Girlfriends computer is acting really dumb. won't allow any access to internet

PennsylvaniaMercury · February 8, 2014

as soon as you try to open chrome or IE it freezes solid and you have to hold power button and force restart it's a compaq laptop.

i got great help here before with my system which is still running awesome. i can still run scans and programs by transferring via network. so that won't be an issue.

Thanks.

PennsylvaniaMercury · February 9, 2014

bump.

PennsylvaniaMercury · February 9, 2014

oops DDS.txt

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 11.0.9600.16428

Run by becca at 10:20:17 on 2014-02-09

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.1900.921 [GMT -5:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

C:\Program Files (x86)\PasswordBox\pbbtnService.exe

C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Program Files (x86)\Sendori\sndappv2.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Sendori\SendoriSvc.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\wbem\unsecapp.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

C:\Windows\system32\taskhost.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\hkcmd.exe

C:\Windows\System32\igfxpers.exe

C:\Windows\system32\taskeng.exe

C:\Windows\SysWOW64\rundll32.exe

C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe

C:\Program Files (x86)\Sendori\SendoriTray.exe

c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\Internet Explorer\IELowutil.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uURLSearchHooks: IMVU Inc C Toolbar: {f2e99efd-72dc-4c5d-9f7c-219133ff8e40} -

mURLSearchHooks: IMVU Inc C Toolbar: {f2e99efd-72dc-4c5d-9f7c-219133ff8e40} -

BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

BHO: PasswordBox Helper: {5DB69B97-934B-451D-94DB-32EF802A01CD} - C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll

BHO: {6C8DB2EC-499B-4897-A784-0E3186C97E9D} - <orphaned>

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: IMVU Inc C Toolbar: {f2e99efd-72dc-4c5d-9f7c-219133ff8e40} -

TB: IMVU Inc C Toolbar: {f2e99efd-72dc-4c5d-9f7c-219133ff8e40} -

uRun: [backgroundContainer] "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\becca\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun

mRun: [iAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

mRun: [HPOSD] C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

mRun: [vProt] "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"

mRun: [sendori Tray] "C:\Program Files (x86)\Sendori\SendoriTray.exe"

dRunOnce: [spUninstallDeleteDir] rmdir /s /q "\SearchProtect"

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204

LSP: C:\Windows\System32\Sendori.dll

TCP: NameServer = 192.168.2.1

TCP: Interfaces\{75542D14-EF18-45D4-AD48-FC007129898B} : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{993FDB8F-6706-4B4A-B196-93B33A59235C} : DHCPNameServer = 192.168.2.1

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\17.1.0\ViProtocol.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: {6C8DB2EC-499B-4897-A784-0E3186C97E9D} - <orphaned>

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s

x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe

x64-Run: [igfxTray] C:\Windows\System32\igfxtray.exe

x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe

x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe

x64-Run: [setDefault] C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe

x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: igfxcui - igfxdev.dll

x64-SSODL: WebCheck - <orphaned>

.

============= SERVICES / DRIVERS ===============

.

R1 avgtp;avgtp;C:\Windows\System32\drivers\avgtpx64.sys [2013-10-10 45856]

R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2012-3-15 98208]

R2 Application Sendori;Application Sendori;C:\Program Files (x86)\Sendori\SendoriSvc.exe [2013-10-7 120096]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2013-4-22 822504]

R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2012-9-27 86528]

R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]

R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2012-8-10 197536]

R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-3-5 35200]

R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-3-15 13336]

R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-3-15 1817088]

R2 PasswordBox;PasswordBox;C:\Program Files (x86)\PasswordBox\pbbtnService.exe [2013-9-24 67584]

R2 RoxioNow Service;RoxioNow Service;C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe [2010-11-26 399344]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-6-26 523944]

R2 sndappv2;sndappv2;C:\Program Files (x86)\Sendori\sndappv2.exe [2013-10-7 3623200]

R2 UNS;Intel® Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2012-3-15 2656280]

R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2010-7-28 31088]

R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2012-3-15 335464]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-3-15 436840]

R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\Windows\System32\drivers\rtl8192ce.sys [2012-3-15 878184]

R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2013-6-26 767144]

R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2013-6-26 273576]

R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2013-6-26 28840]

R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2013-6-26 23208]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-6-26 207528]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2012-7-8 104912]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2012-7-8 123856]

S2 Service Sendori;Service Sendori;C:\Program Files (x86)\Sendori\Sendori.Service.exe [2013-10-7 22304]

S3 Desura Install Service;Desura Install Service;C:\Program Files (x86)\Common Files\Desura\desura_service.exe [2014-1-26 131912]

S3 GamesAppIntegrationService;GamesAppIntegrationService;C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [2013-8-27 240736]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2013-12-13 111616]

S3 SaiH0464;SaiH0464;C:\Windows\System32\drivers\SaiH0464.sys [2008-3-31 178432]

S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]

S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]

S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2010-11-20 59392]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2010-11-20 31232]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-7-29 1255736]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== Created Last 30 ================

.

2014-02-08 05:10:36 -------- d-----w- C:\Program Files (x86)\Games

2014-02-07 19:29:28 -------- d-----w- C:\Windows\ND 28 Ghost of Thornton Hall

2014-02-07 19:29:28 -------- d-----w- C:\Program Files (x86)\ND 28 Ghost of Thornton Hall

2014-02-07 14:38:56 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2387D691-B285-402A-A01C-614138DC1BF2}\offreg.dll

2014-02-07 14:21:28 10315576 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{2387D691-B285-402A-A01C-614138DC1BF2}\mpengine.dll

2014-01-26 15:32:42 -------- d-----w- C:\Program Files (x86)\Common Files\Desura

2014-01-26 15:31:58 -------- d-----w- C:\ProgramData\Desura

2014-01-26 15:31:31 -------- d-----w- C:\Program Files (x86)\Desura

2014-01-24 21:56:14 -------- d-----w- C:\Program Files\Microsoft Mouse and Keyboard Center

2014-01-22 04:42:17 -------- d-----w- C:\Users\becca\AppData\Local\Diagnostics

2014-01-15 04:07:39 99840 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

2014-01-15 04:07:39 7808 ----a-w- C:\Windows\System32\drivers\usbd.sys

2014-01-15 04:07:39 53248 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2014-01-15 04:07:39 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2014-01-15 04:07:39 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys

2014-01-15 04:07:39 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2014-01-15 04:07:39 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2014-01-15 04:07:38 376768 ----a-w- C:\Windows\System32\drivers\netio.sys

2014-01-15 04:07:38 3156480 ----a-w- C:\Windows\System32\win32k.sys

2014-01-12 23:36:16 -------- d-----w- C:\Users\becca\AppData\Local\Nancy Drew

2014-01-12 23:31:49 -------- d-----w- C:\Program Files (x86)\Nancy Drew

2014-01-12 23:31:49 -------- d-----w- C:\Program Files (x86)\Common Files\Nancy Drew Prerequisites

.

