Infected with viruses

brando223 · November 5, 2013

Hello! I have reently been infected by a number of viruses. Here is my Malwarebytes log:

I appreciate any help I can get!

-Brandon

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2013.11.05.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Brandon :: BRANDON-HP [administrator]

11/5/2013 4:27:30 PM
MBAM-log-2013-11-05 (17-20-58).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 208765
Time elapsed: 5 minute(s), 5 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 11
HKCR\CrossriderApp0026276.BHO (PUP.Optional.CrossRider.A) -> No action taken.
HKCR\CrossriderApp0026276.BHO.1 (PUP.Optional.CrossRider.A) -> No action taken.
HKCR\CrossriderApp0026276.Sandbox (PUP.Optional.CrossRider.A) -> No action taken.
HKCR\CrossriderApp0026276.Sandbox.1 (PUP.Optional.CrossRider.A) -> No action taken.
HKCU\Software\Cr_Installer\26276 (PUP.Optional.CrossRider.A) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken.
HKCR\CLSID\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken.
HKCR\TypeLib\{44444444-4444-4444-4444-440244624476} (PUP.Optional.CrossRider.M) -> No action taken.
HKCR\Interface\{55555555-5555-5555-5555-550255625576} (PUP.Optional.CrossRider.M) -> No action taken.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211621176} (PUP.Optional.CrossRider.M) -> No action taken.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Users\Brandon\Downloads\frostwire-5.5.6.windows.exe (PUP.Optional.OpenCandy) -> No action taken.
C:\Program Files (x86)\Deal Spy\Deal Spy.dll (PUP.Optional.CrossRider.M) -> No action taken.

(end)

kevinf80 · November 5, 2013

Your log states "no action taken" why have you not removed those entries?

brando223 · November 6, 2013

Dont want to remove items without consulting people on the forums first.

kevinf80 · November 6, 2013

Yes please do remove all entries and post the new log..

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Please also be aware of Forum protocol regarding P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Maurice Naggar · November 9, 2013

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Maurice Naggar · November 11, 2013

Thread is re-opened per request.

brando223 · November 11, 2013

Thank you!

FRST log

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-11-2013 01
Ran by Brandon (administrator) on BRANDON-HP on 10-11-2013 20:25:35
Running from C:\Users\Brandon\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe
(Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Proximity Sensor\HPPRXSVC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe
(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files\Hewlett-Packard\HP LaunchBox\HPTaskBar2.exe
(Microsoft Corporation) C:\Users\Brandon\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Hewlett Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Audio\HPWA.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(CyberLink Corp.) C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(SecureW2 B.V.) C:\Program Files (x86)\SecureW2\sw2_tray.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Microsoft Corp.) C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Intel® Corporation) C:\Program Files\Intel\TurboBoost\TurboBoost.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe
(Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
(Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Aestan Software) C:\wamp\wampmanager.exe
(Apache Software Foundation) c:\wamp\bin\apache\apache2.4.4\bin\httpd.exe
() c:\wamp\bin\mysql\mysql5.6.12\bin\mysqld.exe
(Apache Software Foundation) C:\wamp\bin\apache\apache2.4.4\bin\httpd.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_9_900_117.exe
(Google) C:\Users\Brandon\AppData\Local\Google\Google Talk Plugin\googletalkplugin.exe
(Microsoft Corporation) C:\Windows\system32\msiexec.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] ()
HKLM\...\Run: [bLEServicesCtrl] - C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe [177936 2012-02-17] (Intel Corporation)
HKLM\...\Run: [bTMTrayAgent] - rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp
HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2885904 2012-02-23] (Synaptics Incorporated)
HKLM\...\Run: [sysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-01-04] (IDT, Inc.)
HKLM\...\Run: [setDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [44880 2011-12-20] (Hewlett-Packard Development Company, L.P.)
HKLM\...\Run: [intelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4123 2012-05-30] ()
HKLM\...\RunOnce: [NCPluginUpdater] - "c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe" Update [21720 2013-11-05] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKCU\...\Run: [steam] - C:\Program Files (x86)\Steam\Steam.exe [1635752 2013-05-03] (Valve Corporation)
HKCU\...\Run: [Google Update] - C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-02-18] (Google Inc.)
HKCU\...\Run: [skyDrive] - C:\Users\Brandon\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257136 2013-10-11] (Microsoft Corporation)
MountPoints2: {7d6312d7-5b28-11e2-a35b-c485087b4d81} - F:\MotoCastSetup.exe -a
MountPoints2: {a99f57c0-1250-11e2-a8eb-806e6f6e6963} - E:\autorun.exe
HKLM-x32\...\Run: [uSB3MON] - C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-26] (Intel Corporation)
HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [636032 2012-03-26] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-01-31] ()
HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe [87336 2011-03-30] (CyberLink Corp.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [843712 2012-01-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [HP CoolSense] - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [1342008 2011-08-26] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [secureW2 Tray] - C:\Program Files (x86)\SecureW2\sw2_tray.exe [287112 2012-02-22] (SecureW2 B.V.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [151952 2012-11-29] (Apple Inc.)
HKLM-x32\...\Run: [bCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-03-13] (Microsoft Corporation)
HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe [54576 2009-11-18] (Hewlett-Packard)
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [MSN Toolbar] - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\mswinext.exe [240992 2009-11-16] (Microsoft Corp.)
HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [288080 2009-07-17] (Microsoft Corporation)
HKLM-x32\...\Run: [hpqSRMon] - C:\Program Files (x86)\HP\Digital Imaging\bin\HpqSRmon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
Startup: C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel® Turbo Boost Technology Monitor 2.6.lnk
ShortcutTarget: Intel® Turbo Boost Technology Monitor 2.6.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKLM-x32 - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKCU - {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = http://search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPNTDF
SearchScopes: HKCU - {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ips\ipsbho.dll (Symantec Corporation)
BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: MSN Toolbar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM-x32 - MSN Toolbar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\coieplg.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_117.dll ()
FF Plugin: @java.com/DTPlugin,version=10.6.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.6.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @Microsoft.com/NpWinExt,version=4.0 - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\npwinext.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @stonetrip.com/ShiVaWebPlayer,version=1.8.0.0 - C:\Users\Brandon\AppData\Roaming\..\LocalLow\StoneTrip\Web Player\npShiVa3D.dll (StoneTrip)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Brandon\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Brandon\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Brandon\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Brandon\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF SearchPlugin: C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\searchplugins\safeguard-secure-search.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\safeguard-secure-search.xml
FF Extension: Deal Spy - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\cca2b8f2-77b0-4282-9533-b31982107a80@ef5174e8-db70-4d61-88df-24b975460bd0.com
FF Extension: WOT - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF Extension: HP Detect - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}
FF Extension: noscript - C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\Firefox
FF Extension: MSN Toolbar - C:\Program Files (x86)\MSN Toolbar\Platform\4.0.0357.1\Firefox
FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\
FF Extension: Search Helper Extension - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\IPSFF
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.101\pdf.dll ()
CHR Plugin: (Norton Identity Safe) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.2.1.36_0\npcoplgn.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.124\npGoogleUpdate3.dll No File
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (Java Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_110.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.90.5) - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Extension: (Google Docs) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Deal Spy) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\dieckmbeafcedhihaiadnaanclccfihd\1.25.16_0
CHR Extension: (Norton Identity Protection) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.3.4_0
CHR Extension: (Google Wallet) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR Extension: (Gmail) - C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\Exts\Chrome.crx

==================== Services (Whitelisted) =================

R2 HPPRXSVC; C:\Program Files (x86)\Hewlett-Packard\HP Proximity Sensor\HPPRXSVC.exe [37432 2012-03-06] (Hewlett-Packard Development Company, L.P.)
R2 ISCTAgent; C:\Program Files\Intel\Intel® Smart Connect Technology Agent\iSCTAgent.exe [133632 2012-02-09] ()
R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2011-12-16] (Intel Corporation)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [273168 2012-02-26] ()
R2 N360; C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-20] (Symantec Corporation)
R3 wampapache; c:\wamp\bin\apache\apache2.4.4\bin\httpd.exe [24576 2013-06-23] (Apache Software Foundation)
R3 wampmysqld; c:\wamp\bin\mysql\mysql5.6.12\bin\mysqld.exe [12867584 2013-06-23] ()
R2 ZeroConfigService; C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2669840 2012-02-26] (Intel® Corporation)

==================== Drivers (Whitelisted) ====================

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [31872 2012-02-01] (Advanced Micro Devices, Inc.)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\BASHDefs\20131101.003\BHDrvx64.sys [1524824 2013-10-22] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1404000.028\ccSetx64.sys [169048 2013-04-15] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-09-02] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [140376 2013-10-28] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\IPSDefs\20131110.002\IDSvia64.sys [521816 2013-10-25] (Symantec Corporation)
R3 ikbevent; C:\Windows\System32\DRIVERS\ikbevent.sys [25536 2012-02-09] ()
R3 imsevent; C:\Windows\System32\DRIVERS\imsevent.sys [25536 2012-02-09] ()
R2 IntelHaxm; C:\Windows\System32\DRIVERS\IntelHaxm.sys [85008 2012-05-22] ()
R3 ISCT; C:\Windows\system32\drivers\ISCTD64.sys [44992 2012-02-09] ()
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\VirusDefs\20131109.006\ENG64.SYS [126040 2013-11-04] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.2.0.19\Definitions\VirusDefs\20131109.006\EX64.SYS [2099288 2013-11-04] (Symantec Corporation)
S3 RSP2STOR; C:\Windows\System32\DRIVERS\RtsP2Stor.sys [260712 2012-01-30] (Realtek Semiconductor Corp.)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
R3 SmbDrv; C:\Windows\system32\drivers\Smb_driver.sys [21264 2012-02-23] (Synaptics Incorporated)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1404000.028\SRTSPX64.SYS [36952 2013-03-04] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-06-17] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1404000.028\Ironx64.SYS [224416 2013-03-04] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1404000.028\SYMNETS.SYS [433752 2013-04-24] (Symantec Corporation)
S3 uxddrv; C:\nbutils\QuickT\wow64\uxddrv64.sys [7256 2009-05-14] ()
R3 WPRO_41_2001; C:\Windows\System32\drivers\WPRO_41_2001.sys [34752 2013-11-08] ()

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-11-10 20:23 - 2013-11-10 20:23 - 00000000 ____D C:\Users\Brandon\Desktop\Torrent Data
2013-11-10 20:14 - 2013-11-10 20:14 - 01957590 _____ (Farbar) C:\Users\Brandon\Desktop\FRST64.exe
2013-11-10 20:14 - 2013-11-10 20:14 - 00000000 ____D C:\FRST
2013-11-08 18:20 - 2013-11-08 18:43 - 00000053 _____ C:\Users\Brandon\Desktop\VGD.txt
2013-11-08 11:47 - 2013-11-08 11:47 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-11-07 22:54 - 2013-11-07 22:54 - 00975932 _____ C:\Users\Brandon\Downloads\AMIDST-3.4.exe
2013-11-06 10:00 - 2013-11-06 10:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-05 16:26 - 2013-11-05 16:26 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Brandon\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Malwarebytes
2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-05 16:26 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-03 14:43 - 2013-11-03 17:39 - 00000000 ____D C:\Users\Brandon\Desktop\export2
2013-11-03 12:34 - 2013-11-03 12:43 - 704643072 _____ C:\Users\Brandon\Desktop\ubuntu-13.10-server-amd64.iso
2013-11-03 11:18 - 2013-11-03 12:32 - 00000000 ____D C:\Users\Brandon\VirtualBox VMs
2013-11-03 11:17 - 2013-11-10 16:35 - 00000000 ____D C:\Users\Brandon\.VirtualBox
2013-11-03 11:16 - 2013-11-03 11:16 - 00001076 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2013-11-03 11:16 - 2013-11-03 11:16 - 00000000 ____D C:\Program Files\Oracle
2013-11-03 11:16 - 2013-11-01 15:13 - 00252688 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2013-11-03 11:16 - 2013-11-01 15:10 - 00126736 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2013-11-03 11:14 - 2013-11-03 11:15 - 106230544 _____ (Oracle Corporation) C:\Users\Brandon\Downloads\VirtualBox-4.3.2-90405-Win.exe
2013-11-03 08:59 - 2013-11-03 08:59 - 00000018 _____ C:\Users\Brandon\Desktop\New Text Document.txt
2013-11-02 20:45 - 2013-11-03 14:38 - 00000000 ____D C:\Users\Brandon\Desktop\export
2013-11-02 20:21 - 2013-11-03 17:39 - 00000000 ____D C:\Users\Brandon\Desktop\backup
2013-11-02 19:53 - 2013-11-02 19:54 - 00000000 ____D C:\wamp
2013-11-02 19:40 - 2013-11-02 19:40 - 00001639 _____ C:\Users\Brandon\Desktop\register.php
2013-11-02 19:39 - 2013-11-02 19:39 - 00000000 _____ C:\Users\Brandon\Desktop\default_position.php
2013-11-02 19:13 - 2013-11-02 19:14 - 40603386 _____ (Hervé Leclerc (HeL)                                         ) C:\Users\Brandon\Downloads\Wampserver2.4-x64(1).exe
2013-11-02 17:42 - 2013-11-02 17:42 - 04812567 _____ (Tim Kosse) C:\Users\Brandon\Downloads\FileZilla_3.7.3_win32-setup.exe
2013-11-02 16:08 - 2013-11-02 20:12 - 00000000 ____D C:\Users\Brandon\Desktop\MultiplayerTechTest
2013-11-02 14:50 - 2013-11-02 16:00 - 00177290 _____ C:\Users\Brandon\Desktop\TEST.capx
2013-11-02 14:50 - 2013-11-02 15:56 - 00177286 _____ C:\Users\Brandon\Desktop\TEST.capx.backup1
2013-11-02 14:42 - 2013-11-02 14:50 - 862987318 _____ C:\Users\Brandon\Desktop\TechTest.capx.backup1
2013-11-02 14:18 - 2013-11-02 14:48 - 00000973 _____ C:\Users\Brandon\Desktop\TechTest.uistate.xml
2013-11-02 14:18 - 2013-11-02 14:18 - 00003884 _____ C:\Users\Brandon\Desktop\TechTest.caproj
2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Layouts
2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Event sheets
2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Animations
2013-11-01 15:10 - 2013-11-01 15:10 - 00154896 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2013-11-01 15:10 - 2013-11-01 15:10 - 00140560 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2013-11-01 15:07 - 2013-11-01 15:07 - 00204048 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2013-11-01 10:26 - 2013-11-01 10:26 - 00000000 ____D C:\Users\Brandon\Desktop\rex_date
2013-10-31 19:56 - 2013-10-31 19:57 - 128683080 _____ (Scirra                                                      ) C:\Users\Brandon\Downloads\construct2-r148-setup_18543583.exe
2013-10-31 19:55 - 2013-10-31 19:55 - 00000000 ____D C:\Users\Brandon\Desktop\7_Textbox_addon
2013-10-30 22:40 - 2013-10-30 22:40 - 02769432 _____ C:\Users\Brandon\Desktop\Ride.3gp.mp4
2013-10-30 22:29 - 2013-10-30 22:29 - 02803140 _____ C:\Users\Brandon\Desktop\Ride.mp4
2013-10-30 15:04 - 2013-10-30 15:04 - 01058176 _____ (PassMark Software                                           ) C:\Users\Brandon\Downloads\diskcheckup.exe
2013-10-30 15:04 - 2013-10-30 15:04 - 00000000 ____D C:\Program Files (x86)\DiskCheckup
2013-10-30 12:17 - 2013-10-30 12:17 - 04668633 _____ C:\Users\Brandon\Downloads\p95v279.win64.zip
2013-10-30 12:16 - 2013-10-30 12:16 - 00425667 _____ C:\Users\Brandon\Downloads\memtest86-iso.zip
2013-10-29 09:57 - 2013-10-31 16:12 - 00000061 _____ C:\Users\Brandon\Desktop\COLLEGEWORK.txt
2013-10-23 16:34 - 2013-10-28 22:46 - 00000000 ____D C:\Users\Brandon\Documents\javascript-sdk-template
2013-10-20 15:35 - 2013-10-20 15:35 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem (1).zip
2013-10-20 15:33 - 2013-10-20 15:33 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(3).zip
2013-10-20 15:31 - 2013-10-20 15:31 - 00000000 ____D C:\Users\Brandon\Desktop\Truth is - Copy
2013-10-20 15:26 - 2013-10-20 15:26 - 00025270 _____ C:\Users\Brandon\Downloads\login_error(1).zip
2013-10-20 15:03 - 2013-10-20 15:03 - 00000000 ____D C:\Users\Brandon\Documents\Add-in Express
2013-10-20 14:50 - 2013-10-20 20:45 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar
2013-10-20 14:50 - 2013-10-20 20:45 - 00000000 ____D C:\Program Files (x86)\AVG SafeGuard toolbar
2013-10-20 14:50 - 2013-10-20 14:50 - 00003746 _____ C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2013-10-20 14:50 - 2013-10-20 14:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\AVG SafeGuard toolbar
2013-10-19 21:47 - 2013-10-19 21:47 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(2).zip
2013-10-19 21:37 - 2013-10-19 21:37 - 00045129 _____ C:\Users\Brandon\Downloads\RegistrationForm.zip
2013-10-19 21:12 - 2013-10-19 21:12 - 00130763 _____ C:\Users\Brandon\Downloads\logintest(1).zip
2013-10-19 21:10 - 2013-10-19 21:10 - 00018387 _____ C:\Users\Brandon\Downloads\loginsystem(1).zip
2013-10-19 21:04 - 2013-10-19 21:04 - 00002553 _____ C:\Users\Brandon\Downloads\login_error.zip
2013-10-19 20:45 - 2013-10-19 20:45 - 00130763 _____ C:\Users\Brandon\Downloads\logintest.zip
2013-10-19 20:37 - 2013-10-19 20:37 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem.zip
2013-10-14 19:02 - 2013-10-14 19:04 - 176553561 _____ C:\Users\Brandon\Downloads\6043 - Pokemon - White 2 (v01)(DSi Enhanced) (J).zip
2013-10-14 13:58 - 2013-10-14 13:59 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2013-10-14 13:58 - 2013-10-14 13:58 - 00001007 _____ C:\Users\Brandon\Desktop\SpeedFan.lnk
2013-10-14 13:58 - 2013-10-14 13:58 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo
2013-10-14 13:57 - 2013-10-14 13:57 - 02143832 _____ C:\Users\Brandon\Downloads\instsf449.exe
2013-10-11 16:34 - 2013-11-08 11:48 - 00000000 ___RD C:\Users\Brandon\Documents\SkyDrive
2013-10-11 16:26 - 2013-10-11 16:34 - 00000000 ___RD C:\Users\Brandon\SkyDrive
2013-10-11 16:26 - 2013-10-11 16:26 - 00002164 _____ C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-11 16:26 - 2013-10-11 16:26 - 00000000 ____D C:\Program Files (x86)\Microsoft SkyDrive
2013-10-11 16:26 - 2013-10-11 16:25 - 06040688 _____ (Microsoft Corporation) C:\Users\Brandon\Downloads\SkyDriveSetup.exe
2013-10-11 16:25 - 2013-10-11 16:25 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
2013-10-11 12:17 - 2013-10-11 12:17 - 00000065 _____ C:\Users\Brandon\Documents\PWOOptions.ini
2013-10-11 11:57 - 2013-10-11 11:58 - 33405439 _____ C:\Users\Brandon\Downloads\PWO181.zip

==================== One Month Modified Files and Folders =======

2013-11-10 20:24 - 2013-04-28 13:42 - 00000000 ____D C:\Users\Brandon\stuff
2013-11-10 20:23 - 2013-11-10 20:23 - 00000000 ____D C:\Users\Brandon\Desktop\Torrent Data
2013-11-10 20:23 - 2012-12-06 11:56 - 00000000 ____D C:\Users\Brandon
2013-11-10 20:21 - 2009-07-13 21:34 - 00000438 _____ C:\Windows\win.ini
2013-11-10 20:14 - 2013-11-10 20:14 - 01957590 _____ (Farbar) C:\Users\Brandon\Desktop\FRST64.exe
2013-11-10 20:14 - 2013-11-10 20:14 - 00000000 ____D C:\FRST
2013-11-10 20:00 - 2012-10-09 17:14 - 01581865 _____ C:\Windows\WindowsUpdate.log
2013-11-10 19:48 - 2013-04-01 15:14 - 00000916 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA.job
2013-11-10 19:30 - 2013-02-18 13:22 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-10 19:29 - 2013-09-19 17:11 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-10 18:32 - 2012-12-09 12:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\CrashDumps
2013-11-10 16:48 - 2013-04-01 15:14 - 00000864 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core.job
2013-11-10 16:35 - 2013-11-03 11:17 - 00000000 ____D C:\Users\Brandon\.VirtualBox
2013-11-10 12:02 - 2013-04-12 18:25 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\.minecraft
2013-11-10 01:39 - 2013-02-18 13:22 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-09 00:49 - 2012-12-06 12:19 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Mozilla
2013-11-08 20:13 - 2013-06-07 19:29 - 00003198 _____ C:\Windows\System32\Tasks\HPCeeScheduleForBrandon
2013-11-08 20:13 - 2013-06-07 19:29 - 00000340 _____ C:\Windows\Tasks\HPCeeScheduleForBrandon.job
2013-11-08 20:13 - 2013-04-05 19:14 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2013-11-08 20:13 - 2012-12-06 21:47 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log
2013-11-08 18:43 - 2013-11-08 18:20 - 00000053 _____ C:\Users\Brandon\Desktop\VGD.txt
2013-11-08 17:20 - 2012-12-06 11:56 - 00003942 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{F38B13B5-4481-4906-A8A1-35CBF3A4D70B}
2013-11-08 11:54 - 2009-07-13 23:45 - 00031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-08 11:54 - 2009-07-13 23:45 - 00031472 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-08 11:53 - 2009-07-14 00:13 - 00779724 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-08 11:48 - 2013-10-11 16:34 - 00000000 ___RD C:\Users\Brandon\Documents\SkyDrive
2013-11-08 11:48 - 2012-12-15 22:38 - 00000000 ____D C:\Program Files (x86)\Steam
2013-11-08 11:47 - 2013-11-08 11:47 - 00094656 _____ (CACE Technologies) C:\Windows\system32\WPRO_41_2001woem.tmp
2013-11-08 11:47 - 2012-10-09 14:48 - 00034752 _____ C:\Windows\system32\Drivers\WPRO_41_2001.sys
2013-11-08 11:47 - 2009-07-14 00:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-08 11:47 - 2009-07-13 23:51 - 00057233 _____ C:\Windows\setupact.log
2013-11-08 11:46 - 2012-12-06 12:15 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-11-08 11:46 - 2010-11-20 22:47 - 00700692 _____ C:\Windows\PFRO.log
2013-11-08 11:45 - 2013-04-01 22:44 - 00000000 ____D C:\Program Files (x86)\Deal Spy
2013-11-07 22:54 - 2013-11-07 22:54 - 00975932 _____ C:\Users\Brandon\Downloads\AMIDST-3.4.exe
2013-11-06 10:00 - 2013-11-06 10:00 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-11-05 16:26 - 2013-11-05 16:26 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Brandon\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\Malwarebytes
2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-05 16:26 - 2013-11-05 16:26 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-03 21:07 - 2013-01-02 13:42 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\FileZilla
2013-11-03 18:54 - 2013-04-28 13:42 - 00000000 ____D C:\Users\Brandon\.frostwire5
2013-11-03 17:39 - 2013-11-03 14:43 - 00000000 ____D C:\Users\Brandon\Desktop\export2
2013-11-03 17:39 - 2013-11-02 20:21 - 00000000 ____D C:\Users\Brandon\Desktop\backup
2013-11-03 14:38 - 2013-11-02 20:45 - 00000000 ____D C:\Users\Brandon\Desktop\export
2013-11-03 12:43 - 2013-11-03 12:34 - 704643072 _____ C:\Users\Brandon\Desktop\ubuntu-13.10-server-amd64.iso
2013-11-03 12:32 - 2013-11-03 11:18 - 00000000 ____D C:\Users\Brandon\VirtualBox VMs
2013-11-03 11:16 - 2013-11-03 11:16 - 00001076 _____ C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2013-11-03 11:16 - 2013-11-03 11:16 - 00000000 ____D C:\Program Files\Oracle
2013-11-03 11:15 - 2013-11-03 11:14 - 106230544 _____ (Oracle Corporation) C:\Users\Brandon\Downloads\VirtualBox-4.3.2-90405-Win.exe
2013-11-03 11:15 - 2013-10-02 23:19 - 00000000 ____D C:\Users\Brandon\Downloads\Windows Server 2008 R2 Standard, Enterprise, Datacenter, and Web (x64) - DVD (English)
2013-11-03 08:59 - 2013-11-03 08:59 - 00000018 _____ C:\Users\Brandon\Desktop\New Text Document.txt
2013-11-02 20:12 - 2013-11-02 16:08 - 00000000 ____D C:\Users\Brandon\Desktop\MultiplayerTechTest
2013-11-02 19:54 - 2013-11-02 19:53 - 00000000 ____D C:\wamp
2013-11-02 19:40 - 2013-11-02 19:40 - 00001639 _____ C:\Users\Brandon\Desktop\register.php
2013-11-02 19:39 - 2013-11-02 19:39 - 00000000 _____ C:\Users\Brandon\Desktop\default_position.php
2013-11-02 19:14 - 2013-11-02 19:13 - 40603386 _____ (Hervé Leclerc (HeL)                                         ) C:\Users\Brandon\Downloads\Wampserver2.4-x64(1).exe
2013-11-02 17:43 - 2013-03-06 22:53 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-11-02 17:42 - 2013-11-02 17:42 - 04812567 _____ (Tim Kosse) C:\Users\Brandon\Downloads\FileZilla_3.7.3_win32-setup.exe
2013-11-02 16:00 - 2013-11-02 14:50 - 00177290 _____ C:\Users\Brandon\Desktop\TEST.capx
2013-11-02 15:56 - 2013-11-02 14:50 - 00177286 _____ C:\Users\Brandon\Desktop\TEST.capx.backup1
2013-11-02 14:50 - 2013-11-02 14:42 - 862987318 _____ C:\Users\Brandon\Desktop\TechTest.capx.backup1
2013-11-02 14:48 - 2013-11-02 14:18 - 00000973 _____ C:\Users\Brandon\Desktop\TechTest.uistate.xml
2013-11-02 14:18 - 2013-11-02 14:18 - 00003884 _____ C:\Users\Brandon\Desktop\TechTest.caproj
2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Layouts
2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Event sheets
2013-11-02 14:18 - 2013-11-02 14:18 - 00000000 ____D C:\Users\Brandon\Desktop\Animations
2013-11-01 15:13 - 2013-11-03 11:16 - 00252688 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2013-11-01 15:10 - 2013-11-03 11:16 - 00126736 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2013-11-01 15:10 - 2013-11-01 15:10 - 00154896 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2013-11-01 15:10 - 2013-11-01 15:10 - 00140560 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2013-11-01 15:07 - 2013-11-01 15:07 - 00204048 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2013-11-01 10:26 - 2013-11-01 10:26 - 00000000 ____D C:\Users\Brandon\Desktop\rex_date
2013-10-31 19:58 - 2013-10-07 15:23 - 00000843 _____ C:\Users\Public\Desktop\Construct 2.lnk
2013-10-31 19:58 - 2012-12-07 20:12 - 00000000 ____D C:\Program Files\Construct 2
2013-10-31 19:57 - 2013-10-31 19:56 - 128683080 _____ (Scirra                                                      ) C:\Users\Brandon\Downloads\construct2-r148-setup_18543583.exe
2013-10-31 19:55 - 2013-10-31 19:55 - 00000000 ____D C:\Users\Brandon\Desktop\7_Textbox_addon
2013-10-31 16:12 - 2013-10-29 09:57 - 00000061 _____ C:\Users\Brandon\Desktop\COLLEGEWORK.txt
2013-10-30 22:40 - 2013-10-30 22:40 - 02769432 _____ C:\Users\Brandon\Desktop\Ride.3gp.mp4
2013-10-30 22:29 - 2013-10-30 22:29 - 02803140 _____ C:\Users\Brandon\Desktop\Ride.mp4
2013-10-30 15:04 - 2013-10-30 15:04 - 01058176 _____ (PassMark Software                                           ) C:\Users\Brandon\Downloads\diskcheckup.exe
2013-10-30 15:04 - 2013-10-30 15:04 - 00000000 ____D C:\Program Files (x86)\DiskCheckup
2013-10-30 12:17 - 2013-10-30 12:17 - 04668633 _____ C:\Users\Brandon\Downloads\p95v279.win64.zip
2013-10-30 12:16 - 2013-10-30 12:16 - 00425667 _____ C:\Users\Brandon\Downloads\memtest86-iso.zip
2013-10-29 21:15 - 2013-08-27 13:39 - 00000000 ____D C:\Users\Brandon\Desktop\New folder (2)
2013-10-28 22:47 - 2012-12-06 11:56 - 00000000 ____D C:\Users\Brandon\AppData\Local\VirtualStore
2013-10-28 22:46 - 2013-10-23 16:34 - 00000000 ____D C:\Users\Brandon\Documents\javascript-sdk-template
2013-10-28 22:46 - 2013-09-15 21:15 - 00000000 ____D C:\Users\Brandon\Desktop\osx
2013-10-28 22:46 - 2012-12-06 14:23 - 00000000 ____D C:\Users\Brandon\AppData\Roaming\SoftGrid Client
2013-10-28 22:46 - 2012-12-06 12:18 - 00000000 ____D C:\.jagex_cache_32
2013-10-28 22:46 - 2012-12-06 11:57 - 00000000 ____D C:\Users\Brandon\AppData\Local\Hewlett-Packard
2013-10-28 22:46 - 2012-10-09 14:54 - 00000000 ____D C:\ProgramData\Norton
2013-10-28 22:46 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
2013-10-28 22:46 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\AppCompat
2013-10-28 22:45 - 2012-12-06 14:28 - 00000000 __RHD C:\MSOCache
2013-10-20 20:45 - 2013-10-20 14:50 - 00000000 ____D C:\ProgramData\AVG SafeGuard toolbar
2013-10-20 20:45 - 2013-10-20 14:50 - 00000000 ____D C:\Program Files (x86)\AVG SafeGuard toolbar
2013-10-20 15:35 - 2013-10-20 15:35 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem (1).zip
2013-10-20 15:33 - 2013-10-20 15:33 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(3).zip
2013-10-20 15:31 - 2013-10-20 15:31 - 00000000 ____D C:\Users\Brandon\Desktop\Truth is - Copy
2013-10-20 15:26 - 2013-10-20 15:26 - 00025270 _____ C:\Users\Brandon\Downloads\login_error(1).zip
2013-10-20 15:03 - 2013-10-20 15:03 - 00000000 ____D C:\Users\Brandon\Documents\Add-in Express
2013-10-20 14:50 - 2013-10-20 14:50 - 00003746 _____ C:\Program Files (x86)\Mozilla Firefoxsafeguard-secure-search.xml
2013-10-20 14:50 - 2013-10-20 14:50 - 00000000 ____D C:\Users\Brandon\AppData\Local\AVG SafeGuard toolbar
2013-10-19 21:47 - 2013-10-19 21:47 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem(2).zip
2013-10-19 21:37 - 2013-10-19 21:37 - 00045129 _____ C:\Users\Brandon\Downloads\RegistrationForm.zip
2013-10-19 21:12 - 2013-10-19 21:12 - 00130763 _____ C:\Users\Brandon\Downloads\logintest(1).zip
2013-10-19 21:10 - 2013-10-19 21:10 - 00018387 _____ C:\Users\Brandon\Downloads\loginsystem(1).zip
2013-10-19 21:04 - 2013-10-19 21:04 - 00002553 _____ C:\Users\Brandon\Downloads\login_error.zip
2013-10-19 20:45 - 2013-10-19 20:45 - 00130763 _____ C:\Users\Brandon\Downloads\logintest.zip
2013-10-19 20:37 - 2013-10-19 20:37 - 00019207 _____ C:\Users\Brandon\Downloads\loginsystem.zip
2013-10-19 20:26 - 2012-12-06 12:18 - 00000024 _____ C:\Users\Brandon\random.dat
2013-10-19 18:46 - 2012-12-06 12:18 - 00000024 _____ C:\Users\Brandon\jagexappletviewer.preferences
2013-10-19 18:45 - 2012-12-06 12:18 - 00000046 _____ C:\Users\Brandon\jagex_cl_runescape_LIVE.dat
2013-10-14 21:45 - 2013-01-27 18:16 - 00002004 ____H C:\Users\Brandon\Documents\Default.rdp
2013-10-14 19:04 - 2013-10-14 19:02 - 176553561 _____ C:\Users\Brandon\Downloads\6043 - Pokemon - White 2 (v01)(DSi Enhanced) (J).zip
2013-10-14 13:59 - 2013-10-14 13:58 - 00000000 ____D C:\Program Files (x86)\SpeedFan
2013-10-14 13:58 - 2013-10-14 13:58 - 00001007 _____ C:\Users\Brandon\Desktop\SpeedFan.lnk
2013-10-14 13:58 - 2013-10-14 13:58 - 00000045 _____ C:\Windows\SysWOW64\initdebug.nfo
2013-10-14 13:57 - 2013-10-14 13:57 - 02143832 _____ C:\Users\Brandon\Downloads\instsf449.exe
2013-10-12 00:39 - 2013-01-02 12:20 - 00000000 ____D C:\Users\Brandon\.gimp-2.8
2013-10-11 16:34 - 2013-10-11 16:26 - 00000000 ___RD C:\Users\Brandon\SkyDrive
2013-10-11 16:26 - 2013-10-11 16:26 - 00002164 _____ C:\Users\Brandon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-11 16:26 - 2013-10-11 16:26 - 00002100 _____ C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft SkyDrive.lnk
2013-10-11 16:26 - 2013-10-11 16:26 - 00000000 ____D C:\Program Files (x86)\Microsoft SkyDrive
2013-10-11 16:25 - 2013-10-11 16:26 - 06040688 _____ (Microsoft Corporation) C:\Users\Brandon\Downloads\SkyDriveSetup.exe
2013-10-11 16:25 - 2013-10-11 16:25 - 00000000 ____D C:\ProgramData\Microsoft SkyDrive
2013-10-11 12:17 - 2013-10-11 12:17 - 00000065 _____ C:\Users\Brandon\Documents\PWOOptions.ini
2013-10-11 11:58 - 2013-10-11 11:57 - 33405439 _____ C:\Users\Brandon\Downloads\PWO181.zip

Files to move or delete:
====================
C:\Users\Brandon\AppData\Roaming\Camdata.ini
C:\Users\Brandon\AppData\Roaming\CamLayout.ini
C:\Users\Brandon\AppData\Roaming\CamShapes.ini
C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat
C:\Users\Brandon\jagex_cl_runescape_LIVE.dat
C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat
C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat
C:\Users\Brandon\random.dat

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2013-11-10 04:16

==================== End Of Log ============================

Addition.txt:

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 10-11-2013 01
Ran by Brandon at 2013-11-10 20:26:08
Running from C:\Users\Brandon\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Norton 360 (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton 360 (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton 360 (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

64 Bit HP CIO Components Installer (Version: 7.2.4)
7-Zip 9.22beta (x32)
Adobe AIR (x32 Version: 2.6.0.19140)
Adobe Community Help (x32 Version: 3.5.23)
Adobe Flash Player 11 ActiveX (x32 Version: 11.9.900.117)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.117)
Adobe Reader X (10.1.2) MUI (x32 Version: 10.1.2)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.3.633)
Age of Empires III (x32 Version: 1.00.0000)
AIO_Scan (x32 Version: 130.0.365.000)
AMD Accelerated Video Transcoding (Version: 2.00.0002)
AMD APP SDK Runtime (Version: 10.0.898.1)
AMD Catalyst Install Manager (Version: 3.0.868.0)
Apple Application Support (x32 Version: 2.3.2)
Apple Mobile Device Support (Version: 6.0.1.3)
Apple Software Update (x32 Version: 2.1.3.127)
Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 2.0.12.13)
Audacity 2.0.3 (x32 Version: 2.0.3)
BioShock Infinite (x32)
Bonjour (Version: 3.0.0.10)
BufferChm (x32 Version: 140.0.212.000)
C310 (x32 Version: 140.0.304.000)
C4200 (x32 Version: 130.0.365.000)
c4200_Help (x32 Version: 82.0.210.000)
CamStudio version 2.7 (x32 Version: 2.7)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2012.0326.310.3601)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.0326.310.3601)
Catalyst Control Center InstallProxy (x32 Version: 2012.0326.310.3601)
Catalyst Control Center Localization All (x32 Version: 2012.0326.310.3601)
Catalyst Control Center Profiles Mobile (x32 Version: 2012.0326.310.3601)
CCC Help Chinese Standard (x32 Version: 2012.0326.0309.3601)
CCC Help Chinese Traditional (x32 Version: 2012.0326.0309.3601)
CCC Help Czech (x32 Version: 2012.0326.0309.3601)
CCC Help Danish (x32 Version: 2012.0326.0309.3601)
CCC Help Dutch (x32 Version: 2012.0326.0309.3601)
CCC Help English (x32 Version: 2012.0326.0309.3601)
CCC Help Finnish (x32 Version: 2012.0326.0309.3601)
CCC Help French (x32 Version: 2012.0326.0309.3601)
CCC Help German (x32 Version: 2012.0326.0309.3601)
CCC Help Greek (x32 Version: 2012.0326.0309.3601)
CCC Help Hungarian (x32 Version: 2012.0326.0309.3601)
CCC Help Italian (x32 Version: 2012.0326.0309.3601)
CCC Help Japanese (x32 Version: 2012.0326.0309.3601)
CCC Help Korean (x32 Version: 2012.0326.0309.3601)
CCC Help Norwegian (x32 Version: 2012.0326.0309.3601)
CCC Help Polish (x32 Version: 2012.0326.0309.3601)
CCC Help Portuguese (x32 Version: 2012.0326.0309.3601)
CCC Help Russian (x32 Version: 2012.0326.0309.3601)
CCC Help Spanish (x32 Version: 2012.0326.0309.3601)
CCC Help Swedish (x32 Version: 2012.0326.0309.3601)
CCC Help Thai (x32 Version: 2012.0326.0309.3601)
CCC Help Turkish (x32 Version: 2012.0326.0309.3601)
ccc-utility64 (Version: 2012.0326.310.3601)
Chivalry: Medieval Warfare (x32)
Cisco Connect (x32 Version: 1.4.12284.0)
Construct 2 r148 (Version: 1.0.148.0)
Copy (x32 Version: 130.0.428.000)
Counter-Strike: Global Offensive (x32)
Coupon Printer for Windows (x32 Version: 5.0.0.0)
CyberLink PowerDVD (x32 Version: 10.0.5.3817)
CyberLink YouCam (x32 Version: 3.5.3.5018)
D3DX10 (x32 Version: 15.4.2368.0902)
Deal Spy (x32 Version: 1.26.153.1)
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
Destinations (x32 Version: 140.0.77.000)
DeviceDiscovery (x32 Version: 140.0.212.000)
DiskCheckup v3.1 (x32 Version: 3.1.1007)
DocProc (x32 Version: 13.0.0.0)
Empires Dawn of the Modern World (x32)
ESU for Microsoft Windows 7 SP1 (x32 Version: 5.1.4)
FileZilla Client 3.7.3 (x32 Version: 3.7.3)
Free RAR Extract Frog (x32 Version: 4.70)
GameSpy Arcade (x32)
GIMP 2.8.2 (Version: 2.8.2)
Google Chrome (x32 Version: 30.0.1599.101)
Google Talk Plugin (x32 Version: 4.9.1.16010)
Google Update Helper (x32 Version: 1.3.21.165)
GPBaseService2 (x32 Version: 140.0.211.000)
Grand Theft Auto (x32)
Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000)
HP 3D DriveGuard (Version: 4.1.12.1)
HP CoolSense (x32 Version: 2.10.3)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8)
HP Customer Participation Program 14.0 (Version: 14.0)
HP Documentation (x32 Version: 1.1.0.0)
HP Imaging Device Functions 14.0 (Version: 14.0)
HP Launch Box (Version: 1.1.5)
HP On Screen Display (x32 Version: 1.3.5)
HP Photo Creations (x32 Version: 1.0.0.2024)
HP Photosmart C4200 All-In-One Driver Software 13.0 Rel. 1 (Version: 13.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Photosmart Prem C310 All-In-One Driver Software 14.0 Rel. 7 (Version: 14.0)
HP Power Manager (x32 Version: 1.4.8)
HP Product Detection (x32 Version: 11.14.0004)
HP Proximity Sensor Utility (x32 Version: 1.0.19)
HP Quick Launch (x32 Version: 2.7.2)
HP Recovery Manager (x32 Version: 2.0.0)
HP Setup (x32 Version: 8.7.4751.3798)
HP Smart Web Printing 4.60 (Version: 4.60)
HP Software Framework (x32 Version: 4.5.6.1)
HP Solution Center 14.0 (Version: 14.0)
HP Support Assistant (x32 Version: 7.0.39.15)
HP Update (x32 Version: 5.002.002.002)
HP Wireless Audio Manager 1.1.4 (x32 Version: 1.1.4)
HPAppStudio (x32 Version: 140.0.95.000)
HPPhotoGadget (x32 Version: 140.0.524.000)
HPPhotoSmartDiscLabelContent1 (x32 Version: 2.04.0000)
HPPhotosmartEssential (x32 Version: 2.04.0000)
HPProductAssistant (x32 Version: 140.0.212.000)
HPSSupply (x32 Version: 140.0.211.000)
IDT Audio (x32 Version: 1.0.6381.0)
Inkscape 0.48.4 (x32 Version: 0.48.4)
Intel PROSet Wireless
Intel® Control Center (x32 Version: 1.2.1.1007)
Intel® Display Audio Driver (x32 Version: 6.14.00.3090)
Intel® Management Engine Components (x32 Version: 8.0.0.1351)
Intel® PROSet/Wireless for Bluetooth® + High Speed (Version: 15.1.0.0096)
Intel® PROSet/Wireless Software for Bluetooth® Technology (Version: 2.1.0.0140)
Intel® Rapid Storage Technology (x32 Version: 11.0.0.1032)
Intel® Smart Connect Technology 2.0 x64 (Version: 2.0.1083.0)
Intel® Turbo Boost Technology Monitor 2.6 (Version: 2.6.2.0)
Intel® USB 3.0 eXtensible Host Controller Driver (x32 Version: 1.0.4.225)
Intel® WiDi (x32 Version: 3.0.13.0)
Intel® Wireless Display
Intel® Hardware Accelerated Execution Manager (Version: 1.0.1)
Intel® PROSet/Wireless WiFi Software (Version: 15.01.0500.0903)
Intel® Trusted Connect Service Client (Version: 1.23.216.0)
ISO to USB (x32)
iTunes (Version: 11.0.0.163)
Java 7 Update 25 (x32 Version: 7.0.250)
Java 7 Update 6 (64-bit) (Version: 7.0.60)
Java Auto Updater (x32 Version: 2.1.9.5)
Left 4 Dead 2 (x32)
Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300)
MarketResearch (x32 Version: 140.0.212.000)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Access 2010 (x32 Version: 14.0.6029.1000)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Default Manager (x32 Version: 2.1.54.0)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office 2010 Language Pack Service Pack 1 (SP1) (x32)
Microsoft Office 2010 Service Pack 1 (SP1) (x32)
Microsoft Office Access 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000)
Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Starter 2010 - English (x32 Version: 14.0.5139.5005)
Microsoft Office Visio 2010 (x32 Version: 14.0.6029.1000)
Microsoft Office Visio MUI (English) 2010 (x32 Version: 14.0.6029.1000)
Microsoft Rise Of Nations (x32)
Microsoft Search Enhancement Pack (x32 Version: 3.0.126.0)
Microsoft Silverlight (Version: 5.1.20913.0)
Microsoft SkyDrive (HKCU Version: 17.0.2015.0811)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visio 2010 Service Pack 1 (SP1) (x32)
Microsoft Visio Professional 2010 (x32 Version: 14.0.6029.1000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual Studio 6.0 Professional Edition (x32)
Microsoft Web Publishing Wizard 1.53 (x32)
Movie Maker (x32 Version: 16.4.3505.0912)
Mozilla Firefox 25.0 (x86 en-US) (x32 Version: 25.0)
Mozilla Maintenance Service (x32 Version: 25.0)
MSN Toolbar (x32 Version: 4.0.0357.1)
MSN Toolbar Platform (x32 Version: 4.0.0357.1)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT110 (x32 Version: 16.4.1108.0727)
MSVCRT110_amd64 (Version: 16.4.1109.0912)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML4 Parser (x32 Version: 1.0.0)
MX Simulator Demo (x32)
Network64 (Version: 140.0.215.000)
NOOK Study (x32 Version: 2.1.2.28770)
Norton 360 (x32 Version: 20.4.0.40)
Notepad++ (x32 Version: 6.2.2)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
Opera Mobile Emulator (x32)
Oracle VM VirtualBox 4.3.2 (Version: 4.3.2)
Paint.NET v3.5.10 (Version: 3.60.0)
Photo Gallery (x32 Version: 16.4.3505.0912)
Power2Go (x32 Version: 6.1.6224)
Project64 1.6 (x32 Version: 1.6)
PS_AIO_07_C310_SW_Min (x32 Version: 140.0.304.000)
PS_AIO_Software_min (x32 Version: 130.0.365.000)
PX Profile Update (x32 Version: 1.00.1.)
QuickTransfer (x32 Version: 140.0.98.000)
Realtek PCIE Card Reader (x32 Version: 6.1.7601.29011)
RuneScape Launcher 1.2.3 (x32 Version: 1.2.3)
S3D Web Player (Version: 1.8.0.1)
Scan (x32 Version: 140.0.80.000)
Secure Download Manager (x32 Version: 3.1.10)
SecureW2 Enterprise Client 3.5.7 (x32)
Shop for HP Supplies (Version: 14.0)
SketchUp 8 (x32 Version: 3.0.16846)
Skype™ 6.7 (x32 Version: 6.7.102)
SmartWebPrinting (x32 Version: 140.0.186.000)
SolutionCenter (x32 Version: 140.0.214.000)
SpeedFan (remove only) (x32)
SSH Secure Shell (x32)
Status (x32 Version: 140.0.256.000)
Steam (x32 Version: 1.0.0.0)
swMSM (x32 Version: 12.0.0.1)
Synaptics Pointing Device Driver (Version: 16.0.1.0)
Team Fortress 2 (x32)
TheHunt (x32 Version: TheHunt)
Toolbox (x32 Version: 140.0.428.000)
TrayApp (x32 Version: 140.0.212.000)
Unity Web Player (HKCU Version: )
UnloadSupport (x32 Version: 11.0.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2566458) (x32)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
WampServer 2.4 (x32)
WebReg (x32 Version: 140.0.212.017)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912)
Windows Live Essentials (x32 Version: 16.4.3505.0912)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (x32 Version: 16.4.3505.0912)
Windows Live Photo Common (x32 Version: 16.4.3505.0912)
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912)
Windows Live SOXE (x32 Version: 16.4.3505.0912)
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912)
Windows Live UX Platform (x32 Version: 16.4.3505.0912)
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912)

==================== Restore Points =========================

17-10-2013 10:20:11 Scheduled Checkpoint
20-10-2013 20:02:44 Removed WinZip 17.5
21-10-2013 01:43:02 Restore Operation
21-10-2013 02:45:51 HOTLLAMA Media Player Installation
29-10-2013 03:42:01 Restore Operation
03-11-2013 16:16:04 Installed Oracle VM VirtualBox 4.3.2
11-11-2013 01:21:36 Removed Microsoft Device Emulator (64 bit) version 3.0 - ENU

==================== Hosts content: ==========================

2009-07-13 21:34 - 2013-11-02 19:54 - 00000986 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
127.0.0.1       localhost
127.0.0.1       localhost
127.0.0.1       localhost
127.0.0.1       localhost
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {11A89BD3-98EC-4CC7-A45C-94281112FD8F} - System32\Tasks\MirageAgent => C:\Program Files (x86)\Cyberlink\YouCam\YCMMirage.exe [2012-02-21] (CyberLink)
Task: {2189B92C-2E1B-4B40-99DD-A36E670F2334} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\wscstub.exe [2013-06-03] (Symantec Corporation)
Task: {336628F0-5EC6-4B35-9AEE-CB9C10D33C57} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
Task: {4ADA26AE-C183-43D8-8397-A7AA74C9DEDC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company)
Task: {53D42EB3-6919-41A6-84FE-478B5B7B08E8} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard)
Task: {6B62729E-FE48-4BB0-9A9C-B79D6E808767} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation)
Task: {6C4AE5B8-3192-42F7-B629-ABDE6A9C9408} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\20.4.0.40\symerr.exe [2013-06-03] (Symantec Corporation)
Task: {8D6311F2-6070-4BEB-88DC-D6C89CD7E415} - System32\Tasks\SecureW2 Task => C:\Program Files (x86)\SecureW2\sw2_tray.exe [2012-02-22] (SecureW2 B.V.)
Task: {91F54832-1A12-4D5A-8EC7-F2C0B685D930} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {BA9611FB-6F29-42DE-9D8E-C324967EE4CA} - System32\Tasks\Registration => C:\Program Files (x86)\Hewlett-Packard\HP Setup\RemEngine.exe [2011-06-27] ()
Task: {BDD1F95D-D7C0-4159-8531-760290E4C0AB} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company)
Task: {BFA5D592-7014-4B47-9D82-0FA2F23434EB} - System32\Tasks\HPCeeScheduleForBrandon => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {C627FC5B-851F-4F0B-8866-510ED592FF86} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-10-09] (Adobe Systems Incorporated)
Task: {D94F17DB-1C5F-4957-B1A5-E74738BD9288} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
Task: {E0E8A6F7-2A5C-4EF4-AEE6-4923D85E62B4} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
Task: {F06FF55F-8619-4CE2-BDEA-0F60D3639353} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {F6A98AC2-4397-4C9C-9FBE-D5C9326BD33A} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe [2013-02-18] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001Core.job => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-4099442173-970438206-790001278-1001UA.job => C:\Users\Brandon\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForBrandon.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2012-02-09 18:26 - 2012-02-09 18:26 - 00048128 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\NetworkHeuristic.dll
2012-02-09 18:26 - 2012-02-09 18:26 - 00036864 _____ () C:\Program Files\Intel\Intel® Smart Connect Technology Agent\ISCTNetDetect.dll
2010-01-02 09:42 - 2010-01-02 09:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-02-28 02:07 - 2012-02-28 02:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2012-02-03 15:33 - 2012-02-03 15:33 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2012-03-26 05:03 - 2012-03-26 05:03 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2013-11-02 19:53 - 2013-06-23 10:09 - 00131072 _____ () c:\wamp\bin\apache\apache2.4.4\bin\pcre.dll
2013-11-02 19:53 - 2013-06-23 10:09 - 00131072 _____ () C:\wamp\bin\apache\apache2.4.4\bin\pcre.dll
2012-11-28 14:13 - 2012-11-28 14:13 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2012-11-28 14:13 - 2012-11-28 14:13 - 01242512 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-08-07 14:25 - 2013-08-07 14:25 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2013-06-17 18:39 - 2012-05-30 09:51 - 00699280 ____R () C:\PROGRAM FILES (X86)\NORTON 360\ENGINE\20.4.0.40\wincfi39.dll
2012-02-26 22:39 - 2012-02-26 22:39 - 00025608 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Wireless Audio\CustomControls.dll
2013-03-12 16:10 - 2013-04-23 21:30 - 00652800 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2012-12-15 22:39 - 2013-05-03 18:35 - 01114536 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2012-12-15 22:39 - 2013-03-26 19:16 - 20341672 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2012-12-15 22:39 - 2012-12-11 12:51 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll
2012-12-15 22:39 - 2012-12-11 12:51 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll
2012-12-15 22:39 - 2012-12-11 12:51 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll
2013-08-14 02:32 - 2013-08-14 02:32 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\991a8d378a3e64b31c0f4770ba9ae071\IsdiInterop.ni.dll
2012-10-09 14:43 - 2011-11-29 22:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2012-10-09 14:43 - 2011-12-16 13:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll
2013-11-06 10:00 - 2013-11-06 10:00 - 03368048 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2013-10-09 09:29 - 2013-10-09 09:29 - 16233864 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_117.dll

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

==================== Faulty Device Manager Devices =============

Name: Microsoft Virtual WiFi Miniport Adapter #2
Description: Microsoft Virtual WiFi Miniport Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart Prem C310 series
Description: Photosmart Prem C310 series
Class Guid: {4d36e971-e325-11ce-bfc1-08002be10318}
Manufacturer: HP
Service:
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

Name: Photosmart Prem C310 series
Description: Photosmart Prem C310 series
Class Guid: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
Manufacturer: HP
Service: StillCam
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================
Error: (11/10/2013 06:32:00 PM) (Source: Application Error) (User: )
Description: Windows cannot access the file for one of the following reasons:
there is a problem with the network connection, the disk that the file is stored on, or the storage
drivers installed on this computer; or the disk is missing.
Windows closed the program Protection Stub because of this error.

Program: Protection Stub
File:

The error value is listed in the Additional Data section.
User Action
1. Open the file again.
This situation might be a temporary problem that corrects itself when the program runs again.
2.
If the file still cannot be accessed and
   - It is on the network,
your network administrator should verify that there is not a problem with the network and that the server can be contacted.
   - It is on a removable disk, for example, a floppy disk or CD-ROM, verify that the disk is fully inserted into the computer.
3. Check and repair the file system by running CHKDSK. To run CHKDSK, click Start, click Run, type CMD, and then click OK. At the command prompt, type CHKDSK /F, and then press ENTER.
4. If the problem persists, restore the file from a backup copy.
5. Determine whether other files on the same disk can be opened. If not, the disk might be damaged. If it is a hard disk, contact your administrator or computer hardware vendor for
further assistance.

Additional Data
Error value: 00000000
Disk type: 0

Error: (11/10/2013 06:32:00 PM) (Source: Application Error) (User: )
Description: Faulting application name: ins5FD8.tmp, version: 3.0.0.0, time stamp: 0x40daa4fa
Faulting module name: ins5FD8.tmp, version: 3.0.0.0, time stamp: 0x40daa4fa
Exception code: 0xc000001d
Fault offset: 0x00058b94
Faulting process id: 0x25c8
Faulting application start time: 0xins5FD8.tmp0
Faulting application path: ins5FD8.tmp1
Faulting module path: ins5FD8.tmp2
Report Id: ins5FD8.tmp3

Error: (11/10/2013 06:21:36 PM) (Source: Application Error) (User: )
Description: Faulting application name: Power2Go.exe, version: 6.1.0.6224, time stamp: 0x4d8c05b5
Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea8e7
Exception code: 0xc0000008
Fault offset: 0x00082808
Faulting process id: 0x228c
Faulting application start time: 0xPower2Go.exe0
Faulting application path: Power2Go.exe1
Faulting module path: Power2Go.exe2
Report Id: Power2Go.exe3

Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 998

Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 998

Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2012

Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2012

Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/09/2013 10:40:45 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1014

System errors:
=============
Error: (11/08/2013 11:46:10 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (11/03/2013 10:51:25 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (11/03/2013 10:27:47 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (11/03/2013 10:16:24 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (11/03/2013 09:59:18 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (11/03/2013 09:23:27 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (11/03/2013 09:15:44 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (11/03/2013 08:59:40 AM) (Source: DCOM) (User: )
Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}

Error: (11/02/2013 08:30:06 PM) (Source: EventLog) (User: )
Description: The previous system shutdown at 9:26:38 PM on ‎11/‎2/‎2013 was unexpected.

Error: (11/02/2013 07:51:05 PM) (Source: Service Control Manager) (User: )
Description: The wampapache service terminated with service-specific error %%1.

Microsoft Office Sessions:
=========================
Error: (11/10/2013 06:32:00 PM) (Source: Application Error)(User: )
Description: Protection Stub000000000

Error: (11/10/2013 06:32:00 PM) (Source: Application Error)(User: )
Description: ins5FD8.tmp3.0.0.040daa4fains5FD8.tmp3.0.0.040daa4fac000001d00058b9425c801cede6cfe4cce22C:\Users\Brandon\AppData\Local\Temp\ins5FD8.tmpC:\Users\Brandon\AppData\Local\Temp\ins5FD8.tmp4b49016f-4a60-11e3-9362-949ec074d51b

Error: (11/10/2013 06:21:36 PM) (Source: Application Error)(User: )
Description: Power2Go.exe6.1.0.62244d8c05b5ntdll.dll6.1.7601.18247521ea8e7c000000800082808228c01cede6b6ae2ec65C:\Program Files (x86)\CyberLink\Power2Go\Power2Go.exeC:\Windows\SysWOW64\ntdll.dlld79ce4ce-4a5e-11e3-9362-949ec074d51b

Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 998

Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 998

Error: (11/10/2013 02:45:03 PM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 2012

Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 2012

Error: (11/09/2013 10:40:46 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (11/09/2013 10:40:45 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1014

==================== Memory info ===========================

Percentage of memory in use: 27%
Total physical RAM: 16286.36 MB
Available physical RAM: 11796.82 MB
Total Pagefile: 32570.89 MB
Available Pagefile: 27807.62 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:677.52 GB) (Free:430.31 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive d: (Recovery) (Fixed) (Total:20.82 GB) (Free:2.53 GB) NTFS ==>[system with boot components (obtained from reading drive)]
Drive e: (AOE III DISC 1) (CDROM) (Total:0.59 GB) (Free:0 GB) CDFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 00815C00)
Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=678 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=21 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=102 MB) - (Type=0C)

==================== End Of Log ============================

kevinf80 · November 11, 2013

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Next,

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Uncheck any elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review.
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted (if necessary):
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Next,

Run Malwarebytes, Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware,

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced log.

Next,

We need to run an online AV scan to ensure there are no remnants of any infection left on your system, this scan can take several hours to complete, it is very thorough and well worth running, please be patient and let it complete:

Run Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings, ensure the options
Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

When the scan is complete

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

If threats were found

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

close program

copy and paste the report here

Next,

Download Security Check by screen317 from either of the following:

http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe

Save it to your Desktop.

Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me see those logs, also give an update on any remaining issues or concerns...

Kevin

fixlist.txt

brando223 · November 12, 2013

FixLog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-11-2013 01
Ran by Brandon at 2013-11-11 14:46:58 Run:1
Running from C:\Users\Brandon\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
MountPoints2: {7d6312d7-5b28-11e2-a35b-c485087b4d81} - F:\MotoCastSetup.exe -a
MountPoints2: {a99f57c0-1250-11e2-a8eb-806e6f6e6963} - E:\autorun.exe
SearchScopes: HKLM - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKLM-x32 - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
SearchScopes: HKCU - {2fa28606-de77-4029-af96-b231e3b8f827} URL = http://search.ask.com/web?q={searchterms}&l=dis&o=HPNTDF
C:\Users\Brandon\AppData\Roaming\Camdata.ini
C:\Users\Brandon\AppData\Roaming\CamLayout.ini
C:\Users\Brandon\AppData\Roaming\CamShapes.ini
C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat
C:\Users\Brandon\jagex_cl_runescape_LIVE.dat
C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat
C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat
C:\Users\Brandon\random.dat
2009-07-13 21:34 - 2013-11-02 19:54 - 00000986 ____A C:\Windows\system32\Drivers\etc\hosts
End

*****************

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7d6312d7-5b28-11e2-a35b-c485087b4d81} => Key deleted successfully.
HKCR\CLSID\{7d6312d7-5b28-11e2-a35b-c485087b4d81} => Key not found.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a99f57c0-1250-11e2-a8eb-806e6f6e6963} => Key deleted successfully.
HKCR\CLSID\{a99f57c0-1250-11e2-a8eb-806e6f6e6963} => Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully.
HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully.
HKCR\Wow6432Node\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} => Key deleted successfully.
HKCR\CLSID\{2fa28606-de77-4029-af96-b231e3b8f827} => Key not found.
C:\Users\Brandon\AppData\Roaming\Camdata.ini => Moved successfully.
C:\Users\Brandon\AppData\Roaming\CamLayout.ini => Moved successfully.
C:\Users\Brandon\AppData\Roaming\CamShapes.ini => Moved successfully.
C:\Users\Brandon\jagex_cl_oldschool_LIVE.dat => Moved successfully.
C:\Users\Brandon\jagex_cl_runescape_LIVE.dat => Moved successfully.
C:\Users\Brandon\jagex_cl_runescape_LIVE1.dat => Moved successfully.
C:\Users\Brandon\jagex_cl_runescape_LIVE_BETA.dat => Moved successfully.
C:\Users\Brandon\random.dat => Moved successfully.
C:\Windows\system32\Drivers\etc\hosts => Moved successfully.

==== End of Fixlog ====

ADW CLEANER:

# AdwCleaner v3.012 - Report created 11/11/2013 at 14:52:36
# Updated 11/11/2013 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : Brandon - BRANDON-HP
# Running from : C:\Users\Brandon\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220222622276}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660266626676}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660266626676}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\Cr_Installer
Key Deleted : HKCU\Software\installedbrowserextensions
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKLM\Software\PIP

***** [ Browsers ] *****

-\\ Internet Explorer v0.0.0.0

-\\ Mozilla Firefox v25.0 (en-US)

[ File : C:\Users\Brandon\AppData\Roaming\Mozilla\Firefox\Profiles\ftninpc5.default\prefs.js ]

Line Deleted : user_pref("extensions.crossrider.bic", "13dc8d8943234a7ac588a42349ce30a7");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationThankYouPage", true);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationTime", 1364874243);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.searchUserConifrmation", false);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setHomepage", false);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setNewTab", false);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.InstallationUserSettings.setSearch", false);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.active", true);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.addressbar", "NA");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.addressbarenhanced", "");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncdb_dbWasSet", true);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncdb_dbWasSet_FF25_FIX", true);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncinternaldb_dbWasSet", true);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.asyncinternaldb_dbWasSet_FF25_FIX", true);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.backgroundjs", "\n\n//\n");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.backgroundver", 11);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.can_run_bg_code", true);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.certdomaininstaller", "");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.changeprevious", false);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallationTime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallationTime.value", "1364874243");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.InstallerParams.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_aoi.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_aoi.value", "1364874243");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_arbitrary_code.expiration", "Mon Nov 11 2013 14:52:14 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_arbitrary_code.value", "%22%28function%28%29%7B_GPL_PLUGIN.st%3D%7B%5C%2274052%26pid%3D1269%5C%22%3A%7Bs%3A%5B%5C%2274052%26pid%3D1695%5C%22%[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_blocklist.expiration", "Mon Nov 11 2013 14:52:14 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_blocklist.value", "%22bing.com%2Cfacebook.com%2Cnonexistantdomain.com%22");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_country_code.expiration", "Wed Nov 13 2013 22:27:05 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_country_code.value", "%22US%22");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_crr.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_crr.value", "1384199238");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_currenttime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_currenttime.value", "%221383332399%22");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_hotfix20111102645.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_hotfix20111102645.value", "%221%22");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_delay.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_delay.value", "24");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_disclosure.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_disclosure.value", "1367856897");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_list.expiration", "Mon Nov 11 2013 16:18:39 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_list.value", "%7B%22f7610cf2b37067876b694a05c56f32e2%22%3A%7B%22p%22%3A%22/%22%7D%2C%22d763717b4b2e0a17a877cc642fb80ee4%22%3A%7B%22p%22%3A[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_t.expiration", "Mon Nov 11 2013 20:14:40 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_ib_t.value", "%22hxxp%3A//download.bleepingcomputer.com/dl/166f9bbb082732c4270bfb13eac5f7d1/52802f7c/windows/security/security-utilities/f/fa[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installer_params.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installer_params.value", "%7B%22source_id%22%3A%22142732%22%2C%22sub_id%22%3A%22default%22%2C%22uzid%22%3A%22142732%26subid%3D%26pid%3D1384%2[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installtime.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_installtime.value", "%221364833255%22");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_parent_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_parent_zoneid.value", "%2214019%22");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_pc_20120828.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_pc_20120828.value", "1364874491204");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_product_id.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_product_id.value", "%221347%22");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_zoneid.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie._GPL_zoneid.value", "%22165991%22");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.dbtest.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.cookie.dbtest.value", "1364874380692");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.description", "Deal Spy");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.domain", "");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.enablesearch", false);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.homepage", "");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.iframe", false);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.InstallerIdentifiers.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.InstallerIdentifiers.value", "%7B%22installer_bic%22%3A%2236DB0BA830CC42F2AEA6A0310D105C93IE%22%2C%22installer_verifier%22%3A%2214a03f09cabe5b[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_appVer.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_appVer.value", "17");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_lastVersion.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_lastVersion.value", "1");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_meta.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_meta.value", "%7B%7D");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_nextCheck.expiration", "Mon Nov 11 2013 16:18:29 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_nextCheck.value", "true");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_queue.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_queue.value", "%7B%7D");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_remote_resources.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.Resources_remote_resources.value", "%7B%22remoteId%22%3A0%7D");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.SoftwareDetected.expiration", "Fri Feb 01 2030 00:00:00 GMT-0500 (Eastern Standard Time)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.internaldb.SoftwareDetected.value", "%7B%22AnySoftware%22%3Afalse%2C%22Wireshark%22%3Afalse%2C%22VirtualBox%22%3Afalse%2C%22VMWare%22%3Afalse%2C%22Inside[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.js", "\n\nif(\"undefined\"!=typeof _GPL_PLUGIN){var _GPL_=function(){_GPL_PLUGIN.started||_GPL_PLUGIN.prepare({pid:1347,baseCDN:\"dealspy-a.akamaihd.net\[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.lastDailyReport", "1384183109255");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.lastUpdate", "1384183108690");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.manifesturl", "");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.name", "Deal Spy");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.newtab", "");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.opensearch", "");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.code", "appAPI._cr_config={appID:function(){var a=appAPI.appInfo;if(a){return appAPI.appInfo.id;}else{return appAPI.appID;}}};$jquery.ex[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.name", "base");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1.ver", 6);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.code", "Array.prototype.indexOf||(Array.prototype.indexOf=function(b){if(void 0===this||null===this)throw new TypeError;var c=Obje[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.name", "GPL Plugin (Loader)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000014.ver", 16);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.code", "var a=appAPI.db.getList(),cf_ran=!1,_GPL_BG={vars:{},rules:{},started:!1,allowed:!1,log:function(b){console.log(b)},factor[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.name", "GPL Background (BG)");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_1000015.ver", 39);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.code", "(function(a){a.selectedText=function(e,c){function d(){if(window.getSelection){return window.getSelection();}else{if(document.g[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.name", "CrossriderAppUtils");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_13.ver", 3);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.code", "if(typeof(appAPI)===\"undefined\"){appAPI={};}var CR__bIsIEWindow=false;if(typeof window!==\"undefined\"&&typeof window.navigat[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.name", "CrossriderUtils");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_14.ver", 8);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.code", "if((typeof isBackground===\"undefined\"||isBackground!==true)&&(typeof _firefoxVersion!==\"undefined\"&&_firefoxVersion>14)&&ty[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.name", "FFAppAPIWrapper");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_16.ver", 9);

Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_17.name", "jQuery");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_17.ver", 4);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.code", "var CrossriderDebugManager=(function(h){var f={appId:appAPI._cr_config.appID(),url:appAPI._cr_config.debug_app};return h.Class.[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.name", "debug");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_21.ver", 4);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.code", "(function(a){appAPI.queueManager={queue:[],register:function(b){this.queue.push(b);}};appAPI.ready=function(c,b){a.when.apply(n[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.name", "resources");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_22.ver", 4);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.code", "var CrossriderInitializerPlugin=(function(e){var c={appId:appAPI._cr_config.appID()},b,g=new e.Deferred(),f;return e.Class.exte[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.name", "initializer");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_28.ver", 3);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.code", "var jQuery = $jquery_171 = $jquery = null;\n\nif (document && typeof document.getElementById !== \"undefined\") {\n\n/*! jQuery [...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.name", "jquery_1_7_1");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_4.ver", 4);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.code", "(function(){appAPI.ready=function(a){appAPI.resources.isReady(a);};}());var CrossRiderResourcesManager=(function(){var C={appId[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.name", "resources_background");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_47.ver", 3);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.code", "(function(){var h=\"__CR_EMPTY_CHANNEL__\";var d=function(j){return(typeof j===\"object\"&&j!==null);};var b=function(j){return[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.name", "appApiMessage");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_64.ver", 2);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.code", "if(appAPI.__should_activate_validation__===true){(function(){var k={};var f=appAPI.appInfo.name;var l=function(s,r,t){var q=\"[[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.name", "appApiValidation");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_72.ver", 3);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.code", "if(typeof jQuery!==\"undefined\"&&(jQuery)&&typeof navigator!==\"undefined\"&&typeof navigator.userAgent!==\"undefined\"){(func[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.name", "CrossriderInfo");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_78.ver", 3);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.code", "(function(){var b=\"cr_\"+appAPI.appID+\"internalMessage\";var a=function(){var d=function(g){if(g===true){unsafeWindow.appAPI=[...]
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.name", "omniCommands");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins.plugin_98.ver", 2);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_0", "4,14,78,16,64,47,72,98,1000015");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_1", "17,14,78,13,16,64,4,1,21,22,72,98,1000014,28");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.plugins_lists.plugins_5", "4,14,78,13,16,64,47,72");

Line Deleted : user_pref("extensions.crossriderapp26276.26276.pluginsversion", 15);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.publisher", "Innovative Apps");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.searchstatus", 0);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.setnewtab", false);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.thankyou", "");
Line Deleted : user_pref("extensions.crossriderapp26276.26276.updateinterval", 360);
Line Deleted : user_pref("extensions.crossriderapp26276.26276.ver", 17);
Line Deleted : user_pref("extensions.crossriderapp26276.adsOldValue", -1);
Line Deleted : user_pref("extensions.crossriderapp26276.apps", "26276");
Line Deleted : user_pref("extensions.crossriderapp26276.bic", "13dc8d8943234a7ac588a42349ce30a7");
Line Deleted : user_pref("extensions.crossriderapp26276.cid", 26276);
Line Deleted : user_pref("extensions.crossriderapp26276.firstrun", false);
Line Deleted : user_pref("extensions.crossriderapp26276.hadappinstalled", true);
Line Deleted : user_pref("extensions.crossriderapp26276.installationdate", 1364874270);
Line Deleted : user_pref("extensions.crossriderapp26276.lastcheck", 23062968);
Line Deleted : user_pref("extensions.crossriderapp26276.lastcheckitem", 23063233);
Line Deleted : user_pref("extensions.crossriderapp26276.modetype", "production");
Line Deleted : user_pref("extensions.crossriderapp26276.reportInstall", true);
Line Deleted : user_pref("extensions.crossriderapp26276.statsDailyCounter", 473);

-\\ Google Chrome v30.0.1599.101

[ File : C:\Users\Brandon\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [21769 octets] - [11/11/2013 14:48:20]
AdwCleaner[s0].txt - [22348 octets] - [11/11/2013 14:52:36]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [22409 octets] ##########

The Malwarebytes log file did not display any threats.

ESET Online Scan log:

C:\Program Files (x86)\Deal Spy\ButtonUtil.dll   a variant of Win32/Toolbar.CrossRider.G application
C:\Program Files (x86)\Deal Spy\Deal Spy-bg.exe   a variant of Win32/Toolbar.CrossRider.E application
C:\Program Files (x86)\Deal Spy\Deal Spy.exe   a variant of Win32/Toolbar.CrossRider.E application
C:\Program Files (x86)\Deal Spy\Uninstall.exe   multiple threats
C:\Users\Brandon\.frostwire5\updates\frostwire-5.6.6.windows.exe   multiple threats
C:\Users\Brandon\Downloads\cbsidlm-cbsi5_3_0_96-Free_RAR_Extract_Frog-SEO-10804840.exe   probably a variant of Win32/CNETInstaller.A application
C:\Users\Brandon\Downloads\cbsidlm-tr1_11-Text_To_Wav-SEO-10788300.exe   Win32/DownloadAdmin.G application

Checkup log:

Results of screen317's Security Check version 0.99.77
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Norton 360
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Deal Spy
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 25
Java version out of Date!
Adobe Flash Player 11.9.900.117
Adobe Reader 10.1.2 Adobe Reader out of Date!
Mozilla Firefox (25.0)
Google Chrome 30.0.1599.101
Google Chrome 30.0.1599.69
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

kevinf80 · November 12, 2013

Uninstall Deal Spy then navigate to and delete all other unwanted entries flagged by ESET

Next,

Adobe Reader is outdated...

Visit http://get.adobe.com/uk/reader/otherversions/ and download the latest version of Acrobat Reader

Step 1 - Select your Operating System.

Step 2 - Select your Langauge.

Step 3 - Select latest version.

Untick the option for any security scanner or toolbar if offered.

Download and install.

Having the latest updates ensures there are no security vulnerabilities in your system.

Next,

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

Go to http://java.com/en/ and click on "Do I have Java"

It will check your current version and then offer to update to the latest version

Watch for and make sure you untick the box next to whatever free program they prompt you to install during the installation, unless you want it.

***Note: Check in Programs and Features (or Add/Remove Programs if you are an XP user) to make certain there are no old versions of Java still installed, if so - remove them.

Let me know if those steps complete ok, also if any remaining issues or concerns....

Kevin

brando223 · November 12, 2013

Those steps completed okay, is there anything else I should look at before everything is all said and done?

kevinf80 · November 12, 2013

If you have no remaining issues or concerns do the following:

We need to remove FRST, first it is very important to deal with its Quarantine folder using FRST itself..

OK, we continue:

Delete any fixlist.txt file previously used, continue:

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). That will confirm the removal action, delete if successful.

Next,

Delete FRST.exe from your Desktop or the folder it was saved to, navigate to and delete its folder C:\FRST

Next,

Uninstall adwcleaner.exe

Please close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Uninstall
Click Yes at Would you like to Uninstall Adwcleaner

Next,

Delete Security Checks from the desktop, c/w any logs...

Next,

Create a new restore point:

1. Right-click on Computer and go to Properties.

2. Next click on the System Protection link.

3. The System Properties dialog screen opens up and you will want to click on Create.

4. Type in a description for the restore point which will help you remember the point at which it was created. Click on create.

5. You should see the message "The restore point was created successfully

To remove all but the most recent restore point do the following:

1. Open Disk Cleanup by clicking the Start button . In the search box, type Disk Cleanup, and then, in the list of results, click Disk Cleanup.

2. If prompted, select the drive that you want to clean up, and then click OK.

3. In the Disk Cleanup for (usually C:\) dialog box, click Clean up system files. Administrator permission required If you're prompted for an administrator password or confirmation, type the password or provide confirmation.

4. If prompted, select the drive that you want to clean up, and then click OK.

5. Click the More Options tab, under System Restore and Shadow Copies, click Clean up.

6. In the Disk Cleanup dialog box, click Delete.

7. Click Delete Files, and then click OK. Re-Boot your PC.

Let me know if those steps complete, also if any remaining issues/concerns.....

Read the following link to fully understand PC security and best practices, you may find it useful....

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

Kevin

AdvancedSetup · November 17, 2013

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Infected with viruses

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information