BrianC Posted January 18, 2014 ID:779439 Share Posted January 18, 2014 Got hit with a massive number of popups and such today. Using Malwarebytes Pro version, it found about 90 different things and removed them. However, I am left with some lingering things: - In IE, I have an extension called TheSeaApp that cannot be disabled or removed and is a hijacker - In IE, I have an extension called "We-Care Add-on" that I can disable but not remove - In control panel-> programs, I have "CWA Reminder by We-Care.com v4.1.24.3" that I cannot uninstall I tried to run DDR as per the instructions, but this is a Win8 machine, and DDR does not run on Win8. I have attached the mbam logfiles so you can get a sense of what it did find. Please advise as to next steps. -Brian Link to post Share on other sites More sharing options...
BrianC Posted January 18, 2014 Author ID:779441 Share Posted January 18, 2014 It doesn't appear like the attaching of files worked, so here's the text: Malwarebytes Anti-Malware (PRO) 1.75.0.1300www.malwarebytes.org Database version: v2014.01.17.03 Windows 8 x64 NTFSInternet Explorer 11.0.9600.16476Dennise :: CHERKYSTUDIO [administrator] Protection: Enabled 1/17/2014 1:30:28 PMmbam-log-2014-01-17 (13-30-28).txt Scan type: Flash scanScan options enabled: Memory | Startup | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: Registry | File System | P2PObjects scanned: 223862Time elapsed: 55 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 26HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\The Sea App (PUP.Optional.TheSeaApp.A) -> No action taken.HKCR\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> No action taken.HKCR\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE} (PUP.Optional.WeCare.A) -> No action taken.HKCR\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3} (PUP.Optional.WeCare.A) -> No action taken.HKCR\IEHelperv250.WeCareReminder.1 (PUP.Optional.WeCare.A) -> No action taken.HKCR\IEHelperv250.WeCareReminder (PUP.Optional.WeCare.A) -> No action taken.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> No action taken.HKCR\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3} (PUP.Optional.WeCare.A) -> No action taken.HKCR\CLSID\{6ED0A312-78F5-493C-A90C-5DAF321D0BF8} (PUP.Optional.WeCare.A) -> No action taken.HKCR\TypeLib\{B3201ABA-7CDE-4C8D-A28D-4316427BD6D1} (PUP.Optional.WeCare.A) -> No action taken.HKCR\Interface\{B60591CD-AA25-4261-B05A-77826471C0A3} (PUP.Optional.WeCare.A) -> No action taken.HKCR\CLSID\{B60591CD-AA25-4261-B05A-77826471C0A3} (PUP.Optional.WeCare.A) -> No action taken.HKCR\CLSID\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCR\TypeLib\{1F29738C-11D6-4AE5-A1B1-86D4D5F3A69C} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCR\Interface\{96B4DEA0-F89C-475C-8124-B247260B7CB5} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B74443DB-5A88-4583-860A-F0D06EF399E3} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> No action taken.HKCR\CLSID\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> No action taken.HKCR\TheSeaApp.Plugin (PUP.Optional.TheSeaApp.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> No action taken. Registry Values Detected: 0(No malicious items detected) Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 9C:\Program Files (x86)\The Sea App (Internet Explorer) (PUP.Optional.TheSeaApp.A) -> No action taken.C:\ProgramData\WeCareReminder (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults\preferences (PUP.Optional.WeCare.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor (PUP.Optional.ArcadeParlor.A) -> No action taken. Files Detected: 32C:\Program Files (x86)\The Sea App (Internet Explorer)\The Sea App.dll.config (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\Interop.SHDocVw.dll (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\Microsoft.mshtml.dll (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\SpicIEx.dll (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\The Sea App.dll (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\Uninstall.exe (PUP.Optional.TheSeaApp.A) -> No action taken.C:\ProgramData\WeCareReminder\MerchantHash.json (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\cleanwateraction.bmp (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEHelperv2.5.0PS.dll (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEMenuItem.dll (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEMenuItemPS.dll (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEToolMenuDisable.exe (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\ReminderHelper.exe (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\WCAutoUpdate.exe (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminderro.crx (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome.manifest (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\install.rdf (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\wecarereminder.jar (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo\default_serp.gif (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo\wecare_logo.bmp (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\httpModifyListener.js (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.idl (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.js (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.xpt (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults\preferences\wecarereminder.js (PUP.Optional.WeCare.A) -> No action taken.C:\Windows\Tasks\ArcadeParlor.job (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\ap.config (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\Arcadeparlor.dll (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\broker.exe (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\removal.exe (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\versioncheck.exe (PUP.Optional.ArcadeParlor.A) -> No action taken. (end) Malwarebytes Anti-Malware (PRO) 1.75.0.1300www.malwarebytes.org Database version: v2014.01.17.03 Windows 8 x64 NTFSInternet Explorer 11.0.9600.16476Dennise :: CHERKYSTUDIO [administrator] Protection: Enabled 1/17/2014 1:35:53 PMmbam-log-2014-01-17 (13-35-53).txt Scan type: Quick scanScan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 263063Time elapsed: 4 minute(s), 9 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 26HKCR\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> No action taken.HKCR\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE} (PUP.Optional.WeCare.A) -> No action taken.HKCR\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3} (PUP.Optional.WeCare.A) -> No action taken.HKCR\IEHelperv250.WeCareReminder.1 (PUP.Optional.WeCare.A) -> No action taken.HKCR\IEHelperv250.WeCareReminder (PUP.Optional.WeCare.A) -> No action taken.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> No action taken.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\The Sea App (PUP.Optional.TheSeaApp.A) -> No action taken.HKCR\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3} (PUP.Optional.WeCare.A) -> No action taken.HKCR\CLSID\{6ED0A312-78F5-493C-A90C-5DAF321D0BF8} (PUP.Optional.WeCare.A) -> No action taken.HKCR\TypeLib\{B3201ABA-7CDE-4C8D-A28D-4316427BD6D1} (PUP.Optional.WeCare.A) -> No action taken.HKCR\Interface\{B60591CD-AA25-4261-B05A-77826471C0A3} (PUP.Optional.WeCare.A) -> No action taken.HKCR\CLSID\{B60591CD-AA25-4261-B05A-77826471C0A3} (PUP.Optional.WeCare.A) -> No action taken.HKCR\CLSID\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCR\TypeLib\{1F29738C-11D6-4AE5-A1B1-86D4D5F3A69C} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCR\Interface\{96B4DEA0-F89C-475C-8124-B247260B7CB5} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B74443DB-5A88-4583-860A-F0D06EF399E3} (PUP.Optional.ArcadeParlor.A) -> No action taken.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> No action taken.HKCR\CLSID\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> No action taken.HKCR\TheSeaApp.Plugin (PUP.Optional.TheSeaApp.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> No action taken.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> No action taken. Registry Values Detected: 0(No malicious items detected) Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 9C:\Program Files (x86)\The Sea App (Internet Explorer) (PUP.Optional.TheSeaApp.A) -> No action taken.C:\ProgramData\WeCareReminder (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults\preferences (PUP.Optional.WeCare.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor (PUP.Optional.ArcadeParlor.A) -> No action taken. Files Detected: 35C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\ReminderHelper.exe (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\WCAutoUpdate.exe (PUP.Optional.WeCare.A) -> No action taken.C:\Users\Dennise\Local Settings\Temporary Internet Files\IE\GBWDAD3L\pdf_14315_2210 (1).exe (PUP.Optional.InstallIQ) -> No action taken.C:\Users\Dennise\Local Settings\Temporary Internet Files\IE\NLC8RPI0\getUpdateZip4.1.25[1].zip (PUP.Optional.WeCare.A) -> No action taken.C:\Windows\Installer\64bab98.msi (PUP.Optional.WeCare.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\The Sea App.dll.config (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\Interop.SHDocVw.dll (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\Microsoft.mshtml.dll (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\SpicIEx.dll (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\The Sea App.dll (PUP.Optional.TheSeaApp.A) -> No action taken.C:\Program Files (x86)\The Sea App (Internet Explorer)\Uninstall.exe (PUP.Optional.TheSeaApp.A) -> No action taken.C:\ProgramData\WeCareReminder\MerchantHash.json (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\cleanwateraction.bmp (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEHelperv2.5.0PS.dll (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEMenuItem.dll (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEMenuItemPS.dll (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\IEToolMenuDisable.exe (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminderro.crx (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome.manifest (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\install.rdf (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\wecarereminder.jar (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo\default_serp.gif (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo\wecare_logo.bmp (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\httpModifyListener.js (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.idl (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.js (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.xpt (PUP.Optional.WeCare.A) -> No action taken.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults\preferences\wecarereminder.js (PUP.Optional.WeCare.A) -> No action taken.C:\Windows\Tasks\ArcadeParlor.job (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\ap.config (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\Arcadeparlor.dll (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\broker.exe (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\removal.exe (PUP.Optional.ArcadeParlor.A) -> No action taken.C:\Users\Dennise\AppData\Local\ArcadeParlor\versioncheck.exe (PUP.Optional.ArcadeParlor.A) -> No action taken. (end) Malwarebytes Anti-Malware (PRO) 1.75.0.1300www.malwarebytes.org Database version: v2014.01.17.03 Windows 8 x64 NTFSInternet Explorer 11.0.9600.16476Dennise :: CHERKYSTUDIO [administrator] Protection: Enabled 1/17/2014 1:42:46 PMmbam-log-2014-01-17 (13-42-46).txt Scan type: Full scan (C:\|D:\|)Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUMScan options disabled: P2PObjects scanned: 653474Time elapsed: 1 hour(s), 28 minute(s), 49 second(s) Memory Processes Detected: 0(No malicious items detected) Memory Modules Detected: 0(No malicious items detected) Registry Keys Detected: 26HKCR\CLSID\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\TypeLib\{B12920CF-BE13-4C09-890D-1B6EFFFE2FBE} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\Interface\{F773BB94-6C19-4643-A570-0E429103D1C3} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\IEHelperv250.WeCareReminder.1 (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\IEHelperv250.WeCareReminder (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\The Sea App (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.HKCR\CLSID\{F773BB94-6C19-4643-A570-0E429103D1C3} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\CLSID\{6ED0A312-78F5-493C-A90C-5DAF321D0BF8} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\TypeLib\{B3201ABA-7CDE-4C8D-A28D-4316427BD6D1} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\Interface\{B60591CD-AA25-4261-B05A-77826471C0A3} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\CLSID\{B60591CD-AA25-4261-B05A-77826471C0A3} (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.HKCR\CLSID\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{39AD0726-986D-40F9-972B-E3BFA24B7745} (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.HKCR\TypeLib\{1F29738C-11D6-4AE5-A1B1-86D4D5F3A69C} (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.HKCR\Interface\{96B4DEA0-F89C-475C-8124-B247260B7CB5} (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B74443DB-5A88-4583-860A-F0D06EF399E3} (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.HKCR\CLSID\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.HKCR\TheSeaApp.Plugin (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{C585D593-E7F3-4852-A200-561686EE02E4} (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully. Registry Values Detected: 0(No malicious items detected) Registry Data Items Detected: 0(No malicious items detected) Folders Detected: 9C:\Program Files (x86)\The Sea App (Internet Explorer) (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults\preferences (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\Users\Dennise\AppData\Local\ArcadeParlor (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully. Files Detected: 35C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\ReminderHelper.exe (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\WCAutoUpdate.exe (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\Users\Dennise\AppData\Local\Microsoft\Windows\INetCache\IE\GBWDAD3L\pdf_14315_2210 (1).exe (PUP.Optional.InstallIQ) -> Quarantined and deleted successfully.C:\Users\Dennise\AppData\Local\Microsoft\Windows\INetCache\IE\NLC8RPI0\getUpdateZip4.1.25[1].zip (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\Windows\Installer\64bab98.msi (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\Program Files (x86)\The Sea App (Internet Explorer)\The Sea App.dll.config (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.C:\Program Files (x86)\The Sea App (Internet Explorer)\Interop.SHDocVw.dll (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.C:\Program Files (x86)\The Sea App (Internet Explorer)\Microsoft.mshtml.dll (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.C:\Program Files (x86)\The Sea App (Internet Explorer)\SpicIEx.dll (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.C:\Program Files (x86)\The Sea App (Internet Explorer)\The Sea App.dll (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.C:\Program Files (x86)\The Sea App (Internet Explorer)\Uninstall.exe (PUP.Optional.TheSeaApp.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\MerchantHash.json (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\cleanwateraction.bmp (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\IEHelperv2.5.0PS.dll (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\IEMenuItem.dll (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\IEMenuItemPS.dll (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\IEToolMenuDisable.exe (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminderro.crx (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome.manifest (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\install.rdf (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\wecarereminder.jar (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo\default_serp.gif (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\chrome\logo\wecare_logo.bmp (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\httpModifyListener.js (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.idl (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.js (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\components\WCR_MerchantHash.xpt (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\ProgramData\WeCareReminder\wecarereminder@bryan\defaults\preferences\wecarereminder.js (PUP.Optional.WeCare.A) -> Quarantined and deleted successfully.C:\Windows\Tasks\ArcadeParlor.job (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.C:\Users\Dennise\AppData\Local\ArcadeParlor\ap.config (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.C:\Users\Dennise\AppData\Local\ArcadeParlor\Arcadeparlor.dll (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.C:\Users\Dennise\AppData\Local\ArcadeParlor\broker.exe (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.C:\Users\Dennise\AppData\Local\ArcadeParlor\removal.exe (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully.C:\Users\Dennise\AppData\Local\ArcadeParlor\versioncheck.exe (PUP.Optional.ArcadeParlor.A) -> Quarantined and deleted successfully. (end) Link to post Share on other sites More sharing options...
Maniac Posted January 18, 2014 ID:779622 Share Posted January 18, 2014 Hello BrianC and ! My name is Borislav and I will be glad to help you solve your malware problem. Please note:If you are a paying customer, you have the privilege to contact the help desk at Consumer Support. If you choose this option to get help, please let me know.I recommend you to keep the instructions I will be giving you so that they are available to you at any time. You can save them in a text file or print them.Make sure you read all of the instructions and fixes thoroughly before continuing with them.Follow my instructions strictly and don’t hesitate to stop and ask me if you have any questions.Post your log files, don't attach them. Every log file should be copy/pasted in your next reply.Do not perform any kind of scanning and fixing without my instructions. If you want to proceed on your own, please let me know.Download OTL to your DesktopDouble click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.Please tick the Scan All users. Next, click the Quick Scan button. The scan wont take long.When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time and post them in your topic. Link to post Share on other sites More sharing options...
BrianC Posted January 18, 2014 Author ID:779637 Share Posted January 18, 2014 I'm going to have to break this up into a couple posts, as when I put both files into the post, I get a "post too long" error. OTL logfile created on: 1/18/2014 10:13:02 AM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Dennise\Desktop64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstationInternet Explorer (Version = 9.11.9600.16476)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 7.87 Gb Total Physical Memory | 4.63 Gb Available Physical Memory | 58.87% Memory free10.12 Gb Paging File | 6.64 Gb Available in Paging File | 65.62% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)Drive C: | 922.94 Gb Total Space | 728.75 Gb Free Space | 78.96% Space Free | Partition Type: NTFS Computer Name: CHERKYSTUDIO | User Name: Dennise | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2014/01/18 10:12:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Dennise\Desktop\OTL.exePRC - [2014/01/16 08:17:41 | 000,078,576 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXEPRC - [2014/01/16 08:15:14 | 000,194,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXEPRC - [2013/12/30 17:12:44 | 003,764,024 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exePRC - [2013/12/30 17:12:44 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exePRC - [2013/07/09 20:04:28 | 000,149,488 | ---- | M] (Sun Microsystems, Inc.) -- C:\Users\Dennise\AppData\Local\Apps\2.0\NJBL172M.V52\2E4P0WQ2.W10\amaz..tion_f2fa081ea2183235_0002.0001_cb34a912a946f839\LocalServiceJre\bin\AmazonCloudDriveW.exePRC - [2013/06/21 16:23:23 | 003,108,864 | ---- | M] () -- C:\Users\Dennise\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exePRC - [2013/04/04 13:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exePRC - [2013/04/04 13:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exePRC - [2013/04/04 13:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exePRC - [2012/11/28 08:05:52 | 004,047,208 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell Backup and Recovery\Toaster.exePRC - [2012/11/25 21:19:48 | 000,492,904 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell Backup and Recovery\Components\DBRUpdate\DBRUpd.exePRC - [2012/11/25 21:18:54 | 001,914,728 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell Backup and Recovery\SftService.exePRC - [2012/08/23 11:37:16 | 000,013,672 | ---- | M] (Intuit Inc.) -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exePRC - [2012/08/01 11:03:22 | 000,073,728 | ---- | M] () -- C:\Program Files (x86)\DELL\DELLOSD\DellOSDService.exePRC - [2012/08/01 11:01:02 | 000,270,336 | ---- | M] (DELL INC.) -- C:\Program Files (x86)\DELL\DELLOSD\MediaButtons.exePRC - [2012/07/22 18:37:50 | 000,077,824 | ---- | M] (Atheros) -- C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exePRC - [2012/07/20 02:00:54 | 000,365,376 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exePRC - [2012/07/20 02:00:52 | 000,277,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exePRC - [2012/07/20 02:00:28 | 000,166,720 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exePRC - [2012/07/09 12:47:18 | 000,277,504 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exePRC - [2012/07/09 12:47:14 | 000,007,168 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exePRC - [2012/06/07 20:34:06 | 000,111,120 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exePRC - [2012/06/06 14:31:56 | 003,076,096 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Browny02\Brother\BrStMonW.exePRC - [2012/06/05 14:56:28 | 000,266,240 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Browny02\BrYNSvc.exePRC - [2012/06/04 11:43:32 | 001,057,408 | ---- | M] (SEIKO EPSON CORPORATION) -- C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exePRC - [2012/06/01 19:47:48 | 000,143,888 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exePRC - [2012/03/22 09:47:54 | 000,106,496 | ---- | M] (DELL INC.) -- C:\Program Files (x86)\DELL\DELLOSD\DELLOSD.exePRC - [2010/10/27 19:17:52 | 000,207,424 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exePRC - [2010/08/25 11:27:44 | 000,309,824 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ArcCon.acPRC - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exePRC - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe ========== Modules (No Company Name) ========== MOD - [2014/01/17 18:41:33 | 000,046,080 | ---- | M] () -- C:\Users\Dennise\AppData\Local\Apps\2.0\NJBL172M.V52\2E4P0WQ2.W10\amaz..tion_f2fa081ea2183235_0002.0001_cb34a912a946f839\NativeOperations.dllMOD - [2014/01/16 08:17:33 | 000,359,592 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\c2r32.dllMOD - [2014/01/16 08:17:22 | 000,316,584 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dllMOD - [2014/01/16 08:14:37 | 000,359,592 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\office15\c2r32.dllMOD - [2014/01/16 08:14:37 | 000,316,584 | ---- | M] () -- C:\Program Files\Microsoft Office 15\root\office15\appvisvstream32.dllMOD - [2013/11/29 13:53:31 | 000,541,696 | ---- | M] () -- C:\Users\Dennise\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dllMOD - [2013/11/16 16:12:44 | 019,336,120 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\libcef.dllMOD - [2013/06/21 16:23:23 | 003,108,864 | ---- | M] () -- C:\Users\Dennise\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exeMOD - [2012/10/11 20:56:46 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dllMOD - [2012/10/11 20:56:22 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dllMOD - [2012/06/08 10:34:06 | 000,016,400 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dllMOD - [2012/06/07 20:34:06 | 000,627,216 | ---- | M] () -- C:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dllMOD - [2009/02/27 15:38:20 | 000,139,264 | R--- | M] () -- C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll ========== Services (SafeList) ========== SRV:64bit: - [2013/12/30 17:12:44 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)SRV:64bit: - [2013/11/29 13:19:22 | 001,584,128 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\workfolderssvc.dll -- (workfolderssvc)SRV:64bit: - [2013/11/29 13:19:22 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)SRV:64bit: - [2013/11/29 13:19:21 | 000,533,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppReadiness.dll -- (AppReadiness)SRV:64bit: - [2013/11/27 08:36:30 | 003,395,920 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)SRV:64bit: - [2013/11/07 20:41:17 | 001,302,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AppXDeploymentServer.dll -- (AppXSvc)SRV:64bit: - [2013/10/31 09:08:22 | 001,907,896 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe -- (OfficeSvc)SRV:64bit: - [2013/09/29 21:03:28 | 001,555,456 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)SRV:64bit: - [2013/09/29 21:03:28 | 000,365,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)SRV:64bit: - [2013/09/29 21:03:27 | 000,491,520 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\GeofenceMonitorService.dll -- (lfsvc)SRV:64bit: - [2013/09/29 21:03:27 | 000,261,120 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)SRV:64bit: - [2013/08/22 05:32:01 | 000,346,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\NisSrv.exe -- (WdNisSvc)SRV:64bit: - [2013/08/22 05:32:00 | 000,023,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)SRV:64bit: - [2013/08/22 05:31:56 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)SRV:64bit: - [2013/08/22 04:32:02 | 000,024,576 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wephostsvc.dll -- (WEPHOSTSVC)SRV:64bit: - [2013/08/22 04:31:43 | 000,040,448 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)SRV:64bit: - [2013/08/22 04:22:45 | 000,066,048 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)SRV:64bit: - [2013/08/22 04:21:15 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)SRV:64bit: - [2013/08/22 04:16:57 | 000,118,272 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)SRV:64bit: - [2013/08/22 03:25:28 | 000,164,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)SRV:64bit: - [2013/08/22 03:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)SRV:64bit: - [2013/08/22 03:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)SRV:64bit: - [2013/08/22 03:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)SRV:64bit: - [2013/08/22 03:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)SRV:64bit: - [2013/08/22 03:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)SRV:64bit: - [2013/08/22 03:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)SRV:64bit: - [2013/08/22 03:19:28 | 000,517,120 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicguestinterface)SRV:64bit: - [2013/08/22 03:04:53 | 000,716,288 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)SRV:64bit: - [2013/08/22 03:02:47 | 000,013,312 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\smphost.dll -- (smphost)SRV:64bit: - [2013/08/22 02:59:26 | 000,832,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)SRV:64bit: - [2013/08/22 02:58:42 | 000,280,576 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)SRV:64bit: - [2013/08/22 02:57:25 | 000,130,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\ScDeviceEnum.dll -- (ScDeviceEnum)SRV:64bit: - [2013/08/22 02:54:59 | 000,059,392 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)SRV:64bit: - [2013/08/22 02:50:59 | 000,245,760 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)SRV:64bit: - [2013/08/22 02:50:00 | 000,525,312 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)SRV:64bit: - [2013/08/22 02:45:59 | 000,151,040 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\ncbservice.dll -- (NcbService)SRV:64bit: - [2013/08/22 02:40:49 | 000,248,832 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)SRV:64bit: - [2013/08/22 02:40:14 | 000,398,848 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)SRV:64bit: - [2013/08/22 02:39:33 | 000,198,656 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)SRV:64bit: - [2013/08/22 02:31:03 | 000,201,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)SRV:64bit: - [2013/08/22 02:15:54 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)SRV:64bit: - [2012/06/19 18:10:34 | 000,634,632 | ---- | M] (Intel® Corporation) [Auto | Running] -- c:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel®SRV:64bit: - [2009/11/17 18:14:26 | 000,098,208 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe -- (AERTFilters)SRV - [2013/10/03 23:43:02 | 000,279,000 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)SRV - [2013/09/29 21:03:26 | 000,357,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\GeofenceMonitorService.dll -- (lfsvc)SRV - [2013/08/22 05:31:56 | 002,899,968 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)SRV - [2013/08/21 20:55:35 | 000,018,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)SRV - [2013/08/21 19:53:34 | 000,011,776 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\smphost.dll -- (smphost)SRV - [2013/04/04 13:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)SRV - [2013/04/04 13:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)SRV - [2012/11/25 21:18:54 | 001,914,728 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell Backup and Recovery\SftService.exe -- (SftService)SRV - [2012/08/23 11:37:16 | 000,013,672 | ---- | M] (Intuit Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe -- (IntuitUpdateServiceV4)SRV - [2012/08/01 11:03:22 | 000,073,728 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\DELL\DELLOSD\DellOSDService.exe -- (Dell WMI Service)SRV - [2012/07/31 18:10:26 | 000,207,488 | ---- | M] (Qualcomm Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\AdminService.exe -- (AtherosSvc)SRV - [2012/07/22 18:37:50 | 000,077,824 | ---- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Dell Wireless\Ath_WlanAgent.exe -- (ZAtheros Wlan Agent)SRV - [2012/07/20 02:00:54 | 000,365,376 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS)SRV - [2012/07/20 02:00:52 | 000,277,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS)SRV - [2012/07/20 02:00:28 | 000,166,720 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe -- (jhi_service)SRV - [2012/07/09 12:47:14 | 000,007,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)SRV - [2012/06/05 14:56:28 | 000,266,240 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Running] -- C:\Program Files (x86)\Browny02\BrYNSvc.exe -- (BrYNSvc)SRV - [2010/03/18 11:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)SRV - [2008/11/09 13:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService) ========== Driver Services (SafeList) ========== DRV:64bit: - [2013/12/30 17:13:02 | 000,079,672 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\aswstm.sys -- (aswStm)DRV:64bit: - [2013/12/30 17:12:48 | 000,207,904 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\aswVmm.sys -- (aswVmm)DRV:64bit: - [2013/12/30 17:12:47 | 001,034,464 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)DRV:64bit: - [2013/12/30 17:12:47 | 000,422,216 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)DRV:64bit: - [2013/12/30 17:12:47 | 000,078,648 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)DRV:64bit: - [2013/11/29 13:19:21 | 000,057,176 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stornvme.sys -- (stornvme)DRV:64bit: - [2013/11/29 13:16:55 | 000,136,536 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\wfplwfs.sys -- (WFPLWFS)DRV:64bit: - [2013/11/16 16:12:45 | 000,092,544 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)DRV:64bit: - [2013/11/16 16:12:45 | 000,065,776 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\aswRvrt.sys -- (aswRvrt)DRV:64bit: - [2013/11/10 19:48:41 | 000,039,768 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\intelpep.sys -- (intelpep)DRV:64bit: - [2013/11/09 04:55:11 | 000,325,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBXHCI.SYS -- (USBXHCI)DRV:64bit: - [2013/11/01 04:39:53 | 000,086,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\pdc.sys -- (pdc)DRV:64bit: - [2013/10/30 17:58:59 | 000,372,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\spaceport.sys -- (spaceport)DRV:64bit: - [2013/10/25 18:54:32 | 000,146,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx2.sys -- (SerCx2)DRV:64bit: - [2013/10/03 23:42:44 | 004,185,600 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)DRV:64bit: - [2013/09/29 21:03:25 | 000,467,800 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\USBHUB3.SYS -- (USBHUB3)DRV:64bit: - [2013/09/29 21:03:25 | 000,236,376 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)DRV:64bit: - [2013/09/29 21:03:25 | 000,175,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VerifierExt.sys -- (VerifierExt)DRV:64bit: - [2013/09/29 20:51:06 | 000,027,488 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)DRV:64bit: - [2013/09/29 20:51:01 | 000,037,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)DRV:64bit: - [2013/09/26 02:08:22 | 000,039,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\intelaud.sys -- (intaud_WaveExtensible)DRV:64bit: - [2013/09/26 02:08:22 | 000,027,032 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iwdbus.sys -- (iwdbus)DRV:64bit: - [2013/08/22 06:25:40 | 000,043,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\condrv.sys -- (condrv)DRV:64bit: - [2013/08/22 06:25:40 | 000,030,048 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\WINDOWS\SysNative\drivers\fs_rec.sys -- (Fs_Rec)DRV:64bit: - [2013/08/22 05:50:19 | 000,057,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\dam.sys -- (dam)DRV:64bit: - [2013/08/22 05:49:54 | 000,079,712 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\acpiex.sys -- (acpiex)DRV:64bit: - [2013/08/22 05:49:33 | 000,159,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)DRV:64bit: - [2013/08/22 05:43:49 | 000,063,840 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\mvumis.sys -- (mvumis)DRV:64bit: - [2013/08/22 05:43:48 | 000,146,272 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpioclx.sys -- (GPIOClx0101)DRV:64bit: - [2013/08/22 05:43:48 | 000,041,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\msgpiowin32.sys -- (msgpiowin32)DRV:64bit: - [2013/08/22 05:43:45 | 003,357,024 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)DRV:64bit: - [2013/08/22 05:43:45 | 000,093,536 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)DRV:64bit: - [2013/08/22 05:43:45 | 000,082,784 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sss.sys -- (LSI_SSS)DRV:64bit: - [2013/08/22 05:43:45 | 000,064,352 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)DRV:64bit: - [2013/08/22 05:43:44 | 000,081,760 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas3.sys -- (LSI_SAS3)DRV:64bit: - [2013/08/22 05:43:41 | 000,782,176 | ---- | M] (PMC-Sierra) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\adp80xx.sys -- (ADP80XX)DRV:64bit: - [2013/08/22 05:43:41 | 000,531,296 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)DRV:64bit: - [2013/08/22 05:43:41 | 000,259,424 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)DRV:64bit: - [2013/08/22 05:43:41 | 000,108,896 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\3ware.sys -- (3ware)DRV:64bit: - [2013/08/22 05:43:41 | 000,079,200 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)DRV:64bit: - [2013/08/22 05:43:40 | 000,114,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)DRV:64bit: - [2013/08/22 05:43:40 | 000,082,784 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\EhStorClass.sys -- (EhStorClass)DRV:64bit: - [2013/08/22 05:43:40 | 000,025,952 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)DRV:64bit: - [2013/08/22 05:43:34 | 000,305,504 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\VSTXRAID.SYS -- (VSTXRAID)DRV:64bit: - [2013/08/22 05:43:33 | 000,189,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\UCX01000.SYS -- (UCX01000)DRV:64bit: - [2013/08/22 05:43:33 | 000,074,080 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uaspstor.sys -- (UASPStor)DRV:64bit: - [2013/08/22 05:43:32 | 000,078,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdstor.sys -- (sdstor)DRV:64bit: - [2013/08/22 05:43:32 | 000,031,072 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)DRV:64bit: - [2013/08/22 05:43:31 | 000,107,872 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\storahci.sys -- (storahci)DRV:64bit: - [2013/08/22 05:43:31 | 000,072,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SpbCx.sys -- (SpbCx)DRV:64bit: - [2013/08/22 05:43:31 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SerCx.sys -- (SerCx)DRV:64bit: - [2013/08/22 05:41:08 | 000,054,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wpcfltr.sys -- (wpcfltr)DRV:64bit: - [2013/08/22 05:39:44 | 000,377,696 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\clfs.sys -- (CLFS)DRV:64bit: - [2013/08/22 05:39:15 | 000,924,512 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\refs.sys -- (ReFS)DRV:64bit: - [2013/08/22 05:39:15 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\uefi.sys -- (UEFI)DRV:64bit: - [2013/08/22 05:37:27 | 000,069,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vpci.sys -- (vpci)DRV:64bit: - [2013/08/22 05:36:12 | 000,026,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WpdUpFltr.sys -- (WpdUpFltr)DRV:64bit: - [2013/08/22 05:34:22 | 000,265,056 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdFilter.sys -- (WdFilter)DRV:64bit: - [2013/08/22 05:34:22 | 000,124,256 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdNisDrv.sys -- (WdNisDrv)DRV:64bit: - [2013/08/22 05:31:28 | 000,034,760 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WdBoot.sys -- (WdBoot)DRV:64bit: - [2013/08/22 04:39:54 | 000,076,800 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\ahcache.sys -- (ahcache)DRV:64bit: - [2013/08/22 04:39:31 | 000,050,688 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicDisplay.sys -- (BasicDisplay)DRV:64bit: - [2013/08/22 04:39:28 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\BasicRender.sys -- (BasicRender)DRV:64bit: - [2013/08/22 04:39:20 | 000,022,016 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HyperVideo.sys -- (HyperVideo)DRV:64bit: - [2013/08/22 04:39:06 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mshidumdf.sys -- (mshidumdf)DRV:64bit: - [2013/08/22 04:38:58 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpitime.sys -- (acpitime)DRV:64bit: - [2013/08/22 04:38:48 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\acpipagr.sys -- (acpipagr)DRV:64bit: - [2013/08/22 04:38:39 | 000,036,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthAvrcpTg.sys -- (BthAvrcpTg)DRV:64bit: - [2013/08/22 04:38:26 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\kdnic.sys -- (kdnic)DRV:64bit: - [2013/08/22 04:38:23 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\vmgencounter.sys -- (gencounter)DRV:64bit: - [2013/08/22 04:38:22 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\npsvctrig.sys -- (npsvctrig)DRV:64bit: - [2013/08/22 04:38:16 | 000,030,720 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BthhfHid.sys -- (bthhfhid)DRV:64bit: - [2013/08/22 04:37:49 | 000,013,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hyperkbd.sys -- (hyperkbd)DRV:64bit: - [2013/08/22 04:37:46 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)DRV:64bit: - [2013/08/22 04:37:42 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bthhfenum.sys -- (BthHFEnum)DRV:64bit: - [2013/08/22 04:37:28 | 000,056,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)DRV:64bit: - [2013/08/22 04:37:28 | 000,041,472 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidi2c.sys -- (hidi2c)DRV:64bit: - [2013/08/22 04:37:14 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)DRV:64bit: - [2013/08/22 04:36:43 | 000,087,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\netvsc63.sys -- (netvsc)DRV:64bit: - [2013/08/22 04:36:37 | 000,224,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\BthLEEnum.sys -- (BthLEEnum)DRV:64bit: - [2013/08/22 04:36:25 | 000,016,384 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NdisVirtualBus.sys -- (NdisVirtualBus)DRV:64bit: - [2013/08/22 04:36:17 | 000,124,928 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\NdisImPlatform.sys -- (NdisImPlatform)DRV:64bit: - [2013/08/22 04:36:07 | 000,066,560 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mslldp.sys -- (MsLldp)DRV:64bit: - [2013/08/22 04:35:42 | 000,103,424 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\Ndu.sys -- (Ndu)DRV:64bit: - [2013/08/22 01:46:33 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\fxppm.sys -- (FxPPM)DRV:64bit: - [2013/08/12 16:25:46 | 000,017,624 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bcmfn2.sys -- (bcmfn2)DRV:64bit: - [2013/08/09 17:39:30 | 000,651,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\drivers\iaStorAV.sys -- (iaStorAV)DRV:64bit: - [2013/07/30 11:47:35 | 000,024,568 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_GPIO.sys -- (iaLPSSi_GPIO)DRV:64bit: - [2013/07/25 12:05:39 | 000,099,320 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\iaLPSSi_I2C.sys -- (iaLPSSi_I2C)DRV:64bit: - [2013/06/18 07:45:02 | 003,680,256 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athw8x.sys -- (athr)DRV:64bit: - [2013/06/18 07:44:59 | 000,129,224 | ---- | M] (Qualcomm Atheros Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C63x64.sys -- (L1C)DRV:64bit: - [2013/04/04 13:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)DRV:64bit: - [2012/12/13 14:50:36 | 000,054,784 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbaapl64.sys -- (USBAAPL64)DRV:64bit: - [2012/10/26 23:02:10 | 000,651,832 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStorA.sys -- (iaStorA)DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys -- (GEARAspiWDM)DRV:64bit: - [2012/08/04 23:22:10 | 000,010,752 | ---- | M] (OSR Open Systems Resources, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\DellRbtn.sys -- (DellRbtn)DRV:64bit: - [2012/07/31 19:51:56 | 000,099,328 | ---- | M] (Qualcomm Atheros Communications Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\qca_shb.sys -- (qca_shb)DRV:64bit: - [2012/07/31 19:51:56 | 000,039,704 | ---- | M] (Atheros) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\leath_hid.sys -- (lehidmini)DRV:64bit: - [2012/07/31 19:51:44 | 000,055,448 | ---- | M] (Windows ® Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AthDfu.sys -- (AthDfu)DRV:64bit: - [2012/07/31 17:52:00 | 000,574,616 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)DRV:64bit: - [2012/07/03 07:16:02 | 000,062,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)DRV:64bit: - [2012/06/25 09:24:50 | 000,092,536 | ---- | M] (CyberLink) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\CLVirtualDrive.sys -- (CLVirtualDrive)DRV:64bit: - [2012/06/13 19:23:58 | 000,339,600 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR)DRV:64bit: - [2012/06/07 11:26:42 | 000,033,128 | ---- | M] (Fintek) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\FintekCIR.sys -- (FintekCIR) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.comIE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.comIE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}IE:64bit: - HKLM\..\SearchScopes\{32564CED-2EF8-466A-900C-38D268CF8C4A}: "URL" = http://ws.infospace.com/playsushi_tbar/ws/redir?_iceUrl=true&tool_id=58485&qkw={searchTerms}IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7IE:64bit: - HKLM\..\SearchScopes\{82BB4865-A5EA-4F74-A910-AA236F1609C0}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJSIE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htmIE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRCIE - HKLM\..\SearchScopes\{82BB4865-A5EA-4F74-A910-AA236F1609C0}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MDDCJS IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope = IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = IE - HKU\S-1-5-21-1974472834-319907891-3525852886-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://dell13.msn.comIE - HKU\S-1-5-21-1974472834-319907891-3525852886-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.accuweather.com/en/us/fort-collins-co/80528/weather-forecast/35250_pcIE - HKU\S-1-5-21-1974472834-319907891-3525852886-1001\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}IE - HKU\S-1-5-21-1974472834-319907891-3525852886-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SRIE - HKU\S-1-5-21-1974472834-319907891-3525852886-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0IE - HKU\S-1-5-21-1974472834-319907891-3525852886-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not foundFF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Dennise\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\msktbird@mcafee.com: C:\Program Files\McAfee\MSK [2014/01/17 13:15:08 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dennise\AppData\Roaming\mozilla\Extensions ========== Chrome ========== CHR - default_search_provider: Google (Enabled)CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},CHR - homepage: CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\PepperFlash\pepflashplayer.dllCHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewerCHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\ppGoogleNaClPluginChrome.dllCHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.76\pdf.dllCHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dllCHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dllCHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dllCHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dllCHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dllCHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dllCHR - plugin: QuickTime Plug-in 7.7.3 (Enabled) = C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dllCHR - plugin: NPCIG.dll (Enabled) = C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dllCHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dllCHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dllCHR - plugin: Intelu00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dllCHR - plugin: Intelu00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dllCHR - plugin: Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dllCHR - plugin: Unity Player (Enabled) = C:\Users\Dennise\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dllCHR - plugin: Shockwave for Director (Enabled) = C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dllCHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dllCHR - Extension: Google Docs = C:\Users\Dennise\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\CHR - Extension: Google Drive = C:\Users\Dennise\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\CHR - Extension: YouTube = C:\Users\Dennise\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\CHR - Extension: Google Search = C:\Users\Dennise\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\CHR - Extension: avast! Online Security = C:\Users\Dennise\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\8.0.8_0\CHR - Extension: avast! Online Security = C:\Users\Dennise\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\9.0.2013.75_0\CHR - Extension: Google Wallet = C:\Users\Dennise\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.0_1\CHR - Extension: Gmail = C:\Users\Dennise\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ O1 HOSTS File: ([2013/08/22 06:25:41 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hostsO2:64bit: - BHO: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)O2:64bit: - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)O2:64bit: - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)O2:64bit: - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)O2 - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL (Microsoft Corporation)O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\office15\GROOVEEX.DLL (Microsoft Corporation)O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)O3:64bit: - HKLM\..\Toolbar: (avast! Online Security) - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)O3 - HKLM\..\Toolbar: (avast! Online Security) - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)O4:64bit: - HKLM..\Run: [btTray] C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtTray.exe (Qualcomm Atheros)O4:64bit: - HKLM..\Run: [btvStack] C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\BtvStack.exe (Qualcomm Atheros Commnucations)O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\SysNative\hkcmd.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [igfxTray] C:\WINDOWS\SysNative\igfxtray.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [Persistence] C:\WINDOWS\SysNative\igfxpers.exe (Intel Corporation)O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe (Realtek Semiconductor)O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)O4 - HKLM..\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (ArcSoft Inc.)O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)O4 - HKLM..\Run: [brStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)O4 - HKLM..\Run: [CLMLServer_For_P2G8] C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe (CyberLink)O4 - HKLM..\Run: [CLVirtualDrive] C:\Program Files (x86)\CyberLink\Power2Go8\VirtualDrive.exe (CyberLink Corp.)O4 - HKLM..\Run: [EEventManager] C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)O4 - HKLM..\Run: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIconLaunch.exe (Intel Corporation)O4 - HKLM..\Run: [iMSS] C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe (Intel Corporation)O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)O4 - HKU\S-1-5-21-1974472834-319907891-3525852886-1001..\Run: [Amazon Cloud Player] C:\Users\Dennise\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe ()O4 - HKU\S-1-5-21-1974472834-319907891-3525852886-1001..\Run: [DW7] "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe" File not foundO4 - HKU\S-1-5-21-1974472834-319907891-3525852886-1001..\Run: [Messenger (Yahoo!)] C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)O4 - HKU\S-1-5-21-1974472834-319907891-3525852886-1001..