==================== Find3M ====================

.

2013-12-18 11:13:56 270496 ------w- C:\Windows\System32\MpSigStub.exe

2013-11-26 10:19:07 2724864 ----a-w- C:\Windows\System32\mshtml.tlb

2013-11-26 10:18:23 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll

2013-11-26 09:48:07 66048 ----a-w- C:\Windows\System32\iesetup.dll

2013-11-26 09:46:25 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll

2013-11-26 09:23:02 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-11-26 09:18:39 139264 ----a-w- C:\Windows\System32\ieUnatt.exe

2013-11-26 09:18:09 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe

2013-11-26 09:16:57 708608 ----a-w- C:\Windows\System32\jscript9diag.dll

2013-11-26 08:35:02 5769216 ----a-w- C:\Windows\System32\jscript9.dll

2013-11-26 08:28:16 553472 ----a-w- C:\Windows\SysWow64\jscript9diag.dll

2013-11-26 08:16:12 4243968 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-11-26 08:02:16 1995264 ----a-w- C:\Windows\System32\inetcpl.cpl

2013-11-26 07:32:06 1928192 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2013-11-26 07:07:57 2334208 ----a-w- C:\Windows\System32\wininet.dll

2013-11-26 06:33:33 1820160 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-11-23 18:26:20 417792 ----a-w- C:\Windows\SysWow64\WMPhoto.dll

2013-11-23 17:47:34 465920 ----a-w- C:\Windows\System32\WMPhoto.dll

2013-11-12 02:23:09 2048 ----a-w- C:\Windows\System32\tzres.dll

2013-11-12 02:07:29 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

.

============= FINISH: 10:20:57.80 ===============

Attach.txt

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 7/8/2013 3:56:14 AM

System Uptime: 2/7/2014 2:44:43 PM (44 hours ago)

.

Motherboard: Hewlett-Packard | | 3672

Processor: Intel® Celeron® CPU B800 @ 1.50GHz | CPU1 | 1500/1333mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 279 GiB total, 210.767 GiB free.

D: is FIXED (NTFS) - 14 GiB total, 1.608 GiB free.

E: is FIXED (FAT32) - 4 GiB total, 2.882 GiB free.

F: is CDROM ()

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP111: 2/8/2014 12:01:14 AM - Scheduled Checkpoint

.

==== Installed Programs ======================

.

Adobe Flash Player 10 ActiveX

Adobe Reader X MUI

Adobe Shockwave Player 12.0

Agatha Christie - Peril at End House

AVG SafeGuard toolbar

Bejeweled 3

Blackhawk Striker 2

Blasterball 3

Blio

Bounce Symphony

Cake Mania

Chronicles of Albian

Chuzzle Deluxe

Cisco EAP-FAST Module

Cisco LEAP Module

Cisco PEAP Module

Compaq Setup Manager

Cradle of Rome 2

CyberLink YouCam

D3DX10

Desura

Desura: One 4 Nine

ESET Online Scanner v3

ESU for Microsoft Windows 7 SP1

Evernote v. 4.2.3

Farm Frenzy

FATE

Google Chrome

Google Update Helper

Governor of Poker 2 Premium Edition

HP Auto

HP Client Services

HP Customer Experience Enhancements

HP Documentation

HP Games

HP Launch Box

HP MovieStore

HP On Screen Display

HP Power Manager

HP Quick Launch

HP Setup

HP Software Framework

HP Support Assistant

IMVU Avatar Chat Software

Intel® Control Center

Intel® Management Engine Components

Intel® Processor Graphics

Intel® Rapid Storage Technology

Jewel Quest: The Sleepless Star - Collector's Edition

Junk Mail filter update

Mah Jong Medley

Malwarebytes Anti-Malware version 1.75.0.1300

Mesh Runtime

Microsoft .NET Framework 1.1

Microsoft .NET Framework 4.5

Microsoft Application Error Reporting

Microsoft Mouse and Keyboard Center

Microsoft Office 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Starter 2010 - English

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft WSE 3.0 Runtime

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Mystery of Mortlake Mansion

Namco All-Stars: PAC-MAN

Nancy Drew The Silent Spy 1.00

Nancy Drew: The Captive Curse

ND 28 Ghost of Thornton Hall

Origin

Penguins!

Plants vs. Zombies - Game of the Year

PlayReady PC Runtime x86

Poker Superstars III

Polar Bowler

Polar Golfer

RAR Opener version 1.0

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

Realtek PCIE Card Reader

REALTEK Wireless LAN Driver

Recovery Manager

RoxioNow Player

Security Update for Microsoft .NET Framework 4.5 (KB2737083)

Security Update for Microsoft .NET Framework 4.5 (KB2742613)

Security Update for Microsoft .NET Framework 4.5 (KB2789648)

Security Update for Microsoft .NET Framework 4.5 (KB2804582)

Security Update for Microsoft .NET Framework 4.5 (KB2833957)

Security Update for Microsoft .NET Framework 4.5 (KB2840642v2)

Security Update for Microsoft .NET Framework 4.5 (KB2861208)

Sendori

Slingo Supreme

Strongvault Online Backup

swMSM

Synaptics TouchPad Driver

The Sims™ 3

The Sims™ 3 Generations

The Sims™ 3 Supernatural

The White Wolf of Icicle Creek

Update for Microsoft .NET Framework 4.5 (KB2750147)

Update for Microsoft .NET Framework 4.5 (KB2805221)

Update for Microsoft .NET Framework 4.5 (KB2805226)

Update Installer for WildTangent Games App

Vacation Quest - The Hawaiian Islands

Virtual Villagers 5 - New Believers

WildTangent Games App for HP

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR 5.01 (32-bit)

Zuma Deluxe

.

==== Event Viewer Messages From Past Week ========

.

2/9/2014 10:19:47 AM, Error: Service Control Manager [7031] - The Service Sendori service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.

2/8/2014 5:29:38 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the Netman service.

2/7/2014 9:44:17 PM, Error: volsnap [14] - The shadow copies of volume C: were aborted because of an IO failure on volume C:.

2/7/2014 2:46:36 PM, Error: Service Control Manager [7022] - The Service Sendori service hung on starting.

2/7/2014 2:44:59 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\Rtlihvs.dll Error Code: 126

2/7/2014 2:42:34 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service sndappv2 with arguments "-Service" in order to run the server: {B1A429DB-FB06-4645-B7C0-0CC405EAD3CD}

2/7/2014 2:28:54 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.

2/7/2014 2:28:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}

2/7/2014 2:28:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

2/7/2014 2:28:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}

2/7/2014 2:28:53 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}

2/7/2014 2:28:52 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

2/7/2014 2:28:44 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}

2/7/2014 2:28:35 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC discache NetBIOS NetBT nsiproxy Psched rdbss spldr tdx vwififlt Wanarpv6 WfpLwf ws2ifsl

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.

2/7/2014 2:28:27 PM, Error: Service Control Manager [7001] - The Client Virtualization Handler service depends on the Application Virtualization Client service which failed to start because of the following error: The dependency service or group failed to start.

2/5/2014 5:57:33 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.

2/5/2014 5:57:20 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.

2/5/2014 5:57:16 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\system32\Rtlihvs.dll Error Code: 21

2/5/2014 5:57:05 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr Wanarpv6

2/4/2014 7:19:35 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wscsvc service.

2/4/2014 7:19:35 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.

2/4/2014 12:26:58 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the WinDefend service.

2/2/2014 2:04:10 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MMCSS service.

.

==== End Of File ===========================

AdvancedSetup · February 10, 2014

Hello and :welcome:

Please read the following information below and post back the requested logs when ready.

General P2P/Piracy Warning:

If you're using
Peer 2 Peer
software such as
uTorrent, BitTorrent
or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have
illegal/cracked software, cracks, keygens etc
. on the system, please remove or uninstall them now and read the policy on
Piracy
.

Before we proceed further, please read all of the following instructions carefully.
If there is anything that you do not understand kindly ask before proceeding.
If needed please print out these instructions.

Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
If the log is too large then you can use attachments by clicking on the More Reply Options button.
Please enable your system to show hidden files: How to see hidden files in Windows
Make sure you're subscribed to this topic:
- Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly
[*]Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive [*]Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you. [*]The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone. [*]Perform everything in the correct order. Sometimes one step requires the previous one. [*]If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue. [*]You can check here if you're not sure if your computer is 32-bit or 64-bit [*]Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners. [*]When we are done, I'll give you instructions on how to cleanup all the tools and logs [*]Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. [*]Your topic will be closed if you haven't replied within 3 days [*](If I have not responded within 24 hours, please send me a Private Message as a reminder)

STEP 0
RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes
so that your normal security software can then run and clean your computer of infections.
When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies
that stop us from using certain tools. When finished it will display a log file that shows the processes that were
terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot
your computer as any malware processes that are configured to start automatically will just be started again.
Instead, after running RKill you should immediately scan your computer using the requested scans I've included.

Please download Rkill by Grinler from one of the links below and save it to your desktop.

Link 1

Link 2

On Windows XP double-click on the Rkill desktop icon to run the tool.
On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
Do not reboot the computer, you will need to run the application again.

STEP 01
Backup the Registry:
Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Please download ERUNT from one of the following links: Link1 | Link2 | Link3
ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
Double click on erunt-setup.exe to Install ERUNT by following the prompts.
NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
Choose a location for the backup.
- Note: the default location is C:\Windows\ERDNT which is acceptable.
[*]Make sure that at least the first two check boxes are selected. [*]Click on OK [*]Then click on YES to create the folder. [*]Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

STEP 02
Please download RogueKiller and save it to your desktop.

You can check here if you're not sure if your computer is 32-bit or 64-bit

RogueKiller 32-bit | RogueKiller 64-bit
Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes Close the program > Don't Fix anything!
Don't run any other options, they're not all bad!!
Post back the report which should be located on your desktop.

PennsylvaniaMercury · February 10, 2014

RogueKiller V8.8.6 _x64_ [Feb 7 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : becca [Admin rights]

Mode : Scan -- Date : 02/10/2014 11:39:12

| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤

[sUSP PATH][DLL] rundll32.exe -- C:\Users\becca\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll [7] -> rundll32.exe KILLED [TermProc]

¤¤¤ Registry Entries : 8 ¤¤¤

[RUN][sUSP PATH] HKCU\[...]\Run : BackgroundContainer ("C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\becca\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun [7][7][x]) -> FOUND

[RUN][sUSP PATH] HKUS\S-1-5-21-1157660980-3504564827-1891706756-1000\[...]\Run : BackgroundContainer ("C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\becca\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun [7][7][x]) -> FOUND

[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 1 ¤¤¤

[V2][sUSP PATH] BackgroundContainer Startup Task : "C:\Windows\SysWOW64\Rundll32.exe" - "C:\Users\becca\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun [7][7][x] -> FOUND

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) TOSHIBA MK3276GSX +++++

--- User ---

[MBR] 9f025efaddf22eddaf6e5f3c2e1c0403

[bSP] ce126a6b1cce517aad9d50e229359747 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 286178 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 586502144 | Size: 14803 Mo

3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 616818688 | Size: 4063 Mo

User = LL1 ... OK!

User = LL2 ... OK!

Finished : << RKreport[0]_S_02102014_113912.txt >>

thank you. now when i boot the laptop though i get a ton of error boxes related to erunt. ?

AdvancedSetup · February 10, 2014

In your startup group on your menu there is an entry for ERUNT you need to either delete it or you can right click and choose Properties, Advanced, and select "Run as administrator"

It's getting an error because it's not loading with admin rights and was one of the steps I indicated to not allow it to do but now that it has you can fix either way.

Please go ahead and run through the following steps and post back the logs when ready.

STEP 03
Please download Malwarebytes Anti-Rootkit from here

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

STEP 04
Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next reply message
When completed make sure to re-enable your antivirus

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

STEP 06

Please go here to run the online antivirus scannner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
[*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

STEP 07
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

Double-click to run it. When the tool opens click Yes to disclaimer.
Press the Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

PennsylvaniaMercury · February 10, 2014

mbar.txt

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

www.malwarebytes.org

Database version: v2014.02.10.06

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

becca :: BECCA-HP [administrator]

2/10/2014 4:17:00 PM

mbar-log-2014-02-10 (16-17-00).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 236311

Time elapsed: 19 minute(s), 43 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

System Log

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED, Q:\ DRIVE_FIXED

CPU speed: 1.496000 GHz

Memory total: 1992146944, free: 1216274432

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED, Q:\ DRIVE_FIXED

CPU speed: 1.496000 GHz

Memory total: 1992146944, free: 1229660160

Downloaded database version: v2014.02.10.06

Downloaded database version: v2013.12.18.01

=======================================

Initializing...

------------ Kernel report ------------

02/10/2014 16:16:53

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_GenuineIntel.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\drivers\compbatt.sys

\SystemRoot\system32\drivers\BATTC.SYS

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\DRIVERS\iaStor.sys

\SystemRoot\system32\drivers\atapi.sys

\SystemRoot\system32\drivers\ataport.SYS

\SystemRoot\system32\drivers\msahci.sys

\SystemRoot\system32\drivers\PCIIDEX.SYS

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\drivers\disk.sys

\SystemRoot\system32\drivers\CLASSPNP.SYS

\SystemRoot\system32\DRIVERS\dtsoftbus01.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\??\C:\Windows\system32\drivers\avgtpx64.sys

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\drivers\ws2ifsl.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\vwififlt.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\termdd.sys

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\SystemRoot\system32\drivers\mssmbios.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\drivers\blbdrive.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\DRIVERS\igdkmd64.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\DRIVERS\HECIx64.sys

\SystemRoot\system32\drivers\usbehci.sys

\SystemRoot\system32\drivers\USBPORT.SYS

\SystemRoot\system32\drivers\HDAudBus.sys

\SystemRoot\system32\DRIVERS\Rt64win7.sys

\SystemRoot\system32\DRIVERS\rtl8192Ce.sys

\SystemRoot\System32\Drivers\fastfat.SYS

\SystemRoot\system32\DRIVERS\vwifibus.sys

\SystemRoot\system32\DRIVERS\RtsPStor.sys

\SystemRoot\system32\DRIVERS\i8042prt.sys

\SystemRoot\system32\drivers\kbdclass.sys

\SystemRoot\system32\DRIVERS\SynTP.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\drivers\CmBatt.sys

\SystemRoot\system32\drivers\wmiacpi.sys

\SystemRoot\system32\DRIVERS\intelppm.sys

\SystemRoot\system32\drivers\CompositeBus.sys

\SystemRoot\system32\DRIVERS\clwvd.sys

\SystemRoot\system32\DRIVERS\ks.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\drivers\swenum.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_iaStor.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\System32\Drivers\usbvideo.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\system32\drivers\luafv.sys

\SystemRoot\system32\DRIVERS\Sftvollh.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\nwifi.sys

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\system32\DRIVERS\Sftfslh.sys

\SystemRoot\system32\DRIVERS\Sftplaylh.sys

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\system32\DRIVERS\Sftredirlh.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\system32\DRIVERS\cdfs.sys

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

\Windows\System32\autochk.exe

\Windows\System32\user32.dll

\Windows\System32\Wldap32.dll

\Windows\System32\ws2_32.dll

\Windows\System32\gdi32.dll

\Windows\System32\setupapi.dll

\Windows\System32\msctf.dll

\Windows\System32\shell32.dll

\Windows\System32\comdlg32.dll

\Windows\System32\kernel32.dll

\Windows\System32\shlwapi.dll

\Windows\System32\wininet.dll

\Windows\System32\advapi32.dll

\Windows\System32\imagehlp.dll

\Windows\System32\ole32.dll

\Windows\System32\msvcrt.dll

\Windows\System32\imm32.dll

\Windows\System32\urlmon.dll

\Windows\System32\lpk.dll

\Windows\System32\nsi.dll

\Windows\System32\psapi.dll

\Windows\System32\normaliz.dll

\Windows\System32\oleaut32.dll

\Windows\System32\difxapi.dll

\Windows\System32\rpcrt4.dll

\Windows\System32\sechost.dll

\Windows\System32\clbcatq.dll

\Windows\System32\iertutil.dll

\Windows\System32\usp10.dll

\Windows\System32\KernelBase.dll

\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll

\Windows\System32\devobj.dll

\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll

\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll

\Windows\System32\crypt32.dll

\Windows\System32\cfgmgr32.dll

\Windows\System32\comctl32.dll

\Windows\System32\wintrust.dll

\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll

\Windows\System32\msasn1.dll

\Windows\SysWOW64\normaliz.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa8003fd3060

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\Ide\IAAStorageDevice-1\

Lower Device Object: 0xfffffa8003e8e050

Lower Device Driver Name: \Driver\iaStor\

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa8003fd3060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa8003fd3b90, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa8003fd3060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa8003e8e050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: E9B0A126

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 407552

Partition file system is NTFS

Partition is bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 409600 Numsec = 586092544

Partition 2 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 586502144 Numsec = 30316544

Partition 3 type is Other (0xc)

Partition is NOT ACTIVE.

Partition starts at LBA: 616818688 Numsec = 8321712

Disk Size: 320072933376 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-625122448-625142448)...

Done!

Scan finished

=======================================

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...

Removal finished

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.1 (02.04.2014:1)

OS: Windows 7 Home Premium x64

Ran by becca on Mon 02/10/2014 at 16:39:57.85

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{f2e99efd-72dc-4c5d-9f7c-219133ff8e40}

Suspicious HKCU\..\Run entries found. Trojan:JS/Medfos.B?

Value Name Type Value Data

========================================================================================

BackgroundContainer REG_SZ "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\becca\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\scripthelper.exe

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\viprotocol.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\conduit

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduit

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\conduitsearchscopes

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\pricegong

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\smartbar

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\toolbar

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\conduit

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\searchprotect

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\protocols\handler\viprotocol

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\s

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\strongvaultapp_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\strongvaultapp_rasmancs

