I'm sure there is Malware here

mccubed27388 · May 27, 2013

Hello:

Allow me to begin by saying that there was about a 2-3 day window between having Malwarebytes Trial expire and ourchasing the Pro version. That said, I've recieved the following issues:

- Yesterdy Morning, my computer did not boot properly (to black screen with cursor), but this was fixed with the option in the advanced startup menu that was similar to "Use last successful boot settings." This was a day after changing my AV from bitdefender to MSE. I uninstalled Bitdefender first, but then when I "booted with last correct settings" the MSE client wasn't functioning properly, so I uninstalled that and went to Bitdefender Free.

- I didn't have too many issues past that. Later that night, and today, my computer began to crash-

- Normally

- During a Malwarebytes Full or Quick, not flash scan

- When attempting to use Steam.

Of all of these, 2 were BSoD's and the rest freezing requireing a restart. In addition, every other boot and the files in the taskbar nd startup menu are only the black page icon. It is possible I assume that my overclock(4.4@1.27) was causinf the blue screens, but it has been running fine for about a month so far.\

I have included my Hijack this log.

Thank you so much in advanced for your doing this.

DDS:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16576

Run by Brett at 13:38:20 on 2013-05-27

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.6210 [GMT -4:00]

.

AV: Bitdefender Antivirus Free Edition *Enabled/Updated* {9B5F5313-CAF9-DD97-C460-E778420237B4}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Bitdefender Antivirus Free Edition *Enabled/Updated* {203EB2F7-ECC3-D219-FED0-DC0A39857D09}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe

C:\Windows\system32\nvvsvc.exe

C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\WLANExt.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe

C:\Program Files\Intel\iCLS Client\HeciServer.exe

C:\Windows\system32\IProsetMonitor.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

D:\Malwarebytes' Anti-Malware\mbamscheduler.exe

D:\Malwarebytes' Anti-Malware\mbamservice.exe

D:\Autodesk Inventor 2014\Inventor 2014\Moldflow\bin\mitsijm.exe

C:\Program Files (x86)\Skype\Updater\Updater.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\taskhost.exe

D:\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\Bitdefender\Antivirus Free Edition\gziface.exe

C:\Windows\system32\Dwm.exe

C:\Program Files\SmartTechnology\Software\ProfilerU.exe

C:\Program Files\SmartTechnology\Software\SaiMfd.exe

C:\Windows\system\3DG4me.exe

C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe

C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\proXPN\bin\proxpn.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\ASUS\PCE-AC66 WLAN Card Utilities\WlanMgr.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\explorer.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = about:blank

mStart Page = about:blank

uProxyOverride = <local>

mWinlogon: Userinit = userinit.exe,

BHO: DownloadTerms: {2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3} - C:\Users\Brett\AppData\Local\DownloadTerms\temp.dat

BHO: getsav-in 5.0: {452392C6-7148-4855-9E64-B5253F04883A} - C:\Users\Brett\AppData\Local\getsav-in\ie\getsav-in_1368482102.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: GetSavin 5.0: {AFC8DD71-809F-4119-AA78-D81CEC3B1F14} - C:\Users\Brett\AppData\Local\getsavin\ie\getsavin_1366933202.dll

uRun: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent

uRun: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe

dRun: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

TCP: NameServer = 10.0.0.1

TCP: Interfaces\{9C7009F5-215D-4A22-8736-15C997F03ADB} : DHCPNameServer = 10.0.0.1

TCP: Interfaces\{9C7009F5-215D-4A22-8736-15C997F03ADB}\0556E6765796E6A725F636B6D2D4F62696C65644566796365637 : DHCPNameServer = 10.0.0.1

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

AppInit_DLLs= C:\PROGRA~2\KEYCRY~1\KEYCRY~3.DLL

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\27.0.1453.94\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-mStart Page = about:blank

x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe

x64-Run: [saiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe

x64-Run: [3DG4me] C:\Windows\System\3DG4me.exe

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R0 avc3;avc3;C:\Windows\System32\drivers\avc3.sys [2013-5-26 718840]

R0 iusb3hcs;Intel® USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2013-4-24 19264]

R1 bdfwfpf;bdfwfpf;C:\Program Files\Bitdefender\Antivirus Free Edition\bdfwfpf.sys [2013-5-26 121928]

R1 gzflt;gzflt;C:\Windows\System32\drivers\gzflt.sys [2013-5-26 148696]

R2 gzserv;Bitdefender Antivirus Free Edition;C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [2013-5-26 30240]

R2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe [2013-5-15 2467664]

R2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-7-27 636952]

R2 Intel® PROSet Monitoring Service;Intel® PROSet Monitoring Service;C:\Windows\System32\IPROSetMonitor.exe [2012-6-5 190824]

R2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe [2013-4-24 164736]

R2 MBAMScheduler;MBAMScheduler;D:\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-4-24 418376]

R2 MBAMService;MBAMService;D:\Malwarebytes' Anti-Malware\mbamservice.exe [2013-4-24 701512]

R2 mitsijm2014;Autodesk Simulation Moldflow MITSI 2014 Job Manager;D:\Autodesk Inventor 2014\Inventor 2014\Moldflow\bin\mitsijm.exe [2013-1-25 952608]

R2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-2-28 161384]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-2-9 383264]

R3 avckf;avckf;C:\Windows\System32\drivers\avckf.sys [2013-5-26 593144]

R3 iusb3xhc;Intel® USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2013-4-24 789824]

R3 keycrypt;keycrypt;C:\Windows\System32\drivers\KeyCrypt64.sys [2013-4-25 25568]

R3 LVUSBS64;Logitech USB Monitor Filter;C:\Windows\System32\drivers\LVUSBS64.sys [2007-2-3 58528]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-4-24 25928]

R3 MBfilt;MBfilt;C:\Windows\System32\drivers\MBfilt64.sys [2013-4-24 32344]

R3 PcaSp60;Rawether NDIS 6.X SPR Protocol Driver;C:\Windows\System32\drivers\PcaSp60.sys [2013-4-26 38912]

R3 SaiK075C;SaiK075C;C:\Windows\System32\drivers\SaiK075C.sys [2013-4-30 181024]

R3 SaiK0CCB;SaiK0CCB;C:\Windows\System32\drivers\SaiK0CCB.sys [2012-9-20 180544]

R3 SaiU0CCB;SaiU0CCB;C:\Windows\System32\drivers\SaiU0CCB.sys [2012-9-20 47168]

R3 USBADVAU;Sennheiser 3D G4ME1 Interface;C:\Windows\System32\drivers\cm11264.sys [2013-5-3 1308160]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-7-9 104912]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-7-8 123856]

S2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2013-4-24 363904]

S3 FlexNet Licensing Service 64;FlexNet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2013-5-10 1471352]

S3 Revoflt;Revoflt;C:\Windows\System32\drivers\revoflt.sys [2013-5-25 31800]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-4-25 1255736]

.

=============== File Associations ===============

.

FileExt: .scr: DWGTrueViewScriptFile=C:\Windows\System32\notepad.exe "%1"

.

=============== Created Last 30 ================

.

2013-05-27 15:57:46 0 ----a-w- C:\Windows\System32\drivers\avchv.sys

2013-05-27 04:44:39 -------- d-----w- C:\Program Files\CCleaner

2013-05-26 18:23:28 -------- d-----w- C:\Users\Brett\AppData\Local\LogMeIn Hamachi

2013-05-26 18:23:21 -------- d-----w- C:\Program Files (x86)\LogMeIn Hamachi

2013-05-26 16:26:50 150860 ----a-w- C:\ProgramData\1369581972.bdinstall.bin

2013-05-26 15:29:35 718840 ----a-w- C:\Windows\System32\drivers\avc3.sys

2013-05-26 15:29:35 593144 ----a-w- C:\Windows\System32\drivers\avckf.sys

2013-05-26 15:26:23 350160 ----a-w- C:\Windows\System32\drivers\trufos.sys

2013-05-26 15:26:23 148696 ----a-w- C:\Windows\System32\drivers\gzflt.sys

2013-05-26 15:19:33 352292784 ----a-w- C:\Windows\System32\REGSITRYBACKUP-1.reg

2013-05-26 01:40:34 238132 ----a-w- C:\ProgramData\1369532333.bdinstall.bin

2013-05-26 01:37:27 -------- d-----w- C:\Program Files (x86)\VS Revo Group

2013-05-26 01:26:11 31800 ----a-w- C:\Windows\System32\drivers\revoflt.sys

2013-05-24 20:05:44 9460464 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4C69198C-3755-47BA-959E-425F712D6C92}\mpengine.dll

2013-05-24 02:19:06 -------- d-----w- C:\Put a directory on PYTHONPATH here

2013-05-20 21:25:10 -------- d-----w- C:\Windows\pss

2013-05-19 01:30:54 -------- d-----w- C:\Users\Brett\AppData\Roaming\TrueCrypt

2013-05-14 23:58:37 -------- d-----w- C:\Program Files (x86)\SpeedFan

2013-05-14 23:16:56 -------- d-----w- C:\Users\Brett\AppData\Roaming\Rainmeter

2013-05-14 23:10:06 -------- d-----w- C:\Program Files\Rainmeter

2013-05-14 19:33:35 983400 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys

2013-05-13 23:59:42 -------- d-----w- C:\Users\Brett\AppData\Local\SplitMediaLabs

2013-05-13 23:57:50 -------- d-----w- C:\ProgramData\SplitMediaLabs

2013-05-13 23:56:59 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2013-05-13 23:56:59 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-05-13 23:56:36 -------- d-----w- C:\Users\Brett\AppData\Roaming\SplitMediaLabs

2013-05-13 23:45:34 -------- d-----w- C:\Users\Brett\AppData\Roaming\Origin

2013-05-13 23:45:34 -------- d-----w- C:\Program Files (x86)\Origin Games

2013-05-13 23:45:28 -------- d-----w- C:\Users\Brett\AppData\Local\Origin

2013-05-13 23:44:37 -------- d-----w- C:\ProgramData\Origin

2013-05-13 23:44:37 -------- d-----w- C:\ProgramData\Electronic Arts

2013-05-13 22:07:20 -------- d-----w- C:\Program Files (x86)\ASIO4ALL v2

2013-05-13 22:07:11 1431552 ----a-w- C:\Windows\SysWow64\rewire.dll

2013-05-13 22:07:08 -------- d-----w- C:\Users\Brett\AppData\Roaming\Image-Line

2013-05-13 22:07:07 -------- d-----w- C:\Program Files\Image-Line

2013-05-13 22:07:00 1554944 ----a-w- C:\Windows\SysWow64\vorbis.acm

2013-05-13 22:06:59 -------- d-----w- C:\Users\Brett\AppData\Roaming\FlowStone

2013-05-13 22:06:58 -------- d-----w- C:\Program Files (x86)\DSPRobotics

2013-05-13 22:05:14 -------- d-----w- C:\Program Files (x86)\Image-Line

2013-05-13 21:58:14 -------- d-----w- C:\Users\Brett\AppData\Local\getsav-in

2013-05-11 16:57:20 -------- d-----w- C:\Program Files (x86)\MSXML 4.0

2013-05-11 03:44:05 -------- d-----w- C:\Users\Brett\AppData\Local\Autodesk,_Inc

2013-05-11 03:42:28 -------- d-----w- C:\Users\Brett\AppData\Local\Granta Design

2013-05-11 03:40:52 -------- d-----w- C:\ProgramData\boost_interprocess

2013-05-11 03:07:33 -------- d-----w- C:\ProgramData\FARO

2013-05-11 02:50:15 -------- d-----w- C:\Program Files\Common Files\Macrovision Shared

2013-05-11 02:44:13 -------- d-----w- C:\Program Files (x86)\Autodesk

2013-05-11 02:41:40 -------- d-----w- C:\Program Files (x86)\DWG TrueView 2014

2013-05-11 02:41:39 -------- d-----w- C:\Users\Brett\AppData\Local\Autodesk

2013-05-11 02:41:39 -------- d-----w- C:\Program Files\Common Files\Autodesk Shared

2013-05-11 02:41:39 -------- d-----w- C:\Program Files\Autodesk

2013-05-11 02:36:53 -------- d-----w- C:\Program Files (x86)\Common Files\Autodesk Shared

2013-05-11 02:33:27 -------- d-----w- C:\Users\Brett\AppData\Roaming\Autodesk

2013-05-11 02:32:01 -------- d-----w- C:\Users\Brett\AppData\Local\Akamai

2013-05-11 02:31:58 -------- d-----w- C:\Autodesk

2013-05-10 23:40:03 -------- d-----w- C:\Windows\Downloaded Installations

2013-05-10 21:17:48 -------- d-----w- C:\Program Files\CPUID

2013-05-10 01:55:47 -------- d-----w- C:\Users\Brett\AppData\Local\EdgeOfReality

2013-05-06 01:53:58 15584 ----a-w- C:\Users\Brett\AppData\Roaming\Microsoft\IdentityCRL\production\ppcrlconfig.dll

2013-05-06 01:48:17 -------- d-sh--w- C:\ProgramData\SecuROM

2013-05-06 01:41:40 -------- d-----w- C:\Users\Brett\AppData\Local\Rockstar Games

2013-05-06 01:41:33 178800 ----a-w- C:\Windows\SysWow64\CmdLineExt_x64.dll

2013-05-06 01:41:28 -------- d-----w- C:\Windows\SysWow64\xlive

2013-05-06 01:41:28 -------- d-----w- C:\Program Files (x86)\Microsoft Games for Windows - LIVE

2013-05-03 03:51:18 -------- d-----w- C:\Users\Brett\.VirtualBox

2013-05-03 03:51:05 237840 ----a-w- C:\Windows\System32\drivers\VBoxDrv.sys

2013-05-03 03:51:02 120080 ----a-w- C:\Windows\System32\drivers\VBoxUSBMon.sys

2013-05-02 23:26:42 -------- d-----w- C:\Users\Brett\AppData\Local\SmartTechnology

2013-04-30 19:50:54 1075424 ----a-w- C:\ProgramData\Microsoft\WDExpress\11.0\1033\ResourceCache.dll

2013-04-30 19:50:41 -------- d-----w- C:\Program Files (x86)\NuGet

2013-04-30 19:50:13 -------- d-----w- C:\Program Files (x86)\Common Files\Merge Modules

2013-04-30 19:49:54 -------- d-----w- C:\Program Files (x86)\Common Files\Microsoft

2013-04-30 19:49:53 -------- d-----w- C:\Program Files (x86)\Windows Kits

2013-04-30 19:49:43 -------- d-----w- C:\Program Files (x86)\Microsoft Help Viewer

2013-04-30 19:49:36 -------- d-----w- C:\Windows\SysWow64\1033

2013-04-30 19:49:36 -------- d-----w- C:\Windows\System32\1033

2013-04-30 19:49:34 -------- d-----w- C:\Program Files\Microsoft SQL Server

2013-04-30 19:49:34 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server

2013-04-30 19:49:28 -------- d-----w- C:\Program Files\Microsoft SQL Server Compact Edition

2013-04-30 19:49:27 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2013-04-30 15:48:14 181024 ----a-w- C:\Windows\System32\drivers\SaiK075C.sys

2013-04-30 15:48:12 959488 ----a-w- C:\Windows\System32\SaiC075C.Dll

2013-04-30 15:48:12 8704 ----a-w- C:\Windows\System32\SaiC075C_0C.dll

2013-04-30 15:48:12 8192 ----a-w- C:\Windows\System32\SaiC075C_10.dll

2013-04-30 15:48:12 8192 ----a-w- C:\Windows\System32\SaiC075C_0A.dll

2013-04-30 15:48:12 8192 ----a-w- C:\Windows\System32\SaiC075C_07.dll

2013-04-30 15:48:12 7680 ----a-w- C:\Windows\System32\SaiC075C_19.dll

2013-04-30 15:48:12 7168 ----a-w- C:\Windows\System32\SaiC075C_09.dll

2013-04-30 15:48:12 7168 ----a-w- C:\Windows\System32\SaiC075C_05.dll

2013-04-30 15:48:12 6656 ----a-w- C:\Windows\System32\SaiC075C_0402.dll

2013-04-30 15:48:12 5632 ----a-w- C:\Windows\System32\SaiC075C_11.dll

2013-04-30 15:48:12 5120 ----a-w- C:\Windows\System32\SaiC075C_12.dll

2013-04-30 01:16:40 -------- d-----w- C:\ProgramData\regid.1991-06.com.microsoft

2013-04-30 01:16:40 -------- d-----w- C:\ProgramData\Package Cache

2013-04-30 01:14:13 -------- d-----w- C:\Users\Brett\.idlerc

2013-04-30 01:00:25 231376 ----a-w- C:\Windows\System32\drivers\truecrypt.sys

2013-04-30 01:00:22 -------- d-----w- C:\Program Files\TrueCrypt

2013-04-30 00:52:40 -------- d-----w- C:\Program Files (x86)\proXPN

2013-04-30 00:43:25 -------- d-----w- C:\Users\Brett\AppData\Roaming\uTorrent

2013-04-29 22:35:52 971680 ----a-w- C:\Windows\System32\deployJava1.dll

2013-04-29 22:35:52 1092512 ----a-w- C:\Windows\System32\npDeployJava1.dll

2013-04-29 22:35:51 108448 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll

2013-04-29 22:29:00 -------- d-----w- C:\Users\Brett\AppData\Roaming\.technic

2013-04-29 22:20:30 -------- d-----w- C:\Users\Brett\AppData\Roaming\.minecraft

2013-04-29 22:19:05 866720 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll

2013-04-29 22:19:05 788896 ----a-w- C:\Windows\SysWow64\deployJava1.dll

.

==================== Find3M ====================

.

2013-05-03 00:10:00 25568 ----a-w- C:\Windows\System32\drivers\KeyCrypt64.sys

2013-05-02 15:29:56 278800 ------w- C:\Windows\System32\MpSigStub.exe

2013-04-25 09:06:07 496115 ----a-w- C:\ProgramData\1366880323.bdinstall.bin

2013-04-13 05:49:23 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll

2013-04-13 05:49:19 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll

2013-04-13 05:49:19 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll

2013-04-13 05:49:19 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll

2013-04-13 04:45:16 474624 ----a-w- C:\Windows\apppatch\AcSpecfc.dll

2013-04-13 04:45:15 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll

2013-04-12 15:41:28 131856 ----a-w- C:\Windows\System32\drivers\VBoxNetAdp.sys

2013-04-12 15:40:18 146704 ----a-w- C:\Windows\System32\drivers\VBoxNetFlt.sys

2013-04-12 15:40:16 204048 ----a-w- C:\Windows\System32\VBoxNetFltNobj.dll

2013-04-12 14:45:08 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys

2013-04-10 06:01:54 265064 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys

2013-04-10 03:30:50 3153920 ----a-w- C:\Windows\System32\win32k.sys

2013-04-07 00:28:08 94208 ----a-w- C:\Windows\pyw.exe

2013-04-07 00:25:14 2653184 ----a-w- C:\Windows\SysWow64\python33.dll

2013-04-07 00:24:36 93696 ----a-w- C:\Windows\py.exe

2013-04-05 06:52:14 2242048 ----a-w- C:\Windows\System32\wininet.dll

2013-04-05 06:50:36 3958784 ----a-w- C:\Windows\System32\jscript9.dll

2013-04-05 06:50:31 67072 ----a-w- C:\Windows\System32\iesetup.dll

2013-04-05 06:50:31 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2013-04-05 05:28:24 1767424 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-04-05 05:26:26 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-04-05 05:26:21 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2013-04-05 05:26:21 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2013-04-05 04:43:00 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2013-04-05 04:29:45 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-04-05 03:51:11 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe

2013-04-05 03:38:25 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe

2013-04-04 18:50:32 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys

2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe

2013-03-19 05:53:58 48640 ----a-w- C:\Windows\System32\wwanprotdim.dll

2013-03-19 05:53:58 230400 ----a-w- C:\Windows\System32\wwansvc.dll

2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll

2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe

2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe

2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll

2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe

2013-02-27 06:02:44 111448 ----a-w- C:\Windows\System32\consent.exe

2013-02-27 05:48:00 1930752 ----a-w- C:\Windows\System32\authui.dll

2013-02-27 05:47:10 70144 ----a-w- C:\Windows\System32\appinfo.dll

2013-02-27 04:49:24 1796096 ----a-w- C:\Windows\SysWow64\authui.dll

.

============= FINISH: 13:38:35.68 ===============

attach.txt

dds.txt

hijackthis.log

Maurice Naggar · May 27, 2013

Hello mccubed and welcome to MalwareBytes forum.

Let me suggest, if you're an MBAM PRO customer, you contact the consumer help desk here.

If you are in an organization or a corporate customer, contact Corporate Support for assistance.

Otherwise,

Know that BSODs can be caused by non-malware issues, such as conflicting auto-start apps, or conflicting driver issues, etc.

I will focus on only hunting for malware.

Kindly always Copy & Paste all log contents directly in-line within main-body of reply. Do not attach (unless a log is way huge).

Regarding the "blue screen STOP exception"

I need to have the STOP code information, along with any descriptive information :excl:

Your STOP screen info will look similar to this:

I need all the information from yours..... if and when the next time it happens.

Step 1

1. Go >> Here << and download ERUNT

(ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.)

2. Install ERUNT by following the prompts

(use the default install settings but say no to the portion that asks you to add ERUNT to the start-up folder, if you like you can enable this option later)

3. Start ERUNT

(either by double clicking on the desktop icon or choosing to start the program at the end of the setup)

4. Choose a location for the backup

(the default location is C:\WINDOWS\ERDNT which is acceptable).

5. Make sure that at least the first two check boxes are ticked

6. Press OK

7. Press YES to create the folder.

Step 2

To show all files:

Press Windows-key +R key on your keyboard to get RUN option.
Type in
```
explorer.exe
```
and press Enter to start Windows Explorer.
From the menu options, Select Tools, then Folder Options.
Next click the View tab.
Locate and uncheck Hide file extensions for known file types.
Locate and uncheck Hide protected operating system files (Recommended).
Locate and click Show hidden files and folders and drives.
Click Apply > OK.

Step 3

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

For directions on how, see How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Do NOT turn off the firewall

Please download AdwCleaner © Xplode from >>here<< and save it on your Desktop.

If your are running Windows XP, double click adwcleaner.exe to start it.

Otherwise, Right-click on adwcleaner.exe and select Run As Administrator to launch the application.

Now click on the Search tab.

Please post the contents of the log-file created in your next post.

Note: The log can also be located at C:\AdwCleaner[XX].txt where XX Denotes the number of times the application has been ran, so in this should be something like R1.

Step 4

Please read carefully and follow these steps.

Download TDSSKiller and save it to your Desktop.
Double-Click on TDSSKiller.exe to run the application, then on Start Scan.
If running Vista or Windows 7, do a RIGHT-Click and select Run as Administrator to start TDSSKILLER.exe.
If an infected file is detected, the default action will be Cure, click on Continue.
If a suspicious file is detected, the default action will be Skip, click on Continue.
If you get the warning about a file UnsignedFile.Multi.Generic or LockedFile.Multi.Generic please choose
Skip and click on Continue
It may ask you to reboot the computer to complete the process. Click on Reboot Now.
If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Step 5

Download & SAVE to your Desktop >> Tigzy's RogueKillerfrom here << or
>> from here <<
Quit all programs that you may have started.
Please disconnect any USB or external drives from the computer before you run this scan!
For Vista or Windows 7, do a right-click on the program, select Run as Administrator to start, & when prompted Allow to run.
For Windows XP, double-click to start.
Wait until Prescan has finished ...
Then Click on Scan button at upper right of screen.
Wait until the Status box shows "Scan Finished"
Click on Report and copy/paste the content of the Notepad into your next reply.
The log should be found in RKreport[1].txt on your Desktop
Exit/Close RogueKiller

Do NOT click any FIX buttons !

Step 6

RE-Enable your antivirus program.

Then copy/paste the following into your post (in order):

the contents of C:\AdwCleaner[R1].txt;
the contents of TDSSKILLER log;
the contents of RKReport log;

Be sure to do a Preview prior to pressing Submit because all reports may not fit into 1 single reply. You may have to do more than 1 reply.

Do not use the attachment feature to place any of your reports. Always put them in-line inside the body of reply.

mccubed27388 · May 27, 2013

Thank you SO much, i'll do that right now and get back to you.

mccubed27388 · May 27, 2013

Question, In step 2, What menu has "tools?" Is it right click menu, or the menu on the side, or start menu?

mccubed27388 · May 27, 2013

Found Folder Options, here is Adwcleaner:

# AdwCleaner v2.301 - Logfile created 05/27/2013 at 15:11:29

# Updated 16/05/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Brett - BRETT-PC

# Boot Mode : Normal

# Running from : D:\adwcleaner.exe

# Option [search]

***** [services] *****

***** [Files / Folders] *****

File Found : C:\END

Folder Found : C:\ProgramData\APN

Folder Found : C:\ProgramData\boost_interprocess

Folder Found : C:\Users\Brett\AppData\Local\getsavin

Folder Found : C:\Users\Brett\AppData\Roaming\DefaultTab

***** [Registry] *****

Key Found : HKCU\Software\APN PIP

Key Found : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Key Found : HKLM\Software\Default Tab

Key Found : HKLM\Software\PIP

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.94

File : C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1040 octets] - [27/05/2013 15:11:29]

########## EOF - C:\AdwCleaner[R1].txt - [1100 octets] ##########

mccubed27388 · May 27, 2013

Step 4 log is too long, Pastebin;

http://pastebin.com/zYkzXBye

mccubed27388 · May 27, 2013

Step 5:

RogueKiller V8.5.4 [Mar 18 2013] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://www.geekstogo.com/forum/files/file/413-roguekiller/

Website : http://tigzy.geekstogo.com/roguekiller.php

Blog : http://tigzyrk.blogspot.com/

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Brett [Admin rights]

Mode : Scan -- Date : 05/27/2013 15:18:05

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤

[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> C:\Windows\system32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: WDC WD1002FAEX-00Z3A0 ATA Device +++++

--- User ---

[MBR] bc8a06daff7617c15612bd4e32963171

[bSP] 93820247174159cc49868fd9ddbc1870 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953867 Mo

User = LL1 ... OK!

User = LL2 ... OK!

+++++ PhysicalDrive1: SanDisk SDSSDX120GG25 ATA Device +++++

--- User ---

[MBR] 446e5150ce3f7668bbc03d2b88a7ed53

[bSP] 707ccd6c5fbce262ed79bfb6f4d13414 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 114371 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[1]_S_05272013_02d1518.txt >>

RKreport[1]_S_05272013_02d1518.txt

Maurice Naggar · May 27, 2013

The Tdsskiller report is good. So is roguekiller. But you do have adwares.

For Windows Explorer, I was referring to the Windows Explorer main menu bar (at the top )

To show all files:

Press Windows-key +R key on your keyboard to get RUN option.
Type in
```
explorer.exe
```
and press Enter to start Windows Explorer.
From the menu options of Windows Explorer, Select Tools, then Folder Options.
Next click the View tab.
Locate and uncheck Hide file extensions for known file types.
Locate and uncheck Hide protected operating system files (Recommended).
Locate and click Show hidden files and folders and drives.
Click Apply > OK.

Task 2

Close any open documents/programs & all internet browsers you have running.
Please start AdwCleaner
Click on Delete button.
Confirm each time with OK.
Your computer will be rebooted automatically. A text file will open after the restart. Please post the content of that logfile in your reply.
Note: You can find the logfile at C:\AdwCleaner[s1]

Task 3

See this Microsoft article http://support.microsoft.com/kb/2483120

To remove remains of MS Security Essentials, click on the Fix it button for Fix it # 50692

You will see it just under the title "Fix It for me".

When all completed, 1) logoff and restart the system fresh and 2) report back here with result

Task 4

Close any open work documents, if any, saving your work.

Make sure to close any other programs that you started before.

Please download Junkware Removal Tool by Thisisu to your Desktop.

Please close your security software to avoid potential conflicts.
Turn off your Antivirus. Leave the firewall alone.
How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs
Run the JRT tool by double-clicking it. If you are using Windows Vista or 7 or 8, right-mouse click JRT.exe and select Run as administrator.
The tool will open and display information and disclaimer in a Command prompt window.
I'd suggest you close all internet browsers at this point.
Press a key on keyboard to start scanning your system.
Please be very patient as this will take several minutes to complete, depending on your system's specifications.
There are approximatly 12 phases or so in this tool. You will see each phase listed in the Command prompt window.
On completion, a log (JRT.txt) is saved to your Desktop and will automatically open. And the command prompt will have been closed.
Please post the contents of JRT.txt into a new reply.

Task 5

1. Download Malwarebytes Anti-Rootkit from http://www.malwarebytes.org/products/mbar/

2. Unzip the contents to a folder in a convenient location.

3. Open the folder where the contents were unzipped and run mbar.exe

IF your Windows is Windows 8 or 7 or Vista, do a RIGHT-Click on mbar.exe and select Run As Administrator and allow to run.

If your Windows is XP, double-click to start.

4. Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

5. Click on the Cleanup button to remove any threats and reboot if prompted to do so.

6. Wait while the system shuts down and the cleanup process is performed.

7. Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

Re-enable your Antivirus security software.

mccubed27388 · May 27, 2013

Step 2 log:

mccubed27388 · May 27, 2013

# AdwCleaner v2.301 - Logfile created 05/27/2013 at 15:54:52

# Updated 16/05/2013 by Xplode

# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)

# User : Brett - BRETT-PC

# Boot Mode : Normal

# Running from : D:\adwcleaner.exe

# Option [Delete]

***** [services] *****

***** [Files / Folders] *****

File Deleted : C:\END

Folder Deleted : C:\ProgramData\APN

Folder Deleted : C:\ProgramData\boost_interprocess

Folder Deleted : C:\Users\Brett\AppData\Local\getsavin

Folder Deleted : C:\Users\Brett\AppData\Roaming\DefaultTab

***** [Registry] *****

Key Deleted : HKCU\Software\APN PIP

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}

Key Deleted : HKLM\Software\Default Tab

Key Deleted : HKLM\Software\PIP

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16576

[OK] Registry is clean.

-\\ Google Chrome v27.0.1453.94

File : C:\Users\Brett\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] File is clean.

*************************

AdwCleaner[R1].txt - [1169 octets] - [27/05/2013 15:11:29]

AdwCleaner[R2].txt - [1229 octets] - [27/05/2013 15:53:42]

AdwCleaner[s1].txt - [1178 octets] - [27/05/2013 15:54:52]

########## EOF - C:\AdwCleaner[s1].txt - [1238 octets] ##########

mccubed27388 · May 27, 2013

My computer did freeze immediately after this finished. Step 4:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 4.9.4 (05.06.2013:1)

OS: Windows 7 Home Premium x64

Ran by Brett on Mon 05/27/2013 at 16:00:25.76

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2C4BA31C-0C15-11E2-90C7-9BFCBEB168B3}

~~~ Files

~~~ Folders

Failed to delete: [Folder] "C:\ProgramData\boost_interprocess"

Successfully deleted: [Folder] "C:\Users\Brett\appdata\local\downloadterms"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 05/27/2013 at 16:03:40.90

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

mccubed27388 · May 27, 2013

I bsod during the root kit scan, will attempt again. *** STOP:0x000000F4 (0x0000000000000003, 0xFFFFFA8007D7EB30, 0xFFFFFA8007D7EE10,0XFFFFF8000399A350)

mccubed27388 · May 27, 2013

BSOD The second time running the anti-root kit, right after the same file (in system32 named I blieve fubar.dll or soemthing like it) Same STOP error code, only this time the BSOD came shortly after the root kit ended itself and not during it.

Maurice Naggar · May 27, 2013

Restart the system into Safe mode with Networking

If Windows normal mode is not useable, force a system restart/reboot, and right away start tapping F8 function key.

When get Advanced Boot Menu, select Safe Mode with Networking.

Then just 1 time each, retry the remaining tasks I outlined.

This bsod may only be just a fluke.

mccubed27388 · May 27, 2013

Would you like me to do all the tasks outlined in your second post or only the ones that I could not complete do to BSOD?

Also, when in safe mode w/networking, the antiroot kit tells me to install a DDA driver before the scan. If I reboot into safemode, however,the scan does not conintue and I recieve the same message.

Should I

-Launch into safemode, allow malwarebytes anti root kit to install this DDA driver and reboot into normla windows

-Or run the anti root kit without installing this DDA driver in safe mode with networking?

Again thank you so much for your time and patience, I appreciae it dearly

Maurice Naggar · May 27, 2013

No, do not repeat those tools you already completed.

I only meant for you to run MBAR in Safe Mode with Networking.

Follow the prompts in MBAR and let it install what it needs. But stay in Safe mode with Networking.

Let me know what the results are.

Maurice Naggar · May 27, 2013

Run the following and post the requested log. Credit Kevinf80 for the following

1. Download Malwarebytes Anti-Rootkit from this link http://www.malwarebytes.org/products/mbar/

2. Unzip the File to a convenient location. (Recommend the Desktop)

3. Open the folder where the contents were unzipped to run mbar.exe

4. Double-click on the mbar.exe file, you may receive a User Account Control prompt asking if you are sure you wish to allow the program to run. Please allow the program to run and MBAR will now start to install any necessary drivers that are required for the program to operate correctly. If a rootkit is interfering with the installation of the drivers you will see a message that states that the DDA driver was not installed and that you should reboot your computer to install it. You will see this image:

5. If you receive this message, please click on the Yes button and Malwarebytes Anti-Rootkit will now restart your computer. Once the computer is rebooted and you login, MBAR will automatically start and you will now be at the start screen. (If no Rootkit warning you will go from step 4 to 6.)

6. The following image opens, select Next.

7. The following image opens, select Update

8. When the Update completes, select Next

9. In the following window ensure "Targets" are ticked. Then select "Scan"

10. If an infection/s is found the "Cleanup Button" to remove threats will be available. A list of infected files will be listed like the following example:

11. Do not select the "Clean up Button" select the "Exit" button, there will be a warning as follows:

12. Select "Yes" to close down the program. If NO infections were found you will see the following image:

13. Select "Exit" to close down.

14. Copy and paste the two following logs from the mbar folder:

System - log

Mbar - log Date and time of scan will also be shown

Post those two logs in your reply.

mccubed27388 · May 27, 2013

Here is a synopsis of what is happening in my two tries:

1. I boot into Safe mode with Networking (let's say SF w/N) and run malwarebytes as administrator.

2. I Go through all the steps, and when I click "Scan" I am propmted to have to download DDA Drvers and restart, I select yes.

3. I do not touch the machine after that, it boots into normal windows on its own, and with the entire screen being black except for one cmd and the scan running.

4. BSOD

---------------------------------------------------------

Attempt 2:

1. I boot into SF w/N, and run malwarebytes (As admin each time)

2. I go through the steps, click scan, and am again prompted to install the DDA drivers.

3. During the restart, I tap F8 and boot back into SF w/N

3. The malwarebytes scan does not strt automaticlly. If I try to manually start it, I am again prompted to install DDA drivers and repeat the cycle.

Maurice Naggar · May 27, 2013

Let's put mbar aside.

Do the following now:

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

Disconnect any external storage drives from the computer.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select English as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

OR If you have the Windows o.s. DVD, then To enter System Recovery Options, by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select English as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:

- Startup Repair
- System Restore
- Windows Complete PC Restore
- Windows Memory Diagnostic Tool
- Command Prompt

[*]Select Command Prompt

Now, Plug the flashdrive with FRST tool into the PC.

[*]In the command window type in notepad and press Enter.

[*]The notepad opens. Under File menu select Open.

[*]Select "Computer" and find your flash drive letter and close the notepad.

[*]In the command window type e:\frst.exe (for x64 bit version type e:\frst64) and press Enter

Note: Replace letter e with the drive letter of your flash drive.

[*]The tool will start to run.

[*]When the tool opens click Yes to disclaimer.

[*]Press Scan button.

[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

mccubed27388 · May 27, 2013

FRST 64 Scan:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-05-2013

Ran by SYSTEM on 27-05-2013 17:47:25

Running from G:\

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Recovery

The current controlset is ControlSet002

ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ProfilerU] C:\Program Files\SmartTechnology\Software\ProfilerU.exe [454144 2013-01-31] (Saitek)

HKLM\...\Run: [saiMfd] C:\Program Files\SmartTechnology\Software\SaiMfd.exe [158208 2013-01-31] (Saitek)

HKLM\...\Run: [3DG4me] C:\Windows\System\3DG4me.exe [126976 2010-04-22] ()

HKLM-x32\...\RunOnce: [A0] cmd /c "C:\Users\Brett\Desktop\MBAR\mbar.exe" /bootscan /s [768584 2013-05-08] (Malwarebytes Corporation)

HKU\Brett\...\Run: [steam] "C:\Program Files (x86)\Steam\steam.exe" -silent [1636264 2013-05-21] (Valve Corporation)

HKU\Brett\...\Run: [Autodesk Sync] C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-04] (Autodesk, Inc.)

Startup: C:\Users\Brett\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk

ShortcutTarget: ERUNT AutoBackup.lnk -> C:\Program Files (x86)\ERUNT\AUTOBACK.EXE ()

==================== Services (Whitelisted) =================

S2 gzserv; C:\Program Files\Bitdefender\Antivirus Free Edition\gzserv.exe [30240 2013-05-14] (Bitdefender)

S2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [164736 2012-11-06] (Intel Corporation)

S2 MBAMScheduler; "D:\Malwarebytes' Anti-Malware\mbamscheduler.exe" [x]

S2 MBAMService; "D:\Malwarebytes' Anti-Malware\mbamservice.exe" [x]

S2 mitsijm2014; "D:\Autodesk Inventor 2014\Inventor 2014\Moldflow\bin\mitsijm.exe" [x]

==================== Drivers (Whitelisted) ====================

S0 avc3; C:\Windows\System32\DRIVERS\avc3.sys [718840 2013-04-17] (BitDefender)

S3 avckf; C:\Windows\System32\DRIVERS\avckf.sys [593144 2013-04-17] (BitDefender)

S1 bdfwfpf; C:\Program Files\Bitdefender\Antivirus Free Edition\bdfwfpf.sys [121928 2013-04-17] (Bitdefender SRL)

S3 gzflt; C:\Windows\System32\DRIVERS\gzflt.sys [148696 2013-04-22] (BitDefender LLC)

S3 keycrypt; C:\Windows\System32\DRIVERS\KeyCrypt64.sys [25568 2013-05-02] (Zemana Ltd.)

S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 PcaSp60; C:\Windows\SysWow64\DRIVERS\PcaSp60.sys [38912 2010-09-07] (Printing Communications Assoc., Inc. (PCAUSA))

S3 SaiK075C; C:\Windows\System32\DRIVERS\SaiK075C.sys [181024 2013-04-30] (Saitek)

S3 SaiK0CCB; C:\Windows\System32\DRIVERS\SaiK0CCB.sys [180544 2012-09-20] (Saitek)

S3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [25120 2013-02-01] (Saitek)

S3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [52640 2013-02-01] (Saitek)

S3 SaiU0CCB; C:\Windows\System32\DRIVERS\SaiU0CCB.sys [47168 2012-09-20] (Saitek)

S0 trufos; C:\Windows\System32\DRIVERS\trufos.sys [350160 2012-10-31] (BitDefender S.R.L.)

S3 USBADVAU; C:\Windows\System32\drivers\cm11264.sys [1308160 2010-04-22] (C-Media Electronics Inc)

S3 97360344; No ImagePath

S3 BCM42RLY; system32\drivers\BCM42RLY.sys [x]

S3 cpuz136; \??\C:\Users\Brett\AppData\Local\Temp\cpuz136\cpuz136_x64.sys [x]

S0 mbamchameleon; system32\drivers\mbamchameleon.sys [x]

S0 mbamswissarmy; system32\drivers\mbamswissarmy.sys [x]

S3 MSICDSetup; \??\E:\CDriver64.sys [x]

S3 NTIOLib_1_0_C; \??\E:\NTIOLib_X64.sys [x]

S1 truecrypt; System32\drivers\truecrypt.sys [x]

S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Corsair\CorsairLINK2\CorsairLINK_HardwareMonitor.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-27 17:47 - 2013-05-27 17:47 - 00000000 ____D C:\FRST

2013-05-27 12:09 - 2013-05-27 12:54 - 00162008 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamswissarmy.sys

2013-05-27 12:09 - 2013-05-27 12:47 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-05-27 12:08 - 2013-05-27 12:31 - 00036680 ____A C:\Windows\System32\Drivers\mbamchameleon.sys

2013-05-27 12:08 - 2013-05-27 12:08 - 00000000 ____D C:\Users\Brett\Desktop\MBAR

2013-05-27 12:03 - 2013-05-27 12:03 - 00000948 ____A C:\Users\Brett\Desktop\JRT.txt

2013-05-27 12:00 - 2013-05-27 12:00 - 00000000 ____D C:\Windows\ERUNT

2013-05-27 12:00 - 2013-05-27 12:00 - 00000000 ____D C:\JRT

2013-05-27 12:00 - 2013-05-27 11:58 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Brett\Desktop\JRT.exe

2013-05-27 11:55 - 2013-05-27 12:17 - 00000000 ____D C:\ProgramData\boost_interprocess

2013-05-27 11:54 - 2013-05-27 11:55 - 00001307 ____A C:\AdwCleaner[s1].txt

2013-05-27 11:53 - 2013-05-27 11:53 - 00001229 ____A C:\AdwCleaner[R2].txt

2013-05-27 11:18 - 2013-05-27 11:18 - 00001682 ____A C:\Users\Brett\Desktop\RKreport[1]_S_05272013_02d1518.txt

2013-05-27 11:17 - 2013-05-27 11:18 - 00000000 ____D C:\Users\Brett\Desktop\RK_Quarantine

2013-05-27 11:11 - 2013-05-27 11:11 - 00001169 ____A C:\AdwCleaner[R1].txt

2013-05-27 11:03 - 2013-05-27 11:03 - 00000924 ____A C:\Users\UpdatusUser\Desktop\NTREGOPT.lnk

2013-05-27 11:03 - 2013-05-27 11:03 - 00000924 ____A C:\Users\Brett\Desktop\NTREGOPT.lnk

2013-05-27 11:03 - 2013-05-27 11:03 - 00000905 ____A C:\Users\UpdatusUser\Desktop\ERUNT.lnk

2013-05-27 11:03 - 2013-05-27 11:03 - 00000905 ____A C:\Users\Brett\Desktop\ERUNT.lnk

2013-05-27 11:03 - 2013-05-27 11:03 - 00000000 ____D C:\Windows\ERDNT

2013-05-27 11:03 - 2013-05-27 11:03 - 00000000 ____D C:\Program Files (x86)\ERUNT

2013-05-27 10:33 - 2013-05-26 07:29 - 00000000 ____A C:\Windows\System32\Drivers\avchv.sys

2013-05-27 09:38 - 2013-05-27 09:38 - 00021181 ____A C:\Users\Brett\Desktop\dds.txt

2013-05-27 09:38 - 2013-05-27 09:38 - 00011945 ____A C:\Users\Brett\Desktop\attach.txt

2013-05-27 09:38 - 2013-05-27 09:37 - 00688992 ____R (Swearware) C:\Users\Brett\Desktop\dds.com

2013-05-26 20:45 - 2013-05-26 20:45 - 00054410 ____A C:\Users\Brett\Documents\REG-2.reg

2013-05-26 20:44 - 2013-05-26 20:44 - 00000000 ____D C:\Program Files\CCleaner

2013-05-26 10:23 - 2013-05-27 08:53 - 00000000 ____D C:\Users\Brett\AppData\Local\LogMeIn Hamachi

2013-05-26 10:23 - 2013-05-26 10:23 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi

2013-05-26 09:57 - 2013-05-26 09:57 - 00000000 ____D C:\Users\Brett\Documents\Wizards of the Coast

2013-05-26 08:26 - 2013-05-26 08:26 - 00150860 ____A C:\ProgramData\1369581972.bdinstall.bin

2013-05-26 07:29 - 2013-04-17 10:59 - 00718840 ____A (BitDefender) C:\Windows\System32\Drivers\avc3.sys

2013-05-26 07:29 - 2013-04-17 10:59 - 00593144 ____A (BitDefender) C:\Windows\System32\Drivers\avckf.sys

2013-05-26 07:26 - 2013-04-22 09:21 - 00148696 ____A (BitDefender LLC) C:\Windows\System32\Drivers\gzflt.sys

2013-05-26 07:26 - 2012-10-31 09:13 - 00350160 ____A (BitDefender S.R.L.) C:\Windows\System32\Drivers\trufos.sys

2013-05-26 07:19 - 2013-05-26 07:19 - 352292784 ____A C:\Windows\System32\REGSITRYBACKUP-1.reg

2013-05-25 17:47 - 2013-05-26 07:18 - 00001945 ____A C:\Windows\epplauncher.mif

2013-05-25 17:40 - 2013-05-25 17:40 - 00238132 ____A C:\ProgramData\1369532333.bdinstall.bin

2013-05-25 17:37 - 2013-05-25 17:37 - 00000000 ____D C:\Program Files (x86)\VS Revo Group

2013-05-25 17:26 - 2009-12-30 07:21 - 00031800 ____A (VS Revo Group) C:\Windows\System32\Drivers\revoflt.sys

2013-05-24 12:27 - 2013-05-24 20:08 - 00000000 ____D C:\Users\Brett\Documents\PhoenixRC

2013-05-23 18:19 - 2013-05-23 18:19 - 00000000 ____D C:\Put a directory on PYTHONPATH here

2013-05-22 13:53 - 2013-05-22 13:53 - 00419663 ____A C:\Users\Brett\Documents\Computerpartsinvoice.xps

2013-05-20 17:54 - 2013-05-20 17:54 - 00000000 ____D C:\Users\Brett\Documents\Rockstar Games

2013-05-20 14:18 - 2013-05-20 14:18 - 00000000 ____D C:\Users\Brett\Documents\SavedGames

2013-05-20 13:25 - 2013-05-20 13:25 - 00000000 ____D C:\Windows\pss

2013-05-19 15:38 - 2013-05-19 15:38 - 00000000 ____D C:\Users\Brett\AppData\LocalGoogle

2013-05-18 17:33 - 2013-05-18 17:33 - 20971520 ____A C:\START(Ipadpass)

2013-05-18 17:30 - 2013-05-18 17:32 - 00000000 ____D C:\Users\Brett\AppData\Roaming\TrueCrypt

2013-05-14 15:58 - 2013-05-14 15:58 - 02143832 ____A C:\Users\Brett\Downloads\instsf449.exe

2013-05-14 15:58 - 2013-05-14 15:58 - 00001007 ____A C:\Users\UpdatusUser\Desktop\SpeedFan.lnk

2013-05-14 15:58 - 2013-05-14 15:58 - 00000045 ____A C:\Windows\SysWOW64\initdebug.nfo

2013-05-14 15:58 - 2013-05-14 15:58 - 00000000 ____D C:\Program Files (x86)\SpeedFan

2013-05-14 15:27 - 2013-05-26 20:48 - 00000000 ____D C:\Users\Brett\Desktop\Games

2013-05-14 15:26 - 2013-05-26 19:47 - 00000000 ____D C:\Users\Brett\Desktop\Antivirus, Gaming

2013-05-14 15:24 - 2013-05-25 17:50 - 00000000 ____D C:\Users\Brett\Desktop\Benchmark, Moniters

2013-05-14 15:23 - 2013-05-26 20:46 - 00000000 ____D C:\Users\Brett\Desktop\Coding, Productivity

2013-05-14 15:22 - 2013-05-14 15:23 - 00000000 ____D C:\Users\Brett\AppData\Roaming\WinRAR

2013-05-14 15:22 - 2013-05-14 15:22 - 00000000 ____D C:\Program Files (x86)\WinRAR

2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Rainmeter

2013-05-14 15:10 - 2013-05-14 15:10 - 00000000 ____D C:\Program Files\Rainmeter

2013-05-14 13:04 - 2013-04-04 22:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll

2013-05-14 13:04 - 2013-04-04 22:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll

2013-05-14 13:04 - 2013-04-04 22:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe

2013-05-14 13:04 - 2013-04-04 22:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll

2013-05-14 13:04 - 2013-04-04 22:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll

2013-05-14 13:04 - 2013-04-04 21:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2013-05-14 13:04 - 2013-04-04 21:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2013-05-14 13:04 - 2013-04-04 21:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2013-05-14 13:04 - 2013-04-04 20:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb

2013-05-14 13:04 - 2013-04-04 20:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2013-05-14 13:04 - 2013-04-04 19:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe

2013-05-14 13:04 - 2013-04-04 19:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe

2013-05-14 11:33 - 2013-04-09 22:01 - 00983400 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgkrnl.sys

2013-05-14 11:33 - 2013-04-09 22:01 - 00265064 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\dxgmms1.sys

2013-05-14 11:33 - 2013-04-09 19:30 - 03153920 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys

2013-05-14 11:33 - 2013-03-18 21:53 - 00230400 ____A (Microsoft Corporation) C:\Windows\System32\wwansvc.dll

2013-05-14 11:33 - 2013-03-18 21:53 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\wwanprotdim.dll

2013-05-14 11:33 - 2013-02-26 22:02 - 00111448 ____A (Microsoft Corporation) C:\Windows\System32\consent.exe

2013-05-14 11:33 - 2013-02-26 21:52 - 14172672 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

2013-05-14 11:33 - 2013-02-26 21:52 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\shdocvw.dll

2013-05-14 11:33 - 2013-02-26 21:48 - 01930752 ____A (Microsoft Corporation) C:\Windows\System32\authui.dll

2013-05-14 11:33 - 2013-02-26 21:47 - 00070144 ____A (Microsoft Corporation) C:\Windows\System32\appinfo.dll

2013-05-14 11:33 - 2013-02-26 20:55 - 12872704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2013-05-14 11:33 - 2013-02-26 20:55 - 00180224 ____A (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll

2013-05-14 11:33 - 2013-02-26 20:49 - 01796096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll

2013-05-14 11:33 - 2011-02-03 03:25 - 00144384 ____A (Microsoft Corporation) C:\Windows\System32\cdd.dll

2013-05-13 16:19 - 2013-05-13 16:19 - 00000000 ____D C:\Users\Brett\Documents\Rainmeter

2013-05-13 15:59 - 2013-05-13 15:59 - 00000000 ____D C:\Users\Brett\AppData\Local\SplitMediaLabs

2013-05-13 15:57 - 2013-05-13 15:57 - 00000000 ____D C:\ProgramData\SplitMediaLabs

2013-05-13 15:56 - 2013-05-27 10:30 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-05-13 15:56 - 2013-05-14 18:30 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-05-13 15:56 - 2013-05-14 18:30 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-05-13 15:56 - 2013-05-13 15:56 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2013-05-13 15:56 - 2013-05-13 15:56 - 00000000 ____D C:\Windows\System32\Macromed

2013-05-13 15:56 - 2013-05-13 15:56 - 00000000 ____D C:\Users\Brett\AppData\Roaming\SplitMediaLabs

2013-05-13 15:45 - 2013-05-13 15:50 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Origin

2013-05-13 15:45 - 2013-05-13 15:45 - 00000000 ____D C:\Users\Brett\AppData\Local\Origin

2013-05-13 15:45 - 2013-05-13 15:45 - 00000000 ____D C:\Program Files (x86)\Origin Games

2013-05-13 15:44 - 2013-05-13 15:50 - 00000000 ____D C:\ProgramData\Origin

2013-05-13 15:44 - 2013-05-13 15:44 - 00000000 ____D C:\ProgramData\Electronic Arts

2013-05-13 14:07 - 2013-05-13 14:07 - 00000000 ____D C:\Users\Brett\Documents\Image-Line

2013-05-13 14:07 - 2013-05-13 14:07 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Image-Line

2013-05-13 14:07 - 2013-05-13 14:07 - 00000000 ____D C:\Program Files\Image-Line

2013-05-13 14:07 - 2013-05-13 14:07 - 00000000 ____D C:\Program Files (x86)\ASIO4ALL v2

2013-05-13 14:07 - 2013-03-12 02:47 - 01431552 ____A (Propellerhead Software AB) C:\Windows\SysWOW64\rewire.dll

2013-05-13 14:07 - 2009-09-15 01:14 - 01554944 ____A (HMS http://hp.vector.co.jp/authors/VA012897/) C:\Windows\SysWOW64\vorbis.acm

2013-05-13 14:06 - 2013-05-13 14:06 - 00000000 ____D C:\Users\Brett\AppData\Roaming\FlowStone

2013-05-13 14:06 - 2013-05-13 14:06 - 00000000 ____D C:\Program Files (x86)\DSPRobotics

2013-05-13 14:05 - 2013-05-13 14:07 - 00000000 ____D C:\Program Files (x86)\Image-Line

2013-05-13 13:59 - 2013-05-13 14:05 - 307359850 ____A (Image-Line) C:\Users\Brett\Downloads\flstudio_11.exe

2013-05-13 13:58 - 2013-05-13 13:58 - 00000000 ____D C:\Users\Brett\AppData\Local\getsav-in

2013-05-12 06:14 - 2013-05-12 06:14 - 00069632 ____A C:\Users\Brett\Documents\WHEA 1.evtx

2013-05-11 08:57 - 2013-05-11 08:57 - 00287956 ____A C:\Windows\msxml4-KB954430-enu.LOG

2013-05-11 08:57 - 2013-05-11 08:57 - 00284150 ____A C:\Windows\msxml4-KB973688-enu.LOG

2013-05-11 08:57 - 2013-05-11 08:57 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0

2013-05-10 19:44 - 2013-05-10 19:44 - 00000000 ____D C:\Users\Brett\AppData\Local\Autodesk,_Inc

2013-05-10 19:42 - 2013-05-10 19:42 - 00000000 ____D C:\Users\Brett\AppData\Local\Granta Design

2013-05-10 19:41 - 2013-05-10 19:41 - 00000000 ____D C:\ProgramData\FLEXnet

2013-05-10 19:07 - 2013-05-10 19:07 - 00000000 ____D C:\ProgramData\FARO

2013-05-10 18:51 - 2013-05-10 19:42 - 00000000 ____D C:\Users\Brett\Documents\Inventor

2013-05-10 18:50 - 2013-05-10 18:50 - 00000000 ____D C:\Users\Brett\Documents\Autodesk

2013-05-10 18:50 - 2013-05-10 18:50 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared

2013-05-10 18:44 - 2013-05-10 18:44 - 00000000 ____D C:\Program Files (x86)\Autodesk

2013-05-10 18:41 - 2013-05-10 19:41 - 00000000 ____D C:\Users\Brett\AppData\Local\Autodesk

2013-05-10 18:41 - 2013-05-10 18:50 - 00000000 ____D C:\Program Files\Common Files\Autodesk Shared

2013-05-10 18:41 - 2013-05-10 18:49 - 00000000 ____D C:\Users\Public\Documents\Autodesk

2013-05-10 18:41 - 2013-05-10 18:43 - 00000000 ____D C:\Program Files\Autodesk

2013-05-10 18:41 - 2013-05-10 18:41 - 00000000 ____D C:\Program Files (x86)\DWG TrueView 2014

2013-05-10 18:33 - 2013-05-10 19:44 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Autodesk

2013-05-10 18:33 - 2013-05-10 19:42 - 00000000 ____D C:\ProgramData\Autodesk

2013-05-10 18:32 - 2013-05-10 18:32 - 00000000 ____D C:\Users\Brett\AppData\Local\Akamai

2013-05-10 18:31 - 2013-05-10 18:31 - 00000000 ____D C:\Autodesk

2013-05-10 15:40 - 2013-05-10 15:40 - 00000000 ____D C:\Windows\Downloaded Installations

2013-05-10 13:17 - 2013-05-10 13:17 - 00000000 ____D C:\Program Files\CPUID

2013-05-09 17:55 - 2013-05-09 17:55 - 00000000 ____D C:\Users\Brett\AppData\Local\EdgeOfReality

2013-05-07 15:51 - 2013-05-07 15:51 - 16846848 ____A C:\Users\Brett\Documents\LOG-1.evtx

2013-05-05 19:18 - 2013-05-26 20:46 - 00000000 ____D C:\Windows\Minidump

2013-05-05 17:48 - 2013-05-05 17:48 - 00000000 __SHD C:\ProgramData\SecuROM

2013-05-05 17:41 - 2013-05-05 17:41 - 00178800 ____A (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt_x64.dll

2013-05-05 17:41 - 2013-05-05 17:41 - 00000000 __RHD C:\Users\Brett\AppData\Roaming\SecuROM

2013-05-05 17:41 - 2013-05-05 17:41 - 00000000 ____D C:\Windows\SysWOW64\xlive

2013-05-05 17:41 - 2013-05-05 17:41 - 00000000 ____D C:\Users\Brett\AppData\Local\Rockstar Games

2013-05-05 17:41 - 2013-05-05 17:41 - 00000000 ____D C:\Program Files (x86)\Microsoft Games for Windows - LIVE

2013-05-05 10:57 - 2013-05-05 10:57 - 00001737 ____A C:\Windows\System32\lvcoinst.log

2013-05-05 10:57 - 2013-05-05 10:57 - 00000000 ____D C:\Program Files\Common Files\logishrd

2013-05-03 20:20 - 2013-05-03 20:20 - 00000000 ____D C:\Users\Default\Documents\Visual Studio 2012

2013-05-03 20:20 - 2013-05-03 20:20 - 00000000 ____D C:\Users\Default User\Documents\Visual Studio 2012

2013-05-03 12:52 - 2013-05-03 12:52 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight

2013-05-03 11:32 - 2013-05-03 11:32 - 00000230 ____A C:\Windows\Cm112.ini.imi

2013-05-03 11:32 - 2013-05-03 11:32 - 00000185 ____A C:\Windows\Cm112.ini.cfl

2013-05-03 11:32 - 2010-04-22 23:14 - 01308160 ____A (C-Media Electronics Inc) C:\Windows\System32\Drivers\cm11264.sys

2013-05-03 11:32 - 2010-04-22 23:14 - 00779776 ___RA C:\Windows\System32\Cmeau112.exe

2013-05-03 11:32 - 2010-04-22 23:14 - 00524768 ___RA (Microsoft Corporation) C:\Windows\difxapi.dll

2013-05-03 11:32 - 2010-04-22 23:14 - 00354304 ___RA C:\Windows\System32\CmiInstallResAll64.dll

2013-05-03 11:32 - 2010-04-22 23:14 - 00004608 ___RA C:\Windows\Thumbs.db

2013-05-03 11:32 - 2010-04-22 23:14 - 00001198 ___RA C:\Windows\Cm112.ini.cfg

2013-05-02 19:51 - 2013-05-26 19:48 - 00000000 ____D C:\Users\Brett\.VirtualBox

2013-05-02 19:51 - 2013-04-12 07:41 - 00237840 ____A (Oracle Corporation) C:\Windows\System32\Drivers\VBoxDrv.sys

2013-05-02 19:51 - 2013-04-12 07:40 - 00120080 ____A (Oracle Corporation) C:\Windows\System32\Drivers\VBoxUSBMon.sys

2013-05-02 19:49 - 2013-05-02 19:49 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_SaiK075C_01009.Wdf

2013-05-02 15:26 - 2013-05-02 15:26 - 00000000 ____D C:\Users\Brett\AppData\Local\SmartTechnology

2013-05-02 15:18 - 2013-05-02 15:18 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_SaiK0CCB_01009.Wdf

2013-04-30 12:10 - 2013-05-14 17:28 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Audacity

2013-04-30 11:59 - 2013-04-30 11:59 - 00008704 ___AH C:\Users\Brett\Desktop\WindowsApplication1.v11.suo

2013-04-30 11:50 - 2013-05-23 18:12 - 00000000 ____D C:\Users\Brett\Documents\Visual Studio 2012

2013-04-30 11:50 - 2013-04-30 11:50 - 00000000 ____D C:\Windows\symbols

2013-04-30 11:50 - 2013-04-30 11:50 - 00000000 ____D C:\Program Files (x86)\NuGet

2013-04-30 11:49 - 2013-04-30 11:50 - 00000000 ____D C:\Program Files\Microsoft SQL Server

2013-04-30 11:49 - 2013-04-30 11:50 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server

2013-04-30 11:49 - 2013-04-30 11:49 - 00000000 ____D C:\Windows\SysWOW64\1033

2013-04-30 11:49 - 2013-04-30 11:49 - 00000000 ____D C:\Windows\System32\1033

2013-04-30 11:49 - 2013-04-30 11:49 - 00000000 ____D C:\Program Files\Microsoft SQL Server Compact Edition

2013-04-30 11:49 - 2013-04-30 11:49 - 00000000 ____D C:\Program Files (x86)\Windows Kits

2013-04-30 11:49 - 2013-04-30 11:49 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition

2013-04-30 11:49 - 2013-04-30 11:49 - 00000000 ____D C:\Program Files (x86)\Microsoft SDKs

2013-04-30 11:49 - 2013-04-30 11:49 - 00000000 ____D C:\Program Files (x86)\Microsoft Help Viewer

2013-04-30 07:48 - 2013-04-30 07:48 - 00959488 ____A C:\Windows\System32\SaiC075C.Dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00181024 ____A (Saitek) C:\Windows\System32\Drivers\SaiK075C.sys

2013-04-30 07:48 - 2013-04-30 07:48 - 00010010 ____A C:\Windows\System32\SaiD075C.pr0

2013-04-30 07:48 - 2013-04-30 07:48 - 00008704 ____A C:\Windows\System32\SaiC075C_0C.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00008192 ____A C:\Windows\System32\SaiC075C_10.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00008192 ____A C:\Windows\System32\SaiC075C_0A.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00008192 ____A C:\Windows\System32\SaiC075C_07.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00007680 ____A C:\Windows\System32\SaiC075C_19.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00007168 ____A C:\Windows\System32\SaiC075C_09.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00007168 ____A C:\Windows\System32\SaiC075C_05.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00006656 ____A C:\Windows\System32\SaiC075C_0402.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00005632 ____A C:\Windows\System32\SaiC075C_11.dll

2013-04-30 07:48 - 2013-04-30 07:48 - 00005120 ____A C:\Windows\System32\SaiC075C_12.dll

2013-04-29 17:16 - 2013-05-13 16:18 - 00000000 ____D C:\ProgramData\Package Cache

2013-04-29 17:14 - 2013-04-29 17:14 - 00000000 ____D C:\Users\Brett\.idlerc

2013-04-29 17:00 - 2013-04-29 17:00 - 00231376 ____A (TrueCrypt Foundation) C:\Windows\System32\Drivers\truecrypt.sys

2013-04-29 17:00 - 2013-04-29 17:00 - 00000000 ____D C:\Program Files\TrueCrypt

2013-04-29 16:52 - 2013-04-29 16:52 - 00000000 ____D C:\Program Files (x86)\proXPN

2013-04-29 16:43 - 2013-05-27 09:21 - 00000000 ____D C:\Users\Brett\AppData\Roaming\uTorrent

2013-04-29 14:35 - 2013-04-29 14:35 - 01092512 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll

2013-04-29 14:35 - 2013-04-29 14:35 - 00971680 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll

2013-04-29 14:35 - 2013-04-29 14:35 - 00311200 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe

2013-04-29 14:35 - 2013-04-29 14:35 - 00188832 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe

2013-04-29 14:35 - 2013-04-29 14:35 - 00188320 ____A (Oracle Corporation) C:\Windows\System32\java.exe

2013-04-29 14:35 - 2013-04-29 14:35 - 00108448 ____A (Oracle Corporation) C:\Windows\System32\WindowsAccessBridge-64.dll

2013-04-29 14:35 - 2013-04-29 14:35 - 00000000 ____D C:\Program Files\Java

2013-04-29 14:29 - 2013-04-29 14:29 - 00000000 ____D C:\Users\Brett\AppData\Roaming\.technic

2013-04-29 14:20 - 2013-04-29 14:28 - 00000000 ____D C:\Users\Brett\AppData\Roaming\.minecraft

2013-04-29 14:19 - 2013-04-29 14:19 - 00866720 ____A (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll

2013-04-29 14:19 - 2013-04-29 14:19 - 00788896 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll

2013-04-29 14:18 - 2013-04-29 14:18 - 00000000 ____D C:\ProgramData\McAfee

2013-04-27 08:33 - 2013-04-27 08:33 - 00000834 ____A C:\Users\Brett\Desktop\Photos - Shortcut.lnk

2013-04-27 02:44 - 2013-05-02 19:49 - 00000000 ____D C:\ProgramData\SmartTechnology

2013-04-27 02:44 - 2013-04-27 02:44 - 00000000 ____D C:\Program Files\SmartTechnology

==================== One Month Modified Files and Folders =======

2013-05-27 17:47 - 2013-05-27 17:47 - 00000000 ____D C:\FRST

2013-05-27 12:54 - 2013-05-27 12:09 - 00162008 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamswissarmy.sys

2013-05-27 12:47 - 2013-05-27 12:09 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2013-05-27 12:46 - 2013-04-24 07:21 - 00000892 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2013-05-27 12:46 - 2013-04-24 07:01 - 00000000 ____D C:\ProgramData\NVIDIA

2013-05-27 12:46 - 2009-07-13 21:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT

2013-05-27 12:46 - 2009-07-13 20:51 - 00042290 ____A C:\Windows\setupact.log

2013-05-27 12:31 - 2013-05-27 12:08 - 00036680 ____A C:\Windows\System32\Drivers\mbamchameleon.sys

2013-05-27 12:17 - 2013-05-27 11:55 - 00000000 ____D C:\ProgramData\boost_interprocess

2013-05-27 12:17 - 2013-04-25 03:52 - 00000000 ____D C:\Program Files (x86)\Steam

2013-05-27 12:08 - 2013-05-27 12:08 - 00000000 ____D C:\Users\Brett\Desktop\MBAR

2013-05-27 12:03 - 2013-05-27 12:03 - 00000948 ____A C:\Users\Brett\Desktop\JRT.txt

2013-05-27 12:03 - 2013-04-24 06:18 - 01802653 ____A C:\Windows\WindowsUpdate.log

2013-05-27 12:03 - 2009-07-13 21:13 - 00780436 ____A C:\Windows\System32\PerfStringBackup.INI

2013-05-27 12:00 - 2013-05-27 12:00 - 00000000 ____D C:\Windows\ERUNT

2013-05-27 12:00 - 2013-05-27 12:00 - 00000000 ____D C:\JRT

2013-05-27 11:58 - 2013-05-27 12:00 - 00545954 ____A (Oleg N. Scherbakov) C:\Users\Brett\Desktop\JRT.exe

2013-05-27 11:55 - 2013-05-27 11:54 - 00001307 ____A C:\AdwCleaner[s1].txt

2013-05-27 11:53 - 2013-05-27 11:53 - 00001229 ____A C:\AdwCleaner[R2].txt

2013-05-27 11:18 - 2013-05-27 11:18 - 00001682 ____A C:\Users\Brett\Desktop\RKreport[1]_S_05272013_02d1518.txt

2013-05-27 11:18 - 2013-05-27 11:17 - 00000000 ____D C:\Users\Brett\Desktop\RK_Quarantine

2013-05-27 11:11 - 2013-05-27 11:11 - 00001169 ____A C:\AdwCleaner[R1].txt

2013-05-27 11:03 - 2013-05-27 11:03 - 00000924 ____A C:\Users\UpdatusUser\Desktop\NTREGOPT.lnk

2013-05-27 11:03 - 2013-05-27 11:03 - 00000924 ____A C:\Users\Brett\Desktop\NTREGOPT.lnk

2013-05-27 11:03 - 2013-05-27 11:03 - 00000905 ____A C:\Users\UpdatusUser\Desktop\ERUNT.lnk

2013-05-27 11:03 - 2013-05-27 11:03 - 00000905 ____A C:\Users\Brett\Desktop\ERUNT.lnk

2013-05-27 11:03 - 2013-05-27 11:03 - 00000000 ____D C:\Windows\ERDNT

2013-05-27 11:03 - 2013-05-27 11:03 - 00000000 ____D C:\Program Files (x86)\ERUNT

2013-05-27 10:30 - 2013-05-13 15:56 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job

2013-05-27 09:39 - 2009-07-13 20:45 - 00021888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2013-05-27 09:39 - 2009-07-13 20:45 - 00021888 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2013-05-27 09:38 - 2013-05-27 09:38 - 00021181 ____A C:\Users\Brett\Desktop\dds.txt

2013-05-27 09:38 - 2013-05-27 09:38 - 00011945 ____A C:\Users\Brett\Desktop\attach.txt

2013-05-27 09:37 - 2013-05-27 09:38 - 00688992 ____R (Swearware) C:\Users\Brett\Desktop\dds.com

2013-05-27 09:37 - 2013-04-24 07:21 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2013-05-27 09:26 - 2010-11-20 19:47 - 00167844 ____A C:\Windows\PFRO.log

2013-05-27 09:23 - 2013-04-24 06:18 - 00000000 ____D C:\Users\Brett\AppData\Local\VirtualStore

2013-05-27 09:21 - 2013-04-29 16:43 - 00000000 ____D C:\Users\Brett\AppData\Roaming\uTorrent

2013-05-27 09:19 - 2009-07-13 21:08 - 00032584 ____A C:\Windows\Tasks\SCHEDLGU.TXT

2013-05-27 08:54 - 2013-04-25 03:57 - 00000021 ____A C:\Users\Brett\AppData\Roaming\config_data.dat

2013-05-27 08:54 - 2013-04-24 07:20 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information

2013-05-27 08:53 - 2013-05-26 10:23 - 00000000 ____D C:\Users\Brett\AppData\Local\LogMeIn Hamachi

2013-05-26 20:48 - 2013-05-14 15:27 - 00000000 ____D C:\Users\Brett\Desktop\Games

2013-05-26 20:46 - 2013-05-14 15:23 - 00000000 ____D C:\Users\Brett\Desktop\Coding, Productivity

2013-05-26 20:46 - 2013-05-05 19:18 - 00000000 ____D C:\Windows\Minidump

2013-05-26 20:45 - 2013-05-26 20:45 - 00054410 ____A C:\Users\Brett\Documents\REG-2.reg

2013-05-26 20:44 - 2013-05-26 20:44 - 00000000 ____D C:\Program Files\CCleaner

2013-05-26 19:48 - 2013-05-02 19:51 - 00000000 ____D C:\Users\Brett\.VirtualBox

2013-05-26 19:47 - 2013-05-14 15:26 - 00000000 ____D C:\Users\Brett\Desktop\Antivirus, Gaming

2013-05-26 19:16 - 2013-04-25 07:11 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Skype

2013-05-26 10:23 - 2013-05-26 10:23 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi

2013-05-26 09:57 - 2013-05-26 09:57 - 00000000 ____D C:\Users\Brett\Documents\Wizards of the Coast

2013-05-26 09:57 - 2013-04-24 07:33 - 00132925 ____A C:\Windows\DirectX.log

2013-05-26 08:26 - 2013-05-26 08:26 - 00150860 ____A C:\ProgramData\1369581972.bdinstall.bin

2013-05-26 07:29 - 2013-05-27 10:33 - 00000000 ____A C:\Windows\System32\Drivers\avchv.sys

2013-05-26 07:29 - 2013-04-25 00:59 - 00000000 ____D C:\Program Files\Bitdefender

2013-05-26 07:19 - 2013-05-26 07:19 - 352292784 ____A C:\Windows\System32\REGSITRYBACKUP-1.reg

2013-05-26 07:18 - 2013-05-25 17:47 - 00001945 ____A C:\Windows\epplauncher.mif

2013-05-25 17:50 - 2013-05-14 15:24 - 00000000 ____D C:\Users\Brett\Desktop\Benchmark, Moniters

2013-05-25 17:40 - 2013-05-25 17:40 - 00238132 ____A C:\ProgramData\1369532333.bdinstall.bin

2013-05-25 17:39 - 2013-04-25 00:58 - 00000000 ____D C:\Program Files\Common Files\Bitdefender

2013-05-25 17:37 - 2013-05-25 17:37 - 00000000 ____D C:\Program Files (x86)\VS Revo Group

2013-05-24 20:08 - 2013-05-24 12:27 - 00000000 ____D C:\Users\Brett\Documents\PhoenixRC

2013-05-23 18:19 - 2013-05-23 18:19 - 00000000 ____D C:\Put a directory on PYTHONPATH here

2013-05-23 18:12 - 2013-04-30 11:50 - 00000000 ____D C:\Users\Brett\Documents\Visual Studio 2012

2013-05-22 13:53 - 2013-05-22 13:53 - 00419663 ____A C:\Users\Brett\Documents\Computerpartsinvoice.xps

2013-05-20 17:54 - 2013-05-20 17:54 - 00000000 ____D C:\Users\Brett\Documents\Rockstar Games

2013-05-20 14:18 - 2013-05-20 14:18 - 00000000 ____D C:\Users\Brett\Documents\SavedGames

2013-05-20 13:25 - 2013-05-20 13:25 - 00000000 ____D C:\Windows\pss

2013-05-19 15:38 - 2013-05-19 15:38 - 00000000 ____D C:\Users\Brett\AppData\LocalGoogle

2013-05-19 15:38 - 2013-04-24 07:21 - 00000000 ____D C:\Users\Brett\AppData\Local\Google

2013-05-19 15:38 - 2013-04-24 07:21 - 00000000 ____D C:\Program Files (x86)\Google

2013-05-18 17:33 - 2013-05-18 17:33 - 20971520 ____A C:\START(Ipadpass)

2013-05-18 17:32 - 2013-05-18 17:30 - 00000000 ____D C:\Users\Brett\AppData\Roaming\TrueCrypt

2013-05-18 13:53 - 2013-04-25 04:16 - 00000000 ____D C:\Users\Brett\Documents\my games

2013-05-18 12:41 - 2013-04-25 07:11 - 00000000 ___RD C:\Program Files (x86)\Skype

2013-05-18 12:41 - 2013-04-25 07:11 - 00000000 ____D C:\ProgramData\Skype

2013-05-16 13:49 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\rescache

2013-05-14 18:30 - 2013-05-13 15:56 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2013-05-14 18:30 - 2013-05-13 15:56 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2013-05-14 17:28 - 2013-04-30 12:10 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Audacity

2013-05-14 15:58 - 2013-05-14 15:58 - 02143832 ____A C:\Users\Brett\Downloads\instsf449.exe

2013-05-14 15:58 - 2013-05-14 15:58 - 00001007 ____A C:\Users\UpdatusUser\Desktop\SpeedFan.lnk

2013-05-14 15:58 - 2013-05-14 15:58 - 00000045 ____A C:\Windows\SysWOW64\initdebug.nfo

2013-05-14 15:58 - 2013-05-14 15:58 - 00000000 ____D C:\Program Files (x86)\SpeedFan

2013-05-14 15:57 - 2013-04-25 03:42 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Mozilla

2013-05-14 15:23 - 2013-05-14 15:22 - 00000000 ____D C:\Users\Brett\AppData\Roaming\WinRAR

2013-05-14 15:22 - 2013-05-14 15:22 - 00000000 ____D C:\Program Files (x86)\WinRAR

2013-05-14 15:16 - 2013-05-14 15:16 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Rainmeter

2013-05-14 15:10 - 2013-05-14 15:10 - 00000000 ____D C:\Program Files\Rainmeter

2013-05-14 15:00 - 2009-07-13 20:45 - 00376400 ____A C:\Windows\System32\FNTCACHE.DAT

2013-05-14 13:04 - 2013-04-26 01:41 - 75016696 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe

2013-05-13 16:19 - 2013-05-13 16:19 - 00000000 ____D C:\Users\Brett\Documents\Rainmeter

2013-05-13 16:18 - 2013-04-29 17:16 - 00000000 ____D C:\ProgramData\Package Cache

2013-05-13 15:59 - 2013-05-13 15:59 - 00000000 ____D C:\Users\Brett\AppData\Local\SplitMediaLabs

2013-05-13 15:57 - 2013-05-13 15:57 - 00000000 ____D C:\ProgramData\SplitMediaLabs

2013-05-13 15:56 - 2013-05-13 15:56 - 00000000 ____D C:\Windows\SysWOW64\Macromed

2013-05-13 15:56 - 2013-05-13 15:56 - 00000000 ____D C:\Windows\System32\Macromed

2013-05-13 15:56 - 2013-05-13 15:56 - 00000000 ____D C:\Users\Brett\AppData\Roaming\SplitMediaLabs

2013-05-13 15:50 - 2013-05-13 15:45 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Origin

2013-05-13 15:50 - 2013-05-13 15:44 - 00000000 ____D C:\ProgramData\Origin

2013-05-13 15:45 - 2013-05-13 15:45 - 00000000 ____D C:\Users\Brett\AppData\Local\Origin

2013-05-13 15:45 - 2013-05-13 15:45 - 00000000 ____D C:\Program Files (x86)\Origin Games

2013-05-13 15:44 - 2013-05-13 15:44 - 00000000 ____D C:\ProgramData\Electronic Arts

2013-05-13 14:07 - 2013-05-13 14:07 - 00000000 ____D C:\Users\Brett\Documents\Image-Line

2013-05-13 14:07 - 2013-05-13 14:07 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Image-Line

2013-05-13 14:07 - 2013-05-13 14:07 - 00000000 ____D C:\Program Files\Image-Line

2013-05-13 14:07 - 2013-05-13 14:07 - 00000000 ____D C:\Program Files (x86)\ASIO4ALL v2

2013-05-13 14:07 - 2013-05-13 14:05 - 00000000 ____D C:\Program Files (x86)\Image-Line

2013-05-13 14:06 - 2013-05-13 14:06 - 00000000 ____D C:\Users\Brett\AppData\Roaming\FlowStone

2013-05-13 14:06 - 2013-05-13 14:06 - 00000000 ____D C:\Program Files (x86)\DSPRobotics

2013-05-13 14:05 - 2013-05-13 13:59 - 307359850 ____A (Image-Line) C:\Users\Brett\Downloads\flstudio_11.exe

2013-05-13 13:58 - 2013-05-13 13:58 - 00000000 ____D C:\Users\Brett\AppData\Local\getsav-in

2013-05-12 06:14 - 2013-05-12 06:14 - 00069632 ____A C:\Users\Brett\Documents\WHEA 1.evtx

2013-05-12 05:43 - 2013-04-25 01:01 - 00108016 ____A C:\Users\Brett\AppData\Local\GDIPFONTCACHEV1.DAT

2013-05-11 13:26 - 2013-04-25 03:57 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Corsair

2013-05-11 08:57 - 2013-05-11 08:57 - 00287956 ____A C:\Windows\msxml4-KB954430-enu.LOG

2013-05-11 08:57 - 2013-05-11 08:57 - 00284150 ____A C:\Windows\msxml4-KB973688-enu.LOG

2013-05-11 08:57 - 2013-05-11 08:57 - 00000000 ____D C:\Program Files (x86)\MSXML 4.0

2013-05-10 19:44 - 2013-05-10 19:44 - 00000000 ____D C:\Users\Brett\AppData\Local\Autodesk,_Inc

2013-05-10 19:44 - 2013-05-10 18:33 - 00000000 ____D C:\Users\Brett\AppData\Roaming\Autodesk

2013-05-10 19:42 - 2013-05-10 19:42 - 00000000 ____D C:\Users\Brett\AppData\Local\Granta Design

2013-05-10 19:42 - 2013-05-10 18:51 - 00000000 ____D C:\Users\Brett\Documents\Inventor

2013-05-10 19:42 - 2013-05-10 18:33 - 00000000 ____D C:\ProgramData\Autodesk

2013-05-10 19:41 - 2013-05-10 19:41 - 00000000 ____D C:\ProgramData\FLEXnet

2013-05-10 19:41 - 2013-05-10 18:41 - 00000000 ____D C:\Users\Brett\AppData\Local\Autodesk

2013-05-10 19:07 - 2013-05-10 19:07 - 00000000 ____D C:\ProgramData\FARO

2013-05-10 18:50 - 2013-05-10 18:50 - 00000000 ____D C:\Users\Brett\Documents\Autodesk

2013-05-10 18:50 - 2013-05-10 18:50 - 00000000 ____D C:\Program Files\Common Files\Macrovision Shared

2013-05-10 18:50 - 2013-05-10 18:41 - 00000000 ____D C:\Program Files\Common Files\Autodesk Shared

2013-05-10 18:49 - 2013-05-10 18:41 - 00000000 ____D C:\Users\Public\Documents\Autodesk

2013-05-10 18:44 - 2013-05-10 18:44 - 00000000 ____D C:\Program Files (x86)\Autodesk

2013-05-10 18:43 - 2013-05-10 18:41 - 00000000 ____D C:\Program Files\Autodesk

2013-05-10 18:41 - 2013-05-10 18:41 - 00000000 ____D C:\Program Files (x86)\DWG TrueView 2014

2013-05-10 18:37 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared