Jump to content

svchost.exe and bitcoins have infected my system.


RileyF1

Recommended Posts

Hello,


Recently I noticed my computer was being unusually loud and when I went to play a game last night, it stuttering all over the place. Looked at process explorer and my GPU usage was around 95% I ran a scan on microsoft security essentials which detected nothing, then I ran a scan on malwarebytes which found a bunch of trojan viruses and bitcoins.


I'm can't remember what they were called (some were svchost) and I clicked to delete them and restarted. My gpu usage was back to normal levels initially but then shot back up again when I tried to play a game.


Just then, I booted in safe mode, ran rkill and ccleaner. Restarted in safe mode and ran a malwarebytes scan which detected viruses and deleted them. Restarted and my GPU has just shot way up again.


I'm not sure what there is I can do at this stage. My computer is a Dell xps, I have an ATI Radeon HD 1570 graphics card and I'm honestly not sure about the rest.


Thanks,


EDIT: Did another scan, results: http://i.imgur.com/QsENxgO.jpg [1]


Do you think I should do a full scan instead of just a quick scan? I don't know why they keep coming back.


EDIT:


What was terminated from rkill:


Rkill 2.6.2 by Lawrence Abrams (Grinler) http://www.bleepingcomputer.com/[2] Copyright 2008-2013 BleepingComputer.com More Information about Rkill can be found at this link:http://www.bleepingcomputer.com/forums/topic308364.html[3]


Program started at: 11/18/2013 05:51:31 PM in x64 mode. Windows Version: Windows 7 Home Premium Service Pack 1


Checking for Windows services to stop:


  • No malware services found to stop.

Checking for processes to terminate:


  • C:\Users\Riley\AppData\Local\Temp\procexp64.exe (PID: 3360) [T-HEUR]
  • C:\Windows\Temp\svchost.exe (PID: 3576) [sFI]

2 proccesses terminated!


Checking Registry for malware related settings:


  • No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.


Performing miscellaneous checks:


  • No issues found.

Checking Windows Service Integrity:


  • No issues found.

Searching for Missing Digital Signatures:


  • No issues found.

Checking HOSTS File:


  • No issues found.

Program finished at: 11/18/2013 05:53:09 PM Execution time: 0 hours(s), 1 minute(s), and 37 seconds(s)


Link to post
Share on other sites

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

 
 
 
You told us that you removed several items with Malwarebytes´ Antimalware. This tool creates a log on every run and we need to see them.


  • The logs can be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Zip any and all of these logs and attach the file to your next reply.

 

 

 

Scan with FRST in normal mode

Please download Farbar's Recovery Scan Tool to your desktop: FRST 32bit or FRST 64bit (If not sure: Start --> Computer (right click) --> properties)

  • Run FRST.
  • Don´t change one of the checkboxes and hit Scan.
  • Logfiles are created on your desktop.
  • Poste the FRST.txt and (after the first scan only!) the Addition.txt.

 
 
 
Scan with Gmer rootkit scanner

Please download Gmer from here by clicking on the "Download EXE" Button.
  • Double click on the randomly named GMER.exe. If asked to allow gmer.sys driver to load, please consent.
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.
  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • Sections
    • IAT/EAT
    • Show All ( should be unchecked by default )

    [*]Leave everything else as it is. [*]Close all other running programs as well as your Browser. [*]Click the Scan button & wait for it to finish. [*]Once done click on the Save.. button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post. [*]Save it where you can easily find it, such as your desktop. [*]Please post the content of the ark.txt here.


**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Link to post
Share on other sites

I've attached the malwarebyte logs.

 

Here is the FRST.txt:

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 17-11-2013 02
Ran by Riley (administrator) on RILEY-PC on 18-11-2013 20:29:59
Running from C:\Users\Riley\Downloads
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Dell, Inc.) C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuAgent.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Microsoft Corporation) C:\Windows\System32\schtasks.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
(BitTorrent, Inc.) C:\Program Files (x86)\uTorrent\uTorrent.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
 
==================== Registry (Whitelisted) ==================
 
HKLM\...\Run: [bCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [108144 2012-11-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] - C:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)
HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [559616 2011-10-09] (Dell)
HKLM-x32\...\runonceex: [ContentMerger] - c:\Program Files (x86)\Common Files\Roxio Shared\10.0\SharedCOM\ContentMerger10.exe [19952 2009-06-26] (Sonic Solutions)
HKLM\...\Policies\Explorer: [NoControlPanel] 0
HKCU\...\Run: [steam] - C:\Program Files (x86)\Steam\Steam.exe [1820584 2013-10-31] (Valve Corporation)
HKCU\...\Run: [Google Update] - C:\Users\Riley\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-01-21] (Google Inc.)
HKCU\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation)
HKCU\...\Policies\Explorer: [] 
MountPoints2: I - I:\setup.exe
MountPoints2: {f0696b46-1ff5-11e0-925c-806e6f6e6963} - D:\autorun.exe -auto
 
==================== Internet (Whitelisted) ====================
 
ProxyServer: http=localhost:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/USCON/19
SearchScopes: HKLM - DefaultScope {0CD3E77A-7E72-4F9C-877B-85150B05798E} URL = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - DefaultScope {29C3C01A-9C3F-44B0-9891-8FA9924072F6} URL = http://www.bing.com/search?q={searchTerms}&form=DLCDF8&pc=MDDC&src=IE-SearchBox
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - DefaultScope {29C3C01A-9C3F-44B0-9891-8FA9924072F6} URL = 
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=60a121de000000000000842b2bb801dc
SearchScopes: HKCU - {29C3C01A-9C3F-44B0-9891-8FA9924072F6} URL = 
BHO: No Name - {27B4851A-3207-45A2-B947-BE8AFE6163AB} -  No File
BHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE_64.dll No File
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 137.219.255.252 137.219.255.251
 
FireFox:
========
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF Plugin-x32: @esn/esnlaunch,version=2.1.3 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.3\npesnlaunch.dll (ESN Social Software AB)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Riley\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Riley\AppData\Local\Google\Update\1.3.21.165\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Riley\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\
 
Chrome: 
=======
CHR DefaultSearchURL: (Delta Search) - http://www.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=60a121de000000000000842b2bb801dc
CHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Extension: (Adblock Plus) - C:\Users\Riley\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb\1.6.1_0
CHR Extension: (Reddit Enhancement Suite) - C:\Users\Riley\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb\4.3.1.1_0
CHR Extension: (Google Wallet) - C:\Users\Riley\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0
CHR StartMenuInternet: Google Chrome - C:\Users\Riley\AppData\Local\Google\Chrome\Application\chrome.exe
 
==================== Services (Whitelisted) =================
 
S4 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)
S2 McMPFSvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [x]
S2 SessionLauncher; c:\Users\ADMINI~1\AppData\Local\Temp\DX9\SessionLauncher.exe [x]
 
==================== Drivers (Whitelisted) ====================
 
S3 D-Vitec; C:\Windows\System32\DRIVERS\dvitdcnt.sys [307968 2012-07-26] (D-vitec)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)
S3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)
S3 papycpu; C:\Windows\SysWow64\Drivers\papycpu.sys [1984 1998-09-04] ()
S0x01000000 papycpu2; C:\Windows\SysWow64\DRIVERS\papycpu2.sys [1984 2003-01-17] ()
S0x01000000 papyjoy; C:\Windows\SysWow64\DRIVERS\papyjoy.sys [1856 2003-01-17] ()
S3 RTL8187; C:\Windows\System32\DRIVERS\wg111v2.sys [340992 2007-12-26] (NETGEAR Inc.)
S1 RxFilter; C:\Windows\SysWow64\DRIVERS\RxFilter.sys [65520 2009-06-26] (Sonic Solutions)
S3 zghsdiag; C:\Windows\System32\DRIVERS\zghsdiag.sys [122624 2011-01-13] (ZTE Incorporated)
S3 zghsmdm; C:\Windows\System32\DRIVERS\zghsmdm.sys [122624 2011-01-13] (ZTE Incorporated)
S3 zghsnmea; C:\Windows\System32\DRIVERS\zghsnmea.sys [122624 2011-01-13] (ZTE Incorporated)
S3 IntcAzAudAddService; system32\drivers\RTKVHD64.sys [x]
S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [x]
U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation)
U3 aswMBR; \??\C:\Users\Riley\AppData\Local\Temp\aswMBR.sys [x]
 
==================== NetSvcs (Whitelisted) ===================
 
 
==================== One Month Created Files and Folders ========
 
2013-11-18 20:29 - 2013-11-18 20:30 - 00013280 _____ C:\Users\Riley\Downloads\FRST.txt
2013-11-18 20:29 - 2013-11-18 20:29 - 00000000 ____D C:\FRST
2013-11-18 20:28 - 2013-11-18 20:28 - 01958026 _____ (Farbar) C:\Users\Riley\Downloads\FRST64.exe
2013-11-18 20:28 - 2013-11-18 20:28 - 00377856 _____ C:\Users\Riley\Downloads\wceeos5r.exe
2013-11-18 20:06 - 2013-11-18 20:07 - 00602112 _____ (OldTimer Tools) C:\Users\Riley\Downloads\OTL.exe
2013-11-18 19:55 - 2013-11-18 19:55 - 05146587 _____ (Swearware) C:\Users\Riley\Desktop\ComboFix.exe
2013-11-18 18:29 - 2013-11-18 18:31 - 79535416 _____ (Sophos Limited) C:\Users\Riley\Downloads\Sophos Virus Removal Tool.exe
2013-11-18 18:18 - 2013-11-18 18:18 - 00000000 ____D C:\Program Files (x86)\ESET
2013-11-18 18:17 - 2013-11-18 18:18 - 02347384 _____ (ESET) C:\Users\Riley\Downloads\esetsmartinstaller_enu.exe
2013-11-18 18:13 - 2013-11-18 18:14 - 04745728 _____ (AVAST Software) C:\Users\Riley\Downloads\aswMBR.exe
2013-11-18 18:09 - 2013-11-18 18:09 - 00000056 _____ C:\Windows\setupact.log
2013-11-18 18:09 - 2013-11-18 18:09 - 00000000 _____ C:\Windows\setuperr.log
2013-11-18 18:08 - 2013-11-18 18:08 - 00001322 _____ C:\Windows\PFRO.log
2013-11-18 18:04 - 2013-11-18 18:04 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Riley\Downloads\tdsskiller.exe
2013-11-18 17:22 - 2013-11-18 17:22 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-18 17:22 - 2013-11-18 17:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-18 17:21 - 2013-11-18 17:21 - 13670584 _____ (Microsoft Corporation) C:\Users\Riley\Downloads\mseinstall (2).exe
2013-11-18 17:18 - 2013-11-18 18:12 - 00048546 _____ C:\Windows\WindowsUpdate.log
2013-11-18 16:40 - 2013-11-18 16:40 - 00000000 ____D C:\Users\Riley\Desktop\rkill
2013-11-18 16:39 - 2013-11-18 19:19 - 00001750 _____ C:\Users\Riley\Desktop\Rkill.txt
2013-11-18 16:39 - 2013-11-18 16:39 - 01898232 _____ (Bleeping Computer, LLC) C:\Users\Riley\Desktop\rkill.com
2013-11-18 16:39 - 2013-11-18 16:39 - 01038584 _____ (Bleeping Computer, LLC) C:\Users\Riley\Downloads\rkill64.com
2013-11-18 16:01 - 2013-11-18 16:01 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-18 16:01 - 2013-11-18 16:01 - 00000000 ____D C:\Users\Riley\AppData\Roaming\Malwarebytes
2013-11-18 16:01 - 2013-11-18 16:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-18 16:01 - 2013-11-18 16:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-18 16:01 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-11-18 15:50 - 2013-11-18 15:50 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Riley\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-18 15:21 - 2013-11-18 15:22 - 00000000 ____D C:\Users\Riley\Desktop\ProcessExplorer
2013-11-18 15:10 - 2013-11-18 15:10 - 13670584 _____ (Microsoft Corporation) C:\Users\Riley\Downloads\mseinstall (1).exe
2013-11-17 18:03 - 2013-11-17 18:03 - 00000000 ____D C:\ProgramData\ATI
2013-11-17 17:46 - 2013-11-17 17:46 - 00000000 ____D C:\Users\Riley\AppData\Local\DriverTuner
2013-11-17 17:43 - 2013-11-17 17:44 - 11840839 _____ C:\Users\Riley\Downloads\Windows6.1-KB2670838-x64.msu
2013-11-17 15:48 - 2013-11-17 15:48 - 00000815 _____ C:\Users\Riley\Desktop\GTR2.exe - Shortcut.lnk
2013-11-17 15:28 - 2013-11-17 15:41 - 00000000 ____D C:\Users\Riley\Downloads\Assassin's Creed 4.Black Flag.Deluxe Edition.v 1.01.(Ubisoft Entertainment).(2013).RiP
2013-11-17 04:00 - 2013-11-18 13:54 - 00000000 ____D C:\Users\Riley\AppData\Roaming\.ACEStream
2013-11-17 03:59 - 2013-11-17 17:15 - 00000000 ____D C:\Users\Riley\AppData\Roaming\ACEStream
2013-11-17 03:54 - 2013-11-17 03:58 - 60117544 _____ C:\Users\Riley\Downloads\Ace_Stream_Media_2.1.10.1_VLC_1.1.12.exe
2013-11-14 03:50 - 2013-11-14 03:50 - 00138240 _____ C:\Users\Riley\Downloads\EG1010_set9(Stoichiometry & reactiveMassbal)_2008 (2).ppt
2013-11-14 03:04 - 2013-10-12 18:45 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-11-14 03:04 - 2013-10-12 18:45 - 01364992 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-11-14 03:04 - 2013-10-12 18:45 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-11-14 03:04 - 2013-10-12 18:43 - 19269632 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 03959808 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-11-14 03:04 - 2013-10-12 18:43 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-11-14 03:04 - 2013-10-12 17:03 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-11-14 03:04 - 2013-10-12 17:03 - 01138176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 14355968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-11-14 03:04 - 2013-10-12 17:02 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-11-14 03:04 - 2013-10-12 16:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-11-14 03:04 - 2013-10-12 16:08 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-11-13 20:44 - 2013-10-06 06:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-11-13 20:44 - 2013-10-06 05:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-11-13 20:44 - 2013-10-04 12:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll
2013-11-13 20:44 - 2013-10-04 12:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll
2013-11-13 20:44 - 2013-10-04 12:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2013-11-13 20:44 - 2013-10-04 11:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll
2013-11-13 20:44 - 2013-10-04 11:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2013-11-13 20:44 - 2013-10-04 11:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll
2013-11-13 20:44 - 2013-09-28 11:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
2013-11-13 20:44 - 2013-09-25 12:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2013-11-13 20:44 - 2013-09-25 12:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2013-11-13 20:44 - 2013-09-25 12:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2013-11-13 20:44 - 2013-09-25 12:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2013-11-13 20:44 - 2013-09-25 12:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2013-11-13 20:44 - 2013-09-25 12:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2013-11-13 20:44 - 2013-09-25 12:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2013-11-13 20:44 - 2013-09-25 12:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2013-11-13 20:44 - 2013-09-25 11:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2013-11-13 20:44 - 2013-09-25 11:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2013-11-13 20:44 - 2013-09-25 11:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2013-11-13 20:44 - 2013-09-25 11:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2013-11-13 20:44 - 2013-09-25 11:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2013-11-13 20:44 - 2013-07-04 22:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2013-11-13 20:39 - 2013-10-12 12:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll
2013-11-13 20:39 - 2013-10-12 12:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2013-11-13 20:39 - 2013-10-12 12:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2013-11-13 20:39 - 2013-10-12 12:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll
2013-11-13 20:39 - 2013-10-12 12:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL
2013-11-13 20:39 - 2013-10-03 12:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2013-11-13 20:39 - 2013-10-03 12:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2013-11-13 14:45 - 2013-11-13 14:45 - 00166912 _____ C:\Users\Riley\Downloads\EG1010_set11(large systems)_2008 (1).ppt
2013-11-13 14:45 - 2013-11-13 14:45 - 00138240 _____ C:\Users\Riley\Downloads\EG1010_set9(Stoichiometry & reactiveMassbal)_2008 (1).ppt
2013-11-13 14:45 - 2013-11-13 14:45 - 00103424 _____ C:\Users\Riley\Downloads\EG1010_set10(combustion Reactions)_2008 (1).ppt
2013-11-13 14:37 - 2013-11-13 14:37 - 00846336 _____ C:\Users\Riley\Downloads\EG1010_set8(Reaction Equilibrium)_2007 (1).ppt
2013-11-13 14:37 - 2013-11-13 14:37 - 00163840 _____ C:\Users\Riley\Downloads\EG1010_set7(Reactions)_2010 (1).ppt
2013-11-13 14:35 - 2013-11-13 14:35 - 00051200 _____ C:\Users\Riley\Downloads\EG1010_set6(Mass Balance multisystem DoF)_2008.ppt
2013-11-13 14:21 - 2013-11-13 14:21 - 00150016 _____ C:\Users\Riley\Downloads\EG1010_set6(Mass Balance examples)_2008 (1).ppt
2013-11-13 11:26 - 2013-11-13 11:26 - 00191488 _____ C:\Users\Riley\Downloads\EG1010_set5(Mass Balance introduction)_2011 (2).ppt
2013-11-12 22:28 - 2013-11-12 22:28 - 01577620 _____ C:\Windows\SysWOW64\scrypt130511Juniperglg2tc4032w64l4.bin
2013-11-12 16:23 - 2013-11-13 08:02 - 00000000 ____D C:\Users\Riley\Downloads\Rush.2013.DVDRip
2013-11-12 16:19 - 2013-11-12 16:19 - 00012577 _____ C:\Users\Riley\Downloads\Rush.2013.DVDRip.torrent
2013-11-12 16:17 - 2013-11-12 16:52 - 00000000 ____D C:\Users\Riley\Downloads\Gravity.2013.DVDRip
2013-11-12 16:16 - 2013-11-12 16:16 - 00014358 _____ C:\Users\Riley\Downloads\Gravity.2013.DVDRip.torrent
2013-11-10 12:14 - 2013-11-10 22:28 - 1214820596 _____ C:\Users\Riley\Downloads\Germany.mkv
2013-11-05 21:56 - 2013-11-05 21:56 - 00000166 _____ C:\Users\Riley\Downloads\20131105185658.m3u
2013-11-04 01:23 - 2013-11-04 01:23 - 00000000 ____D C:\Users\Riley\Desktop\True to Life AI
2013-11-01 17:43 - 2013-11-01 17:43 - 00098304 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt.dll
2013-11-01 07:01 - 2013-11-01 07:01 - 00789236 _____ C:\Windows\SysWOW64\phatk121016Juniperv2w128l4.bin
2013-11-01 06:56 - 2013-11-01 06:56 - 00000000 __SHD C:\found.001
2013-10-31 22:45 - 2013-10-31 22:45 - 00000000 ____D C:\Papyrus
2013-10-31 22:39 - 2013-10-31 23:11 - 00000000 ____D C:\Users\Riley\Desktop\NASCAR MODS
2013-10-31 22:31 - 2013-10-31 22:39 - 00000000 ____D C:\Users\Riley\Downloads\NASCAR Racing 2003 Season
2013-10-31 10:00 - 2013-11-18 14:57 - 00000000 ____D C:\GSC2013
2013-10-29 23:07 - 2013-10-29 23:07 - 00001362 _____ C:\Users\Riley\Desktop\FTruck.exe - Shortcut.lnk
2013-10-29 23:06 - 2013-10-29 23:06 - 00003120 _____ C:\Windows\System32\Tasks\Origin
2013-10-29 23:03 - 2013-10-29 23:09 - 00000000 ____D C:\Program Files (x86)\FTruck2013
2013-10-29 21:42 - 2013-10-29 22:39 - 00000000 ____D C:\Users\Riley\Downloads\Formula Truck Simulator 2013-HI2U
2013-10-29 21:19 - 2013-10-29 23:34 - 00000000 ____D C:\Users\Riley\Downloads\GAME GSC2013
2013-10-29 03:34 - 2013-10-29 03:34 - 00000000 ____D C:\Users\Riley\Downloads\Formula 1 - 2013 Indian Grand Prix
2013-10-25 00:14 - 2013-10-25 00:14 - 00846336 _____ C:\Users\Riley\Downloads\EG1010_set8(Reaction Equilibrium)_2007.ppt
2013-10-25 00:14 - 2013-10-25 00:14 - 00166912 _____ C:\Users\Riley\Downloads\EG1010_set11(large systems)_2008.ppt
2013-10-25 00:14 - 2013-10-25 00:14 - 00163840 _____ C:\Users\Riley\Downloads\EG1010_set7(Reactions)_2010.ppt
2013-10-25 00:14 - 2013-10-25 00:14 - 00138240 _____ C:\Users\Riley\Downloads\EG1010_set9(Stoichiometry & reactiveMassbal)_2008.ppt
2013-10-25 00:14 - 2013-10-25 00:14 - 00103424 _____ C:\Users\Riley\Downloads\EG1010_set10(combustion Reactions)_2008.ppt
2013-10-21 00:34 - 2013-10-21 00:34 - 00000000 ____D C:\Users\Riley\Documents\Char_01-50-2-1-0-3-1-2012-30-6
2013-10-21 00:30 - 2013-11-18 14:57 - 00000000 ____D C:\Users\Riley\AppData\Roaming\Notepad++
2013-10-21 00:30 - 2013-11-18 14:57 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-10-21 00:29 - 2013-10-21 00:29 - 05576634 _____ C:\Users\Riley\Downloads\npp.5.9.Installer.exe
2013-10-21 00:26 - 2013-10-21 00:26 - 00000000 ____D C:\Users\Riley\AppData\Local\{4383FEDB-7E83-402D-9B03-DFA3809D0D6D}
2013-10-20 17:50 - 2013-10-20 17:50 - 00000222 _____ C:\Users\Riley\Desktop\RaceRoom Racing Experience.url
 
==================== One Month Modified Files and Folders =======
 
2013-11-18 20:30 - 2013-11-18 20:29 - 00013280 _____ C:\Users\Riley\Downloads\FRST.txt
2013-11-18 20:30 - 2012-03-03 11:46 - 00000000 ____D C:\Users\Riley\AppData\Roaming\uTorrent
2013-11-18 20:29 - 2013-11-18 20:29 - 00000000 ____D C:\FRST
2013-11-18 20:28 - 2013-11-18 20:28 - 01958026 _____ (Farbar) C:\Users\Riley\Downloads\FRST64.exe
2013-11-18 20:28 - 2013-11-18 20:28 - 00377856 _____ C:\Users\Riley\Downloads\wceeos5r.exe
2013-11-18 20:24 - 2013-02-26 22:57 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-11-18 20:07 - 2013-11-18 20:06 - 00602112 _____ (OldTimer Tools) C:\Users\Riley\Downloads\OTL.exe
2013-11-18 20:02 - 2013-06-07 13:40 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-11-18 19:55 - 2013-11-18 19:55 - 05146587 _____ (Swearware) C:\Users\Riley\Desktop\ComboFix.exe
2013-11-18 19:52 - 2011-01-21 20:12 - 00000908 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3519446951-2150770932-507619035-1000UA.job
2013-11-18 19:19 - 2013-11-18 16:39 - 00001750 _____ C:\Users\Riley\Desktop\Rkill.txt
2013-11-18 18:31 - 2013-11-18 18:29 - 79535416 _____ (Sophos Limited) C:\Users\Riley\Downloads\Sophos Virus Removal Tool.exe
2013-11-18 18:18 - 2013-11-18 18:18 - 00000000 ____D C:\Program Files (x86)\ESET
2013-11-18 18:18 - 2013-11-18 18:17 - 02347384 _____ (ESET) C:\Users\Riley\Downloads\esetsmartinstaller_enu.exe
2013-11-18 18:16 - 2009-07-14 14:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-11-18 18:16 - 2009-07-14 14:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-11-18 18:14 - 2013-11-18 18:13 - 04745728 _____ (AVAST Software) C:\Users\Riley\Downloads\aswMBR.exe
2013-11-18 18:12 - 2013-11-18 17:18 - 00048546 _____ C:\Windows\WindowsUpdate.log
2013-11-18 18:09 - 2013-11-18 18:09 - 00000056 _____ C:\Windows\setupact.log
2013-11-18 18:09 - 2013-11-18 18:09 - 00000000 _____ C:\Windows\setuperr.log
2013-11-18 18:09 - 2013-07-10 21:33 - 00000000 ____D C:\Program Files (x86)\Steam
2013-11-18 18:09 - 2013-06-07 13:40 - 00000892 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-11-18 18:09 - 2009-07-14 15:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-11-18 18:08 - 2013-11-18 18:08 - 00001322 _____ C:\Windows\PFRO.log
2013-11-18 18:04 - 2013-11-18 18:04 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Riley\Downloads\tdsskiller.exe
2013-11-18 17:22 - 2013-11-18 17:22 - 00000000 ____D C:\Program Files\Microsoft Security Client
2013-11-18 17:22 - 2013-11-18 17:22 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2013-11-18 17:22 - 2013-07-10 20:10 - 00001945 _____ C:\Windows\epplauncher.mif
2013-11-18 17:21 - 2013-11-18 17:21 - 13670584 _____ (Microsoft Corporation) C:\Users\Riley\Downloads\mseinstall (2).exe
2013-11-18 16:41 - 2013-06-27 23:29 - 00000000 ____D C:\Users\Riley\Documents\Euro Truck Simulator 2
2013-11-18 16:40 - 2013-11-18 16:40 - 00000000 ____D C:\Users\Riley\Desktop\rkill
2013-11-18 16:39 - 2013-11-18 16:39 - 01898232 _____ (Bleeping Computer, LLC) C:\Users\Riley\Desktop\rkill.com
2013-11-18 16:39 - 2013-11-18 16:39 - 01038584 _____ (Bleeping Computer, LLC) C:\Users\Riley\Downloads\rkill64.com
2013-11-18 16:11 - 2011-01-20 15:21 - 00000422 _____ C:\Windows\Tasks\SystemToolsDailyTest.job
2013-11-18 16:10 - 2011-01-20 16:00 - 00003488 _____ C:\Windows\System32\Tasks\PCDEventLauncher
2013-11-18 16:10 - 2011-01-20 15:21 - 00003444 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest
2013-11-18 16:01 - 2013-11-18 16:01 - 00001111 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-11-18 16:01 - 2013-11-18 16:01 - 00000000 ____D C:\Users\Riley\AppData\Roaming\Malwarebytes
2013-11-18 16:01 - 2013-11-18 16:01 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-11-18 16:01 - 2013-11-18 16:01 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-11-18 15:50 - 2013-11-18 15:50 - 10285040 _____ (Malwarebytes Corporation                                    ) C:\Users\Riley\Downloads\mbam-setup-1.75.0.1300.exe
2013-11-18 15:22 - 2013-11-18 15:21 - 00000000 ____D C:\Users\Riley\Desktop\ProcessExplorer
2013-11-18 15:10 - 2013-11-18 15:10 - 13670584 _____ (Microsoft Corporation) C:\Users\Riley\Downloads\mseinstall (1).exe
2013-11-18 15:07 - 2012-02-13 17:11 - 00000000 ____D C:\Program Files (x86)\NVIDIA Corporation
2013-11-18 15:05 - 2013-05-17 23:25 - 00000000 ____D C:\Program Files (x86)\Metro Last Light
2013-11-18 15:01 - 2013-07-25 00:39 - 00000000 ____D C:\Users\Riley\Documents\rFactor2
2013-11-18 15:01 - 2013-07-25 00:38 - 00000000 ____D C:\Program Files (x86)\rFactor2
2013-11-18 15:00 - 2013-09-16 06:57 - 00000000 ____D C:\GSC2012DEMO
2013-11-18 14:57 - 2013-10-31 10:00 - 00000000 ____D C:\GSC2013
2013-11-18 14:57 - 2013-10-21 00:30 - 00000000 ____D C:\Users\Riley\AppData\Roaming\Notepad++
2013-11-18 14:57 - 2013-10-21 00:30 - 00000000 ____D C:\Program Files (x86)\Notepad++
2013-11-18 14:57 - 2013-09-16 07:09 - 00000019 _____ C:\Windows\Sierra.ini
2013-11-18 14:57 - 2011-01-14 09:57 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information
2013-11-18 14:37 - 2013-02-27 19:50 - 00000000 ____D C:\Users\Riley\AppData\Roaming\Dropbox
2013-11-18 14:36 - 2013-07-05 19:34 - 00000000 ____D C:\Users\Riley\AppData\Roaming\Ventrilo
2013-11-18 14:36 - 2011-02-12 12:47 - 00000000 ____D C:\Users\Riley\AppData\Roaming\TS3Client
2013-11-18 14:00 - 2011-01-20 15:21 - 00000564 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2013-11-18 13:55 - 2013-07-25 02:52 - 00000000 ____D C:\Program Files (x86)\iRacing
2013-11-18 13:55 - 2011-01-20 15:19 - 00000000 ____D C:\Users\Riley
2013-11-18 13:54 - 2013-11-17 04:00 - 00000000 ____D C:\Users\Riley\AppData\Roaming\.ACEStream
2013-11-18 13:54 - 2011-11-21 11:41 - 00000000 ____D C:\Users\Riley\AppData\Roaming\vlc
2013-11-18 13:54 - 2011-03-17 14:39 - 00000000 ____D C:\Users\Riley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-11-18 13:54 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\rescache
2013-11-18 13:54 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\AppCompat
2013-11-18 13:53 - 2013-08-24 16:29 - 00000000 ____D C:\ProgramData\PnG_Launcher
2013-11-18 13:53 - 2013-08-24 16:19 - 00000000 ____D C:\Program Files (x86)\PnG3
2013-11-18 13:53 - 2013-08-24 16:14 - 00000000 ____D C:\GTR2
2013-11-18 13:53 - 2013-07-20 21:24 - 00000000 ____D C:\Program Files\DC++
2013-11-18 13:53 - 2011-11-15 20:04 - 00000000 ____D C:\Program Files\Common Files\ATI Technologies
2013-11-18 13:53 - 2009-07-14 13:20 - 00000000 ____D C:\Windows\registration
2013-11-18 13:53 - 2009-07-14 13:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-11-18 13:48 - 2013-06-30 15:00 - 00000000 ____D C:\ProgramData\Package Cache
2013-11-18 13:48 - 2013-06-07 13:40 - 00000000 ____D C:\Program Files (x86)\Google
2013-11-18 13:48 - 2013-03-29 13:09 - 00000000 ____D C:\Program Files (x86)\AMD AVT
2013-11-18 13:48 - 2012-04-22 13:48 - 00000000 __RHD C:\MSOCache
2013-11-18 13:48 - 2011-03-01 18:24 - 00000000 ____D C:\ProgramData\Electronic Arts
2013-11-18 12:40 - 2011-01-20 16:00 - 00000000 ____D C:\ProgramData\PCDr
2013-11-18 03:05 - 2013-07-18 02:09 - 00000000 ____D C:\Windows\system32\MRT
2013-11-17 21:53 - 2012-06-28 15:24 - 00000000 ____D C:\ProgramData\Origin
2013-11-17 21:47 - 2013-08-24 21:19 - 00000000 ____D C:\Program Files (x86)\AskPartnerNetwork
2013-11-17 21:47 - 2012-06-28 15:25 - 00000000 ____D C:\Program Files (x86)\Origin Games
2013-11-17 18:03 - 2013-11-17 18:03 - 00000000 ____D C:\ProgramData\ATI
2013-11-17 18:03 - 2013-03-29 13:09 - 00000000 ____D C:\ProgramData\AMD
2013-11-17 18:02 - 2011-11-15 20:03 - 00000000 ____D C:\Program Files\ATI Technologies
2013-11-17 17:46 - 2013-11-17 17:46 - 00000000 ____D C:\Users\Riley\AppData\Local\DriverTuner
2013-11-17 17:44 - 2013-11-17 17:43 - 11840839 _____ C:\Users\Riley\Downloads\Windows6.1-KB2670838-x64.msu
2013-11-17 17:15 - 2013-11-17 03:59 - 00000000 ____D C:\Users\Riley\AppData\Roaming\ACEStream
2013-11-17 17:14 - 2013-10-18 18:26 - 00000000 ____D C:\Users\Riley\Desktop\Terraria Patch v1.2.0.2 - v1.3.0.1
2013-11-17 17:09 - 2012-07-29 14:07 - 00000000 ____D C:\Program Files (x86)\rFactor
2013-11-17 17:08 - 2012-06-28 14:03 - 00000000 ____D C:\Program Files (x86)\Origin
2013-11-17 15:48 - 2013-11-17 15:48 - 00000815 _____ C:\Users\Riley\Desktop\GTR2.exe - Shortcut.lnk
2013-11-17 15:41 - 2013-11-17 15:28 - 00000000 ____D C:\Users\Riley\Downloads\Assassin's Creed 4.Black Flag.Deluxe Edition.v 1.01.(Ubisoft Entertainment).(2013).RiP
2013-11-17 10:52 - 2011-01-21 20:12 - 00000856 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3519446951-2150770932-507619035-1000Core.job
2013-11-17 04:10 - 2011-12-19 19:08 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{A8D769D6-8673-42F2-8255-9AD58BF25833}
2013-11-17 03:58 - 2013-11-17 03:54 - 60117544 _____ C:\Users\Riley\Downloads\Ace_Stream_Media_2.1.10.1_VLC_1.1.12.exe
2013-11-14 03:50 - 2013-11-14 03:50 - 00138240 _____ C:\Users\Riley\Downloads\EG1010_set9(Stoichiometry & reactiveMassbal)_2008 (2).ppt
2013-11-14 03:04 - 2011-10-18 22:16 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-11-14 03:01 - 2011-10-01 22:11 - 82896128 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-11-13 14:45 - 2013-11-13 14:45 - 00166912 _____ C:\Users\Riley\Downloads\EG1010_set11(large systems)_2008 (1).ppt
2013-11-13 14:45 - 2013-11-13 14:45 - 00138240 _____ C:\Users\Riley\Downloads\EG1010_set9(Stoichiometry & reactiveMassbal)_2008 (1).ppt
2013-11-13 14:45 - 2013-11-13 14:45 - 00103424 _____ C:\Users\Riley\Downloads\EG1010_set10(combustion Reactions)_2008 (1).ppt
2013-11-13 14:37 - 2013-11-13 14:37 - 00846336 _____ C:\Users\Riley\Downloads\EG1010_set8(Reaction Equilibrium)_2007 (1).ppt
2013-11-13 14:37 - 2013-11-13 14:37 - 00163840 _____ C:\Users\Riley\Downloads\EG1010_set7(Reactions)_2010 (1).ppt
2013-11-13 14:35 - 2013-11-13 14:35 - 00051200 _____ C:\Users\Riley\Downloads\EG1010_set6(Mass Balance multisystem DoF)_2008.ppt
2013-11-13 14:21 - 2013-11-13 14:21 - 00150016 _____ C:\Users\Riley\Downloads\EG1010_set6(Mass Balance examples)_2008 (1).ppt
2013-11-13 11:26 - 2013-11-13 11:26 - 00191488 _____ C:\Users\Riley\Downloads\EG1010_set5(Mass Balance introduction)_2011 (2).ppt
2013-11-13 08:02 - 2013-11-12 16:23 - 00000000 ____D C:\Users\Riley\Downloads\Rush.2013.DVDRip
2013-11-12 22:28 - 2013-11-12 22:28 - 01577620 _____ C:\Windows\SysWOW64\scrypt130511Juniperglg2tc4032w64l4.bin
2013-11-12 16:52 - 2013-11-12 16:17 - 00000000 ____D C:\Users\Riley\Downloads\Gravity.2013.DVDRip
2013-11-12 16:20 - 2013-08-03 13:30 - 00000665 _____ C:\Users\Riley\Desktop\New Text Document.txt
2013-11-12 16:19 - 2013-11-12 16:19 - 00012577 _____ C:\Users\Riley\Downloads\Rush.2013.DVDRip.torrent
2013-11-12 16:16 - 2013-11-12 16:16 - 00014358 _____ C:\Users\Riley\Downloads\Gravity.2013.DVDRip.torrent
2013-11-12 15:50 - 2009-07-14 15:13 - 00792654 _____ C:\Windows\system32\PerfStringBackup.INI
2013-11-12 15:46 - 2012-08-25 16:19 - 00000000 ____D C:\Users\Riley\Desktop\Moosic
2013-11-10 22:28 - 2013-11-10 12:14 - 1214820596 _____ C:\Users\Riley\Downloads\Germany.mkv
2013-11-05 21:56 - 2013-11-05 21:56 - 00000166 _____ C:\Users\Riley\Downloads\20131105185658.m3u
2013-11-04 04:21 - 2013-09-04 15:36 - 00000052 _____ C:\Windows\MC10demo.INI
2013-11-04 04:21 - 2013-08-20 21:02 - 00000000 ____D C:\MC10demo
2013-11-04 01:23 - 2013-11-04 01:23 - 00000000 ____D C:\Users\Riley\Desktop\True to Life AI
2013-11-01 17:43 - 2013-11-01 17:43 - 00098304 _____ (Sony DADC Austria AG.) C:\Windows\SysWOW64\CmdLineExt.dll
2013-11-01 07:01 - 2013-11-01 07:01 - 00789236 _____ C:\Windows\SysWOW64\phatk121016Juniperv2w128l4.bin
2013-11-01 06:56 - 2013-11-01 06:56 - 00000000 __SHD C:\found.001
2013-10-31 23:11 - 2013-10-31 22:39 - 00000000 ____D C:\Users\Riley\Desktop\NASCAR MODS
2013-10-31 22:45 - 2013-10-31 22:45 - 00000000 ____D C:\Papyrus
2013-10-31 22:39 - 2013-10-31 22:31 - 00000000 ____D C:\Users\Riley\Downloads\NASCAR Racing 2003 Season
2013-10-31 22:22 - 2012-04-01 16:24 - 00000000 ____D C:\Fraps
2013-10-31 20:59 - 2011-01-26 13:23 - 00000000 ____D C:\Users\Riley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games
2013-10-29 23:34 - 2013-10-29 21:19 - 00000000 ____D C:\Users\Riley\Downloads\GAME GSC2013
2013-10-29 23:09 - 2013-10-29 23:03 - 00000000 ____D C:\Program Files (x86)\FTruck2013
2013-10-29 23:07 - 2013-10-29 23:07 - 00001362 _____ C:\Users\Riley\Desktop\FTruck.exe - Shortcut.lnk
2013-10-29 23:06 - 2013-10-29 23:06 - 00003120 _____ C:\Windows\System32\Tasks\Origin
2013-10-29 23:06 - 2012-06-28 14:03 - 00000000 ___HD C:\Users\Riley\AppData\Roaming\Origin
2013-10-29 22:39 - 2013-10-29 21:42 - 00000000 ____D C:\Users\Riley\Downloads\Formula Truck Simulator 2013-HI2U
2013-10-29 03:34 - 2013-10-29 03:34 - 00000000 ____D C:\Users\Riley\Downloads\Formula 1 - 2013 Indian Grand Prix
2013-10-25 00:14 - 2013-10-25 00:14 - 00846336 _____ C:\Users\Riley\Downloads\EG1010_set8(Reaction Equilibrium)_2007.ppt
2013-10-25 00:14 - 2013-10-25 00:14 - 00166912 _____ C:\Users\Riley\Downloads\EG1010_set11(large systems)_2008.ppt
2013-10-25 00:14 - 2013-10-25 00:14 - 00163840 _____ C:\Users\Riley\Downloads\EG1010_set7(Reactions)_2010.ppt
2013-10-25 00:14 - 2013-10-25 00:14 - 00138240 _____ C:\Users\Riley\Downloads\EG1010_set9(Stoichiometry & reactiveMassbal)_2008.ppt
2013-10-25 00:14 - 2013-10-25 00:14 - 00103424 _____ C:\Users\Riley\Downloads\EG1010_set10(combustion Reactions)_2008.ppt
2013-10-21 00:34 - 2013-10-21 00:34 - 00000000 ____D C:\Users\Riley\Documents\Char_01-50-2-1-0-3-1-2012-30-6
2013-10-21 00:29 - 2013-10-21 00:29 - 05576634 _____ C:\Users\Riley\Downloads\npp.5.9.Installer.exe
2013-10-21 00:26 - 2013-10-21 00:26 - 00000000 ____D C:\Users\Riley\AppData\Local\{4383FEDB-7E83-402D-9B03-DFA3809D0D6D}
2013-10-21 00:26 - 2011-02-08 07:37 - 00000000 ____D C:\Users\Riley\AppData\Local\Windows Live
2013-10-20 20:44 - 2011-01-20 16:04 - 00000000 ____D C:\Users\Riley\Documents\My Games
2013-10-20 17:50 - 2013-10-20 17:50 - 00000222 _____ C:\Users\Riley\Desktop\RaceRoom Racing Experience.url
2013-10-19 00:19 - 2013-10-16 07:23 - 00000000 __SHD C:\Users\Riley\wc
2013-10-19 00:19 - 2013-10-16 07:23 - 00000000 ____D C:\Users\Riley\Documents\Universe Sandbox
 
Some content of TEMP:
====================
C:\Users\Riley\AppData\Local\Temp\ubi50EE.tmp.exe
 
 
==================== Bamital & volsnap Check =================
 
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
 
 
LastRegBack: 2013-11-10 00:00
 
==================== End Of Log ============================
 
 
Here is the Addition.txt
 
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 17-11-2013 02
Ran by Riley at 2013-11-18 20:31:05
Running from C:\Users\Riley\Downloads
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Disabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}
 
==================== Installed Programs ======================
 
µTorrent (x32 Version: 3.1.2)
7-Zip 9.20 (x64 edition) (Version: 9.20.00.0)
Adobe Flash Player 11 ActiveX (x32 Version: 11.7.700.224)
Adobe Flash Player 11 Plugin (x32 Version: 11.7.700.224)
Adobe Reader 9.1.2 (x32 Version: 9.1.2)
Adobe Shockwave Player 11.6 (x32 Version: 11.6.1.629)
AMD Accelerated Video Transcoding (Version: 12.5.100.21219)
AMD APP SDK Runtime (Version: 10.0.1084.4)
AMD Catalyst Install Manager (Version: 8.0.903.0)
AMD Drag and Drop Transcoding (Version: 2.00.0000)
AMD Media Foundation Decoders (Version: 1.0.71219.1540)
Amnesia - A Machine For Pigs (x32 Version: 2.0.0.3)
Amnesia - The Dark Descent  (x32 Version: 1.0.1)
Apple Application Support (x32 Version: 1.5.1)
Apple Mobile Device Support (Version: 3.4.0.25)
Apple Software Update (x32 Version: 2.1.2.120)
ATI Catalyst Control Center (x32 Version: 2.010.0113.2207)
AutoCAD 2013 - English (Version: 19.0.55.0)
AutoCAD 2013 Language Pack - English (Version: 19.0.55.0)
Autodesk Content Service (x32 Version: 3.0.84.0)
Autodesk Content Service Language Pack (x32 Version: 3.0.84.0)
Autodesk Inventor Fusion 2013 (Version: 2.0.0.206)
Autodesk Inventor Fusion plug-in for AutoCAD 2013 (Version: 0.2.0.230)
Autodesk Inventor Fusion plug-in language pack for AutoCAD 2013 (Version: 0.2.0.230)
Autodesk Material Library 2013 (x32 Version: 3.0.13)
Autodesk Material Library Base Resolution Image Library 2013 (x32 Version: 3.0.13)
Autodesk Sync (Version: 3.5.24.0)
Beat Hazard 1.3s (x32)
Bonjour (Version: 2.0.5.0)
Catalyst Control Center - Branding (x32 Version: 1.00.0000)
Catalyst Control Center (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Core Implementation (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center Graphics Full Existing (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center Graphics Full New (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center Graphics Light (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center Graphics Previews Common (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Graphics Previews Vista (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center InstallProxy (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485)
Catalyst Control Center Localization All (x32 Version: 2010.0113.2208.39662)
Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485)
CCC Help Chinese Standard (x32 Version: 2010.0113.2207.39662)
CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485)
CCC Help Chinese Traditional (x32 Version: 2010.0113.2207.39662)
CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485)
CCC Help Czech (x32 Version: 2010.0113.2207.39662)
CCC Help Czech (x32 Version: 2012.1219.1520.27485)
CCC Help Danish (x32 Version: 2010.0113.2207.39662)
CCC Help Danish (x32 Version: 2012.1219.1520.27485)
CCC Help Dutch (x32 Version: 2010.0113.2207.39662)
CCC Help Dutch (x32 Version: 2012.1219.1520.27485)
CCC Help English (x32 Version: 2010.0113.2207.39662)
CCC Help English (x32 Version: 2012.1219.1520.27485)
CCC Help Finnish (x32 Version: 2010.0113.2207.39662)
CCC Help Finnish (x32 Version: 2012.1219.1520.27485)
CCC Help French (x32 Version: 2010.0113.2207.39662)
CCC Help French (x32 Version: 2012.1219.1520.27485)
CCC Help German (x32 Version: 2010.0113.2207.39662)
CCC Help German (x32 Version: 2012.1219.1520.27485)
CCC Help Greek (x32 Version: 2010.0113.2207.39662)
CCC Help Greek (x32 Version: 2012.1219.1520.27485)
CCC Help Hungarian (x32 Version: 2010.0113.2207.39662)
CCC Help Hungarian (x32 Version: 2012.1219.1520.27485)
CCC Help Italian (x32 Version: 2010.0113.2207.39662)
CCC Help Italian (x32 Version: 2012.1219.1520.27485)
CCC Help Japanese (x32 Version: 2010.0113.2207.39662)
CCC Help Japanese (x32 Version: 2012.1219.1520.27485)
CCC Help Korean (x32 Version: 2010.0113.2207.39662)
CCC Help Korean (x32 Version: 2012.1219.1520.27485)
CCC Help Norwegian (x32 Version: 2010.0113.2207.39662)
CCC Help Norwegian (x32 Version: 2012.1219.1520.27485)
CCC Help Polish (x32 Version: 2010.0113.2207.39662)
CCC Help Polish (x32 Version: 2012.1219.1520.27485)
CCC Help Portuguese (x32 Version: 2010.0113.2207.39662)
CCC Help Portuguese (x32 Version: 2012.1219.1520.27485)
CCC Help Russian (x32 Version: 2010.0113.2207.39662)
CCC Help Russian (x32 Version: 2012.1219.1520.27485)
CCC Help Spanish (x32 Version: 2010.0113.2207.39662)
CCC Help Spanish (x32 Version: 2012.1219.1520.27485)
CCC Help Swedish (x32 Version: 2010.0113.2207.39662)
CCC Help Swedish (x32 Version: 2012.1219.1520.27485)
CCC Help Thai (x32 Version: 2010.0113.2207.39662)
CCC Help Thai (x32 Version: 2012.1219.1520.27485)
CCC Help Turkish (x32 Version: 2010.0113.2207.39662)
CCC Help Turkish (x32 Version: 2012.1219.1520.27485)
ccc-core-static (x32 Version: 2010.0113.2208.39662)
ccc-utility64 (Version: 2010.0113.2208.39662)
ccc-utility64 (Version: 2012.1219.1521.27485)
CCleaner (Version: 3.09)
Crysis WARHEAD® (x32 Version: 1.0)
Crysis WARHEAD® (x32)
Crysis Wars® (x32 Version: 1.0)
Crysis Wars® (x32)
Crysis Wars® Patch (x32 Version: 1.0.5.0)
Crysis Wars® Patch (x32)
Crysis® (x32 Version: 1.00.0000)
D3DX10 (x32 Version: 15.4.2368.0902)
Dark Souls: Prepare to Die Edition (x32)
Definition Update for Microsoft Office 2010 (KB982726) 64-Bit Edition
Dell DataSafe Local Backup - Support Software (x32 Version: 9.4.60)
Dell DataSafe Local Backup (x32 Version: 9.4.60)
Dell DataSafe Online (x32 Version: 2.1.19634)
Dell Edoc Viewer (Version: 1.0.0)
Dell Getting Started Guide (x32 Version: 1.00.0000)
Dell MusicStage (x32 Version: 1.3.31.0)
Dell PhotoStage (x32 Version: 1.5.0.19)
Dell Stage (x32 Version: 1.5.420.0)
Dell Support Center (Version: 3.0.5621.01)
Dell VideoStage (x32 Version: 1.1.0.1011)
DirectXInstallService (x32 Version: 9.0.2)
DiRT 3 (x32)
EMC 10 Content (x32 Version: 1.0.035)
EMCGadgets64 (Version: 1.0.302)
ESET Online Scanner v3 (x32)
ESN Sonar (x32 Version: 0.70.4)
Euro Truck Simulator 2 (x32 Version: 1.1.1)
F1 2010 (x32 Version: 1.0.0001.132)
F1 2013 (x32)
Far Cry 3 (x32 Version: 1.04)
FARO LS 1.1.406.58 (x32 Version: 4.6.58.2)
Fraps (x32)
Google Chrome (HKCU Version: 31.0.1650.57)
Google Update Helper (x32 Version: 1.3.21.165)
Graphmatica (x32)
GRID 2 (x32)
GTR 2 1.0.0.0 (x32 Version: v1.0.0.0)
GTR2 Championship Manager (x32 Version: 1.6.2)
Intel® Control Center (x32 Version: 1.2.0.1006)
Intel® Rapid Storage Technology (x32 Version: 9.5.0.1037)
iTunes (Version: 10.2.2.12)
Java Auto Updater (x32 Version: 2.0.5.1)
Java 6 Update 22 (64-bit) (Version: 6.0.220)
Java 6 Update 26 (x32 Version: 6.0.260)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
League of Legends (x32 Version: 1.3)
Logitech Gaming Software 5.10 (Version: 5.10.127)
Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mark Webber 2013 Screensaver (x32)
Mass Effect (x32 Version: 1.00)
Mass Effect 2 (x32 Version: 1.00)
MATLAB R2011a (Version: 7.12)
Mesh Runtime (x32 Version: 15.4.5722.2)
Messenger Companion (x32 Version: 15.4.3502.0922)
Micro-Cap 10 Evaluation (x32 Version: 10.1.0.0)
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Excel 2010 (Version: 14.0.7015.1000)
Microsoft Games for Windows - LIVE Redistributable (x32 Version: 3.5.92.0)
Microsoft Games for Windows Marketplace (x32 Version: 3.5.50.0)
Microsoft Office Excel 2010 (Version: 14.0.7015.1000)
Microsoft Office Excel MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Office 32-bit Components 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint 2010 (Version: 14.0.7015.1000)
Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proof (Spanish) 2010 (Version: 14.0.7015.1000)
Microsoft Office Proofing (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared 32-bit MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft Office Word 2010 (Version: 14.0.7015.1000)
Microsoft Office Word MUI (English) 2010 (Version: 14.0.7015.1000)
Microsoft PowerPoint 2010 (Version: 14.0.7015.1000)
Microsoft Rise Of Nations (x32)
Microsoft Search Enhancement Pack (x32 Version: 3.0.131.0)
Microsoft Security Client (Version: 4.4.0304.0)
Microsoft Security Essentials (Version: 4.4.304.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.50727.42)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (x32 Version: 11.0.50727.1)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (x32 Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (x32 Version: 11.0.50727)
Microsoft Word 2010 (Version: 14.0.7015.1000)
Microsoft Works (x32 Version: 08.05.0818)
Microsoft XNA Framework Redistributable 4.0 (x32 Version: 4.0.20823.0)
MotoGP13 Demo (x32 Version: 1.00.0000)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
MSXML4 Parser (x32 Version: 1.0.0)
Multimedia Card Reader (x32 Version: 1.4.915.1)
Nexus Mod Manager (Version: 0.45.4)
NVIDIA PhysX (x32 Version: 9.12.1031)
OpenAL (x32)
PlanetSide 2 (x32)
PowerISO (x32 Version: 5.4)
QuickTime (x32 Version: 7.69.80.9)
Race Injection (x32)
RaceRoom Racing Experience  (x32)
RaceRoom Racing Experience Launcher (x32 Version: 1.0)
Rapture3D 2.4.8 Game (x32)
Richard Burns Rally (x32 Version: 1.00.000)
Rise of Nations (x32 Version: 1.0)
Roxio Activation Module (x32 Version: 1.0)
Roxio BackOnTrack (x32 Version: 1.3.0)
Roxio Central Audio (x32 Version: 3.8.0)
Roxio Central Copy (x32 Version: 3.8.0)
Roxio Central Core (x32 Version: 3.8.0)
Roxio Central Data (x32 Version: 3.8.0)
Roxio Central Tools (x32 Version: 3.8.0)
Roxio Easy CD and DVD Burning (x32 Version: 10.3)
Roxio Easy CD and DVD Burning (x32 Version: 10.3.106)
Roxio Express Labeler 3 (x32 Version: 3.2.1)
Roxio File Backup (Version: 1.3.0)
Roxio Update Manager (x32 Version: 6.0.0)
Secret of the Magic Crystal (x32)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 64-Bit Edition
Setup - Formula Truck 2013 ... (x32 Version: ...)
Skins (x32 Version: 2010.0113.2208.39662)
Skype Toolbars (x32 Version: 1.0.4051)
Skype™ 6.3 (x32 Version: 6.3.105)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0)
SopCast 3.8.3 (x32 Version: 3.8.3)
Steam (x32 Version: 1.0.0.0)
swMSM (x32 Version: 12.0.0.1)
TeamSpeak 3 Client (Version: 3.0.12)
The Elder Scrolls V: Skyrim (x32)
The Movies (x32 Version: 1.0)
THX TruStudio PC (x32 Version: 1.0)
Unity Web Player (HKCU Version: )
Universe Sandbox (x32)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3) (x32 Version: 3)
Update for Microsoft Filter Pack 2.0 (KB2810071) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 64-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 64-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 64-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 64-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 64-Bit Edition
Update for Microsoft Office 2010 (KB2826026) 64-Bit Edition
Update for Microsoft OneNote 2010 (KB2810072) 64-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2553145) 64-Bit Edition
Update for Microsoft Word 2010 (KB2827323) 64-Bit Edition
Uplay (x32 Version: 2.0)
VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0)
VD64Inst (Version: 1.00.0000)
Ventrilo Client for Windows x64 (Version: 3.0.8.0)
VLC media player 1.1.11 (x32 Version: 1.1.11)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3502.0922)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3502.0922)
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3502.0922)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)
WinRAR archiver
 
==================== Restore Points  =========================
 
17-11-2013 08:36:21 Installed DirectX
17-11-2013 08:42:21 Windows Update
17-11-2013 10:42:47 Windows Update
17-11-2013 11:41:30 Restore Operation
17-11-2013 12:06:14 Windows Update
17-11-2013 17:00:33 Windows Update
18-11-2013 03:42:56 Restore Operation
18-11-2013 03:57:38 Installed DirectX
18-11-2013 04:59:11 Removed Microsoft Silverlight
18-11-2013 05:07:01 Removed NVIDIA Photoshop Plug-ins
 
==================== Hosts content: ==========================
 
2009-07-14 12:34 - 2009-06-11 07:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
 
==================== Scheduled Tasks (whitelisted) =============
 
Task: {04D21E14-EADB-42F2-BE70-998A239465A1} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-06-12] (Adobe Systems Incorporated)
Task: {17B24BD9-C8FA-44BB-B93F-171F905F2550} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\Dell Support Center\pcdrcui.exe [2010-08-06] (PC-Doctor, Inc.)
Task: {22CD8939-2985-42B5-B214-446D29679BEE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07] (Google Inc.)
Task: {259DDDBE-E7C2-49CC-8928-9DB2AABA1097} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {3F31EFA5-FDD7-42DA-BA88-A59B7246FF0A} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell Support Center\uaclauncher.exe [2010-08-06] (PC-Doctor, Inc.)
Task: {4693D17C-D501-4C1C-AC44-DC2550EE886C} - System32\Tasks\Origin => C:\Users\Riley\AppData\Roaming\Origin\update.vbe [2013-10-29] ()
Task: {64DA9C1A-E25C-4D99-958B-006D2EE32E2F} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3519446951-2150770932-507619035-1000UA => C:\Users\Riley\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-21] (Google Inc.)
Task: {67B9C636-9248-442D-84F1-C7CB98CACD15} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2009-10-22] (Apple Inc.)
Task: {76092FA5-0750-4CA6-833A-F6D042F33620} - System32\Tasks\PCDEventLauncher => C:\Program Files\Dell Support Center\sessionchecker.exe [2010-08-06] ()
Task: {979579F5-8D9B-4D37-ADE4-88778379D6B3} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3519446951-2150770932-507619035-1000Core => C:\Users\Riley\AppData\Local\Google\Update\GoogleUpdate.exe [2011-01-21] (Google Inc.)
Task: {A899575D-09CF-4ED6-B1EA-E76307A21C9C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-06-07] (Google Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3519446951-2150770932-507619035-1000Core.job => C:\Users\Riley\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3519446951-2150770932-507619035-1000UA.job => C:\Users\Riley\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\Dell Support Center\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\Dell Support Center\pcdrcui.exe
 
==================== Loaded Modules (whitelisted) =============
 
2011-02-06 21:05 - 2010-03-15 11:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2011-01-14 09:57 - 2009-10-02 15:18 - 00058880 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll
2013-07-01 08:20 - 2013-10-25 03:45 - 00691200 _____ () C:\Program Files (x86)\Steam\SDL2.dll
2013-07-09 17:56 - 2013-10-31 05:25 - 01123240 _____ () C:\Program Files (x86)\Steam\bin\chromehtml.DLL
2013-07-09 13:45 - 2013-10-24 06:07 - 20625832 _____ () C:\Program Files (x86)\Steam\bin\libcef.dll
2013-06-14 15:49 - 2013-06-15 09:49 - 01100800 _____ () C:\Program Files (x86)\Steam\bin\avcodec-53.dll
2013-06-14 15:49 - 2013-06-15 09:49 - 00124416 _____ () C:\Program Files (x86)\Steam\bin\avutil-51.dll
2013-06-14 15:49 - 2013-06-15 09:49 - 00192000 _____ () C:\Program Files (x86)\Steam\bin\avformat-53.dll
2013-11-15 10:54 - 2013-11-14 21:28 - 00702416 _____ () C:\Users\Riley\AppData\Local\Google\Chrome\Application\31.0.1650.57\libglesv2.dll
2013-11-15 10:54 - 2013-11-14 21:28 - 00099792 _____ () C:\Users\Riley\AppData\Local\Google\Chrome\Application\31.0.1650.57\libegl.dll
2013-11-15 10:54 - 2013-11-14 21:29 - 04055504 _____ () C:\Users\Riley\AppData\Local\Google\Chrome\Application\31.0.1650.57\pdf.dll
2013-11-15 10:54 - 2013-11-14 21:29 - 00399312 _____ () C:\Users\Riley\AppData\Local\Google\Chrome\Application\31.0.1650.57\ppGoogleNaClPluginChrome.dll
2013-11-15 10:54 - 2013-11-14 21:28 - 01619408 _____ () C:\Users\Riley\AppData\Local\Google\Chrome\Application\31.0.1650.57\ffmpegsumo.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
AlternateDataStreams: C:\ProgramData:gs5sys
AlternateDataStreams: C:\Users\All Users:gs5sys
AlternateDataStreams: C:\Users\Riley:gs5sys
AlternateDataStreams: C:\ProgramData\Application Data:gs5sys
AlternateDataStreams: C:\ProgramData\Templates:gs5sys
AlternateDataStreams: C:\Users\Public\Pictures:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Public\Documents\My Pictures:gs5sys
AlternateDataStreams: C:\Users\Riley\Application Data:gs5sys
AlternateDataStreams: C:\Users\Riley\Cookies:gs5sys
AlternateDataStreams: C:\Users\Riley\Local Settings:gs5sys
AlternateDataStreams: C:\Users\Riley\Templates:gs5sys
AlternateDataStreams: C:\Users\Riley\Desktop\desktop.ini:gs5sys
AlternateDataStreams: C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice (1).eml:OECustomProperty
AlternateDataStreams: C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice.eml:OECustomProperty
AlternateDataStreams: C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice.mht.eml:OECustomProperty
AlternateDataStreams: C:\Users\Riley\AppData\Local:gs5sys
AlternateDataStreams: C:\Users\Riley\AppData\Roaming:gs5sys
AlternateDataStreams: C:\Users\Riley\AppData\Local\Application Data:gs5sys
AlternateDataStreams: C:\Users\Riley\AppData\Local\History:gs5sys
AlternateDataStreams: C:\Users\Riley\Documents\desktop.ini:gs5sys
 
==================== Safe Mode (whitelisted) ===================
 
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\McMPFSvc => ""="Service"
 
==================== Faulty Device Manager Devices =============
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (11/18/2013 06:18:32 PM) (Source: SideBySide) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error: (11/18/2013 06:06:13 PM) (Source: Windows Search Service) (User: )
 
Error: (11/18/2013 04:10:00 PM) (Source: PC-Doctor) (User: )
Description: (260) Asapi: (16:10:00:4020)(260) Asapi.State - Error -- 123 Plugin S3LogPusher.dll failed to load.
 
Error: (11/18/2013 04:10:00 PM) (Source: PC-Doctor) (User: )
Description: (260) Asapi: (16:10:00:4010)(260) libAsapi.DynamicLoadedPlugin - Error -- 64 Unable to load library 'S3LogPusher.dll'
 
Error: (11/18/2013 04:00:02 PM) (Source: PC-Doctor) (User: )
Description: (4236) Asapi: (16:00:02:8010)(4236) Asapi.State - Error -- 123 Plugin S3LogPusher.dll failed to load.
 
Error: (11/18/2013 04:00:02 PM) (Source: PC-Doctor) (User: )
Description: (4236) Asapi: (16:00:02:7920)(4236) libAsapi.DynamicLoadedPlugin - Error -- 64 Unable to load library 'S3LogPusher.dll'
 
Error: (11/18/2013 02:35:41 PM) (Source: Windows Search Service) (User: )
 
Error: (11/18/2013 00:40:22 PM) (Source: PC-Doctor) (User: )
Description: (1212) Asapi: (12:40:22:7880)(1212) Asapi.State - Error -- 123 Plugin S3LogPusher.dll failed to load.
 
Error: (11/18/2013 00:40:22 PM) (Source: PC-Doctor) (User: )
Description: (1212) Asapi: (12:40:22:6780)(1212) libAsapi.DynamicLoadedPlugin - Error -- 64 Unable to load library 'S3LogPusher.dll'
 
Error: (11/18/2013 00:11:04 PM) (Source: PC-Doctor) (User: )
Description: (1192) Asapi: (12:11:04:0040)(1192) engine.EngineLink - Error -- 81 Invalid connection to client
 
 
System errors:
=============
Error: (11/18/2013 06:09:11 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
papycpu2
papyjoy
RxFilter
 
Error: (11/18/2013 06:09:03 PM) (Source: Service Control Manager) (User: )
Description: The SessionLauncher service failed to start due to the following error: 
%%2
 
Error: (11/18/2013 06:09:03 PM) (Source: Service Control Manager) (User: )
Description: The McAfee Personal Firewall Service service depends the following service: MfeFire. This service might not be installed.
 
Error: (11/18/2013 06:08:48 PM) (Source: Application Popup) (User: )
Description: \SystemRoot\SysWow64\DRIVERS\papyjoy.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (11/18/2013 06:08:48 PM) (Source: Application Popup) (User: )
Description: \SystemRoot\SysWow64\DRIVERS\papycpu2.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (11/18/2013 05:55:07 PM) (Source: iaStor) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.
 
Error: (11/18/2013 05:47:08 PM) (Source: Service Control Manager) (User: )
Description: The following boot-start or system-start driver(s) failed to load: 
papycpu2
papyjoy
RxFilter
 
Error: (11/18/2013 05:46:59 PM) (Source: Service Control Manager) (User: )
Description: The SessionLauncher service failed to start due to the following error: 
%%2
 
Error: (11/18/2013 05:46:59 PM) (Source: Service Control Manager) (User: )
Description: The McAfee Personal Firewall Service service depends the following service: MfeFire. This service might not be installed.
 
Error: (11/18/2013 05:46:47 PM) (Source: Application Popup) (User: )
Description: \SystemRoot\SysWow64\DRIVERS\papyjoy.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
 
Microsoft Office Sessions:
=========================
Error: (11/18/2013 06:18:32 PM) (Source: SideBySide)(User: )
Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Riley\Downloads\esetsmartinstaller_enu.exe
 
Error: (11/18/2013 06:06:13 PM) (Source: Windows Search Service)(User: )
 
Error: (11/18/2013 04:10:00 PM) (Source: PC-Doctor)(User: )
Description: (260) Asapi: (16:10:00:4020)(260) Asapi.State - Error -- 123 Plugin S3LogPusher.dll failed to load.
 
Error: (11/18/2013 04:10:00 PM) (Source: PC-Doctor)(User: )
Description: (260) Asapi: (16:10:00:4010)(260) libAsapi.DynamicLoadedPlugin - Error -- 64 Unable to load library 'S3LogPusher.dll'
 
Error: (11/18/2013 04:00:02 PM) (Source: PC-Doctor)(User: )
Description: (4236) Asapi: (16:00:02:8010)(4236) Asapi.State - Error -- 123 Plugin S3LogPusher.dll failed to load.
 
Error: (11/18/2013 04:00:02 PM) (Source: PC-Doctor)(User: )
Description: (4236) Asapi: (16:00:02:7920)(4236) libAsapi.DynamicLoadedPlugin - Error -- 64 Unable to load library 'S3LogPusher.dll'
 
Error: (11/18/2013 02:35:41 PM) (Source: Windows Search Service)(User: )
 
Error: (11/18/2013 00:40:22 PM) (Source: PC-Doctor)(User: )
Description: (1212) Asapi: (12:40:22:7880)(1212) Asapi.State - Error -- 123 Plugin S3LogPusher.dll failed to load.
 
Error: (11/18/2013 00:40:22 PM) (Source: PC-Doctor)(User: )
Description: (1212) Asapi: (12:40:22:6780)(1212) libAsapi.DynamicLoadedPlugin - Error -- 64 Unable to load library 'S3LogPusher.dll'
 
Error: (11/18/2013 00:11:04 PM) (Source: PC-Doctor)(User: )
Description: (1192) Asapi: (12:11:04:0040)(1192) engine.EngineLink - Error -- 81 Invalid connection to client
 
 
CodeIntegrity Errors:
===================================
  Date: 2013-03-29 10:43:32.700
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\atikmpag.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2013-03-29 10:43:32.622
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\atikmpag.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2013-03-29 10:35:55.470
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\atikmpag.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2013-03-29 10:35:55.392
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\atikmpag.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2013-03-29 10:33:24.782
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\atikmpag.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2013-03-29 10:33:24.704
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\atikmpag.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
==================== Memory info =========================== 
 
Percentage of memory in use: 38%
Total physical RAM: 6103.08 MB
Available physical RAM: 3728.87 MB
Total Pagefile: 12204.34 MB
Available Pagefile: 9585.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.8 MB
 
==================== Drives ================================
 
Drive c: (OS) (Fixed) (Total:919.13 GB) (Free:452.48 GB) NTFS
Drive d: (MassEffect2) (CDROM) (Total:7.31 GB) (Free:0 GB) UDF
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: B0000000)
Partition 1: (Not Active) - (Size=133 MB) - (Type=DE)
Partition 2: (Active) - (Size=12 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=919 GB) - (Type=07 NTFS)
 
==================== End Of Log ============================
 
 
 
 
 
 
 
I am going to use the rookie scanner now.

 

 

malware logs.zip

Link to post
Share on other sites

Fix with FRST (normal mode)

  • Open notepad (Start =>All Programs => Accessories => Notepad).
  • Please copy the entire contents of the code box below.
    (To do this highlight the contents of the box, right click on it and select copy. Right-click in the open notepad and select Paste).
  • Save it to the same direction as frst.exe (or frst64.exe) as fixlist.txt.

    SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=60a121de000000000000842b2bb801dcBHO: Expat Shield Class - {3706EE7C-3CAD-445D-8A43-03EBC3B75908} - C:\Program Files (x86)\Expat Shield\HssIE\ExpatIE_64.dll No FileCHR DefaultSearchURL: (Delta Search) - http://www.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=60a121de000000000000842b2bb801dcCHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}Task: {4693D17C-D501-4C1C-AC44-DC2550EE886C} - System32\Tasks\Origin => C:\Users\Riley\AppData\Roaming\Origin\update.vbe [2013-10-29] ()AlternateDataStreams: C:\ProgramData:gs5sysAlternateDataStreams: C:\Users\All Users:gs5sysAlternateDataStreams: C:\Users\Riley:gs5sysAlternateDataStreams: C:\ProgramData\Application Data:gs5sysAlternateDataStreams: C:\ProgramData\Templates:gs5sysAlternateDataStreams: C:\Users\Public\Pictures:gs5sysAlternateDataStreams: C:\Users\Public\Documents\desktop.ini:gs5sysAlternateDataStreams: C:\Users\Public\Documents\My Pictures:gs5sysAlternateDataStreams: C:\Users\Riley\Application Data:gs5sysAlternateDataStreams: C:\Users\Riley\Cookies:gs5sysAlternateDataStreams: C:\Users\Riley\Local Settings:gs5sysAlternateDataStreams: C:\Users\Riley\Templates:gs5sysAlternateDataStreams: C:\Users\Riley\Desktop\desktop.ini:gs5sysAlternateDataStreams: C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice (1).eml:OECustomPropertyAlternateDataStreams: C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice.eml:OECustomPropertyAlternateDataStreams: C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice.mht.eml:OECustomPropertyAlternateDataStreams: C:\Users\Riley\AppData\Local:gs5sysAlternateDataStreams: C:\Users\Riley\AppData\Roaming:gs5sysAlternateDataStreams: C:\Users\Riley\AppData\Local\Application Data:gs5sysAlternateDataStreams: C:\Users\Riley\AppData\Local\History:gs5sysAlternateDataStreams: C:\Users\Riley\Documents\desktop.ini:gs5sysC:\Program Files (x86)\Expat ShieldC:\Windows\System32\Tasks\OriginC:\Users\Riley\AppData\Roaming\OriginC:\Users\Riley\AppData\Local\Temp\ubi50EE.tmp.exe
    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
  • Run frst.exe (on 64bit, run frst64.exe) and press the Fix button just once and wait.
  • The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.

 

 

Full System Scan with Malwarebytes Antimalware


  • If not existing, please download
Malwarebytes' Anti-Malware to your desktop. Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.



If the program is already installed:

  • Run Malwarebytes Antimalware
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform fullscan, place a checkmark on all hard drives, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
  • Post that log back here.

Link to post
Share on other sites

C:\Program Files (x86)\Expat Shield

C:\Windows\System32\Tasks\Origin

C:\Users\Riley\AppData\Roaming\Origin

C:\Users\Riley\AppData\Local\Temp\ubi50EE.tmp.exe

*****************

 

HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key deleted successfully.

HKCR\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} => Key not found.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3706EE7C-3CAD-445D-8A43-03EBC3B75908} => Key deleted successfully.

HKCR\CLSID\{3706EE7C-3CAD-445D-8A43-03EBC3B75908} => Key deleted successfully.

CHR DefaultSearchURL: (Delta Search) - http://www.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=60a121de000000000000842b2bb801dc ==> The Chrome "Settings" can be used to fix the entry.

CHR DefaultSuggestURL: (Delta Search) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter} ==> The Chrome "Settings" can be used to fix the entry.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{4693D17C-D501-4C1C-AC44-DC2550EE886C} => Key deleted successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{4693D17C-D501-4C1C-AC44-DC2550EE886C} => Key deleted successfully.

C:\Windows\System32\Tasks\Origin => Moved successfully.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Origin => Key deleted successfully.

C:\ProgramData => ":gs5sys" ADS removed successfully.

"C:\Users\All Users" => ":gs5sys" ADS not found.

C:\Users\Riley => ":gs5sys" ADS removed successfully.

"C:\ProgramData\Application Data" => ":gs5sys" ADS not found.

"C:\ProgramData\Templates" => ":gs5sys" ADS not found.

C:\Users\Public\Pictures => ":gs5sys" ADS removed successfully.

C:\Users\Public\Documents\desktop.ini => ":gs5sys" ADS removed successfully.

"C:\Users\Public\Documents\My Pictures" => ":gs5sys" ADS not found.

"C:\Users\Riley\Application Data" => ":gs5sys" ADS not found.

"C:\Users\Riley\Cookies" => ":gs5sys" ADS not found.

"C:\Users\Riley\Local Settings" => ":gs5sys" ADS not found.

"C:\Users\Riley\Templates" => ":gs5sys" ADS not found.

C:\Users\Riley\Desktop\desktop.ini => ":gs5sys" ADS removed successfully.

C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice (1).eml => ":OECustomProperty" ADS removed successfully.

C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice.eml => ":OECustomProperty" ADS removed successfully.

C:\Users\Riley\Downloads\CatchOfTheDay_com_au - Tax Invoice.mht.eml => ":OECustomProperty" ADS removed successfully.

C:\Users\Riley\AppData\Local => ":gs5sys" ADS removed successfully.

C:\Users\Riley\AppData\Roaming => ":gs5sys" ADS removed successfully.

"C:\Users\Riley\AppData\Local\Application Data" => ":gs5sys" ADS not found.

"C:\Users\Riley\AppData\Local\History" => ":gs5sys" ADS not found.

C:\Users\Riley\Documents\desktop.ini => ":gs5sys" ADS removed successfully.

"C:\Program Files (x86)\Expat Shield" => File/Directory not found.

"C:\Windows\System32\Tasks\Origin" => File/Directory not found.

 

"C:\Users\Riley\AppData\Roaming\Origin" directory move:

 

C:\Users\Riley\AppData\Roaming\Origin\local.xml => Moved successfully.

C:\Users\Riley\AppData\Roaming\Origin\local_3ddf03291627ae81737fb4af692507d6.xml => Moved successfully.

C:\Users\Riley\AppData\Roaming\Origin\update.vbe => Moved successfully.

C:\Users\Riley\AppData\Roaming\Origin\Web Storage\WebpageIcons.db => Moved successfully.

C:\Users\Riley\AppData\Roaming\Origin\Web Storage\LocalStorage\widget_mygames-1888374ed0f84721b1fee3d06596011a9e1c4c48_0.localstorage => Moved successfully.

C:\Users\Riley\AppData\Roaming\Origin\Cloud Saves\2382605563.usage => Moved successfully.

C:\Users\Riley\AppData\Roaming\Origin\Cloud Saves\blacklist => Moved successfully.

Could not move "C:\Users\Riley\AppData\Roaming\Origin" directory. => Scheduled to move on reboot.

 

C:\Users\Riley\AppData\Local\Temp\ubi50EE.tmp.exe => Moved successfully.

 

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2013-11-19 07:32:09)<=

 

==> ATTENTION: System is not rebooted.

C:\Users\Riley\AppData\Roaming\Origin => Is moved successfully.

 

==== End of Fixlog ====

 

 

 

I am doing the full scan now.

Link to post
Share on other sites

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

 

Database version: v2013.11.18.01

 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16736

Riley :: RILEY-PC [administrator]

 

19/11/2013 7:35:12 AM

mbam-log-2013-11-19 (07-35-12).txt

 

Scan type: Full scan (C:\|)

Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM

Scan options disabled: P2P

Objects scanned: 901437

Time elapsed: 2 hour(s), 14 minute(s), 34 second(s)

 

Memory Processes Detected: 0

(No malicious items detected)

 

Memory Modules Detected: 0

(No malicious items detected)

 

Registry Keys Detected: 0

(No malicious items detected)

 

Registry Values Detected: 0

(No malicious items detected)

 

Registry Data Items Detected: 0

(No malicious items detected)

 

Folders Detected: 0

(No malicious items detected)

 

Files Detected: 8

C:\Users\Riley\Desktop\SopCast\Setup-SopCast-3.8.3-2013-6-26.exe (PUP.Optional.Spigot.A) -> Quarantined and deleted successfully.

C:\Users\Riley\Desktop\SopCast\SopCast.zip (PUP.Optional.Spigot.A) -> Quarantined and deleted successfully.

C:\Windows\Temp\svchost.exe (Trojan.Agent.Gen) -> Quarantined and deleted successfully.

C:\Windows\Temp\phatk121016.cl (Trojan.BitcoinMiner) -> Quarantined and deleted successfully.

C:\Windows\Temp\scrypt130511.cl (Trojan.BitcoinMiner) -> Quarantined and deleted successfully.

C:\Windows\Temp\diablo130302.cl (Trojan.BitcoinMiner) -> Quarantined and deleted successfully.

C:\Windows\Temp\poclbm130302.cl (Trojan.BitcoinMiner) -> Quarantined and deleted successfully.

C:\Windows\Temp\diakgcn121016.cl (Trojan.BitcoinMiner) -> Quarantined and deleted successfully.

 

(end)
Link to post
Share on other sites

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked
  • Click on Advanced Settings and ensure these options are ticked:
    • Scan for potentially unwanted applications
  • Scan for potentially unsafe applications
  • Enable Anti-Stealth Technology

[*]Click Scan[*]Wait for the scan to finish[*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

Link to post
Share on other sites

C:\FRST\Quarantine\update.vbe VBS/CoinMiner.AD trojan

C:\Program Files (x86)\Dell DataSafe Local Backup\hstart.exe a variant of Win32/HiddenStart.A application

C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application

C:\Users\All Users\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application

C:\Users\Riley\Downloads\Pete_Murray_Always_a_winner_downloader_401a.exe a variant of Win32/YourFileDownloader application
Link to post
Share on other sites

 

C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Users\All Users\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll a variant of Win32/Adware.Yontoo.B application
C:\Users\Riley\Downloads\Pete_Murray_Always_a_winner_downloader_401a.exe a variant of Win32/YourFileDownloader application

 

Delete these files.

 

 

Then we can do the cleanup - if you are facing any issues, report that immediately.

Delete junk with adwCleaner

Please download AdwCleaner to your desktop.

  • Run adwcleaner.exe
  • Hit Scan and wait for the scan to finish.
  • Confirm the message but don´t uncheck anything.
  • Hit Clean
  • When the run is finished, it will open up a text file
  • Please post its contents within your next reply
  • You´ll find the log file at C:\AdwCleaner[s1].txt also

SecurityCheck

Please download SecurityCheck: LINK1 LINK2

  • Save it to your desktop, start it and follow the instructions in the window.
  • After the scan finished the (checkup.txt) will open. Copy its content to your thread.

Link to post
Share on other sites

# AdwCleaner v3.012 - Report created 20/11/2013 at 20:04:11

# Updated 11/11/2013 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Riley - RILEY-PC

# Running from : C:\Users\Riley\Downloads\adwcleaner.exe

# Option : Clean

 

***** [ Services ] *****

 

 

***** [ Files / Folders ] *****

 

Folder Deleted : C:\ProgramData\apn

Folder Deleted : C:\ProgramData\Babylon

Folder Deleted : C:\ProgramData\Tarma Installer

Folder Deleted : C:\ProgramData\Trymedia

Folder Deleted : C:\Program Files (x86)\AskPartnerNetwork

Folder Deleted : C:\Program Files (x86)\Gophoto.it

File Deleted : C:\Users\Riley\AppData\Roaming\Mozilla\Firefox\Profiles\0\Extensions\freehdsport@freehdsport.tv.xpi

File Deleted : C:\Users\Riley\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.delta-search.com_0.localstorage-journal

 

***** [ Shortcuts ] *****

 

 

***** [ Registry ] *****

 

Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS

Key Deleted : HKCU\Software\5d68fd8b63db814

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_euro-truck-simulator_RASAPI32

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_euro-truck-simulator_RASMANCS

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}

Key Deleted : HKCU\Software\Softonic

Key Deleted : HKCU\Software\YahooPartnerToolbar

Key Deleted : HKLM\Software\Babylon

Key Deleted : HKLM\Software\DataMngr

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}

Key Deleted : [x64] HKLM\SOFTWARE\Tarma Installer

 

***** [ Browsers ] *****

 

-\\ Internet Explorer v0.0.0.0

 

 

-\\ Mozilla Firefox v

 

[ File : C:\Users\Riley\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js ]

 

 

-\\ Google Chrome v

 

[ File : C:\Users\Riley\AppData\Local\Google\Chrome\User Data\Default\preferences ]

 

Deleted : icon_url

Deleted : search_url

Deleted : keyword

 

*************************

 

AdwCleaner[R0].txt - [4275 octets] - [20/11/2013 20:03:30]

AdwCleaner[s0].txt - [4149 octets] - [20/11/2013 20:04:11]

 

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [4209 octets] ##########
Link to post
Share on other sites

 Results of screen317's Security Check version 0.99.77  

 Windows 7 Service Pack 1 x64 (UAC is disabled!)  

 Internet Explorer 10 Out of date! 

``````````````Antivirus/Firewall Check:`````````````` 

 Windows Security Center service is not running! This report may not be accurate! 

 Windows Firewall Enabled!  

Microsoft Security Essentials   

  (On Access scanning disabled!) 

`````````Anti-malware/Other Utilities Check:````````` 

 Malwarebytes Anti-Malware version 1.75.0.1300  

 Java 6 Update 26  

 Java version out of Date! 

 Adobe Flash Player 11.7.700.224  

 Adobe Reader 9 Adobe Reader out of Date! 

 Google Chrome 30.0.1599.101  

 Google Chrome 31.0.1650.57  

````````Process Check: objlist.exe by Laurent````````  

 Microsoft Security Essentials MSMpEng.exe 

 Microsoft Security Essentials msseces.exe 

`````````````````System Health check````````````````` 

 Total Fragmentation on Drive C: 0% 

````````````````````End of Log`````````````````````` 
Link to post
Share on other sites

Your system is clean now! :)

 

 

Internet Explorer out of date

Your version of Internet Explorer is outdated.

  1. Please download IE 8 from http://windows.microsoft.com/en-US/internet-explorer/downloads/ie-8.
  2. Save it to your desktop.
  3. Double click on the file on your desktop to start the installation process.
  4. Reboot

 

 

 

Java runtime Environment out of date

Your Java runtime environment is outdated. We will fix this.

  • Get the actual JRE from here
  • Save jxpiinstall.exe to your desktop
  • Close all running programs, especially your browser(s)
  • Run jxpiinstall.exe. This will download the newest JRE installer and install the software
  • when finished, go to
    Start-->control panel-->add/remove programs and remove all older Java versions. (if existing)
  • When finished, reboot your computer.


After the reboot

  • Open control panel again and click the java symbol.
  • Click Settings under Temporary Internet Files.
    The Temporary Files Settings dialog box appears.
  • Click Delete Files.
    The Delete Temporary Files dialog box appears
  • Click OK on Delete Temporary Files window.
  • Click OK again.

 

 

 

Adobe Reader out of date

Your Adobe Reader is outdated. We will fix this.


  • Get the actual software from here. Important: Uncheck any optional software (for example Google Chrome, etc.) offered.
  • Run setup and follow the instructions.
  • Click upon Start-->control panel-->add/remove programs.
  • Search for and remove any older reader versions.

 

 

 

Then we can do the cleanup - if you are facing any issues, report that immediately.

Delete junk with adwCleaner


Please download AdwCleaner to your desktop.


  • Run adwcleaner.exe
  • Hit Scan and wait for the scan to finish.
  • Confirm the message but don´t uncheck anything.
  • Hit Clean
  • When the run is finished, it will open up a text file
  • Please post its contents within your next reply
  • You´ll find the log file at C:\AdwCleaner[s1].txt also


SecurityCheck

Please download SecurityCheck: LINK1 LINK2

  • Save it to your desktop, start it and follow the instructions in the window.
  • After the scan finished the (checkup.txt) will open. Copy its content to your thread.

 

 

 

Recommendations: How to protect yourself

  • System Updates
    Please ensure to have automatic updates activated in your control panel.
    For further information and a tutorial, see this Microsoft Support article.
  • Protection
    What you need is one (not more) virus scanner with background protection. Additionally I recommend a special malware scanner to run on demand weekly.
    Personally I am using avast! Antivirus Free Edition and Malwarebytes Anti-Malware. They offer good protection for free.
    • To keep your browser free of advertising, you may install the Adblock Plus browser extension.
      It will filter unwanted advertising out of the website´s content.
    • To protect yourself from accidentally visiting malicious web sites, install the Web of Trust (WOT) browser extension.
      It will display a green (safe), yellow (unknown) or red (potentially dangerous) icon for a visited website within your browser.
      In addition, before accessing a dangerous classified web site, a warning screen is displayed.


    [*]Up to date Software
    Keep your Windows and your third party software up to date. The easiest way to get infected is an outdated windows, followed by: browser(s) (including add-ons and plug-ins), Adobe Flash Player and Adobe Reader, Java Runtime Environment, your antivirus program and so on. These links may help you to check:

    [*]Backup
    Hardware issues, malware, fire, lightning strike: There is a long list of different ways to loose all your data. Back up your files regularly. Use the windows internal backup function or a third party tool and save your data onto an external hard drive, cloud storage, optical media like CDs or DVDs or (if available) a professional network backup system. [*]Behaviour
    The commonest error when using a computer is "error 80" - what means that the error is located about 80cm in front of the monitor. This is a common joke between IT support technicians but it shows that all the safety mechanisms won´t help you if aren´t careful enough.

    • While surfing the internet, don´t click on anything you don´t know. In the worst case, it infects your system with malware.
    • Watch your step in social networks! Many cyber criminals use them to spread malware, mine personal pata (to be sold to advertising companies, for example) or simply do damage to other users. Even if a received hyperlink within a message seems to be coming from one of your friends, have a closer look. In addition, don´t click everything.
    • When installing software, have a look to each of the setup windows and uncheck any additional toolbars or free programs that may be offered additionally. Most of today´s setup procedures contain potentially unwanted programs so keep them off your system.
    • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
      They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.



Link to post
Share on other sites

  • Root Admin

Glad we could help. :)

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.