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\Toolbar.CT3318151

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{62C401AA-E0AC-462F-A322-17BE10188466}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6C8DB2EC-499B-4897-A784-0E3186C97E9D}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f2e99efd-72dc-4c5d-9f7c-219133ff8e40}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{f2e99efd-72dc-4c5d-9f7c-219133ff8e40}

~~~ Files

Successfully deleted: [File] "C:\end"

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\conduit"

Successfully deleted: [Folder] "C:\Users\becca\appdata\local\conduit"

Successfully deleted: [Folder] "C:\Users\becca\appdata\local\cre"

Successfully deleted: [Folder] "C:\Users\becca\appdata\local\searchprotect"

Successfully deleted: [Folder] "C:\Users\becca\appdata\locallow\conduit"

Successfully deleted: [Folder] "C:\Users\becca\appdata\locallow\pricegong"

Successfully deleted: [Folder] "C:\Program Files (x86)\conduit"

Successfully deleted: [Folder] "C:\ai_recyclebin"

Successfully deleted: [Empty Folder] C:\Users\becca\appdata\local\{C6CE8354-B17A-438F-86C7-5E91F4D7A351}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Mon 02/10/2014 at 16:48:28.69

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

AdwCleaner

# AdwCleaner v3.018 - Report created 10/02/2014 at 16:53:51

# Updated 28/01/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : becca - BECCA-HP

# Running from : C:\Users\becca\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Program Files (x86)\SearchFlyBar2

Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search

Folder Deleted : C:\Windows\SysWOW64\Searchprotect

Folder Deleted : C:\Users\becca\AppData\Local\AVG Secure Search

Folder Deleted : C:\Users\becca\AppData\LocalLow\IMVU_Inc_C

Folder Deleted : C:\Users\becca\AppData\LocalLow\SearchFlyBar2

File Deleted : C:\Users\becca\AppData\Local\Temp\Uninstall.exe

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D2580209-EBD1-477B-A9A9-4171D6E8958C}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F2E99EFD-72DC-4C5D-9F7C-219133FF8E40}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{F2E99EFD-72DC-4C5D-9F7C-219133FF8E40}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D2580209-EBD1-477B-A9A9-4171D6E8958C}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{657848CE-3D09-46D0-B497-45A918A635B8}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CDD44727-CFEC-488F-A7C1-5630A05ADC1D}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5DD418BD-817C-4016-87B6-400DBCA95B47}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FA1A23D2-913D-4AC3-8CC2-5D76BBA914CE}

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}

Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{F2E99EFD-72DC-4C5D-9F7C-219133FF8E40}]

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{F2E99EFD-72DC-4C5D-9F7C-219133FF8E40}]

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Deleted : HKCU\Software\AVG Secure Search

Key Deleted : HKCU\Software\AppDataLow\Software\IMVU_Inc_C

Key Deleted : HKCU\Software\AppDataLow\Software\SearchFlyBar2

Key Deleted : HKLM\Software\AVG Secure Search

Key Deleted : HKLM\Software\IMVU_Inc_C

Key Deleted : HKLM\Software\SearchFlyBar2

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

-\\ Google Chrome v32.0.1700.107

[ File : C:\Users\becca\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage

*************************

AdwCleaner[R0].txt - [7569 octets] - [09/10/2013 21:31:39]

AdwCleaner[R1].txt - [4307 octets] - [10/10/2013 19:50:09]

AdwCleaner[R2].txt - [3745 octets] - [10/02/2014 16:51:23]

AdwCleaner[s0].txt - [3830 octets] - [10/10/2013 19:52:13]

AdwCleaner[s1].txt - [3534 octets] - [10/02/2014 16:53:51]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [3594 octets] ##########

MBAM

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.02.10.07

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

becca :: BECCA-HP [administrator]

2/10/2014 4:59:27 PM

mbam-log-2014-02-10 (16-59-27).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 215282

Time elapsed: 6 minute(s), 13 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 1

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|BackgroundContainer (PUP.Optional.Conduit) -> Data: "C:\Windows\SysWOW64\Rundll32.exe" "C:\Users\becca\AppData\Local\Conduit\BackgroundContainer\BackgroundContainer.dll",DllRun -> Quarantined and deleted successfully.

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 3

C:\$RECYCLE.BIN\S-1-5-21-1157660980-3504564827-1891706756-1000\$RKITJI3.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.

C:\Users\becca\AppData\Local\Temp\bitool.dll (PUP.Optional.Somoto) -> Quarantined and deleted successfully.

C:\Users\becca\Local Settings\Temporary Internet Files\Content.IE5\Z2LCZQQ6\BiTool[1].dll (PUP.Optional.Somoto) -> Quarantined and deleted successfully.

(end)

ESET

C:\AdwCleaner\Quarantine\C\Program Files (x86)\lucky leap\luckyleapUninstall.exe.vir Win32/BrowseFox.C potentially unwanted application

C:\Program Files (x86)\VideoConverter\VideoConverter.exe a variant of Win32/InstallCore.A potentially unwanted application

C:\Program Files (x86)\VideoConverter\Uninstall\Uninstall.exe a variant of Win32/InstallCore.CF potentially unwanted application

C:\Users\becca\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\A53MIZ2L\TBUpdaterLogic[1].dll Win32/Toolbar.Conduit.Y potentially unwanted application

C:\Users\becca\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZBZ63TTQ\TBUpdaterLogic[1].dll Win32/Toolbar.Conduit.Y potentially unwanted application

C:\Users\becca\AppData\Local\Temp\nsh1A86.tmp Win32/Toolbar.Conduit.S potentially unwanted application

C:\Users\becca\AppData\Local\Temp\nsp45E8.tmp Win32/Toolbar.Conduit.S potentially unwanted application

C:\Users\becca\Downloads\ArcadeFrontierGames (1).exe Win32/OpenCandy potentially unsafe application

C:\Users\becca\Downloads\ArcadeFrontierGames (2).exe Win32/OpenCandy potentially unsafe application

C:\Users\becca\Downloads\ArcadeFrontierGames.exe Win32/OpenCandy potentially unsafe application

C:\Users\becca\Downloads\cbsidlm-cbsi134-AdwCleaner-SEO-75851221.exe a variant of Win32/CNETInstaller.B potentially unwanted application

C:\Users\becca\Downloads\Shockwave_Installer_Slim.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\becca\Downloads\TinyMediaPlayer_RocketFuelInstaller.exe a variant of Win32/Verti.A potentially unwanted application

C:\Users\becca\Downloads\VideoConverterSetup (1).exe a variant of Win32/InstallCore.CF potentially unwanted application

C:\Users\becca\Downloads\VideoConverterSetup (2).exe a variant of Win32/InstallCore.CF potentially unwanted application

C:\Users\becca\Downloads\VideoConverterSetup.exe a variant of Win32/InstallCore.CF potentially unwanted application

C:\Windows\System32\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Windows\SysWOW64\Adobe\Shockwave 12\gt.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

FRST

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-02-2014 01

Ran by becca (administrator) on BECCA-HP on 10-02-2014 18:50:42

Running from C:\Users\becca\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

(PasswordBox, Inc.) C:\Program Files (x86)\PasswordBox\pbbtnService.exe

(Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Sendori) C:\Program Files (x86)\Sendori\sndappv2.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Sendori, Inc.) C:\Program Files (x86)\Sendori\SendoriSvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(sendori) C:\Program Files (x86)\Sendori\Sendori.Service.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Microsoft Corporation) c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Microsoft Corporation) c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe

(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Sendori, Inc.) C:\Program Files (x86)\Sendori\SendoriTray.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(ESET) C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6602856 2011-01-11] (Realtek Semiconductor)

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2799912 2011-06-09] (Synaptics Incorporated)

HKLM\...\Run: [setDefault] - C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe [42808 2011-06-27] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [iAStorIcon] - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [283160 2010-09-13] (Intel Corporation)

HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [578944 2012-03-05] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.)

HKLM-x32\...\Run: [sendori Tray] - C:\Program Files (x86)\Sendori\SendoriTray.exe [83232 2013-10-07] (Sendori, Inc.)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\.DEFAULT\...\RunOnce: [spUninstallDeleteDir] - rmdir /s /q "\SearchProtect"

HKU\S-1-5-21-1157660980-3504564827-1891706756-1000\...\Run: [DAEMON Tools Lite] - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3675352 2013-10-28] (Disc Soft Ltd)

==================== Internet (Whitelisted) ====================

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

BHO: No Name - {6C8DB2EC-499B-4897-A784-0E3186C97E9D} - No File

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO-x32: PasswordBox Helper - {5DB69B97-934B-451D-94DB-32EF802A01CD} - C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll (PasswordBox, Inc.)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

Winsock: Catalog9 01 C:\Windows\SysWOW64\Sendori.dll [325920] (Sendori)

Winsock: Catalog9 02 C:\Windows\SysWOW64\Sendori.dll [325920] (Sendori)

Winsock: Catalog9 03 C:\Windows\SysWOW64\Sendori.dll [325920] (Sendori)

Winsock: Catalog9 04 C:\Windows\SysWOW64\Sendori.dll [325920] (Sendori)

Winsock: Catalog9 15 C:\Windows\SysWOW64\Sendori.dll [325920] (Sendori)

Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

Chrome:

=======

CHR Extension: (Google Wallet) - C:\Users\becca\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]

CHR HKCU\...\Chrome\Extension: [acohkacenjkkllhbfgfflibmenakobco] - C:\Users\becca\AppData\Local\CRE\acohkacenjkkllhbfgfflibmenakobco.crx [2013-08-21]

CHR HKCU\...\Chrome\Extension: [fibbpolejomdcpiahkgcmdmaliooeien] - C:\Users\becca\AppData\Local\CRE\fibbpolejomdcpiahkgcmdmaliooeien.crx [2013-08-21]

CHR HKCU\...\Chrome\Extension: [hgiifhjbblnglipdbpdgagphlcbililb] - C:\Users\becca\AppData\Local\CRE\hgiifhjbblnglipdbpdgagphlcbililb.crx [2013-08-21]

CHR HKCU\...\Chrome\Extension: [klibnahbojhkanfgaglnlalfkgpcppfi] - C:\Users\becca\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx [2013-08-21]

CHR HKCU\...\Chrome\Extension: [oopdmcnionefjjnmchkiimificckpkif] - C:\Users\becca\AppData\Local\CRE\oopdmcnionefjjnmchkiimificckpkif.crx [2013-08-21]

CHR HKLM-x32\...\Chrome\Extension: [acohkacenjkkllhbfgfflibmenakobco] - C:\Users\becca\AppData\Local\CRE\acohkacenjkkllhbfgfflibmenakobco.crx [2013-08-21]

CHR HKLM-x32\...\Chrome\Extension: [fibbpolejomdcpiahkgcmdmaliooeien] - C:\Users\becca\AppData\Local\CRE\fibbpolejomdcpiahkgcmdmaliooeien.crx [2013-08-21]

CHR HKLM-x32\...\Chrome\Extension: [hgiifhjbblnglipdbpdgagphlcbililb] - C:\Users\becca\AppData\Local\CRE\hgiifhjbblnglipdbpdgagphlcbililb.crx [2013-08-21]

CHR HKLM-x32\...\Chrome\Extension: [klibnahbojhkanfgaglnlalfkgpcppfi] - C:\Users\becca\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx [2013-08-21]

CHR HKLM-x32\...\Chrome\Extension: [oopdmcnionefjjnmchkiimificckpkif] - C:\Users\becca\AppData\Local\CRE\oopdmcnionefjjnmchkiimificckpkif.crx [2013-08-21]

==================== Services (Whitelisted) =================

R2 Application Sendori; C:\Program Files (x86)\Sendori\SendoriSvc.exe [120096 2013-10-07] (Sendori, Inc.)

S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [240736 2013-08-27] (WildTangent)

R2 PasswordBox; C:\Program Files (x86)\PasswordBox\pbbtnService.exe [67584 2013-09-24] (PasswordBox, Inc.)

R2 Service Sendori; C:\Program Files (x86)\Sendori\Sendori.Service.exe [22304 2013-10-07] (sendori)

R2 sndappv2; C:\Program Files (x86)\Sendori\sndappv2.exe [3623200 2013-10-07] (Sendori)

S4 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [X]

==================== Drivers (Whitelisted) ====================

R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [45856 2013-10-10] (AVG Technologies)

R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [283064 2014-02-09] (Disc Soft Ltd)

S3 SaiH0464; C:\Windows\System32\DRIVERS\SaiH0464.sys [178432 2008-03-31] (Saitek)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-10 18:50 - 2014-02-10 18:50 - 00010039 _____ () C:\Users\becca\Desktop\FRST.txt

2014-02-10 18:50 - 2014-02-10 18:46 - 02151424 _____ (Farbar) C:\Users\becca\Desktop\FRST64.exe

2014-02-10 18:46 - 2014-02-10 18:46 - 00002202 _____ () C:\Users\becca\Desktop\eset.txt

2014-02-10 16:51 - 2014-02-10 16:48 - 01166132 _____ () C:\Users\becca\Desktop\AdwCleaner.exe

2014-02-10 16:48 - 2014-02-10 16:48 - 00006214 _____ () C:\Users\becca\Desktop\JRT.txt

2014-02-10 16:39 - 2014-02-10 16:37 - 01037530 _____ (Thisisu) C:\Users\becca\Desktop\JRT.exe

2014-02-10 16:16 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\becca\Desktop\mbar

2014-02-10 16:16 - 2014-02-10 16:16 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-02-10 16:15 - 2014-02-10 16:12 - 12589848 _____ (Malwarebytes Corp.) C:\Users\becca\Desktop\mbar-1.07.0.1009.exe

2014-02-10 12:11 - 2014-02-09 19:24 - 00000079 ____R () C:\Users\becca\Desktop\MHM0502400000.cue

2014-02-10 11:39 - 2014-02-10 11:39 - 00002815 _____ () C:\Users\becca\Desktop\RKreport[0]_S_02102014_113912.txt

2014-02-10 11:36 - 2014-02-10 11:39 - 00000000 ____D () C:\Users\becca\Desktop\RK_Quarantine

2014-02-10 11:34 - 2014-02-10 11:35 - 00000000 ____D () C:\Program Files (x86)\ERUNT

2014-02-10 11:34 - 2014-02-10 11:34 - 00000928 _____ () C:\Users\becca\Desktop\NTREGOPT.lnk

2014-02-10 11:34 - 2014-02-10 11:34 - 00000909 _____ () C:\Users\becca\Desktop\ERUNT.lnk

2014-02-10 11:34 - 2014-02-10 11:31 - 00791393 _____ (Lars Hederer ) C:\Users\becca\Desktop\erunt-setup.exe

2014-02-10 11:32 - 2014-02-10 11:32 - 00004485 _____ () C:\Users\becca\Desktop\iExplore - Shortcut.lnk

2014-02-10 11:30 - 2014-02-10 11:32 - 00000002 _____ () C:\Users\becca\Desktop\Rkill.txt

2014-02-09 19:36 - 2014-02-09 19:36 - 00000959 _____ () C:\Users\Public\Desktop\Message in a Haunted Mansion.lnk

2014-02-09 19:30 - 2014-02-09 19:26 - 664978608 ____R () C:\Users\becca\Desktop\MHM0502400000.bin

2014-02-09 19:23 - 2014-02-10 12:11 - 00000000 ____D () C:\Users\becca\AppData\Roaming\DAEMON Tools Lite

2014-02-09 19:23 - 2014-02-09 19:33 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys

2014-02-09 19:23 - 2014-02-09 19:23 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite

2014-02-09 19:22 - 2014-02-09 19:34 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite

2014-02-09 19:12 - 2014-02-09 19:12 - 00002982 _____ () C:\Windows\System32\Tasks\{EDB7B79D-22B5-4870-8A48-6EBA9D77895C}

2014-02-09 19:12 - 2014-02-09 19:12 - 00002982 _____ () C:\Windows\System32\Tasks\{C2C74585-4E1C-411C-BEC1-2357B8BB083A}

2014-02-08 00:13 - 2014-02-09 18:03 - 00000000 ____D () C:\Users\becca\Documents\The Silent Spy

2014-02-08 00:10 - 2014-02-09 18:56 - 00000000 ____D () C:\Program Files (x86)\Games

2014-02-07 14:52 - 2014-02-07 21:09 - 00000000 ____D () C:\Users\becca\Documents\Ghost of Thornton Hall

2014-02-07 14:29 - 2014-02-07 14:32 - 00000000 ____D () C:\Program Files (x86)\ND 28 Ghost of Thornton Hall

2014-02-07 14:29 - 2014-02-07 14:29 - 00000000 ____D () C:\Windows\ND 28 Ghost of Thornton Hall

2014-01-26 20:31 - 2014-01-26 20:32 - 00688992 ____R (Swearware) C:\Users\becca\Downloads\dds (1).scr

2014-01-26 11:15 - 2014-01-26 11:09 - 531572487 _____ () C:\Users\becca\Desktop\witch_hunter_120114_13468.zip

2014-01-26 10:31 - 2014-01-26 10:55 - 00000000 ____D () C:\Program Files (x86)\Desura

2014-01-26 10:31 - 2014-01-26 10:31 - 00000000 ____D () C:\ProgramData\Desura

2014-01-26 10:30 - 2014-01-26 10:31 - 01252424 _____ () C:\Users\becca\Downloads\DesuraInstaller.exe

2014-01-24 17:57 - 2014-01-24 18:09 - 00000000 ____D () C:\Users\becca\Downloads\Left 4 Dead 2 V2.0.2.7 Full-Rip {blaze69}

2014-01-24 17:52 - 2014-02-05 17:50 - 00000000 ____D () C:\Users\becca\AppData\Roaming\uTorrent

2014-01-24 17:51 - 2014-01-24 17:52 - 01307736 _____ (BitTorrent Inc.) C:\Users\becca\Downloads\utorrent.exe

2014-01-24 17:50 - 2014-01-24 17:50 - 00003344 _____ () C:\Windows\System32\Tasks\{6B1FC949-516B-43A4-AA40-31BC47521ADC}

2014-01-24 17:09 - 2014-01-24 17:09 - 18496195 _____ () C:\Users\becca\Downloads\l4d1_rochelle_remplace_zoey_060114_27670.zip

2014-01-24 16:56 - 2014-01-24 16:56 - 00003118 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe

2014-01-24 16:56 - 2014-01-24 16:56 - 00003092 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe

2014-01-24 16:56 - 2014-01-24 16:56 - 00003090 _____ () C:\Windows\System32\Tasks\Microsoft_Hardware_Launch_itype_exe

2014-01-24 16:56 - 2014-01-24 16:56 - 00003062 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe

2014-01-24 16:56 - 2014-01-24 16:56 - 00003060 _____ () C:\Windows\System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe

2014-01-24 16:56 - 2014-01-24 16:56 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_Kernel_point64_01011.Wdf

2014-01-24 16:56 - 2014-01-24 16:56 - 00000000 ____D () C:\Program Files\Microsoft Mouse and Keyboard Center

2014-01-22 19:26 - 2014-01-22 19:26 - 00001588 _____ () C:\Users\becca\Desktop\Play Left4Dead.lnk

2014-01-22 19:16 - 2014-01-22 19:17 - 02841532 _____ (Saitek ) C:\Users\becca\Downloads\Saitek_Cyborg_Evo_SD6_64.exe

2014-01-17 17:52 - 2014-02-06 22:54 - 00000000 ____D () C:\Users\becca\Documents\The Deadly Device

2014-01-16 02:53 - 2014-01-16 23:17 - 00000000 ____D () C:\Users\becca\Documents\Tomb of the Lost Queen

2014-01-15 14:23 - 2014-01-16 00:29 - 00000000 ____D () C:\Users\becca\Documents\Alibi in Ashes

2014-01-14 23:07 - 2013-11-26 20:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-14 23:07 - 2013-11-26 20:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-14 23:07 - 2013-11-26 20:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-14 23:07 - 2013-11-26 20:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-14 23:07 - 2013-11-26 20:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-14 23:07 - 2013-11-26 20:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-14 23:07 - 2013-11-26 20:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-14 23:07 - 2013-11-26 06:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-14 23:07 - 2013-11-26 05:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-13 20:57 - 2014-01-15 00:09 - 00000000 ____D () C:\Users\becca\Documents\The Captive Curse

2014-01-12 18:36 - 2014-01-12 18:36 - 00000000 ____D () C:\Users\becca\AppData\Local\Nancy Drew

2014-01-12 18:31 - 2014-01-12 18:35 - 00000000 ____D () C:\Program Files (x86)\Nancy Drew

==================== One Month Modified Files and Folders =======

2014-02-10 18:50 - 2014-02-10 18:50 - 00010039 _____ () C:\Users\becca\Desktop\FRST.txt

2014-02-10 18:50 - 2013-10-10 22:35 - 00000000 ____D () C:\FRST

2014-02-10 18:49 - 2012-03-15 22:08 - 01416137 _____ () C:\Windows\WindowsUpdate.log

2014-02-10 18:46 - 2014-02-10 18:50 - 02151424 _____ (Farbar) C:\Users\becca\Desktop\FRST64.exe

2014-02-10 18:46 - 2014-02-10 18:46 - 00002202 _____ () C:\Users\becca\Desktop\eset.txt

2014-02-10 18:13 - 2013-10-12 04:03 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-10 17:15 - 2009-07-13 23:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-10 17:15 - 2009-07-13 23:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-10 17:08 - 2013-10-12 04:03 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-10 17:07 - 2010-11-20 22:47 - 00986786 _____ () C:\Windows\PFRO.log

2014-02-10 17:07 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-10 17:07 - 2009-07-13 23:51 - 00052458 _____ () C:\Windows\setupact.log

2014-02-10 16:53 - 2013-10-09 21:31 - 00000000 ____D () C:\AdwCleaner

2014-02-10 16:48 - 2014-02-10 16:51 - 01166132 _____ () C:\Users\becca\Desktop\AdwCleaner.exe

2014-02-10 16:48 - 2014-02-10 16:48 - 00006214 _____ () C:\Users\becca\Desktop\JRT.txt

2014-02-10 16:37 - 2014-02-10 16:39 - 01037530 _____ (Thisisu) C:\Users\becca\Desktop\JRT.exe

2014-02-10 16:37 - 2014-02-10 16:16 - 00000000 ____D () C:\Users\becca\Desktop\mbar

2014-02-10 16:37 - 2013-10-10 19:07 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-02-10 16:16 - 2014-02-10 16:16 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-02-10 16:13 - 2013-07-08 03:00 - 00000000 ___RD () C:\Users\becca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

2014-02-10 16:12 - 2014-02-10 16:15 - 12589848 _____ (Malwarebytes Corp.) C:\Users\becca\Desktop\mbar-1.07.0.1009.exe

2014-02-10 12:11 - 2014-02-09 19:23 - 00000000 ____D () C:\Users\becca\AppData\Roaming\DAEMON Tools Lite

2014-02-10 11:39 - 2014-02-10 11:39 - 00002815 _____ () C:\Users\becca\Desktop\RKreport[0]_S_02102014_113912.txt

2014-02-10 11:39 - 2014-02-10 11:36 - 00000000 ____D () C:\Users\becca\Desktop\RK_Quarantine

2014-02-10 11:35 - 2014-02-10 11:34 - 00000000 ____D () C:\Program Files (x86)\ERUNT

2014-02-10 11:34 - 2014-02-10 11:34 - 00000928 _____ () C:\Users\becca\Desktop\NTREGOPT.lnk

2014-02-10 11:34 - 2014-02-10 11:34 - 00000909 _____ () C:\Users\becca\Desktop\ERUNT.lnk

2014-02-10 11:32 - 2014-02-10 11:32 - 00004485 _____ () C:\Users\becca\Desktop\iExplore - Shortcut.lnk

2014-02-10 11:32 - 2014-02-10 11:30 - 00000002 _____ () C:\Users\becca\Desktop\Rkill.txt

2014-02-10 11:31 - 2014-02-10 11:34 - 00791393 _____ (Lars Hederer ) C:\Users\becca\Desktop\erunt-setup.exe

2014-02-10 10:20 - 2013-07-08 03:00 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{1FA883F4-6E4F-41C1-8534-91BE246FE0CC}

2014-02-09 20:21 - 2009-07-14 00:13 - 00796484 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-09 19:36 - 2014-02-09 19:36 - 00000959 _____ () C:\Users\Public\Desktop\Message in a Haunted Mansion.lnk

2014-02-09 19:36 - 2013-11-14 23:27 - 00000000 ____D () C:\Users\becca\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games

2014-02-09 19:35 - 2014-01-07 01:27 - 00000000 ____D () C:\Program Files\Nancy Drew

2014-02-09 19:34 - 2014-02-09 19:22 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite

2014-02-09 19:33 - 2014-02-09 19:23 - 00283064 _____ (Disc Soft Ltd) C:\Windows\system32\Drivers\dtsoftbus01.sys

2014-02-09 19:26 - 2014-02-09 19:30 - 664978608 ____R () C:\Users\becca\Desktop\MHM0502400000.bin

2014-02-09 19:24 - 2014-02-10 12:11 - 00000079 ____R () C:\Users\becca\Desktop\MHM0502400000.cue

2014-02-09 19:23 - 2014-02-09 19:23 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite

2014-02-09 19:12 - 2014-02-09 19:12 - 00002982 _____ () C:\Windows\System32\Tasks\{EDB7B79D-22B5-4870-8A48-6EBA9D77895C}

2014-02-09 19:12 - 2014-02-09 19:12 - 00002982 _____ () C:\Windows\System32\Tasks\{C2C74585-4E1C-411C-BEC1-2357B8BB083A}

2014-02-09 18:56 - 2014-02-08 00:10 - 00000000 ____D () C:\Program Files (x86)\Games

2014-02-09 18:03 - 2014-02-08 00:13 - 00000000 ____D () C:\Users\becca\Documents\The Silent Spy

2014-02-07 21:09 - 2014-02-07 14:52 - 00000000 ____D () C:\Users\becca\Documents\Ghost of Thornton Hall

2014-02-07 14:32 - 2014-02-07 14:29 - 00000000 ____D () C:\Program Files (x86)\ND 28 Ghost of Thornton Hall

2014-02-07 14:29 - 2014-02-07 14:29 - 00000000 ____D () C:\Windows\ND 28 Ghost of Thornton Hall

2014-02-06 22:54 - 2014-01-17 17:52 - 00000000 ____D () C:\Users\becca\Documents\The Deadly Device

2014-02-05 17:50 - 2014-01-24 17:52 - 00000000 ____D () C:\Users\becca\AppData\Roaming\uTorrent

2014-02-04 13:51 - 2013-08-02 10:21 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-01-26 20:32 - 2014-01-26 20:31 - 00688992 ____R (Swearware) C:\Users\becca\Downloads\dds (1).scr

2014-01-26 17:19 - 2013-07-08 02:59 - 00058408 _____ () C:\Users\becca\AppData\Local\GDIPFONTCACHEV1.DAT

2014-01-26 17:19 - 2009-07-13 23:45 - 00268856 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-01-26 11:09 - 2014-01-26 11:15 - 531572487 _____ () C:\Users\becca\Desktop\witch_hunter_120114_13468.zip

2014-01-26 10:55 - 2014-01-26 10:31 - 00000000 ____D () C:\Program Files (x86)\Desura

2014-01-26 10:31 - 2014-01-26 10:31 - 00000000 ____D () C:\ProgramData\Desura

2014-01-26 10:31 - 2014-01-26 10:30 - 01252424 _____ () C:\Users\becca\Downloads\DesuraInstaller.exe

2014-01-25 00:03 - 2011-07-12 22:20 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard

2014-01-24 20:39 - 2013-07-22 16:17 - 00000000 ____D () C:\games

2014-01-24 18:56 - 2013-10-10 19:50 - 00000000 ____D () C:\Program Files (x86)\PasswordBox

2014-01-24 18:47 - 2014-01-05 16:50 - 00000000 ___HD () C:\Windows\msdownld.tmp

2014-01-24 18:47 - 2014-01-05 16:50 - 00000000 ____D () C:\Windows\SysWOW64\directx

2014-01-24 18:09 - 2014-01-24 17:57 - 00000000 ____D () C:\Users\becca\Downloads\Left 4 Dead 2 V2.0.2.7 Full-Rip {blaze69}

2014-01-24 17:52 - 2014-01-24 17:51 - 01307736 _____ (BitTorrent Inc.) C:\Users\becca\Downloads\utorrent.exe