bbobrob Posted May 17, 2013 ID:680703 Share Posted May 17, 2013 Hi, I was recently infected with the FBI Moneypak malware. Before, I had been able to remove it via booting into safemode and finding the startup file and deleting it, but this version of the malware prevent booting in any safemode start up. I've looked around, and it looks like the Farbar Recovery Scan Tool is what most people are using to help get the problem resolved. I've run both the scan and the search for services.exe, and these are the logs that are returned. If anyone could help with the removal, it would be greatly appreciated!FRST.txtScan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 16-05-2013Ran by SYSTEM on 17-05-2013 00:37:54Running from F:\Windows 7 Professional Service Pack 1 (X64) OS Language: English(US)Internet Explorer Version 9Boot Mode: RecoveryThe current controlset is ControlSet001ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.==================== Registry (Whitelisted) ==================HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2531624 2010-12-17] (Synaptics Incorporated)HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6611048 2011-02-18] (Realtek Semiconductor)HKLM\...\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /MAXX3 [2188904 2011-01-18] (Realtek Semiconductor)HKLM\...\Run: [FreeFallProtection] C:\Program Files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe [686704 2010-12-17] ()HKLM\...\Run: [intelTBRunOnce] wscript.exe //b //nologo "C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs" [4526 2010-11-29] ()HKLM\...\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon [1432144 2006-10-16] (CANON INC.)HKLM\...\Run: [intelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1933584 2010-12-17] (Intel® Corporation)HKLM\...\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup [207845 2011-05-30] ()HKLM\...\Run: [QuickSet] c:\Program Files\Dell\QuickSet\QuickSet.exe [4479648 2011-01-25] (Dell Inc.)HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1281512 2013-01-27] (Microsoft Corporation)HKLM\...\RunOnce: [*Restore] C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)HKLM-x32\...\Run: [] [x]HKLM-x32\...\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup [885760 2011-05-30] ()HKLM-x32\...\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-25] (Apple Inc.)HKU\Roberty\...\Run: [Aim] "C:\Program Files (x86)\AIM\aim.exe" /d locale=en-US [4331392 2012-05-30] (AOL Inc.)HKU\Roberty\...\Run: [GoogleChromeAutoLaunch_994E78B1C6964A952745C39F20184D66] "C:\Users\Roberty\AppData\Local\Google\Chrome\Application\chrome.exe" --no-startup-window [1312720 2013-04-09] (Google Inc.)HKU\Roberty\...\Run: [Google Update] "C:\Users\Roberty\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-08-13] (Google Inc.)HKU\Roberty\...\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] C:\Users\Roberty\Documents\7ca88402.exe [24064 2013-05-17] ()HKU\Roberty\...\Winlogon: [shell] cmd.exe [345088 2010-11-20] (Microsoft Corporation) <==== ATTENTIONAppInit_DLLs: C:\Windows\system32\nvinitx.dll [239720 2011-05-21] (NVIDIA Corporation)==================== Services (Whitelisted) =================S2 CLKMSVC10_9EC60124; c:\Program Files (x86)\Cyberlink\PowerDVD9\NavFilter\kmsvc.exe [236016 2010-10-29] (CyberLink)S2 IJPLMSVC; C:\Program Files (x86)\Canon\IJPLM\IJPLMSVC.EXE [99936 2006-11-10] ()S2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-12-17] ()S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)S2 Adobe Licensing Console; %SystemRoot%\system32\msvfd32.exe [x]S2 SftService; "C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE" [x]==================== Drivers (Whitelisted) ====================S1 A2DDA; C:\Users\Roberty\Desktop\comp stuff\Emsisoft emergency kit\Run\a2ddax64.sys [26176 2013-04-18] (Emsisoft GmbH)S3 appliand; C:\Windows\System32\DRIVERS\appliand.sys [33888 2011-06-25] (Applian Technologies Inc.)S3 appliandMP; C:\Windows\System32\DRIVERS\appliand.sys [33888 2011-06-25] (Applian Technologies Inc.)S3 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [270912 2011-10-16] (DT Soft Ltd)S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)S3 PcdrNdisuio; syswow64\drivers\pcdrndisuio.sys [x]==================== NetSvcs (Whitelisted) ======================================= One Month Created Files and Folders ========2013-05-17 01:46 - 2013-05-17 01:46 - 01096081 ____A C:\Users\Roberty\Local Settings\Application Data\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096081 ____A C:\Users\Roberty\Local Settings\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096081 ____A C:\Users\Roberty\AppData\Local\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096052 ____A C:\ProgramData\Application Data\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096052 ____A C:\ProgramData\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096030 ____A C:\Users\Roberty\Application Data\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096030 ____A C:\Users\Roberty\AppData\Roaming\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 00024064 ____A C:\Users\Roberty\My Documents\7ca88402.exe2013-05-17 01:46 - 2013-05-17 01:46 - 00024064 ____A C:\Users\Roberty\Documents\7ca88402.exe2013-05-17 00:57 - 2013-05-17 01:04 - 317833178 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 07 [DD26C39E].mkv2013-05-17 00:57 - 2013-05-17 00:57 - 00026605 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 07 [720p].mkv.torrent2013-05-17 00:57 - 2013-05-17 00:57 - 00024517 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 07 [DD26C39E].mkv.torrent2013-05-17 00:57 - 2013-05-17 00:57 - 00015982 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 07 [h264-720p][1811D4CD].mkv.torrent2013-05-17 00:44 - 2013-05-17 00:52 - 364630566 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 07 [9A59FE10].mkv2013-05-17 00:42 - 2013-05-17 00:42 - 00014252 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 07 [9A59FE10].mkv.torrent2013-05-17 00:16 - 2013-05-17 00:16 - 00000000 ____D C:\FRST2013-05-16 04:11 - 2013-04-05 01:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll2013-05-16 04:11 - 2013-04-05 01:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll2013-05-16 04:11 - 2013-04-05 01:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe2013-05-16 04:11 - 2013-04-05 01:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll2013-05-16 04:11 - 2013-04-05 01:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll2013-05-16 04:11 - 2013-04-05 01:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll2013-05-16 04:11 - 2013-04-05 01:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll2013-05-16 04:11 - 2013-04-05 01:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll2013-05-16 04:11 - 2013-04-05 01:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll2013-05-16 04:11 - 2013-04-05 01:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll2013-05-16 04:11 - 2013-04-05 01:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll2013-05-16 04:11 - 2013-04-05 01:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll2013-05-16 04:11 - 2013-04-05 01:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll2013-05-16 04:11 - 2013-04-05 01:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll2013-05-16 04:11 - 2013-04-05 00:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2013-05-16 04:11 - 2013-04-05 00:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2013-05-16 04:11 - 2013-04-05 00:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2013-05-16 04:11 - 2013-04-05 00:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2013-05-16 04:11 - 2013-04-05 00:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2013-05-16 04:11 - 2013-04-05 00:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2013-05-16 04:11 - 2013-04-05 00:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2013-05-16 04:11 - 2013-04-05 00:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2013-05-16 04:11 - 2013-04-05 00:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2013-05-16 04:11 - 2013-04-05 00:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll2013-05-16 04:11 - 2013-04-05 00:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2013-05-16 04:11 - 2013-04-05 00:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2013-05-16 04:11 - 2013-04-05 00:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2013-05-16 04:11 - 2013-04-04 23:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb2013-05-16 04:11 - 2013-04-04 23:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2013-05-16 04:11 - 2013-04-04 22:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe2013-05-16 04:11 - 2013-04-04 22:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe2013-05-16 01:24 - 2013-05-16 01:24 - 00015053 ____A C:\Users\Roberty\Downloads\[Commie] Red Data Girl - 07 [9E511653].mkv.torrent2013-05-15 23:53 - 2013-05-15 23:53 - 00018384 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 07 [43542873].mkv.torrent2013-05-15 12:08 - 2013-04-10 01:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys2013-05-15 12:08 - 2013-04-10 01:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys2013-05-15 12:08 - 2013-04-09 22:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys2013-05-15 12:08 - 2013-03-19 00:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll2013-05-15 12:08 - 2013-03-19 00:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll2013-05-15 12:08 - 2013-02-27 01:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe2013-05-15 12:08 - 2013-02-27 00:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll2013-05-15 12:08 - 2013-02-27 00:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll2013-05-15 12:08 - 2013-02-27 00:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll2013-05-15 12:08 - 2013-02-27 00:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll2013-05-15 12:08 - 2013-02-26 23:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll2013-05-15 12:08 - 2013-02-26 23:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll2013-05-15 12:08 - 2013-02-26 23:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll2013-05-15 12:08 - 2011-02-03 06:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll2013-05-14 23:08 - 2013-05-14 23:09 - 00000059 ____A C:\Users\Roberty\Desktop\sublet.txt2013-05-14 20:20 - 2013-05-14 20:20 - 00002318 ____A C:\Users\Roberty\Downloads\TrillEndTurn.mscz2013-05-14 20:15 - 2013-05-14 20:15 - 17613192 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2013-05-13 01:32 - 2013-05-13 01:34 - 154004500 ____A C:\Users\Roberty\Downloads\CD 2.zip2013-05-13 01:32 - 2013-05-13 01:33 - 46036144 ____A C:\Users\Roberty\Downloads\Sasami-san@Ganbaranai OP Single.zip2013-05-13 01:31 - 2013-05-13 01:32 - 146825869 ____A C:\Users\Roberty\Downloads\CD 1.zip2013-05-12 18:25 - 2013-05-12 18:25 - 00011325 ____A C:\Users\Roberty\Downloads\[uTW-Vivid]_Suisei_no_Gargantia_-_06_[h264-720p][1913EBDC].mkv.torrent2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\Local Settings\MusE2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\Local Settings\Application Data\MusE2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\Application Data\MusE2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\MusE2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\AppData\Local\MusE2013-05-12 02:56 - 2013-05-12 02:57 - 00000000 ____D C:\Program Files (x86)\MuseScore2013-05-12 02:55 - 2013-05-12 02:56 - 38678632 ____A C:\Users\Roberty\Downloads\MuseScore-1.3.exe2013-05-11 21:51 - 2013-05-11 21:51 - 00021566 ____A C:\Users\Roberty\Downloads\[rori] Hentai Ouji to Warawanai Neko - 05 [1CA32DE3].mkv.torrent2013-05-11 18:00 - 2013-05-11 18:00 - 00028007 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_06_[58DD948A].mkv.torrent2013-05-11 17:59 - 2013-05-11 17:59 - 00017418 ____A C:\Users\Roberty\Downloads\[Commie] Shingeki no Kyojin - 06 [9EB697CD].mkv.torrent2013-05-11 16:09 - 2013-05-11 16:09 - 00019898 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_05_[3C4316EC].mkv.torrent2013-05-11 13:36 - 2013-05-11 13:36 - 00026204 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Oreimo S2 - 06 [720p].mkv.torrent2013-05-10 21:09 - 2013-05-10 21:09 - 00019487 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 06 [0EA312EF].mkv.torrent2013-05-10 02:47 - 2013-05-10 02:51 - 218114955 ____A C:\Users\Roberty\Downloads\Chuunibyou demo Koi ga Shitai! Original Soundtrack.zip2013-05-09 23:26 - 2013-05-09 23:26 - 00014402 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 06 [h264-720p][E01A643A].mkv.torrent2013-05-09 22:16 - 2013-05-09 22:16 - 00026645 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 06 [720p].mkv.torrent2013-05-09 22:16 - 2013-05-09 22:16 - 00022957 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 06 [1561E908].mkv.torrent2013-05-09 22:16 - 2013-05-09 22:16 - 00013075 ____A C:\Users\Roberty\Downloads\[uTW]_Photokano_-_06_[h264-720p][20C46E61].mkv.torrent2013-05-09 15:23 - 2013-05-09 15:23 - 00000881 ____A C:\Users\Roberty\Downloads\5-9-13 BCA.txt2013-05-09 00:38 - 2013-05-09 00:38 - 00012552 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 06 [609D1BF5].mkv.torrent2013-05-09 00:37 - 2013-05-09 00:37 - 00016404 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 06 [D7315B5E].mkv.torrent2013-05-09 00:37 - 2013-05-09 00:37 - 00015280 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Dansai Bunri no Crime Edge - 06 [h264-720p][AA0E2578].mkv.torrent2013-05-06 01:57 - 2013-05-06 01:58 - 00000000 ____D C:\Users\Roberty\Desktop\Shinsekai Yori OST2013-05-06 01:41 - 2013-05-06 01:58 - 145064823 ____A C:\Users\Roberty\Downloads\Shinsekai Yori ED1-2 Single.zip2013-05-06 01:41 - 2013-05-06 01:44 - 110688048 ____A C:\Users\Roberty\Downloads\Shinsekai Yori Original Soundtrack CD1.zip2013-05-06 01:40 - 2013-05-06 01:42 - 97281297 ____A C:\Users\Roberty\Downloads\Shinsekai Yori Original Soundtrack CD2.zip2013-05-05 18:32 - 2013-05-05 18:32 - 00011345 ____A C:\Users\Roberty\Downloads\[uTW-Vivid]_Suisei_no_Gargantia_-_05_[h264-720p][F023716C].mkv.torrent2013-05-04 18:03 - 2013-05-04 18:03 - 00043367 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_05_[4F8DC1FE].mkv.torrent2013-05-04 15:19 - 2013-05-04 15:19 - 00026204 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Oreimo S2 - 05 [720p].mkv.torrent2013-05-04 15:19 - 2013-05-04 15:19 - 00018778 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_04_[62E1DBF8].mkv.torrent2013-05-04 03:27 - 2013-05-04 03:27 - 00010557 ____A C:\Users\Roberty\Downloads\[Commie] Yahari Ore no Seishun Love Comedy wa Machigatteiru - My Teenage RomCom SNAFU - 05 [81EFE37C].mkv.torrent2013-05-03 23:12 - 2013-05-03 23:12 - 00017180 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 05 [263D245F].mkv.torrent2013-05-03 14:00 - 2013-05-03 14:05 - 00001120 ____A C:\Users\Roberty\Downloads\5-3-13 BCA.txt2013-05-03 01:10 - 2013-05-03 01:10 - 00026925 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 05 [720p].mkv.torrent2013-05-03 01:09 - 2013-05-03 01:09 - 00013342 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 05 [h264-720p][2C4D5F3B].mkv.torrent2013-05-03 01:08 - 2013-05-03 01:08 - 00014688 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 05 [CAA2CC24].mkv.torrent2013-05-03 01:07 - 2013-05-03 01:07 - 00011675 ____A C:\Users\Roberty\Downloads\[uTW]_Photokano_-_05_[h264-720p][7B7F1136].mkv.torrent2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\Local Settings\Application Data\{F189B0AE-4EDF-4CBF-809C-D59E82E7FB32}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\Local Settings\Application Data\{748B2987-B1F6-4D79-8310-D08DEAB8FA95}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\Local Settings\{F189B0AE-4EDF-4CBF-809C-D59E82E7FB32}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\Local Settings\{748B2987-B1F6-4D79-8310-D08DEAB8FA95}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\AppData\Local\{F189B0AE-4EDF-4CBF-809C-D59E82E7FB32}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\AppData\Local\{748B2987-B1F6-4D79-8310-D08DEAB8FA95}2013-05-02 03:47 - 2013-05-02 03:50 - 00000000 ____D C:\Program Files (x86)\VST2013-05-02 01:47 - 2013-05-02 01:47 - 00013580 ____A C:\Users\Roberty\Downloads\[Commie] Red Data Girl - 05 [3112FD30].mkv.torrent2013-05-01 23:31 - 2013-05-01 23:31 - 00013087 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 05 [C72D3F29].mkv.torrent2013-05-01 22:17 - 2013-05-01 22:17 - 00016822 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 05 [C2683E71].mkv.torrent2013-05-01 02:47 - 2013-05-01 02:47 - 00011704 ____A C:\Users\Roberty\Downloads\[Commie] Yahari Ore no Seishun Love Comedy wa Machigatteiru - My Teenage RomCom SNAFU - 04 [D1A71D9F].mkv.torrent2013-04-30 23:51 - 2013-04-30 23:51 - 00000005 ____A C:\Windows\kpfolfka.ini2013-04-30 23:48 - 2013-04-30 23:48 - 00000005 ____A C:\Windows\oleajonn.ini2013-04-30 23:41 - 2013-04-30 23:45 - 00000000 ____D C:\Users\Roberty\My Documents\My Ivory Cantabile Files2013-04-30 23:41 - 2013-04-30 23:45 - 00000000 ____D C:\Users\Roberty\Documents\My Ivory Cantabile Files2013-04-30 23:41 - 2013-04-30 23:41 - 00000000 ____D C:\Users\Roberty\Application Data\Synthogy2013-04-30 23:41 - 2013-04-30 23:41 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\Synthogy2013-04-30 23:35 - 2013-05-02 03:47 - 00083505 ____A C:\Program Files (x86)\Uninstal.exe2013-04-30 23:35 - 2013-05-02 03:47 - 00000000 ____D C:\Program Files (x86)\Synthogy2013-04-30 23:19 - 2013-04-30 23:33 - 00000000 ____D C:\Synthogy Ivory 1.502013-04-30 21:42 - 2013-04-30 21:42 - 00019220 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 04 [A3CE6140].mkv.torrent2013-04-30 21:42 - 2013-04-30 21:42 - 00019220 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 04 [A3CE6140].mkv (1).torrent2013-04-30 04:48 - 2013-04-30 04:48 - 00001416 ____A C:\Users\UpdatusUser\Desktop\CVPiano-Modeled.lnk2013-04-30 04:47 - 2007-02-23 21:09 - 00905728 ____A (SIA Syncrosoft) C:\Windows\System32\synsoacc.dll2013-04-30 04:47 - 2006-11-16 18:58 - 00031248 ____A (SIA Syncrosoft) C:\Windows\System32\Drivers\synUSB64.sys2013-04-30 04:47 - 2006-01-29 14:48 - 00401462 ____A (Microsoft Corporation) C:\Windows\SysWOW64\temp.0002013-04-30 04:47 - 2006-01-29 14:48 - 00147425 ____A C:\Windows\System32\SYNSOACC-Aide.chm2013-04-30 04:47 - 2006-01-29 14:48 - 00120468 ____A C:\Windows\System32\SYNSOACC-Hilfe.chm2013-04-30 04:47 - 2006-01-29 14:48 - 00114279 ____A C:\Windows\System32\SYNSOACC-Help.chm2013-04-29 02:57 - 2013-04-29 02:57 - 00018204 ____A C:\Users\Roberty\Downloads\[uTW-Vivid]_Suisei_no_Gargantia_-_04_[h264-720p][D33AE3BB].mkv.torrent2013-04-28 15:18 - 2013-04-28 15:18 - 00026014 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Suisei no Gargantia - 04 [720p].mkv.torrent2013-04-28 15:18 - 2013-04-28 15:18 - 00011015 ____A C:\Users\Roberty\Downloads\[uTW]_Photokano_-_04_[h264-720p][813C1052].mkv.torrent2013-04-27 22:02 - 2013-04-27 22:02 - 00035707 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_04_[36EF8BD0].mkv.torrent2013-04-27 16:01 - 2013-04-27 16:01 - 00026204 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Oreimo S2 - 04 [720p].mkv.torrent2013-04-27 16:00 - 2013-04-27 16:00 - 00018858 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_03_[0E161BCC].mkv.torrent2013-04-26 20:38 - 2013-04-26 20:38 - 00016482 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 04 [h264-720p][FC7501E6].mkv.torrent2013-04-25 23:07 - 2013-04-25 23:07 - 00026885 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 04 [720p].mkv.torrent2013-04-25 23:07 - 2013-04-25 23:07 - 00013278 ____A C:\Users\Roberty\Downloads\[Hien] Chuunibyou Demo Koi ga Shitai! - Depth of Field ~ Ai to Nikushimi Gekijou Phase 5 [bD 1080p H.264 10-bit AAC][1EE86152].mkv.torrent2013-04-25 23:07 - 2013-04-25 23:07 - 00011790 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 04 [6B837B52].mkv.torrent2013-04-25 18:11 - 2013-04-25 18:11 - 00819595 ____A C:\Users\Roberty\Downloads\Attachments_2013425.zip2013-04-25 02:45 - 2013-04-25 02:45 - 00012587 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 04 [62492EF4].mkv.torrent2013-04-24 23:15 - 2013-04-24 23:15 - 00015162 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 04 [93561A30].mkv.torrent2013-04-24 15:16 - 2013-04-12 09:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys2013-04-21 17:35 - 2013-04-21 17:35 - 00012145 ____A C:\Users\Roberty\Downloads\[uTW-Vivid]_Suisei_no_Gargantia_-_03_[h264-720p][9FE96C2A].mkv.torrent2013-04-21 15:58 - 2013-04-21 15:58 - 00026054 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Suisei no Gargantia - 03 [720p].mkv.torrent2013-04-21 06:30 - 2013-04-21 06:30 - 00000000 ____D C:\Users\Roberty\Application Data\SynthMaker2013-04-21 06:30 - 2013-04-21 06:30 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\SynthMaker2013-04-21 06:26 - 2013-05-02 03:50 - 00000000 ____D C:\Program Files (x86)\VstPlugins2013-04-21 06:26 - 2013-04-21 06:26 - 00001152 ____A C:\Users\UpdatusUser\Desktop\FL Studio 10.lnk2013-04-21 06:26 - 2013-04-21 06:26 - 00001144 ____A C:\Users\Roberty\Desktop\ASIO4ALL v2 Instruction Manual.lnk2013-04-21 06:26 - 2013-04-21 06:26 - 00000000 ____D C:\Users\Roberty\My Documents\Image-Line2013-04-21 06:26 - 2013-04-21 06:26 - 00000000 ____D C:\Users\Roberty\Documents\Image-Line2013-04-21 06:26 - 2013-04-21 06:26 - 00000000 ____D C:\Program Files (x86)\Outsim2013-04-21 06:26 - 2013-04-21 06:26 - 00000000 ____D C:\Program Files (x86)\ASIO4ALL v22013-04-21 06:26 - 2009-09-15 04:14 - 01554944 ____A (HMS http://hp.vector.co.jp/authors/VA012897/) C:\Windows\SysWOW64\vorbis.acm2013-04-21 06:26 - 2006-06-20 03:56 - 00225280 ____A (Propellerhead Software AB) C:\Windows\SysWOW64\rewire.dll2013-04-21 06:22 - 2013-04-21 06:26 - 00000000 ____D C:\Program Files (x86)\Image-Line2013-04-21 06:21 - 2013-04-21 06:21 - 00818169 ____A ( ) C:\Windows\SysWOW64\msvfd32.exe2013-04-20 21:10 - 2013-04-20 21:10 - 00029487 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_03_[F23BCC9D].mkv.torrent2013-04-20 19:39 - 2013-04-20 19:39 - 00046827 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_02_[AF2A47CF].mkv (1).torrent2013-04-20 19:35 - 2013-04-20 19:35 - 00020880 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_02v2_[b4F2EA74].mkv.torrent2013-04-20 14:29 - 2013-04-20 14:29 - 00026264 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Oreimo S2 - 03 [720p].mkv.torrent2013-04-20 14:28 - 2013-04-20 14:28 - 00020878 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_02 [6043C689].mkv.torrent2013-04-20 04:20 - 2013-04-20 04:20 - 00000000 ____D C:\Users\Roberty\Desktop\Sakurasou OST2013-04-20 04:16 - 2013-04-20 04:18 - 135244186 ____A C:\Users\Roberty\Downloads\SAKURASOU NO PET NA KANOJO Special Disc Vol.2 Soundtrack 1.7z2013-04-20 03:11 - 2013-04-20 03:11 - 00018201 ____A C:\Users\Roberty\Downloads\[gg]_Aku_no_Hana_-_03_[1591D8CE].mkv.torrent2013-04-20 02:28 - 2013-04-20 02:28 - 00013340 ____A C:\Users\Roberty\Downloads\[Commie] Red Data Girl - 03 [CA2A90A5].mkv.torrent2013-04-19 23:09 - 2013-04-19 23:09 - 00262144 ____A C:\Windows\Minidump\041913-34398-01.dmp2013-04-19 22:51 - 2013-04-19 22:52 - 00262144 ____A C:\Windows\Minidump\041913-30560-01.dmp2013-04-19 22:17 - 2013-04-19 22:17 - 00262144 ____A C:\Windows\Minidump\041913-34195-01.dmp2013-04-19 22:12 - 2013-04-19 22:12 - 00262144 ____A C:\Windows\Minidump\041913-25084-01.dmp2013-04-19 22:10 - 2013-04-19 22:10 - 00010775 ____A C:\Users\Roberty\Downloads\[uTW]_Photokano_-_03_[h264-720p][39B23ACE].mkv.torrent2013-04-19 22:09 - 2013-04-19 22:09 - 00014158 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 03 [AC862BEA].mkv.torrent2013-04-19 08:03 - 2013-04-19 08:03 - 00354304 ____A (Microsoft Corporation) C:\Users\Roberty\Downloads\StikyNot (1).exe2013-04-19 08:02 - 2013-04-19 08:03 - 00354304 ____A (Microsoft Corporation) C:\Users\Roberty\Downloads\StikyNot.exe2013-04-19 03:39 - 2013-04-19 03:39 - 00000000 __SHD C:\found.0012013-04-19 03:11 - 2013-04-19 03:11 - 00181950 ____A C:\Users\Roberty\Downloads\StikyNot.zip2013-04-19 03:02 - 2013-04-19 03:02 - 00154640 ____A C:\Users\Roberty\Downloads\Sticky Notes.exe2013-04-19 02:23 - 2013-04-19 02:23 - 00026905 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 03 [720p].mkv.torrent2013-04-19 02:23 - 2013-04-19 02:23 - 00014044 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 03 [E54AD6FE].mkv.torrent2013-04-19 02:23 - 2013-04-19 02:23 - 00011610 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 03 [480F888D].mkv.torrent2013-04-19 02:15 - 2013-04-19 02:15 - 00584600 ____A C:\Users\Roberty\Downloads\cbsidlm-tr1_13-7_Sticky_Notes-ORG-75375596.exe2013-04-19 01:07 - 2013-04-19 01:07 - 00014662 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 03 [h264-720p][DE3A3CAA].mkv.torrent2013-04-19 00:05 - 2013-04-19 00:05 - 00000000 ____D C:\Windows\SysWOW64\tenarchlib2013-04-19 00:05 - 2013-04-19 00:05 - 00000000 ____D C:\Users\Roberty\Application Data\Tenebril2013-04-19 00:05 - 2013-04-19 00:05 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\Tenebril2013-04-18 23:41 - 2013-04-18 23:42 - 04685671 ____A C:\Users\Roberty\Downloads\StickyNote_9.0.zip2013-04-18 23:41 - 2013-04-18 23:41 - 00290240 ____A (SoftSafe) C:\Users\Roberty\Downloads\StickyNote 9.0.zip (1).exe2013-04-18 23:41 - 2013-04-18 23:41 - 00000000 ____D C:\ProgramData\SoftSafe2013-04-18 23:41 - 2013-04-18 23:41 - 00000000 ____D C:\ProgramData\Application Data\SoftSafe2013-04-18 23:40 - 2013-04-18 23:41 - 00000000 ____D C:\ProgramData\InstallMate2013-04-18 23:40 - 2013-04-18 23:41 - 00000000 ____D C:\ProgramData\Application Data\InstallMate2013-04-18 23:40 - 2013-04-18 23:40 - 00290240 ____A (SoftSafe) C:\Users\Roberty\Downloads\StickyNote 9.0.zip.exe2013-04-18 23:04 - 2013-04-18 23:09 - 00000866 ____A C:\Windows\SysWOW64\InstallUtil.InstallLog2013-04-18 21:56 - 2013-04-18 12:03 - 00071168 ____A C:\Users\Roberty\Desktop\StickyNotes.snt2013-04-18 19:51 - 2013-04-19 22:21 - 00002244 ____A C:\Windows\epplauncher.mif2013-04-18 19:51 - 2013-04-18 19:51 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client2013-04-18 19:50 - 2013-04-18 19:51 - 00000000 ____D C:\Program Files\Microsoft Security Client2013-04-18 19:49 - 2013-04-18 19:50 - 13475464 ____A (Microsoft Corporation) C:\Users\Roberty\Downloads\mseinstall.exe2013-04-18 18:00 - 2013-04-18 18:00 - 00064306 ____A C:\Users\Roberty\Downloads\cc_20130418_160033.reg2013-04-18 01:48 - 2013-04-18 01:48 - 00013567 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 03 [1E3F52B8].mkv.torrent2013-04-17 22:42 - 2013-04-17 22:42 - 07601227 ____A C:\Users\Roberty\Downloads\Attachments_2013417.zip2013-04-17 13:10 - 2013-04-17 13:10 - 00291225 ____A C:\Users\Roberty\Downloads\morphology.zip==================== One Month Modified Files and Folders =======2013-05-17 01:56 - 2012-12-21 17:02 - 00036032 ____A C:\Windows\setupact.log2013-05-17 01:56 - 2011-08-08 17:49 - 00000000 ____D C:\ProgramData\NVIDIA2013-05-17 01:56 - 2011-08-08 17:49 - 00000000 ____D C:\ProgramData\Application Data\NVIDIA2013-05-17 01:56 - 2011-08-08 16:22 - 00000000 ____D C:\Users\Default\Local Settings\SoftThinks2013-05-17 01:56 - 2011-08-08 16:22 - 00000000 ____D C:\Users\Default\Local Settings\Application Data\SoftThinks2013-05-17 01:56 - 2011-08-08 16:22 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks2013-05-17 01:56 - 2011-08-08 16:22 - 00000000 ____D C:\Users\Default User\Local Settings\SoftThinks2013-05-17 01:56 - 2011-08-08 16:22 - 00000000 ____D C:\Users\Default User\Local Settings\Application Data\SoftThinks2013-05-17 01:56 - 2011-08-08 16:22 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks2013-05-17 01:56 - 2011-08-08 16:15 - 00000000 ____D C:\Dell DataSafe Local Backup2013-05-17 01:56 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT2013-05-17 01:46 - 2013-05-17 01:46 - 01096081 ____A C:\Users\Roberty\Local Settings\Application Data\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096081 ____A C:\Users\Roberty\Local Settings\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096081 ____A C:\Users\Roberty\AppData\Local\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096052 ____A C:\ProgramData\Application Data\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096052 ____A C:\ProgramData\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096030 ____A C:\Users\Roberty\Application Data\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 01096030 ____A C:\Users\Roberty\AppData\Roaming\2433f4332013-05-17 01:46 - 2013-05-17 01:46 - 00024064 ____A C:\Users\Roberty\My Documents\7ca88402.exe2013-05-17 01:46 - 2013-05-17 01:46 - 00024064 ____A C:\Users\Roberty\Documents\7ca88402.exe2013-05-17 01:21 - 2011-08-13 16:31 - 00000916 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3481103015-3984997456-3542171105-1002UA.job2013-05-17 01:15 - 2012-04-13 19:39 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job2013-05-17 01:06 - 2011-08-14 14:45 - 00000000 ____D C:\Users\Roberty\Application Data\uTorrent2013-05-17 01:06 - 2011-08-14 14:45 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\uTorrent2013-05-17 01:04 - 2013-05-17 00:57 - 317833178 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 07 [DD26C39E].mkv2013-05-17 01:00 - 2009-07-14 00:13 - 00796662 ____A C:\Windows\System32\PerfStringBackup.INI2013-05-17 00:57 - 2013-05-17 00:57 - 00026605 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 07 [720p].mkv.torrent2013-05-17 00:57 - 2013-05-17 00:57 - 00024517 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 07 [DD26C39E].mkv.torrent2013-05-17 00:57 - 2013-05-17 00:57 - 00015982 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 07 [h264-720p][1811D4CD].mkv.torrent2013-05-17 00:52 - 2013-05-17 00:44 - 364630566 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 07 [9A59FE10].mkv2013-05-17 00:42 - 2013-05-17 00:42 - 00014252 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 07 [9A59FE10].mkv.torrent2013-05-17 00:38 - 2009-07-13 23:45 - 00021312 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02013-05-17 00:38 - 2009-07-13 23:45 - 00021312 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02013-05-17 00:34 - 2011-08-08 17:51 - 01488459 ____A C:\Windows\WindowsUpdate.log2013-05-17 00:33 - 2011-08-08 16:44 - 00000000 ____D C:\ProgramData\Sonic2013-05-17 00:33 - 2011-08-08 16:44 - 00000000 ____D C:\ProgramData\Application Data\Sonic2013-05-17 00:27 - 2011-08-13 16:31 - 00000864 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3481103015-3984997456-3542171105-1002Core.job2013-05-17 00:16 - 2013-05-17 00:16 - 00000000 ____D C:\FRST2013-05-16 22:50 - 2011-08-14 18:49 - 12937948 ____A C:\Users\Roberty\Desktop\stuff to do.txt2013-05-16 19:59 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache2013-05-16 12:01 - 2009-07-13 23:45 - 00473376 ____A C:\Windows\System32\FNTCACHE.DAT2013-05-16 04:20 - 2011-08-13 19:49 - 00000000 ____D C:\ProgramData\Microsoft Help2013-05-16 04:20 - 2011-08-13 19:49 - 00000000 ____D C:\ProgramData\Application Data\Microsoft Help2013-05-16 04:17 - 2011-09-18 04:10 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe2013-05-16 01:51 - 2013-03-13 22:39 - 00000000 ____D C:\Users\Roberty\Desktop\adv immuno II2013-05-16 01:24 - 2013-05-16 01:24 - 00015053 ____A C:\Users\Roberty\Downloads\[Commie] Red Data Girl - 07 [9E511653].mkv.torrent2013-05-15 23:53 - 2013-05-15 23:53 - 00018384 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 07 [43542873].mkv.torrent2013-05-14 23:09 - 2013-05-14 23:08 - 00000059 ____A C:\Users\Roberty\Desktop\sublet.txt2013-05-14 22:28 - 2012-01-09 21:32 - 00039496 ____A C:\Users\Roberty\Desktop\stuff to read.txt2013-05-14 20:20 - 2013-05-14 20:20 - 00002318 ____A C:\Users\Roberty\Downloads\TrillEndTurn.mscz2013-05-14 20:15 - 2013-05-14 20:15 - 17613192 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2013-05-14 20:15 - 2012-04-13 19:39 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2013-05-14 20:15 - 2011-10-03 12:13 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2013-05-14 17:26 - 2011-08-14 18:49 - 00110126 ____A C:\Users\Roberty\Desktop\youtube.txt2013-05-14 17:07 - 2012-08-16 21:34 - 00000383 ____A C:\Users\Roberty\Desktop\additional music.txt2013-05-13 02:34 - 2011-08-13 16:31 - 00000000 ____D C:\Program Files (x86)\Steam2013-05-13 02:31 - 2013-03-08 00:57 - 00000000 ____D C:\Users\Roberty\Desktop\FOR IPOD 122013-05-13 01:34 - 2013-05-13 01:32 - 154004500 ____A C:\Users\Roberty\Downloads\CD 2.zip2013-05-13 01:33 - 2013-05-13 01:32 - 46036144 ____A C:\Users\Roberty\Downloads\Sasami-san@Ganbaranai OP Single.zip2013-05-13 01:32 - 2013-05-13 01:31 - 146825869 ____A C:\Users\Roberty\Downloads\CD 1.zip2013-05-13 01:00 - 2012-07-25 21:11 - 00000000 ____D C:\Users\Roberty\Desktop\thesis2013-05-12 18:25 - 2013-05-12 18:25 - 00011325 ____A C:\Users\Roberty\Downloads\[uTW-Vivid]_Suisei_no_Gargantia_-_06_[h264-720p][1913EBDC].mkv.torrent2013-05-12 15:27 - 2012-09-09 01:45 - 00000000 ____D C:\Users\Roberty\Application Data\Synthesia2013-05-12 15:27 - 2012-09-09 01:45 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\Synthesia2013-05-12 15:23 - 2013-02-16 14:45 - 00127344 ____A C:\Windows\System32\GDIPFONTCACHEV1.DAT2013-05-12 13:40 - 2009-07-14 00:08 - 00032632 ____A C:\Windows\Tasks\SCHEDLGU.TXT2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\Local Settings\MusE2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\Local Settings\Application Data\MusE2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\Application Data\MusE2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\MusE2013-05-12 02:57 - 2013-05-12 02:57 - 00000000 ____D C:\Users\Roberty\AppData\Local\MusE2013-05-12 02:57 - 2013-05-12 02:56 - 00000000 ____D C:\Program Files (x86)\MuseScore2013-05-12 02:57 - 2011-12-25 00:45 - 00000000 ____D C:\Users\Roberty\Desktop\Audio and video2013-05-12 02:56 - 2013-05-12 02:55 - 38678632 ____A C:\Users\Roberty\Downloads\MuseScore-1.3.exe2013-05-12 01:08 - 2012-06-25 02:16 - 00000000 ____D C:\Users\Roberty\Desktop\Touhou medleys2013-05-11 21:51 - 2013-05-11 21:51 - 00021566 ____A C:\Users\Roberty\Downloads\[rori] Hentai Ouji to Warawanai Neko - 05 [1CA32DE3].mkv.torrent2013-05-11 18:00 - 2013-05-11 18:00 - 00028007 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_06_[58DD948A].mkv.torrent2013-05-11 17:59 - 2013-05-11 17:59 - 00017418 ____A C:\Users\Roberty\Downloads\[Commie] Shingeki no Kyojin - 06 [9EB697CD].mkv.torrent2013-05-11 16:09 - 2013-05-11 16:09 - 00019898 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_05_[3C4316EC].mkv.torrent2013-05-11 13:36 - 2013-05-11 13:36 - 00026204 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Oreimo S2 - 06 [720p].mkv.torrent2013-05-11 13:26 - 2013-02-22 23:01 - 00127344 ____A C:\Windows\SysWOW64\GDIPFONTCACHEV1.DAT2013-05-11 02:26 - 2011-08-17 00:06 - 00000000 ____D C:\Users\Roberty\Application Data\Skype2013-05-11 02:26 - 2011-08-17 00:06 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\Skype2013-05-10 21:09 - 2013-05-10 21:09 - 00019487 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 06 [0EA312EF].mkv.torrent2013-05-10 02:51 - 2013-05-10 02:47 - 218114955 ____A C:\Users\Roberty\Downloads\Chuunibyou demo Koi ga Shitai! Original Soundtrack.zip2013-05-09 23:26 - 2013-05-09 23:26 - 00014402 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 06 [h264-720p][E01A643A].mkv.torrent2013-05-09 22:16 - 2013-05-09 22:16 - 00026645 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 06 [720p].mkv.torrent2013-05-09 22:16 - 2013-05-09 22:16 - 00022957 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 06 [1561E908].mkv.torrent2013-05-09 22:16 - 2013-05-09 22:16 - 00013075 ____A C:\Users\Roberty\Downloads\[uTW]_Photokano_-_06_[h264-720p][20C46E61].mkv.torrent2013-05-09 15:23 - 2013-05-09 15:23 - 00000881 ____A C:\Users\Roberty\Downloads\5-9-13 BCA.txt2013-05-09 00:38 - 2013-05-09 00:38 - 00012552 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 06 [609D1BF5].mkv.torrent2013-05-09 00:37 - 2013-05-09 00:37 - 00016404 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 06 [D7315B5E].mkv.torrent2013-05-09 00:37 - 2013-05-09 00:37 - 00015280 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Dansai Bunri no Crime Edge - 06 [h264-720p][AA0E2578].mkv.torrent2013-05-08 18:15 - 2011-08-13 16:11 - 00000000 ____D C:\Users\Roberty\Local Settings\Nero2013-05-08 18:15 - 2011-08-13 16:11 - 00000000 ____D C:\Users\Roberty\Local Settings\Application Data\Nero2013-05-08 18:15 - 2011-08-13 16:11 - 00000000 ____D C:\Users\Roberty\AppData\Local\Nero2013-05-07 22:40 - 2013-04-04 21:36 - 00000000 ____D C:\Users\Roberty\Desktop\journal club2013-05-06 01:58 - 2013-05-06 01:57 - 00000000 ____D C:\Users\Roberty\Desktop\Shinsekai Yori OST2013-05-06 01:58 - 2013-05-06 01:41 - 145064823 ____A C:\Users\Roberty\Downloads\Shinsekai Yori ED1-2 Single.zip2013-05-06 01:44 - 2013-05-06 01:41 - 110688048 ____A C:\Users\Roberty\Downloads\Shinsekai Yori Original Soundtrack CD1.zip2013-05-06 01:42 - 2013-05-06 01:40 - 97281297 ____A C:\Users\Roberty\Downloads\Shinsekai Yori Original Soundtrack CD2.zip2013-05-05 18:32 - 2013-05-05 18:32 - 00011345 ____A C:\Users\Roberty\Downloads\[uTW-Vivid]_Suisei_no_Gargantia_-_05_[h264-720p][F023716C].mkv.torrent2013-05-04 18:03 - 2013-05-04 18:03 - 00043367 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_05_[4F8DC1FE].mkv.torrent2013-05-04 15:19 - 2013-05-04 15:19 - 00026204 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Oreimo S2 - 05 [720p].mkv.torrent2013-05-04 15:19 - 2013-05-04 15:19 - 00018778 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_04_[62E1DBF8].mkv.torrent2013-05-04 03:27 - 2013-05-04 03:27 - 00010557 ____A C:\Users\Roberty\Downloads\[Commie] Yahari Ore no Seishun Love Comedy wa Machigatteiru - My Teenage RomCom SNAFU - 05 [81EFE37C].mkv.torrent2013-05-03 23:12 - 2013-05-03 23:12 - 00017180 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 05 [263D245F].mkv.torrent2013-05-03 14:05 - 2013-05-03 14:00 - 00001120 ____A C:\Users\Roberty\Downloads\5-3-13 BCA.txt2013-05-03 01:10 - 2013-05-03 01:10 - 00026925 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 05 [720p].mkv.torrent2013-05-03 01:09 - 2013-05-03 01:09 - 00013342 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 05 [h264-720p][2C4D5F3B].mkv.torrent2013-05-03 01:08 - 2013-05-03 01:08 - 00014688 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 05 [CAA2CC24].mkv.torrent2013-05-03 01:07 - 2013-05-03 01:07 - 00011675 ____A C:\Users\Roberty\Downloads\[uTW]_Photokano_-_05_[h264-720p][7B7F1136].mkv.torrent2013-05-02 11:55 - 2013-02-27 12:37 - 00012442 ____A C:\Windows\PFRO.log2013-05-02 10:29 - 2010-11-20 22:27 - 00278800 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\Local Settings\Application Data\{F189B0AE-4EDF-4CBF-809C-D59E82E7FB32}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\Local Settings\Application Data\{748B2987-B1F6-4D79-8310-D08DEAB8FA95}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\Local Settings\{F189B0AE-4EDF-4CBF-809C-D59E82E7FB32}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\Local Settings\{748B2987-B1F6-4D79-8310-D08DEAB8FA95}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\AppData\Local\{F189B0AE-4EDF-4CBF-809C-D59E82E7FB32}2013-05-02 04:15 - 2013-05-02 04:15 - 00000000 ____D C:\Users\Roberty\AppData\Local\{748B2987-B1F6-4D79-8310-D08DEAB8FA95}2013-05-02 04:15 - 2011-11-23 01:09 - 00000000 ____D C:\Users\Roberty\Local Settings\Windows Live2013-05-02 04:15 - 2011-11-23 01:09 - 00000000 ____D C:\Users\Roberty\Local Settings\Application Data\Windows Live2013-05-02 04:15 - 2011-11-23 01:09 - 00000000 ____D C:\Users\Roberty\AppData\Local\Windows Live2013-05-02 03:50 - 2013-05-02 03:47 - 00000000 ____D C:\Program Files (x86)\VST2013-05-02 03:50 - 2013-04-21 06:26 - 00000000 ____D C:\Program Files (x86)\VstPlugins2013-05-02 03:47 - 2013-04-30 23:35 - 00083505 ____A C:\Program Files (x86)\Uninstal.exe2013-05-02 03:47 - 2013-04-30 23:35 - 00000000 ____D C:\Program Files (x86)\Synthogy2013-05-02 01:47 - 2013-05-02 01:47 - 00013580 ____A C:\Users\Roberty\Downloads\[Commie] Red Data Girl - 05 [3112FD30].mkv.torrent2013-05-01 23:31 - 2013-05-01 23:31 - 00013087 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 05 [C72D3F29].mkv.torrent2013-05-01 22:17 - 2013-05-01 22:17 - 00016822 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 05 [C2683E71].mkv.torrent2013-05-01 02:47 - 2013-05-01 02:47 - 00011704 ____A C:\Users\Roberty\Downloads\[Commie] Yahari Ore no Seishun Love Comedy wa Machigatteiru - My Teenage RomCom SNAFU - 04 [D1A71D9F].mkv.torrent2013-04-30 23:51 - 2013-04-30 23:51 - 00000005 ____A C:\Windows\kpfolfka.ini2013-04-30 23:48 - 2013-04-30 23:48 - 00000005 ____A C:\Windows\oleajonn.ini2013-04-30 23:45 - 2013-04-30 23:41 - 00000000 ____D C:\Users\Roberty\My Documents\My Ivory Cantabile Files2013-04-30 23:45 - 2013-04-30 23:41 - 00000000 ____D C:\Users\Roberty\Documents\My Ivory Cantabile Files2013-04-30 23:41 - 2013-04-30 23:41 - 00000000 ____D C:\Users\Roberty\Application Data\Synthogy2013-04-30 23:41 - 2013-04-30 23:41 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\Synthogy2013-04-30 23:33 - 2013-04-30 23:19 - 00000000 ____D C:\Synthogy Ivory 1.502013-04-30 21:42 - 2013-04-30 21:42 - 00019220 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 04 [A3CE6140].mkv.torrent2013-04-30 21:42 - 2013-04-30 21:42 - 00019220 