\Run: [skyDrive] C:\Users\Dennise\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)O4 - Startup: C:\Users\Dennise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Amazon Cloud Drive.lnk = C:\Users\Dennise\AppData\Local\Apps\2.0\NJBL172M.V52\2E4P0WQ2.W10\amaz..tion_f2fa081ea2183235_0002.0001_cb34a912a946f839\AmazonCloudDrive.exe (Amazon Digital Services, LLC.)O4 - Startup: C:\Users\Dennise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk = C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights presentO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)O8:64bit: - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)O9:64bit: - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)O9:64bit: - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)O9:64bit: - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)O9:64bit: - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Dell Wireless\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)O9:64bit: - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)O9:64bit: - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)O9 - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\office15\OCHelper.dll (Microsoft Corporation)O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)O1364bit: - gopher Prefix: missingO13 - gopher Prefix: missingO16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} http://qtinstall.apple.com/qtactivex/qtplugin.cab (QuickTime Object)O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 24.56.178.101 24.56.178.102 74.211.89.201O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1F27FA77-39F3-4048-9952-92A2BF9652E9}: DhcpNameServer = 24.56.178.101 24.56.178.102 74.211.89.201O18:64bit: - Protocol\Handler\osf - No CLSID value foundO18:64bit: - Protocol\Handler\wlpg - No CLSID value foundO18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\WINDOWS\SysWow64\userinit.exe (Microsoft Corporation)O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\WINDOWS\SysNative\igfxdev.dll (Intel Corporation)O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.O30 - LSA: Security Packages - (livessp) - File not foundO32 - HKLM CDRom: AutoRun - 1O34 - HKLM BootExecute: (autocheck autochk *)O35:64bit: - HKLM\..comfile [open] -- "%1" %*O35:64bit: - HKLM\..exefile [open] -- "%1" %*O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2014/01/18 10:12:32 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Dennise\Desktop\OTL.exe[2014/01/17 19:30:34 | 001,037,068 | ---- | C] (Thisisu) -- C:\Users\Dennise\Desktop\JRT.exe[2014/01/17 18:40:58 | 000,000,000 | R--D | C] -- C:\Users\Dennise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices[2014/01/17 18:27:10 | 000,000,000 | ---D | C] -- C:\AdwCleaner[2014/01/17 13:15:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\modules[2014/01/17 13:15:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\js[2014/01/17 13:15:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\images[2014/01/17 13:15:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\html[2014/01/17 13:15:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\css[2014/01/17 13:15:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\The Weather Channel[2014/01/17 13:15:08 | 000,000,000 | ---D | C] -- C:\Users\Dennise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ArcadeParlor[2014/01/16 08:23:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java[2014/01/10 10:43:38 | 000,000,000 | ---D | C] -- C:\Users\Dennise\Desktop\4-H Treasurer Book[2014/01/08 07:32:44 | 000,000,000 | ---D | C] -- C:\Users\Dennise\Documents\blocksvszombies_for_1.6.2[2013/12/30 17:12:49 | 000,079,672 | ---- | C] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\aswstm.sys[2013/12/24 16:54:07 | 000,167,936 | ---- | C] (ICSharpCode.net) -- C:\Users\Dennise\Desktop\ICSharpCode.SharpZipLib1.dll[5 C:\Users\Dennise\Documents\*.tmp files -> C:\Users\Dennise\Documents\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2014/01/18 10:12:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Dennise\Desktop\OTL.exe[2014/01/18 09:54:00 | 000,000,926 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job[2014/01/17 19:31:05 | 001,236,282 | ---- | M] () -- C:\Users\Dennise\Desktop\AdwCleaner (1).exe[2014/01/17 19:30:32 | 001,037,068 | ---- | M] (Thisisu) -- C:\Users\Dennise\Desktop\JRT.exe[2014/01/17 18:45:55 | 000,865,408 | ---- | M] () -- C:\WINDOWS\SysNative\PerfStringBackup.INI[2014/01/17 18:45:55 | 000,731,446 | ---- | M] () -- C:\WINDOWS\SysNative\perfh009.dat[2014/01/17 18:45:55 | 000,136,056 | ---- | M] () -- C:\WINDOWS\SysNative\perfc009.dat[2014/01/17 18:42:04 | 000,002,191 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk[2014/01/17 18:41:39 | 000,067,584 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2014/01/17 18:40:53 | 000,003,091 | ---- | M] () -- C:\Users\Dennise\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Amazon Cloud Drive.lnk[2014/01/17 18:40:51 | 000,000,922 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job[2014/01/17 18:39:36 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys[2014/01/17 18:39:35 | 2468,438,015 | -HS- | M] () -- C:\hiberfil.sys[2014/01/17 12:50:01 | 000,000,334 | ---- | M] () -- C:\WINDOWS\BRCALIB.INI[2014/01/16 20:49:36 | 004,169,728 | ---- | M] () -- C:\Users\Dennise\Documents\Hannah Vision Board.pub[2014/01/16 08:23:25 | 000,002,287 | ---- | M] () -- C:\Users\Dennise\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk[2014/01/08 22:04:36 | 002,327,040 | ---- | M] () -- C:\Users\Dennise\Desktop\Hannah 1D pics.pub[2013/12/30 17:13:04 | 000,001,984 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk[2013/12/30 17:13:02 | 000,079,672 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\aswstm.sys[2013/12/30 17:12:48 | 000,207,904 | ---- | M] () -- C:\WINDOWS\SysNative\drivers\aswVmm.sys[2013/12/30 17:12:47 | 001,034,464 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\aswSnx.sys[2013/12/30 17:12:47 | 000,422,216 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\aswSP.sys[2013/12/30 17:12:47 | 000,334,136 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\aswBoot.exe[2013/12/30 17:12:47 | 000,078,648 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\aswMonFlt.sys[2013/12/30 17:12:46 | 000,043,152 | ---- | M] (AVAST Software) -- C:\WINDOWS\avastSS.scr[2013/12/26 13:37:31 | 000,000,157 | ---- | M] () -- C:\WINDOWS\SysWow64\SystemPreferences.xml[2013/12/24 16:54:07 | 000,167,936 | ---- | M] (ICSharpCode.net) -- C:\Users\Dennise\Desktop\ICSharpCode.SharpZipLib1.dll[2013/12/21 16:06:21 | 000,000,174 | ---- | M] () -- C:\Users\Dennise\Desktop\Goodreads Recent Updates.url[5 C:\Users\Dennise\Documents\*.tmp files -> C:\Users\Dennise\Documents\*.tmp -> ] ========== Files Created - No Company Name ========== [2014/01/17 19:31:08 | 001,236,282 | ---- | C] () -- C:\Users\Dennise\Desktop\AdwCleaner (1).exe[2014/01/15 03:22:33 | 000,138,240 | ---- | C] () -- C:\WINDOWS\SysNative\OEMLicense.dll[2014/01/15 03:22:33 | 000,103,936 | ---- | C] () -- C:\WINDOWS\SysWow64\OEMLicense.dll[2014/01/11 15:46:24 | 004,169,728 | ---- | C] () -- C:\Users\Dennise\Documents\Hannah Vision Board.pub[2014/01/08 22:04:35 | 002,327,040 | ---- | C] () -- C:\Users\Dennise\Desktop\Hannah 1D pics.pub[2013/11/29 12:26:18 | 000,000,334 | ---- | C] () -- C:\WINDOWS\BRCALIB.INI[2013/10/03 23:42:46 | 000,343,040 | ---- | C] () -- C:\WINDOWS\SysWow64\igdmd32.dll[2013/10/03 23:42:40 | 000,180,736 | ---- | C] () -- C:\WINDOWS\SysWow64\igdde32.dll[2013/10/03 23:42:38 | 000,142,848 | ---- | C] () -- C:\WINDOWS\SysWow64\igdail32.dll[2013/08/22 08:36:43 | 000,215,943 | ---- | C] () -- C:\WINDOWS\SysWow64\dssec.dat[2013/08/22 08:36:42 | 000,000,741 | ---- | C] () -- C:\WINDOWS\SysWow64\NOISE.DAT[2013/08/22 07:46:23 | 000,067,584 | --S- | C] () -- C:\WINDOWS\bootstat.dat[2013/08/22 00:01:23 | 000,043,131 | ---- | C] () -- C:\WINDOWS\mib.bin[2013/08/21 20:32:36 | 000,046,080 | ---- | C] () -- C:\WINDOWS\SysWow64\BWContextHandler.dll[2013/08/21 16:55:20 | 000,364,544 | ---- | C] () -- C:\WINDOWS\SysWow64\msjetoledb40.dll[2013/08/21 16:52:39 | 000,673,088 | ---- | C] () -- C:\WINDOWS\SysWow64\mlang.dat[2013/03/31 08:13:03 | 000,000,469 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.400.32.bc[2013/03/21 17:57:32 | 000,002,270 | ---- | C] () -- C:\Users\Dennise\.powerupdate.user.properties[2013/02/28 18:00:19 | 000,073,220 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPrinterDB.dat[2013/02/28 18:00:19 | 000,001,140 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_PT.dat[2013/02/28 18:00:19 | 000,001,140 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_BP.dat[2013/02/28 18:00:19 | 000,001,137 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_ES.dat[2013/02/28 18:00:19 | 000,001,130 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_FR.dat[2013/02/28 18:00:19 | 000,001,130 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_CF.dat[2013/02/28 18:00:19 | 000,001,104 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPresetData_EN.dat[2013/02/28 18:00:19 | 000,000,097 | ---- | C] () -- C:\WINDOWS\SysWow64\PICSDK.ini[2013/02/28 18:00:18 | 000,031,053 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern131.dat[2013/02/28 18:00:18 | 000,029,114 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern1.dat[2013/02/28 18:00:18 | 000,027,417 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern121.dat[2013/02/28 18:00:18 | 000,021,021 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern3.dat[2013/02/28 18:00:18 | 000,015,670 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern5.dat[2013/02/28 18:00:18 | 000,013,280 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern2.dat[2013/02/28 18:00:18 | 000,010,673 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern4.dat[2013/02/28 18:00:18 | 000,004,943 | ---- | C] () -- C:\WINDOWS\SysWow64\EPPICPattern6.dat[2013/02/28 17:57:56 | 000,000,061 | ---- | C] () -- C:\WINDOWS\PERFV37_370.ini[2013/02/17 11:56:15 | 000,045,056 | ---- | C] () -- C:\WINDOWS\SysWow64\BRTCPCON.DLL[2013/02/17 11:56:14 | 000,000,114 | ---- | C] () -- C:\WINDOWS\SysWow64\BRLMW03A.INI[2012/12/15 04:31:24 | 000,880,342 | ---- | C] () -- C:\WINDOWS\SysWow64\PerfStringBackup.INI[2012/06/19 17:52:42 | 000,001,536 | ---- | C] () -- C:\WINDOWS\SysWow64\IusEventLog.dll ========== ZeroAccess Check ========== [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64"" = C:\Windows\SysNative\shell32.dll -- [2013/11/29 13:20:18 | 021,196,664 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]"" = %SystemRoot%\system32\shell32.dll -- [2013/11/29 13:20:18 | 018,642,504 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2013/08/22 02:49:49 | 000,921,088 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]"" = %systemroot%\system32\wbem\fastprox.dll -- [2013/08/21 19:45:10 | 000,691,712 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2013/08/22 02:45:17 | 000,483,840 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2014/01/18 09:58:24 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\.minecraft[2013/11/25 08:31:25 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\AVAST Software[2013/02/17 16:38:54 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\canon[2013/03/21 18:01:50 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\CmapTools[2013/10/28 20:50:20 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\Epson[2013/02/17 11:14:46 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\Leadertech[2013/02/17 17:13:50 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\LibreOffice[2013/09/02 13:12:24 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\MakeMusic[2013/09/18 19:56:42 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\Oracle[2013/02/18 15:00:48 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\PCDr[2013/02/24 11:14:28 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\Thunderbird[2013/12/04 11:03:53 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\WebApp[2013/07/05 12:28:21 | 000,000,000 | ---D | M] -- C:\Users\Dennise\AppData\Roaming\XnView ========== Purity Check ========== ========== Alternate Data Streams ========== @Alternate Data Stream - 220 bytes -> C:\Users\Dennise\SkyDrive:ms-properties@Alternate Data Stream - 128 bytes -> C:\ProgramData\Temp:07F6D9E4 < End of report > Link to post Share on other sites More sharing options...
BrianC Posted January 18, 2014 Author ID:779638 Share Posted January 18, 2014 OTL Extras logfile created on: 1/18/2014 10:13:02 AM - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Dennise\Desktop64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstationInternet Explorer (Version = 9.11.9600.16476)Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 7.87 Gb Total Physical Memory | 4.63 Gb Available Physical Memory | 58.87% Memory free10.12 Gb Paging File | 6.64 Gb Available in Paging File | 65.62% Paging File freePaging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)Drive C: | 922.94 Gb Total Space | 728.75 Gb Free Space | 78.96% Space Free | Partition Type: NTFS Computer Name: CHERKYSTUDIO | User Name: Dennise | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit ScansCompany Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].html[@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation).url[@ = InternetShortcut] -- C:\WINDOWS\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- C:\WINDOWS\SysWow64\control.exe (Microsoft Corporation).html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [edit] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [print] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)InternetShortcut [open] -- "C:\WINDOWS\system32\rundll32.exe" "C:\WINDOWS\system32\ieframe.dll",OpenURL %l (Microsoft Corporation)InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)exefile [open] -- "%1" %*helpfile [open] -- Reg Error: Key error.htmlfile [edit] -- Reg Error: Key error.htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [explore] -- Reg Error: Value error.Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]"VistaSp1" = AC 1C AE C5 46 9F CE 01 [binary data]"AntiVirusOverride" = 0"AntiSpywareOverride" = 0"FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]"UpgradeTime" = [binary data] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Upgrade]"UpgradeTime" = Reg Error: Unknown registry data type -- File not found ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]"EnableFirewall" = 1"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1"DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]"EnableFirewall" = 1"DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{12CE017D-DAE5-47E6-8F60-22B28D2A26BB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{2851866A-F47C-4EAE-AFAF-58A58F6D9B90}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | "{32269CC9-F046-4245-A803-2FBC00208DE2}" = rport=10243 | protocol=6 | dir=out | app=system | "{443D4F4B-ED6E-4982-975C-75DC23B20360}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{4F339095-6428-4B6E-8A98-E4FB34BFDEB6}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{54A00B34-B88B-4C6D-B38E-AFFF8E1BD43F}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdateservice.exe | "{5B5E7AEB-A75C-4EFF-B848-70926D713B2A}" = lport=10243 | protocol=6 | dir=in | app=system | "{5DABFBDE-0449-4BDC-94A7-66D842FAF589}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office 15\root\office15\outlook.exe | "{857F3A6E-04F2-4D59-8E8F-78EE47625755}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | "{A9D4DDA4-850B-4953-8DC9-1F226B93E99D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{B3726CB4-7081-49F5-8A96-8A4FAD249473}" = rport=80 | protocol=6 | dir=out | app=c:\program files (x86)\common files\intuit\update service v4\intuitupdater.exe | "{DAEA155A-39E1-4446-9D8C-E47C1581FC9F}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{EF5EA8E0-6520-45CB-8910-E94AD9136405}" = lport=2869 | protocol=6 | dir=in | app=system | "{FFB04E71-4760-4E00-B887-B4860E8FFE9E}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]"{004DADD6-3EDF-4755-82DE-0F0CA3C97809}" = dir=out | name=slots | "{0393FBD2-2154-458C-AA4A-B6D244858A7B}" = dir=out | name=cut the rope | "{061689B2-BE0E-4071-8733-DDBD76CD74D4}" = dir=out | name=the constitution of the united states | "{0811F7CF-624D-4942-969E-FB9ADC7FC286}" = dir=out | name=nasa be a martian | "{092046C2-6AF2-470F-AE33-DD472715A1EB}" = dir=in | name=smartboard calculator | "{0E2E0908-09D5-4D39-8E20-280CEF4AE493}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{0E7ED7F0-FF10-43A5-ADA4-52A25BBF50AB}" = dir=out | name=sonicwall mobile connect | "{0FA29B03-B14B-4CCA-A959-C9F057DE6D92}" = dir=out | name=weird but true by national geographic kids | "{111465AD-9B04-47A8-8674-A654174D6D04}" = dir=out | name=online education | "{11343FE5-365C-4829-955B-C33A52D9361B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{1455BF9C-90EB-4534-AC84-565100060031}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd cinema\powerdvdcinema10.exe | "{164BC25C-A509-428E-ADCE-7A0B18BC026B}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{1CC2EA9D-0C99-4230-8E18-E2DA0CA12596}" = dir=out | name=brainpop featured movie | "{1D2458F4-B43C-4FD3-A4E9-E3A6E85AC6DB}" = dir=out | name=netflix | "{1EC01145-2B4D-497F-9C31-8CD1C97AB857}" = dir=out | name=memorylage | "{21D78947-72FF-4DC9-8D04-AF25580B387B}" = dir=in | name=skype | "{232A9F70-EDC5-4F58-A38B-C1816147BBEB}" = dir=out | name=instant anatomy free | "{23BEC4E9-25B2-484B-A111-1F75B9F7E0FE}" = dir=out | name=physamajig | "{247A3C5F-0B45-47A5-9ED2-53132767FCA4}" = protocol=6 | dir=out | app=system | "{27D38433-0DDE-4C97-B7D9-FA018239CF4D}" = dir=out | name=kno textbooks for dell | "{29342672-3279-49E2-8355-88090663F147}" = dir=out | name=wordrecon | "{293AD697-B66A-4B69-88B2-4365F1FB4E28}" = dir=out | name=cat prep | "{2B52C2A6-6492-455F-B04B-6D0A39567A84}" = dir=out | name=united states geography quiz | "{2C34FF70-29D1-44BA-8CCE-FEF90AAA8052}" = dir=out | name=programming languages tutorials | "{2CEB22E2-BF41-4243-AAA0-CCD8B1D0ECED}" = dir=out | name=planet story | "{2E764F7A-301D-4A88-BE70-678462E39DE2}" = dir=in | name=juniper networks junos pulse | "{2E8FA4DB-6733-40A1-B2D6-4B4BC4660550}" = dir=out | name=dictionary. | "{2EE10273-06D5-4E3E-A694-123BD3F83109}" = dir=out | name=math lab | "{306D3F17-1FCC-4BD2-B8DB-1ECB37EFA5AD}" = dir=out | name=noogra nuts seasons | "{31BC0EC8-954B-4B0A-BA02-D1CA95C8B907}" = dir=out | name=f5 vpn | "{322CF516-20A4-4006-A532-AFE3FF4A8E97}" = dir=out | name=microsoft solitaire collection | "{325007E1-23CE-47EC-944D-16A2827484A8}" = dir=out | name=word twist | "{327FDAB8-E646-4A0B-BA30-6462A85199A0}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{35514EA6-8AF8-4C49-9D7E-CAC554BEE0AE}" = dir=out | name=windows_ie_ac_001 | "{35D855FF-C044-40AC-84D9-8EB9422D895A}" = dir=out | name=windows_ie_ac_001 | "{38EA62F5-52A6-46DA-93FB-9DC3FB18A533}" = dir=out | name=windows_ie_ac_001 | "{3C3D8647-B40A-4D1B-9A98-13C47D740A7D}" = dir=out | name=instruments make music | "{3CF1DEDC-7F08-4B3E-81F8-7B04203E3800}" = dir=out | name=juniper networks junos pulse | "{4252C8F6-94D9-47F2-BCB8-FD3906480F70}" = dir=out | name=check point vpn | "{4282FE99-8560-4BC7-9576-5F3ED84E263F}" = dir=in | name=checkpoint.vpn | "{42C8FE67-D49D-4676-823B-E3BA295C0833}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{44C67A8C-50A3-4D47-B31D-9CCAB14293DD}" = dir=out | name=smart dictionary | "{4A67BABC-03FC-42DE-9C6E-D90B43F3481E}" = dir=out | name=parts of a computer | "{4AAA46EE-D782-482E-BA78-691B2CFFD163}" = dir=out | name=the three stooges | "{4B5A53ED-C0CE-4AF9-863D-116B80FEABD3}" = protocol=6 | dir=in | app=c:\program files\microsoft office 15\root\office15\ucmapi.exe | "{4B986091-BB5A-47C5-925A-99A93652507F}" = dir=out | name=inkarus | "{4BF74BF0-B5B3-46CB-96E1-A14C7054E25C}" = dir=out | name=sock runner | "{4C76188F-3647-4D22-8787-489D298DF90C}" = dir=out | name=what's the word? | "{4E60E1FB-E2C0-48DF-90B3-2A301F5CEF72}" = dir=in | name=dictionary. | "{4FFB19E4-1A7E-4C4B-83CE-EB40A6B1C3D9}" = dir=out | name=plumber3 | "{5211D386-CEB6-465F-9848-1121200A8D4A}" = protocol=6 | dir=in | app=c:\program files (x86)\dell wireless\bluetooth suite\bttray.exe | "{5315E482-66B8-47C4-8F00-D07F2A318BF5}" = protocol=6 | dir=out | app=c:\program files (x86)\dell wireless\bluetooth suite\bttray.exe | "{560448D6-095C-4907-B046-AC7F710701A7}" = dir=in | name=sonicwall.mobileconnect | "{56DBF3D3-3B95-4FB7-8665-CBD00A88F47D}" = dir=out | name=word connection | "{576BAC03-F53E-42D4-81E5-5076E5FFF6CB}" = dir=in | app=c:\program files (x86)\cyberlink\powerdirector10\pdr10.exe | "{5885489E-A02D-4497-87E9-BB292FAA3E38}" = dir=out | name=roman empire free | "{5BB637B7-65B9-4F68-8873-D9F434167EDB}" = dir=out | name=the final frontier | "{5BF5DA9B-D3CD-4165-B397-80D9D54C1232}" = dir=out | name=common core standards | "{5F4632C0-D5B1-40C3-B0D9-E3A759C81B9E}" = dir=out | name=sonicwall.mobileconnect | "{63097401-AE0F-4E36-A0E8-602D129CEE9A}" = dir=out | name=us states (match'em up™ history & geography) | "{641AC683-11AD-4BB9-99A7-FC3CD3135221}" = dir=in | name=jetpack joyride | "{66D11868-46EF-4E35-96C1-2DEB87135B96}" = dir=out | name=icalendar importer | "{6A779EE3-0A22-40CF-9C75-67794DEBC59D}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe | "{6B1C4E54-DA80-4AD1-905F-65EB574128E4}" = dir=out | name=skype | "{6C84EAD9-6F51-43A5-8017-32E4AFEE82FE}" = dir=out | name=gravistation | "{7266818B-B295-4255-93A2-B148BA69718E}" = dir=in | name=check point vpn | "{73D412AA-A8D1-473F-A4E0-288D5AA510C0}" = dir=out | name=windows ted talks | "{75235898-396B-42F6-B81A-170122FA934D}" = protocol=6 | dir=in | app=c:\program files\microsoft office 15\root\office15\lync.exe | "{7529CC10-C353-4BC3-8C34-BC3A7D860328}" = dir=out | name=wordrecon | "{779B148E-4937-4555-B6CD-1564A44E6FAF}" = dir=out | name=howstuffworks | "{78EA68AD-FE4A-4D51-A327-53B5A2738AFC}" = dir=out | name=doodle god free | "{78F1C115-0455-4FD7-895D-812628D1D5BF}" = dir=out | name=famous castles | "{7A915275-0C70-469C-9EAA-B9E26E10BE8E}" = dir=in | name=dell shop | "{7A932D0B-D608-4468-AADF-DE88C15EDD73}" = dir=out | name=mickey mouse cartoons | "{7AE79AB8-7473-47FB-84C0-6AD280A937B3}" = dir=out | name=dell shop | "{7AF63FE5-B37D-4F1E-9CFB-D8EB5288701D}" = dir=in | name=pinball fx2 | "{7B9618FB-9A8B-4C57-9E92-8CB3DEC07D78}" = dir=out | name=invaders from space win8 | "{7C2DE628-077A-4257-BD59-B5C4E532A38C}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | "{7EBB72AE-3DE2-4709-9D90-F16C02DBC096}" = dir=out | name=the complete sherlock holmes - free | "{81B362E0-1DDD-47E1-A2DA-E9015F1E8EA3}" = dir=out | name=science forkids | "{842D04B0-A12C-45E4-810F-D90EEA303CE9}" = dir=out | name=pinball fx2 | "{845FC6E7-72B3-4DE1-986D-4342D5848D1F}" = dir=out | name=math rush decimals | "{84D050C1-9BF3-4C10-A2AF-13D91B62CF53}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | "{85A9CFA0-4CCF-4680-B391-7FC082008850}" = dir=out | name=minute physics mix | "{8C2D8156-A839-4180-8F92-C0A42B54BFB5}" = dir=out | name=famous scientists | "{900FFB69-D5DC-4945-9119-374B6EACB594}" = dir=out | name=learn the world | "{906232B5-E633-4944-A0D0-7C0C7FFFA39D}" = dir=out | name=the declaration of independence | "{90894BEE-DD36-476F-84FE-A6147764301B}" = dir=out | name=turtle graphics | "{9099B4DC-5726-47AB-869B-30E38E7D751A}" = dir=out | name=adera | "{91709EDC-D2CC-4E44-A4A2-DCF7F48B3C51}" = dir=out | name=pew pew | "{928ACED3-8A5D-4765-881A-04AD94C6A606}" = dir=out | name=jetpack joyride | "{92E706C4-80CF-4F3B-9DC2-CDDD8F870384}" = dir=out | name=skymap free | "{931CCF03-924B-47BE-A55E-9E406EEF4F45}" = dir=out | name=bubble blast 2 | "{95456ACA-09CB-4458-9948-670DCC8E2B94}" = dir=out | name=solitaire hd | "{95A64BF0-521C-4999-80BF-C3BFD65B91B1}" = dir=out | name=blocked in | "{97DFF770-384A-4AEF-9C51-727CBB9AE8E2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{9A73ADC7-249A-4A18-B9BC-3BE37776B490}" = dir=out | name=khan academy | "{9C2D3870-9698-4C74-9E38-68A4B3B68A4A}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | "{9D189F62-9C82-4EC3-8721-50B0A998D0AB}" = dir=out | name=cat lab! free | "{9DEEF002-72DA-4B96-95AD-5F9615D59D37}" = dir=out | name=congress watch | "{9E1159FA-31C0-4C19-930B-00ED9711EF5C}" = dir=out | name=tabahani | "{9E4E5103-0897-48E9-935F-F1CCDFD3B6A8}" = dir=out | name=mcafee® central for dell | "{9E5B7837-4806-472B-93A2-269DA495667C}" = protocol=17 | dir=in | app=c:\program files\microsoft office 15\root\office15\ucmapi.exe | "{A07EAF6C-3AF2-48D2-BCDF-26CC9FDB65E2}" = dir=out | name=virtual fireplace | "{A5D7CDD9-092A-4521-9815-00CFCD50D8D3}" = dir=out | name=facebook | "{A6D35F7E-3F94-4A3F-8C10-1C55E7EB1AB4}" = dir=out | name=geogebra | "{ABCD1DBE-8380-4B23-9E75-DA6521A7C8B6}" = dir=in | name=microsoft solitaire collection | "{AC86B43B-40BD-48B9-93CB-E5381CB27B1E}" = dir=out | name=smartboard calculator | "{ADB8E6A7-E95C-4D81-AB1B-FCBB1D5783E7}" = dir=out | name=tom and jerry | "{AF14011F-43FB-4C9D-9C0B-BE4247650EFF}" = dir=out | name=taptitude unlimited | "{AF81D6F2-CD4C-453B-9275-0C618F710A70}" = dir=out | name=watch spider-man | "{B20457A3-7D62-4B83-9043-41741AB5C0F4}" = protocol=17 | dir=in | app=c:\program files\microsoft office 15\root\office15\lync.exe | "{B2E2E25D-BEC4-4A06-BF6E-46AF226D12FE}" = dir=out | name=learning point | "{B5AF88E0-A3A9-4A37-8961-4516A55984E0}" = dir=out | name=windows 8 fireplace | "{B67605C4-7C55-49AC-99C5-4B03B8AB7735}" = dir=out | name=metroradio | "{B6D4AF3D-4EC9-4260-B9B6-05A4BAB7F579}" = dir=out | name=physics for kids | "{B7D8CF6E-FADD-4663-95B2-EEEC9D8B25E5}" = dir=out | name=amazon | "{B84A2653-F0E1-4F37-9AB4-2B0DB1681F79}" = dir=out | name=world flags | "{B84BA5E4-D6B6-4C1D-BA94-929F8CA4630D}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | "{BA0B89B8-C1E0-46EB-B8DE-31C92F26EE14}" = dir=out | name=we the people | "{BC9FFB3F-DA49-4F97-8C01-BE130CB92339}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{BCF26B2E-6514-4E97-B3F6-E02F531BAB5A}" = dir=in | name=f5 vpn | "{BE520B45-EE02-4BFD-9D23-3E606AFE38A1}" = protocol=6 | dir=in | app=c:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe | "{BEBE92F4-8053-45BB-B63B-C20E0F21C004}" = dir=out | name=teach kids music | "{C10886EE-60FB-49CC-93D5-5F2F4DA2194C}" = dir=out | name=the bill of rights | "{C1D293D7-B580-4E13-9C7C-41095D35B0D4}" = dir=in | app=c:\users\dennise\appdata\local\microsoft\skydrive\skydrive.exe | "{C21551F3-D8E1-47D0-857D-7D0AEC79508E}" = dir=out | name=chore_checklist | "{C2AE8ED3-B3F5-4B14-A646-FD2676A65B21}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | "{C3234CAE-C8FB-4F36-9261-FDCB5DFD63F9}" = dir=out | name=word twirl | "{C32981FF-5E9D-4910-93B0-717673B0CACC}" = dir=out | name=logos quiz+ | "{C384B82B-25B8-4FE9-89AC-BCBF7F20CBCE}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | "{C440961D-DEF0-4146-8C43-B10185289F0E}" = dir=out | name=dodo gogo | "{C4CBD18B-19F8-44E9-AF9D-1249DADF0FE1}" = dir=out | name=us presidents (match'em up™ history and geography) | "{C824CB72-2060-4A81-8212-2108DD061616}" = dir=out | name=ebay | "{C87AFB04-1167-42B0-968A-FCCBC91373C9}" = dir=out | name=geometry: circumference & arc length | "{C9F4F470-50FC-426F-BE96-82CBDF0EFF6B}" = dir=out | name=shuriken ninja | "{CABA3ECB-A1F8-4F5B-816E-4972DBC5F596}" = dir=out | name=3d logo quiz | "{CCB1044C-7772-4997-8A36-4944A00A533B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{CDB01DD3-3588-4A14-B891-551078903F5A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{CECA5887-7A28-4627-BFDD-B5F9DC9FFEAC}" = dir=out | name=mars rover: curiosity | "{D127A0F2-6840-4719-8DAA-FD7F947CE0CE}" = dir=in | name=mcafee® central for dell | "{D1AB1A28-0D03-4AE3-8D98-6F054F979C21}" = dir=out | name=free books- 23,469 classics to go. | "{D48AC33E-0C23-49BE-9616-1538748F5282}" = dir=out | name=mortar melon | "{D55CDDEE-0075-440C-9EF2-797B24185818}" = dir=in | name=kno textbooks for dell | "{D6147A76-CF4F-48BE-955F-0FEEB314051D}" = dir=out | name=imath | "{D6980480-941A-4DF6-AB81-3734ECD3D779}" = dir=out | name=junipernetworks.junospulsevpn | "{DB59588E-ED90-4C47-A7B5-7929DD0C0BD2}" = dir=out | name=checkpoint.vpn | "{DC2EAF1B-DBD3-4C10-AD47-8D6A41D741D2}" = dir=out | name=radiant | "{DEB11431-9156-47CB-AC34-FD39263B8C87}" = dir=out | name=7 little words | "{DFAA97FE-7C76-45E0-8E2E-32AA6677D622}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | "{E1AA22C5-2725-4557-8D00-EBBAF325909C}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | "{E26500FD-17B7-4C25-8C16-0C5767C25363}" = dir=out | name=sat - word root test - easy | "{E29EA64E-D663-4E58-9DE1-7BF5DE058F64}" = dir=out | name=audible - audiobooks and more | "{E57FEE14-5760-42BF-B555-E8E121599029}" = dir=in | name=sonicwall mobile connect | "{E59681FB-0917-4EF5-BCF8-B25B8CBC3B33}" = dir=out | name=pocket tanks | "{E5B9BEF3-9CBC-4C27-BCEE-731267A43006}" = dir=out | name=ae solitaire | "{E68B799C-6FAA-4EC9-B13F-3590041ECF77}" = dir=in | name=wordrecon | "{E6FFF32E-DFC0-423D-90A7-DC79B82D0F82}" = dir=out | name=sci-fi classics free | "{E75AF0F3-0077-49DB-8B7E-0A0EA31961ED}" = dir=out | name=scooby-doo | "{E7619657-7C8F-487F-9F14-4256832A1F55}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe | "{E80FC4DD-6789-40FD-AD1C-D4C968022144}" = dir=out | name=wordament | "{E8B50391-71F4-4F72-A6F1-61726A8FDD5F}" = dir=out | name=math rush fractions | "{E9497E50-D028-428E-AB1C-75EEA8D6EBA1}" = dir=out | name=t.i.t.a.n. | "{E98F05F8-3626-47F5-BB8F-807D3CF7A8D8}" = dir=out | name=the holy bible | "{EA75350D-BF8A-47B5-88AC-A0B2DFF0ECB8}" = dir=out | name=untangle me | "{EAC7B5F7-30D9-40C6-AA68-1179CAB5FC64}" = dir=out | name=kindle | "{EBA18120-BDE1-4683-9FC0-2C116AF81F10}" = dir=out | name=pegs 'n holes | "{EBC7C53B-6959-43EB-84AF-85F8916BCBD8}" = dir=out | name=cheatsheet | "{EC799E33-72BA-42D7-9127-DEFE68F9799D}" = dir=in | name=junipernetworks.junospulsevpn | "{ECDB6E7D-7074-4753-8E9D-7581AA72FC29}" = protocol=6 | dir=out | app=c:\program files (x86)\dell wireless\bluetooth suite\win7ui.exe | "{ED3BDA3A-956C-4C71-A751-8D6063255CB3}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{EF097DE7-4BD6-488F-9AA7-466DBBA09D10}" = dir=out | name=matched | "{F5F50210-C85E-41DC-A2CF-AEA9D9CDB597}" = dir=out | name=math | "{F64300AD-D559-4000-BD45-0997BCC8E70A}" = dir=out | name=f5.vpn.client | "{F77E5446-4378-4E99-8B7A-7061AAAEA193}" = dir=in | name=f5.vpn.client | "{F7A43871-9809-4E9C-929B-7226D4014DC7}" = dir=out | name=solvethemath | "{F9B0034F-6A25-4BE0-8E69-1CCF6FAF96F5}" = dir=out | name=kids' orchestra | "{FC17C8CB-793D-426E-B8A6-F7772DA4814B}" = dir=out | name=wordrecon | "{FDC06635-7CCA-408C-8F5F-826D35211624}" = dir=in | name=wordrecon | "TCP Query User{6D5EEC3E-78CE-4F97-844F-331F0906A623}C:\program files (x86)\epson\scanner driver update\pv37_370\e_dupa30.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson\scanner driver update\pv37_370\e_dupa30.exe | "TCP Query User{744B98C7-A5F5-44FE-851F-64AC79FE0DE9}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | "TCP Query User{7B65643D-E8A2-4944-B057-5A80297CC6F4}C:\program files (x86)\sonos\sonos.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sonos\sonos.exe | "TCP Query User{7FA361B0-A96B-40E8-97CC-9FA1FB347EBB}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=6 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | "TCP Query User{8251EDD2-ADBE-46A7-BE24-C2AFE7FDE946}C:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe | "TCP Query User{89CFFE19-0112-4749-9769-FC71EEE9ADC8}C:\program files (x86)\libreoffice 4\program\soffice.bin" = protocol=6 | dir=in | app=c:\program files (x86)\libreoffice 4\program\soffice.bin | "TCP Query User{BCCB562B-E7FF-4E84-84F4-493F809A2887}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | "TCP Query User{CF596913-A1AF-4986-A36A-2720EEE6E562}C:\program files (x86)\dell wireless\bluetooth suite\bttray.exe" = protocol=6 | dir=in | app=c:\program files (x86)\dell wireless\bluetooth suite\bttray.exe | "UDP Query User{0F1223DA-E9E1-4677-AD9E-38FB78570860}C:\program files (x86)\libreoffice 4\program\soffice.bin" = protocol=17 | dir=in | app=c:\program files (x86)\libreoffice 4\program\soffice.bin | "UDP Query User{0F48E492-62A6-4F80-B3F6-1C324660D8C7}C:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dell wireless\bluetooth suite\btvstack.exe | "UDP Query User{5EAAC7A4-5F5F-4A06-AE82-13CCE51925D4}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | "UDP Query User{7A7D5F53-4400-48BF-8114-D577560C7021}C:\program files (x86)\epson software\event manager\eeventmanager.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson software\event manager\eeventmanager.exe | "UDP Query User{81B039E8-F1AD-4347-B57A-D66657DFEC01}C:\program files (x86)\dell wireless\bluetooth suite\bttray.exe" = protocol=17 | dir=in | app=c:\program files (x86)\dell wireless\bluetooth suite\bttray.exe | "UDP Query User{95347C32-16BD-467F-840B-3938827506DA}C:\program files (x86)\epson\scanner driver update\pv37_370\e_dupa30.exe" = protocol=17 | dir=in | app=c:\program files (x86)\epson\scanner driver update\pv37_370\e_dupa30.exe | "UDP Query User{A1429B9B-BA68-45C7-B71B-5B8C3068F45C}C:\program files (x86)\sonos\sonos.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sonos\sonos.exe | "UDP Query User{F22BCB39-F6D3-4867-9855-C3EF930357E4}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219"{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}" = Apple Mobile Device Support"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{90150000-008F-0000-1000-0000000FF1CE}" = Office 15 Click-to-Run Licensing Component"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting"{977D1ABF-4089-4CA7-BA33-CC75808B7ACE}" = Intel® Trusted Connect Service Client"{A84A4FB1-D703-48DB-89E0-68B6499D2801}" = Qualcomm Atheros Bluetooth Suite (64)"{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}" = iTunes"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64"{EF79C448-6946-4D71-8134-03407888C054}" = Shared C Run-time for x64"HomeStudentRetail - en-us" = Microsoft Office Home and Student 2013 - en-us"PC-Doctor for Windows" = My Dell"ProPlusRetail - en-us" = Microsoft Office Professional Plus 2013 - en-us [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0228288D-975E-42F7-9993-E91A82E6BBD9}" = CWA Reminder by We-Care.com v4.1.24.3"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell Backup and Recovery"{123DE6D6-9566-4777-AC81-E6D86FFA95DA}" = HL-4150CDN"{148C8BF9-E1B4-445D-AC67-2CABAE63949A}" = Epson Event Manager"{18272881-CFC0-434D-A975-E5BE44206AA0}" = Windows Live UX Platform Language Pack"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer"{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}" = CyberLink Media Suite 10"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer"{26A24AE4-039D-4CA4-87B4-2F83217040FF}" = Java 7 Update 51"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Dell WLAN and Bluetooth Client Installation"{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}" = CyberLink Power2Go 8"{30F99474-EBE3-4134-A02B-F6CD38CFE243}" = Photo Gallery"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel® Rapid Storage Technology"{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}" = Google Earth Plug-in"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform"{5BABDA39-61CF-41EE-992D-4054B6649A9B}" = Movie Maker"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel® Management Engine Components"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update"{7BBA9BF8-05DF-47D8-8880-82A9B99505B9}" = Sonos Controller"{7CE9654D-78E7-4C95-9F8D-0E8C38D4FB10}" = TurboTax 2012 wcoiper"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{846A2732-D5DB-48BA-AF00-158078C1E034}" = LibreOffice 4.1 Help Pack (English (United States))"{89EC099E-958D-462E-972C-385591946978}" = TurboTax 2012 WinPerFedFormset"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions"{8A7A4673-CB99-40B2-8699-FF46DFD05473}" = Amazon 1Button App"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110"{90150000-008C-0000-0000-0000000FF1CE}" = Office 15 Click-to-Run Extensibility Component"{90150000-008C-0409-0000-0000000FF1CE}" = Office 15 Click-to-Run Localization Component"{936FB937-76FC-4AF3-B0D1-AFAD069195F0}" = Grammarlogues"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{A8B1F076-965D-4663-A9D4-C2FB58A42AE4}" = TurboTax 2012 WinPerTaxSupport"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell Backup and Recovery - Support Software"{AA72FB28-73B4-49E5-B6B4-E78F44BBD0AD}" = Epson Copy Utility 3.5"{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}" = CyberLink PowerDirector 10"{B0F29C6D-C7A9-40AC-9658-921961818E2B}" = DELLOSD"{B4A3C072-87AF-4937-880D-3D7997111C0D}" = Document Capture Pro"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime"{C034A6F9-6569-491B-B3BF-F5D15221A708}" = Windows Live Essentials"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint 2.5"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common"{D888F114-7537-4D48-AF03-5DA9C82D7540}" = Photo Common"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = CyberLink PowerDVD 10"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10"{E83F5F27-43F3-4163-ABE5-F68C989286ED}" = TurboTax 2012 wrapper"{ED6C77F9-4D7E-447C-9EC0-9A212D075535}" = Movie Maker"{F014B696-28C5-4554-802F-A15380418F53}" = TurboTax 2012 WinPerReleaseEngine"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel® Processor Graphics"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver"{F1EE568A-171F-4C06-9BE6-2395BED067A3}" = LibreOffice 4.1.1.2"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel® Control Center"{FB46F473-333E-4A06-A777-31C54188593E}" = ArcSoft MediaImpression 2"{FC6C7107-7D72-41A1-A031-3CE751159BAB}" = Photo Gallery"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE"{FF8455A9-21E8-457D-AC64-510A705D53B3}" = ArcSoft Scan-n-Stitch Deluxe"Adobe Shockwave Player" = Adobe Shockwave Player 12.0"avast" = avast! Free Antivirus"CameraWindowDC" = Canon Utilities CameraWindow DC 8"EPSON Scanner" = EPSON Scan"Finale NotePad 2012" = Finale NotePad 2012"Google Chrome" = Google Chrome"InstallShield_{8F14AA37-5193-4A14-BD5B-BDF9B361AEF7}" = CyberLink Media Suite Essentials"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300"ScannerDriverUpdateEPSON Perfection V370 Photo_is1" = EPSON Perfection V370 Photo Scanner Driver Update version 3.0.2.0"TurboTax 2012" = TurboTax 2012"WinLiveSuite" = Windows Live Essentials"XnView_is1" = XnView 1.99.6"Yahoo! Companion" = Yahoo! Toolbar"Yahoo! Messenger" = Yahoo! Messenger"Yahoo! Software Update" = Yahoo! Software Update ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-1974472834-319907891-3525852886-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"23ab716f18849b6f" = Amazon Cloud Drive"Amazon Amazon Cloud Player" = Amazon Cloud Player"SkyDriveSetup.exe" = Microsoft SkyDrive"UnityWebPlayer" = Unity Web Player ========== Last 20 Event Log Errors ========== [ Application Events ]Error - 1/18/2014 10:54:40 AM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x13a0 Faulting application start time: 0x01cf145d367f9678 Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: 74925779-8050-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 11:09:40 AM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x1934 Faulting application start time: 0x01cf145f4ef15ff6 Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: 8d035d8c-8052-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 11:24:40 AM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x9f8 Faulting application start time: 0x01cf146167634ddd Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: a5841b0b-8054-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 11:39:40 AM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x1fb0 Faulting application start time: 0x01cf14637fd2c796 Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: bde36562-8056-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 11:54:40 AM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x1ccc Faulting application start time: 0x01cf146598482c25 Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: d64082e9-8058-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 11:58:15 AM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x1e28 Faulting application start time: 0x01cf146618e495f8 Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: 56bf2677-8059-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 12:24:40 PM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0xae8 Faulting application start time: 0x01cf1469c9279daf Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: 072acbb0-805d-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 12:39:40 PM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x1a98 Faulting application start time: 0x01cf146be19844ba Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: 1f8e02f8-805f-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 12:49:29 PM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x1a40 Faulting application start time: 0x01cf146d41054228 Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: 7f0e649d-8060-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App Error - 1/18/2014 1:02:34 PM | Computer Name = CherkyStudio | Source = Application Error | ID = 1000Description = Faulting application name: backgroundTaskHost.exe, version: 6.3.9600.16384, time stamp: 0x52157d67 Faulting module name: combase.dll, version: 6.3.9600.16408, time stamp: 0x523d3001 Exception code: 0xc000027b Fault offset: 0x000fa5bd Faulting process id: 0x1d6c Faulting application start time: 0x01cf146f14eb129a Faulting application path: C:\WINDOWS\syswow64\backgroundTaskHost.exe Faulting module path: C:\WINDOWS\SYSTEM32\combase.dllReport Id: 52d86afd-8062-11e3-beb3-a4173184ec28 Faulting package full name: KnoIncorporated.KnoTextbooksforDell_3.2.1.29_x86__f8h8gdj9q0fsyFaulting package-relative application ID: App [ System Events ]Error - 1/12/2014 8:25:10 PM | Computer Name = CherkyStudio | Source = Schannel | ID = 36888Description = A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 40. The Windows SChannel error state is 107. Error - 1/13/2014 1:00:01 PM | Computer Name = CherkyStudio | Source = DCOM | ID = 10016Description = Error - 1/13/2014 4:59:08 PM | Computer Name = CherkyStudio | Source = Schannel | ID = 36887Description = A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40. Error - 1/13/2014 9:22:01 PM | Computer Name = CherkyStudio | Source = Schannel | ID = 36887Description = A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40. Error - 1/13/2014 9:22:01 PM | Computer Name = CherkyStudio | Source = Schannel | ID = 36887Description = A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40. Error - 1/14/2014 12:23:01 AM | Computer Name = CherkyStudio | Source = Schannel | ID = 36887Description = A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40. Error - 1/14/2014 12:57:27 PM | Computer Name = CherkyStudio | Source = DCOM | ID = 10010Description = Error - 1/14/2014 1:00:03 PM | Computer Name = CherkyStudio | Source = DCOM | ID = 10016Description = Error - 1/14/2014 1:03:10 PM | Computer Name = CherkyStudio | Source = Schannel | ID = 36887Description = A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40. Error - 1/14/2014 2:21:37 PM | Computer Name = CherkyStudio | Source = Schannel | ID = 36887Description = A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 40. < End of report > Link to post Share on other sites More sharing options...
Maniac Posted January 25, 2014 ID:782692 Share Posted January 25, 2014 Sorry about this delay! Are you still with me? Link to post Share on other sites More sharing options...
BrianC Posted January 28, 2014 Author ID:783736 Share Posted January 28, 2014 Well, so what has happened is that on Sunday, the hard drive electronics on this computer died. I now have a new hard drive and a fresh install of Windows that doesn't have this malware. So, I guess this case is closed. It appears to be a hardware failure of the drive, so I'm guessing unrelated to this infection. Link to post Share on other sites More sharing options...
Maniac Posted January 31, 2014 ID:784832 Share Posted January 31, 2014 That's right. Thanks for your explanation! Some malware preventions: users.telenet.be/bluepatchy/miekiemoes/prevention.html Safe surfing! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 6, 2014 Root Admin ID:787352 Share Posted February 6, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts