <==== ATTENTION Task: {6AC1E7BD-18EC-4940-A618-AFAC30D64AD7} - \Microsoft\Windows\Setup\gwx\refreshgwxconfigandcontent -> No File <==== ATTENTION Task: {7A66CEB3-F811-4EBD-A80C-2B8E1C30DD69} - \Microsoft\Windows\Setup\GWXTriggers\MachineUnlock-5d -> No File <==== ATTENTION Task: {81BE3181-D6B5-4ED4-B7AA-00F404C11B37} - System32\Tasks\Microsoft\Windows\Media Center\DispatchRecoveryTasks => C:\Windows\ehome\ehPrivJob.exe Task: {8F6B1880-D49C-4068-91A2-6697ECA053AC} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.) Task: {927001DC-0D0B-4E64-A812-A865C22F578E} - System32\Tasks\GarminUpdaterTask => C:\Program Files (x86)\Garmin\Express Self Updater\ExpressSelfUpdater.exe Task: {935A6283-4F4A-4175-A3B5-479B5F7B5CF2} - \Microsoft\Windows\Setup\GWXTriggers\refreshgwxconfig-B -> No File <==== ATTENTION Task: {991EC07A-6C22-489B-A6EA-3F32357F2051} - System32\Tasks\Microsoft\Windows\Media Center\ReindexSearchRoot => C:\Windows\ehome\ehPrivJob.exe Task: {A41A8353-6B3E-4A75-AEFF-71FBF1DF4028} - \PCDoctorBackgroundMonitorTask -> No File <==== ATTENTION Task: {A8D64032-4F4D-446F-A722-2234F6DBAE5B} - \PCDEventLauncherTask -> No File <==== ATTENTION Task: {A9A6C089-1578-4F1F-8FD2-489E12858F65} - \Microsoft\Windows\Setup\GWXTriggers\OutOfIdle-5d -> No File <==== ATTENTION Task: {AEA935D9-F4FC-4F9B-A801-0CF0BB9718BE} - \SystemToolsDailyTest -> No File <==== ATTENTION Task: {B2732475-6458-4120-9BD8-C9949A35E5DA} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2016-04-02] (Adobe Systems Incorporated) Task: {B7C8ABB6-BC05-4253-BFF6-6B367762BF65} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate => C:\Windows\ehome\mcupdate.exe Task: {BBD9B359-9279-4334-8A39-215FE1AC4A53} - \Microsoft\Windows\Setup\GWXTriggers\OutOfSleep-5d -> No File <==== ATTENTION Task: {C02F3B0C-DDD5-4AFC-8D8D-30C15C313238} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe Task: {C2DF9C68-2E07-44AD-A951-E550062CECDE} - System32\Tasks\Microsoft\Windows\Media Center\MediaCenterRecoveryTask => C:\Windows\ehome\mcupdate.exe Task: {C9AC1370-0BA7-4793-8D27-82239F9C3C66} - System32\Tasks\Microsoft\Windows\Media Center\PvrRecoveryTask => C:\Windows\ehome\mcupdate.exe Task: {CB0D2A25-1318-4F23-9E83-52BDF907D6ED} - System32\Tasks\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask => C:\Windows\ehome\mcupdate.exe Task: {CE18ECF5-0BED-4AF0-B7AE-D9CAFEC4C7E6} - System32\Tasks\Microsoft\Windows\Media Center\ehDRMInit => C:\Windows\ehome\ehPrivJob.exe Task: {D320FD39-B399-4751-A8C4-67B3831AFDBA} - System32\Tasks\Microsoft\Windows\Media Center\InstallPlayReady => C:\Windows\ehome\ehPrivJob.exe Task: {D39A3699-EF5F-429F-BA22-9E2B627CB406} - System32\Tasks\DropboxUpdateTaskMachineUA => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe [2015-11-09] (Dropbox, Inc.) Task: {D40A9373-D6CA-4D6C-88A5-20C333F63CB8} - \Microsoft\Windows\Setup\GWXTriggers\Telemetry-4xd -> No File <==== ATTENTION Task: {D467F90D-2418-4B45-AB12-A62D2F28058A} - System32\Tasks\Microsoft\Windows\Media Center\UpdateRecordPath => C:\Windows\ehome\ehPrivJob.exe Task: {DCDC4774-5EA8-4B47-91CA-CAF5A8C389F1} - System32\Tasks\Apple Diagnostics => C:\Program Files (x86)\Common Files\Apple\Internet Services\EReporter.exe [2015-12-01] (Apple Inc.) Task: {EDFCCBF7-1F5D-4285-B852-00DACB0541A2} - System32\Tasks\DCTN02K1\Administrator - Start WLAN Tray Applet => C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRAY.EXE [2009-07-17] (Dell Inc.) Task: {F352A09E-179F-4880-A2DE-829F01B450A2} - System32\Tasks\Microsoft\Windows\Media Center\PBDADiscovery => C:\Windows\ehome\ehPrivJob.exe Task: {F5482B7C-6E07-4D63-B9F9-487ABB61B80B} - System32\Tasks\Microsoft\Windows\Media Center\PvrScheduleTask => C:\Windows\ehome\mcupdate.exe (If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.) Task: C:\WINDOWS\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineCore.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\DropboxUpdateTaskMachineUA.job => C:\Program Files (x86)\Dropbox\Update\DropboxUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Shortcuts ============================= (The entries could be listed to be restored or removed.) ==================== Loaded Modules (Whitelisted) ============== 2015-07-10 05:33 - 2015-07-10 05:33 - 00028160 _____ () C:\WINDOWS\SYSTEM32\efsext.dll 2015-09-10 07:08 - 2015-09-10 07:08 - 00032768 _____ () C:\WINDOWS\SYSTEM32\licensemanagerapi.dll 2010-10-18 11:07 - 2009-12-21 03:42 - 00090624 _____ () C:\WINDOWS\System32\Primomonnt.dll 2015-09-10 07:08 - 2015-09-10 07:08 - 00404480 _____ () C:\WINDOWS\System32\diagtrack_wininternal.dll 2015-10-13 06:45 - 2015-10-13 06:45 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll 2015-10-13 06:45 - 2015-10-13 06:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll 2010-08-19 10:52 - 2010-08-19 10:52 - 00229376 _____ () C:\ProgramData\DatacardService\DCService.exe 2009-12-08 16:11 - 2009-07-17 03:06 - 00033280 _____ () C:\Program Files\Dell\Dell Wireless WLAN Card\WLTRYSVC.EXE 2009-12-08 16:11 - 2009-07-17 03:06 - 00058368 _____ () C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlrmt.dll 2015-10-22 05:27 - 2015-10-22 05:27 - 02494712 _____ () C:\WINDOWS\system32\CoreUIComponents.dll 2015-10-22 05:27 - 2015-10-22 05:27 - 02494712 _____ () C:\WINDOWS\System32\CoreUIComponents.dll 2016-03-16 12:17 - 2016-03-16 12:17 - 00052912 _____ () C:\Program Files\FileZilla FTP Client\fzshellext_64.dll 2011-08-21 17:06 - 2011-05-28 23:05 - 00164864 _____ () C:\Program Files\WinRAR\rarext.dll 2015-10-22 05:27 - 2015-10-22 05:27 - 00429056 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\QuickActions.dll 2015-07-10 05:13 - 2015-07-10 05:13 - 00143360 _____ () C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\XamlTileRendering.dll 2016-01-16 11:58 - 2015-11-25 06:20 - 06569472 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\CortanaApi.dll 2016-01-16 11:57 - 2015-11-25 06:17 - 00471040 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core.dll 2016-01-16 11:57 - 2015-11-25 06:17 - 01808384 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.BackgroundTask.dll 2015-10-22 05:27 - 2015-10-22 05:27 - 02274816 _____ () C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\RemindersUI.dll 2015-07-10 21:42 - 2015-06-18 12:22 - 00062464 _____ () C:\Program Files (x86)\Common Files\Freemake Shared\ProductUpdater\ProductUpdater.exe 2015-07-10 05:16 - 2015-07-10 06:39 - 00215352 _____ () c:\windows\system32\WerEtw.dll 2009-12-08 16:15 - 2009-09-17 21:05 - 00128240 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\STLog.dll 2009-12-08 16:15 - 2009-09-17 21:04 - 00115952 ____N () C:\Program Files (x86)\Dell DataSafe Local Backup\PSTVdsDisk.dll 2015-10-13 06:46 - 2015-10-13 06:46 - 01040144 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2014-02-06 01:52 - 2014-02-06 01:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2015-10-13 06:45 - 2015-10-13 06:45 - 00237328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxslt.dll 2015-06-02 14:51 - 2015-06-02 14:51 - 00545792 _____ () C:\Program Files (x86)\Trusteer\Rapport\bin\js32.dll ==================== Alternate Data Streams (Whitelisted) ========= (If an entry is included in the fixlist, only the ADS will be removed.) ==================== Safe Mode (Whitelisted) =================== (If an entry is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver" HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver" ==================== EXE Association (Whitelisted) =============== (If an entry is included in the fixlist, the registry item will be restored to default or removed.) ==================== Internet Explorer trusted/restricted =============== (If an entry is included in the fixlist, it will be removed from the registry.) ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2009-07-14 04:34 - 2016-04-07 13:49 - 00001041 ____A C:\WINDOWS\system32\Drivers\etc\hosts 127.0.0.1 www.cosmos.dev 0.0.0.1 mssplus.mcafee.com ==================== Other Areas ============================ (Currently there is no automatic fix for this section.) HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Rosebud\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper DNS Servers: 192.168.2.103 HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1) Windows Firewall is enabled. ==================== MSCONFIG/TASK MANAGER disabled items == (Currently there is no automatic fix for this section.) HKLM\...\StartupApproved\Run: => "SysTrayApp" HKLM\...\StartupApproved\Run: => "iTunesHelper" HKLM\...\StartupApproved\Run32: => "APSDaemon" HKLM\...\StartupApproved\Run32: => "PDVDDXSrv" HKLM\...\StartupApproved\Run32: => "Desktop Disc Tool" HKLM\...\StartupApproved\Run32: => "Dropbox" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\StartupApproved\StartupFolder: => "Dell Dock.lnk" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\StartupApproved\StartupFolder: => "Dropbox.lnk" HKU\S-1-5-21-2778284475-3753871239-3632022125-1000\...\StartupApproved\StartupFolder: => "Netzmanager.lnk" ==================== FirewallRules (Whitelisted) =============== (If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.) FirewallRules: [vm-monitoring-nb-session] => (Allow) LPort=139 FirewallRules: [{281FA80D-89E9-4CE0-B72D-7CE631AF36D1}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{A01370A8-0F31-441B-8C09-1798A8B74C44}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{6B4C3263-F53D-47CB-BAEB-30A00DE96F13}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe FirewallRules: [{E3DC3C07-6077-4851-BC8C-9FF952974BD8}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe FirewallRules: [{C0AAAF40-060C-4DCB-ADE6-9F4642DE7FBD}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe FirewallRules: [{E1BE07A6-DFFE-4F20-A342-EC916AAC3437}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe FirewallRules: [{1921E10A-2938-422B-B382-7669EA277FDE}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe FirewallRules: [{4B185433-FDF3-4575-ADC5-741AD3323193}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe FirewallRules: [{93144161-E82E-4023-88F2-4043EE20E92B}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe FirewallRules: [{E5CC1F2E-49B4-4EB6-916D-F0B972230623}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe FirewallRules: [{7E7F6C5E-A98B-4F96-8219-37C610B9C733}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe FirewallRules: [{5121145A-BF84-42E9-A0D5-48B349C920DD}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe FirewallRules: [{895E3B75-BB99-4353-B1B8-B3AF9DE8A1A7}] => (Allow) LPort=9322 FirewallRules: [{ABA6340C-8BE3-418D-8AE5-970F89C0AD09}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe FirewallRules: [{A6F62C82-EA5A-4FF1-9DA8-6DAE740B0930}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe FirewallRules: [{B392DF5E-3422-4EF9-BBAE-D9007B9EAAD7}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe FirewallRules: [{1AFB05DA-26CD-40B5-AAD5-BC8CEA9366F5}] => (Allow) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe FirewallRules: [{68CDEE1E-23C6-40C7-BFEA-2D53438D5094}] => (Allow) LPort=5353 FirewallRules: [{68C7A28A-EE7B-4031-AE30-97D64FC7C4DB}] => (Allow) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe FirewallRules: [{89320EDE-F162-4830-AC97-492E9184ADAA}] => (Allow) C:\Program Files (x86)\SweetIM\Communicator\SweetPacksUpdateManager.exe FirewallRules: [{0462F10B-AA17-441F-9B9B-644ACA53CCDC}] => (Allow) C:\Windows\SysWOW64\msiexec.exe FirewallRules: [{B24C0AEF-0E44-449F-9D51-D69238F5F5CE}] => (Allow) C:\Windows\SysWOW64\msiexec.exe FirewallRules: [{E29C825F-067F-47C1-BA33-053F9DCA9C4C}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe FirewallRules: [{A9FDA66E-431F-4EAD-9CFF-C336D63EFAD3}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe FirewallRules: [{625D6B76-0362-427D-AF36-CB189CE6FA48}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe FirewallRules: [{6CB49AF9-2FA7-4E81-BD08-A73F5D10C719}] => (Allow) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer.exe FirewallRules: [{93036CEF-C5FF-4040-A785-828C1F9A5EC2}] => (Allow) C:\Users\Rosebud\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe FirewallRules: [{3B9275BC-DDB8-44CB-8719-268FC193892B}] => (Allow) C:\Users\Rosebud\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe FirewallRules: [{91517D64-FF44-4589-ABE5-95416284C4F5}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe FirewallRules: [{91AEF478-C8A1-4335-8E5E-FD4D5B47CCA1}] => (Allow) C:\ProgramData\Kodak\Installer\Setup.exe FirewallRules: [{2B635701-A7EC-43D4-830E-45061B5C5915}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe FirewallRules: [{3B069B2E-E471-46CC-B4F7-B78F8BD15254}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Firmware\KodakAiOUpdater.exe FirewallRules: [{5FEF79B2-5E5F-40D4-9C0A-CF51A3150D8F}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe FirewallRules: [{B3A766CD-927D-40FE-A16F-BA6A4BB2D167}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\NetworkPrinterDiscovery.exe FirewallRules: [{C70F623D-F28A-49C7-96FF-5358F8485932}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe FirewallRules: [{BCBD78EA-3867-4480-B87F-0335AA90F6D4}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\Kodak.Statistics.exe FirewallRules: [{23D54D7A-BC1D-43E8-A08F-945CD4B66C7E}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe FirewallRules: [{1B6928A0-9A55-4BDC-87C6-F1C7BB5C4355}] => (Allow) C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe FirewallRules: [{EEB83E30-B25F-44E3-BD34-A71D8D2345DB}] => (Allow) LPort=9322 FirewallRules: [{81CED988-BCCD-4C78-8C77-B6A2D9114AEE}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{4AD4A14B-5833-418D-990D-A0338F288DF3}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{07497436-C7D2-4FE7-BACD-652A784FAD72}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{05B2DBCD-1B90-43A1-91E1-B0399309E85D}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{8CB80A13-9449-4B01-B4AA-7A8FCF9F83A1}] => (Allow) LPort=5353 FirewallRules: [{A14B1C34-6E46-4025-B6B8-A15C0216E290}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe FirewallRules: [{D8F53177-B1A7-4139-8512-37118269F98D}] => (Allow) LPort=1900 FirewallRules: [{7C9E0D92-83D3-4D09-AAB1-BC0A022E0A3D}] => (Allow) LPort=2869 FirewallRules: [{231704F8-232B-411C-90BB-6E6DF05737F7}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe FirewallRules: [{B8AF602E-861B-42E1-84D0-EB7AF6B3CC44}] => (Allow) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe FirewallRules: [{48CA801B-DC20-4B6D-98EA-5C66A52744D4}] => (Allow) C:\Program Files (x86)\TeamViewer\Version5\TeamViewer.exe FirewallRules: [{16443398-1BFA-41DC-907B-D51749D6E979}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe FirewallRules: [{6497D47E-56A3-4E8A-87CC-B999B4663E07}] => (Allow) C:\Program Files (x86)\CyberLink\PowerDVD DX\PowerDVD.exe FirewallRules: [{CD7386BE-4BFE-434E-A513-739819E80636}] => (Allow) C:\Program Files (x86)\Windows Live\Sync\WindowsLiveSync.exe FirewallRules: [{44BD437A-0B52-40AF-BC11-B86D0B42F8D2}] => (Allow) svchost.exe FirewallRules: [{4FBAE9B4-AF49-43CE-87C6-1B7E6456DCA5}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe FirewallRules: [{A3B6587C-0ABA-4939-83B9-415DF5E402D8}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{FDBFBDFD-E57F-4CAA-BE22-945327FE01C6}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe FirewallRules: [{C8FDC2D9-E6C8-4B59-AF2E-E747890CC098}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{391693E4-F923-425F-9128-DC535DF63BB9}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe FirewallRules: [{B34D5FD0-CACC-4C42-B910-06111E7B7B4F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{CFF3F35E-D41B-4AE4-904A-50337A8F433F}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe FirewallRules: [{78DD70A8-28A2-47A9-8A4F-9267B2FBF461}] => (Allow) C:\Program Files\iTunes\iTunes.exe FirewallRules: [{0BB80E13-12D1-430E-BA74-4ECB74465EE3}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe FirewallRules: [{3D0BE540-C1BF-42AE-BB03-1F0F9266F5DD}] => (Allow) C:\Program Files (x86)\Dropbox\Client\Dropbox.exe ==================== Restore Points ========================= 10-03-2016 21:33:41 Windows Update 26-03-2016 18:19:34 Installed Rapport 03-04-2016 12:11:00 Windows Update 07-04-2016 12:34:58 Installed Rapport ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (04/07/2016 06:21:18 PM) (Source: Application Hang) (EventID: 1002) (User: ) Description: The program FRST64.exe version 5.3.2016.1 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Security and Maintenance control panel. Process ID: e10 Start Time: 01d190e90d82616e Termination Time: 11 Application Path: C:\Users\Rosebud\Desktop\FRST64.exe Report Id: bda0367a-fcdc-11e5-8d81-0025647dd35b Faulting package full name: Faulting package-relative application ID: Error: (04/07/2016 06:05:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Unexpected conflict discarding 18 116.2.168.192.in-addr.arpa. PTR Rosebud-PC.local. Error: (04/07/2016 06:05:47 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Received from 192.168.2.116:5353 20 116.2.168.192.in-addr.arpa. PTR Rosebud-PC-2.local. Error: (04/07/2016 03:26:55 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: AcroRd32.exe, version: 15.10.20056.36345, time stamp: 0x56741546 Faulting module name: PPKLite.api, version: 15.10.20060.43353, time stamp: 0x56d0a55f Exception code: 0xc0000005 Fault offset: 0x0024656d Faulting process id: 0x1e0 Faulting application start time: 0xAcroRd32.exe0 Faulting application path: AcroRd32.exe1 Faulting module path: AcroRd32.exe2 Report Id: AcroRd32.exe3 Faulting package full name: AcroRd32.exe4 Faulting package-relative application ID: AcroRd32.exe5 Error: (04/07/2016 03:10:38 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: SystemSettings.exe, version: 10.0.10240.16384, time stamp: 0x559f39ae Faulting module name: SettingsHandlers_StorageSense.dll, version: 10.0.10240.16384, time stamp: 0x559f3d87 Exception code: 0xc0000005 Fault offset: 0x00000000000174b9 Faulting process id: 0x1bf4 Faulting application start time: 0xSystemSettings.exe0 Faulting application path: SystemSettings.exe1 Faulting module path: SystemSettings.exe2 Report Id: SystemSettings.exe3 Faulting package full name: SystemSettings.exe4 Faulting package-relative application ID: SystemSettings.exe5 Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: Local Hostname Rosebud-PC.local already in use; will try Rosebud-PC-2.local instead Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: ProbeCount 2; will deregister 4 Rosebud-PC.local. Addr 192.168.2.116 Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Received from 192.168.2.116:5353 16 Rosebud-PC.local. AAAA 2003:0084:A979:A601:0408:96AF:F706:D169 Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 Rosebud-PC.local. AAAA FE80:0000:0000:0000:0408:96AF:F706:D169 Error: (04/07/2016 02:08:20 PM) (Source: Bonjour Service) (EventID: 100) (User: ) Description: mDNSCoreReceiveResponse: Received from 192.168.2.116:5353 16 Rosebud-PC.local. AAAA 2003:0084:A979:A601:0408:96AF:F706:D169 System errors: ============= Error: (04/07/2016 06:05:47 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The NPEService service failed to start due to the following error: %%1053 Error: (04/07/2016 06:05:47 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the NPEService service to connect. Error: (04/07/2016 06:05:42 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The MBAMService service failed to start due to the following error: %%1053 Error: (04/07/2016 06:05:42 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMService service to connect. Error: (04/07/2016 06:05:41 PM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: The MBAMScheduler service failed to start due to the following error: %%1053 Error: (04/07/2016 06:05:41 PM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect. Error: (04/07/2016 06:03:50 PM) (Source: Application Popup) (EventID: 875) (User: ) Description: BMLoad.sys Error: (04/07/2016 06:04:46 PM) (Source: EventLog) (EventID: 6008) (User: ) Description: The previous system shutdown at 4:07:47 PM on ‎4/‎7/‎2016 was unexpected. Error: (04/07/2016 03:48:36 PM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinDefend service. Error: (04/07/2016 03:48:01 PM) (Source: Service Control Manager) (EventID: 7011) (User: ) Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinDefend service. CodeIntegrity: =================================== Date: 2016-04-07 18:23:27.161 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 18:23:26.934 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 18:23:26.676 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 18:23:14.395 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:54:17.416 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:30.828 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:30.622 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:30.405 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:30.062 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2016-04-07 15:32:29.864 Description: Code Integrity determined that a process (\Device\HarddiskVolume3\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume3\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Processor: Pentium(R) Dual-Core CPU T4300 @ 2.10GHz Percentage of memory in use: 49% Total physical RAM: 4056.36 MB Available physical RAM: 2029.26 MB Total Virtual: 8152.36 MB Available Virtual: 6099.82 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:451.07 GB) (Free:273.62 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 465.8 GB) (Disk ID: 75349890) Partition 1: (Not Active) - (Size=39 MB) - (Type=DE) Partition 2: (Active) - (Size=14.6 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=451.1 GB) - (Type=07 NTFS) ==================== End of Addition.txt ============================
  2. Hi, I have just scanned my computer with Malwarebytes Anti-Malware Home, and it detected the following items: Trojan.Agent.ED PUP.Optional.Yontoo (13 of these) PUP.Optional.OpenCandy PUP.Optional.BundleInstaller.DW PUP.Optional.Babylon I quarentined and then deleted all the files and then re-ran Malwarebytes twice. It is saying the computer is clean now, but can I be sure that it is? Many thanks! Caroline
  3. A Win7 Pro x64 Laptop has become infected over the past couple of days (very slow operation; protected by Malwarebytes & Vipre). Malwarebytes log extracts are appended, with the Trojan identifications including: Trojan.Agent.ED Trojan.Agent.0BGen2 Exploit.Drop.70 Trojan.Dorkbot.ED These files are on the Windows desktop (and elsewhere): HELP_DECRYPT.HTML HELP_DECRYPT.PNG HELP_DECRYPT.TXT HELP_DECRYPT.URL And "The Windows Security Center can't be started" - MicrosoftFixit50981.msi doesn't work, nor can 'Security Center' services be started. Any suggestions would be much appreciated. Dave. Detection, 12/02/2015 11:14:59, XXX, XXX-LAPTOP, Protection, Malware Protection, File, Trojan.Agent.ED, C:\Users\XXX\AppData\Local\Ommics\NmGd3.exe, Quarantine, [b57bf22b385289adefcb79a226dc0bf5] Scan, 12/02/2015 13:38:07, SYSTEM, XXX-LAPTOP, Manual, Start:12/02/2015 13:07:15, Duration:19 min 35 sec, Threat Scan, Completed, 0 Malware Detections, 6 Non-Malware Detections, Detection, 12/02/2015 15:21:49, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 188.165.164.184, ip-addr.es, 49572, Outbound, C:\Windows\SysWOW64\svchost.exe, Detection, 12/02/2015 15:21:55, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 188.165.164.184, ip-addr.es, 49572, Outbound, C:\Windows\SysWOW64\svchost.exe, Detection, 12/02/2015 15:22:01, SYSTEM, XXX-LAPTOP, Protection, Malware Protection, File, Trojan.Agent.0BGen2, C:\Users\XXX\AppData\Local\Temp\3F42.tmp, Quarantine, [ee4261bcf6940f27a6e68685de249b65] Detection, 12/02/2015 15:22:09, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 114.202.247.141, dcmaulmembers.com, 49587, Outbound, C:\Windows\SysWOW64\svchost.exe, Detection, 12/02/2015 15:22:15, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 114.202.247.141, dcmaulmembers.com, 49587, Outbound, C:\Windows\SysWOW64\svchost.exe, Detection, 12/02/2015 15:22:25, XXX, XXX-LAPTOP, Protection, Malware Protection, File, Trojan.Agent.ED, C:\Users\XXX\AppData\Local\Temp\update.exe, Quarantine, [db552bf2e4a63ef818752fef49b949b7] Detection, 12/02/2015 15:24:49, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 188.165.164.184, ip-addr.es, 49791, Outbound, C:\Windows\SysWOW64\svchost.exe, Detection, 12/02/2015 15:26:30, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 166.78.144.80, sksqqagakeicoeso.org, 49859, Outbound, C:\Windows\SysWOW64\regsvr32.exe, Detection, 12/02/2015 15:26:31, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 166.78.144.80, sksqqagakeicoeso.org, 49859, Outbound, C:\Windows\SysWOW64\regsvr32.exe, Update, 12/02/2015 15:27:22, SYSTEM, XXX-LAPTOP, Manual, Malware Database, 2015.2.11.4, 2015.2.12.3, Detection, 12/02/2015 15:27:34, SYSTEM, XXX-LAPTOP, Protection, Malware Protection, File, Exploit.Drop.70, C:\Users\XXX\AppData\Local\Temp\tmpa2d9f912\run.exe, Quarantine, [76ba2af37a101e18265d1658eb1527d9] Detection, 12/02/2015 15:27:50, XXX, XXX-LAPTOP, Protection, Malware Protection, File, Trojan.Dorkbot.ED, C:\Users\XXX\AppData\Local\Temp\tmp2206b12f\new.exe, Quarantine, [7320c15c1575d4624cd9ed99bb46fb05] Detection, 12/02/2015 15:36:12, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 50834, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 15:45:28, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 5.149.250.194, 51799, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 15:45:34, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 51800, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 15:49:22, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 216.172.61.83, appsrumors.com, 52584, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 15:49:22, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 52585, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 15:59:35, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 46.250.111.47, uociwiiqgmqwwmkq.org, 57901, Outbound, C:\Windows\SysWOW64\regsvr32.exe, Detection, 12/02/2015 16:01:24, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 58133, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:25:33, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 216.172.61.83, newslikes.com, 52571, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:25:33, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 52583, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:30:03, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 5.149.250.194, 56096, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:30:03, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 56097, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:30:20, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 166.78.144.80, sksqqagakeicoeso.org, 56098, Outbound, C:\Windows\SysWOW64\regsvr32.exe, Detection, 12/02/2015 16:30:20, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 166.78.144.80, sksqqagakeicoeso.org, 56098, Outbound, C:\Windows\SysWOW64\regsvr32.exe, Detection, 12/02/2015 16:30:41, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 5.149.250.194, 56107, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:30:42, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 56108, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:33:27, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 5.149.250.194, 56162, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:33:28, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 56163, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:33:52, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 5.149.250.194, 56169, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 16:33:52, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 56170, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Scan, 12/02/2015 16:35:10, SYSTEM, XXX-LAPTOP, Manual, Start:12/02/2015 15:27:29, Duration:29 min 50 sec, Threat Scan, Completed, 8 Malware Detections, 0 Non-Malware Detections, Detection, 12/02/2015 16:41:08, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 212.117.180.190, search-inter.com, 49192, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 17:01:26, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 216.172.61.83, appsrumors.com, 56895, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe, Detection, 12/02/2015 17:08:35, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 173.224.248.55, uociwiiqgmqwwmkq.org, 57504, Outbound, C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe, Detection, 12/02/2015 17:13:47, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 31.193.87.88, uociwiiqgmqwwmkq.org, 57732, Outbound, C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe, Detection, 12/02/2015 17:22:08, SYSTEM, XXX-LAPTOP, Protection, Malicious Website Protection, IP, 208.43.117.244, data.rtbfy.com, 58438, Outbound, C:\Program Files (x86)\Internet Explorer\iexplore.exe,
  4. MBAM has suddenly started detecting two REMO Repair files as trojans, starting today: C:\Program Files (x86)\Remo Repair MOV 2.0\rs-repairmov.exe C:\Program Files (x86)\Remo Repair Zip 2.0\rsziprpr.exe rs-repairmov.exe [17028329548EE3E55DB5559D7E68DE97=MD5] at Virus Total: 0/55 https://www.virustotal.com/en/file/155102c482cf1627442ff85961fc94b2943cb8cd4f9e80cad8990c080aabb9b5/analysis/ rsziprpr.exe [FBA2EFB06FF0E43C6FB7B2055B2F7CB5=MD5] at Virus Total: 0/54 https://www.virustotal.com/en/file/2b2875ef977ae9d6eab353ae5653c8649a719180c7fd200e4150457c14bca14e/analysis/ rs-repairmov.zip rsziprpr.zip MBAM Daily Protection Log.txt
  5. Hi, I downloaded a game called War Thunder a while back from Steam and have been playing this for a while. It has never caused problems before until now, when I started the game after a recent update, Malwarebytes would detect it as a threat. I did a Threat Scan and it found nothing, but when I scanned the War Thunder file specifically in C:/Program Files, then it will detect it. Before this, the launcher would cause the Malicious Website Protection to go off too, usually during updates. So I'm wondering if this is a false positive or this game is a dangerous file? I trust Steam would not put anything malicious in their store, but I know you can get this game without Steam too. It is a F2P game, by the way, and generally highly regarded. Also, unrelated to War Thunder but I've had this "Trojan.Dorkbot.ED" in my quarentine for a while, since December 2013. I don't qite remember what it was and if it was safe or not. Here are the logs... FRST.txt Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:16-06-2014 Ran by Brandon (administrator) on BRANDON-PC on 17-06-2014 14:21:10 Running from C:\Users\Brandon\Desktop Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English(US) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\System32\atiesrxx.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (LogMeIn, Inc.) C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe (Impulse Point, LLC) C:\Program Files\SafeConnect\scManager.sys (TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe (LogMeIn Inc.) C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (AMD) C:\Windows\System32\atieclxx.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (LSI Corp.) C:\Program Files\ltmoh\ltmoh.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TEco.exe (Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe (Logitech©) C:\Program Files\Logitech\G930\G930.exe (Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe (AVAST Software) C:\Program Files\Alwil Software\Avast5\avastui.exe (LogMeIn Inc.) C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Valve Corporation) C:\Program Files\Steam\Steam.exe (Impulse Point, LLC) C:\Program Files\SafeConnect\SCClient.exe (Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe (ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe (Valve Corporation) C:\Program Files\Common Files\Steam\SteamService.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe (LSI Corporation) C:\Program Files\LSI SoftModem\agrsmsvc.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe (TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe (Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [7625248 2009-07-28] (Realtek Semiconductor) HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1545512 2009-07-20] (Synaptics Incorporated) HKLM\...\Run: [LtMoh] => C:\Program Files\ltmoh\Ltmoh.exe [195080 2008-09-25] (LSI Corp.) HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [476512 2009-08-21] (TOSHIBA Corporation) HKLM\...\Run: [smoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [460088 2009-07-28] (TOSHIBA Corporation) HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [738616 2009-08-05] (TOSHIBA Corporation) HKLM\...\Run: [TosWaitSrv] => C:\Program Files\TOSHIBA\TPHM\TosWaitSrv.exe [611672 2009-08-06] (TOSHIBA Corporation) HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1324384 2009-08-11] (TOSHIBA Corporation) HKLM\...\Run: [TWebCamera] => C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2446648 2009-08-11] (TOSHIBA CORPORATION.) HKLM\...\Run: [smartFaceVWatcher] => C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatcher.exe [163840 2009-07-29] (TOSHIBA Corporation) HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [611672 2009-09-17] (TOSHIBA Corporation) HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation) HKLM\...\Run: [Malwarebytes Anti-Malware (reboot)] => "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript HKLM\...\Run: [Logitech G930] => C:\Program Files\Logitech\G930\G930.exe [1516888 2011-03-23] (Logitech©) HKLM\...\Run: [sunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\Run: [startCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642304 2013-04-30] (Advanced Micro Devices, Inc.) HKLM\...\Run: [AMD AVT] => C:\Program Files\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] () HKLM\...\Run: [AvastUI.exe] => C:\Program Files\Alwil Software\Avast5\AvastUI.exe [3890208 2014-06-06] (AVAST Software) HKLM\...\Run: [LogMeIn Hamachi Ui] => C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe [3814736 2014-05-13] (LogMeIn Inc.) HKU\S-1-5-21-2539973999-1635078157-892821977-1000\...\Run: [steam] => C:\Program Files\Steam\steam.exe [1754816 2014-05-29] (Valve Corporation) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\SafeConnect.lnk ShortcutTarget: SafeConnect.lnk -> C:\Program Files\SafeConnect\SCClient.exe (Impulse Point, LLC) Startup: C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation) Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) FireFox: ======== FF ProfilePath: C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\osrnedtv.default FF Homepage: about:home FF Keyword.URL: user_pref("keyword.URL", ""); FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/WLPG,version=14.0.8081.0709 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll No File FF Plugin: @pandonetworks.com/PandoWebPlugin - C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll No File FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Brandon\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll No File FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation) FF Extension: Rikaichan Japanese-English Dictionary File - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\osrnedtv.default\Extensions\rikaichan-jpen@polarcloud.com [2013-07-15] FF Extension: Rikaichan - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\osrnedtv.default\Extensions\{0AA9101C-D3C1-4129-A9B7-D778C6A17F82} [2012-12-08] FF Extension: WOT - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\osrnedtv.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27] FF Extension: Personas Plus - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\osrnedtv.default\Extensions\personas@christopher.beard.xpi [2013-03-01] FF Extension: Adblock Plus - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\osrnedtv.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-06-29] FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-04-08] FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-04-08] ========================== Services (Whitelisted) ================= R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agrsmsvc.exe [14336 2009-03-27] (LSI Corporation) R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [291840 2013-04-29] (Advanced Micro Devices, Inc.) [File not signed] R2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [50344 2014-05-03] (AVAST Software) R2 cfWiMAXService; C:\Program Files\TOSHIBA\ConfigFree\CFIWmxSvcs.exe [185712 2009-08-10] (TOSHIBA CORPORATION) R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-10] (TOSHIBA CORPORATION) S3 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [250616 2009-05-22] (WildTangent, Inc.) R2 Hamachi2Svc; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [1682768 2014-05-13] (LogMeIn Inc.) R2 LMIGuardianSvc; C:\Program Files\LogMeIn Hamachi\LMIGuardianSvc.exe [375056 2014-04-15] (LogMeIn, Inc.) R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) R2 RSELSVC; C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe [62832 2009-07-07] (TOSHIBA Corporation) R2 SCManager; C:\Program Files\SafeConnect\scManager.sys [176520 2013-12-16] (Impulse Point, LLC) S3 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [54136 2011-02-11] (TOSHIBA Corporation) R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [185712 2009-08-11] (TOSHIBA Corporation) R3 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [111960 2009-09-17] (TOSHIBA Corporation) R3 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [685424 2009-08-06] (TOSHIBA Corporation) ==================== Drivers (Whitelisted) ==================== R2 AODDriver4.1; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\i386\AODDriver2.sys [45184 2012-03-05] (Advanced Micro Devices) R2 aswHwid; C:\windows\system32\drivers\aswHwid.sys [24184 2014-05-03] () R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [67824 2014-05-03] (AVAST Software) R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [81768 2014-05-03] (AVAST Software) R0 aswRvrt; C:\windows\system32\Drivers\aswRvrt.sys [49944 2014-05-03] () R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [777488 2014-05-15] (AVAST Software) R1 aswSP; C:\windows\system32\drivers\aswSP.sys [411680 2014-05-15] (AVAST Software) R2 aswStm; C:\windows\system32\drivers\aswStm.sys [68312 2014-05-15] (AVAST Software) R0 aswVmm; C:\windows\system32\Drivers\aswVmm.sys [180632 2014-05-03] () R3 hamachi; C:\windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.) S3 LADF_BakerCOnly; C:\windows\System32\DRIVERS\ladfBakerCi386.sys [378568 2011-03-18] (Logitech) S3 LADF_BakerROnly; C:\windows\System32\DRIVERS\ladfBakerRi386.sys [312136 2011-03-18] (Logitech) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [110296 2014-06-17] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [51928 2014-05-12] (Malwarebytes Corporation) R3 PGEffect; C:\windows\System32\DRIVERS\pgeffect.sys [24064 2009-06-22] (TOSHIBA Corporation) R3 RTL8187Se; C:\windows\System32\DRIVERS\RTL8187Se.sys [372736 2009-08-13] (Realtek Semiconductor Corporation ) R2 TVALZFL; C:\windows\System32\DRIVERS\TVALZFL.sys [12920 2009-06-19] (TOSHIBA Corporation) U5 AppMgmt; C:\windows\system32\svchost.exe [20992 2009-07-13] (Microsoft Corporation) S3 EagleNT; \??\C:\windows\system32\drivers\EagleNT.sys [X] S3 EagleXNt; \??\C:\windows\system32\drivers\EagleXNt.sys [X] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-06-17 14:21 - 2014-06-17 14:21 - 00015991 _____ () C:\Users\Brandon\Desktop\FRST.txt 2014-06-17 14:20 - 2014-06-17 14:21 - 00000000 ____D () C:\FRST 2014-06-17 14:11 - 2014-06-17 14:11 - 01072640 _____ (Farbar) C:\Users\Brandon\Desktop\FRST.exe 2014-06-14 03:13 - 2014-06-17 14:01 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-14 03:11 - 2014-06-08 01:48 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-14 03:11 - 2014-06-08 01:43 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-14 03:11 - 2014-05-30 02:18 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-06-14 03:11 - 2014-05-30 02:02 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-06-14 03:11 - 2014-05-30 02:02 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-06-14 03:11 - 2014-05-30 01:44 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-06-14 03:11 - 2014-05-30 01:43 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-06-14 03:11 - 2014-05-30 01:42 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-06-14 03:11 - 2014-05-30 01:38 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-06-14 03:11 - 2014-05-30 01:34 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-06-14 03:11 - 2014-05-30 01:33 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-06-14 03:11 - 2014-05-30 01:30 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-06-14 03:11 - 2014-05-30 01:28 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-06-14 03:11 - 2014-05-30 01:28 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-06-14 03:11 - 2014-05-30 01:27 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-06-14 03:11 - 2014-05-30 01:21 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-06-14 03:11 - 2014-05-30 01:16 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-06-14 03:11 - 2014-05-30 01:10 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-06-14 03:11 - 2014-05-30 01:06 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-06-14 03:11 - 2014-05-30 01:04 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-06-14 03:11 - 2014-05-30 01:02 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-06-14 03:11 - 2014-05-30 00:57 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-06-14 03:11 - 2014-05-30 00:56 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-06-14 03:11 - 2014-05-30 00:54 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-06-14 03:11 - 2014-05-30 00:50 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-06-14 03:11 - 2014-05-30 00:49 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-06-14 03:11 - 2014-05-30 00:40 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-06-14 03:11 - 2014-05-30 00:21 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-06-14 03:11 - 2014-05-30 00:15 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-06-14 03:11 - 2014-05-30 00:13 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-06-14 03:11 - 2014-04-24 19:06 - 00626688 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll 2014-06-14 03:11 - 2014-04-04 19:25 - 01294272 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys 2014-06-14 03:11 - 2014-04-04 19:24 - 00187840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS 2014-06-14 03:11 - 2014-03-26 07:27 - 01389056 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll 2014-06-14 03:11 - 2014-03-26 07:27 - 01237504 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll 2014-06-14 03:11 - 2014-03-26 07:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll 2014-06-14 03:11 - 2014-03-26 07:25 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll 2014-06-08 21:32 - 2014-06-08 21:32 - 00000214 _____ () C:\Users\Brandon\Desktop\Garry's Mod.url 2014-05-22 23:05 - 2014-05-22 23:05 - 00000000 ____D () C:\Program Files\Common Files\Skype 2014-05-21 23:26 - 2014-05-21 23:49 - 00000000 ____D () C:\ProgramData\Narcissu Side 2nd 2014-05-21 23:26 - 2014-05-21 23:26 - 00000000 ____D () C:\Users\Brandon\AppData\Roaming\Ponscripter 2014-05-21 23:21 - 2014-05-21 23:21 - 00000216 _____ () C:\Users\Brandon\Desktop\Narcissu 1st & 2nd.url 2014-05-19 13:51 - 2014-05-19 13:51 - 00000000 ____D () C:\Users\Brandon\Desktop\Visa paperwork 2014-05-19 13:47 - 2014-05-19 13:47 - 00000000 ____D () C:\Users\Brandon\Desktop\IRS Stuff ==================== One Month Modified Files and Folders ======= 2014-06-17 14:21 - 2014-06-17 14:21 - 00015991 _____ () C:\Users\Brandon\Desktop\FRST.txt 2014-06-17 14:21 - 2014-06-17 14:20 - 00000000 ____D () C:\FRST 2014-06-17 14:21 - 2014-02-06 22:44 - 00000000 ____D () C:\Users\Brandon\AppData\Local\temp 2014-06-17 14:11 - 2014-06-17 14:11 - 01072640 _____ (Farbar) C:\Users\Brandon\Desktop\FRST.exe 2014-06-17 14:11 - 2009-10-08 19:48 - 01505103 _____ () C:\windows\WindowsUpdate.log 2014-06-17 14:01 - 2014-06-14 03:13 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job 2014-06-17 13:59 - 2014-02-16 04:42 - 00000886 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-06-17 13:46 - 2012-10-19 16:26 - 00034332 _____ () C:\windows\setupact.log 2014-06-17 13:45 - 2014-04-11 01:50 - 00110296 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbamswissarmy.sys 2014-06-17 13:45 - 2009-07-13 21:34 - 00015792 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-06-17 13:45 - 2009-07-13 21:34 - 00015792 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-06-17 13:41 - 2014-02-16 04:42 - 00000882 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-06-17 13:41 - 2013-05-31 16:16 - 00000000 ____D () C:\Program Files\Steam 2014-06-17 13:41 - 2012-12-08 16:09 - 00000000 ____D () C:\Program Files\SafeConnect 2014-06-17 13:41 - 2011-04-08 12:55 - 00000000 ____D () C:\Users\Brandon\AppData\Local\LogMeIn Hamachi 2014-06-17 13:40 - 2009-07-13 21:53 - 00000006 ____H () C:\windows\Tasks\SA.DAT 2014-06-17 02:26 - 2014-05-06 21:25 - 00000000 ___SD () C:\windows\system32\CompatTel 2014-06-17 02:25 - 2012-05-15 10:50 - 00000000 ____D () C:\Users\Brandon\AppData\Roaming\Skype 2014-06-17 00:05 - 2009-10-08 20:01 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-06-17 00:02 - 2013-07-26 23:26 - 00000000 ____D () C:\windows\system32\MRT 2014-06-16 23:59 - 2009-12-08 15:21 - 92708840 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2014-06-14 03:13 - 2012-04-06 10:16 - 00699056 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerApp.exe 2014-06-14 03:13 - 2011-07-02 14:27 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\system32\FlashPlayerCPLApp.cpl 2014-06-09 23:24 - 2009-09-01 22:32 - 00796094 _____ () C:\windows\system32\PerfStringBackup.INI 2014-06-08 21:32 - 2014-06-08 21:32 - 00000214 _____ () C:\Users\Brandon\Desktop\Garry's Mod.url 2014-06-08 01:48 - 2014-06-14 03:11 - 00391680 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll 2014-06-08 01:43 - 2014-06-14 03:11 - 00302592 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll 2014-06-06 15:10 - 2009-07-13 21:53 - 00032644 _____ () C:\windows\Tasks\SCHEDLGU.TXT 2014-06-06 14:46 - 2009-07-13 19:37 - 00000000 ____D () C:\windows\system32\NDF 2014-06-06 14:30 - 2013-05-31 16:16 - 00000000 ____D () C:\Program Files\Common Files\Steam 2014-06-06 14:25 - 2014-04-11 01:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-06-06 14:25 - 2014-04-11 01:48 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware 2014-06-06 14:25 - 2012-07-28 14:53 - 00001071 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-05-30 02:18 - 2014-06-14 03:11 - 17271296 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2014-05-30 02:02 - 2014-06-14 03:11 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2014-05-30 02:02 - 2014-06-14 03:11 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll 2014-05-30 01:44 - 2014-06-14 03:11 - 00455168 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll 2014-05-30 01:43 - 2014-06-14 03:11 - 00061952 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2014-05-30 01:42 - 2014-06-14 03:11 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll 2014-05-30 01:38 - 2014-06-14 03:11 - 02179072 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2014-05-30 01:34 - 2014-06-14 03:11 - 00043008 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2014-05-30 01:33 - 2014-06-14 03:11 - 00032768 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2014-05-30 01:30 - 2014-06-14 03:11 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2014-05-30 01:28 - 2014-06-14 03:11 - 00112128 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe 2014-05-30 01:28 - 2014-06-14 03:11 - 00108032 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe 2014-05-30 01:27 - 2014-06-14 03:11 - 00592896 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll 2014-05-30 01:21 - 2014-06-14 03:11 - 00646144 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe 2014-05-30 01:16 - 2014-06-14 03:11 - 00368128 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll 2014-05-30 01:10 - 2014-06-14 03:11 - 00032256 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll 2014-05-30 01:06 - 2014-06-14 03:11 - 00164864 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll 2014-05-30 01:04 - 2014-06-14 03:11 - 00069632 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll 2014-05-30 01:02 - 2014-06-14 03:11 - 00242688 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll 2014-05-30 00:57 - 2014-06-14 03:11 - 00595968 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2014-05-30 00:56 - 2014-06-14 03:11 - 04244992 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2014-05-30 00:54 - 2014-06-14 03:11 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2014-05-30 00:50 - 2014-06-14 03:11 - 01068032 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll 2014-05-30 00:49 - 2014-06-14 03:11 - 01964544 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl 2014-05-30 00:40 - 2014-06-14 03:11 - 11725312 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2014-05-30 00:21 - 2014-06-14 03:11 - 01790976 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2014-05-30 00:15 - 2014-06-14 03:11 - 01143296 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2014-05-30 00:13 - 2014-06-14 03:11 - 00704512 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll 2014-05-24 22:49 - 2012-05-15 10:50 - 00000000 ____D () C:\ProgramData\Skype 2014-05-22 23:05 - 2014-05-22 23:05 - 00000000 ____D () C:\Program Files\Common Files\Skype 2014-05-22 23:05 - 2014-03-09 01:25 - 00000000 ___RD () C:\Program Files\Skype 2014-05-21 23:49 - 2014-05-21 23:26 - 00000000 ____D () C:\ProgramData\Narcissu Side 2nd 2014-05-21 23:26 - 2014-05-21 23:26 - 00000000 ____D () C:\Users\Brandon\AppData\Roaming\Ponscripter 2014-05-21 23:21 - 2014-05-21 23:21 - 00000216 _____ () C:\Users\Brandon\Desktop\Narcissu 1st & 2nd.url 2014-05-21 22:57 - 2014-04-07 04:00 - 00000000 ____D () C:\Users\Brandon\Desktop\ENGL 198T articles 2014-05-19 13:51 - 2014-05-19 13:51 - 00000000 ____D () C:\Users\Brandon\Desktop\Visa paperwork 2014-05-19 13:47 - 2014-05-19 13:47 - 00000000 ____D () C:\Users\Brandon\Desktop\IRS Stuff Some content of TEMP: ==================== C:\Users\Brandon\AppData\Local\temp\AutoRun.exe C:\Users\Brandon\AppData\Local\temp\AutoRunGUI.dll C:\Users\Brandon\AppData\Local\temp\eauninstall.exe C:\Users\Brandon\AppData\Local\temp\Harry Potter Quidditch World Cup_uninst.exe C:\Users\Brandon\AppData\Local\temp\jre-7u55-windows-i586-iftw.exe ==================== Bamital & volsnap Check ================= C:\windows\explorer.exe => File is digitally signed C:\windows\system32\winlogon.exe => File is digitally signed C:\windows\system32\wininit.exe => File is digitally signed C:\windows\system32\svchost.exe => File is digitally signed C:\windows\system32\services.exe => File is digitally signed C:\windows\system32\User32.dll => File is digitally signed C:\windows\system32\userinit.exe => File is digitally signed C:\windows\system32\rpcss.dll => File is digitally signed C:\windows\system32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-05-19 00:08 ==================== End Of Log ============================ Addition.txt Additional scan result of Farbar Recovery Scan Tool (x86) Version:16-06-2014 Ran by Brandon at 2014-06-17 14:22:06 Running from C:\Users\Brandon\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736} ==================== Installed Programs ====================== Update for Microsoft Office 2007 (KB2508958) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft) Adobe Flash Player 10 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 10.0.22.87 - Adobe Systems Incorporated) Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated) Adobe Reader 9.1 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A91000000001}) (Version: 9.1.0 - Adobe Systems Incorporated) Age of Empires II: HD Edition (HKLM\...\Steam App 221380) (Version: - Hidden Path Entertainment, Ensemble Studios) AMD Accelerated Video Transcoding (Version: 12.5.100.30429 - Advanced Micro Devices, Inc.) Hidden AMD APP SDK Runtime (Version: 10.0.937.2 - Advanced Micro Devices Inc.) Hidden AMD Catalyst Install Manager (HKLM\...\{B448BC74-1CB7-7A57-3313-5E075AFB413E}) (Version: 8.0.877.0 - Advanced Micro Devices, Inc.) AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden AMD Fuel (Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden AMD Media Foundation Decoders (Version: 1.0.80430.0002 - Advanced Micro Devices, Inc.) Hidden AMD VISION Engine Control Center (Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden avast! Free Antivirus (HKLM\...\avast) (Version: 9.0.2018 - Avast Software) Catalyst Control Center - Branding (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Graphics Previews Common (Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center InstallProxy (Version: 2009.0729.2238.38827 - ATI Technologies, Inc.) Hidden Catalyst Control Center InstallProxy (Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden Catalyst Control Center Localization All (Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Standard (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Chinese Traditional (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Czech (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Danish (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Dutch (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help English (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Finnish (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help French (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help German (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Greek (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Hungarian (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Italian (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Japanese (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Korean (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Norwegian (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Polish (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Portuguese (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Russian (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Spanish (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Swedish (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Thai (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden CCC Help Turkish (Version: 2013.0429.2312.39747 - Advanced Micro Devices, Inc.) Hidden ccc-utility (Version: 2013.0429.2313.39747 - Advanced Micro Devices, Inc.) Hidden CCleaner (HKLM\...\CCleaner) (Version: 4.09 - Piriform) Combined Community Codec Pack 2011-07-30 (HKLM\...\Combined Community Codec Pack_is1) (Version: 2011.07.30.0 - CCCP Project) Compatibility Pack for the 2007 Office system (HKLM\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Garry's Mod (HKLM\...\Steam App 4000) (Version: - Facepunch Studios) Google Toolbar for Internet Explorer (HKLM\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden Java 7 Update 51 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217040FF}) (Version: 7.0.510 - Oracle) Java Auto Updater (Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden Junk Mail filter update (Version: 14.0.8089.726 - Microsoft Corporation) Hidden Katawa Shoujo (HKLM\...\Katawa Shoujo) (Version: - ) Label@Once 1.0 (HKLM\...\{0D795777-9D60-4692-8386-F2B3F2B5E5BF}) (Version: 1.0 - Corel) League of Legends (HKLM\...\{92606477-9366-4D3B-8AE3-6BE4B29727AB}) (Version: 1.3 - Riot Games) Left 4 Dead 2 (HKLM\...\Steam App 550) (Version: - Valve) Logitech G930 (HKLM\...\{BF247007-01DE-448A-97F6-55F3C81EC7FE}) (Version: 1.0.364 - Logitech) LogMeIn Hamachi (HKLM\...\LogMeIn Hamachi) (Version: 2.2.0.193 - LogMeIn, Inc.) LogMeIn Hamachi (Version: 2.2.0.193 - LogMeIn, Inc.) Hidden LSI V92 MOH Application (HKLM\...\LTMOH) (Version: - LSI Corporation) Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) Microsoft .NET Framework 1.1 (HKLM\...\Microsoft .NET Framework 1.1 (1033)) (Version: - ) Microsoft .NET Framework 1.1 (Version: 1.1.4322 - Microsoft) Hidden Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden Microsoft Choice Guard (Version: 2.0.48.0 - Microsoft Corporation) Hidden Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version: - Microsoft) Hidden Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation) Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft VC9 runtime libraries (Version: 1.0.0 - AOL LLC) Hidden Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation) Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation) Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610 (HKLM\...\{95716cce-fc71-413f-8ad5-56c2892d4b3a}) (Version: 11.0.60610.1 - Microsoft Corporation) Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610 (Version: 11.0.60610 - Microsoft Corporation) Hidden Microsoft Works (HKLM\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation) Microsoft XNA Framework Redistributable 3.1 (HKLM\...\{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}) (Version: 3.1.10527.0 - Microsoft Corporation) Mozilla Firefox 29.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 29.0.1 (x86 en-US)) (Version: 29.0.1 - Mozilla) Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla) MSVCRT (Version: 14.0.1468.721 - Microsoft) Hidden MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) MyToshiba (HKLM\...\{01250B8F-D947-4F8A-9408-FE8E3EE2EC92}) (Version: 2.2.0.3 - Toshiba) Narcissu 1st & 2nd (HKLM\...\Steam App 264380) (Version: - stage-nana) Norton Internet Security (Version: 16.7.0.30 - Symantec Corporation) Hidden OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation) Quickbooks Financial Center (HKLM\...\{3B843B38-04B1-4CE6-8888-586273E0F289}) (Version: 2.02 - TOSHIBA Corporation) Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0008 - Realtek) Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5904 - Realtek Semiconductor Corp.) Realtek USB 2.0 Card Reader (HKLM\...\{96AE7E41-E34E-47D0-AC07-1091A8127911}) (Version: 6.1.7600.30101 - Realtek Semiconductor Corp.) Realtek WLAN Driver (HKLM\...\{0FB630AB-7BD8-40AE-B223-60397D57C3C9}) (Version: 2.00.0006 - Realtek) SafeConnect (HKLM\...\SafeConnect) (Version: - ) Skype Launcher (HKLM\...\{DA84ECBF-4B79-47F2-B34C-95C38484C058}) (Version: 2.01 - TOSHIBA Corporation) Skype™ 6.16 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.16.105 - Skype Technologies S.A.) Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation) Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 13.2.6.1 - Synaptics Incorporated) Toshiba Application and Driver Installer (HKLM\...\{970472D0-F5F9-4158-A6E3-1AE49EFEF2D3}) (Version: 9.0.0.9 - Toshiba) TOSHIBA Assist (HKLM\...\{12B3A009-A080-4619-9A2A-C6DB151D8D67}) (Version: 2.01.11 - TOSHIBA) TOSHIBA ConfigFree (HKLM\...\{F3529665-D75E-4D6D-98F0-745C78C68E9B}) (Version: 8.0.21 - TOSHIBA Corporation) TOSHIBA Disc Creator (HKLM\...\{5DA0E02F-970B-424B-BF41-513A5018E4C0}) (Version: 2.1.0.1 - TOSHIBA Corporation) TOSHIBA DVD PLAYER (HKLM\...\{6C5F3BDC-0A1B-4436-A696-5939629D5C31}) (Version: 3.01.0.07-A - TOSHIBA Corporation) TOSHIBA eco Utility (HKLM\...\InstallShield_{53536479-DFB0-47ED-9D10-43F3708C222D}) (Version: 1.1.7.0 - TOSHIBA Corporation) TOSHIBA eco Utility (Version: 1.1.7.0 - TOSHIBA Corporation) Hidden TOSHIBA Extended Tiles for Windows Mobility Center (HKLM\...\InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}) (Version: 1.01.00 - TOSHIBA Corporation) TOSHIBA Extended Tiles for Windows Mobility Center (Version: 1.01.00 - TOSHIBA Corporation) Hidden TOSHIBA Face Recognition (HKLM\...\InstallShield_{C730E42C-935A-45BB-A0C5-37E5234D111B}) (Version: 3.1.0.32 - TOSHIBA Corporation) TOSHIBA Face Recognition (Version: 3.1.0.32 - TOSHIBA Corporation) Hidden TOSHIBA Hardware Setup (HKLM\...\{D0387727-C89D-4774-B643-B9333EAA09DE}) (Version: 2.00.11 - TOSHIBA Corporation) TOSHIBA HDD/SSD Alert (HKLM\...\InstallShield_{D4322448-B6AF-4316-B859-D8A0E84DCB38}) (Version: 3.1.0.2 - TOSHIBA Corporation) TOSHIBA HDD/SSD Alert (Version: 3.1.0.2 - TOSHIBA Corporation) Hidden TOSHIBA Internal Modem Region Select Utility (HKLM\...\InstallShield_{89F7D66C-777D-473B-AA11-319C0F190EAC}) (Version: 2.3.0.01 - TOSHIBA Corporation) TOSHIBA Internal Modem Region Select Utility (Version: 2.3.0.01 - TOSHIBA Corporation) Hidden Toshiba Online Backup (HKLM\...\{C57BCDE1-7CB9-467D-B3BA-7E119916CDC1}) (Version: 1.2.0.35 - Toshiba) TOSHIBA PC Health Monitor (HKLM\...\{9DECD0F9-D3E8-48B0-A390-1CF09F54E3A4}) (Version: 1.4.1.0 - TOSHIBA Corporation) Toshiba Quality Application (HKLM\...\{E69992ED-A7F6-406C-9280-1C156417BC49}) (Version: 1.001.0000 - Toshiba) TOSHIBA Recovery Media Creator (HKLM\...\{B65BBB06-1F8E-48F5-8A54-B024A9E15FDF}) (Version: 2.1.0.2 - TOSHIBA Corporation) TOSHIBA Service Station (HKLM\...\{AC6569FA-6919-442A-8552-073BE69E247A}) (Version: 2.2.9 - TOSHIBA) TOSHIBA Speech System Applications (HKLM\...\{EE033C1F-443E-41EC-A0E2-559B539A4E4D}) (Version: 1.00.2518 - ) TOSHIBA Speech System SR Engine(U.S.) Version1.0 (HKLM\...\{008D69EB-70FF-46AB-9C75-924620DF191A}) (Version: - ) TOSHIBA Speech System TTS Engine(U.S.) Version1.0 (HKLM\...\{3FBF6F99-8EC6-41B4-8527-0A32241B5496}) (Version: - ) TOSHIBA Supervisor Password (HKLM\...\{A208044D-A88B-4ACF-AE95-E4F213E6EDC0}) (Version: 2.00.09 - TOSHIBA Corporation) TOSHIBA Value Added Package (HKLM\...\InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}) (Version: 1.2.26 - TOSHIBA Corporation) TOSHIBA Value Added Package (Version: 1.2.26 - TOSHIBA Corporation) Hidden TOSHIBA Web Camera Application (HKLM\...\{5E6F6CF3-BACC-4144-868C-E14622C658F3}) (Version: 1.1.1.4 - TOSHIBA Corporation) ToshibaRegistration (HKLM\...\{5AF550B4-BB67-4E7E-82F1-2C4300279050}) (Version: 1.0.3 - Toshiba) Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Access 2007 Help (KB963663) (HKLM\...\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}) (Version: - Microsoft) Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version: - Microsoft) Update for Microsoft Office Infopath 2007 Help (KB963662) (HKLM\...\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{716B81B8-B13C-41DF-8EAC-7A2F656CAB63}) (Version: - Microsoft) Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM\...\{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{ED38F8A3-4F61-494E-8BCA-E3AC7760C924}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{0451F231-E3E3-4943-AB9F-58EB96171784}) (Version: - Microsoft) Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2881065) 32-Bit Edition (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B7EF38F7-1D58-4085-A9A4-0F6C69A5AA1E}) (Version: - Microsoft) Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version: - Microsoft) Update for Microsoft Office Publisher 2007 Help (KB963667) (HKLM\...\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2E40DE55-B289-4C8B-8901-5D369B16814F}) (Version: - Microsoft) Update for Microsoft Office Script Editor Help (KB963671) (HKLM\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft) Update for Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version: - Microsoft) Ventrilo Client (HKLM\...\{789289CA-F73A-4A16-A331-54D498CE069F}) (Version: 3.0.8 - Flagship Industries, Inc.) War Thunder (HKLM\...\Steam App 236390) (Version: - Gaijin Entertainment) WildTangent Games (HKLM\...\WildTangent toshiba Master Uninstall) (Version: 1.0.0.71 - WildTangent) Windows Live Call (Version: 14.0.8064.0206 - Microsoft Corporation) Hidden Windows Live Communications Platform (Version: 14.0.8064.206 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8089.0726 - Microsoft Corporation) Windows Live Essentials (Version: 14.0.8089.726 - Microsoft Corporation) Hidden Windows Live Mail (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden Windows Live Messenger (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden Windows Live Photo Gallery (Version: 14.0.8081.709 - Microsoft Corporation) Hidden Windows Live Sign-in Assistant (HKLM\...\{45338B07-A236-4270-9A77-EBB4115517B5}) (Version: 5.000.818.5 - Microsoft Corporation) Windows Live Sync (HKLM\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation) Windows Live Upload Tool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation) Windows Live Writer (Version: 14.0.8089.0726 - Microsoft Corporation) Hidden WinRAR 4.00 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.00.0 - win.rar GmbH) World of Tanks (HKLM\...\{1EAC1D02-C6AC-4FA6-9A44-96258C37C812NA}_is1) (Version: - Wargaming.net) ==================== Restore Points ========================= 30-05-2014 08:33:09 Windows Update 06-06-2014 21:20:27 Windows Update 14-06-2014 10:05:43 Windows Update 17-06-2014 06:54:00 Windows Update ==================== Hosts content: ========================== 2009-07-13 19:04 - 2014-02-06 22:43 - 00000027 ____A C:\windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= Task: {08140998-93CE-4051-A80A-8ECC9CB67B57} - System32\Tasks\{561F621B-7B56-4543-9FD0-CA8DE4A880C4} => Firefox.exe http://ui.skype.com/ui/0/6.6.0.106/en/go/help.faq.installer?LastError=1618 Task: {11590910-C861-4791-813A-5A088D25EEA8} - System32\Tasks\{DFD61A5E-2EBA-47D5-866E-E166BDC924D0} => Firefox.exe http://ui.skype.com/ui/0/6.6.0.106/en/go/help.faq.installer?LastError=1618 Task: {67A85225-3F33-43E6-BBFC-7000403824EB} - System32\Tasks\Adobe Flash Player Updater => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-14] (Adobe Systems Incorporated) Task: {886DC625-F9C5-49A0-A3F5-6E77AF76B877} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-18] (Google Inc.) Task: {89005DB7-85C2-4788-A71B-758FA4C20F87} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-12-17] (Piriform Ltd) Task: {9D7464DB-D7B6-4AC9-9B03-1D393A421CB1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2010-10-18] (Google Inc.) Task: {A385A306-6583-488B-B302-488FB8A27360} - System32\Tasks\{15550E89-245B-4FD7-8B7B-22511CBA9D1C} => Firefox.exe http://ui.skype.com/ui/0/6.9.0.106/en/go/help.faq.installer?LastError=1618 Task: {AF98DA14-C921-478C-BF6B-C1CDB03878D1} - System32\Tasks\ConfigFree Startup Programs => C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe [2009-07-13] (TOSHIBA CORPORATION) Task: {CC499296-126B-42DC-ACAF-A6FE4A9C43E5} - System32\Tasks\avast! Emergency Update => C:\Program Files\Alwil Software\Avast5\AvastEmUpdate.exe [2014-05-03] (AVAST Software) Task: {D1FE8D42-F552-4747-9FD8-7C9DB8FEF39D} - System32\Tasks\{551163E0-634A-48D8-A4CB-0D048A251EDA} => Firefox.exe http://ui.skype.com/ui/0/6.6.0.106/en/go/help.faq.installer?LastError=1618 Task: {F81BD0C3-A029-42F9-AFFF-637B794219D5} - System32\Tasks\{40478EA2-1F8C-4BC1-8F80-2A81E7F792C2} => Firefox.exe http://ui.skype.com/ui/0/6.6.0.106/en/go/help.faq.installer?LastError=1618 Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-06-16 23:49 - 2014-06-16 23:49 - 02776064 _____ () C:\Program Files\Alwil Software\Avast5\defs\14061601\algo.dll 2014-06-17 13:42 - 2014-06-17 13:42 - 02776064 _____ () C:\Program Files\Alwil Software\Avast5\defs\14061700\algo.dll 2013-04-29 23:24 - 2013-04-29 23:24 - 00065024 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll 2011-04-08 12:50 - 2011-03-02 12:40 - 00140288 _____ () C:\Program Files\WinRAR\rarext.dll 2009-07-16 15:27 - 2009-07-16 15:27 - 07263544 _____ () C:\Program Files\TOSHIBA\FlashCards\BlackPng.dll 2009-07-16 15:27 - 2009-07-16 15:27 - 00052536 _____ () C:\Program Files\TOSHIBA\FlashCards\Hotkey\FnZ.dll 2009-09-01 22:30 - 2009-06-22 15:38 - 00015160 _____ () C:\Program Files\TOSHIBA\TOSHIBA Assist\NotifyX.dll 2009-03-12 19:08 - 2009-03-12 19:08 - 00049152 _____ () C:\Program Files\Toshiba\PCDiag\NotifyPCD.dll 2009-07-25 11:07 - 2009-07-25 11:07 - 00058704 _____ () C:\Program Files\TOSHIBA\TOSHIBA Disc Creator\NotifyTDC.dll 2013-11-24 23:47 - 2013-11-24 23:47 - 19336120 _____ () C:\Program Files\Alwil Software\Avast5\libcef.dll 2014-05-21 23:12 - 2014-04-29 17:08 - 01135104 _____ () C:\Program Files\Steam\libavcodec-55.dll 2014-04-22 16:00 - 2014-04-29 17:08 - 00471552 _____ () C:\Program Files\Steam\libavutil-53.dll 2014-05-21 23:12 - 2014-04-29 17:08 - 00404992 _____ () C:\Program Files\Steam\libavformat-55.dll 2014-01-22 01:02 - 2014-04-29 17:08 - 00340992 _____ () C:\Program Files\Steam\libavresample-1.dll 2013-04-23 18:30 - 2014-05-16 18:36 - 00756224 _____ () C:\Program Files\Steam\SDL2.dll 2014-05-21 23:13 - 2014-05-29 10:37 - 02139840 _____ () C:\Program Files\Steam\video.dll 2014-05-21 23:12 - 2014-04-28 17:37 - 00519168 _____ () C:\Program Files\Steam\libswscale-2.dll 2013-05-03 15:35 - 2014-05-29 10:36 - 01116864 _____ () C:\Program Files\Steam\bin\chromehtml.DLL 2013-03-26 16:16 - 2014-05-01 16:35 - 20628160 _____ () C:\Program Files\Steam\bin\libcef.dll 2012-12-11 09:51 - 2013-06-14 16:49 - 01100800 _____ () C:\Program Files\Steam\bin\avcodec-53.dll 2012-12-11 09:51 - 2013-06-14 16:49 - 00124416 _____ () C:\Program Files\Steam\bin\avutil-51.dll 2012-12-11 09:51 - 2013-06-14 16:49 - 00192000 _____ () C:\Program Files\Steam\bin\avformat-53.dll 2013-04-29 23:24 - 2013-04-29 23:24 - 00095232 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll 2013-06-18 15:49 - 2013-06-18 15:49 - 00016384 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Branding\Branding.dll 2013-04-29 23:08 - 2013-04-29 23:08 - 00369152 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2009-09-17 16:36 - 2009-09-17 16:36 - 00079192 _____ () C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosIPCWraper.dll 2014-05-12 19:39 - 2014-05-12 19:39 - 03839088 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll 2014-06-14 03:13 - 2014-06-14 03:13 - 17024688 _____ () C:\windows\system32\Macromed\Flash\NPSWF32_14_0_0_125.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service" ==================== EXE Association (whitelisted) ============= ==================== MSCONFIG/TASK MANAGER disabled items ========= MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start MSCONFIG\startupreg: MyTOSHIBA => "C:\Program Files\TOSHIBA\My Toshiba\MyToshiba.exe" /AUTO MSCONFIG\startupreg: NortonOnlineBackupReminder => "C:\Program Files\TOSHIBA\Toshiba Online Backup\Activation\TobuActivation.exe" UNATTENDED MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun MSCONFIG\startupreg: ToshibaServiceStation => "C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe" /hide:60 ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (06/06/2014 02:25:33 PM) (Source: Application Error) (EventID: 1000) (User: ) Description: Faulting application name: mbamservice.exe, version: 3.0.2.0, time stamp: 0x5318d363 Faulting module name: mbamservice.exe, version: 3.0.2.0, time stamp: 0x5318d363 Exception code: 0x40000015 Fault offset: 0x0007da8a Faulting process id: 0xa34 Faulting application start time: 0xmbamservice.exe0 Faulting application path: mbamservice.exe1 Faulting module path: mbamservice.exe2 Report Id: mbamservice.exe3 Error: (05/03/2014 01:34:31 AM) (Source: VSS) (EventID: 8194) (User: ) Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied. . This is often caused by incorrect security settings in either the writer or requestor process. Operation: Gathering Writer Data Context: Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220} Writer Name: System Writer Writer Instance ID: {ab127595-7616-4302-8cc3-95a295053a89} Error: (04/21/2014 06:24:52 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to poke open firewall Error: (04/20/2014 07:20:09 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to poke open firewall Error: (04/20/2014 00:49:22 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to poke open firewall Error: (04/20/2014 00:15:12 AM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to poke open firewall Error: (04/18/2014 02:55:16 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to poke open firewall Error: (04/17/2014 01:17:44 PM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to poke open firewall Error: (04/17/2014 00:27:27 AM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to poke open firewall Error: (04/17/2014 00:22:14 AM) (Source: Steam Client Service) (EventID: 1) (User: ) Description: Error: Failed to poke open firewall System errors: ============= Error: (06/16/2014 11:51:36 PM) (Source: WMPNetworkSvc) (EventID: 14332) (User: ) Description: WMPNetworkSvc0x80070420 Error: (06/16/2014 11:49:09 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "BRANDON-PC :20" could not be registered on the interface with IP address 10.0.0.23. The computer with the IP address 10.0.0.22 did not allow the name to be claimed by this computer. Error: (06/16/2014 11:49:09 PM) (Source: Server) (EventID: 2505) (User: ) Description: The server could not bind to the transport \Device\NetBT_Tcpip_{39BB13CB-6A22-4B48-A8F9-233FEC078B5C} because another computer on the network has the same name. The server could not start. Error: (06/16/2014 11:48:28 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "BRANDON-PC :0" could not be registered on the interface with IP address 10.0.0.23. The computer with the IP address 10.0.0.22 did not allow the name to be claimed by this computer. Error: (06/14/2014 03:00:56 AM) (Source: DCOM) (EventID: 10010) (User: ) Description: {4991D34B-80A1-4291-83B6-3328366B9097} Error: (06/14/2014 02:54:38 AM) (Source: DCOM) (EventID: 10010) (User: ) Description: {4991D34B-80A1-4291-83B6-3328366B9097} Error: (06/09/2014 10:11:54 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "BRANDON-PC :20" could not be registered on the interface with IP address 10.0.0.23. The computer with the IP address 10.0.0.22 did not allow the name to be claimed by this computer. Error: (06/09/2014 10:11:54 PM) (Source: Server) (EventID: 2505) (User: ) Description: The server could not bind to the transport \Device\NetBT_Tcpip_{39BB13CB-6A22-4B48-A8F9-233FEC078B5C} because another computer on the network has the same name. The server could not start. Error: (06/09/2014 10:11:17 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "BRANDON-PC :0" could not be registered on the interface with IP address 10.0.0.23. The computer with the IP address 10.0.0.22 did not allow the name to be claimed by this computer. Error: (06/08/2014 09:25:22 PM) (Source: NetBT) (EventID: 4321) (User: ) Description: The name "BRANDON-PC :20" could not be registered on the interface with IP address 10.0.0.23. The computer with the IP address 10.0.0.22 did not allow the name to be claimed by this computer. Microsoft Office Sessions: ========================= ==================== Memory info =========================== Percentage of memory in use: 54% Total physical RAM: 2812.17 MB Available physical RAM: 1287.99 MB Total Pagefile: 5622.63 MB Available Pagefile: 3777.01 MB Total Virtual: 2047.88 MB Available Virtual: 1901.92 MB ==================== Drives ================================ Drive c: (TI103426W0D) (Fixed) (Total:288.71 GB) (Free:166.88 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 89E6579C) Partition 1: (Active) - (Size=1 GB) - (Type=27) Partition 2: (Not Active) - (Size=289 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=8 GB) - (Type=17) ==================== End Of Log ============================
  6. Hi there, My MBAM Premium scan detected Trojan.Agent.ED on June 17. I quarantined and deleted it, then ran CCleaner too. The scans up until today, June 20, were clean, but now it says it found Trojan.Agent.ED again. I have no clue how I am getting infected with this virus, or whether I have been able to clean it off properly. Can someone help me make sure this virus is fully cleared? Thanks.
  7. Similar to my earlier post from today, I'd like to get the ball rolling on this similarly-infected PC. $20 donation posted for all of your hard work! Thank you. attach.txt dds.txt
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.