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 04 [A3CE6140].mkv (1).torrent2013-04-30 04:48 - 2013-04-30 04:48 - 00001416 ____A C:\Users\UpdatusUser\Desktop\CVPiano-Modeled.lnk2013-04-29 02:57 - 2013-04-29 02:57 - 00018204 ____A C:\Users\Roberty\Downloads\[uTW-Vivid]_Suisei_no_Gargantia_-_04_[h264-720p][D33AE3BB].mkv.torrent2013-04-28 15:18 - 2013-04-28 15:18 - 00026014 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Suisei no Gargantia - 04 [720p].mkv.torrent2013-04-28 15:18 - 2013-04-28 15:18 - 00011015 ____A C:\Users\Roberty\Downloads\[uTW]_Photokano_-_04_[h264-720p][813C1052].mkv.torrent2013-04-28 15:07 - 2011-08-08 16:14 - 00000000 ____D C:\ProgramData\Application Data\Adobe2013-04-28 15:07 - 2011-08-08 16:14 - 00000000 ____D C:\ProgramData\Adobe2013-04-27 22:02 - 2013-04-27 22:02 - 00035707 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_04_[36EF8BD0].mkv.torrent2013-04-27 16:01 - 2013-04-27 16:01 - 00026204 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Oreimo S2 - 04 [720p].mkv.torrent2013-04-27 16:00 - 2013-04-27 16:00 - 00018858 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_03_[0E161BCC].mkv.torrent2013-04-26 23:59 - 2013-02-19 03:58 - 00000000 ___RD C:\Program Files (x86)\Skype2013-04-26 23:59 - 2011-08-08 16:16 - 00000000 ____D C:\ProgramData\Skype2013-04-26 23:59 - 2011-08-08 16:16 - 00000000 ____D C:\ProgramData\Application Data\Skype2013-04-26 23:22 - 2011-08-14 15:43 - 00000000 ____D C:\Users\Roberty\Desktop\keyboard stuff2013-04-26 20:38 - 2013-04-26 20:38 - 00016482 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 04 [h264-720p][FC7501E6].mkv.torrent2013-04-25 23:07 - 2013-04-25 23:07 - 00026885 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 04 [720p].mkv.torrent2013-04-25 23:07 - 2013-04-25 23:07 - 00013278 ____A C:\Users\Roberty\Downloads\[Hien] Chuunibyou Demo Koi ga Shitai! - Depth of Field ~ Ai to Nikushimi Gekijou Phase 5 [bD 1080p H.264 10-bit AAC][1EE86152].mkv.torrent2013-04-25 23:07 - 2013-04-25 23:07 - 00011790 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 04 [6B837B52].mkv.torrent2013-04-25 18:11 - 2013-04-25 18:11 - 00819595 ____A C:\Users\Roberty\Downloads\Attachments_2013425.zip2013-04-25 02:45 - 2013-04-25 02:45 - 00012587 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 04 [62492EF4].mkv.torrent2013-04-24 23:15 - 2013-04-24 23:15 - 00015162 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 04 [93561A30].mkv.torrent2013-04-21 20:05 - 2011-12-08 04:44 - 00027666 ____A C:\Users\Roberty\Application Data\ReplayMusicLog.log2013-04-21 20:05 - 2011-12-08 04:44 - 00027666 ____A C:\Users\Roberty\AppData\Roaming\ReplayMusicLog.log2013-04-21 17:35 - 2013-04-21 17:35 - 00012145 ____A C:\Users\Roberty\Downloads\[uTW-Vivid]_Suisei_no_Gargantia_-_03_[h264-720p][9FE96C2A].mkv.torrent2013-04-21 15:58 - 2013-04-21 15:58 - 00026054 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Suisei no Gargantia - 03 [720p].mkv.torrent2013-04-21 06:30 - 2013-04-21 06:30 - 00000000 ____D C:\Users\Roberty\Application Data\SynthMaker2013-04-21 06:30 - 2013-04-21 06:30 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\SynthMaker2013-04-21 06:26 - 2013-04-21 06:26 - 00001152 ____A C:\Users\UpdatusUser\Desktop\FL Studio 10.lnk2013-04-21 06:26 - 2013-04-21 06:26 - 00001144 ____A C:\Users\Roberty\Desktop\ASIO4ALL v2 Instruction Manual.lnk2013-04-21 06:26 - 2013-04-21 06:26 - 00000000 ____D C:\Users\Roberty\My Documents\Image-Line2013-04-21 06:26 - 2013-04-21 06:26 - 00000000 ____D C:\Users\Roberty\Documents\Image-Line2013-04-21 06:26 - 2013-04-21 06:26 - 00000000 ____D C:\Program Files (x86)\Outsim2013-04-21 06:26 - 2013-04-21 06:26 - 00000000 ____D C:\Program Files (x86)\ASIO4ALL v22013-04-21 06:26 - 2013-04-21 06:22 - 00000000 ____D C:\Program Files (x86)\Image-Line2013-04-21 06:21 - 2013-04-21 06:21 - 00818169 ____A ( ) C:\Windows\SysWOW64\msvfd32.exe2013-04-20 21:10 - 2013-04-20 21:10 - 00029487 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_03_[F23BCC9D].mkv.torrent2013-04-20 19:39 - 2013-04-20 19:39 - 00046827 ____A C:\Users\Roberty\Downloads\[gg]_Shingeki_no_Kyojin_-_02_[AF2A47CF].mkv (1).torrent2013-04-20 19:35 - 2013-04-20 19:35 - 00020880 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_02v2_[b4F2EA74].mkv.torrent2013-04-20 14:29 - 2013-04-20 14:29 - 00026264 ____A C:\Users\Roberty\Downloads\[HorribleSubs] Oreimo S2 - 03 [720p].mkv.torrent2013-04-20 14:28 - 2013-04-20 14:28 - 00020878 ____A C:\Users\Roberty\Downloads\[gg]_Hentai_Ouji_to_Warawanai_Neko_-_02 [6043C689].mkv.torrent2013-04-20 04:20 - 2013-04-20 04:20 - 00000000 ____D C:\Users\Roberty\Desktop\Sakurasou OST2013-04-20 04:18 - 2013-04-20 04:16 - 135244186 ____A C:\Users\Roberty\Downloads\SAKURASOU NO PET NA KANOJO Special Disc Vol.2 Soundtrack 1.7z2013-04-20 03:11 - 2013-04-20 03:11 - 00018201 ____A C:\Users\Roberty\Downloads\[gg]_Aku_no_Hana_-_03_[1591D8CE].mkv.torrent2013-04-20 02:28 - 2013-04-20 02:28 - 00013340 ____A C:\Users\Roberty\Downloads\[Commie] Red Data Girl - 03 [CA2A90A5].mkv.torrent2013-04-19 23:17 - 2011-08-08 16:39 - 00000000 ____D C:\ProgramData\McAfee2013-04-19 23:17 - 2011-08-08 16:39 - 00000000 ____D C:\ProgramData\Application Data\McAfee2013-04-19 23:09 - 2013-04-19 23:09 - 00262144 ____A C:\Windows\Minidump\041913-34398-01.dmp2013-04-19 23:09 - 2012-12-07 22:07 - 00000000 ____D C:\Windows\Minidump2013-04-19 22:52 - 2013-04-19 22:51 - 00262144 ____A C:\Windows\Minidump\041913-30560-01.dmp2013-04-19 22:21 - 2013-04-18 19:51 - 00002244 ____A C:\Windows\epplauncher.mif2013-04-19 22:17 - 2013-04-19 22:17 - 00262144 ____A C:\Windows\Minidump\041913-34195-01.dmp2013-04-19 22:12 - 2013-04-19 22:12 - 00262144 ____A C:\Windows\Minidump\041913-25084-01.dmp2013-04-19 22:10 - 2013-04-19 22:10 - 00010775 ____A C:\Users\Roberty\Downloads\[uTW]_Photokano_-_03_[h264-720p][39B23ACE].mkv.torrent2013-04-19 22:09 - 2013-04-19 22:09 - 00014158 ____A C:\Users\Roberty\Downloads\[FFF] Yahari Ore no Seishun Love Come wa Machigatteiru. - 03 [AC862BEA].mkv.torrent2013-04-19 08:03 - 2013-04-19 08:03 - 00354304 ____A (Microsoft Corporation) C:\Users\Roberty\Downloads\StikyNot (1).exe2013-04-19 08:03 - 2013-04-19 08:02 - 00354304 ____A (Microsoft Corporation) C:\Users\Roberty\Downloads\StikyNot.exe2013-04-19 03:39 - 2013-04-19 03:39 - 00000000 __SHD C:\found.0012013-04-19 03:11 - 2013-04-19 03:11 - 00181950 ____A C:\Users\Roberty\Downloads\StikyNot.zip2013-04-19 03:02 - 2013-04-19 03:02 - 00154640 ____A C:\Users\Roberty\Downloads\Sticky Notes.exe2013-04-19 02:23 - 2013-04-19 02:23 - 00026905 ____A C:\Users\Roberty\Downloads\[HorribleSubs] DEVIL SURVIVOR 2 THE ANIMATION - 03 [720p].mkv.torrent2013-04-19 02:23 - 2013-04-19 02:23 - 00014044 ____A C:\Users\Roberty\Downloads\[FFF] Red Data Girl - 03 [E54AD6FE].mkv.torrent2013-04-19 02:23 - 2013-04-19 02:23 - 00011610 ____A C:\Users\Roberty\Downloads\[FFF] Hataraku Maou-sama! - 03 [480F888D].mkv.torrent2013-04-19 02:15 - 2013-04-19 02:15 - 00584600 ____A C:\Users\Roberty\Downloads\cbsidlm-tr1_13-7_Sticky_Notes-ORG-75375596.exe2013-04-19 01:50 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\NDF2013-04-19 01:07 - 2013-04-19 01:07 - 00014662 ____A C:\Users\Roberty\Downloads\[Anime-Koi] Karneval - 03 [h264-720p][DE3A3CAA].mkv.torrent2013-04-19 00:05 - 2013-04-19 00:05 - 00000000 ____D C:\Windows\SysWOW64\tenarchlib2013-04-19 00:05 - 2013-04-19 00:05 - 00000000 ____D C:\Users\Roberty\Application Data\Tenebril2013-04-19 00:05 - 2013-04-19 00:05 - 00000000 ____D C:\Users\Roberty\AppData\Roaming\Tenebril2013-04-18 23:42 - 2013-04-18 23:41 - 04685671 ____A C:\Users\Roberty\Downloads\StickyNote_9.0.zip2013-04-18 23:41 - 2013-04-18 23:41 - 00290240 ____A (SoftSafe) C:\Users\Roberty\Downloads\StickyNote 9.0.zip (1).exe2013-04-18 23:41 - 2013-04-18 23:41 - 00000000 ____D C:\ProgramData\SoftSafe2013-04-18 23:41 - 2013-04-18 23:41 - 00000000 ____D C:\ProgramData\Application Data\SoftSafe2013-04-18 23:41 - 2013-04-18 23:40 - 00000000 ____D C:\ProgramData\InstallMate2013-04-18 23:41 - 2013-04-18 23:40 - 00000000 ____D C:\ProgramData\Application Data\InstallMate2013-04-18 23:40 - 2013-04-18 23:40 - 00290240 ____A (SoftSafe) C:\Users\Roberty\Downloads\StickyNote 9.0.zip.exe2013-04-18 23:16 - 2012-07-27 18:17 - 00000000 ____D C:\Users\Roberty\Desktop\comp stuff2013-04-18 23:09 - 2013-04-18 23:04 - 00000866 ____A C:\Windows\SysWOW64\InstallUtil.InstallLog2013-04-18 23:01 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Resources2013-04-18 19:51 - 2013-04-18 19:51 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client2013-04-18 19:51 - 2013-04-18 19:50 - 00000000 ____D C:\Program Files\Microsoft Security Client2013-04-18 19:50 - 2013-04-18 19:49 - 13475464 ____A (Microsoft Corporation) C:\Users\Roberty\Downloads\mseinstall.exe2013-04-18 18:00 - 2013-04-18 18:00 - 00064306 ____A C:\Users\Roberty\Downloads\cc_20130418_160033.reg2013-04-18 12:03 - 2013-04-18 21:56 - 00071168 ____A C:\Users\Roberty\Desktop\StickyNotes.snt2013-04-18 01:48 - 2013-04-18 01:48 - 00013567 ____A C:\Users\Roberty\Downloads\[Mezashite] Dansai Bunri no Crime Edge - 03 [1E3F52B8].mkv.torrent2013-04-17 22:42 - 2013-04-17 22:42 - 07601227 ____A C:\Users\Roberty\Downloads\Attachments_2013417.zip2013-04-17 13:10 - 2013-04-17 13:10 - 00291225 ____A C:\Users\Roberty\Downloads\morphology.zipOther Malware:===========C:\ProgramData\ezsidmv.datC:\ProgramData\zak_lo0i7g.pad==================== Known DLLs (Whitelisted) ==================================== Bamital & volsnap Check =================C:\Windows\System32\winlogon.exe => MD5 is legitC:\Windows\System32\wininit.exe => MD5 is legitC:\Windows\SysWOW64\wininit.exe => MD5 is legitC:\Windows\explorer.exe => MD5 is legitC:\Windows\SysWOW64\explorer.exe => MD5 is legitC:\Windows\System32\svchost.exe => MD5 is legitC:\Windows\SysWOW64\svchost.exe => MD5 is legitC:\Windows\System32\services.exe => MD5 is legitC:\Windows\System32\User32.dll => MD5 is legitC:\Windows\SysWOW64\User32.dll => MD5 is legitC:\Windows\System32\userinit.exe => MD5 is legitC:\Windows\SysWOW64\userinit.exe => MD5 is legitC:\Windows\System32\Drivers\volsnap.sys => MD5 is legit==================== EXE ASSOCIATION =====================HKLM\...\.exe: exefile => OKHKLM\...\exefile\DefaultIcon: %1 => OKHKLM\...\exefile\open\command: "%1" %* => OK==================== Restore Points =========================Restore point made on: 2013-05-16 04:10:31==================== Memory info ===========================Percentage of memory in use: 11%Total physical RAM: 6058.17 MBAvailable physical RAM: 5337.22 MBTotal Pagefile: 6056.37 MBAvailable Pagefile: 5324.28 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.89 MB==================== Drives ================================Drive c: (OS) (Fixed) (Total:679 GB) (Free:17.83 GB) NTFS (Disk=0 Partition=3)Drive d: (RECOVERY) (Fixed) (Total:19.53 GB) (Free:10.99 GB) NTFS (Disk=0 Partition=2) ==>[system with boot components (obtained from reading drive)]Drive f: (HP v125w) (Removable) (Total:3.75 GB) (Free:2.05 GB) FAT32 (Disk=1 Partition=1)Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows Vista) (Size: 699 GB) (Disk ID: 07F2837E)Partition 1: (Not Active) - (Size=102 MB) - (Type=DE)Partition 2: (Active) - (Size=20 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=679 GB) - (Type=07 NTFS)========================================================Disk: 1 (Size: 4 GB) (Disk ID: 00000000)Partition 1: (Not Active) - (Size=4 GB) - (Type=0C)Last Boot: 2013-05-14 03:41==================== End Of Log ============================Search.txtFarbar Recovery Scan Tool (x64) Version: 16-05-2013Ran by SYSTEM at 2013-05-17 00:41:07Running from F:\Boot Mode: Recovery================== Search: "services.exe" ===================C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCBC:\Windows\System32\services.exe[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB====== End Of Search ======Once again, thanks a lot! Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680740 Share Posted May 17, 2013 Looking at it now.....MrC Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680742 Share Posted May 17, 2013 OK, here you go......this should get you going:Please download the attached fixlist.txt and copy it to your flashdrive.NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating systemOn Vista or Windows 7: Now please enter System Recovery Options. (as you did before)Run FRST64 or FRST (which ever one you're using) and press the Fix button just once and wait.The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.See if the computer boots normally now and if so..........Download Malwarebytes Anti-Rootkit from HEREUnzip the contents to a folder in a convenient location.Open the folder where the contents were unzipped and run mbar.exeFollow the instructions in the wizard to update and allow the program to scan your computer for threats.Click on the Cleanup button to remove any threats and reboot if prompted to do so.Wait while the system shuts down and the cleanup process is performed.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.When done, please post the two logs produced they will be in the MBAR folder..... mbar-log.txt and system-log.txtTo attach a log if needed:Bottom right corner of this page.New window that comes up.~~~~~~~~~~~~~~~~~~~~~~~Note:If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:Internet accessWindows UpdateWindows FirewallIf there are additional problems with your system, such as any of those listed above or other system issues, then run the fixdamage tool included with Malwarebytes Anti-Rootkit and reboot. It's located in the Plugins folder which is in the MBAR folder.Just run fixdamage.exe.Verify that your system is now functioning normally.MrC Link to post Share on other sites More sharing options...
bbobrob Posted May 17, 2013 Author ID:680929 Share Posted May 17, 2013 Hi, thanks for the prompt response! Just to give you a heads-up before you look at the fixlog, prior to your response (but after my original post), I had fiddled around to try and get rid of the malware myself and ended up deleting the executable through the system recovery command prompt. After, I was able to get into my user account via the normal startup, and looked over the log returned by FRST to manually delete some of the malware files and registries, which is why some of the files weren't found by the FRST fix.I also ran the Malwarebytes anti-rootkit tool twice, and a clean slate was returned both times. I did get a message stating "Registry value "AppInit_Dlls" has been found, which may be caused by rootkit activity," but I didn't end up removing it (following the instructions in the pop-up, i.e. going back to remove it if something weird happens during the scan).The computer itself seems to be in normal shape, and Windows update seems to work fine, so I think the problem is resolved!Once again, thanks a lot for your help and time!(I have attached and copy/pasted the different logs you requested)Here's the fixlog:Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 16-05-2013Ran by SYSTEM at 2013-05-17 06:36:00 Run:1Running from E:\Boot Mode: Recovery==============================================HKEY_USERS\Roberty\Software\Microsoft\Windows\CurrentVersion\Run\\qcgce2mrvjq91kk1e7pnbb19m52fx => Value not found.HKEY_USERS\Roberty\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => Value deleted successfully.C:\Users\Roberty\Local Settings\2433f433 => File/Directory not found.C:\Users\Roberty\AppData\Local\2433f433 => File/Directory not found.C:\ProgramData\Application Data\2433f433 => Moved successfully.C:\ProgramData\2433f433 => File/Directory not found.C:\Users\Roberty\Application Data\2433f433 => File/Directory not found.C:\Users\Roberty\AppData\Roaming\2433f433 => File/Directory not found.C:\Users\Roberty\My Documents\7ca88402.exe => File/Directory not found.C:\Users\Roberty\Documents\7ca88402.exe => File/Directory not found.C:\ProgramData\ezsidmv.dat => File/Directory not found.C:\ProgramData\zak_lo0i7g.pad => File/Directory not found.==== End of Fixlog ====mbar-log:Malwarebytes Anti-Rootkit BETA 1.05.0.1001www.malwarebytes.orgDatabase version: v2013.05.17.05Windows 7 Service Pack 1 x64 NTFSInternet Explorer 10.0.9200.16540Roberty :: ROBERTY-PC [administrator]5/17/2013 12:32:51 PMmbar-log-2013-05-17 (12-32-51).txtScan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2PScan options disabled: Objects scanned: 32472Time elapsed: 36 minute(s), 58 second(s)Memory Processes Detected: 0(No malicious items detected)Memory Modules Detected: 0(No malicious items detected)Registry Keys Detected: 0(No malicious items detected)Registry Values Detected: 0(No malicious items detected)Registry Data Items Detected: 0(No malicious items detected)Folders Detected: 0(No malicious items detected)Files Detected: 0(No malicious items detected)(end)system-log:---------------------------------------Malwarebytes Anti-Rootkit BETA 1.05.0.1001© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16540Java version: 1.6.0_26File system is: NTFSDisk drives: C:\ DRIVE_FIXEDCPU speed: 2.693000 GHzMemory total: 6352453632, free: 3931103232------------ Kernel report ------------ 05/17/2013 10:51:30------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\drivers\iaStor.sys\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\system32\DRIVERS\MpFilter.sys\SystemRoot\System32\Drivers\PxHlpa64.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\system32\DRIVERS\stdcfltn.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\SysWOW64\speedfan.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\system32\DRIVERS\nvpciflt.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\drivers\disk.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\DRIVERS\termdd.sys\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\DRIVERS\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\system32\drivers\csc.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\??\C:\Users\Roberty\Desktop\comp stuff\Emsisoft emergency kit\Run\a2ddax64.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\wmiacpi.sys\SystemRoot\system32\DRIVERS\nvlddmkm.sys\SystemRoot\System32\Drivers\nvBridge.kmd\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\system32\DRIVERS\HECIx64.sys\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\DRIVERS\HDAudBus.sys\SystemRoot\system32\DRIVERS\NETwNs64.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\DRIVERS\nusb3xhc.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\DRIVERS\Rt64win7.sys\SystemRoot\system32\DRIVERS\i8042prt.sys\SystemRoot\system32\DRIVERS\kbdclass.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\DRIVERS\Accelern.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\DRIVERS\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\appliand.sys\SystemRoot\system32\DRIVERS\rdpbus.sys\SystemRoot\system32\DRIVERS\swenum.sys\SystemRoot\system32\DRIVERS\ks.sys\SystemRoot\system32\DRIVERS\dtsoftbus01.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\WDKMD.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\system32\DRIVERS\nusb3hub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\IntcDAud.sys\SystemRoot\system32\DRIVERS\cdfs.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_iaStor.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\System32\Drivers\usbvideo.sys\SystemRoot\system32\DRIVERS\qicflt.sys\SystemRoot\system32\DRIVERS\CtClsFlt.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\system32\drivers\luafv.sys\??\C:\Windows\system32\drivers\mbam.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\DRIVERS\TurboB.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\??\C:\Windows\system32\Drivers\rikvm_9EC60124.sys\SystemRoot\system32\DRIVERS\vwifimp.sys\SystemRoot\system32\DRIVERS\NisDrvWFP.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\System32\ATMFD.DLL\SystemRoot\System32\Drivers\fastfat.SYS\SystemRoot\system32\DRIVERS\iBtFltCoex.sys\SystemRoot\system32\DRIVERS\btmhsf.sys\SystemRoot\System32\Drivers\BTHUSB.sys\SystemRoot\System32\Drivers\bthport.sys\SystemRoot\system32\DRIVERS\rfcomm.sys\SystemRoot\system32\drivers\BthEnum.sys\SystemRoot\system32\DRIVERS\bthpan.sys\SystemRoot\system32\DRIVERS\btmaux.sys\SystemRoot\system32\DRIVERS\USBSTOR.SYS\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\WUDFRd.sys\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\comdlg32.dll\Windows\System32\shlwapi.dll\Windows\System32\setupapi.dll\Windows\System32\nsi.dll\Windows\System32\ole32.dll\Windows\System32\lpk.dll\Windows\System32\usp10.dll\Windows\System32\ws2_32.dll\Windows\System32\user32.dll\Windows\System32\difxapi.dll\Windows\System32\imm32.dll\Windows\System32\normaliz.dll\Windows\System32\clbcatq.dll\Windows\System32\iertutil.dll\Windows\System32\msvcrt.dll\Windows\System32\kernel32.dll\Windows\System32\imagehlp.dll\Windows\System32\sechost.dll\Windows\System32\oleaut32.dll\Windows\System32\shell32.dll\Windows\System32\msctf.dll\Windows\System32\wininet.dll\Windows\System32\rpcrt4.dll\Windows\System32\psapi.dll\Windows\System32\Wldap32.dll\Windows\System32\urlmon.dll\Windows\System32\gdi32.dll\Windows\System32\advapi32.dll\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll\Windows\System32\comctl32.dll\Windows\System32\KernelBase.dll\Windows\System32\crypt32.dll\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll\Windows\System32\devobj.dll\Windows\System32\cfgmgr32.dll\Windows\System32\wintrust.dll\Windows\System32\msasn1.dll\Windows\SysWOW64\normaliz.dll----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk1\DR1Upper Device Object: 0xfffffa8005f4b790Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\00000091\Lower Device Object: 0xfffffa8005dbf060Lower Device Driver Name: \Driver\USBSTOR\Driver name found: USBSTORInitialization returned 0x0Load Function returned 0x0<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa8007e4a060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IAAStorageDevice-1\Lower Device Object: 0xfffffa8005f12050Lower Device Driver Name: \Driver\iaStor\Driver name found: iaStorInitialization returned 0x0Load Function returned 0x0Downloaded database version: v2013.05.17.05Downloaded database version: v2013.05.14.03Initializing...Done!<<<2>>>Device number: 0, partition: 3Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa8007e4a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8007e4ab90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8007e4a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8007cf3ba0, DeviceName: Unknown, DriverName: \Driver\stdcfltn\DevicePointer: 0xfffffa8005f0c800, DeviceName: Unknown, DriverName: \Driver\ACPI\DevicePointer: 0xfffffa8005f12050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a01078f0e0, 0xfffffa8007e4a060, 0xfffffa800852a790Lower DeviceData: 0xfffff8a00c07a960, 0xfffffa8005f12050, 0xfffffa8005fba090<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning directory: C:\Windows\system32\drivers...<<<2>>>Device number: 0, partition: 3<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 7F2837EPartition information: Partition 0 type is Other (0xde) Partition is NOT ACTIVE. Partition starts at LBA: 63 Numsec = 208782 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 212992 Numsec = 40960000 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 41172992 Numsec = 1423974128 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 750156374016 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-62-1465129168-1465149168)...Physical Sector Size: 512Drive: 1, DevicePointer: 0xfffffa8005f4b790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8006167260, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8005f4b790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8005dbf060, DeviceName: \Device\00000091\, DriverName: \Driver\USBSTOR\------------ End ----------Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a012030f20, 0xfffffa8005f4b790, 0xfffffa80060df530Lower DeviceData: 0xfffff8a00d483120, 0xfffffa8005dbf060, 0xfffffa80057e7cc0Drive 1Scanning MBR on drive 1...Inspecting partition table:MBR Signature: 55AADisk Signature: 0Partition information: Partition 0 type is Other (0xc) Partition is NOT ACTIVE. Partition starts at LBA: 8064 Numsec = 7876736 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 4037017600 bytesSector size: 512 bytesDone!Performing system, memory and registry scan...Done!Scan finished=======================================---------------------------------------Malwarebytes Anti-Rootkit BETA 1.05.0.1001© Malwarebytes Corporation 2011-2012OS version: 6.1.7601 Windows 7 Service Pack 1 x64Account is AdministrativeInternet Explorer version: 10.0.9200.16540Java version: 1.6.0_26File system is: NTFSDisk drives: C:\ DRIVE_FIXEDCPU speed: 2.693000 GHzMemory total: 6352453632, free: 4084494336------------ Kernel report ------------ 05/17/2013 11:55:29------------ Loaded modules -----------\SystemRoot\system32\ntoskrnl.exe\SystemRoot\system32\hal.dll\SystemRoot\system32\kdcom.dll\SystemRoot\system32\mcupdate_GenuineIntel.dll\SystemRoot\system32\PSHED.dll\SystemRoot\system32\CLFS.SYS\SystemRoot\system32\CI.dll\SystemRoot\system32\drivers\Wdf01000.sys\SystemRoot\system32\drivers\WDFLDR.SYS\SystemRoot\system32\drivers\ACPI.sys\SystemRoot\system32\drivers\WMILIB.SYS\SystemRoot\system32\drivers\msisadrv.sys\SystemRoot\system32\drivers\pci.sys\SystemRoot\system32\drivers\vdrvroot.sys\SystemRoot\System32\drivers\partmgr.sys\SystemRoot\system32\DRIVERS\compbatt.sys\SystemRoot\system32\DRIVERS\BATTC.SYS\SystemRoot\system32\drivers\volmgr.sys\SystemRoot\System32\drivers\volmgrx.sys\SystemRoot\System32\drivers\mountmgr.sys\SystemRoot\system32\drivers\iaStor.sys\SystemRoot\system32\drivers\amdxata.sys\SystemRoot\system32\drivers\fltmgr.sys\SystemRoot\system32\drivers\fileinfo.sys\SystemRoot\system32\DRIVERS\MpFilter.sys\SystemRoot\System32\Drivers\PxHlpa64.sys\SystemRoot\System32\Drivers\Ntfs.sys\SystemRoot\System32\Drivers\msrpc.sys\SystemRoot\System32\Drivers\ksecdd.sys\SystemRoot\System32\Drivers\cng.sys\SystemRoot\System32\drivers\pcw.sys\SystemRoot\System32\Drivers\Fs_Rec.sys\SystemRoot\system32\drivers\ndis.sys\SystemRoot\system32\drivers\NETIO.SYS\SystemRoot\System32\Drivers\ksecpkg.sys\SystemRoot\System32\drivers\tcpip.sys\SystemRoot\System32\drivers\fwpkclnt.sys\SystemRoot\system32\drivers\volsnap.sys\SystemRoot\system32\DRIVERS\stdcfltn.sys\SystemRoot\System32\Drivers\spldr.sys\SystemRoot\SysWOW64\speedfan.sys\SystemRoot\System32\drivers\rdyboost.sys\SystemRoot\system32\DRIVERS\nvpciflt.sys\SystemRoot\System32\Drivers\mup.sys\SystemRoot\System32\drivers\hwpolicy.sys\SystemRoot\System32\DRIVERS\fvevol.sys\SystemRoot\system32\drivers\disk.sys\SystemRoot\system32\drivers\CLASSPNP.SYS\SystemRoot\system32\DRIVERS\cdrom.sys\SystemRoot\System32\Drivers\Null.SYS\SystemRoot\System32\Drivers\Beep.SYS\SystemRoot\System32\drivers\vga.sys\SystemRoot\System32\drivers\VIDEOPRT.SYS\SystemRoot\System32\drivers\watchdog.sys\SystemRoot\System32\DRIVERS\RDPCDD.sys\SystemRoot\system32\drivers\rdpencdd.sys\SystemRoot\system32\drivers\rdprefmp.sys\SystemRoot\System32\Drivers\Msfs.SYS\SystemRoot\System32\Drivers\Npfs.SYS\SystemRoot\system32\DRIVERS\tdx.sys\SystemRoot\system32\DRIVERS\TDI.SYS\SystemRoot\System32\DRIVERS\netbt.sys\SystemRoot\system32\drivers\afd.sys\SystemRoot\system32\DRIVERS\wfplwf.sys\SystemRoot\system32\DRIVERS\pacer.sys\SystemRoot\system32\DRIVERS\vwififlt.sys\SystemRoot\system32\DRIVERS\netbios.sys\SystemRoot\system32\DRIVERS\wanarp.sys\SystemRoot\system32\DRIVERS\termdd.sys\SystemRoot\system32\DRIVERS\rdbss.sys\SystemRoot\system32\drivers\nsiproxy.sys\SystemRoot\system32\DRIVERS\mssmbios.sys\SystemRoot\System32\drivers\discache.sys\SystemRoot\system32\drivers\csc.sys\SystemRoot\System32\Drivers\dfsc.sys\SystemRoot\system32\DRIVERS\blbdrive.sys\??\C:\Users\Roberty\Desktop\comp stuff\Emsisoft emergency kit\Run\a2ddax64.sys\SystemRoot\system32\DRIVERS\tunnel.sys\SystemRoot\system32\DRIVERS\wmiacpi.sys\SystemRoot\system32\DRIVERS\nvlddmkm.sys\SystemRoot\System32\Drivers\nvBridge.kmd\SystemRoot\System32\drivers\dxgkrnl.sys\SystemRoot\System32\drivers\dxgmms1.sys\SystemRoot\system32\DRIVERS\igdkmd64.sys\SystemRoot\system32\DRIVERS\HECIx64.sys\SystemRoot\system32\drivers\usbehci.sys\SystemRoot\system32\drivers\USBPORT.SYS\SystemRoot\system32\DRIVERS\HDAudBus.sys\SystemRoot\system32\DRIVERS\NETwNs64.sys\SystemRoot\system32\DRIVERS\vwifibus.sys\SystemRoot\system32\DRIVERS\nusb3xhc.sys\SystemRoot\system32\DRIVERS\USBD.SYS\SystemRoot\system32\DRIVERS\Rt64win7.sys\SystemRoot\system32\DRIVERS\i8042prt.sys\SystemRoot\system32\DRIVERS\kbdclass.sys\SystemRoot\system32\DRIVERS\SynTP.sys\SystemRoot\system32\DRIVERS\mouclass.sys\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys\SystemRoot\system32\DRIVERS\Accelern.sys\SystemRoot\system32\DRIVERS\CmBatt.sys\SystemRoot\system32\DRIVERS\intelppm.sys\SystemRoot\system32\DRIVERS\CompositeBus.sys\SystemRoot\system32\DRIVERS\AgileVpn.sys\SystemRoot\system32\DRIVERS\rasl2tp.sys\SystemRoot\system32\DRIVERS\ndistapi.sys\SystemRoot\system32\DRIVERS\ndiswan.sys\SystemRoot\system32\DRIVERS\raspppoe.sys\SystemRoot\system32\DRIVERS\raspptp.sys\SystemRoot\system32\DRIVERS\rassstp.sys\SystemRoot\system32\DRIVERS\appliand.sys\SystemRoot\system32\DRIVERS\rdpbus.sys\SystemRoot\system32\DRIVERS\swenum.sys\SystemRoot\system32\DRIVERS\ks.sys\SystemRoot\system32\DRIVERS\dtsoftbus01.sys\SystemRoot\system32\DRIVERS\umbus.sys\SystemRoot\system32\DRIVERS\WDKMD.sys\SystemRoot\system32\DRIVERS\usbhub.sys\SystemRoot\system32\DRIVERS\nusb3hub.sys\SystemRoot\System32\Drivers\NDProxy.SYS\SystemRoot\system32\drivers\RTKVHD64.sys\SystemRoot\system32\drivers\portcls.sys\SystemRoot\system32\drivers\drmk.sys\SystemRoot\system32\drivers\ksthunk.sys\SystemRoot\system32\DRIVERS\IntcDAud.sys\SystemRoot\system32\DRIVERS\USBSTOR.SYS\SystemRoot\system32\DRIVERS\cdfs.sys\SystemRoot\System32\win32k.sys\SystemRoot\System32\drivers\Dxapi.sys\SystemRoot\System32\Drivers\fastfat.SYS\SystemRoot\system32\DRIVERS\usbccgp.sys\SystemRoot\System32\Drivers\usbvideo.sys\SystemRoot\system32\DRIVERS\qicflt.sys\SystemRoot\system32\DRIVERS\CtClsFlt.sys\SystemRoot\System32\Drivers\crashdmp.sys\SystemRoot\System32\Drivers\dump_iaStor.sys\SystemRoot\System32\Drivers\dump_dumpfve.sys\SystemRoot\system32\DRIVERS\iBtFltCoex.sys\SystemRoot\system32\DRIVERS\btmhsf.sys\SystemRoot\System32\Drivers\BTHUSB.sys\SystemRoot\System32\Drivers\bthport.sys\SystemRoot\system32\DRIVERS\monitor.sys\SystemRoot\system32\DRIVERS\rfcomm.sys\SystemRoot\system32\drivers\BthEnum.sys\SystemRoot\system32\DRIVERS\bthpan.sys\SystemRoot\system32\DRIVERS\btmaux.sys\SystemRoot\System32\TSDDD.dll\SystemRoot\System32\cdd.dll\SystemRoot\System32\ATMFD.DLL\SystemRoot\system32\drivers\luafv.sys\??\C:\Windows\system32\drivers\mbam.sys\SystemRoot\system32\DRIVERS\lltdio.sys\SystemRoot\system32\DRIVERS\nwifi.sys\SystemRoot\system32\DRIVERS\ndisuio.sys\SystemRoot\system32\DRIVERS\rspndr.sys\SystemRoot\system32\DRIVERS\TurboB.sys\SystemRoot\system32\drivers\HTTP.sys\SystemRoot\system32\DRIVERS\bowser.sys\SystemRoot\System32\drivers\mpsdrv.sys\SystemRoot\system32\DRIVERS\mrxsmb.sys\SystemRoot\system32\DRIVERS\mrxsmb10.sys\SystemRoot\system32\DRIVERS\mrxsmb20.sys\??\C:\Windows\system32\Drivers\rikvm_9EC60124.sys\SystemRoot\system32\DRIVERS\NisDrvWFP.sys\SystemRoot\system32\drivers\peauth.sys\SystemRoot\System32\Drivers\secdrv.SYS\SystemRoot\System32\DRIVERS\srvnet.sys\SystemRoot\System32\drivers\tcpipreg.sys\SystemRoot\system32\DRIVERS\vwifimp.sys\SystemRoot\System32\DRIVERS\srv2.sys\SystemRoot\System32\DRIVERS\srv.sys\SystemRoot\system32\drivers\WudfPf.sys\SystemRoot\system32\DRIVERS\WUDFRd.sys\SystemRoot\system32\drivers\spsys.sys\??\C:\Windows\system32\drivers\mbamchameleon.sys\??\C:\Windows\system32\drivers\mbamswissarmy.sys\Windows\System32\ntdll.dll\Windows\System32\smss.exe\Windows\System32\apisetschema.dll\Windows\System32\autochk.exe\Windows\System32\ole32.dll\Windows\System32\oleaut32.dll\Windows\System32\msctf.dll\Windows\System32\sechost.dll\Windows\System32\psapi.dll\Windows\System32\shlwapi.dll\Windows\System32\Wldap32.dll\Windows\System32\comdlg32.dll\Windows\System32\rpcrt4.dll\Windows\System32\setupapi.dll\Windows\System32\advapi32.dll\Windows\System32\wininet.dll\Windows\System32\msvcrt.dll\Windows\System32\kernel32.dll\Windows\System32\usp10.dll\Windows\System32\clbcatq.dll\Windows\System32\ws2_32.dll\Windows\System32\gdi32.dll\Windows\System32\nsi.dll\Windows\System32\normaliz.dll\Windows\System32\difxapi.dll\Windows\System32\lpk.dll\Windows\System32\shell32.dll\Windows\System32\user32.dll\Windows\System32\imagehlp.dll\Windows\System32\urlmon.dll\Windows\System32\iertutil.dll\Windows\System32\imm32.dll\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll\Windows\System32\comctl32.dll\Windows\System32\crypt32.dll\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll\Windows\System32\devobj.dll\Windows\System32\KernelBase.dll\Windows\System32\wintrust.dll\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll\Windows\System32\cfgmgr32.dll\Windows\System32\msasn1.dll\Windows\SysWOW64\normaliz.dll----------- End -----------<<<1>>>Upper Device Name: \Device\Harddisk1\DR1Upper Device Object: 0xfffffa8009c18060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\00000083\Lower Device Object: 0xfffffa8009c1f800Lower Device Driver Name: \Driver\USBSTOR\Driver name found: USBSTORInitialization returned 0x0Load Function returned 0x0<<<1>>>Upper Device Name: \Device\Harddisk0\DR0Upper Device Object: 0xfffffa8007e4c060Upper Device Driver Name: \Driver\Disk\Lower Device Name: \Device\Ide\IAAStorageDevice-1\Lower Device Object: 0xfffffa8006323050Lower Device Driver Name: \Driver\iaStor\Driver name found: iaStorInitialization returned 0x0Load Function returned 0x0Host not foundHost not foundHost not foundInitializing...Done!<<<2>>>Device number: 0, partition: 3Physical Sector Size: 512Drive: 0, DevicePointer: 0xfffffa8007e4c060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8007e4cb90, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8007e4c060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8007cf8c50, DeviceName: Unknown, DriverName: \Driver\stdcfltn\DevicePointer: 0xfffffa800631c630, DeviceName: Unknown, DriverName: \Driver\ACPI\DevicePointer: 0xfffffa8006323050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\------------ End ----------Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a00c88bcc0, 0xfffffa8007e4c060, 0xfffffa8005b70790Lower DeviceData: 0xfffff8a00c7814c0, 0xfffffa8006323050, 0xfffffa80082457f0<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesScanning directory: C:\Windows\system32\drivers...<<<2>>>Device number: 0, partition: 3<<<3>>>Volume: C:File system type: NTFSSectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytesDone!Drive 0Scanning MBR on drive 0...Inspecting partition table:MBR Signature: 55AADisk Signature: 7F2837EPartition information: Partition 0 type is Other (0xde) Partition is NOT ACTIVE. Partition starts at LBA: 63 Numsec = 208782 Partition 1 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 212992 Numsec = 40960000 Partition file system is NTFS Partition is bootable Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 41172992 Numsec = 1423974128 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 750156374016 bytesSector size: 512 bytesScanning physical sectors of unpartitioned space on drive 0 (1-62-1465129168-1465149168)...Physical Sector Size: 512Drive: 1, DevicePointer: 0xfffffa8009c18060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\--------- Disk Stack ------DevicePointer: 0xfffffa8009c1f330, DeviceName: Unknown, DriverName: \Driver\partmgr\DevicePointer: 0xfffffa8009c18060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\DevicePointer: 0xfffffa8009c1f800, DeviceName: \Device\00000083\, DriverName: \Driver\USBSTOR\------------ End ----------Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\Upper DeviceData: 0xfffff8a00d5472c0, 0xfffffa8009c18060, 0xfffffa8005791790Lower DeviceData: 0xfffff8a00dc316a0, 0xfffffa8009c1f800, 0xfffffa800beb86a0Drive 1Scanning MBR on drive 1...Inspecting partition table:MBR Signature: 55AADisk Signature: 0Partition information: Partition 0 type is Other (0xc) Partition is NOT ACTIVE. Partition starts at LBA: 8064 Numsec = 7876736 Partition 1 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 2 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0 Partition 3 type is Empty (0x0) Partition is NOT ACTIVE. Partition starts at LBA: 0 Numsec = 0Disk Size: 4037017600 bytesSector size: 512 bytesDone!Performing system, memory and registry scan...Done!Scan finished======================================= Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680930 Share Posted May 17, 2013 Well Done, lets run ComboFix to clear up any leftovers.Please download and run ComboFix.The most important things to remember when running it is to disable all your malware programs and run Combofix from your desktop.Please visit this webpage for download links, and instructions for running ComboFixhttp://www.bleepingcomputer.com/combofix/how-to-use-combofixEnsure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Information on disabling your malware programs can be found Here.Make sure you run ComboFix from your desktop. Give it at least 30-45 minutes to finish if needed.Please include the C:\ComboFix.txt in your next reply for further review.---------->NOTE<----------If you get the message Illegal operation attempted on registry key that has been marked for deletion after you run ComboFix....please reboot the computer, this should resolve the problem. You may have to do this several times if needed.MrC Link to post Share on other sites More sharing options...
bbobrob Posted May 17, 2013 Author ID:680931 Share Posted May 17, 2013 oops, forgot to attach the logs (in case they're easier for you to work with)system-log.txtmbar-log-2013-05-17 (12-32-51).txtFixlog.txt Link to post Share on other sites More sharing options...
MrCharlie Posted May 17, 2013 ID:680932 Share Posted May 17, 2013 Post above yours....MrC Link to post Share on other sites More sharing options...
bbobrob Posted May 17, 2013 Author ID:680943 Share Posted May 17, 2013 Hi, didn't see that post in-between mine (you guys respond really quickly!). So, I just ran ComboFix and here's the log (copy/pasted or attached):ComboFix 13-05-16.02 - Roberty 7/2013 Fri 14:24:27.1.4 - x64Microsoft Windows 7 Professional 6.1.7601.1.932.81.1033.18.6058.3502 [GMT -7:00]Running from: c:\users\Roberty\Desktop\ComboFix.exeAV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\program files (x86)\StartNow Toolbarc:\program files (x86)\StartNow Toolbar\Resources\images\engine_images.pngc:\program files (x86)\StartNow Toolbar\Resources\images\engine_maps.pngc:\program files (x86)\StartNow Toolbar\Resources\images\engine_news.pngc:\program files (x86)\StartNow Toolbar\Resources\images\engine_videos.pngc:\program files (x86)\StartNow Toolbar\Resources\images\engine_web.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_amazon.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_ebay.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_facebook.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_games.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_msn.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_shopping.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_travel.pngc:\program files (x86)\StartNow Toolbar\Resources\images\icon_twitter.pngc:\program files (x86)\StartNow Toolbar\Resources\images\startnow_logo.pngc:\program files (x86)\StartNow Toolbar\Resources\installer.xmlc:\program files (x86)\StartNow Toolbar\Resources\protect\index.htmlc:\program files (x86)\StartNow Toolbar\Resources\protect\NotIE6.cssc:\program files (x86)\StartNow Toolbar\Resources\protect\OnlyIE6.cssc:\program files (x86)\StartNow Toolbar\Resources\protect\SearchProtectIcon.pngc:\program files (x86)\StartNow Toolbar\Resources\protect\window.cssc:\program files (x86)\StartNow Toolbar\Resources\protect\window.jsc:\program files (x86)\StartNow Toolbar\Resources\reactivate\index.htmlc:\program files (x86)\StartNow Toolbar\Resources\reactivate\LeftImage.pngc:\program files (x86)\StartNow Toolbar\Resources\reactivate\NotIE6.cssc:\program files (x86)\StartNow Toolbar\Resources\reactivate\OnlyIE6.cssc:\program files (x86)\StartNow Toolbar\Resources\reactivate\window.cssc:\program files (x86)\StartNow Toolbar\Resources\reactivate\window.jsc:\program files (x86)\StartNow Toolbar\Resources\skin\chevron_button.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_hover.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_button_normal.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_dropdown_button_normal.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_background.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_left.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\searchbox_input_middle.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\separator.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\splitter.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ff_hover_c.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_c.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_l.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_hover_r.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_c.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_l.pngc:\program files (x86)\StartNow Toolbar\Resources\skin\toolbarbutton_ie_normal_r.pngc:\program files (x86)\StartNow Toolbar\Resources\toolbar.xmlc:\program files (x86)\StartNow Toolbar\Resources\update.xmlc:\program files (x86)\StartNow Toolbar\uninstall.datc:\programdata\PCDr\6032\AddOnDownloaded\1b0b3c38-2b97-4f8d-954b-06296209b73d.dllc:\programdata\PCDr\6032\AddOnDownloaded\1ea63693-456f-437c-857f-522df77e7357.dllc:\programdata\PCDr\6032\AddOnDownloaded\32ac3173-77bd-4ec6-9638-94e174508c22.dllc:\programdata\PCDr\6032\AddOnDownloaded\3e0b29b2-9809-4050-abfc-ef8aff73ceab.dllc:\programdata\PCDr\6032\AddOnDownloaded\4d4f44db-c9f0-4cc8-a32f-e98ea4fff68d.dllc:\programdata\PCDr\6032\AddOnDownloaded\5f2ce3e8-3c56-40bb-86d6-a1a41867000b.dllc:\programdata\PCDr\6032\AddOnDownloaded\7b6e388f-35d0-44f8-aa2c-20538273473f.dllc:\programdata\PCDr\6032\AddOnDownloaded\7dd123b0-30e9-4f67-b7e2-20e7374cbb87.dllc:\programdata\PCDr\6032\AddOnDownloaded\88bde4bf-b24d-4cb6-92ef-eb02d3276f09.dllc:\programdata\PCDr\6032\AddOnDownloaded\96c23f75-9f21-4ef8-a3c8-1a554b815309.dllc:\programdata\PCDr\6032\AddOnDownloaded\97cd9b9c-9747-469a-acfa-cfbf8aed528a.dllc:\programdata\PCDr\6032\AddOnDownloaded\9cdc7b97-c1d2-495c-8b7f-12fd3c7e14b8.dllc:\programdata\PCDr\6032\AddOnDownloaded\be661974-a339-4e9a-bea4-bda0af68ba7f.dllc:\programdata\PCDr\6032\AddOnDownloaded\bea3f575-677a-4c92-89ca-7be8480c11a9.dllc:\programdata\PCDr\6032\AddOnDownloaded\c0ff87a7-2f82-4d5e-8d0f-38cbd0c2f4d1.dllc:\programdata\PCDr\6032\AddOnDownloaded\ca35a61e-780d-401f-891e-22b67162d061.dllc:\programdata\PCDr\6032\AddOnDownloaded\caf72ad2-a222-415c-a303-8ca35e466713.dllc:\programdata\PCDr\6032\AddOnDownloaded\d04640e7-f772-4909-8f8e-f8294ff0752f.dllc:\programdata\PCDr\6032\AddOnDownloaded\d2597799-52b1-4a68-9280-897ad5c0c18e.dllc:\programdata\PCDr\6032\AddOnDownloaded\fb803e34-29ed-4941-a7b3-4074ca51286c.dllc:\programdata\Roamingc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{079BF75E-18C7-4798-9DBF-0365A0190193}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{19076AA2-8499-4596-B913-546312EBA6CA}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{20AD19F9-8D78-4D2E-909B-886D51FC3348}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{59030B74-72AB-4E0B-92EA-C7AC0A064742}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{64422228-F885-454B-87BA-23D5118374BE}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{6790E1CF-6769-4EB1-AF31-9BD35432CB44}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7AE48ED9-E52E-4764-A226-85FC31460AC6}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{7B27D0F3-CD25-4339-B85E-AC2CF9CDB116}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{A62FB548-76A7-4E75-BE20-62AFC03F8939}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{ABDDC225-B7E1-461A-B382-D41249C11C6B}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{B8675A2F-F1F2-4461-B0D2-80FAC3B9C3C5}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{D4B8DA25-24B6-42BE-867B-2046403FEBD1}.xpsc:\users\Roberty\AppData\Local\Microsoft\Windows\Temporary Internet Files\{FC5EF1BF-4187-4D6C-AAB2-5106A250CADD}.xpsc:\users\Roberty\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbkc:\users\Roberty\AppData\Roaming\Microsoft\Network\Connections\Pbk\_hiddenPbk\rasphone.pbkc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}c:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome.manifestc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\bar.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\bar.xulc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\buttons.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\constants.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\events.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\globals.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\htmldialog.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\htmldialog.xulc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\htmldropdown.xulc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\init.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\engine_images.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\engine_maps.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\engine_news.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\engine_videos.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\engine_web.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\icon_amazon.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\icon_ebay.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\icon_facebook.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\icon_games.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\icon_msn.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\icon_shopping.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\icon_travel.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\icon_twitter.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\images\startnow_logo.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\installer.xmlc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\protect\index.htmlc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\protect\NotIE6.cssc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\protect\OnlyIE6.cssc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\protect\SearchProtectIcon.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\protect\Web.configc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\protect\window.cssc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\protect\window.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\reactivate\index.htmlc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\reactivate\LeftImage.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\reactivate\NotIE6.cssc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\reactivate\OnlyIE6.cssc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\reactivate\window.cssc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\reactivate\window.jsc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\chevron_button.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\searchbox_button_hover.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\searchbox_button_normal.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\searchbox_dropdown_button_normal.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\searchbox_input_background.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\searchbox_input_left.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\searchbox_input_middle.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\separator.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\splitter.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\toolbarbutton_ff_hover_c.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\toolbarbutton_ie_hover_c.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\toolbarbutton_ie_hover_l.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\toolbarbutton_ie_hover_r.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\toolbarbutton_ie_normal_c.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\toolbarbutton_ie_normal_l.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\skin\toolbarbutton_ie_normal_r.pngc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\content\resources\toolbar.xmlc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\locale\en-US\{5911488E-9D1E-40ec-8CBB-06B231CC153F}.dtdc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\chrome\skin\overlay.cssc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\extensions\{5911488E-9D1E-40ec-8CBB-06B231CC153F}\install.rdfc:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\searchplugins\bing-zugo.xmlc:\windows\SysWow64\frapsvid.dllc:\windows\SysWow64\msvfd32.exe..((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))..-------\Service_Adobe Licensing Console..((((((((((((((((((((((((( Files Created from 2013-04-17 to 2013-05-17 )))))))))))))))))))))))))))))))..2013-05-17 20:26 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll2013-05-17 20:26 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll2013-05-17 09:06 . 2013-05-13 06:37 9460464 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{11EA3927-38A4-4951-991D-7D32D7D925AB}\mpengine.dll2013-05-17 08:42 . 2013-05-17 08:42 -------- d-----w- c:\users\Roberty\AppData\Roaming\Malwarebytes2013-05-17 08:42 . 2013-05-17 08:42 -------- d-----w- c:\programdata\Malwarebytes2013-05-17 08:42 . 2013-05-17 08:42 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware2013-05-17 08:42 . 2013-04-04 21:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys2013-05-17 05:16 . 2013-05-17 05:16 -------- d-----w- C:\FRST2013-05-14 21:03 . 2013-05-13 06:37 9460464 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll2013-05-12 07:57 . 2013-05-12 07:57 -------- d-----w- c:\users\Roberty\AppData\Roaming\MusE2013-05-12 07:57 . 2013-05-12 07:57 -------- d-----w- c:\users\Roberty\AppData\Local\MusE2013-05-12 07:56 . 2013-05-12 07:57 -------- d-----w- c:\program files (x86)\MuseScore2013-05-02 08:47 . 2013-05-02 08:50 -------- d-----w- c:\program files (x86)\VST2013-05-01 04:41 . 2013-05-01 04:41 -------- d-----w- c:\users\Roberty\AppData\Roaming\Synthogy2013-05-01 04:35 . 2013-05-02 08:47 83505 ----a-w- c:\program files (x86)\Uninstal.exe2013-05-01 04:35 . 2013-05-02 08:47 -------- d-----w- c:\program files (x86)\Synthogy2013-05-01 04:19 . 2013-05-01 04:33 -------- d-----w- C:\Synthogy Ivory 1.502013-04-30 09:47 . 2007-02-24 02:09 905728 ----a-w- c:\windows\system32\synsoacc.dll2013-04-30 09:47 . 2006-11-16 23:58 31248 ----a-w- c:\windows\system32\drivers\synUSB64.sys2013-04-30 09:47 . 2006-01-29 19:48 401462 ----a-w- c:\windows\SysWow64\temp.0002013-04-27 04:59 . 2013-04-27 04:59 -------- d-----w- c:\program files (x86)\Common Files\Skype2013-04-24 20:16 . 2013-04-12 14:45 1656680 ----a-w- c:\windows\system32\drivers\ntfs.sys2013-04-24 01:00 . 2013-04-19 00:54 972264 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll2013-04-24 01:00 . 2013-04-24 01:00 905296 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{1F5FD95B-6100-4950-A8C2-9DB10999FA4B}\gapaengine.dll2013-04-21 11:30 . 2013-04-21 11:30 -------- d-----w- c:\users\Roberty\AppData\Roaming\SynthMaker2013-04-21 11:26 . 2013-04-21 11:26 -------- d-----w- c:\program files (x86)\ASIO4ALL v22013-04-21 11:26 . 2013-05-02 08:50 -------- d-----w- c:\program files (x86)\VstPlugins2013-04-21 11:26 . 2006-06-20 08:56 225280 ----a-w- c:\windows\SysWow64\rewire.dll2013-04-21 11:26 . 2009-09-15 09:14 1554944 ----a-w- c:\windows\SysWow64\vorbis.acm2013-04-21 11:26 . 2013-04-21 11:26 -------- d-----w- c:\program files (x86)\Outsim2013-04-21 11:22 . 2013-04-21 11:26 -------- d-----w- c:\program files (x86)\Image-Line2013-04-20 03:22 . 2013-04-20 03:22 -------- d-----w- c:\users\Roberty\AppData\Local\ElevatedDiagnostics2013-04-19 08:39 . 2013-04-19 08:39 -------- d-----w- C:\found.0012013-04-19 05:05 . 2013-04-19 05:05 -------- d-----w- c:\users\Roberty\AppData\Roaming\Tenebril2013-04-19 05:05 . 2013-04-19 05:05 -------- d-----w- c:\windows\SysWow64\tenarchlib2013-04-19 04:41 . 2013-04-19 04:41 -------- d-----w- c:\programdata\SoftSafe2013-04-19 04:40 . 2013-04-19 04:41 -------- d-----w- c:\programdata\InstallMate2013-04-19 00:51 . 2013-04-19 00:51 -------- d-----w- c:\program files (x86)\Microsoft Security Client2013-04-19 00:50 . 2013-04-19 00:51 -------- d-----w- c:\program files\Microsoft Security Client...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2013-05-17 10:15 . 2012-04-14 00:39 692104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2013-05-17 10:15 . 2011-10-03 17:13 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2013-05-16 09:17 . 2011-09-18 09:10 75016696 ----a-w- c:\windows\system32\MRT.exe2013-05-11 18:23 . 2010-06-24 16:33 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll2013-05-02 15:29 . 2010-11-21 03:27 278800 ------w- c:\windows\system32\MpSigStub.exe2013-03-19 06:04 . 2013-04-10 17:50 5550424 ----a-w- c:\windows\system32\ntoskrnl.exe2013-03-19 05:46 . 2013-04-10 17:50 43520 ----a-w- c:\windows\system32\csrsrv.dll2013-03-19 05:04 . 2013-04-10 17:50 3968856 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe2013-03-19 05:04 . 2013-04-10 17:50 3913560 ----a-w- c:\windows\SysWow64\ntoskrnl.exe2013-03-19 04:47 . 2013-04-10 17:50 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll2013-03-19 03:06 . 2013-04-10 17:50 112640 ----a-w- c:\windows\system32\smss.exe2013-03-14 07:33 . 2013-03-14 07:33 73728 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe2013-03-14 07:33 . 2013-03-14 07:33 719360 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll2013-03-14 07:33 . 2013-03-14 07:33 61952 ----a-w- c:\windows\SysWow64\tdc.ocx2013-03-14 07:33 . 2013-03-14 07:33 523264 ----a-w- c:\windows\SysWow64\vbscript.dll2013-03-14 07:33 . 2013-03-14 07:33 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll2013-03-14 07:33 . 2013-03-14 07:33 38400 ----a-w- c:\windows\SysWow64\imgutil.dll2013-03-14 07:33 . 2013-03-14 07:33 361984 ----a-w- c:\windows\SysWow64\html.iec2013-03-14 07:33 . 2013-03-14 07:33 23040 ----a-w- c:\windows\SysWow64\licmgr10.dll2013-03-14 07:33 . 2013-03-14 07:33 226304 ----a-w- c:\windows\system32\elshyph.dll2013-03-14 07:33 . 2013-03-14 07:33 216064 ----a-w- c:\windows\system32\msls31.dll2013-03-14 07:33 . 2013-03-14 07:33 197120 ----a-w- c:\windows\system32\msrating.dll2013-03-14 07:33 . 2013-03-14 07:33 185344 ----a-w- c:\windows\SysWow64\elshyph.dll2013-03-14 07:33 . 2013-03-14 07:33 158720 ----a-w- c:\windows\SysWow64\msls31.dll2013-03-14 07:33 . 2013-03-14 07:33 150528 ----a-w- c:\windows\SysWow64\iexpress.exe2013-03-14 07:33 . 2013-03-14 07:33 1441280 ----a-w- c:\windows\SysWow64\inetcpl.cpl2013-03-14 07:33 . 2013-03-14 07:33 138752 ----a-w- c:\windows\SysWow64\wextract.exe2013-03-14 07:33 . 2013-03-14 07:33 137216 ----a-w- c:\windows\SysWow64\ieUnatt.exe2013-03-14 07:33 . 2013-03-14 07:33 12800 ----a-w- c:\windows\SysWow64\mshta.exe2013-03-14 07:33 . 2013-03-14 07:33 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll2013-03-14 07:33 . 2013-03-14 07:33 1054720 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe2013-03-14 07:33 . 2013-03-14 07:33 97280 ----a-w- c:\windows\system32\mshtmled.dll2013-03-14 07:33 . 2013-03-14 07:33 92160 ----a-w- c:\windows\system32\SetIEInstalledDate.exe2013-03-14 07:33 . 2013-03-14 07:33 905728 ----a-w- c:\windows\system32\mshtmlmedia.dll2013-03-14 07:33 . 2013-03-14 07:33 81408 ----a-w- c:\windows\system32\icardie.dll2013-03-14 07:33 . 2013-03-14 07:33 77312 ----a-w- c:\windows\system32\tdc.ocx2013-03-14 07:33 . 2013-03-14 07:33 762368 ----a-w- c:\windows\system32\ieapfltr.dll2013-03-14 07:33 . 2013-03-14 07:33 62976 ----a-w- c:\windows\system32\pngfilt.dll2013-03-14 07:33 . 2013-03-14 07:33 599552 ----a-w- c:\windows\system32\vbscript.dll2013-03-14 07:33 . 2013-03-14 07:33 52224 ----a-w- c:\windows\system32\msfeedsbs.dll2013-03-14 07:33 . 2013-03-14 07:33 51200 ----a-w- c:\windows\system32\imgutil.dll2013-03-14 07:33 . 2013-03-14 07:33 48640 ----a-w- c:\windows\system32\mshtmler.dll2013-03-14 07:33 . 2013-03-14 07:33 452096 ----a-w- c:\windows\system32\dxtmsft.dll2013-03-14 07:33 . 2013-03-14 07:33 441856 ----a-w- c:\windows\system32\html.iec2013-03-14 07:33 . 2013-03-14 07:33 281600 ----a-w- c:\windows\system32\dxtrans.dll2013-03-14 07:33 . 2013-03-14 07:33 27648 ----a-w- c:\windows\system32\licmgr10.dll2013-03-14 07:33 . 2013-03-14 07:33 270848 ----a-w- c:\windows\system32\iedkcs32.dll2013-03-14 07:33 . 2013-03-14 07:33 247296 ----a-w- c:\windows\system32\webcheck.dll2013-03-14 07:33 . 2013-03-14 07:33 235008 ----a-w- c:\windows\system32\url.dll2013-03-14 07:33 . 2013-03-14 07:33 173568 ----a-w- c:\windows\system32\ieUnatt.exe2013-03-14 07:33 . 2013-03-14 07:33 167424 ----a-w- c:\windows\system32\iexpress.exe2013-03-14 07:33 . 2013-03-14 07:33 1509376 ----a-w- c:\windows\system32\inetcpl.cpl2013-03-14 07:33 . 2013-03-14 07:33 149504 ----a-w- c:\windows\system32\occache.dll2013-03-14 07:33 . 2013-03-14 07:33 144896 ----a-w- c:\windows\system32\wextract.exe2013-03-14 07:33 . 2013-03-14 07:33 1400416 ----a-w- c:\windows\system32\ieapfltr.dat2013-03-14 07:33 . 2013-03-14 07:33 13824 ----a-w- c:\windows\system32\mshta.exe2013-03-14 07:33 . 2013-03-14 07:33 136192 ----a-w- c:\windows\system32\iepeers.dll2013-03-14 07:33 . 2013-03-14 07:33 135680 ----a-w- c:\windows\system32\IEAdvpack.dll2013-03-14 07:33 . 2013-03-14 07:33 12800 ----a-w- c:\windows\system32\msfeedssync.exe2013-03-14 07:33 . 2013-03-14 07:33 102912 ----a-w- c:\windows\system32\inseng.dll2013-03-01 03:36 . 2013-04-10 17:50 3153408 ----a-w- c:\windows\system32\win32k.sys2013-02-21 10:30 . 2013-04-11 09:08 1766912 ----a-w- c:\windows\SysWow64\wininet.dll2013-02-21 10:29 . 2013-04-11 09:08 2877440 ----a-w- c:\windows\SysWow64\jscript9.dll2013-02-21 10:29 . 2013-04-11 09:08 61440 ----a-w- c:\windows\SysWow64\iesetup.dll2013-02-21 10:29 . 2013-04-11 09:08 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll2013-02-21 10:15 . 2013-04-11 09:08 51712 ----a-w- c:\windows\system32\ie4uinit.exe2013-02-21 10:15 . 2013-04-11 09:08 2240512 ----a-w- c:\windows\system32\wininet.dll2013-02-21 10:14 . 2013-04-11 09:08 1365504 ----a-w- c:\windows\system32\urlmon.dll2013-02-21 10:14 . 2013-04-11 09:08 19230208 ----a-w- c:\windows\system32\mshtml.dll2013-02-21 10:14 . 2013-04-11 09:08 603136 ----a-w- c:\windows\system32\msfeeds.dll2013-02-21 10:14 . 2013-04-11 09:08 3958784 ----a-w- c:\windows\system32\jscript9.dll2013-02-21 10:14 . 2013-04-11 09:08 53248 ----a-w- c:\windows\system32\jsproxy.dll2013-02-21 10:14 . 2013-04-11 09:08 855552 ----a-w- c:\windows\system32\jscript.dll2013-02-21 10:14 . 2013-04-11 09:08 526336 ----a-w- c:\windows\system32\ieui.dll2013-02-21 10:14 . 2013-04-11 09:08 67072 ----a-w- c:\windows\system32\iesetup.dll2013-02-21 10:14 . 2013-04-11 09:08 136704 ----a-w- c:\windows\system32\iesysprep.dll2013-02-21 10:14 . 2013-04-11 09:08 2647040 ----a-w- c:\windows\system32\iertutil.dll2013-02-21 10:14 . 2013-04-11 09:08 39936 ----a-w- c:\windows\system32\iernonce.dll2013-02-21 10:14 . 2013-04-11 09:08 15404544 ----a-w- c:\windows\system32\ieframe.dll2013-02-19 12:01 . 2013-04-11 09:08 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb2013-02-19 11:42 . 2013-04-11 09:08 2706432 ----a-w- c:\windows\system32\mshtml.tlb2013-02-19 11:10 . 2013-04-11 09:08 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe2013-02-19 10:51 . 2013-04-11 09:08 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"Aim"="c:\program files (x86)\AIM\aim.exe" [2012-05-30 4331392]"GoogleChromeAutoLaunch_994E78B1C6964A952745C39F20184D66"="c:\users\Roberty\AppData\Local\Google\Chrome\Application\chrome.exe" [2013-04-09 1312720].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2011-05-30 885760]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-25 421888].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"ConsentPromptBehaviorAdmin"= 5 (0x5)"ConsentPromptBehaviorUser"= 3 (0x3)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"LoadAppInit_DLLs"=1 (0x1)"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]"aux1"=wdmaud.drv.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@="".[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]@="Service".R2 CLKMSVC10_9EC60124;CyberLink Product - 2011/08/08 16:39;c:\program files (x86)\Cyberlink\PowerDVD9\NavFilter\kmsvc.exe [2010-10-29 236016]R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632]R2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [x]R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-03-01 161384]R3 appliand;Applian Network Service;c:\windows\system32\DRIVERS\appliand.sys [2011-06-26 33888]R3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-01-24 1298496]R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]R3 Impcd;Impcd;c:\windows\system32\drivers\Impcd.sys [2010-02-27 158976]R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2010-12-17 340240]R3 netvsc;netvsc;c:\windows\system32\DRIVERS\netvsc60.sys [2010-11-21 168448]R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys [2013-01-20 130008]R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe [2013-01-27 379360]R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656]R3 Sound Blaster X-Fi MB Licensing Service;Sound Blaster X-Fi MB Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\XMBLicensing.exe [2011-08-13 79360]R3 SynthVid;SynthVid;c:\windows\system32\DRIVERS\VMBusVideoM.sys [2010-11-21 22528]R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]R3 TurboBoost;Intel® Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe [2010-11-29 149504]R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-08-16 1255736]R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2011-05-21 27240]S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856]S0 stdcfltn;Disk Class Filter Driver for Accelerometer;c:\windows\system32\DRIVERS\stdcfltn.sys [2010-08-20 21616]S1 A2DDA;A2 Direct Disk Access Support Driver;c:\users\Roberty\Desktop\comp stuff\Emsisoft emergency kit\Run\a2ddax64.sys [2013-04-19 26176]S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-01-24 901184]S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-01-24 991296]S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-04-04 418376]S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-04-04 701512]S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe [2011-11-25 687400]S2 NOBU;Dell DataSafe Online;c:\program files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe SERVICE [x]S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2011-05-21 378472]S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2010-11-29 16120]S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-12-20 2656280]S3 Acceler;Accelerometer Service;c:\windows\system32\DRIVERS\Accelern.sys [2010-12-13 27760]S3 appliandMP;appliandMP;c:\windows\system32\DRIVERS\appliand.sys [2011-06-26 33888]S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [2011-01-24 58128]S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2011-01-24 274944]S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [2011-01-20 176096]S3 dtsoftbus01;DAEMON Tools Virtual Bus Driver;c:\windows\system32\DRIVERS\dtsoftbus01.sys [2011-10-16 270912]S3 iBtFltCoex;iBtFltCoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-01-24 59904]S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440]S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-04-04 25928]S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2011-02-10 82432]S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2011-02-10 181760]S3 qicflt;upper Device Filter Driver;c:\windows\system32\DRIVERS\qicflt.sys [2010-07-13 29288]S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-02-17 428136]S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys [2010-12-01 42392]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - WS2IFSL*Deregistered* - CLKMDRV10_9EC60124.Contents of the 'Scheduled Tasks' folder.2013-05-17 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-14 10:15].2013-05-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3481103015-3984997456-3542171105-1002Core.job- c:\users\Roberty\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-13 21:31].2013-05-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3481103015-3984997456-3542171105-1002UA.job- c:\users\Roberty\AppData\Local\Google\Update\GoogleUpdate.exe [2011-08-13 21:31]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-02-18 6611048]"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-18 2188904]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-03-30 167960]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-30 391704]"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-30 418840]"FreeFallProtection"="c:\program files (x86)\STMicroelectronics\AccelerometerP11\FF_Protection.exe" [2010-12-17 686704]"IntelTBRunOnce"="wscript.exe" [2009-07-14 168960]"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-10-17 1432144]"IntelWireless"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2010-12-17 1933584]"DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2011-05-30 2055816]"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLs"=c:\windows\System32\nvinitx.dll.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - LocalServiceFontCache.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmmLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.localIE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105TCP: DhcpNameServer = 171.64.7.99 171.64.7.121 171.64.7.55TCP: Interfaces\{CE5451F2-BA77-4E05-AE76-23E622425E8D}: NameServer = 0.0.0.0FF - ProfilePath - c:\users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/?pc=Z131&install_date=20110818FF - prefs.js: browser.search.selectedEngine - BingFF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z131&form=ZGAADF&install_date=20110818&q=FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false.- - - - ORPHANS REMOVED - - - -.Toolbar-Locked - (no file)Toolbar-{5911488E-9D1E-40ec-8CBB-06B231CC153F} - (no file)Wow6432Node-HKLM-Run-<NO NAME> - (no file)HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - startToolbar-Locked - (no file)HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exeAddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - c:\programdata\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1}\bm_installer.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_202_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_202_ActiveX.exe".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.11".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_202.ocx, 1".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]@Denied: (A 2) (Everyone)@="IFlashBroker5".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\SOFTWARE\McAfee]"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\.[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]@Denied: (A) (Everyone)"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}".[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]@Denied: (A) (Everyone).[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]"Key"="ActionsPane3""Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd".[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]@Denied: (Full) (Everyone).------------------------ Other Running Processes ------------------------.c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exec:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\program files (x86)\Canon\IJPLM\IJPLMSVC.EXEc:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exec:\program files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exec:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe.**************************************************************************.Completion time: 2013-05-17 14:48:10 - machine was rebootedComboFix-quarantined-files.txt 2013-05-17 21:48.Pre-Run: 26,673,098,752 bytes freePost-Run: 27,923,263,488 bytes free.- - End Of File - - B2F882D040323AFA5A17472C454F0DFEComboFix.txt Link to post Share on other sites More sharing options...
MrCharlie Posted May 19, 2013 ID:681396 Share Posted May 19, 2013 Sorry for the delay, some how I missed your reply.Log looks OK...Lets check for any adware while you're here:Please download AdwCleaner from here and save it on your Desktop.AdwCleaner is a reliable removal tool for Adware, Foistware, toolbars and potentially unwanted programs.AdwCleaner is a tool that deletes :· Adwares (software ads)· PUP/LPI (Potentially Undesirable Program)· Toolbars· Hijacker (Hijack of the browser's homepage)It works with a Search and Deletion method. It can be easily uninstalled using the "Uninstall" mode. Right-click on adwcleaner.exe and select Run As Administrator (for XP just double click) to launch the application.Now click on the Search tab.Please post the contents of the log-file created in your next post.Note: The log can also be located at C:\ >> AdwCleaner[XX].txt >> XX <-- Denotes the number of times the application has been ran, so in this should be something like R1.Note:Please look over what was found......especially any folders, we're going to permanently delete it all in the next step....if there's something you may want to keep...please let me know and I'll explain to why it shouldn't be on your system.If you see AVG Secure Search being targeted for deletion, Here's Why and Here. You can always Reinstall it.Please note that Antivir Webguard uses ASK Toolbar as part of its web security. If you remove ASK by using Adwcleaner, Antivir Webguard will no longer work properly. Therefore, if you use this program please use the instructions below to access the options screen where you should enable /DisableAskDetections before using AdwCleaner.You can click on the question mark (?) in the upper left corner of the program and then click on Options. You will then be presented with a dialog where you can disable various detections. These options are described below:/DisableAskDetection - This option disables Ask Toolbar detection.MrC Link to post Share on other sites More sharing options...
bbobrob Posted May 21, 2013 Author ID:682099 Share Posted May 21, 2013 Here's the log (I looked it over, and it looks like all extraneous/unwanted stuff to me):# AdwCleaner v2.301 - Logfile created 05/21/2013 at 01:01:33# Updated 16/05/2013 by Xplode# Operating system : Windows 7 Professional Service Pack 1 (64 bits)# User : Roberty - ROBERTY-PC# Boot Mode : Normal# Running from : C:\Users\Roberty\Desktop\adwcleaner.exe# Option [search]***** [services] ********** [Files / Folders] *****File Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dllFile Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xptFile Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dllFile Found : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xptFolder Found : C:\Program Files (x86)\Common Files\Software Update UtilityFolder Found : C:\ProgramData\InstallMateFolder Found : C:\ProgramData\SoftSafeFolder Found : C:\Users\Roberty\AppData\Local\PackageAware***** [Registry] *****Key Found : HKCU\Software\IminentKey Found : HKCU\Software\YahooPartnerToolbarKey Found : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}Key Found : HKLM\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}Key Found : HKLM\SOFTWARE\Classes\AppID\dnu.EXEKey Found : HKLM\SOFTWARE\Classes\AppID\Toolbar.DLLKey Found : HKLM\SOFTWARE\Classes\dnUpdateKey Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowserKey Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1Key Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdControllerKey Found : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1Key Found : HKLM\SOFTWARE\Classes\Toolbar.BandObjectKey Found : HKLM\SOFTWARE\Classes\Toolbar.BandObject.1Key Found : HKLM\SOFTWARE\Classes\Toolbar.ToolbarHelperObjectKey Found : HKLM\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}Key Found : HKLM\Software\IminentKey Found : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32Key Found : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCSKey Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}Key Found : HKLM\Software\StartNow ToolbarKey Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}Key Found : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}Key Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARPKey Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtilityKey Found : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}Key Found : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}Key Found : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}Key Found : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}Key Found : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}Key Found : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}Key Found : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}Key Found : HKLM\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}Key Found : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}Key Found : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}Key Found : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}Key Found : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}Key Found : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}Key Found : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}Key Found : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}Key Found : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}Key Found : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}Key Found : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}Key Found : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}Key Found : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}Key Found : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}Key Found : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}Key Found : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}Key Found : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}Key Found : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}Key Found : HKLM\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}Key Found : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}Key Found : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}Key Found : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}Key Found : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}Key Found : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}Key Found : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}Key Found : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}Key Found : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}Key Found : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}Key Found : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}Key Found : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}Key Found : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}Key Found : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}Key Found : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}Key Found : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}Key Found : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}Key Found : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}Key Found : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}Key Found : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}Key Found : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}Key Found : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}Value Found : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{5911488E-9D1E-40EC-8CBB-06B231CC153F}]***** [internet Browsers] *****-\\ Internet Explorer v10.0.9200.16537[OK] Registry is clean.-\\ Mozilla Firefox v21.0 (en-US)File : C:\Users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\prefs.js[OK] File is clean.-\\ Google Chrome v26.0.1410.64File : C:\Users\Roberty\AppData\Local\Google\Chrome\User Data\Default\Preferences[OK] File is clean.*************************AdwCleaner[R1].txt - [12365 octets] - [21/05/2013 01:01:33]########## EOF - C:\AdwCleaner[R1].txt - [12426 octets] ##########AdwCleanerR1.txt Link to post Share on other sites More sharing options...
MrCharlie Posted May 21, 2013 ID:682122 Share Posted May 21, 2013 Lots of adware found....lets clear it out.....Please re-run AdwCleanerClick on Delete button.Confirm each time with OK if asked.Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.Note: You can find the logfile at C:\AdwCleaner[sn].txt as well - n is the order number.Then......Lets check your computers security before you go and we have a little cleanup to do also:Download Security Check by screen317 from HERE or HERE.Save it to your Desktop.Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.A Notepad document should open automatically called checkup.txt.Please Post the contents of that document.Do Not Attach It!!!MrC Link to post Share on other sites More sharing options...
bbobrob Posted May 21, 2013 Author ID:682256 Share Posted May 21, 2013 Here are the logs:Adwcleaner log:# AdwCleaner v2.301 - Logfile created 05/21/2013 at 12:49:10# Updated 16/05/2013 by Xplode# Operating system : Windows 7 Professional Service Pack 1 (64 bits)# User : Roberty - ROBERTY-PC# Boot Mode : Normal# Running from : C:\Users\Roberty\Desktop\adwcleaner.exe# Option [Delete]***** [services] ********** [Files / Folders] *****File Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.dllFile Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnu.xptFile Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.dllFile Deleted : C:\Program Files (x86)\Mozilla Firefox\plugins\npdnupdater2.xptFolder Deleted : C:\Program Files (x86)\Common Files\Software Update UtilityFolder Deleted : C:\ProgramData\InstallMateFolder Deleted : C:\ProgramData\SoftSafeFolder Deleted : C:\Users\Roberty\AppData\Local\PackageAware***** [Registry] *****Key Deleted : HKCU\Software\IminentKey Deleted : HKCU\Software\YahooPartnerToolbarKey Deleted : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{7E8A36EA-2501-4ED3-A3C8-CFA9143FB169}Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}Key Deleted : HKLM\SOFTWARE\Classes\AppID\dnu.EXEKey Deleted : HKLM\SOFTWARE\Classes\AppID\Toolbar.DLLKey Deleted : HKLM\SOFTWARE\Classes\dnUpdateKey Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowserKey Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUIBrowser.1Key Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdControllerKey Deleted : HKLM\SOFTWARE\Classes\dnUpdater.DownloadUpdController.1Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.BandObjectKey Deleted : HKLM\SOFTWARE\Classes\Toolbar.BandObject.1Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.ToolbarHelperObjectKey Deleted : HKLM\SOFTWARE\Classes\Toolbar.ToolbarHelperObject.1Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{6857AC4A-95B4-4E2C-B2D2-8A235FCCEF4A}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{92380354-381A-471F-BE2E-DD9ACD9777EA}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}Key Deleted : HKLM\Software\IminentKey Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCSKey Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}Key Deleted : HKLM\Software\StartNow ToolbarKey Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7B089B94-D1DC-4C6B-87E1-8156E22C1D96}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E15A9BFD-D16D-496D-8222-44CADF316E70}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48D2-9061-8BBD4899EB08}Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchTheWebARPKey Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SoftwareUpdUtilityKey Deleted : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{1C888195-0160-4883-91B7-294C0CE2F277}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{660E6F4F-840D-436D-B668-433D9591BAC5}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{99ACA0F7-D864-45CB-8C40-FD42A077E7CA}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7435878-65B9-44D1-A443-81754E5DFC90}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}Value Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{5911488E-9D1E-40EC-8CBB-06B231CC153F}]***** [internet Browsers] *****-\\ Internet Explorer v10.0.9200.16537[OK] Registry is clean.-\\ Mozilla Firefox v21.0 (en-US)File : C:\Users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\prefs.jsC:\Users\Roberty\AppData\Roaming\Mozilla\Firefox\Profiles\qzb68gul.default\user.js ... Deleted ![OK] File is clean.-\\ Google Chrome v26.0.1410.64File : C:\Users\Roberty\AppData\Local\Google\Chrome\User Data\Default\Preferences[OK] File is clean.*************************AdwCleaner[R1].txt - [12402 octets] - [21/05/2013 01:01:33]AdwCleaner[s1].txt - [12796 octets] - [21/05/2013 12:49:10]########## EOF - C:\AdwCleaner[s1].txt - [12857 octets] ##########SecurityCheck log: Results of screen317's Security Check version 0.99.63 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 Java 6 Update 26 Java version out of Date! Adobe Flash Player 11.7.700.202 Adobe Reader 10.1.1 Adobe Reader out of Date! Mozilla Firefox (21.0) Google Chrome 26.0.1410.43 Google Chrome 26.0.1410.64 ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
MrCharlie Posted May 21, 2013 ID:682292 Share Posted May 21, 2013 Out dated programs on the system are vulnerable to malware.Please update or uninstall them:~~~~~~~~~~~~~~~~~~~~~~~~~~Java™ 6 Update 26 <----please uninstall from add/remove programsJava version out of Date! <-------Download and install the latest version from HereUncheck the box to install the Ask toolbar!!! and any other free "stuff".------------------------------Adobe Reader 10.1.1 Adobe Reader out of Date! <---please check for an update if available or uninstall and download and install Foxit Reader which is less vulnerable to malware and much better than Adobe. Don't install any toolbars that may come with it (ASK Toolbar).-------------------------------Google Chrome 26.0.1410.43 <-----OLDGoogle Chrome 26.0.1410.64 <-----OKYou have old versions of Google Chrome on the system.Please download and run OldChromeRemover.@Windows Vista/Windows 7-8 users must use “Run As Administrator.”~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~A little clean up to do....Please Uninstall ComboFix: (if you used it)Press the Windows logo key + R to bring up the "run box"Copy and paste next command in the field:ComboFix /uninstallMake sure there's a space between Combofix and /Then hit enter.This will uninstall Combofix, delete its related folders and files, hide file extensions, hide the system/hidden files and clears System Restore cache and create new Restore point(If that doesn't work.....you can simply rename ComboFix.exe to Uninstall.exe and double click it to complete the uninstall)---------------------------------If you used DeFogger to disable your CD Emulation drivers, please re-enable them.-------------------------------Please download OTC to your desktop.http://oldtimer.geekstogo.com/OTC.exeDouble-click OTC to run it. (Vista and up users, please right click on OTC and select "Run as an Administrator")Click on the CleanUp! button and follow the prompts.(If you get a warning from your firewall or other security programs regarding OTC attempting to contact the Internet, please allow the connection.)You will be asked to reboot the machine to finish the Cleanup process, choose Yes.After the reboot all the tools we used should be gone.Note: Some more recently created tools may not yet be removed by OTC. Feel free to manually delete any tools it leaves behind.Any other programs or logs you can manually delete.IE: RogueKiller.exe, RKreport.txt, RK_Quarantine folder, C:\FRST, MBAR, etc....AdwCleaner > just run the program and click uninstall.-------------------------------Any questions...please post back.If you think I've helped you, please leave a comment > click on my avatar picture > click Profile Feed.Take a look at My Preventive Maintenance to avoid being infected again.Good Luck and Thanks for using the forum, MrC Link to post Share on other sites More sharing options...
LDTate Posted May 22, 2013 ID:682481 Share Posted May 22, 2013 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts