Jump to content

Infected computer and need assistance please

shnncof
 Share

Recommended Posts

shnncof

shnncof

Posted
Posted

About a month ago my computer was infected, one of the infections was RogueWin32/FakeRean and it completely froze up my computer. Took me days to finally find a way to get around it enough that I could scan my computer with Malware. Thought that I had gotten them all removed because my computer went back to normal and nothing was showing up with scans until about 2 weeks later. As soon as I turned my computer on one day, after 3 days of not using it at all, I got warnings my pc was infected. Scanned and had a list of things show up. Problem is, I have deleted, run anti-virus tools, removal tools, and either they reinstall or new ones show up. I cannot get rid of them. Computer is slow, doesn't repsond at all at times, and I get website redirects all of the time too. Any assistance in removing these infections and help in clearing up my computer would be greatly appreciated.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Hello and :welcome:

 

Please run the following and post back the logs on your next reply.  I'll check back on you again some time later tomorrow.

 

 

STEP 01

Backup the Registry:

Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.
 

  • Please download ERUNT from one of the following links: Link1 | Link2 | Link3
  • ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
  • Double click on erunt-setup.exe to Install ERUNT by following the prompts.
  • Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
  • Choose a location for the backup.
    • Note: the default location is C:\Windows\ERDNT which is acceptable.
  • Make sure that at least the first two check boxes are selected.
  • Click on OK
  • Then click on YES to create the folder.

Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe


STEP 02

Please download Malwarebytes Anti-Rootkit from HERE


  • Unzip the contents to a folder in a convenient location.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
  • Wait while the system shuts down and the cleanup process is performed.
  • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
  • When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt


STEP 03

Please download Junkware Removal Tool to your desktop.


  • Shutdown your antivirus to avoid any conflicts.
  • Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next reply message
  • When completed make sure to re-enable your antivirus



STEP 04

Please download AdwCleaner by Xplode to your desktop.


  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • If prompted by the User Account Control click Yes to allow it to run.
  • Under Actions click on the Delete button.
  • Click OK on all prompts.
  • You will be prompted to restart your computer. A text file will open after the restart.
  • Please post the entire contents of that logfile to your next reply.
  • You can find the logfile at C:\AdwCleaner[s1].txt where the number in brackets indicates how often it was run.


STEP 05

button_eos.gif

Please go here to run the online antivirus scannner from ESET.


  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Click Scan
  • Wait for the scan to finish
  • If any threats were found, click the 'List of found threats' , then click Export to text file....
  • Save it to your desktop, then please copy and paste that log as a reply to this topic.

 

 

 

Thanks

 

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

Here is the Mbar log:

 

Malwarebytes Anti-Rootkit BETA 1.06.0.1004
www.malwarebytes.org

Database version: v2013.06.01.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
Shannon Shoemake :: SHANNONSHOEMAKE [administrator]

6/24/2013 2:21:08 PM
mbar-log-2013-06-24 (14-21-08).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 234808
Time elapsed: 15 minute(s), 16 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

 

 

Here is the system log:

 

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.06.0.1004

© Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 10.0.9200.16618

Java version: 1.6.0_33

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 2.194000 GHz
Memory total: 2074062848, free: 450621440

Initializing...
------------ Kernel report ------------
     06/24/2013 14:20:49
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\iaStor.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\system32\drivers\mfehidk.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\mfewfpk.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\DRIVERS\disk.sys
\SystemRoot\system32\DRIVERS\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\mwlPSDFilter.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mwlPSDVDisk.sys
\SystemRoot\system32\DRIVERS\mwlPSDNServ.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\usbuhci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\bcmwl664.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\drivers\i8042prt.sys
\SystemRoot\system32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\drivers\wmiacpi.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\mfeavfk.sys
\SystemRoot\system32\drivers\mfefirek.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\drivers\mfeapfk.sys
\SystemRoot\system32\drivers\cfwids.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
\Windows\System32\normaliz.dll
\Windows\System32\msvcrt.dll
\Windows\System32\urlmon.dll
\Windows\System32\oleaut32.dll
\Windows\System32\Wldap32.dll
\Windows\System32\imagehlp.dll
\Windows\System32\ws2_32.dll
\Windows\System32\shlwapi.dll
\Windows\System32\setupapi.dll
\Windows\System32\msctf.dll
\Windows\System32\clbcatq.dll
\Windows\System32\user32.dll
\Windows\System32\iertutil.dll
\Windows\System32\kernel32.dll
\Windows\System32\difxapi.dll
\Windows\System32\psapi.dll
\Windows\System32\rpcrt4.dll
\Windows\System32\gdi32.dll
\Windows\System32\imm32.dll
\Windows\System32\advapi32.dll
\Windows\System32\sechost.dll
\Windows\System32\lpk.dll
\Windows\System32\ole32.dll
\Windows\System32\wininet.dll
\Windows\System32\nsi.dll
\Windows\System32\comdlg32.dll
\Windows\System32\usp10.dll
\Windows\System32\shell32.dll
\Windows\System32\wintrust.dll
\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
\Windows\System32\cfgmgr32.dll
\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
\Windows\System32\devobj.dll
\Windows\System32\KernelBase.dll
\Windows\System32\crypt32.dll
\Windows\System32\comctl32.dll
\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
\Windows\System32\msasn1.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa80026e5790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa800221e050
Lower Device Driver Name: \Driver\iaStor\
<<<2>>>
Device number: 0, partition: 3
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa80026e5790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800272c040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80026e5790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800221e050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
Device number: 0, partition: 3
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 3
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Read File: File "c:\Windows\System32\drivers\acpipmi.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\acpipmi.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\adp94xx.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\adp94xx.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\adpahci.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\adpahci.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\adpu320.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\adpu320.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\aliide.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\aliide.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\amdide.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\amdide.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\amdk8.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\amdk8.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\amdppm.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\amdppm.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\amdsata.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\amdsata.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\amdsbs.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\amdsbs.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\amdxata.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\amdxata.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\arc.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\arc.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\b57nd60a.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\b57nd60a.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\BCMWL664.SYS" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\BCMWL664.SYS" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\blbdrive.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\blbdrive.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\BrFiltLo.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\BrFiltLo.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\BrFiltUp.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\BrFiltUp.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\BrSerId.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\BrSerId.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\BrSerWdm.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\BrSerWdm.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\BrUsbMdm.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\BrUsbMdm.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\BrUsbSer.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\BrUsbSer.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\bthmodem.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\bthmodem.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\bxvbda.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\bxvbda.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\cfwids.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\cfwids.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\circlass.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\circlass.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\cmdide.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\cmdide.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\compbatt.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\compbatt.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\crcdisk.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\crcdisk.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\elxstor.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\elxstor.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\evbda.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\evbda.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\fdc.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\fdc.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\flpydisk.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\flpydisk.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\fssfltr.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\fssfltr.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\hcw85cir.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\hcw85cir.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\hidbatt.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\hidbatt.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\hidbth.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\hidbth.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\hidir.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\hidir.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\HipShieldK.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\HipShieldK.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\HpSAMD.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\HpSAMD.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\iaStor.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\iaStor.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\iaStorV.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\iaStorV.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\igdkmd64.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\igdkmd64.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\intelide.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\intelide.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\IPMIDrv.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\IPMIDrv.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\KMWDFILTER.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\KMWDFILTER.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\L1C62x64.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\L1C62x64.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\lsi_fc.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\lsi_fc.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\lsi_sas.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\lsi_sas.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\lsi_sas2.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\lsi_sas2.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\arcsas.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\arcsas.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\GAGP30KX.SYS" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\GAGP30KX.SYS" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\iirsp.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\iirsp.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\lsi_scsi.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\lsi_scsi.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\UBHelper.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\UBHelper.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\vgapnp.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\vgapnp.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mbam.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mbam.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mbamchameleon.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mbamchameleon.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mbamswissarmy.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mbamswissarmy.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\megasas.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\megasas.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\MegaSR.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\MegaSR.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mfeapfk.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mfeapfk.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mfeavfk.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mfeavfk.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mfeclnk.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mfeclnk.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mfefirek.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mfefirek.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mfehidk.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mfehidk.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mferkdet.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mferkdet.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mfewfpk.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mfewfpk.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\MpFilter.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\MpFilter.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\msahci.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\msahci.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\MTConfig.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\MTConfig.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mwlPSDFilter.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mwlPSDFilter.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mwlPSDNserv.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mwlPSDNserv.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\mwlPSDVDisk.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\mwlPSDVDisk.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\nfrd960.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\nfrd960.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\NisDrvWFP.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\NisDrvWFP.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\NTIDrvr.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\NTIDrvr.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\nvraid.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\nvraid.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\nvstor.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\nvstor.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\NV_AGP.SYS" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\NV_AGP.SYS" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\parport.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\parport.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\pcmcia.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\pcmcia.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\processr.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\processr.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\ql2300.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\ql2300.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\ql40xx.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\ql40xx.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\rdpbus.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\rdpbus.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RTConvEQ.dat" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RTConvEQ.dat" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RTEQEX0.dat" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RTEQEX0.dat" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RTEQEX1.dat" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RTEQEX1.dat" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RTEQEX2.dat" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RTEQEX2.dat" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RTEQEX3.dat" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RTEQEX3.dat" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RTHDAEQ1.dat" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RTHDAEQ1.dat" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RtHdatEx.dat" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RtHdatEx.dat" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\rtkhdaud.dat" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\rtkhdaud.dat" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RTKVHD64.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RTKVHD64.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RtPCEE3.DAT" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RtPCEE3.DAT" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\RtsUStor.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\RtsUStor.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\sbp2port.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\sbp2port.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\secdrv.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\secdrv.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\serenum.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\serenum.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\serial.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\serial.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\sfloppy.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\sfloppy.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\sisraid2.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\sisraid2.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\sisraid4.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\sisraid4.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\stexstor.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\stexstor.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\swenum.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\swenum.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\SynTP.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\SynTP.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\UAGP35.SYS" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\UAGP35.SYS" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\ULIAGPKX.SYS" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\ULIAGPKX.SYS" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\umpass.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\umpass.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\usbcir.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\usbcir.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\viaide.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\viaide.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\vsmraid.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\vsmraid.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\wacompen.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\wacompen.sys" is compressed (flags = 1)
Read File: File "c:\Windows\System32\drivers\wd.sys" is compressed (flags = 1)
Read File: File "C:\Windows\system32\drivers\wd.sys" is compressed (flags = 1)
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: C8410CF0

Partition information:

    Partition 0 type is Other (0x27)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 2048  Numsec = 27262976

    Partition 1 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 27265024  Numsec = 204800
    Partition file system is NTFS
    Partition is bootable

    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 27469824  Numsec = 460924928

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0

Disk Size: 250059350016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-488377168-488397168)...
Done!
Read File: File "c:\programdata\bkimagehun.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageita.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagejpn.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagekor.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageloc.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagelth.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagelvi.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagenld.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagenor.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageplk.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageptb.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageptg.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagerom.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagerus.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagesky.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageslv.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagesve.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkaux.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxbgr.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxchs.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxcht.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxcsy.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxdan.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxdeu.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxell.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxesn.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxeti.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxfin.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxfra.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxhrv.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxhun.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkauxzhh.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagehrv.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagetrk.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowdeu.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowjpn.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowptg.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayhrv.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraytrk.dll" is compressed (flags = 1)
Read File: File "c:\programdata\hddrw32.dll" is compressed (flags = 1)
Read File: File "c:\programdata\migratecht.dll" is compressed (flags = 1)
Read File: File "c:\programdata\migratenor.dll" is compressed (flags = 1)
Read File: File "c:\programdata\npf.ico" is compressed (flags = 1)
Read File: File "c:\programdata\ntiinteractivedialogdan.dll" is compressed (flags = 1)
Read File: File "c:\programdata\ntiinteractivedialognld.dll" is compressed (flags = 1)
Read File: File "c:\programdata\ntimailloc.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagezhh.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnow.exe" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnow.ini" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowbgr.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowbgr.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowchs.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowchs.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowcht.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowcht.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowcsy.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowcsy.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowdan.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowdan.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowdeu.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowell.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowell.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowesn.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowesn.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnoweti.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnoweti.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowfin.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowfin.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowfra.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowfra.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowhrv.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowhrv.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowhun.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowhun.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowita.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowita.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowjpn.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowkor.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowkor.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowloc.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowloc.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowlth.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowlth.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowlvi.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowlvi.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnownld.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnownld.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnownor.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnownor.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowplk.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowplk.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowptb.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowptb.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowptg.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowrom.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowrom.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowrus.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowrus.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowsky.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowsky.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowslv.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowslv.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowsve.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowsve.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowtrk.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowtrk.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowzhh.chm" is compressed (flags = 1)
Read File: File "c:\programdata\bkupnowzhh.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimage.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagebgr.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagechs.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagecht.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagecsy.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagedan.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagedeu.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageell.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageesn.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimageeti.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagefin.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkimagefra.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptray.exe" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraybgr.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraychs.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraycht.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraycsy.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraydan.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraydeu.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayell.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayesn.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayeti.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayfin.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayfra.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayhun.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayita.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayjpn.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraykor.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayloc.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraylth.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraylvi.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraynld.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraynor.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayplk.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayptb.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayptg.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayrom.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayrus.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraysky.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayslv.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptraysve.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bkuptrayzhh.dll" is compressed (flags = 1)
Read File: File "c:\programdata\blockdll.dll" is compressed (flags = 1)
Read File: File "c:\programdata\bunsplash.bmp" is compressed (flags = 1)
Read File: File "c:\programdata\burner list.txt" is compressed (flags = 1)
Read File: File "c:\programdata\cdrmmc32.dll" is compressed (flags = 1)
Read File: File "c:\programdata\cdrw32.bdb" is compressed (flags = 1)
Read File: File "c:\programdata\cdrw32.dll" is compressed (flags = 1)
Read File: File "c:\programdata\cdrwex32.dll" is compressed (flags = 1)
Read File: File "c:\programdata\compdir.dll" is compressed (flags = 1)
Read File: File "c:\programdata\data32.dll" is compressed (flags = 1)
Read File: File "c:\programdata\dataex32.dll" is compressed (flags = 1)
Read File: File "c:\programdata\imagfile.dll" is compressed (flags = 1)
Read File: File "c:\programdata\logfile.dll" is compressed (flags = 1)
Read File: File "c:\programdata\mfc71.dll" is compressed (flags = 1)
Read File: File "c:\programdata\migrate.dll" is compressed (flags = 1)
Read File: File "c:\programdata\migratebgr.dll" is compressed (flags = 1)
Read File: File "c:\programdata\migratechs.dll" is compressed (flags = 1)
Read File: File "c:\ProgramData\McAfee\MNA\NAData" is compressed (flags = 1)
Read File: File "c:\ProgramData\McAfee\MNM\NDData" is compressed (flags = 1)
Read File: File "c:\ProgramData\McAfee\msc\McUsers.dat" is compressed (flags = 1)
Read File: File "c:\ProgramData\McAfee\SiteAdvisor\SA.dat" is compressed (flags = 1)
Read File: File "c:\programdata\client\ace.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\acexml.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\acexml_parser.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\agentsvc.exe" is compressed (flags = 1)
Read File: File "c:\programdata\client\agent_stub.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\bkuptray.exe" is compressed (flags = 1)
Read File: File "c:\programdata\client\listor.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\locator.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\mfc71.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\mfc71u.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\msvcp71.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\msvcr71.dll" is compressed (flags = 1)
Read File: File "c:\programdata\client\ntibackup.exe" is compressed (flags = 1)
Read File: File "c:\programdata\client\svc.conf" is compressed (flags = 1)
Read File: File "c:\programdata\logs\backupsvc.log" is compressed (flags = 1)
Read File: File "c:\programdata\logs\scheduler.log" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_086d2b0dd413d33f8f228216083842f1_31bf3856ad364e35_6.1.7601.17725_none_8d01a7aa060b4f4d.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_152d8e5975884d6ee913ae7045b2153a_31bf3856ad364e35_6.1.7601.21861_none_fa86e5b61ff753a0.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_3b2f68fe4d68a47f39836a59384bb797_31bf3856ad364e35_6.1.7600.21092_none_7caaba89deb50f41.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_5d45097eb426019b8290506e5b7faa24_31bf3856ad364e35_6.1.7600.16841_none_29fb2b5f4788482f.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_621937a9db63a967555f2004a79aaec9_31bf3856ad364e35_6.1.7601.21861_none_291cf0508f2b2a07.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_9466e75ec52f89a773df7771ecebbb6d_31bf3856ad364e35_6.1.7600.21092_none_385228be4652a244.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_a8a83e5f450a757f9d3b3629706fd8d1_31bf3856ad364e35_6.1.7600.21092_none_6457ad66e70e0805.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_f3d3ffe49e904c155ab6ba8195455abf_31bf3856ad364e35_6.1.7600.16915_none_553a0e884df335ab.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_f63dbca4ee99931ebcbb2ecdcb5ae3fc_31bf3856ad364e35_6.1.7600.16915_none_024809eb54bba0b9.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7600.16915_none_b5178ac115a5de10.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7600.21092_none_b5477d8a2f074778.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_microsoft-windows-r..gistry-trustedtypes_31bf3856ad364e35_6.1.7600.16841_none_e01a334047fc404c.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_4ba20878e436a9a2cc4424b6f12b134d_31bf3856ad364e35_6.1.7600.21092_none_e9904ffd5d7e85db.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\amd64_b19a5ee2a27d1e0cad1ccbb597005492_31bf3856ad364e35_6.1.7601.17725_none_6e951d24477b8b28.manifest" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_1_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_6_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_8_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_for_kb2644615_sp1_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_1_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_1_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_2_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_2_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_2_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_3_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_3_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_4_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_4_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_4_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_4_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_5_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_5_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_5_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_6_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_6_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_6_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_7_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_7_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_7_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_7_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_8_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_8_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_10_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_10_for_kb2644615_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_10_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_10_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_8_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_9_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_9_for_kb2644615~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_for_kb2644615_rtm_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_for_kb2644615_rtm~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_for_kb2644615_sp1_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_for_kb2644615_sp1~31bf3856ad364e35~amd64~~6.1.1.0.cat" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\package_for_kb2644615_sp1~31bf3856ad364e35~amd64~~6.1.1.0.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\update-bf.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\update.mum" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\windows6.1-kb2644615-x64-express.cab" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\windows6.1-kb2644615-x64.psf.cix.xml" is compressed (flags = 1)
Read File: File "c:\program files\common files\microsoft shared\wow64_microsoft-windows-ntdll_31bf3856ad364e35_6.1.7600.16915_none_bf6c35134a06a00b.manifest" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1024.db" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF95B77A1A4781B2FF.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DFCDFDA2B7E547E2FB.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DFF725B1AC3017AA3E.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF32814C4192B83E82.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF360208A5878F4619.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF5B6B2021D02B3BBC.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF68AA53DD55EEF4C3.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF8163DEF79064C124.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF008B8E1066335304.TMP" is compressed (flags = 1)
Read File: File "c:\Windows\WindowsUpdate.log" is compressed (flags = 1)
Read File: File "c:\windows\media\trado.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\trajanpro-bold.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\trajanpro-regular.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\trebuc.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\trebucbd.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\trebucbi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\trebucit.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\unpact__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcdb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcdbi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcdi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcdl.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upceb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcebi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcei.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcel.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcfb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcfbi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcfi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcib.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcibi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcii.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcil.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcjb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcjbi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcji.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcjl.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upckb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upckbi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcki.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upckl.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upclb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upclbi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcli.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\upcll.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\utsaah.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\utsaahb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\utsaahi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\valken__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\vani.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\vanib.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\velve___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\verdana.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\verdanab.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\verdanai.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\verdanaz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\acme____.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\antquai.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\arialnb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\bobcat.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\browaz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\constan.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\gothici.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\abbess__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\acaslonpro-bold.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\acaslonpro-bolditalic.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\acaslonpro-italic.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\acaslonpro-regular.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\acaslonpro-semibold.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\acaslonpro-semibolditalic.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\acclait_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\aparaj.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\aparajb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\aparajbi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\aparaji.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\arabtype.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\arialn.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\arialnbi.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\arialni.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\arialuni.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\ariblk.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\asimov.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\autumn__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\babyk___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\ballet__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\balth___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\bandi___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\bangle__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\bastion_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\birchstd.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\bkant.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\blackoakstd.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\bnjinx.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\bnmachine.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\brushscriptstd.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\bruss___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\bssym7.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\calibrib.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\calli___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\calviit_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\calvin__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cambria.ttc" is compressed (flags = 1)
Read File: File "c:\windows\media\cambriab.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cambriai.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cambriaz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\candara.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\candarab.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\candarai.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\candaraz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\candles_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\century.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\chaparralpro-bold.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\chaparralpro-boldit.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\chaparralpro-italic.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\chaparralpro-regular.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\charlemagnestd-bold.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\chinyen.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\clare___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\colbert_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\comic.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\comicbd.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\commons_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\consola.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\consolab.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\consolai.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\consolaz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\constanb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\constani.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\constanz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cools___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cooperblackstd-italic.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\cooperblackstd.otf" is compressed (flags = 1)
Read File: File "c:\windows\media\coprgtb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\coprgtl.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\corbel.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\corbelb.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\corbeli.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\corbelz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cordia.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cordiab.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cordiai.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cordiau.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cordiaub.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cordiaui.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cordiauz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cordiaz.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\corpo___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\cracj___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\crand___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\creerg__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\curlz___.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\daunpenh.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\david.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\davidbd.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\dayton__.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\deneane_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\detente_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\dicotbo_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\dicotli_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\dicotme_.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\digifit.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\distant galaxy 2.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\dokchamp.ttf" is compressed (flags = 1)
Read File: File "c:\windows\media\domin___.ttf" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF68AA53DD55EEF4C3.TMP" is compressed (flags = 1)
Read File: File "c:\Users\Shannon Shoemake\AppData\Local\Temp\~DF68AA53DD55EEF4C3.TMP" is compressed (flags = 1)
Scan finished
=======================================


Removal queue found; removal started
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\bootstrap_0_1_27265024_i.mbam...
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_r.mbam...
Removal finished

Will now do step 3 and report back

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

Here is the JRT log:

