Dlink redirect virus

historybuff77 · May 26, 2013

Hello,

I think I've been infected with the Dlink redirect virus on Chrome. I've used CCleaner and cleaned my Chrome History but it's still showing up when I search. Thanks in advance for your help.

Here are my logs:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16537

Run by User at 22:28:28 on 2013-05-25

Microsoft Windows 8 6.2.9200.0.1252.2.1033.18.7650.5532 [GMT -4:00]

.

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\Hpservice.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

C:\Windows\system32\svchost.exe -k apphost

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe

C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe

C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Windows\system32\dashost.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\System32\dwm.exe

C:\Windows\system32\atieclxx.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\system32\taskhostex.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe

C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Program Files\IDT\WDM\sttray64.exe

C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe

C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoDashboard.exe

C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

C:\Program Files (x86)\Seagate\Seagate Dashboard\HipServAgent\HipServAgent.exe

C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mStart Page = about:blank

mWinlogon: Userinit = userinit.exe,

BHO: Speed Test Analysis: {310D38FE-EB4C-467C-8781-B7C2AEB7847D} - C:\Program Files (x86)\Speed Test Analysis\ScriptHost.dll

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\CoIEPlg.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\IPS\IPSBHO.dll

BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll

TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\CoIEPlg.dll

mRun: [btTray] "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe"

mRun: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey

mRun: [seagate Dashboard] C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mPolicies-Explorer: NoDriveTypeAutoRun = dword:28

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503}

TCP: NameServer = 192.168.0.1

TCP: Interfaces\{0327BF37-553C-4D09-8230-9F5D50667E24} : DHCPNameServer = 64.71.255.204 64.71.255.198

TCP: Interfaces\{53677ED1-0FBD-40FF-9C76-3CAB33DE80AE} : DHCPNameServer = 192.168.0.1

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-mStart Page = about:blank

x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-mPolicies-Explorer: NoDriveTypeAutoRun = dword:28

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ei4gauue.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: browser.search.selectedEngine -

FF - plugin: C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\windows\SysWOW64\Adobe\Director\np32dsw.dll

FF - ExtSQL: 2013-04-01 13:47; {F04D2D30-776C-4d02-8627-8E4385ECA58D}; C:\ProgramData\Norton\{92622AAD-05E8-4459-B256-765CE1E929FB}\NST_2013.3.0.26\coFFPlgn

FF - ExtSQL: 2013-04-25 12:56; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\coFFPlgn

FF - ExtSQL: 2013-04-27 11:44; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\IPSFFPlgn

FF - ExtSQL: !HIDDEN! 2013-03-12 15:21; speedtestanalysis@SpeedAnalysis.com; C:\Users\User\AppData\Roaming\Mozilla\Extensions\speedtestanalysis@SpeedAnalysis.com

.

============= SERVICES / DRIVERS ===============

.

R0 amd_sata;amd_sata;C:\Windows\System32\Drivers\amd_sata.sys [2012-7-24 79528]

R0 amd_xata;amd_xata;C:\Windows\System32\Drivers\amd_xata.sys [2012-7-24 26280]

R0 SymDS;Symantec Data Store;C:\Windows\System32\Drivers\N360x64\1403010.016\SymDS64.sys [2013-4-25 493656]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\Drivers\N360x64\1403010.016\SymEFA64.sys [2013-4-25 1139800]

R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\BASHDefs\20130515.001\BHDrvx64.sys [2013-5-20 1390680]

R1 ccSet_N360;Norton 360 Settings Manager;C:\Windows\System32\Drivers\N360x64\1403010.016\ccSetx64.sys [2013-4-25 168096]

R1 ccSet_NST;Norton Identity Safe Settings Manager;C:\Windows\System32\Drivers\NSTx64\7DD03030.013\ccsetx64.sys [2013-4-16 168096]

R1 CLVirtualDrive;CLVirtualDrive;C:\Windows\System32\Drivers\CLVirtualDrive.sys [2012-11-21 92536]

R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\IPSDefs\20130524.001\IDSviA64.sys [2013-5-25 513184]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\Drivers\N360x64\1403010.016\Ironx64.sys [2013-4-25 224416]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\Drivers\N360x64\1403010.016\symnets.sys [2013-4-25 432800]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-8-9 239616]

R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-8-8 361984]

R2 APXACC;AppEx Networks Accelerator LWF;C:\Windows\System32\Drivers\appexDrv.sys [2012-11-21 199008]

R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2012-8-10 85504]

R2 hpsrv;HP Service;C:\Windows\System32\hpservice.exe [2012-8-10 29600]

R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-7-9 35232]

R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-11-21 2451456]

R2 MemeoBackgroundService;MemeoBackgroundService;C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe [2011-5-4 25824]

R2 N360;Norton 360;C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe [2013-4-25 144520]

R2 NCO;Norton Identity Safe;C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccsvchst.exe [2013-4-16 144520]

R2 SeagateDashboardService;Seagate Dashboard Service;C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe [2012-10-15 14752]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\Drivers\AtihdW86.sys [2012-7-18 98472]

R3 BtAudioBusSrv;IVT Bluetooth Audio Bus Service;C:\Windows\System32\Drivers\BtAudioBus.sys [2012-6-15 23136]

R3 BthL2caScoIfSrv;Bluetooth Profile Interface Driver Service;C:\Windows\System32\Drivers\BtL2caScoIf.sys [2012-7-19 56904]

R3 BthLEEnum;Bluetooth Low Energy Driver;C:\Windows\System32\Drivers\BthLEEnum.sys [2012-7-25 202752]

R3 btUrbFilterDrv;IVT URB Bluetooth Filter Driver Service;C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [2012-8-9 48736]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-4-27 138912]

R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\System32\Drivers\netr28x.sys [2012-11-21 1958984]

R3 RSP2STOR;Realtek PCIE CardReader Driver - P2;C:\Windows\System32\Drivers\RtsP2Stor.sys [2012-11-21 269968]

R3 rtbth;RTBTH Bluetooth Device Driver;C:\Windows\System32\Drivers\rtbth.sys [2012-8-9 695392]

R3 RTL8168;Realtek 8168 NT Driver;C:\Windows\System32\Drivers\Rt630x64.sys [2012-11-21 690832]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\Drivers\usbfilter.sys [2012-11-21 57000]

R3 WirelessButtonDriver;HP Wireless Button Driver Service;C:\Windows\System32\Drivers\WirelessButtonDriver64.sys [2012-8-3 20288]

S0 SymELAM;Symantec ELAM Driver;C:\Windows\System32\Drivers\N360x64\1403010.016\SymELAM.sys [2013-4-25 23448]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 iaStorA;iaStorA;C:\Windows\System32\Drivers\iaStorA.sys [2012-7-31 645952]

S3 SmbDrv;SmbDrv;C:\Windows\System32\Drivers\Smb_driver_AMDASF.sys [2012-11-21 41272]

S3 SmbDrvI;SmbDrvI;C:\Windows\System32\Drivers\Smb_driver_Intel.sys [2012-11-21 43832]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]

S3 WUDFWpdMtp;WUDFWpdMtp;C:\Windows\System32\Drivers\WUDFRd.sys [2012-7-25 198656]

.

=============== Created Last 30 ================

.

2013-05-26 01:33:34 198320 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10204.bin

2013-05-17 12:11:29 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-05-17 12:11:29 -------- d-----w- C:\Program Files\iTunes

2013-05-17 12:11:29 -------- d-----w- C:\Program Files\iPod

2013-05-17 12:11:29 -------- d-----w- C:\Program Files (x86)\iTunes

.

==================== Find3M ====================

.

2013-04-25 16:52:20 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2013-04-11 14:22:56 421200 ----a-w- C:\Windows\SysWow64\msvcp100.dll

2013-04-02 22:08:01 78176 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-04-02 22:08:01 692576 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-03-19 22:19:24 4041728 ----a-w- C:\Windows\System32\win32k.sys

2013-03-12 19:28:21 1409 ----a-w- C:\Windows\QTFont.for

2013-03-07 06:50:56 6991592 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-03-02 10:57:48 337128 ----a-w- C:\Windows\System32\drivers\USBXHCI.SYS

2013-03-02 10:57:46 77544 ----a-w- C:\Windows\System32\drivers\storahci.sys

2013-03-02 10:57:46 332520 ----a-w- C:\Windows\System32\drivers\storport.sys

2013-03-02 10:57:46 283880 ----a-w- C:\Windows\System32\drivers\spaceport.sys

2013-03-02 10:45:20 148712 ----a-w- C:\Windows\System32\drivers\tpm.sys

2013-03-02 10:45:19 194792 ----a-w- C:\Windows\System32\drivers\sdbus.sys

2013-03-02 10:45:10 125160 ----a-w- C:\Windows\System32\drivers\dumpsd.sys

2013-03-02 10:39:39 495336 ----a-w- C:\Windows\System32\drivers\vhdmp.sys

2013-03-02 10:39:38 69864 ----a-w- C:\Windows\System32\drivers\pdc.sys

2013-03-02 10:39:32 327912 ----a-w- C:\Windows\System32\drivers\Classpnp.sys

2013-03-02 09:59:37 2231528 ----a-w- C:\Windows\System32\drivers\tcpip.sys

2013-03-02 09:59:36 411880 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS

2013-03-02 08:24:08 34304 ----a-w- C:\Windows\SysWow64\wuapp.exe

2013-03-02 08:23:43 83968 ----a-w- C:\Windows\SysWow64\wudriver.dll

2013-03-02 08:23:43 125952 ----a-w- C:\Windows\SysWow64\wuwebv.dll

2013-03-02 08:23:30 893952 ----a-w- C:\Windows\SysWow64\winmde.dll

2013-03-02 08:23:30 1338880 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll

2013-03-02 08:23:28 601088 ----a-w- C:\Windows\SysWow64\Windows.Globalization.dll

2013-03-02 08:23:28 504320 ----a-w- C:\Windows\SysWow64\Windows.Security.Authentication.OnlineId.dll

2013-03-02 08:23:19 8857088 ----a-w- C:\Windows\SysWow64\twinui.dll

2013-03-02 08:23:19 246784 ----a-w- C:\Windows\SysWow64\ubpm.dll

2013-03-02 08:23:04 356352 ----a-w- C:\Windows\SysWow64\SettingSync.dll

2013-03-02 08:23:04 100864 ----a-w- C:\Windows\SysWow64\SettingSyncInfo.dll

2013-03-02 08:23:00 375808 ----a-w- C:\Windows\SysWow64\ReAgent.dll

2013-03-02 08:22:36 357888 ----a-w- C:\Windows\SysWow64\netcfgx.dll

2013-03-02 08:22:32 5091840 ----a-w- C:\Windows\SysWow64\mstscax.dll

2013-03-02 08:22:18 361984 ----a-w- C:\Windows\SysWow64\MFMediaEngine.dll

2013-03-02 08:22:17 850944 ----a-w- C:\Windows\SysWow64\mfasfsrcsnk.dll

2013-03-02 08:21:56 550912 ----a-w- C:\Windows\SysWow64\drvstore.dll

2013-03-02 08:21:52 36352 ----a-w- C:\Windows\SysWow64\DevDispItemProvider.dll

2013-03-02 08:21:40 309760 ----a-w- C:\Windows\SysWow64\BCP47Langs.dll

2013-03-02 08:21:39 2033664 ----a-w- C:\Windows\SysWow64\authui.dll

2013-03-02 08:21:32 145408 ----a-w- C:\Windows\SysWow64\powercfg.cpl

2013-03-02 02:44:59 448512 ----a-w- C:\Windows\System32\SettingSync.dll

2013-03-02 02:44:59 128512 ----a-w- C:\Windows\System32\SettingSyncInfo.dll

2013-03-02 02:44:56 1011200 ----a-w- C:\Windows\System32\reseteng.dll

2013-03-02 02:44:41 455168 ----a-w- C:\Windows\System32\netcfgx.dll

2013-03-02 02:44:41 117248 ----a-w- C:\Windows\System32\NdisImPlatform.dll

2013-03-02 02:44:38 5978624 ----a-w- C:\Windows\System32\mstscax.dll

2013-03-02 02:44:30 468992 ----a-w- C:\Windows\System32\MFMediaEngine.dll

2013-03-02 02:44:29 1048576 ----a-w- C:\Windows\System32\mfasfsrcsnk.dll

2013-03-02 02:44:08 703488 ----a-w- C:\Windows\System32\drvstore.dll

2013-03-02 02:44:07 150016 ----a-w- C:\Windows\System32\discan.dll

2013-03-02 02:44:05 49152 ----a-w- C:\Windows\System32\DevDispItemProvider.dll

2013-03-02 02:43:59 1933312 ----a-w- C:\Windows\System32\wbem\cimwin32.dll

2013-03-02 02:43:56 389120 ----a-w- C:\Windows\System32\BCP47Langs.dll

2013-03-02 02:43:55 2302464 ----a-w- C:\Windows\System32\authui.dll

2013-03-02 02:43:51 2146304 ----a-w- C:\Windows\System32\actxprxy.dll

2013-03-02 02:43:50 156160 ----a-w- C:\Windows\System32\powercfg.cpl

2013-03-02 02:15:53 26112 ----a-w- C:\Windows\System32\drivers\mouhid.sys

2013-03-01 04:56:33 156672 ----a-w- C:\Windows\System32\drivers\rfcomm.sys

2013-03-01 04:56:18 30720 ----a-w- C:\Windows\System32\drivers\monitor.sys

2013-03-01 04:55:37 1175040 ----a-w- C:\Windows\System32\drivers\bthport.sys

.

============= FINISH: 22:29:30.60 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 8

Boot Device: \Device\HarddiskVolume2

Install Date: 2012-12-29 11:43:44 PM

System Uptime: 2013-04-27 6:31:08 PM (676 hours ago)

.

Motherboard: Hewlett-Packard | | 1849

Processor: AMD A10-4600M APU with Radeon HD Graphics | Socket FT1 | 1400/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 673 GiB total, 537.056 GiB free.

D: is FIXED (NTFS) - 25 GiB total, 2.967 GiB free.

E: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP27: 2013-05-07 11:25:02 AM - Scheduled Checkpoint

RP28: 2013-05-16 2:12:25 PM - Scheduled Checkpoint

.

==== Installed Programs ======================

.

4 Elements II

7 Wonders II

Adobe Shockwave Player 11.6

Aloha TriPeaks

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Install Manager

AMD Fuel

AMD Quick Stream

AMD VISION Engine Control Center

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Bejeweled 3

Bonjour

Build-a-lot 4 - Power Source

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

Chuzzle Deluxe

Cradle of Rome 2

Crazy Chicken Soccer

CyberLink LabelPrint

CyberLink Media Suite 10

CyberLink PhotoDirector

CyberLink Power2Go 8

CyberLink PowerDirector 10

CyberLink PowerDVD

CyberLink YouCam

D3DX10

Energy Star

Farm Frenzy

Final Drive Fury

FlatOut 2

Foxit Reader

Galerie de photos Windows Live

Google Chrome

Google Toolbar for Internet Explorer

Google Update Helper

Governor of Poker 2 Premium Edition

Hewlett-Packard ACLM.NET v1.2.0.0

Hoyle Card Games

HP 3D DriveGuard

HP Connected Music (Meridian - installer)

HP CoolSense

HP Customer Experience Enhancements

HP Documentation

HP Games

HP MyRoom

HP Postscript Converter

HP Quick Launch

HP Recovery Manager

HP Registration Service

HP Software Framework

HP Support Assistant

HP Utility Center

HP Wireless Button Driver

IDT Audio

iTunes

Jewel Match 3

John Deere Drive Green

Letters from Nowhere 2

Luxor Evolved

Machete Lite 3.8

Mahjongg Dimensions Deluxe: Tiles in Time

Memeo AutoSync

Memeo Instant Backup

Microsoft Application Error Reporting

Microsoft Office

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (English) 2007

Microsoft Office Home and Student 2007

Microsoft Office Office 64-bit Components 2007

Microsoft Office OneNote MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared 64-bit MUI (English) 2007

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319

Mozilla Firefox 20.0 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

Norton 360

Norton Identity Safe

Peggle Nights

Penguins!

Polar Bowler

Polar Golfer

QuickTime

Ralink Bluetooth Stack64

Ralink RT3290 802.11bgn Wi-Fi Adapter

Realtek Ethernet Controller Driver

Realtek PCIE Card Reader

Roads of Rome 3

Seagate Dashboard

Search Protect by conduit

Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2687499) 32-Bit Edition

Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition

Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition

Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition

Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition

Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition

Speed Test Analysis

swMSM

Synaptics Pointing Device Driver

The Treasures of Mystery Island: The Ghost Ship

TouchFreeze

Trinklit Supreme

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update Installer for WildTangent Games App

VLC media player 2.0.5

WildTangent Games

WildTangent Games App

Windows Live

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Language Selector

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Zuma's Revenge

.

==== Event Viewer Messages From Past Week ========

.

2013-05-23 8:30:02 PM, Error: cdrom [15] - The device, \Device\CdRom0, is not ready for access yet.

.

==== End Of File ===========================

gringo_pr · May 26, 2013

Hello historybuff77

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
[*]Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
[*]Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
[*]Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Delete.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner[s1].txt as well.

-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

When they are complete let me have the two reports and let me know how things are running.

Gringo

historybuff77 · May 26, 2013

Hi Gringo,

Thanks for your help. Here are my logs:

# AdwCleaner v2.301 - Logfile created 05/26/2013 at 11:35:16

# Updated 16/05/2013 by Xplode

# Operating system : Windows 8 (64 bits)

# User : User - LAPTOP-PC

# Boot Mode : Normal

# Running from : C:\Users\User\Desktop\AdwCleaner (1).exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\END

***** [Registry] *****

Key Deleted : HKCU\Software\AppDataLow\Software\Conduit

Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar

Key Deleted : HKCU\Software\Conduit

Key Deleted : HKCU\Software\SearchProtect

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKLM\SOFTWARE\Classes\AppID\PropertySync.EXE

Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3287823

Key Deleted : HKLM\Software\Conduit

Key Deleted : HKLM\Software\SearchProtect

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}

Key Deleted : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16537

[OK] Registry is clean.

-\\ Mozilla Firefox v20.0 (en-US)

-\\ Google Chrome v27.0.1453.94

*************************

AdwCleaner[R1].txt - [1424 octets] - [31/03/2013 15:57:11]

AdwCleaner[R2].txt - [771 octets] - [01/04/2013 11:57:50]

AdwCleaner[R3].txt - [830 octets] - [01/04/2013 13:44:01]

AdwCleaner[R4].txt - [986 octets] - [09/04/2013 23:34:07]

AdwCleaner[R5].txt - [2141 octets] - [21/04/2013 23:08:54]

AdwCleaner[R6].txt - [1788 octets] - [26/05/2013 11:33:24]

AdwCleaner[s1].txt - [1350 octets] - [31/03/2013 15:58:13]

AdwCleaner[s2].txt - [889 octets] - [01/04/2013 13:45:05]

AdwCleaner[s3].txt - [1045 octets] - [09/04/2013 23:34:28]

AdwCleaner[s4].txt - [1743 octets] - [26/05/2013 11:35:16]

########## EOF - C:\AdwCleaner[s4].txt - [1803 octets] ##########

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 8 x64

Ran by User on 2013-05-26 at 11:42:22.85

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{ECD5D19E-F577-4A6F-9DF0-BC36C80A769F}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{ECD5D19E-F577-4A6F-9DF0-BC36C80A769F}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\User\appdata\locallow\conduit"

~~~ FireFox

Successfully deleted: [Folder] C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\ei4gauue.default\smartbar

Successfully deleted: [Registry Value] HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\\speedtestanalysis@speedanalysis.com

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions\\speedtestanalysis@speedanalysis.com

Successfully deleted the following from C:\Users\User\AppData\Roaming\mozilla\firefox\profiles\ei4gauue.default\prefs.js

user_pref("CT3287823.1000082.isPlayDisplay", "true");

user_pref("CT3287823.1000082.state", "{\"state\":\"stopped\",\"text\":\"Californi...\",\"description\":\"California Rock - Rock\",\"url\":\"hxxp://www.feedlive.net/california.

user_pref("CT3287823.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT3287823.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT3287823.FF19Solved", "true");

user_pref("CT3287823.FirstTime", "true");

user_pref("CT3287823.FirstTimeFF3", "true");

user_pref("CT3287823.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3287823&SearchSource=2&CUI=UN21880024042243823&UM=2&q=");

user_pref("CT3287823.TopHitsConfig.enc", "ew0KICAgICJzcHJpdGVVcmwiOiAiaHR0cDovL3N0b3JhZ2UuY29uZHVpdC5jb20vcHMvVG9wSGl0c0dlbmVyaWNBcHAvY29uZmlncy9VUy1VSy1EYW5jZS1Sb2NrLVJhcC9zc

user_pref("CT3287823.UserID", "UN21880024042243823");

user_pref("CT3287823.YTbyClickFavorites.enc", "W10=");

user_pref("CT3287823.YTbyClickRecent.enc", "W10=");

user_pref("CT3287823.addressBarTakeOverEnabledInHidden", "true");

user_pref("CT3287823.autoDisableScopes", -1);

user_pref("CT3287823.browser.search.defaultthis.engineName", "true");

user_pref("CT3287823.defaultSearch", "true");

user_pref("CT3287823.embeddedsData", "[{\"appId\":\"130058557034802204\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"get

user_pref("CT3287823.enableAlerts", "true");

user_pref("CT3287823.enableFix404ByUser", "TRUE");

user_pref("CT3287823.enableSearchFromAddressBar", "true");

user_pref("CT3287823.firstTimeDialogOpened", "true");

user_pref("CT3287823.fixPageNotFoundError", "true");

user_pref("CT3287823.fixPageNotFoundErrorByUser", "true");

user_pref("CT3287823.fixPageNotFoundErrorInHidden", "true");

user_pref("CT3287823.fixUrls", true);

user_pref("CT3287823.installDate", "21/4/2013 12:20:59");

user_pref("CT3287823.installId", "aaa_cid159_87");

user_pref("CT3287823.installSessionId", "{13CE1994-6E8D-4470-8B21-F0E729BF73CC}");

user_pref("CT3287823.installSp", "TRUE");

user_pref("CT3287823.installType", "conduitnsisintegration");

user_pref("CT3287823.installUsage", "2013-04-22T03:45:10.0145328+03:00");

user_pref("CT3287823.installUsageEarly", "2013-04-22T03:45:08.0926209+03:00");

user_pref("CT3287823.installerVersion", "1.4.1.3");

user_pref("CT3287823.isCheckedStartAsHidden", true);

user_pref("CT3287823.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT3287823.isFirstTimeToolbarLoading", "false");

user_pref("CT3287823.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}");

user_pref("CT3287823.keyword", "true");

user_pref("CT3287823.lastNewTabSettings", "{\"isEnabled\":false,\"newTabUrl\":\"hxxp://search.conduit.com/?ctid=CT3287823&octid=CT3287823&SearchSource=15&CUI=UN218800240422438

user_pref("CT3287823.lastVersion", "10.15.2.23");

user_pref("CT3287823.mam_gk_appStateReportTime.enc", "MTM2NjU5MTUxODg4Mg==");

user_pref("CT3287823.mam_gk_appState_CouponBuddy.enc", "b24=");

user_pref("CT3287823.mam_gk_appState_Easytobook.enc", "b24=");

user_pref("CT3287823.mam_gk_appState_Easytobook_targeted.enc", "b24=");

user_pref("CT3287823.mam_gk_appState_PriceGong.enc", "b24=");

user_pref("CT3287823.mam_gk_appState_WindowShopper.enc", "b24=");

user_pref("CT3287823.mam_gk_appsData.enc", "eyJhcHBzIjpbeyJpZCI6IlByaWNlR29uZyIsInVybCI6Imh0dHA6Ly9wcmljZWdvbmcuY29uZHVpdGFwcHMuY29tL01BTS92MS9odG1sX2NvbXAuaHRtbCIsIm9wdGlvbnN

user_pref("CT3287823.mam_gk_appsDefaultEnabled.enc", "dHJ1ZQ==");

user_pref("CT3287823.mam_gk_configuration.enc", "eyJjb25maWd1cmF0aW9uIjpbeyJpZCI6IldpbmRvd1Nob3BwZXIiLCJjcml0ZXJpYXMiOlt7ImNyaXRlcmlhSWQiOiI2MTkzOWRmZS03OTg4LTQ1NTEtOGM1NC03Mz

user_pref("CT3287823.mam_gk_currentVersion.enc", "MS40LjQuNg==");

user_pref("CT3287823.mam_gk_first_time.enc", "MQ==");

user_pref("CT3287823.mam_gk_gadgetOpen.enc", "d2VsY29tZQ==");

user_pref("CT3287823.mam_gk_installer_preapproved.enc", "ZmFsc2U=");

user_pref("CT3287823.mam_gk_lastLoginTime.enc", "MTM2NjU5MTUxNDkxNg==");

user_pref("CT3287823.mam_gk_localization.enc", "eyJnYWRnZXRDb250ZW50UG9saWN5Ijp7IlRleHQiOiJDb250ZW50IFBvbGljeSJ9LCJnYWRnZXREZXNjcmlwdGlvblByaW1hcnkiOnsiVGV4dCI6IlZhbHVlIEFwcHM

user_pref("CT3287823.mam_gk_pgUnloadedOnce.enc", "dHJ1ZQ==");

user_pref("CT3287823.mam_gk_settings1.4.4.6.enc", "eyJTdGF0dXMiOiJzdWNjZWVkZWQiLCJEYXRhIjp7ImludGVydmFsIjoyNDAsInN0YW1wIjoiNjFfLTEiLCJpc1Rlc3QiOmZhbHNlLCJpc1dlbGNvbWVFeHBlcmll

user_pref("CT3287823.mam_gk_showCloseButton.enc", "dHJ1ZQ==");

user_pref("CT3287823.mam_gk_showWelcomeGadget.enc", "dHJ1ZQ==");

user_pref("CT3287823.mam_gk_userId.enc", "YWM4NWU3ZjItZjQyYi00OTQ3LTkwZGMtNGIyODBmYzVjYzky");

user_pref("CT3287823.migrateAppsAndComponents", true);

user_pref("CT3287823.navigationAliasesJson", "{\"EB_SEARCH_TERM\":\"\",\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fsearch.conduit.com%2F%3Fctid%3DCT3287823%26octid%3DCT3287823%26Sear

user_pref("CT3287823.openThankYouPage", "false");

user_pref("CT3287823.openUninstallPage", "true");

user_pref("CT3287823.revertSettingsEnabled", "false");

user_pref("CT3287823.search.searchAppId", "130058557034802204");

user_pref("CT3287823.search.searchCount", "0");

user_pref("CT3287823.searchFromAddressBarEnabledByUser", "true");

user_pref("CT3287823.searchInNewTabEnabledByUser", "true");

user_pref("CT3287823.searchInNewTabEnabledInHidden", "true");

user_pref("CT3287823.searchRevert", "false");

user_pref("CT3287823.searchUserMode", "2");

user_pref("CT3287823.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT3287823.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}");

user_pref("CT3287823.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"2\"}");

user_pref("CT3287823.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3287823\"}");

user_pref("CT3287823.serviceLayer_service_toolbarGrouping_activeDownloadUrl", "{\"dataType\":\"string\",\"data\":\"hxxp://MixiDJV9.OurToolbar.com//xpi\"}");

user_pref("CT3287823.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"MixiDJ V9\"}");

user_pref("CT3287823.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}");

user_pref("CT3287823.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1366591511913");

user_pref("CT3287823.serviceLayer_services_appsMetadata_lastUpdate", "1366591509892");

user_pref("CT3287823.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1366591510098");

user_pref("CT3287823.serviceLayer_services_installUsage_ToolbarInstallEarly_lastUpdate", "1366591508092");

user_pref("CT3287823.serviceLayer_services_installUsage_ToolbarInstall_lastUpdate", "1366591509762");

user_pref("CT3287823.serviceLayer_services_location_lastUpdate", "1366591507747");

user_pref("CT3287823.serviceLayer_services_login_10.15.2.23_lastUpdate", "1366591511861");

user_pref("CT3287823.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1366591510054");

user_pref("CT3287823.serviceLayer_services_searchAPI_lastUpdate", "1366591507928");

user_pref("CT3287823.serviceLayer_services_serviceMap_lastUpdate", "1366591507039");

user_pref("CT3287823.serviceLayer_services_toolbarContextMenu_lastUpdate", "1366591510142");

user_pref("CT3287823.serviceLayer_services_toolbarSettings_lastUpdate", "1366591508374");

user_pref("CT3287823.serviceLayer_services_translation_lastUpdate", "1366591512129");

user_pref("CT3287823.settingsINI", true);

user_pref("CT3287823.shouldFirstTimeDialog", "false");

user_pref("CT3287823.showToolbarPermission", "false");

user_pref("CT3287823.smartbar.CTID", "CT3287823");

user_pref("CT3287823.smartbar.Uninstall", "0");

user_pref("CT3287823.smartbar.homepage", "true");

user_pref("CT3287823.smartbar.toolbarName", "MixiDJ V9 ");

user_pref("CT3287823.startPage", "true");

user_pref("CT3287823.toolbarBornServerTime", "22-4-2013");

user_pref("CT3287823.toolbarCurrentServerTime", "22-4-2013");

user_pref("CT3287823.toolbarLoginClientTime", "Sun Apr 21 2013 20:45:11 GMT-0400 (Eastern Daylight Time)");

user_pref("CT3287823.versionFromInstaller", "10.15.2.23");

user_pref("CT3287823_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1366591499766,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}

user_pref("Smartbar.ConduitHomepagesList", "hxxp://search.conduit.com/?ctid=CT3287823&octid=CT3287823&SearchSource=61&CUI=UN21880024042243823&UM=2&UP=SPA5937323-AD3E-4253-9C99

user_pref("Smartbar.ConduitSearchEngineList", "MixiDJ V9 Customized Web Search");

user_pref("Smartbar.ConduitSearchUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3287823&SearchSource=2&CUI=UN21880024042243823&UM=2&q=");

user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");

user_pref("Smartbar.keywordURLSelectedCTID", "CT3287823");

user_pref("smartbar.conduitHomepageList", "hxxp://search.conduit.com/?ctid=CT3287823&CUI=UN21880024042243823&UM=2&SearchSource=13,hxxp://search.conduit.com/?ctid=CT3287823&oct

user_pref("smartbar.conduitSearchAddressUrlList", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3287823&SearchSource=2&CUI=UN21880024042243823&UM=2&q=");

user_pref("smartbar.machineId", "3PFCA1ANHHJRWXN7BMZGBX5HK8HPAAYYZBAJDVDUPA0Q2MDNEFU09TKSWWRKMZG551C3BABDKOGMUNPUU3ITJW");

user_pref("smartbar.originalHomepage", "about:home");

user_pref("smartbar.originalSearchAddressUrl", "");

user_pref("smartbar.originalSearchEngine", "");

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on 2013-05-26 at 11:47:01.89

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

gringo_pr · May 26, 2013

Hello historybuff77

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.

When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

historybuff77 · May 26, 2013

Hi Gringo,

Combofix won't run on Windows 8. Is there another option?

Thanks!

gringo_pr · May 26, 2013

Hello historybuff77

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Gringo

historybuff77 · May 27, 2013

Hi Gringo,

Windows Smart screen is blocking me from running that app. I tried running as administrator but it wouldn't work either. Do I need to do anything like turning off my anti-virus program before running it?

Thank you.

historybuff77 · May 27, 2013

Whoops, never mind. I figured it out. Here are my logs:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-05-2013 04

Ran by User (administrator) on 26-05-2013 21:26:56

Running from C:\Users\User\Desktop

Windows 8 (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

(Memeo) C:\Program Files (x86)\Seagate\Seagate Dashboard\SeagateDashboardService.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\ccSvcHst.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe

(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\ccSvcHst.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Memeo) C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoDashboard.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Axentra Corporation) C:\Program Files (x86)\Seagate\Seagate Dashboard\HipServAgent\HipServAgent.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(Farbar) C:\Users\User\Desktop\FRST64.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-07-21] (IDT, Inc.)

HKLM\...\Run: [synTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-24] (Synaptics Incorporated)

HKLM-x32\...\Run: [btTray] "C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe" [363520 2012-08-02] (IVT Corporation)

HKLM-x32\...\Run: [HP CoolSense] C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe -byrunkey [1342008 2011-08-26] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [seagate Dashboard] C:\Program Files (x86)\Seagate\Seagate Dashboard\MemeoLauncher.exe --silent --no_ui [79776 2012-10-15] ()

HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-04-21] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-05-15] (Apple Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPCON13/4

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/706-156705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKLM - {ECD5D19E-F577-4A6F-9DF0-BC36C80A769F} URL = http://www.amazon.ca/s/ref=azs_osd_ieaca?ie=UTF-8&tag=hp-ca2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/706-156705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/706-156705-11896-0/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: Speed Test Analysis - {310D38FE-EB4C-467C-8781-B7C2AEB7847D} - C:\Program Files (x86)\Speed Test Analysis\ScriptHost.dll (SpeedAnalysis.com)

BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\coIEPlg.dll (Symantec Corporation)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Winsock: Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [21504] (Microsoft Corporation)

Winsock: Catalog5-x64 07 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:

========

FF ProfilePath: C:\Users\User\AppData\Roaming\Mozilla\Firefox\Profiles\ei4gauue.default

FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");

FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf - C:\PROGRAM FILES (X86)\FOXIT SOFTWARE\FOXIT READER\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 - C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()

Chrome:

=======

CHR Extension: (Google Docs) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0

CHR Extension: (Google Drive) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0

CHR Extension: (YouTube) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0

CHR Extension: (Google Search) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0

CHR Extension: (Speed Test Analysis) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\kckgnnipheglejoddfhekdjpbdbinhmb\1.0.0.0_0

CHR Extension: (Norton Identity Protection) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.3.3.19_0

CHR Extension: (Gmail) - C:\Users\User\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-08-08] (Advanced Micro Devices, Inc.)

R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1544192 2012-08-02] (IVT Corporation)

R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [138752 2012-07-10] (IVT Corporation)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 N360; C:\Program Files (x86)\Norton 360\Engine\20.3.1.22\diMaster.dll [554288 2013-03-29] (Symantec Corporation)

R2 NCO; C:\Program Files (x86)\Norton Identity Safe\Engine\2013.3.3.19\diMaster.dll [554288 2013-03-29] (Symantec Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [14920 2013-01-28] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [199008 2012-06-23] (AppEx Networks Corporation)

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98472 2012-07-18] (Advanced Micro Devices)

R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\BASHDefs\20130515.001\BHDrvx64.sys [1390680 2013-04-12] (Symantec Corporation)

R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)

U4 BthAvrcpTg;

U4 BthHFEnum;

U4 bthhfhid;

R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [56904 2012-07-19] (Ralink Corporation)

R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)

R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [48736 2012-08-09] (Ralink Corporation)

R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [92536 2012-06-25] (CyberLink)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows ® Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows ® Win 7 DDK provider)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2013-04-25] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2013-04-25] (Symantec Corporation)

R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\IPSDefs\20130524.001\IDSvia64.sys [513184 2013-04-24] (Symantec Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\VirusDefs\20130525.006\ENG64.SYS [126040 2013-05-23] (Symantec Corporation)

R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.3.1.22\Definitions\VirusDefs\20130525.006\EX64.SYS [2098776 2013-05-23] (Symantec Corporation)

R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [269968 2012-07-03] (Realtek Semiconductor Corp.)

R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [695392 2012-08-09] (Ralink Technology, Corp.)

S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [41272 2012-08-24] (Synaptics Incorporated)

S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [43832 2012-08-24] (Synaptics Incorporated)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-04-25] (Symantec Corporation)

R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20288 2012-08-03] (Hewlett-Packard Development Company, L.P.)

S3 WUDFWpdMtp; C:\Windows\system32\DRIVERS\WUDFRd.sys [198656 2012-07-25] (Microsoft Corporation)

R1 ccSet_N360; \SystemRoot\system32\drivers\N360x64\1403010.016\ccSetx64.sys [x]

R1 ccSet_NST; \SystemRoot\system32\drivers\NSTx64\7DD03030.013\ccSetx64.sys [x]

R3 SRTSP; \SystemRoot\system32\drivers\N360x64\1403010.016\SRTSP64.SYS [x]

R1 SRTSPX; \SystemRoot\system32\drivers\N360x64\1403010.016\SRTSPX64.SYS [x]

R0 SymDS; system32\drivers\N360x64\1403010.016\SYMDS64.SYS [x]

R0 SymEFA; system32\drivers\N360x64\1403010.016\SYMEFA64.SYS [x]

S0 SymELAM; system32\drivers\N360x64\1403010.016\SymELAM.sys [x]

R1 SymIRON; \SystemRoot\system32\drivers\N360x64\1403010.016\Ironx64.SYS [x]

R1 SymNetS; \SystemRoot\system32\drivers\N360x64\1403010.016\SYMNETS.SYS [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-26 21:26 - 2013-05-26 21:26 - 00000000 ____D C:\FRST

2013-05-26 21:20 - 2013-05-26 21:20 - 01915390 ____A (Farbar) C:\Users\User\Desktop\FRST64.exe

2013-05-26 16:31 - 2013-05-26 16:31 - 05071432 ____A (Swearware) C:\Users\User\Desktop\ComboFix.exe

2013-05-26 11:47 - 2013-05-26 11:47 - 00011150 ____A C:\Users\User\Desktop\JRT.txt

2013-05-26 11:42 - 2013-05-26 11:42 - 00000000 ____D C:\Windows\ERUNT

2013-05-26 11:41 - 2013-05-26 11:41 - 00000000 ____D C:\JRT

2013-05-26 11:35 - 2013-05-26 11:35 - 00001872 ____A C:\AdwCleaner[s4].txt

2013-05-26 11:34 - 2013-05-26 11:34 - 00001788 ____A C:\Users\User\Desktop\AdwCleaner[R6].txt

2013-05-26 11:33 - 2013-05-26 11:33 - 00001788 ____A C:\AdwCleaner[R6].txt

2013-05-26 11:32 - 2013-05-26 11:32 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\User\Desktop\JRT.exe

2013-05-26 11:31 - 2013-05-26 11:31 - 00632031 ____A C:\Users\User\Desktop\AdwCleaner (1).exe

2013-05-25 22:45 - 2013-05-25 22:45 - 00001109 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-05-25 22:45 - 2013-05-25 22:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-05-25 22:45 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys

2013-05-25 22:42 - 2013-05-25 22:43 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\User\Desktop\mbam-setup-1.75.0.1300 (1).exe

2013-05-25 22:27 - 2013-05-25 22:27 - 00688992 ____R (Swearware) C:\Users\User\Desktop\dds (1).com

2013-05-25 22:27 - 2013-05-25 22:27 - 00688992 ____A (Swearware) C:\Users\User\Downloads\dds.com

2013-05-25 09:47 - 2013-05-25 09:47 - 00015591 ____A C:\Users\User\Downloads\Rachel Cere 0313354 Essay Proposal.odt

2013-05-19 21:07 - 2013-05-19 21:07 - 00015636 ____A C:\Users\User\Downloads\Editorial Board Meeting.zip

2013-05-17 08:12 - 2013-05-17 08:12 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk

2013-05-17 08:11 - 2013-05-17 08:12 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-05-17 08:11 - 2013-05-17 08:11 - 00000000 ____D C:\Program Files\iTunes

2013-05-17 08:11 - 2013-05-17 08:11 - 00000000 ____D C:\Program Files\iPod

2013-05-17 08:11 - 2013-05-17 08:11 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-05-09 15:30 - 2013-05-09 15:30 - 06128802 ____A C:\Users\User\Downloads\Annual Report.zip

2013-05-05 02:54 - 2013-05-05 02:54 - 00001230 ____A C:\Users\User\Desktop\RKreport[4]_S_05052013_02d0254.txt

2013-05-01 20:47 - 2013-05-01 20:47 - 00010756 ____A C:\Users\User\Downloads\Presenters and CCIH staff.xlsx

2013-05-01 13:44 - 2013-05-01 13:44 - 00001193 ____A C:\Users\User\Desktop\RKreport[3]_S_05012013_02d1344.txt

2013-04-28 22:44 - 2013-04-28 22:44 - 04829104 ____A (F-Secure Corporation) C:\Users\User\Downloads\F-SecureOnlineScanner(1).exe

2013-04-28 22:40 - 2013-04-28 22:40 - 00659968 ____A C:\Users\User\Downloads\MicrosoftFixit50195.msi

==================== One Month Modified Files and Folders =======

2013-05-26 21:26 - 2013-05-26 21:26 - 00000000 ____D C:\FRST

2013-05-26 21:23 - 2012-12-30 11:08 - 00000914 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-05-26 21:22 - 2012-08-10 21:45 - 00000821 ____A C:\Windows\SysWOW64\bscs.ini

2013-05-26 21:21 - 2012-07-26 04:12 - 00000000 ____D C:\Windows\System32\sru

2013-05-26 21:20 - 2013-05-26 21:20 - 01915390 ____A (Farbar) C:\Users\User\Desktop\FRST64.exe

2013-05-26 21:19 - 2012-11-21 00:34 - 00004524 ____A C:\Windows\SysWOW64\LOCALSERVICE.INI

2013-05-26 21:19 - 2012-11-21 00:34 - 00000043 ____A C:\Windows\SysWOW64\LOCALDEVICE.INI

2013-05-26 16:31 - 2013-05-26 16:31 - 05071432 ____A (Swearware) C:\Users\User\Desktop\ComboFix.exe

2013-05-26 11:47 - 2013-05-26 11:47 - 00011150 ____A C:\Users\User\Desktop\JRT.txt

2013-05-26 11:42 - 2013-05-26 11:42 - 00000000 ____D C:\Windows\ERUNT

2013-05-26 11:41 - 2013-05-26 11:41 - 00000000 ____D C:\JRT

2013-05-26 11:38 - 2012-07-26 01:26 - 00262144 __ASH C:\Windows\System32\config\ELAM

2013-05-26 11:37 - 2013-04-14 21:29 - 00000348 ____A C:\Windows\Tasks\HPCeeScheduleForUser.job

2013-05-26 11:37 - 2012-12-30 11:08 - 00000910 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-05-26 11:37 - 2012-07-26 03:22 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-05-26 11:36 - 2012-07-26 01:26 - 00262144 __ASH C:\Windows\System32\config\BBI

2013-05-26 11:35 - 2013-05-26 11:35 - 00001872 ____A C:\AdwCleaner[s4].txt

2013-05-26 11:34 - 2013-05-26 11:34 - 00001788 ____A C:\Users\User\Desktop\AdwCleaner[R6].txt

2013-05-26 11:33 - 2013-05-26 11:33 - 00001788 ____A C:\AdwCleaner[R6].txt

2013-05-26 11:32 - 2013-05-26 11:32 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\User\Desktop\JRT.exe

2013-05-26 11:31 - 2013-05-26 11:31 - 00632031 ____A C:\Users\User\Desktop\AdwCleaner (1).exe

2013-05-25 22:45 - 2013-05-25 22:45 - 00001109 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2013-05-25 22:45 - 2013-05-25 22:45 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware

2013-05-25 22:44 - 2013-04-21 22:49 - 00018373 ____A C:\Users\User\Desktop\dds.txt

2013-05-25 22:44 - 2013-04-21 22:49 - 00007523 ____A C:\Users\User\Desktop\attach.txt

2013-05-25 22:43 - 2013-05-25 22:42 - 10285040 ____A (Malwarebytes Corporation ) C:\Users\User\Desktop\mbam-setup-1.75.0.1300 (1).exe

2013-05-25 22:27 - 2013-05-25 22:27 - 00688992 ____R (Swearware) C:\Users\User\Desktop\dds (1).com

2013-05-25 22:27 - 2013-05-25 22:27 - 00688992 ____A (Swearware) C:\Users\User\Downloads\dds.com

2013-05-25 09:47 - 2013-05-25 09:47 - 00015591 ____A C:\Users\User\Downloads\Rachel Cere 0313354 Essay Proposal.odt

2013-05-24 15:23 - 2013-04-23 08:48 - 00002183 ____A C:\Users\Public\Desktop\Google Chrome.lnk

2013-05-20 20:45 - 2012-08-25 15:38 - 00877348 ____A C:\Windows\System32\perfh00C.dat

2013-05-20 20:45 - 2012-08-25 15:38 - 00191806 ____A C:\Windows\System32\perfc00C.dat

2013-05-20 20:45 - 2012-07-26 03:28 - 01994298 ____A C:\Windows\System32\PerfStringBackup.INI

2013-05-19 21:36 - 2012-12-30 23:10 - 00000052 ____A C:\Windows\SysWOW64\DOErrors.log

2013-05-19 21:36 - 2012-12-30 23:10 - 00000000 ____A C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt

2013-05-19 21:07 - 2013-05-19 21:07 - 00015636 ____A C:\Users\User\Downloads\Editorial Board Meeting.zip

2013-05-18 22:03 - 2012-12-30 01:28 - 00000000 ____D C:\Users\User\AppData\Roaming\vlc

2013-05-18 20:25 - 2013-02-19 18:29 - 00000000 ____D C:\Users\User\AppData\Roaming\dvdcss

2013-05-17 08:12 - 2013-05-17 08:12 - 00001783 ____A C:\Users\Public\Desktop\iTunes.lnk

2013-05-17 08:12 - 2013-05-17 08:11 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2013-05-17 08:11 - 2013-05-17 08:11 - 00000000 ____D C:\Program Files\iTunes

2013-05-17 08:11 - 2013-05-17 08:11 - 00000000 ____D C:\Program Files\iPod

2013-05-17 08:11 - 2013-05-17 08:11 - 00000000 ____D C:\Program Files (x86)\iTunes

2013-05-16 22:55 - 2012-07-26 04:12 - 00000000 ____D C:\Windows\System32\NDF

2013-05-09 15:30 - 2013-05-09 15:30 - 06128802 ____A C:\Users\User\Downloads\Annual Report.zip

2013-05-05 02:54 - 2013-05-05 02:54 - 00001230 ____A C:\Users\User\Desktop\RKreport[4]_S_05052013_02d0254.txt

2013-05-03 18:51 - 2013-01-03 17:44 - 00000000 ____D C:\Users\User\AppData\Local\CrashDumps

2013-05-01 20:47 - 2013-05-01 20:47 - 00010756 ____A C:\Users\User\Downloads\Presenters and CCIH staff.xlsx

2013-05-01 13:44 - 2013-05-01 13:44 - 00001193 ____A C:\Users\User\Desktop\RKreport[3]_S_05012013_02d1344.txt

2013-04-29 16:18 - 2013-04-25 17:22 - 00000000 ____D C:\Users\User\Desktop\pics from show

2013-04-28 22:44 - 2013-04-28 22:44 - 04829104 ____A (F-Secure Corporation) C:\Users\User\Downloads\F-SecureOnlineScanner(1).exe

2013-04-28 22:40 - 2013-04-28 22:40 - 00659968 ____A C:\Users\User\Downloads\MicrosoftFixit50195.msi

2013-04-27 18:35 - 2013-03-28 21:57 - 00000000 ____D C:\Windows\Minidump

2013-04-27 13:24 - 2013-01-05 16:19 - 00077136 ____A C:\Users\User\AppData\Local\GDIPFONTCACHEV1.DAT

2013-04-26 13:21 - 2013-04-03 22:39 - 00000000 ____D C:\Users\User\Desktop\backups

2013-04-26 09:11 - 2012-07-26 04:12 - 00000000 ____D C:\Windows\AUInstallAgent

Other Malware:

===========

C:\ProgramData\ntuser.dat

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

Last Boot: 2013-05-22 12:40

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-05-2013 04

Ran by User at 2013-05-26 21:27:30 Run:

Running from C:\Users\User\Desktop

Boot Mode: Normal

==========================================================

==================== Installed Programs =======================

4 Elements II (Version: 2.2.0.98)

7 Wonders II (Version: 2.2.0.98)

Adobe Shockwave Player 11.6 (Version: 11.6.5.635)

Aloha TriPeaks (Version: 2.2.0.98)

AMD Accelerated Video Transcoding (Version: 12.5.100.20808)

AMD APP SDK Runtime (Version: 10.0.938.2)

AMD Catalyst Install Manager (Version: 8.0.881.0)

AMD Fuel (Version: 2012.0808.1024.16666)

AMD Quick Stream (Version: 3.3.26.0)

AMD VISION Engine Control Center (Version: 2012.0808.1024.16666)

Apple Application Support (Version: 2.3.4)

Apple Mobile Device Support (Version: 6.1.0.13)

Apple Software Update (Version: 2.1.3.127)

Bejeweled 3 (Version: 2.2.0.98)

Bonjour (Version: 3.0.0.10)

Build-a-lot 4 - Power Source (Version: 2.2.0.98)

Catalyst Control Center - Branding (Version: 1.00.0000)

Catalyst Control Center Graphics Previews Common (Version: 2012.0808.1024.16666)

Catalyst Control Center InstallProxy (Version: 2012.0808.1024.16666)

Catalyst Control Center Localization All (Version: 2012.0808.1024.16666)

CCC Help Chinese Standard (Version: 2012.0808.1023.16666)

CCC Help Chinese Traditional (Version: 2012.0808.1023.16666)

CCC Help Czech (Version: 2012.0808.1023.16666)

CCC Help Danish (Version: 2012.0808.1023.16666)

CCC Help Dutch (Version: 2012.0808.1023.16666)

CCC Help English (Version: 2012.0808.1023.16666)

CCC Help Finnish (Version: 2012.0808.1023.16666)

CCC Help French (Version: 2012.0808.1023.16666)

CCC Help German (Version: 2012.0808.1023.16666)

CCC Help Greek (Version: 2012.0808.1023.16666)

CCC Help Hungarian (Version: 2012.0808.1023.16666)

CCC Help Italian (Version: 2012.0808.1023.16666)

CCC Help Japanese (Version: 2012.0808.1023.16666)

CCC Help Korean (Version: 2012.0808.1023.16666)

CCC Help Norwegian (Version: 2012.0808.1023.16666)

CCC Help Polish (Version: 2012.0808.1023.16666)

CCC Help Portuguese (Version: 2012.0808.1023.16666)

CCC Help Russian (Version: 2012.0808.1023.16666)

CCC Help Spanish (Version: 2012.0808.1023.16666)

CCC Help Swedish (Version: 2012.0808.1023.16666)

CCC Help Thai (Version: 2012.0808.1023.16666)

CCC Help Turkish (Version: 2012.0808.1023.16666)

ccc-utility64 (Version: 2012.0808.1024.16666)

CCleaner (Version: 3.28)

Chuzzle Deluxe (Version: 2.2.0.95)

Cradle of Rome 2 (Version: 2.2.0.98)

Crazy Chicken Soccer (Version: 2.2.0.98)

CyberLink LabelPrint (Version: 2.5.1.5407)

CyberLink Media Suite 10 (Version: 10.0.1.1916)

CyberLink PhotoDirector (Version: 2.0.1.3119)

CyberLink Power2Go 8 (Version: 8.0.1.1926)

CyberLink PowerDirector 10 (Version: 10.0.1.1925)

CyberLink PowerDVD (Version: 10.0.6.4319)

CyberLink YouCam (Version: 3.5.4.5527)

D3DX10 (Version: 15.4.2368.0902)

Energy Star (Version: 1.0.8)

Farm Frenzy (Version: 2.2.0.98)

Final Drive Fury (Version: 2.2.0.95)

FlatOut 2 (Version: 2.2.0.98)

Foxit Reader (Version: 5.4.5.124)

Galerie de photos Windows Live (Version: 15.4.3502.0922)

Google Chrome (Version: 27.0.1453.94)

Google Toolbar for Internet Explorer (Version: 1.0.0)

Google Toolbar for Internet Explorer (Version: 7.4.3607.2246)

Google Update Helper (Version: 1.3.21.145)

Governor of Poker 2 Premium Edition (Version: 2.2.0.95)

Hewlett-Packard ACLM.NET v1.2.0.0 (Version: 1.00.0000)

Hoyle Card Games (Version: 2.2.0.95)

HP 3D DriveGuard (Version: 4.2.5.1)

HP Connected Music (Meridian - installer) (Version: v1.0)

HP CoolSense (Version: 2.10.3)

HP Customer Experience Enhancements (Version: 6.0.1.7)

HP Documentation (Version: 1.1.0.0)

HP Games (Version: 1.0.3.0)

HP MyRoom (Version: 9.0.0.0)

HP Postscript Converter (Version: 3.1.3554)

HP Quick Launch (Version: 3.0.3)

HP Recovery Manager (Version: 7.00)

HP Registration Service (Version: 1.0.5976.4186)

HP Software Framework (Version: 4.6.8.1)

HP Support Assistant (Version: 7.0.32.44)

HP Utility Center (Version: 1.0.7)

HP Wireless Button Driver (Version: 1.0.5.1)

IDT Audio (Version: 1.0.6417.0)

iTunes (Version: 11.0.3.42)

Jewel Match 3 (Version: 2.2.0.98)

John Deere Drive Green (Version: 2.2.0.95)

Letters from Nowhere 2 (Version: 2.2.0.97)

Luxor Evolved (Version: 2.2.0.98)

Machete Lite 3.8 (Version: 3.8.44)

Mahjongg Dimensions Deluxe: Tiles in Time (Version: 2.2.0.98)

Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)

Memeo AutoSync

Memeo Instant Backup (Version: 4.60.0.7923)

Microsoft Application Error Reporting (Version: 12.0.6015.5000)

Microsoft Office (Version: 14.0.6120.5004)

Microsoft Office 2007 Service Pack 3 (SP3)

Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000)

Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000)

Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)

Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)

Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)

Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)

Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (Version: 9.0.21022)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (Version: 10.0.30319)

Mozilla Firefox 20.0 (x86 en-US) (Version: 20.0)

Mozilla Maintenance Service (Version: 20.0)

MSVCRT (Version: 15.4.2862.0708)

Norton 360 (Version: 20.3.1.22)

Norton Identity Safe (Version: 2013.3.3.19)

Peggle Nights (Version: 2.2.0.98)

Penguins! (Version: 2.2.0.98)

Polar Bowler (Version: 2.2.0.97)

Polar Golfer (Version: 2.2.0.98)

QuickTime (Version: 7.73.80.64)

Ralink Bluetooth Stack64 (Version: 9.0.715.0)

Ralink RT3290 802.11bgn Wi-Fi Adapter (Version: 5.0.2.0)

Realtek Ethernet Controller Driver (Version: 8.3.730.2012)

Realtek PCIE Card Reader (Version: 6.2.8400.29029)

Roads of Rome 3 (Version: 2.2.0.98)

Seagate Dashboard (Version: 1.1.0.1554)

Speed Test Analysis (Version: 1.0.0.0)

swMSM (Version: 12.0.0.1)

Synaptics Pointing Device Driver (Version: 16.2.10.12)

The Treasures of Mystery Island: The Ghost Ship (Version: 2.2.0.98)

TouchFreeze (Version: 1.1.0)

Trinklit Supreme (Version: 2.2.0.98)

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft Office 2007 Help for Common Features (KB963673)

Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition

Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition

Update for Microsoft Office Excel 2007 Help (KB963678)

Update for Microsoft Office OneNote 2007 Help (KB963670)

Update for Microsoft Office Powerpoint 2007 Help (KB963669)

Update for Microsoft Office Script Editor Help (KB963671)

Update for Microsoft Office Word 2007 Help (KB963665)

Update Installer for WildTangent Games App

VLC media player 2.0.5 (Version: 2.0.5)

WildTangent Games (Version: 1.0.3.0)

WildTangent Games App (Version: 4.0.9.6)

Windows Live (Version: 15.4.3502.0922)

Windows Live Communications Platform (Version: 15.4.3502.0922)

Windows Live Essentials (Version: 15.4.3502.0922)

Windows Live Essentials (Version: 15.4.3555.0308)

Windows Live Installer (Version: 15.4.3502.0922)

Windows Live Language Selector (Version: 15.4.3555.0308)

Windows Live Movie Maker (Version: 15.4.3502.0922)

Windows Live Photo Common (Version: 15.4.3502.0922)

Windows Live Photo Gallery (Version: 15.4.3502.0922)

Windows Live PIMT Platform (Version: 15.4.3508.1109)

Windows Live SOXE (Version: 15.4.3502.0922)

Windows Live SOXE Definitions (Version: 15.4.3502.0922)

Windows Live UX Platform (Version: 15.4.3502.0922)

Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)

Windows Live Writer (Version: 15.4.3502.0922)

Windows Live Writer Resources (Version: 15.4.3502.0922)

Zuma's Revenge (Version: 2.2.0.98)

==================== Restore Points =========================

07-05-2013 15:25:02 Scheduled Checkpoint

16-05-2013 18:12:25 Scheduled Checkpoint

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

System errors:

=============

Microsoft Office Sessions:

=========================

CodeIntegrity Errors:

===================================

Date: 2013-05-26 21:26:50.830