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.9.4 (05.06.2013:1)
OS: Windows 7 Home Premium x64
Ran by Shannon Shoemake on Mon 06/24/2013 at 14:53:58.12
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}



~~~ Files



~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"
Successfully deleted: [Folder] "C:\ProgramData\partner"
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{00049BF5-B23B-4A62-9B8B-1BE2F20CC6CF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{002A2AA0-4430-486A-A22E-AC6E0DD6B4C3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{00A63229-23A9-4FC6-B1C5-6BD2A891B89E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{00ACA271-1271-4FB1-896E-6C4DE3D1D8AF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{00BE7373-CFE7-4847-909B-DDC0EFB9671B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{00D5B584-C856-4861-A3C2-D56A5B85F410}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{00E317B2-CB2E-40E4-A7C1-4D054C576806}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{00F70E6D-7438-4107-979D-4FB8E4D4907A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{010F310E-B9F8-4005-9D9B-6CE7F3E41D7E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0140EBC0-95C3-4ED9-9100-774C6194E9DD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{018E91B3-0EE0-4C70-A095-4C6E8F48607F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{01A47D1F-5ED8-4665-9523-F66228DE390B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{022EE563-B9CB-42B5-9C89-79DB883657F2}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{04D8F5A6-DD21-4BEA-8DD7-1167028785CF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{04DDCA5C-3001-4D60-BF7E-30705FD221E8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{05DCF7E1-91A2-4180-B9F0-AAB3B469BF6A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0608CF88-3B39-402C-B590-4CD5448DCAC4}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{06666D27-01C5-405C-A1CB-4CF342C045EC}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{067FBAEB-3A3A-4934-8FFA-FBBA4C0FF85F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{06A319B8-7B3D-4EF9-9EA9-DDFD0D44297C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0740EA81-448A-4551-8CCB-7E0287A04ADA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0816A828-9EDB-4A7F-BAFF-94F30E0EE1CE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{09214C36-DDD0-4E7C-B98E-088CB0F041BA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{097A7642-BFD4-42AC-B8ED-086FF6EEE4A5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{09A7873D-A23A-4870-BEE7-59D19AD7BF42}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0B57CDC9-BA07-4AFE-8475-8B46A0545E7C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0BA80DB0-7A92-4A12-88EB-2B2A07C04610}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0C121C64-3BB5-4E31-94CA-FBF655C382EA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0C96D488-BAF2-4E4B-983A-AD29F0C5F420}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0CA9029A-EBA6-4364-BED4-5D3796E98677}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0DA2FCB8-A1FF-4DE6-87ED-C223332CA0F8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0E02E5D2-4A18-4F9E-9F55-C1D06F884B59}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0EB9C444-D081-4B90-9A9B-549F6ED4D68F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0EBEF910-D390-42A5-A71F-1593D25FA1EB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0F0C44DE-3002-4E0F-948B-7AD88CF25550}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0F886BD9-E8E3-4AB5-AC22-66EC3BC95A23}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{0F9D4C7C-6A95-4624-9C73-0A4AF2108275}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{116B9CD5-6FFA-4D64-B94B-C1CB7943E7C8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{11945FA4-8EE7-44C5-8399-4B90F9630EB3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{11AA19AF-1976-4AC0-AA2C-D3184103BADD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{11F50AC2-9A91-45C0-ACBD-65B7679ADFCA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{129491AC-9E59-4286-A614-BE8D65F910DA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{12E7A79E-191B-4BEF-9E22-7C27F1DDBAF3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1349C112-734C-4DA2-8B84-966E9B89C8AE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{13D204EE-7CBB-48B2-AF8A-727E14E02F4E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{148E7185-D6F9-4DAB-AD60-A9E6C9D687AD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{149394E0-5D22-4292-AC1C-C16DF9F477B5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{14C4D822-CFFC-4CD2-9C9F-9A5501C7487B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{14FCEA16-75D4-4392-B02E-33BB398D4891}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1536F058-FC67-43DD-AB9B-49C82C14A410}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1642474D-555A-4851-90CA-572D152296BF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{16E46DBE-8177-46F3-8ABD-D351F02B191A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{17AB46DC-50AD-42D8-875F-857D8B95A012}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{18C38BFB-AFC8-4AE4-8508-A9BB51003411}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1906C82F-9606-4C11-B541-E1304C38BDF3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{198C210C-CAF7-41D1-8635-EA80D96BDA9E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1A60394D-E967-41D3-9DD6-D6DA3D0F0DDF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1BC21DB5-E66A-405E-9026-60D9968D9190}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1CA3051F-105B-424F-9A8A-7FBCEABC31CC}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1E346D45-B472-45B1-9DE2-D6EF4D6B3400}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{1F51D0DC-7717-4422-AAD5-059F77527BFE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{20482BFF-8F05-4CD1-BA5B-4ED46AE5973C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{21410092-67C6-4E4E-8BBE-C3D8D464BADC}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{21534725-7FED-4FA7-94F0-1034522DED86}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{215435F3-C339-47E8-9E44-D668072F051D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{223C3324-B873-4A13-A2A3-4B90AFA6BCCA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{22E487F8-59CA-4E00-8E76-71CA90B36E98}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{23012E8C-0ED9-4C3A-9171-3933BE766BDF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{231A1337-25C6-46D2-B4BB-5BD2AA82462D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{247A1D75-C4C0-4EFE-AB57-1C0698162715}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{26E00CA1-2F6F-4CED-98F2-CDBEF61E15C9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2720F4F5-519B-4088-A41B-BDDA8471E62C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{27F49EA6-18A3-4B13-90C3-2F0E5750ACF0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2967B415-9879-47C0-AE74-B35C57611326}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{29BA8D0F-76DA-4A2D-8BCE-456FB6C16A9B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{29E9E90D-9F24-4BA1-80A5-14338659F75E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2A239AC1-6B93-4FD5-9614-BC885E5C6231}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2B2ADB0A-9309-430D-838E-72B871A6AD53}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2B4C7DE4-7C39-4107-8764-AC31826068C0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2B63E5D7-9805-4440-B1EF-376EADEEE3CA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2B8F6EDB-A87D-4764-B459-7E317371D11D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2BB9C58D-645E-4CF9-8823-87C8D0054431}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2BC8ED5C-D599-44B2-94E3-3C008081FCB9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2BFAE366-9157-43FF-9CEF-D53C25BB26B1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2D0708C1-5FDA-4AEC-A344-57396141D31C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2D5D819A-7A31-4EFF-A62E-EE8E2E6D4DFC}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2D6D916A-5B90-463A-9115-7F1F10EA9672}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2DA76C6F-9164-4EE2-A0E2-A0F267B0EC5A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2DDC5F3D-EB7F-401C-B1AD-382C79A44E20}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2E4F3B7D-9579-4338-BBF2-A82BBD060A65}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2E90DDB6-3ACD-4762-AD1C-B9638A90129D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2EB3C0E1-9D6E-4890-B549-6BC7414BDEE8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{2EFC5282-DE09-44C0-91BA-FECDFB8FDE98}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{303FADAB-704B-46FB-8196-ADBE249519D6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{30EFDFED-3234-4160-9374-922988A9F6A6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3185A2C4-8DBE-438B-9358-FC5BCE629988}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{31A1370D-6B05-48CA-9388-871020C61F50}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{31EDAFB7-65FC-44B7-B01B-9A4E77A2CD74}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{32BAF91F-4189-47EB-B22B-AF6569B1DAC1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3455CA79-6F99-4BD0-92C1-8C578CC853AC}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{34C47274-E20E-47DE-94B5-5660FB6766D3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{35B4428D-4448-4123-94E1-51EF865A0FB8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{35BC39EA-A8C9-45DF-8FFD-71458FC46852}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{36294743-EBBA-4495-8521-6997402B04A0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{37507D95-6821-4BEB-9353-CDD8BCB8C967}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{37D2D74E-C855-455C-8516-7E29A9ADE54E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{390A7761-7A33-4416-80A2-FA8C4952054A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{390CCABD-9D6D-408D-A2BF-46502ED88F62}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3938F5C8-7F67-4DFA-ABBE-0F64E8DA6016}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{39501F36-3DAB-4F3F-875D-23EB7445F4A8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3951F0BE-342B-4FE5-9D39-545867E4EEC3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3B5B9E69-5B6B-4E23-838B-934042A29BEB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3BB3CEE1-F65E-4947-B6D7-F14D06E34817}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3C83FCA4-0D08-4A0C-8389-C4424BAA68C4}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3CEB7451-F33F-47EC-97A8-36C79DA814A7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3CED8F4E-6502-4FCA-862E-914EA84391D8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3D1553EC-867F-4F8A-A1EB-D40E2BBEA43C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3D6F651E-68E9-4CE6-AACE-7526FE8BC10B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3DEFB198-CECE-46C8-9AEE-3C76D73C3FD5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3ED4F531-FBEA-4C06-963E-FACB0C4B4C6B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3EE2C52D-EA89-451A-8E5C-0C4A704CB065}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3F9E9369-8BA2-4D77-9D03-53907FF86AA1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{3FEAE037-CF91-4408-9D5E-0B690F2FC4A5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4040490F-ABA1-4868-8A94-8CF95B26A8BE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{40F7C8E0-C0BA-40AF-8457-29B8FE1FB2B3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{413341C7-D306-4FAC-BD0F-9855EB2D90F6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{41380087-31AB-4ED3-8C94-09F62CE489BD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{41C0E332-A413-4E6B-8624-CC4F54A23B0B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{41E2DE15-CC8A-404E-A63E-859E1D403DB0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{42219CD5-C68E-45B9-9010-030E07A23C13}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{42EB71C7-27E4-4C47-A8F5-C8001CCF1268}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{43265E31-D27F-4596-86B2-880BFB556FEA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{43760050-ABF2-4E7F-B090-11D35A50BECB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{44A729D4-864F-4400-808D-908C9B942B41}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{45D7A2BD-51BC-4106-9BFF-A94B67E7E753}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{465DDED2-337A-441B-B812-368D233CE3EF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{46E8D943-C095-461E-945B-E155959CB89C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4711B4C7-C05D-43D7-96E0-95064BB481DB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{48D2A9DC-33EF-4119-A46D-34F726866D88}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{48F1BA13-2A39-42C8-B68B-BE48329CD90D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{49CBD6E2-7948-4A80-9AF1-7D80C378AC5A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4A00F991-C63F-4559-83BE-9C2092FD4B74}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4A386B2A-5E1E-4AB0-9F01-680CC7042737}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4A7ABDB4-D603-4203-BA34-EC8B868AF691}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4AEDE148-6FA9-4653-B582-765AAD45B0DF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4B0D19A1-C579-49CF-9223-2036BCD6F178}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4B176CA6-2657-4D17-A22E-1ACF0FBD1A82}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4C186815-4099-4CFD-9DB6-78FB11FADC6C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4C4E81B2-4ACB-4095-BD7E-3DD014BA668D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4CB8DFD1-A5FB-4090-8408-DD31B20AC77E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4E6DF7B2-8B51-4259-BA88-C34314678B7C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4E847136-993E-43A4-8A0A-04E5C1BEDB0C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4EDBD1F5-F491-4874-BD0F-3C13C1D20BBC}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4EF47D6C-2B73-4F12-8254-703E48A4CC27}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4EF5DC50-986D-446B-B2D6-FF4BFA37A572}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4F43835A-932F-4E1F-99AB-1005CA62968C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4F8C3812-C3B4-4A4E-93C5-3D9C2BEEB394}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{4F9110B4-C9F4-4AF2-B967-1B83CEA1483A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{50F5D74D-CAB8-485C-8E66-80C079702DC1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{515F6DDA-1698-419F-8C35-336A643B8DFE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{51626A2D-1349-4A1C-9D43-50EBD413B269}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{517CF3E5-300F-45BE-82BC-D6088E2EAEDC}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{51D20733-2225-4D6F-8E64-2627787DFB22}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5242CB76-A9AF-4CC8-B35D-234884F665F6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{52ABB795-3DA2-4A40-9A2B-C404E5EF17FD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{52F10270-2075-4B46-BB49-6E77FE1FC27F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{535D0E28-E1FB-4F43-B532-13CD1B66165F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{53A0B567-39F7-462C-B78E-80358202084E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{53D04434-943C-4670-B275-B3A6D39E42A9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5445BF83-A43E-4FC4-ACBD-9DDBCC38AC17}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{54950670-31AE-497C-B20B-59E4A0839C38}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{55A4E56C-D2C9-42C6-A713-EB1DC96E72CE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{55B649DB-C1E5-46AD-AD83-F04F1A97E9AA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5601B4BE-A541-40D8-9961-18CA0D406F92}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{578ABD36-10E4-4C1F-877E-9887931890E2}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{58FB40DC-A00F-4E1F-B252-B70EBBD46647}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{59DE1C81-6658-480B-AFA5-DF69AD40DDD0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5A62E488-3060-4F4B-A58E-CFDF9FBEE07D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5A845F60-5F55-42C6-862C-5CD2AE816BC7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5AC54718-8772-4B10-B2A4-055F6D333B5F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5B5B77D3-EBE7-4D88-A74B-FA74A084B3C1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5C0A36D1-D9B8-47FB-BB6A-81C07AEBA87C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5C22B59B-987F-48C8-B6FA-A184ABC39B34}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5CAB9F43-E200-4D41-9CAE-579039B2B42D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5CC89A47-7A33-4CF7-9290-8C266BCC61DD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5CE9C8A0-6897-48B5-A050-BC9C30D6D54E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5D70EB76-1078-422B-B8E5-2D58E3D32334}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5E0EF4D5-F667-4324-AC41-DB47DF66B4F4}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5E76D610-8083-4646-918E-326059348690}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5FA858AF-18EB-444E-8D55-AD7DE4E5AAD3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{5FBE15B5-8E16-4145-9B06-D7CF452AD8D1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{607C1E7E-2FAA-4C11-B698-A18CC5834518}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{61169DCB-8E5F-4100-831B-6679BCA03C5F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{617A449B-6C47-4CD1-B00A-A48277A30201}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{619A2209-7A7F-4AD1-9409-7B9F0C5F3817}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{61D58255-FCAC-4740-8748-C7473C312D6A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{61E42FA1-A7FD-4227-AEBB-55D079878B9B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6291CCFB-7316-4DF1-A52E-EBC7A26DFBBB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{63AA47FA-1865-45B5-AF92-F6E76EEED507}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6520B971-58BB-4B41-921A-E5ED6A686350}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{652777C3-1213-4094-A738-4D8457C4089C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6552FA27-3C5A-4596-ACCE-6ED292BCEB54}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{65F70CC0-ED08-4156-BDBE-1F3805DCE38A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{66A66B7A-AAD2-49C3-B528-8D8EF904831B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{66DBA84B-2824-4A48-8728-4B61701CEBB0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{66E7AED0-4E74-4400-B2BF-220F395E7D80}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{674AC5E7-DBD9-4317-B69C-928A2AEE802C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{68690147-2B8A-4ADB-A145-78DCCEDC1D35}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6A2F1912-4DB3-497C-993D-D2A93291ED74}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6A35BCD7-DE02-4763-821B-808C6413BBC6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6A722ACB-403F-484E-8B9A-F858FDF5AE90}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6CE2DDC5-FABD-4E5B-9C94-AFCD9222CB23}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6D08A709-C9F3-445B-9D31-0FB9D1433F49}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6D627CDC-8BCF-43A4-B667-727EBFF28CE3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6DFCFB27-3982-457D-8276-E60F7986EF54}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6F23A234-36AD-4B40-9BD1-8A672E971B22}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6F5BF6C9-0A51-43EC-BA7F-756D599D4457}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6FA89211-349C-4985-AA3B-1F228556BBB6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6FBEA474-9167-4BEA-A600-BF418A1DEE58}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6FBF2AA0-B203-4861-A68B-3DE7D8AA3A62}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6FC70ACB-CB42-4811-869D-1D2713533190}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{6FE0C7EC-54A2-4405-9E1C-25193F7C79AE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{72A5F1A3-9994-4489-9E83-3D7E1C8E2356}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{72F83A4D-F7B2-4C38-93C6-99C843D25A35}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{744ADB86-765B-4ABC-946A-8A7176D67E7E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{74F9D22A-965D-4D3F-99A3-0526FEEA36F9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7559F8EE-7216-4E44-B05B-7F3F85C71737}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{765D8E0C-273A-4CD1-ACC5-0B36883D87E8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{767BED6F-FD1A-417C-A302-6BE664727A77}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{76A5E918-4F1F-4A74-A4A6-70AF88BAB225}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{76BAF20A-1671-4A76-ADAE-49BE4F62FAE5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{76D19004-A41B-464C-BB4A-8734038EE24C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{776A8255-138A-4327-8FED-D58AB7E7A4D3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{77ACDF2D-3298-48C0-83A2-767A0A354E6B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{783788F1-8C90-4A55-9CDB-D77252B4587B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{78839737-1808-4C6F-922D-3FFC821B5888}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{794EFDB5-0720-4D48-BAAD-F4AB8E1DCC0A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{795220F7-925F-4ACE-9D19-DC30D01C69F9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7A61DF6A-08D7-4133-9427-C4486BDF5548}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7B578CDC-87D9-42D1-8F7E-86C8B89DCA85}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7B5C545C-DC26-433E-B076-C670D31E1313}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7B6A24FC-EAD3-4DBB-9D63-050CFD21D046}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7C4B73BE-816E-42E3-BE72-17069DDCDE8A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7CA23058-693C-4821-A0EA-AC3F9B78E051}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7CBB7BB9-982E-4CFD-9FB0-07681F57AECB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7D690CAB-1422-4215-B0FA-1AB3F3BBDAA1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7E6943F5-85DD-4FD0-A3C9-D784665F4FBE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{7FD810B0-12A2-4AC2-9E1D-5856AC8A9E35}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{820BB852-26B9-457D-99DD-A81764A23D73}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{82132126-50FA-4F3E-836F-9DC0918512CE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{831F16B4-B03C-451D-B3AE-BB85D668C5C5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{835E274F-56D2-4CC2-9368-39CBE16491D1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{83B50945-21EF-4F68-806D-0C21C7179D07}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{83C9F216-E644-4E92-A36C-6A7E950E8C7D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{83F566A0-1984-4C80-85C6-688B980F742D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{84BA99DD-9660-4183-98A6-A8ABE6017FF4}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{852A0DF7-052A-4F6B-A366-16872BFAFE60}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{86F5422B-D700-45CC-B0D4-6DFF3C8E9C1F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{87C34874-9CA4-4EB2-BF6C-5BF6CB291506}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{88A11A74-CEBD-48E3-9B12-C993F05AD075}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{890B6A07-52CE-4684-8D21-B474E23A12B5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8913CA58-0B01-480F-8BBA-E07578A116EF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{896E11FB-0173-437F-9907-9AA9188A84E9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{899A20EA-990F-45E3-B88D-26F87F3F5D00}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{89C8F969-FC01-4538-A4FD-77D382EFBEB1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8A0B9A05-F525-47AA-A57E-604149F24266}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8A2FB8E5-8A27-4637-96EF-569F557A491F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8A481288-BE20-4A46-B70A-8040E0A5360B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8B08B74A-707D-4BFA-9176-70CD7F4C4AFF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8BE16577-1F83-4FC6-95F8-3FAD21891686}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8C071059-916D-45C4-AB52-194813FB8F95}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8C865602-1D9A-4E58-9E4B-CA5A61FCBE75}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8D560DF6-50CE-4C5B-A108-29FA3B50CE09}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8E5EA610-2A6B-4419-9135-2C1269897D64}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8EA1CAD1-F882-4583-BFA2-01F8FC2A1DBF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{8EC0665C-C95F-4B1F-9D57-9A85B108D69C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{90099EFB-CFE0-4EF5-A2CC-F8BEAD01A2DA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{90134DFB-81C0-49D1-9F6F-B1C23947B14F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9022A144-BA19-41C0-A385-020A1F90001A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9039B1A9-EEC6-42E6-A868-3C4B2B2556E0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{908ED9B3-BF03-46AA-ABFD-C3D9FE543603}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{90EB2516-8CDA-494E-8833-1E03D7FF20C7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{90F2DEB7-4E27-42C8-8981-7920D1014491}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{910A927D-0C32-4C18-B824-CC2A1C082FFD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9190735D-253E-4613-8971-9F23AD7A29CD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{91D76E6F-4850-4E93-AC0C-5F99228B2419}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{94D98FBC-E8F5-4A8F-86B8-190014816ECB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{953B987C-467C-4522-8AD9-CFC662BF8B6B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9602BCAF-5E8C-49E1-AC12-C6FD9754DF6B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{961D1F00-78C0-46A3-BCDB-3718DEBDE4BF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{975E5C8A-13F3-425F-A141-10D5F8AD2F0A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{97A74DBC-CB81-4C87-8AD2-8018A29CF8B7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{97AE326B-BC3E-4613-9E3A-3DA30FCD3692}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{97FB8ADF-F3CA-4F06-8F9B-ADA86487B621}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{990F872F-1DC9-4E31-9D99-4369EC4803DF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{997C680C-7A3A-4E24-A83B-D96FBB12A860}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{99A74FC1-E52A-401C-ABA7-4BA5B0580AB5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{99A80C0D-9759-49BB-9109-29875786DBC9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9CC7C09A-89B2-49C4-94D7-F193876C7FED}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9D2BFE1C-5E9A-4786-93E8-7A70B19F21C8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9E1B3FAC-455F-49E2-8FED-2197DECD807D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9E1B7E72-3C5F-481F-937A-D2A084736F0A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9ECAB16C-5725-4B40-9589-4237A95DFCFD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9F35FE2A-41F3-400D-86CA-7EDE27BCEEB3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{9F3F8834-1873-45FB-BFB9-399EA3610D03}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A0DC56DF-406D-4055-8649-7C06387C5621}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A0F838A0-DB5B-4A26-9B70-1F53183C8905}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A101CE12-B377-4354-834B-B29A25E2A4AD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A10AA643-D42E-422D-B0BC-980407FFFAA3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A1A136C3-7AE2-444D-BFAB-59FD02F46B06}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A2C740C2-4317-4D6A-9E97-B88DC8A24D73}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A35F00FA-0097-442D-8AAB-BC254740517D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A3E08BDA-1808-41D6-805C-DE908BFB9F45}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A416E304-A92B-435D-9B6B-FCD18ECEDA70}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A4211ADB-BFE1-4DB0-87A1-34AF6AFE66D9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A4359A71-664A-4A6D-BD53-9900F189C59C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A44145E8-2B18-44C7-BCD7-E5CE485F5C5C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A469ECA6-A043-4B89-A00D-185DF6987C7A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A47EB5E9-A0CF-443C-987D-2B1131D77F9C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A47F9A31-7DD3-4188-AC21-F21A02DA4BBD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A4A24D45-7F59-4E5E-BE97-F76D97A255E8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A4C0E77D-9655-4D57-885D-3E3ED0DD1364}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A59BAFA6-D403-439F-A5B6-0311AE0431D6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A5C77BD0-EF37-4C19-A171-61E9D997A7EE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A5F7AA48-A6D6-4D15-BD24-3AEABC584285}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A5F8EC57-7472-41B7-9D4C-5A328794634E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A60E975E-F149-41C5-8180-1FCAE3326EE7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A6DBE694-BAB7-4E88-8C00-71B688A0AA19}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A6DEB53C-6BE5-4A30-934F-2E0F8142BDC8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A6FB578B-B002-445A-A250-1C53D9521DE9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A80F56F1-154D-4F1C-B946-67A6798A380A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A8793CEA-90F3-4C1D-98AC-ACF25272A714}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A8E24067-50B9-44F9-A09A-238717E52E94}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A95E88FF-222D-4C17-8CE1-83F315E5AB41}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{A97D65A5-9C91-434C-B9C1-E409E5886FE6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{AAD75A74-7BBC-4C34-9233-BE3E91BB8587}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{AAE2A888-D080-4120-A361-25AD552546E6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{AB71A0CB-196B-4BE1-8EC6-453153D2038A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{AC2FAE27-9A0A-44E5-9396-69F080C86BC1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{AC5D0C1E-1BBE-49BD-B82C-140571C67C97}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{AC8B6F1C-9A6B-4D4D-9E12-1204C6A32933}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{ACE27F17-4FA8-4544-80BB-DD77EF251196}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{AD582EE0-CA96-427A-ADD0-A94ACF1BB436}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{AF3F84D4-561B-4F2F-8B10-24640589923D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B0568F44-5CA9-4BE7-9DE1-34859D511491}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B057F35B-F937-45D8-BBD2-1CC234C15EB2}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B0C4C7CF-DD40-4CF0-AC6B-9D3E8414A42F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B1ED4FBE-ADDA-4D4C-BC48-21B94CDF429F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B201F145-CE17-40AE-B5CD-79497448C165}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B37DA603-E948-4DA4-A775-6A277FC6EF75}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B3ED658C-F25E-46FC-9B4C-D51FFA341F82}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B5F99811-DDDA-4BBE-8992-B105283CBB65}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B64D3F9E-55E3-4AB2-B245-81707F2FC10C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B6FEC533-B254-4891-9BF1-C0FD0FB4CA9B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B70A1721-3B35-4B49-90E5-7D4807AC349F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B7185248-D2EF-4982-8302-FFBFB4122982}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B7375F03-7DAD-44E9-B571-CEC138A6E486}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B76C9662-4C6E-4843-B785-1084D6E85A75}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B7A5D714-DE41-4E62-85DB-769135AA7F21}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B8252456-E107-4123-907A-64D7F693C3F1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B8A3218D-107F-495A-9758-EEF47DE8781A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{B974FE99-64F5-4715-996B-B0E87ABF6889}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BA0BCB0C-E086-40B1-8EF7-232ABD6355D9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BA23F6A5-D360-4E2F-863F-AE5ADACBEC36}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BA52572F-AA02-420A-959D-8DB8F3481D78}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BAABB9F5-6D74-4492-B84B-57973415B678}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BD85D4C2-4413-43F3-9B97-89A0FD01C9A7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BDE26AA7-FE72-482A-BFE1-41A91D3D66AB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BE482D9B-8E9F-485E-BA28-E909E65FFD50}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BEA4D904-D752-4093-A678-3A0DCC06461B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BEAAAA9C-EC7C-4892-9269-DB9B74C00E8B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BEF955B6-3D87-424C-8F4C-B1A7298A346D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BF0FC19D-0247-4926-A5A4-B7418EA5DB01}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{BF871A2F-951A-4574-B799-198FA758ECBB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C04680AD-5DCF-4A2A-BF27-0639E8B62BEE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C05A3284-15E1-432B-8BA1-F67A44C30127}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C086B6FE-2991-47FA-857B-8E12F1DB73D0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C0EB7E9F-111C-4998-986F-252F504CDF2D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C17CC144-526B-4F6D-856E-406C9685A8BF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C211CDDD-C109-469D-B5AA-F01986664A65}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C28584B3-A989-4532-A861-A7ED5D80B7F7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C2BFF747-2D26-418D-8ED8-9CFEDA713BC4}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C3C57DDC-02C9-446A-8544-736B90DC3C35}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C4089F36-6F79-4328-AA97-7B5C96372BDD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C40A4435-B136-4EC6-87EF-519EB5DCFAA7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C412F8DF-F38F-429B-B60F-80A1240428E3}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C41D2D2F-9F33-4A0B-8C7C-D809B0BA008A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C4EC7466-4983-4D7C-823E-0B4AC28216D0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C5294860-F820-4FE3-A7EF-1A92E16C668F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C6FA099D-C339-488B-BDA6-0B30CA2D1792}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C7FB28B1-0486-40D2-B43D-BFBF841C3CF0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C8D5F181-734F-4A5E-81D8-87C6B6DDD421}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{C9CB3CBC-06BB-4557-A926-7100FE76B78B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CADAF102-072F-4BCF-BE22-738BE02BC63B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CB4B14DA-A8E2-46DB-92E4-5C3E54F294BE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CB73DE93-DF21-4C9C-BF0F-444F2917020D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CB769FC6-A20A-4A11-ABDF-94638C668E3A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CC7E00AA-E0CA-464E-A242-53CC4929C778}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CD59FFDD-8158-4CAD-BC0D-22474A500204}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CDD83532-C909-478F-8A43-3FB83F268CE6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CEAC420B-672A-4329-9FE2-0C48BCA3D9FD}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CEC48FDE-0B14-4B23-AC76-1D3ACFC1FD81}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{CF6E8D6D-3B56-4B56-ABA7-BBD59005956F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D09F2D97-06EE-4A70-85E6-F070BA2530FF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D0A07C51-19B4-48DD-94CF-DD06EADA0C4F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D267418E-57E7-4A41-80E7-6D7098F6D1B5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D2A4DF55-02B2-4626-B57F-2D2AF58D2E4F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D3A6192C-1A34-4A16-B672-DB752D1DA34F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D5000B4B-DF1E-4571-8B4B-C71DE8B8006B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D5B9A69A-7FBE-4E07-A158-37449FB5F442}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D5F393D0-66D8-4769-943C-68D0B4F267F2}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D61CB33E-4435-48F6-B956-F70F3B5BF2EA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D62C3A34-A35D-4D67-A6E0-F9C46F9FA10F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D6322BD8-1FA9-4359-83EB-09010BFBECDB}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D67333D9-E7CA-47F1-80B3-A243E6839347}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D68820D7-30BD-41A9-B081-43841E3F71E1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D79F9394-69FB-4E21-A820-49DE7877F05B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D829355E-BED8-471C-ACCA-BF0CCD0A2BFA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D82F9331-E3F4-4D99-B579-A08DA3D399B7}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D8603F18-2E38-4C60-AEEE-FF7F7360019F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D8B8480A-ABCE-4EE0-A055-2BA61E769D81}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D94E7A89-1E95-4F3E-9B02-B6B45C5D0D15}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{D98F529C-0238-4D4B-8E45-2B57EDBBDFF1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DAF58CCE-DA16-46CC-A7C7-246BCACF8F57}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DC254281-6370-4DE6-B979-091A19ECF6CE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DC2E3E87-7D2C-4CD6-8753-963E08B1FF2A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DD8BAF6D-2814-4DD1-B220-7BA6D703FEE2}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DE7EEAB2-C505-45F8-92E4-E83484705B58}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DF5AA3C0-4DB0-49E4-972B-C4C76DDA8E86}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DF6C6881-612F-44A0-A5DD-2EEB719FFB96}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DFC083A8-1C9F-42CE-80BE-071389585875}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{DFE2A498-81CA-411C-9051-51FCED606365}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E04F3F4B-34A7-4B36-8F1A-D55E6884D560}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E0D51BE8-D4DA-4E3E-9C94-A9C1D1DFFEAA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E109B7E8-AAD0-4000-96A5-8C67D2159EA6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E139FA62-37C1-4F6F-8421-3E40BA9D490D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E1952D1D-E505-436C-AC40-E4B2875D13D5}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E1DCB28B-3029-4857-986E-A41CDEC13B2C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E202CE1B-4D63-4E32-A163-342E08925E46}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E2051CFA-A0CF-47DE-B6BE-063E25199955}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E2A7AD14-9F73-4421-93FA-979B5EB73078}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E302DEA7-A72F-44AF-9672-A6E86FEBD183}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E40E7030-B484-48AC-8E69-076E3DD359DE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E4F7D299-AEE9-4432-BEAC-3A015D2EAE15}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E61680D4-B381-4780-9FFD-BF295119D36D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E684733E-104E-4EBD-92D5-6090AC73CC96}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E6AA4A1E-2F89-4CE7-8AD7-94135731C86B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E73C0D3A-F363-46A3-9E8E-D7CDD9489056}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E78C5B01-FFAE-4932-B7EA-F4B40F445B6D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E7EF47A8-D50B-442F-9FEE-3C32222FBF0F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E8031FAD-5F1E-44D6-A85C-16B4941EF5D9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{E8FA2A52-B9BE-40CD-A5DA-2E1CD66998FC}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EB2127A9-3DC2-4E74-BFD5-DA27F47F1D7A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EBEAAFDD-8261-455D-9374-43CAFFE242CA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EC2EF77D-D86E-4DFB-8799-D2C9E8270AA0}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EC65F1E3-BB45-475B-B58B-B18E7DF96E7E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EC7063BD-0201-4CE2-86A8-F0E162656485}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EC8B32C1-F648-4755-A20B-D44657601C9A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{ECA46F74-4624-4F80-9B9E-FE8C1E418B93}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{ED0D28B4-0249-41D5-A312-0E5EBB9463E4}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{ED9ACC90-E253-4410-BBBC-4C9F768D04FA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EE0DDFA7-0BF0-4DFC-9A82-31471BC7E045}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EE47AA2D-36EF-4159-BF11-5637EB6794AF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EE5D490C-D3A0-4487-9EE8-BB8C5A480C4C}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EE972975-D32F-465F-9382-6BD22A265B68}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EEC9346C-611F-46CF-88EB-F4B3E631E05F}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{EEF4BF3E-FC09-4E6F-BCA3-799291C272E6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F15BFDF6-DEB6-4967-8D67-75B23A49B928}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F232A1D8-C3C3-4191-B514-13866524F5A8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F2688C7C-5078-413B-856B-5BAFE35610FA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F2BBEAA4-8A58-42DD-A856-E052929CE490}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F2E0D060-A80C-409A-AC91-461C4573BB87}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F30F4453-D953-415E-AA7C-D19F5667EFA1}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F33798C0-9270-43E3-B183-2C24EA59BE24}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F41E309E-C5DC-4140-8621-243C8296A038}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F459F394-D750-424A-BF68-955F361B6588}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F4A95F78-30C6-4ACE-B4C4-9058B6317F4B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F4EB6B3C-C056-4A00-8E42-8D29286FF154}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F5617523-F307-419A-AD9D-EF03B27969BA}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F57A1A9D-F006-45FB-85ED-2F1F1C3F749D}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F5A5F799-AF1E-4D52-91DB-93D4CA9B2749}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F680E5A6-D1CC-4321-A10B-7FB19AC82C67}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F6B3A234-6752-4E9C-8C81-A614FFDD26BF}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F724CBDD-CB88-4323-8AFB-983D3B092D29}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F8576FB9-A694-4AA7-9A23-15B45352E64A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F9122AED-EC1B-4D39-B519-AEE544ECBE1A}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F9889CD6-A5F0-475C-BE24-962EB721C761}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{F9E11CAE-E2D5-4290-8543-11BE0D9A9DC8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FA1A9211-7DE7-4ADF-8972-13B2D1EF1D0B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FA7CF185-32B4-4D8F-83F7-7E1120DCD374}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FB25BF23-9DCF-40BD-A606-6C8FEFEB1E60}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FB5C359B-B4A6-41CD-B2C2-E264F9258906}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FBA03A3D-2367-41F2-9E36-6BC2EEC9E649}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FBCDC766-33A3-4BDD-955C-106EAB1DEEB6}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FC4B8CFD-6B76-4E23-804A-963FDF77FEF9}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FD737FF9-1376-4B28-AE96-AC71D9510E1B}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FD74E3E7-65F7-4294-83F5-E9DEA91295B8}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FDC8B98C-3ABE-4F40-B8D4-0E393BF56CDE}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FE662A34-62D8-4D14-8E1A-C0C1B905C3A2}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FE8E1FE1-43D8-40DD-9A87-FF64D2FB3D20}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FF821026-9E21-4AA2-9419-6978EE9DCB4E}
Successfully deleted: [Empty Folder] C:\Users\Shannon Shoemake\appdata\local\{FFAC33D9-85C2-4D0D-B599-F121EAE5EDC9}



~~~ FireFox

Successfully deleted: [File] C:\Users\Shannon Shoemake\AppData\Roaming\mozilla\firefox\profiles\sv6y3npz.default\extensions\sdufcguqwi@sdufcguqwi.org.xpi [Tracur]
Successfully deleted: [File] "C:\Users\Shannon Shoemake\AppData\Roaming\mozilla\firefox\profiles\sv6y3npz.default\extensions\jid0-bbA9VAawX3LMWDu668aUDrpQVXU@jetpack.xpi"
Emptied folder: C:\Users\Shannon Shoemake\AppData\Roaming\mozilla\firefox\profiles\sv6y3npz.default\minidumps [9 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 06/24/2013 at 15:01:19.42
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 

Now moving on to step 4 will post results

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

Here is the AdwCleaner log:

 

# AdwCleaner v2.303 - Logfile created 06/24/2013 at 15:10:11
# Updated 08/06/2013 by Xplode
# Operating system : Windows 7 Home Premium Service Pack 1 (64 bits)
# User : Shannon Shoemake - SHANNONSHOEMAKE
# Boot Mode : Normal
# Running from : C:\Users\Shannon Shoemake\Desktop\AdwCleaner.exe
# Option [Delete]


***** [services] *****


***** [Files / Folders] *****

Folder Deleted : C:\Users\SHANNO~1\AppData\Local\Temp\boost_interprocess

***** [Registry] *****

Key Deleted : HKCU\Software\YahooPartnerToolbar
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{98279C38-DE4B-4BCF-93C9-8EC26069D6F4}]

***** [internet Browsers] *****

-\\ Internet Explorer v10.0.9200.16611

[OK] Registry is clean.

-\\ Mozilla Firefox v21.0 (en-US)

File : C:\Users\Shannon Shoemake\AppData\Roaming\Mozilla\Firefox\Profiles\sv6y3npz.default\prefs.js

[OK] File is clean.

*************************

AdwCleaner[s1].txt - [1184 octets] - [24/06/2013 15:10:11]

########## EOF - C:\AdwCleaner[s1].txt - [1244 octets] ##########
 

 

Moving on to step 5 will post results

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please go ahead and delete this file.

Next, Please visit this webpage for instructions on downloading and running ComboFix: How to use ComboFix

Please make sure you disable your security applications before running ComboFix.

Once Combofix has completed it will produce and open a log file. Please attach that log file to your next reply.

If needed the file can be located here: C:\combofix.txt

NOTE: If you receive the message "illegal operation has been attempted on a registry key that has been marked for deletion", just reboot the computer.

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

ComboFix log:

 

ComboFix 13-06-24.01 - Shannon Shoemake 06/24/2013  18:07:12.1.1 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.1978.1017 [GMT -7:00]
Running from: c:\users\Shannon Shoemake\Downloads\ComboFix.exe
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\DRM\E970.tmp
c:\programdata\Microsoft\Windows\DRM\EB18.tmp
c:\users\Shannon Shoemake\acrobatreader.exe
c:\users\Shannon Shoemake\alg.exe
c:\users\Shannon Shoemake\chrome.exe
c:\users\Shannon Shoemake\conhost933010.exe
c:\users\Shannon Shoemake\flashplayer.exe
c:\users\Shannon Shoemake\iexplore675775.exe
c:\users\Shannon Shoemake\jucheck.exe
c:\users\Shannon Shoemake\notepad.exe
c:\users\Shannon Shoemake\opera.exe
c:\users\Shannon Shoemake\opera489636.exe
c:\users\Shannon Shoemake\skype.exe
c:\users\Shannon Shoemake\teamviewer.exe
c:\users\Shannon Shoemake\vlcplayer.exe
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((((   Files Created from 2013-05-25 to 2013-06-25  )))))))))))))))))))))))))))))))
.
.
2013-06-25 01:49 . 2013-06-25 01:49    --------    dc----w-    c:\users\Default\AppData\Local\temp
2013-06-24 22:26 . 2013-06-24 22:26    --------    dc----w-    c:\program files (x86)\ESET
2013-06-24 22:05 . 2013-06-12 03:08    9552976    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{68CB1E9D-2B5C-4CC3-A1BC-DD720FFC705F}\mpengine.dll
2013-06-24 21:53 . 2013-06-24 21:53    --------    dc----w-    c:\windows\ERUNT
2013-06-24 21:53 . 2013-06-24 21:53    --------    dc----w-    C:\JRT
2013-06-24 20:41 . 2013-06-24 20:41    --------    dc----w-    c:\program files (x86)\ERUNT
2013-06-20 22:52 . 2013-06-20 22:52    964552    ------w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{340195E5-29FF-4E58-97DF-3A60D705FB22}\gapaengine.dll
2013-06-20 22:52 . 2013-06-12 03:08    9552976    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-06-17 19:57 . 2013-06-17 19:57    71048    -c--a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-17 19:57 . 2013-06-17 19:57    692104    -c--a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-16 23:56 . 2013-06-16 23:56    --------    dc----w-    c:\users\Shannon Shoemake\AppData\Roaming\WildTangent
2013-06-16 22:26 . 2013-06-24 21:36    --------    dc----w-    c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-06-16 18:44 . 2013-06-16 18:44    --------    dc----w-    C:\Stinger_Quarantine
2013-06-16 16:33 . 2013-06-16 16:33    --------    dc----w-    C:\Verizon_Android
2013-06-15 18:10 . 2012-04-20 23:40    196440    -c--a-w-    c:\windows\system32\drivers\HipShieldK.sys
2013-06-15 18:09 . 2013-06-15 18:09    --------    dc----w-    c:\program files (x86)\McAfee.com
2013-06-15 18:09 . 2013-02-19 20:55    10728    -c--a-w-    c:\windows\system32\drivers\mfeclnk.sys
2013-06-15 18:09 . 2013-02-19 20:59    70112    -c--a-w-    c:\windows\system32\drivers\cfwids.sys
2013-06-15 18:09 . 2013-02-19 20:55    106552    -c--a-w-    c:\windows\system32\drivers\mferkdet.sys
2013-06-15 18:09 . 2013-02-19 20:53    515968    -c--a-w-    c:\windows\system32\drivers\mfefirek.sys
2013-06-15 18:09 . 2013-02-19 20:53    309840    -c--a-w-    c:\windows\system32\drivers\mfeavfk.sys
2013-06-15 18:09 . 2013-06-15 18:09    --------    dc----w-    c:\program files\McAfee.com
2013-06-15 17:38 . 2013-06-16 18:55    --------    dc----w-    c:\users\Shannon Shoemake\AppData\Local\7c8e1740-9fd8-46c8-8332-018ca09201fbad
2013-06-15 16:45 . 2013-02-19 20:56    182752    -c--a-w-    c:\windows\system32\mfevtps.exe
2013-06-14 16:47 . 2013-06-16 21:44    --------    dc----w-    c:\users\Shannon Shoemake\AppData\Roaming\wabEventSupport16
2013-06-13 21:02 . 2013-06-13 21:03    2706432    ----a-w-    c:\windows\system32\mshtml.tlb
2013-06-13 20:47 . 2013-06-13 20:47    9089416    -c--a-w-    c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-06-13 16:53 . 2013-06-13 21:01    1424384    ----a-w-    c:\windows\system32\WindowsCodecs.dll
2013-06-13 16:53 . 2013-06-13 21:01    1230336    ----a-w-    c:\windows\SysWow64\WindowsCodecs.dll
2013-06-13 16:51 . 2013-06-13 21:02    30720    ----a-w-    c:\windows\system32\cryptdlg.dll
2013-06-13 16:51 . 2013-06-13 21:02    24576    ----a-w-    c:\windows\SysWow64\cryptdlg.dll
2013-06-13 16:49 . 2013-06-13 21:26    1910632    ----a-w-    c:\windows\system32\drivers\tcpip.sys
2013-06-13 16:48 . 2013-06-13 21:01    1192448    ----a-w-    c:\windows\system32\certutil.exe
2013-06-13 16:48 . 2013-06-13 21:01    903168    ----a-w-    c:\windows\SysWow64\certutil.exe
2013-06-13 16:48 . 2013-06-13 21:01    184320    ----a-w-    c:\windows\system32\cryptsvc.dll
2013-06-13 16:48 . 2013-06-13 21:01    1464320    ----a-w-    c:\windows\system32\crypt32.dll
2013-06-13 16:48 . 2013-06-13 21:01    139776    ----a-w-    c:\windows\system32\cryptnet.dll
2013-06-13 16:48 . 2013-06-13 21:01    1160192    ----a-w-    c:\windows\SysWow64\crypt32.dll
2013-06-13 16:48 . 2013-06-13 21:01    103936    ----a-w-    c:\windows\SysWow64\cryptnet.dll
2013-06-13 16:48 . 2013-06-13 21:01    52224    ----a-w-    c:\windows\system32\certenc.dll
2013-06-13 16:48 . 2013-06-13 21:01    43008    ----a-w-    c:\windows\SysWow64\certenc.dll
2013-06-13 16:48 . 2013-06-13 21:01    140288    ----a-w-    c:\windows\SysWow64\cryptsvc.dll
2013-06-13 16:38 . 2013-06-13 16:58    --------    dc----w-    C:\d8a921097c5d80eb60
2013-06-13 16:18 . 2013-06-13 21:03    751104    ----a-w-    c:\windows\system32\win32spl.dll
2013-06-13 16:18 . 2013-06-13 21:03    492544    ----a-w-    c:\windows\SysWow64\win32spl.dll
2013-06-13 16:02 . 2013-06-13 21:00    1887232    ----a-w-    c:\windows\system32\d3d11.dll
2013-06-13 16:02 . 2013-06-13 21:00    1505280    ----a-w-    c:\windows\SysWow64\d3d11.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-04 01:16 . 2011-05-05 02:38    75898224    -c--a-w-    c:\windows\system32\MRT.exe
2013-05-21 03:41 . 2012-02-10 23:28    964552    ------w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-05-16 12:50 . 2013-05-15 15:24    983400    ----a-w-    c:\windows\system32\drivers\dxgkrnl.sys
2013-05-16 12:50 . 2013-05-15 15:24    265064    ----a-w-    c:\windows\system32\drivers\dxgmms1.sys
2013-05-16 12:50 . 2013-05-15 15:24    144384    ----a-w-    c:\windows\system32\cdd.dll
2013-05-16 12:49 . 2013-05-15 15:24    474624    ----a-w-    c:\windows\apppatch\AcSpecfc.dll
2013-05-16 12:49 . 2013-05-15 15:24    308736    ----a-w-    c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-05-16 12:49 . 2013-05-15 15:24    135168    ----a-w-    c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-05-16 12:49 . 2013-05-15 15:24    350208    ----a-w-    c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-05-16 12:49 . 2013-05-15 15:24    2176512    ----a-w-    c:\windows\apppatch\AcGenral.dll
2013-05-16 12:49 . 2013-05-15 15:24    111104    ----a-w-    c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-05-16 12:48 . 2013-05-15 15:23    14172672    ----a-w-    c:\windows\system32\shell32.dll
2013-05-16 12:48 . 2013-05-15 15:23    197120    ----a-w-    c:\windows\system32\shdocvw.dll
2013-05-16 12:48 . 2013-05-15 15:23    1930752    ----a-w-    c:\windows\system32\authui.dll
2013-05-16 12:48 . 2013-05-15 15:23    1796096    ----a-w-    c:\windows\SysWow64\authui.dll
2013-05-16 12:48 . 2013-05-15 15:23    111448    ----a-w-    c:\windows\system32\consent.exe
2013-05-16 12:48 . 2013-05-15 15:23    70144    ----a-w-    c:\windows\system32\appinfo.dll
2013-05-16 12:48 . 2013-05-15 15:22    48640    ----a-w-    c:\windows\system32\wwanprotdim.dll
2013-05-16 12:48 . 2013-05-15 15:22    230400    ----a-w-    c:\windows\system32\wwansvc.dll
2013-05-16 12:47 . 2013-05-15 15:22    3153920    ----a-w-    c:\windows\system32\win32k.sys
2013-05-15 02:08 . 2012-06-27 14:49    22240    -c--a-w-    c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-02 09:06 . 2011-06-24 22:18    278800    -c----w-    c:\windows\system32\MpSigStub.exe
2013-04-25 03:54 . 2013-04-24 13:00    1656680    ----a-w-    c:\windows\system32\drivers\ntfs.sys
2013-04-11 03:53 . 2013-04-10 12:21    223752    ----a-w-    c:\windows\system32\drivers\fvevol.sys
2013-04-11 03:52 . 2013-04-10 12:21    5550424    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-04-11 03:52 . 2013-04-10 12:21    3913560    ----a-w-    c:\windows\SysWow64\ntoskrnl.exe
2013-04-11 03:52 . 2013-04-10 12:21    3968856    ----a-w-    c:\windows\SysWow64\ntkrnlpa.exe
2013-04-11 03:52 . 2013-04-10 12:21    43520    ----a-w-    c:\windows\system32\csrsrv.dll
2013-04-11 03:52 . 2013-04-10 12:21    112640    ----a-w-    c:\windows\system32\smss.exe
2013-04-11 03:52 . 2013-04-10 12:21    6656    ----a-w-    c:\windows\SysWow64\apisetschema.dll
2013-04-04 21:50 . 2013-05-21 02:15    25928    -c--a-w-    c:\windows\system32\drivers\mbam.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-02-01 18:03    120176    ----a-w-    c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIHWA.EXE" [2013-01-07 241280]
"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
"FUFAXRCV"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe" [2011-03-09 495616]
"FUFAXSTM"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" [2011-03-09 856064]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-03-14 1532992]
.
c:\users\Shannon Shoemake\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files (x86)\ERUNT\AUTOBACK.EXE %SystemRoot%\ERDNT\AutoBackup\#Date# /noconfirmdelete /noprogresswindow [2005-10-20 38912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys;c:\windows\SYSNATIVE\drivers\HipShieldK.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys;c:\windows\SYSNATIVE\drivers\mferkdet.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [x]
S2 EpsonCustomerParticipation;EpsonCustomerParticipation;c:\program files\EPSON\EpsonCustomerParticipation\EPCP.exe;c:\program files\EPSON\EpsonCustomerParticipation\EPCP.exe [x]
S2 File Backup;File Backup Service;c:\program files (x86)\Workspace\offSyncService.exe;c:\program files (x86)\Workspace\offSyncService.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\McSACore.exe;c:\progra~2\mcafee\SITEAD~1\McSACore.exe [x]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe;c:\windows\SYSNATIVE\mfevtps.exe [x]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys;c:\windows\SYSNATIVE\drivers\mfefirek.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-15 23:51]
.
2013-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-15 23:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-02-01 18:06    137584    ----a-w-    c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\off0]
@="{8E33AEC3-C5F2-43C4-B048-9E3EB19B1DD5}"
[HKEY_CLASSES_ROOT\CLSID\{8E33AEC3-C5F2-43C4-B048-9E3EB19B1DD5}]
2012-05-25 13:25    1308432    -c--a-w-    c:\program files (x86)\Workspace\offsyncext64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\off1]
@="{8E33AEC4-C5F2-43C4-B048-9E3EB19B1DD5}"
[HKEY_CLASSES_ROOT\CLSID\{8E33AEC4-C5F2-43C4-B048-9E3EB19B1DD5}]
2012-05-25 13:25    1308432    -c--a-w-    c:\program files (x86)\Workspace\offsyncext64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to AMV/AVI Video Converter... - c:\program files (x86)\Media Player Utilities 4.41\AMVConverter\grab.html
Trusted Zone: taxact.com\www
Trusted Zone: yahoo.com\games
TCP: DhcpNameServer = 10.0.0.1
FF - ProfilePath - c:\users\Shannon Shoemake\AppData\Roaming\Mozilla\Firefox\Profiles\sv6y3npz.default\
FF - ExtSQL: 2013-06-14 09:47; {8A0689E3-2A95-E5F1-31B7-712A9D839912}; c:\users\Shannon Shoemake\AppData\Roaming\Mozilla\Firefox\Profiles\sv6y3npz.default\extensions\{8A0689E3-2A95-E5F1-31B7-712A9D839912}
FF - ExtSQL: 2013-06-24 15:12; {D19CA586-DD6C-4a0a-96F8-14644F340D60}; c:\program files (x86)\Common Files\McAfee\SystemCore
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe
SafeBoot-76552741.sys
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3291179897-1488255658-4253967872-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2013-06-24  18:55:06
ComboFix-quarantined-files.txt  2013-06-25 01:55
.
Pre-Run: 20,059,918,336 bytes free
Post-Run: 19,954,556,928 bytes free
.
- - End Of File - - D86D7F88AA48D3081C04BA0B06F694AF
D41D8CD98F00B204E9800998ECF8427E
 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please save the attached file CFScript.txt to your local computer.

Then drag and drop it onto Combofix which will launch and run Combofix with the script and remove the file in question.

Once it's done it will create a new log. Please post back that log.

Thanks

CFScript.txt

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

Updated ComboFix log:

 

ComboFix 13-06-24.01 - Shannon Shoemake 06/24/2013  21:01:42.2.1 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.1978.1076 [GMT -7:00]
Running from: c:\users\Shannon Shoemake\Downloads\ComboFix.exe
Command switches used :: c:\users\Shannon Shoemake\Downloads\CFScript.txt
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: Microsoft Security Essentials *Disabled/Updated* {3F839487-C7A2-C958-E30C-E2825BA31FB5}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: Microsoft Security Essentials *Disabled/Updated* {84E27563-E198-C6D6-D9BC-D9F020245508}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
FILE ::
"c:\users\Shannon Shoemake\AppData\Roaming\wabEventSupport16\{08f70139-daa2-d9d9-d255-d8e0e399db12}.exe"
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Shannon Shoemake\AppData\Roaming\wabEventSupport16\{08f70139-daa2-d9d9-d255-d8e0e399db12}.exe
.
Infected copy of c:\windows\SysWow64\userinit.exe was found and disinfected
Restored copy from - c:\windows\erdnt\cache86\userinit.exe
.
.
(((((((((((((((((((((((((   Files Created from 2013-05-25 to 2013-06-25  )))))))))))))))))))))))))))))))
.
.
2013-06-25 04:08 . 2013-06-25 04:08    --------    dc----w-    c:\users\Default\AppData\Local\temp
2013-06-24 22:26 . 2013-06-24 22:26    --------    dc----w-    c:\program files (x86)\ESET
2013-06-24 22:05 . 2013-06-12 03:08    9552976    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{68CB1E9D-2B5C-4CC3-A1BC-DD720FFC705F}\mpengine.dll
2013-06-24 21:53 . 2013-06-24 21:53    --------    dc----w-    c:\windows\ERUNT
2013-06-24 21:53 . 2013-06-24 21:53    --------    dc----w-    C:\JRT
2013-06-24 20:41 . 2013-06-24 20:41    --------    dc----w-    c:\program files (x86)\ERUNT
2013-06-20 22:52 . 2013-06-20 22:52    964552    ------w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{340195E5-29FF-4E58-97DF-3A60D705FB22}\gapaengine.dll
2013-06-20 22:52 . 2013-06-12 03:08    9552976    ----a-w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2013-06-17 19:57 . 2013-06-17 19:57    71048    -c--a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-06-17 19:57 . 2013-06-17 19:57    692104    -c--a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2013-06-16 23:56 . 2013-06-16 23:56    --------    dc----w-    c:\users\Shannon Shoemake\AppData\Roaming\WildTangent
2013-06-16 22:26 . 2013-06-24 21:36    --------    dc----w-    c:\programdata\Malwarebytes' Anti-Malware (portable)
2013-06-16 18:44 . 2013-06-16 18:44    --------    dc----w-    C:\Stinger_Quarantine
2013-06-16 16:33 . 2013-06-16 16:33    --------    dc----w-    C:\Verizon_Android
2013-06-15 18:10 . 2012-04-20 23:40    196440    -c--a-w-    c:\windows\system32\drivers\HipShieldK.sys
2013-06-15 18:09 . 2013-06-15 18:09    --------    dc----w-    c:\program files (x86)\McAfee.com
2013-06-15 18:09 . 2013-02-19 20:55    10728    -c--a-w-    c:\windows\system32\drivers\mfeclnk.sys
2013-06-15 18:09 . 2013-02-19 20:59    70112    -c--a-w-    c:\windows\system32\drivers\cfwids.sys
2013-06-15 18:09 . 2013-02-19 20:55    106552    -c--a-w-    c:\windows\system32\drivers\mferkdet.sys
2013-06-15 18:09 . 2013-02-19 20:53    515968    -c--a-w-    c:\windows\system32\drivers\mfefirek.sys
2013-06-15 18:09 . 2013-02-19 20:53    309840    -c--a-w-    c:\windows\system32\drivers\mfeavfk.sys
2013-06-15 18:09 . 2013-06-15 18:09    --------    dc----w-    c:\program files\McAfee.com
2013-06-15 17:38 . 2013-06-16 18:55    --------    dc----w-    c:\users\Shannon Shoemake\AppData\Local\7c8e1740-9fd8-46c8-8332-018ca09201fbad
2013-06-15 16:45 . 2013-02-19 20:56    182752    -c--a-w-    c:\windows\system32\mfevtps.exe
2013-06-14 16:47 . 2013-06-25 04:08    --------    dc----w-    c:\users\Shannon Shoemake\AppData\Roaming\wabEventSupport16
2013-06-13 21:02 . 2013-06-13 21:03    2706432    ----a-w-    c:\windows\system32\mshtml.tlb
2013-06-13 20:47 . 2013-06-13 20:47    9089416    -c--a-w-    c:\windows\SysWow64\FlashPlayerInstaller.exe
2013-06-13 16:53 . 2013-06-13 21:01    1424384    ----a-w-    c:\windows\system32\WindowsCodecs.dll
2013-06-13 16:53 . 2013-06-13 21:01    1230336    ----a-w-    c:\windows\SysWow64\WindowsCodecs.dll
2013-06-13 16:51 . 2013-06-13 21:02    30720    ----a-w-    c:\windows\system32\cryptdlg.dll
2013-06-13 16:51 . 2013-06-13 21:02    24576    ----a-w-    c:\windows\SysWow64\cryptdlg.dll
2013-06-13 16:49 . 2013-06-13 21:26    1910632    ----a-w-    c:\windows\system32\drivers\tcpip.sys
2013-06-13 16:48 . 2013-06-13 21:01    1192448    ----a-w-    c:\windows\system32\certutil.exe
2013-06-13 16:48 . 2013-06-13 21:01    903168    ----a-w-    c:\windows\SysWow64\certutil.exe
2013-06-13 16:48 . 2013-06-13 21:01    184320    ----a-w-    c:\windows\system32\cryptsvc.dll
2013-06-13 16:48 . 2013-06-13 21:01    1464320    ----a-w-    c:\windows\system32\crypt32.dll
2013-06-13 16:48 . 2013-06-13 21:01    139776    ----a-w-    c:\windows\system32\cryptnet.dll
2013-06-13 16:48 . 2013-06-13 21:01    1160192    ----a-w-    c:\windows\SysWow64\crypt32.dll
2013-06-13 16:48 . 2013-06-13 21:01    103936    ----a-w-    c:\windows\SysWow64\cryptnet.dll
2013-06-13 16:48 . 2013-06-13 21:01    52224    ----a-w-    c:\windows\system32\certenc.dll
2013-06-13 16:48 . 2013-06-13 21:01    43008    ----a-w-    c:\windows\SysWow64\certenc.dll
2013-06-13 16:48 . 2013-06-13 21:01    140288    ----a-w-    c:\windows\SysWow64\cryptsvc.dll
2013-06-13 16:38 . 2013-06-13 16:58    --------    dc----w-    C:\d8a921097c5d80eb60
2013-06-13 16:18 . 2013-06-13 21:03    751104    ----a-w-    c:\windows\system32\win32spl.dll
2013-06-13 16:18 . 2013-06-13 21:03    492544    ----a-w-    c:\windows\SysWow64\win32spl.dll
2013-06-13 16:02 . 2013-06-13 21:00    1887232    ----a-w-    c:\windows\system32\d3d11.dll
2013-06-13 16:02 . 2013-06-13 21:00    1505280    ----a-w-    c:\windows\SysWow64\d3d11.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-06-04 01:16 . 2011-05-05 02:38    75898224    -c--a-w-    c:\windows\system32\MRT.exe
2013-05-21 03:41 . 2012-02-10 23:28    964552    ------w-    c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2013-05-16 12:50 . 2013-05-15 15:24    983400    ----a-w-    c:\windows\system32\drivers\dxgkrnl.sys
2013-05-16 12:50 . 2013-05-15 15:24    265064    ----a-w-    c:\windows\system32\drivers\dxgmms1.sys
2013-05-16 12:50 . 2013-05-15 15:24    144384    ----a-w-    c:\windows\system32\cdd.dll
2013-05-16 12:49 . 2013-05-15 15:24    474624    ----a-w-    c:\windows\apppatch\AcSpecfc.dll
2013-05-16 12:49 . 2013-05-15 15:24    308736    ----a-w-    c:\windows\apppatch\AppPatch64\AcGenral.dll
2013-05-16 12:49 . 2013-05-15 15:24    135168    ----a-w-    c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2013-05-16 12:49 . 2013-05-15 15:24    350208    ----a-w-    c:\windows\apppatch\AppPatch64\AcLayers.dll
2013-05-16 12:49 . 2013-05-15 15:24    2176512    ----a-w-    c:\windows\apppatch\AcGenral.dll
2013-05-16 12:49 . 2013-05-15 15:24    111104    ----a-w-    c:\windows\apppatch\AppPatch64\acspecfc.dll
2013-05-16 12:48 . 2013-05-15 15:23    14172672    ----a-w-    c:\windows\system32\shell32.dll
2013-05-16 12:48 . 2013-05-15 15:23    197120    ----a-w-    c:\windows\system32\shdocvw.dll
2013-05-16 12:48 . 2013-05-15 15:23    1930752    ----a-w-    c:\windows\system32\authui.dll
2013-05-16 12:48 . 2013-05-15 15:23    1796096    ----a-w-    c:\windows\SysWow64\authui.dll
2013-05-16 12:48 . 2013-05-15 15:23    111448    ----a-w-    c:\windows\system32\consent.exe
2013-05-16 12:48 . 2013-05-15 15:23    70144    ----a-w-    c:\windows\system32\appinfo.dll
2013-05-16 12:48 . 2013-05-15 15:22    48640    ----a-w-    c:\windows\system32\wwanprotdim.dll
2013-05-16 12:48 . 2013-05-15 15:22    230400    ----a-w-    c:\windows\system32\wwansvc.dll
2013-05-16 12:47 . 2013-05-15 15:22    3153920    ----a-w-    c:\windows\system32\win32k.sys
2013-05-15 02:08 . 2012-06-27 14:49    22240    -c--a-w-    c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2013-05-02 09:06 . 2011-06-24 22:18    278800    -c----w-    c:\windows\system32\MpSigStub.exe
2013-04-25 03:54 . 2013-04-24 13:00    1656680    ----a-w-    c:\windows\system32\drivers\ntfs.sys
2013-04-11 03:53 . 2013-04-10 12:21    223752    ----a-w-    c:\windows\system32\drivers\fvevol.sys
2013-04-11 03:52 . 2013-04-10 12:21    5550424    ----a-w-    c:\windows\system32\ntoskrnl.exe
2013-04-11 03:52 . 2013-04-10 12:21    3913560    ----a-w-    c:\windows\SysWow64\ntoskrnl.exe
2013-04-11 03:52 . 2013-04-10 12:21    3968856    ----a-w-    c:\windows\SysWow64\ntkrnlpa.exe
2013-04-11 03:52 . 2013-04-10 12:21    43520    ----a-w-    c:\windows\system32\csrsrv.dll
2013-04-11 03:52 . 2013-04-10 12:21    112640    ----a-w-    c:\windows\system32\smss.exe
2013-04-11 03:52 . 2013-04-10 12:21    6656    ----a-w-    c:\windows\SysWow64\apisetschema.dll
2013-04-04 21:50 . 2013-05-21 02:15    25928    -c--a-w-    c:\windows\system32\drivers\mbam.sys
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-02-01 18:03    120176    ----a-w-    c:\program files (x86)\EgisTec MyWinLocker\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIHWA.EXE" [2013-01-07 241280]
"NortonOnlineBackupReminder"="c:\program files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe" [2009-07-24 588648]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"EEventManager"="c:\program files (x86)\Epson Software\Event Manager\EEventManager.exe" [2010-10-12 979328]
"FUFAXRCV"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe" [2011-03-09 495616]
"FUFAXSTM"="c:\program files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe" [2011-03-09 856064]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2013-03-14 1532992]
.
c:\users\Shannon Shoemake\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files (x86)\ERUNT\AUTOBACK.EXE %SystemRoot%\ERDNT\AutoBackup\#Date# /noconfirmdelete /noprogresswindow [2005-10-20 38912]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R3 HipShieldK;McAfee Inc. HipShieldK;c:\windows\system32\drivers\HipShieldK.sys;c:\windows\SYSNATIVE\drivers\HipShieldK.sys [x]
R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys;c:\windows\SYSNATIVE\drivers\mferkdet.sys [x]
R3 NisDrv;Microsoft Network Inspection System;c:\windows\system32\DRIVERS\NisDrvWFP.sys;c:\windows\SYSNATIVE\DRIVERS\NisDrvWFP.sys [x]
R3 NisSrv;Microsoft Network Inspection;c:\program files\Microsoft Security Client\NisSrv.exe;c:\program files\Microsoft Security Client\NisSrv.exe [x]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys;c:\windows\SYSNATIVE\Drivers\RtsUStor.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys;c:\windows\SYSNATIVE\drivers\mfewfpk.sys [x]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys;c:\windows\SYSNATIVE\DRIVERS\mwlPSDVDisk.sys [x]
S2 ABBYY.Licensing.FineReader.Sprint.9.0;ABBYY FineReader 9.0 Sprint Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe;c:\program files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [x]
S2 DsiWMIService;Dritek WMI Service;c:\program files (x86)\Launch Manager\dsiwmis.exe;c:\program files (x86)\Launch Manager\dsiwmis.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [x]
S2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [x]
S2 EpsonCustomerParticipation;EpsonCustomerParticipation;c:\program files\EPSON\EpsonCustomerParticipation\EPCP.exe;c:\program files\EPSON\EpsonCustomerParticipation\EPCP.exe [x]
S2 File Backup;File Backup Service;c:\program files (x86)\Workspace\offSyncService.exe;c:\program files (x86)\Workspace\offSyncService.exe [x]
S2 GREGService;GREGService;c:\program files (x86)\Acer\Registration\GREGsvc.exe;c:\program files (x86)\Acer\Registration\GREGsvc.exe [x]
S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\progra~2\mcafee\SITEAD~1\McSACore.exe;c:\progra~2\mcafee\SITEAD~1\McSACore.exe [x]
S2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
S2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe;c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe [x]
S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [x]
S2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe;c:\windows\SYSNATIVE\mfevtps.exe [x]
S2 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe;c:\program files (x86)\EgisTec MyWinLocker\x86\MWLService.exe [x]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [x]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [x]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe;c:\program files\Acer\Acer Updater\UpdaterService.exe [x]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys;c:\windows\SYSNATIVE\drivers\cfwids.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys;c:\windows\SYSNATIVE\drivers\mfefirek.sys [x]
.
.
--- Other Services/Drivers In Memory ---
.
*Deregistered* - mfeavfk01
.
Contents of the 'Scheduled Tasks' folder
.
2013-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-15 23:51]
.
2013-06-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-11-15 23:51]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2010-02-01 18:06    137584    ----a-w-    c:\program files (x86)\EgisTec MyWinLocker\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\off0]
@="{8E33AEC3-C5F2-43C4-B048-9E3EB19B1DD5}"
[HKEY_CLASSES_ROOT\CLSID\{8E33AEC3-C5F2-43C4-B048-9E3EB19B1DD5}]
2012-05-25 13:25    1308432    -c--a-w-    c:\program files (x86)\Workspace\offsyncext64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\off1]
@="{8E33AEC4-C5F2-43C4-B048-9E3EB19B1DD5}"
[HKEY_CLASSES_ROOT\CLSID\{8E33AEC4-C5F2-43C4-B048-9E3EB19B1DD5}]
2012-05-25 13:25    1308432    -c--a-w-    c:\program files (x86)\Workspace\offsyncext64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-01-27 1281512]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm

mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Add to AMV/AVI Video Converter... - c:\program files (x86)\Media Player Utilities 4.41\AMVConverter\grab.html
Trusted Zone: taxact.com\www
Trusted Zone: yahoo.com\games
TCP: DhcpNameServer = 10.0.0.1
FF - ProfilePath - c:\users\Shannon Shoemake\AppData\Roaming\Mozilla\Firefox\Profiles\sv6y3npz.default\
FF - ExtSQL: 2013-06-14 09:47; {8A0689E3-2A95-E5F1-31B7-712A9D839912}; c:\users\Shannon Shoemake\AppData\Roaming\Mozilla\Firefox\Profiles\sv6y3npz.default\extensions\{8A0689E3-2A95-E5F1-31B7-712A9D839912}
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
AddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3291179897-1488255658-4253967872-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vcf\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="WindowsLiveMail.VCard.1"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
   00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SysWOW64\rundll32.exe
c:\program files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
.
**************************************************************************
.
Completion time: 2013-06-24  21:17:01 - machine was rebooted
ComboFix-quarantined-files.txt  2013-06-25 04:17
ComboFix2.txt  2013-06-25 01:55
.
Pre-Run: 18,778,963,968 bytes free
Post-Run: 18,650,947,584 bytes free
.
- - End Of File - - A04A98166967384D3633AADD8B0246C6
D41D8CD98F00B204E9800998ECF8427E
 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Please update McAfee and do a Full System Scan with it and let me know if it finds anything. Combofix found a core system file that was infected and was able to replace it but we want to make sure there is nothing else there.

How is the computer running now overall ?

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

Please update McAfee and do a Full System Scan with it and let me know if it finds anything. Combofix found a core system file that was infected and was able to replace it but we want to make sure there is nothing else there.

How is the computer running now overall ?

I updated McAfee and am unable to perform any type of scan on my computer now. I get an error. Would it be ok to uninstall and re-install McAfee? I am unsure why the error is happening and have tried for hours and I am still unable to scan my computer using McAfee now.

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

Uninstalled McAfee and ran Microsoft Security Essentials. No threats were detected. Yesterday I ran Microsoft Security Essentials, McAfee, and MWB before posting on here for help, and none of them detected this infected file, yet it was there all along. Is there a reason for this? Should I use another anti-virus software maybe?

 

Do I need to do anything about all of the files that are being compressed that was found in an earlier scan?

 

As far as how my computer is now operating, I have had no redirects from web pages now which I was getting all of the time prior. IE and FireFox both still become unresponsive over and over and my computer is still running slow or stalls still which I never had these issues prior to all of the infections.

 

Thank you for all your help!

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

Today I was using Fire Fox and all of a sudden a I got a blue screen stating windows had to shut down due to an unexpected

error. It restarts and happens all over again. I am in safe mode now. This is the info I got while in safe mode about the

problem.

 

Problem signature:
  Problem Event Name:    BlueScreen
  OS Version:    6.1.7601.2.1.0.768.3
  Locale ID:    1033

Additional information about the problem:
  BCCode:    e1
  BCP1:    FFFFF800033CDD50
  BCP2:    0000000000000002
  BCP3:    FFFFFA8006B99900
  BCP4:    FFFFFA8006B99900
  OS Version:    6_1_7601
  Service Pack:    1_0
  Product:    768_1

Files that help describe the problem:
  C:\Windows\Minidump\062613-34382-01.dmp
  C:\Users\Shannon Shoemake\AppData\Local\Temp\WER-56035-0.sysdata.xml

Read our privacy statement online:
  http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0409

If the online privacy statement is not available, please read our privacy statement offline:
  C:\Windows\system32\en-US\erofflps.txt
 

I am also getting unresponsive web browsers and website redirects again. I have run scans and nothing is detected.

I have never had this blue screen situation and unsure what else I am to do now.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Unfortunately some of these infections do wreak havoc with the system.  In most cases we're able to restore functionality to the system but sometimes the damage is too extensive and a format and reinstall of Windows after backing up all your data is called for.  I don't think we're at that level yet though and there are more things we can do to try to fix the computer it just takes time.  As for the infections themselves there is no product that can or will catch everything on any given day and why using layered protection is often best.

 

Please locate the that dump file and zip it up and attach it if its not too big and we'll take look and see if we can find any details of the crash from that file.

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Not overly telling - it looks like ntkrnlmp.exe had an issue in a call.  Just not enough information there to tell for sure.  Could even potentially be a hardware issue.

Please do the following for Firefox.

Please visit this site and restore Firefox back to the factory default settings.
Restore Firefox Default Settings Without Uninstalling It

Then run the MBAR Anti-Rootkit utility again please and post back the log.

 

Link to post
Share on other sites
shnncof

shnncof

Posted
  • Author
Posted

Restored Firefox to factory settings and here is the MBAR Anti-Rootkit Log:

 

Malwarebytes Anti-Rootkit BETA 1.06.0.1003
www.malwarebytes.org

Database version: v2013.06.26.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16618
Shannon Shoemake :: SHANNONSHOEMAKE [administrator]

6/26/2013 10:26:31 PM
mbar-log-2013-06-26 (22-26-31).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: Deep Anti-Rootkit Scan | PUP
Objects scanned: 234973
Time elapsed: 28 minute(s), 25 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

If you're using the PRO version of Malwarebytes Anti-Malware please open the program and go to the Protection tab and uncheck the option to load with Windows.

 

Then reboot the computer and download and run the following temporary file cleaner.

 

 

Please Run TFC by OldTimer to clear temporary files:

  • Download TFC from here and save it to your desktop.
  • http://oldtimer.geekstogo.com/TFC.exe
  • Close any open programs and Internet browsers.
  • Right click and choose "Run as administrator") and once it opens click on the Start button on the lower left of the program to allow it to begin cleaning.
  • Please be patient as clearing out temp files may take a while.
  • Once it completes you may be prompted to restart your computer, please do so.
  • Once it's finished you may delete TFC.exe from your desktop or save it for later use for the cleaning of temporary files.

 

 

Once that's done you can open MBAM again and re-enable the option to start with Windows.

 

Then run combofix again and post back the new log.

 

Thanks

 

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept