Possible infection...Help!

zalloy · February 8, 2014

I posted yesterday over in MBAM Help because I noticed that my MBAM Pro isn't updating automatically anymore. For the last couple of weeks, I've had to go in and manually update the database. Also, for some reason or another, The Weather Channel app is being detected as adware. Not sure why. I know it asks to install toolbars when it installs, but I always decline, and it always seems to work. I've used that app for a long time, and they just came out with a new version, so that might be why it's being detected.

Anyhoo, here's the DDS:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 11.0.9600.16428 BrowserJavaVersion: 10.51.2

Run by Laurie at 17:49:14 on 2014-02-07

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.12031.5600 [GMT -5:00]

.

AV: Norton Security Suite *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}

SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Norton Security Suite *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}

FW: Norton Security Suite *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\crypserv.exe

C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe

C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe

C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt

C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe

C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe

C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe

C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\NetRatingsNetSight\NetSight\NielsenUpdate.exe

C:\Program Files (x86)\PDF Suite 2012\HelperService.exe

C:\Program Files (x86)\PDF Suite 2012\ConversionService.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\Windows\System32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\SearchIndexer.exe

C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\Dwm.exe

C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe

C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe

C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe

C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

C:\Program Files (x86)\Nettalk6\Nettalk.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files (x86)\NetRatingsNetSight\NetSight\nielsenonline.exe

C:\Program Files (x86)\Nuance\PDF Create 7\PdfCreate7Hook.exe

C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe

C:\Program Files (x86)\Ninite Updater\NiniteUpdater.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\NielsenOnline64.exe

C:\Users\Laurie\AppData\Local\Temp\8c9feab4-8824-11e3-804b-6805ca1e2e3b\Ninite.exe

C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files (x86)\PhraseExpress\PhraseExpress.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Users\Laurie\AppData\Roaming\mjusbsp\magicJack.exe

C:\Windows\SysWOW64\ctfmon.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Windows\System32\taskmgr.exe

C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe

C:\Windows\Explorer.exe

C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\HipChat\HipChat.exe

C:\Program Files (x86)\Cloudmark\Desktop\Service\cdswin.exe

C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

C:\Program Files (x86)\Google\Drive\googledrivesync.exe

C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

uProxyOverride = 127.0.0.1;*.local

uURLSearchHooks: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - <orphaned>

BHO: HP Print Enhancer: {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\Hp\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

BHO: RealNetworks Download and Record Plugin for Internet Explorer: {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll

BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\coieplg.dll

BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\IPS\ipsbho.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Constant Guard Protection Suite: {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - C:\ProgramData\White Sky, Inc\ID Vault\IEBHO1.13.1211.1\NativeBHO.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

BHO: HP Smart BHO Class: {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\Hp\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

TB: The Weather Channel Toolbar: {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\Windows\SysWOW64\TwcToolbarIe7.dll

TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\coieplg.dll

EB: HP Smart Web Printing: {555D4D79-4BD2-4094-A395-CFC534424A05} - C:\Program Files (x86)\Hp\Digital Imaging\Smart Web Printing\hpswp_bho.dll

uRun: [OpenDNS Updater] "C:\Program Files (x86)\OpenDNS Updater\OpenDNSUpdater.exe" /autostart

uRun: [Plex Media Server] "C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe"

uRun: [GoogleChromeAutoLaunch_E76C975296F20119B357F0CF28EB7223] "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-startup-window

uRun: [GoogleDriveSync] "C:\Program Files (x86)\Google\Drive\googledrivesync.exe" /autostart

uRun: [TWC.Win7] C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe

mRun: [NielsenOnline] C:\Program Files (x86)\NetRatingsNetSight\NetSight\NielsenOnline.exe

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [switchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

mRun: [PDF7 Registry Controller] C:\Program Files (x86)\Nuance\PDF Create 7\RegistryController.exe

mRun: [OmniPage Preload] C:\Program Files (x86)\Nuance\OmniPage18\OmniPage18.exe /preload

mRun: [PDFHook] C:\Program Files (x86)\Nuance\PDF Create 7\pdfcreate7hook.exe

mRun: [Nuance OmniPage 18-reminder] "C:\Program Files (x86)\Nuance\OmniPage18\Ereg\Ereg.exe" -r "C:\ProgramData\ScanSoft\OmniPage 18\Ereg\Ereg.ini"

mRun: [EKStatusMonitor] C:\PROGRAM FILES (X86)\KODAK\AIO\STATUSMONITOR\EKStatusMonitor.EXE

mRun: [Ninite Updater] "C:\Program Files (x86)\Ninite Updater\NiniteUpdater.exe" /updaterclient /stub:trayapp /autorun

mRun: [TkBellExe] "C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe" -osboot

mRun: [Conime] C:\Windows\System32\conime.exe

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

dRunOnce: [KodakHomeCenter] "C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe"

dRunOnce: [DeleteEngineAfterUpdate] reg DELETE HKCU\Software\AppDataLow\Software\ConduitEngine /f

StartupFolder: C:\Users\Laurie\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Nettalk.lnk - C:\Program Files (x86)\Nettalk6\Nettalk.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CLOUDM~1.LNK - C:\Program Files (x86)\Cloudmark\Desktop\Service\cdswin.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\CONSTA~1.LNK - C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\PHRASE~1.LNK - C:\Program Files (x86)\PhraseExpress\phraseexpress.exe

uPolicies-Explorer: NoDrives = dword:0

mPolicies-Explorer: NoDrives = dword:0

mPolicies-System: ConsentPromptBehaviorAdmin = dword:5

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableUIADesktopToggle = dword:0

IE: Append Link Target to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Append to Existing PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert Link Target to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert to Adobe PDF - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000

IE: Google Sidewiki... - C:\Program Files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_7461B1589E8B4FB7.dll/cmsidewiki.html

IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files (x86)\Hp\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

.

INFO: HKCU has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

TCP: NameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{4AAE8CCC-600E-457C-AA28-C0D50643B0CA} : NameServer = 208.67.222.222,208.67.220.220

TCP: Interfaces\{4AAE8CCC-600E-457C-AA28-C0D50643B0CA} : DHCPNameServer = 75.75.75.75 75.75.76.76

TCP: Interfaces\{C92ED2A1-DD1B-4AB0-ABFC-F7CBA6D0159A} : NameServer = 75.75.75.75,75.75.76.76

TCP: Interfaces\{C92ED2A1-DD1B-4AB0-ABFC-F7CBA6D0159A} : DHCPNameServer = 75.75.75.75 75.75.76.76

Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

x64-BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.1.0.18\CoIEPlg.dll

x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.1.0.18\CoIEPlg.dll

x64-Run: [hpsysdrv] c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe

x64-Run: [RTHDVCPL] "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" -s

x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll

x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\k4qc5cj9.default\

FF - prefs.js: browser.search.defaulturl -

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: network.proxy.type - 0

FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3050.dll

FF - plugin: C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\FirefoxAddOns\npfirefoxtracker.dll

FF - plugin: C:\Program Files (x86)\PDF Suite 2012\firefoxextension2012\plugins\NPPdfExt2012.dll

FF - plugin: c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll

FF - plugin: C:\Program Files (x86)\Winamp Detect\npwachk.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll

FF - plugin: C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll

FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll

FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll

FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll

FF - plugin: C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll

FF - plugin: C:\Users\Laurie\AppData\Local\Citrix\Plugins\104\npappdetector.dll

FF - plugin: C:\Users\Laurie\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll

FF - plugin: C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\k4qc5cj9.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}\plugins\npAclmPlugin.dll

FF - plugin: C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\k4qc5cj9.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}\plugins\npPitPlugin.dll

FF - plugin: C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\k4qc5cj9.default\extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}\plugins\npProductDetectPlugin.dll

FF - plugin: C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\k4qc5cj9.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll

FF - plugin: C:\Windows\System32\Wat\npWatWeb.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll

FF - ExtSQL: !HIDDEN! 2013-04-16 16:57; smartwebprinting@hp.com; C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

.

============= SERVICES / DRIVERS ===============

.

R0 amd_sata;amd_sata;C:\Windows\System32\drivers\amd_sata.sys [2013-3-31 82600]

R0 amd_xata;amd_xata;C:\Windows\System32\drivers\amd_xata.sys [2013-3-31 42664]

R0 gfibto;gfibto;C:\Windows\System32\drivers\gfibto.sys [2013-6-8 14456]

R0 NBVol;Nero Backup Volume Filter Driver;C:\Windows\System32\drivers\NBVol.sys [2011-11-10 72240]

R0 NBVolUp;Nero Backup Volume Upper Filter Driver;C:\Windows\System32\drivers\NBVolUp.sys [2011-11-10 15920]

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\N360x64\1501000.012\SymDS64.sys [2013-11-14 493656]

R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\N360x64\1501000.012\SymEFA64.sys [2013-11-14 1147480]

R1 AntiLog32;AntiLog32;C:\Windows\System32\drivers\AntiLog64.sys [2014-1-11 49240]

R1 BHDrvx64;BHDrvx64;C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20140121.001\BHDrvx64.sys [2014-1-22 1526488]

R1 ccSet_N360;N360 Settings Manager;C:\Windows\System32\drivers\N360x64\1501000.012\ccSetx64.sys [2013-11-14 162392]

R1 IDSVia64;IDSVia64;C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20140206.001\IDSviA64.sys [2014-2-6 521944]

R1 nnfwdk;Nielsen WFP Driver;C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\nnfwdk64.sys [2013-12-20 26664]

R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\N360x64\1501000.012\Ironx64.sys [2013-11-14 264280]

R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\N360x64\1501000.012\symnets.sys [2013-11-14 590936]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-5-26 204288]

R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-7-13 361984]

R2 AODDriver4.01;AODDriver4.01;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2011-6-24 55424]

R2 DragonSvc;Dragon Service;C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe [2010-7-23 296808]

R3 amdiox64;AMD IO Driver;C:\Windows\System32\drivers\amdiox64.sys [2011-9-23 46136]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2013-11-23 137648]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-6-30 25928]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2011-5-26 38456]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]

S3 AODDriver4.0;AODDriver4.0;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2011-6-24 55424]

S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-2-4 231440]

S3 prwntdrv;prwntdrv;C:\Windows\System32\prwntdrv.sys [2013-8-31 16776]

S3 pwdrvio;pwdrvio;C:\Windows\System32\pwdrvio.sys [2013-8-30 19936]

S3 pwdspio;pwdspio;C:\Windows\System32\pwdspio.sys [2013-8-30 13280]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2012-11-3 19456]

S3 Revoflt;Revoflt;C:\Windows\System32\drivers\revoflt.sys [2013-8-23 31800]

S3 rspSanity;rspSanity;C:\Windows\System32\drivers\rspSanity64.sys [2012-9-20 29752]

S3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2013-10-25 872152]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-11-3 57856]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2012-11-3 30208]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]

.

=============== Created Last 30 ================

.

2014-02-06 03:22:58 -------- d-----w- C:\Users\Laurie\AppData\Roaming\Cloudmark

2014-02-06 03:22:50 -------- d-----w- C:\ProgramData\Cloudmark

2014-02-06 03:22:50 -------- d-----w- C:\Program Files (x86)\Cloudmark

2014-02-05 18:03:33 -------- d-----w- C:\Users\Laurie\AppData\Local\Skype

2014-02-05 03:04:25 272496 ----a-w- C:\Program Files (x86)\Mozilla Firefox\browser\components\browsercomps.dll

2014-01-25 16:08:05 -------- d-----w- C:\Program Files\iPod

2014-01-25 16:08:02 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-25 16:08:02 -------- d-----w- C:\Program Files\iTunes

2014-01-25 16:04:16 -------- d-----w- C:\Users\Laurie\AppData\Roaming\DropboxMaster

2014-01-19 02:52:29 -------- d-----w- C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}

2014-01-17 18:07:39 -------- d-----r- C:\Users\Laurie\Google Drive

2014-01-16 14:40:09 -------- d-----w- C:\Program Files (x86)\LG Electronics

2014-01-14 21:33:38 99840 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

2014-01-14 21:33:38 7808 ----a-w- C:\Windows\System32\drivers\usbd.sys

2014-01-14 21:33:38 53248 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2014-01-14 21:33:38 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2014-01-14 21:33:38 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys

2014-01-14 21:33:38 3156480 ----a-w- C:\Windows\System32\win32k.sys

2014-01-14 21:33:38 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2014-01-14 21:33:38 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2014-01-14 21:33:37 376768 ----a-w- C:\Windows\System32\drivers\netio.sys

2014-01-14 21:30:49 108968 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll

2014-01-14 21:30:01 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll

2014-01-11 15:48:40 -------- d-----w- C:\Program Files\Calibre2

2014-01-11 15:15:02 10674488 ----a-w- C:\Windows\SysWow64\ZALSDKCore.dll

2014-01-11 15:15:01 49240 ----a-w- C:\Windows\System32\drivers\AntiLog64.sys

2014-01-11 15:15:01 -------- d-----w- C:\Windows\SysWow64\ZALSDK_uninst

2014-01-11 15:15:00 -------- d-----w- C:\Users\Laurie\AppData\Local\Zemana

.

==================== Find3M ====================

.

2014-02-05 03:04:50 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2014-02-05 03:04:50 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2013-11-26 10:19:07 2724864 ----a-w- C:\Windows\System32\mshtml.tlb

2013-11-26 10:18:23 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll

2013-11-26 09:48:07 66048 ----a-w- C:\Windows\System32\iesetup.dll

2013-11-26 09:46:25 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll

2013-11-26 09:23:02 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2013-11-26 09:18:39 139264 ----a-w- C:\Windows\System32\ieUnatt.exe

2013-11-26 09:18:09 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe

2013-11-26 09:16:57 708608 ----a-w- C:\Windows\System32\jscript9diag.dll

2013-11-26 08:35:02 5769216 ----a-w- C:\Windows\System32\jscript9.dll

2013-11-26 08:28:16 553472 ----a-w- C:\Windows\SysWow64\jscript9diag.dll

2013-11-26 08:16:12 4243968 ----a-w- C:\Windows\SysWow64\jscript9.dll

2013-11-26 08:02:16 1995264 ----a-w- C:\Windows\System32\inetcpl.cpl

2013-11-26 07:32:06 1928192 ----a-w- C:\Windows\SysWow64\inetcpl.cpl

2013-11-26 07:07:57 2334208 ----a-w- C:\Windows\System32\wininet.dll

2013-11-26 06:33:33 1820160 ----a-w- C:\Windows\SysWow64\wininet.dll

2013-11-23 18:26:20 417792 ----a-w- C:\Windows\SysWow64\WMPhoto.dll

2013-11-23 17:47:34 465920 ----a-w- C:\Windows\System32\WMPhoto.dll

2013-11-14 19:51:01 44436 ----a-w- C:\cc_20131114_145050.reg

2013-11-14 13:22:15 177752 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS

2013-11-12 02:23:09 2048 ----a-w- C:\Windows\System32\tzres.dll

2013-11-12 02:07:29 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

2012-06-13 13:23:30 893560 ----a-w- C:\Program Files (x86)\Common Files\AutoCompletePro.exe

.

============= FINISH: 17:50:28.40 ===============

zalloy · February 8, 2014

And the Attach:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 7/21/2011 4:14:38 PM

System Uptime: 1/28/2014 8:50:39 AM (249 hours ago)

.

Motherboard: FOXCONN | | 2AB1

Processor: AMD Phenom II X2 521 Processor | CPU 1 | 3500/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 920 GiB total, 623.138 GiB free.

D: is FIXED (NTFS) - 11 GiB total, 1.339 GiB free.

E: is CDROM ()

F: is CDROM ()

G: is Removable

H: is Removable

I: is Removable

J: is Removable

K: is CDROM ()

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e96c-e325-11ce-bfc1-08002be10318}

Description: AMD High Definition Audio Device

Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_791A&SUBSYS_00791A00&REV_1000\5&233C03F5&0&0001

Manufacturer: Advanced Micro Devices

Name: AMD High Definition Audio Device

PNP Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_791A&SUBSYS_00791A00&REV_1000\5&233C03F5&0&0001

Service: AtiHDAudioService

.

==== System Restore Points ===================

.

RP399: 1/18/2014 9:53:02 PM - Installed HP Support Assistant

RP400: 1/26/2014 4:45:59 PM - Scheduled Checkpoint

RP401: 2/4/2014 7:41:14 PM - Scheduled Checkpoint

RP402: 2/5/2014 10:22:24 PM - Installed Cloudmark DesktopOne.

.

==== Installed Programs ======================

.

64 Bit HP CIO Components Installer

7-Data Recovery Suite version 2.3

Adobe AIR

Adobe Community Help

Adobe Digital Editions 2.0

Adobe Flash Player 12 ActiveX

Adobe Flash Player 12 Plugin

Adobe Media Player

Adobe Photoshop CS5

AIO_Scan

aioscnnr

Amazon Kindle

AMD APP SDK Runtime

AMD Catalyst Install Manager

AMD Fuel

AMD Media Foundation Decoders

AMD Problem Report Wizard

AMD VISION Engine Control Center

Anonymous Guest v4.20 Pro Multilanguage

AntiLogger SDK version 1.6.6.296

Apple Application Support

Apple Mobile Device Support

Apple Software Update

Audacity 1.3.13 (Unicode)

Audacity 2.0.5

AutoHotkey 1.1.13.01

Bejeweled 2 Deluxe

Bejeweled 3

Bing Rewards Client Installer

Bitvise Tunnelier 4.40 (remove only)

Bonjour

BufferChm

C4USelfUpdater

calibre 64bit

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

center

Chrometa version 2.0.2.3.61

Citrix Online Launcher

Classic Doom 3 1.3.1

Cloudmark DesktopOne

Comcast Desktop Software (v1.2.1)

Constant Guard Protection Suite

Copy

CryptoPrevent v3.1.0

D3DX10

Defraggler

Destinations

DeviceDiscovery

DJ_AIO_Software

DJ_AIO_Software_min

Doomsday Engine 1.9.9

Dragon NaturallySpeaking 11

DriverIdentifier 4.2.7

DriverToolkit version 8.1.1.0

Dropbox

EaseUS Data Recovery Wizard 6.0

EaseUS Partition Recovery 5.6.1

Eassos PartitionGuru Professional 4.4.0

EMCO UnLock IT 3.0

ESET Online Scanner v3

essentials

Express Scribe

FBackup 4

FLAC 1.2.1b (remove only)

FTR TheRecord Player

Google Chrome

Google Drive

Google Earth

Google Update Helper

GoToMeeting 5.9.1216 IT Installer

GoToMeeting 6.0.1259 IT Installer

GoToMeeting 6.1.0.1312

GoToMeeting 6.1.1298 IT Installer

GoToMeeting 6.1.1312 IT Installer

GPBaseService2

Grammarly Add-In

HD Tune Pro 5.50

HipChat

HP Auto

HP Client Services

HP Customer Experience Enhancements

HP Customer Participation Program 13.0

HP Deskjet All-In-One Driver Software 13.0 Rel. 1

HP Games

HP Imaging Device Functions 13.0

HP LinkUp

HP MediaSmart/TouchSmart Netflix

HP Odometer

HP Photosmart Essential 3.5

HP Product Detection

HP Setup

HP Setup Manager

HP Smart Web Printing 4.51

HP Solution Center 13.0

HP Support Assistant

HP Support Information

HP Update

HP Vision Hardware Diagnostics

HPPhotoGadget

HPPhotoSmartDiscLabelContent1

HPPhotosmartEssential

HPProductAssistant

HPSSupply

Hulu Desktop

HydraVision

iCloud

iTunes

JAP

Java 7 Update 51

Java 7 Update 51 (64-bit)

Java Auto Updater

Junk Mail filter update

Kodak AIO Printer

KODAK AiO Software

LabelPrint

LG United Mobile Driver

LightScribe System Software

MagicfeaturesPlugin Release 2.11

magicJack

MagniPic

Mah Jong Medley

Malwarebytes Anti-Malware version 1.75.0.1300

MarketResearch

MediaMonkey 4.1

Mesh Runtime

Microsoft .NET Framework 1.1

Microsoft .NET Framework 4.5.1

Microsoft Application Error Reporting

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727

Microsoft WSE 3.0 Runtime

Microsoft_VC80_ATL_x86

Microsoft_VC80_ATL_x86_x64

Microsoft_VC80_CRT_x86

Microsoft_VC80_CRT_x86_x64

Microsoft_VC80_MFC_x86

Microsoft_VC80_MFC_x86_x64

Microsoft_VC80_MFCLOC_x86

Microsoft_VC80_MFCLOC_x86_x64

Microsoft_VC90_ATL_x86

Microsoft_VC90_ATL_x86_x64

Microsoft_VC90_CRT_x86

Microsoft_VC90_CRT_x86_x64

Microsoft_VC90_MFC_x86

Microsoft_VC90_MFC_x86_x64

MiniTool Partition Recovery 5.0

MiniTool Partition Wizard Home Edition 8.0

MiniTool Power Data Recovery

Mobipocket Reader 6.2

Morphyre

Mozilla Firefox 25.0.1 (x86 en-US)

Mozilla Firefox 27.0 (x86 en-US)

Mozilla Maintenance Service

Mozilla Thunderbird 24.3.0 (x86 en-US)

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB2721691)

MSXML 4.0 SP3 Parser (KB2758694)

Namco All-Stars PAC-MAN

Nero 11 Collection 1

Nero 11 Kwik Themes 3

Nero 11 Kwik Themes 4

Nero 11 Mini Repack

Nero 11 PiP Effects 1

Nero 11 Video Transitions 1

Nero Backup Drivers

Nettalk 6.7

Nielsen

Ninite Updater

Norton Security Suite

Nuance Cloud Connector

Nuance OmniPage 18

Nuance PDF Create 7

ocr

oDesk Team

Ontrack EasyRecovery Professional

OpenDNS Updater 2.2.1

OpenOffice 4.0.1

PDF Settings CS5

PDF Suite 2012

PeerBlock 1.1 (r518)

PerformanceTest v7.0 (64-bit)

PhraseExpress

PhraseExpress v10.0.135

Pidgin

Pixillion Image Converter

PlayReady PC Runtime amd64

PlayReady PC Runtime x86

Plex

Plex Media Server

Power2Go

PreReq

PressReader

Prism Video File Converter

Pure Networks Platform

QuickTime

RealDownloader

RealNetworks - Microsoft Visual C++ 2008 Runtime

RealNetworks - Microsoft Visual C++ 2010 Runtime

RealPlayer

Realtek Ethernet Controller Driver

Realtek High Definition Audio Driver

RealUpgrade 1.1

Recovery Manager

Recuva

Remote Graphics Receiver

Revo Uninstaller Pro 3.0.7

Safari

SanityCheck 2.01

Scan

Scansoft PDF Create

Security Update for CAPICOM (KB931906)

Shop for HP Supplies

Skype Click to Call

Skype™ 6.13

SmartWebPrinting

SolutionCenter

Sony Player Plug-in for Windows Media Player

SoulseekQt

Status

Stella 3.4.1

Stellar Phoenix Windows Data Recovery - Technical

Switch Sound File Converter

The FTW Transcriber version 2.1.0

The Weather Channel App

Toolbox

Transcription Buddy 4.0 (build 38)

TrayApp

Ubuntu

UnloadSupport

Visual C++ 9.0 Runtime for Dragon NaturallySpeaking 64bit (x64)

Visual Studio 2010 x64 Redistributables

VLC media player 2.1.3

Vuze

WebEx Support Manager for Internet Explorer

WebReg

Winamp

Winamp Detector Plug-in

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

Windows Product Key Finder Pro® 2.3

WinPcap 4.1.2

WinRAR 5.01 (64-bit)

Wireshark 1.8.3 (64-bit)

Wise Data Recovery 3.39

Zinio Reader 4

.

==== Event Viewer Messages From Past Week ========

.

2/7/2014 5:49:46 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MBAMScheduler service.

.

==== End Of File ===========================

AdvancedSetup · February 8, 2014

You have a proxy set here on the computer which is a bit odd for most users and can typically be a sign of an infection. Did you set a proxy on your computer browser?

uProxyOverride = 127.0.0.1;*.local

Please read the following information below and post back the requested logs when ready.

General P2P/Piracy Warning:

If you're using
Peer 2 Peer
software such as
uTorrent, BitTorrent
or similar you must either fully uninstall them or completely disable them from running while being assisted here.

Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.

If you have
illegal/cracked software, cracks, keygens etc
. on the system, please remove or uninstall them now and read the policy on
Piracy
.

Before we proceed further, please read all of the following instructions carefully.
If there is anything that you do not understand kindly ask before proceeding.
If needed please print out these instructions.

Please do not post logs using CODE, QUOTE, or FONT tags. Just paste them as direct text.
If the log is too large then you can use attachments by clicking on the More Reply Options button.
Please enable your system to show hidden files: How to see hidden files in Windows
Make sure you're subscribed to this topic:
- Click on the Follow This Topic Button (at the top right of this page), make sure that the Receive notification box is checked and that it is set to Instantly
[*]Removing malware can be unpredictable...It is unlikely but things can go very wrong! Please make sure you Backup all files that cannot be replaced if something were to happen. You can copy them to a CD/DVD, external drive or a pen drive [*]Please don't run any other scans, download, install or uninstall any programs unless requested by me while I'm working with you. [*]The removal of malware is not instantaneous, please be patient. Often we are also on a different Time Zone. [*]Perform everything in the correct order. Sometimes one step requires the previous one. [*]If you have any problems while following my instructions, Stop there and tell me the exact nature of the issue. [*]You can check here if you're not sure if your computer is 32-bit or 64-bit [*]Please disable your antivirus while running any requested scanners so that they do not interfere with the scanners. [*]When we are done, I'll give you instructions on how to cleanup all the tools and logs [*]Please stick with me until I give you the "all clear" and Please don't waste my time by leaving before that. [*]Your topic will be closed if you haven't replied within 3 days [*](If I have not responded within 24 hours, please send me a Private Message as a reminder)

STEP 0
RKill is a program that was developed at BleepingComputer.com that attempts to terminate known malware processes
so that your normal security software can then run and clean your computer of infections.
When RKill runs it will kill malware processes and then removes incorrect executable associations and fixes policies
that stop us from using certain tools. When finished it will display a log file that shows the processes that were
terminated while the program was running.

As RKill only terminates a program's running process, and does not delete any files, after running it you should not reboot
your computer as any malware processes that are configured to start automatically will just be started again.
Instead, after running RKill you should immediately scan your computer using the requested scans I've included.

Please download Rkill by Grinler from one of the links below and save it to your desktop.

Link 1

Link 2

On Windows XP double-click on the Rkill desktop icon to run the tool.
On Windows Vista/Windows 7 or 8, right-click on the Rkill desktop icon and select Run As Administrator
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
If the tool does not run from any of the links provided, please let me know.
Do not reboot the computer, you will need to run the application again.

STEP 01
Backup the Registry:
Modifying the Registry can create unforeseen problems, so it always wise to create a backup before doing so.

Please download ERUNT from one of the following links: Link1 | Link2 | Link3
ERUNT (Emergency Recovery Utility NT) is a free program that allows you to keep a complete backup of your registry and restore it when needed.
Double click on erunt-setup.exe to Install ERUNT by following the prompts.
NOTE: Do not choose to allow ERUNT to add an Entry to the Startup folder. Click NO.
Start ERUNT either by double clicking on the desktop icon or choosing to start the program at the end of the setup process.
Choose a location for the backup.
- Note: the default location is C:\Windows\ERDNT which is acceptable.
[*]Make sure that at least the first two check boxes are selected. [*]Click on OK [*]Then click on YES to create the folder. [*]Note: if it is necessary to restore the registry, open the backup folder and start ERDNT.exe

STEP 02
Please download RogueKiller and save it to your desktop.

You can check here if you're not sure if your computer is 32-bit or 64-bit

RogueKiller 32-bit | RogueKiller 64-bit
Quit all running programs.
For Windows XP, double-click to start.
For Vista,Windows 7/8, Right-click on the program and select Run as Administrator to start and when prompted allow it to run.
Read and accept the EULA (End User Licene Agreement)
Click Scan to scan the system.
When the scan completes Close the program > Don't Fix anything!
Don't run any other options, they're not all bad!!
Post back the report which should be located on your desktop.

zalloy · February 8, 2014

Not sure what's going on with the proxy. I don't use any proxies or torrenting software, but I do have Constant Guard from Comcast, and I was using OpenDNS before. When I installed the CG, it disabled the OpenDNS. I only use Norton because Comcast gives it out for free to their customers. I tried other free AV, but most of them seem to be adware. Norton lets everything go by it.

Here are the logs from RKill and RogueKiller:

Rkill 2.6.5 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

More Information about Rkill can be found at this link:

http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 02/08/2014 05:33:00 PM in x64 mode.

Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Windows\system32\crypserv.exe (PID: 1780) [WD-HEUR]

* C:\Users\Laurie\AppData\Local\Temp\8c9feab4-8824-11e3-804b-6805ca1e2e3b\Ninite.exe (PID: 7664) [T-HEUR]

2 proccesses terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Defender Disabled

[HKLM\SOFTWARE\Microsoft\Windows Defender]

"DisableAntiSpyware" = dword:00000001

Checking Windows Service Integrity:

* Windows Defender (WinDefend) is not Running.

Startup Type set to: Manual

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost

Program finished at: 02/08/2014 05:33:49 PM

Execution time: 0 hours(s), 0 minute(s), and 48 seconds(s)

RogueKiller V8.8.6 _x64_ [Feb 7 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Laurie [Admin rights]

Mode : Scan -- Date : 02/08/2014 17:38:18

| ARK || FAK || MBR |

¤¤¤ Bad processes : 1 ¤¤¤

[sUSP PATH] cdswin.exe -- C:\Program Files (x86)\Cloudmark\Desktop\Service\cdswin.exe [7] -> KILLED [TermProc]

¤¤¤ Registry Entries : 4 ¤¤¤

[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND

[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HDS721010CLA332 SATA Disk Device +++++

--- User ---

[MBR] 0898b5c44c58ee2b233b581feea6ca66

[bSP] 072f3ca5aad42da821a8c268faed96c8 : Windows Vista/7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 942267 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1929969664 | Size: 11500 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] 0c959f160c0bfdaccc5ebf7fe9c560d2

[bSP] ede960c251a9b1bd984edccbf8c8278d : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 217933824 | Size: 300 Mo

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) Generic- SD/MMC USB Device +++++

Error reading User MBR! ([0x15] The device is not ready. )

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] The request is not supported. )

+++++ PhysicalDrive2: (\\.\PHYSICALDRIVE2 @ USB) Generic- Compact Flash USB Device +++++

Error reading User MBR! ([0x15] The device is not ready. )

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] The request is not supported. )

+++++ PhysicalDrive3: (\\.\PHYSICALDRIVE3 @ USB) Generic- SM/xD-Picture USB Device +++++

Error reading User MBR! ([0x15] The device is not ready. )

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] The request is not supported. )

+++++ PhysicalDrive4: (\\.\PHYSICALDRIVE4 @ USB) Generic- MS/MS-Pro USB Device +++++

Error reading User MBR! ([0x15] The device is not ready. )

User = LL1 ... OK!

Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_S_02082014_173818.txt >>

RKreport[0]_D_08162013_123712.txt;RKreport[0]_H_08162013_123806.txt;RKreport[0]_S_08162013_123528.txt

AdvancedSetup · February 9, 2014

Okay well hopefully not infected but let's go ahead and run some scans to be sure.

Please go ahead and run through the following steps and post back the logs when ready.

STEP 03
Please download Malwarebytes Anti-Rootkit from here

Unzip the contents to a folder in a convenient location.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder... mbar-log.txt and system-log.txt

STEP 04
Please download Junkware Removal Tool to your desktop.

Shutdown your antivirus to avoid any conflicts.
Right click over JRT.exe and select Run as administrator on Windows Vista or Windows 7, double-click on XP.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next reply message
When completed make sure to re-enable your antivirus

STEP 05
Lets clean out any adware now: (this will require a reboot so save all your work)

Please download AdwCleaner by Xplode and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Please uncheck elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you may want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review. (all items found are adware/spyware/foistware)
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted:
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Then..................

Open up Malwarebytes > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick Scan with Malwarebytes Anti-Malware, post the report.

Make sure that everything is checked, and click Remove Selected.

STEP 06

Please go here to run the online antivirus scannner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
[*]Click Scan [*]Wait for the scan to finish [*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

STEP 07
Please download the Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit

Double-click to run it. When the tool opens click Yes to disclaimer.
Press the Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it also makes another log (Addition.txt). Please attach it to your reply as well.

zalloy · February 9, 2014

Here's the MBAR logs:

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

www.malwarebytes.org

Database version: v2014.02.09.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

Laurie :: ZINCS-HP [administrator]

2/8/2014 10:15:53 PM

mbar-log-2014-02-08 (22-15-53).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 267294

Time elapsed: 13 minute(s), 21 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 1

HKCU\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Delete on reboot.

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

www.malwarebytes.org

Database version: v2014.02.09.01

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16476

Laurie :: ZINCS-HP [administrator]

2/8/2014 10:33:47 PM

mbar-log-2014-02-08 (22-33-47).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 267187

Time elapsed: 13 minute(s), 21 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

Physical Sectors Detected: 0

(No malicious items detected)

(end)

zalloy · February 9, 2014

And the system log:

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.500000 GHz

Memory total: 12615716864, free: 4496420864

Downloaded database version: v2014.02.09.01

Downloaded database version: v2013.12.18.01

=======================================

Initializing...

------------ Kernel report ------------

02/08/2014 22:15:49

------------ Loaded modules -----------

\SystemRoot\system32\ntoskrnl.exe

\SystemRoot\system32\hal.dll

\SystemRoot\system32\kdcom.dll

\SystemRoot\system32\mcupdate_AuthenticAMD.dll

\SystemRoot\system32\PSHED.dll

\SystemRoot\system32\CLFS.SYS

\SystemRoot\system32\CI.dll

\SystemRoot\system32\drivers\Wdf01000.sys

\SystemRoot\system32\drivers\WDFLDR.SYS

\SystemRoot\system32\drivers\ACPI.sys

\SystemRoot\system32\drivers\WMILIB.SYS

\SystemRoot\system32\drivers\msisadrv.sys

\SystemRoot\system32\drivers\pci.sys

\SystemRoot\system32\drivers\vdrvroot.sys

\SystemRoot\system32\drivers\gfibto.sys

\SystemRoot\System32\drivers\partmgr.sys

\SystemRoot\system32\drivers\volmgr.sys

\SystemRoot\System32\drivers\volmgrx.sys

\SystemRoot\System32\drivers\mountmgr.sys

\SystemRoot\system32\drivers\amd_sata.sys

\SystemRoot\system32\drivers\storport.sys

\SystemRoot\system32\drivers\amd_xata.sys

\SystemRoot\system32\drivers\amdxata.sys

\SystemRoot\system32\drivers\fltmgr.sys

\SystemRoot\system32\drivers\N360x64\1501000.012\SYMDS64.SYS

\SystemRoot\system32\drivers\fileinfo.sys

\SystemRoot\system32\drivers\N360x64\1501000.012\SYMEFA64.SYS

\SystemRoot\System32\Drivers\Ntfs.sys

\SystemRoot\System32\Drivers\msrpc.sys

\SystemRoot\System32\Drivers\ksecdd.sys

\SystemRoot\System32\Drivers\cng.sys

\SystemRoot\System32\drivers\pcw.sys

\SystemRoot\System32\Drivers\Fs_Rec.sys

\SystemRoot\system32\drivers\ndis.sys

\SystemRoot\system32\drivers\NETIO.SYS

\SystemRoot\System32\Drivers\ksecpkg.sys

\SystemRoot\System32\drivers\tcpip.sys

\SystemRoot\System32\drivers\fwpkclnt.sys

\SystemRoot\system32\drivers\volsnap.sys

\SystemRoot\System32\Drivers\spldr.sys

\SystemRoot\System32\drivers\rdyboost.sys

\SystemRoot\system32\DRIVERS\NBVol.sys

\SystemRoot\system32\DRIVERS\NBVolUp.sys

\SystemRoot\System32\Drivers\mup.sys

\SystemRoot\System32\drivers\hwpolicy.sys

\SystemRoot\System32\DRIVERS\fvevol.sys

\SystemRoot\system32\drivers\disk.sys

\SystemRoot\system32\drivers\CLASSPNP.SYS

\SystemRoot\system32\drivers\AtiPcie64.sys

\SystemRoot\system32\DRIVERS\cdrom.sys

\SystemRoot\system32\drivers\N360x64\1501000.012\ccSetx64.sys

\SystemRoot\system32\drivers\N360x64\1501000.012\Ironx64.SYS

\SystemRoot\System32\Drivers\Null.SYS

\SystemRoot\System32\Drivers\Beep.SYS

\SystemRoot\System32\drivers\vga.sys

\SystemRoot\System32\drivers\VIDEOPRT.SYS

\SystemRoot\System32\drivers\watchdog.sys

\SystemRoot\System32\DRIVERS\RDPCDD.sys

\SystemRoot\system32\drivers\rdpencdd.sys

\SystemRoot\system32\drivers\rdprefmp.sys

\SystemRoot\System32\Drivers\Msfs.SYS

\SystemRoot\System32\Drivers\Npfs.SYS

\SystemRoot\system32\DRIVERS\tdx.sys

\SystemRoot\system32\DRIVERS\TDI.SYS

\SystemRoot\System32\DRIVERS\netbt.sys

\SystemRoot\system32\drivers\afd.sys

\SystemRoot\system32\drivers\ws2ifsl.sys

\SystemRoot\system32\DRIVERS\wfplwf.sys

\SystemRoot\system32\DRIVERS\pacer.sys

\SystemRoot\system32\DRIVERS\netbios.sys

\SystemRoot\system32\DRIVERS\wanarp.sys

\SystemRoot\system32\drivers\termdd.sys

\SystemRoot\system32\drivers\N360x64\1501000.012\SYMNETS.SYS

\??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS

\SystemRoot\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS

\SystemRoot\system32\DRIVERS\rdbss.sys

\SystemRoot\system32\drivers\nsiproxy.sys

\??\C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\nnfwdk64.sys

\SystemRoot\system32\ckldrv.sys

\SystemRoot\system32\drivers\mssmbios.sys

\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys

\??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys

\SystemRoot\System32\drivers\discache.sys

\SystemRoot\System32\Drivers\dfsc.sys

\SystemRoot\system32\drivers\blbdrive.sys

\??\C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20140121.001\BHDrvx64.sys

\??\C:\Windows\system32\drivers\AntiLog64.sys

\SystemRoot\system32\DRIVERS\tunnel.sys

\SystemRoot\system32\drivers\amdppm.sys

\SystemRoot\system32\DRIVERS\atikmpag.sys

\SystemRoot\system32\DRIVERS\atikmdag.sys

\SystemRoot\System32\drivers\dxgkrnl.sys

\SystemRoot\System32\drivers\dxgmms1.sys

\SystemRoot\system32\drivers\HDAudBus.sys

\SystemRoot\system32\DRIVERS\e1q62x64.sys

\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys

\SystemRoot\system32\DRIVERS\usbohci.sys

\SystemRoot\system32\DRIVERS\USBPORT.SYS

\SystemRoot\system32\drivers\usbfilter.sys

\SystemRoot\system32\DRIVERS\usbehci.sys

\SystemRoot\system32\drivers\wmiacpi.sys

\SystemRoot\system32\drivers\CompositeBus.sys

\SystemRoot\system32\drivers\serscan.sys

\SystemRoot\system32\drivers\ksthunk.sys

\SystemRoot\system32\drivers\ks.sys

\SystemRoot\system32\DRIVERS\AgileVpn.sys

\SystemRoot\system32\DRIVERS\rasl2tp.sys

\SystemRoot\system32\DRIVERS\ndistapi.sys

\SystemRoot\system32\DRIVERS\ndiswan.sys

\SystemRoot\system32\DRIVERS\raspppoe.sys

\SystemRoot\system32\DRIVERS\raspptp.sys

\SystemRoot\system32\DRIVERS\rassstp.sys

\SystemRoot\system32\DRIVERS\kbdclass.sys

\SystemRoot\system32\DRIVERS\mouclass.sys

\SystemRoot\system32\DRIVERS\mcdbus.sys

\SystemRoot\system32\DRIVERS\SCSIPORT.SYS

\SystemRoot\system32\drivers\swenum.sys

\SystemRoot\system32\DRIVERS\amdiox64.sys

\SystemRoot\system32\DRIVERS\umbus.sys

\SystemRoot\system32\DRIVERS\usbhub.sys

\SystemRoot\System32\Drivers\NDProxy.SYS

\SystemRoot\system32\drivers\RTKVHD64.sys

\SystemRoot\system32\drivers\portcls.sys

\SystemRoot\system32\drivers\drmk.sys

\SystemRoot\system32\DRIVERS\usbccgp.sys

\SystemRoot\system32\DRIVERS\USBD.SYS

\SystemRoot\system32\DRIVERS\USBSTOR.SYS

\SystemRoot\system32\drivers\usbaudio.sys

\SystemRoot\system32\DRIVERS\hidusb.sys

\SystemRoot\system32\DRIVERS\HIDCLASS.SYS

\SystemRoot\system32\DRIVERS\HIDPARSE.SYS

\SystemRoot\system32\DRIVERS\cdfs.sys

\SystemRoot\system32\DRIVERS\kbdhid.sys

\SystemRoot\system32\DRIVERS\mouhid.sys

\SystemRoot\System32\win32k.sys

\SystemRoot\System32\drivers\Dxapi.sys

\SystemRoot\System32\Drivers\crashdmp.sys

\SystemRoot\System32\Drivers\dump_diskdump.sys

\SystemRoot\System32\Drivers\dump_amd_sata.sys

\SystemRoot\System32\Drivers\dump_dumpfve.sys

\SystemRoot\system32\DRIVERS\monitor.sys

\SystemRoot\System32\TSDDD.dll

\SystemRoot\System32\cdd.dll

\SystemRoot\System32\ATMFD.DLL

\SystemRoot\system32\drivers\luafv.sys

\??\C:\Windows\system32\drivers\mbam.sys

\SystemRoot\system32\drivers\WudfPf.sys

\SystemRoot\system32\DRIVERS\lltdio.sys

\SystemRoot\system32\DRIVERS\nwifi.sys

\SystemRoot\system32\DRIVERS\ndisuio.sys

\SystemRoot\system32\DRIVERS\pnarp.sys

\SystemRoot\system32\DRIVERS\purendis.sys

\SystemRoot\system32\DRIVERS\rspndr.sys

\SystemRoot\system32\drivers\HTTP.sys

\SystemRoot\system32\DRIVERS\bowser.sys

\SystemRoot\System32\drivers\mpsdrv.sys

\SystemRoot\system32\DRIVERS\mrxsmb.sys

\SystemRoot\system32\DRIVERS\mrxsmb10.sys

\SystemRoot\system32\DRIVERS\mrxsmb20.sys

\??\C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys

\SystemRoot\system32\drivers\npf.sys

\SystemRoot\system32\drivers\peauth.sys

\SystemRoot\System32\Drivers\secdrv.SYS

\SystemRoot\System32\DRIVERS\srvnet.sys

\SystemRoot\System32\drivers\tcpipreg.sys

\SystemRoot\System32\DRIVERS\srv2.sys

\SystemRoot\System32\DRIVERS\srv.sys

\SystemRoot\system32\DRIVERS\WUDFRd.sys

\SystemRoot\system32\drivers\N360x64\1501000.012\SRTSP64.SYS

\SystemRoot\system32\DRIVERS\asyncmac.sys

\??\C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20140207.001\IDSvia64.sys

\??\C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20140208.009\EX64.SYS

\??\C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20140208.009\ENG64.SYS

\??\C:\Windows\system32\drivers\mbamchameleon.sys

\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys

\Windows\System32\ntdll.dll

\Windows\System32\smss.exe

\Windows\System32\apisetschema.dll

----------- End -----------

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk4\DR4

Upper Device Object: 0xfffffa800bdc6080

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\000000a1\

Lower Device Object: 0xfffffa800bdcb080

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk3\DR3

Upper Device Object: 0xfffffa800c1d3080

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\000000a0\

Lower Device Object: 0xfffffa800b00b080

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk2\DR2

Upper Device Object: 0xfffffa800bdc2200

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\0000009f\

Lower Device Object: 0xfffffa800b002080

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xfffffa800c1d4080

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\0000009e\

Lower Device Object: 0xfffffa800bdc3b60

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa800a71c5c0

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\0000006c\

Lower Device Object: 0xfffffa800a609080

Lower Device Driver Name: \Driver\amd_sata\

<<<2>>>

Physical Sector Size: 512

Drive: 0, DevicePointer: 0xfffffa800a71c5c0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800a71d060, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800a71c5c0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800a60d060, DeviceName: Unknown, DriverName: \Driver\amd_xata\

DevicePointer: 0xfffffa800a609080, DeviceName: \Device\0000006c\, DriverName: \Driver\amd_sata\

------------ End ----------

Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\

Upper DeviceData: 0x0, 0x0, 0x0

Lower DeviceData: 0x0, 0x0, 0x0

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 78D42AD7

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 204800

Partition file system is UNKNOWN

Partition is not bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 206848 Numsec = 1929762816

Partition 2 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 1929969664 Numsec = 23552000

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953505168-1953525168)...

Done!

Physical Sector Size: 0

Drive: 1, DevicePointer: 0xfffffa800c1d4080, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800c069060, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800c1d4080, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800bdc4790, DeviceName: Unknown, DriverName: \Driver\usbfilter\

DevicePointer: 0xfffffa800bdc3b60, DeviceName: \Device\0000009e\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 2, DevicePointer: 0xfffffa800bdc2200, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800bdcb580, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800bdc2200, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800b049060, DeviceName: Unknown, DriverName: \Driver\usbfilter\

DevicePointer: 0xfffffa800b002080, DeviceName: \Device\0000009f\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 3, DevicePointer: 0xfffffa800c1d3080, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800bdc7060, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800c1d3080, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800bdc36d0, DeviceName: Unknown, DriverName: \Driver\usbfilter\

DevicePointer: 0xfffffa800b00b080, DeviceName: \Device\000000a0\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 4, DevicePointer: 0xfffffa800bdc6080, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800c069660, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800bdc6080, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800b00bbf0, DeviceName: Unknown, DriverName: \Driver\usbfilter\

DevicePointer: 0xfffffa800bdcb080, DeviceName: \Device\000000a1\, DriverName: \Driver\USBSTOR\

------------ End ----------

Infected: HKCU\SOFTWARE\The Weather Channel --> [Adware.Hotbar]

Scan finished

Creating System Restore point...

Cleaning up...

Removal successful. No system shutdown is required.

=======================================

---------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1009

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16476

File system is: NTFS

Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED

CPU speed: 3.500000 GHz

Memory total: 12615716864, free: 5262217216

=======================================

Initializing...

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...

Removal finished

Done!

<<<1>>>

Upper Device Name: \Device\Harddisk4\DR4

Upper Device Object: 0xfffffa800bdc6080

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\000000a1\

Lower Device Object: 0xfffffa800bdcb080

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk3\DR3

Upper Device Object: 0xfffffa800c1d3080

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\000000a0\

Lower Device Object: 0xfffffa800b00b080

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk2\DR2

Upper Device Object: 0xfffffa800bdc2200

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\0000009f\

Lower Device Object: 0xfffffa800b002080

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk1\DR1

Upper Device Object: 0xfffffa800c1d4080

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\0000009e\

Lower Device Object: 0xfffffa800bdc3b60

Lower Device Driver Name: \Driver\USBSTOR\

<<<1>>>

Upper Device Name: \Device\Harddisk0\DR0

Upper Device Object: 0xfffffa800a71c5c0

Upper Device Driver Name: \Driver\Disk\

Lower Device Name: \Device\0000006c\

Lower Device Object: 0xfffffa800a609080

Lower Device Driver Name: \Driver\amd_sata\

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...

<<<2>>>

<<<3>>>

Volume: C:

File system type: NTFS

SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes

Done!

Drive 0

Scanning MBR on drive 0...

Inspecting partition table:

MBR Signature: 55AA

Disk Signature: 78D42AD7

Partition information:

Partition 0 type is Primary (0x7)

Partition is ACTIVE.

Partition starts at LBA: 2048 Numsec = 204800

Partition file system is UNKNOWN

Partition is not bootable

Partition 1 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 206848 Numsec = 1929762816

Partition 2 type is Primary (0x7)

Partition is NOT ACTIVE.

Partition starts at LBA: 1929969664 Numsec = 23552000

Partition 3 type is Empty (0x0)

Partition is NOT ACTIVE.

Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes

Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953505168-1953525168)...

Done!

Physical Sector Size: 0

Drive: 1, DevicePointer: 0xfffffa800c1d4080, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800c069060, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800c1d4080, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800bdc4790, DeviceName: Unknown, DriverName: \Driver\usbfilter\

DevicePointer: 0xfffffa800bdc3b60, DeviceName: \Device\0000009e\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 2, DevicePointer: 0xfffffa800bdc2200, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800bdcb580, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800bdc2200, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800b049060, DeviceName: Unknown, DriverName: \Driver\usbfilter\

DevicePointer: 0xfffffa800b002080, DeviceName: \Device\0000009f\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 3, DevicePointer: 0xfffffa800c1d3080, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800bdc7060, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800c1d3080, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800bdc36d0, DeviceName: Unknown, DriverName: \Driver\usbfilter\

DevicePointer: 0xfffffa800b00b080, DeviceName: \Device\000000a0\, DriverName: \Driver\USBSTOR\

------------ End ----------

Physical Sector Size: 0

Drive: 4, DevicePointer: 0xfffffa800bdc6080, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

--------- Disk Stack ------

DevicePointer: 0xfffffa800c069660, DeviceName: Unknown, DriverName: \Driver\partmgr\

DevicePointer: 0xfffffa800bdc6080, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\

DevicePointer: 0xfffffa800b00bbf0, DeviceName: Unknown, DriverName: \Driver\usbfilter\

DevicePointer: 0xfffffa800bdcb080, DeviceName: \Device\000000a1\, DriverName: \Driver\USBSTOR\

------------ End ----------

Scan finished

=======================================

Removal queue found; removal started

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...

Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...

Removal finished

zalloy · February 9, 2014

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.1 (02.04.2014:1)

OS: Windows 7 Home Premium x64

Ran by Laurie on Sat 02/08/2014 at 22:55:01.10

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] "hkey_current_user\software\apn pip"

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\adtrustmedia"

Failed to delete: [Folder] "C:\ProgramData\boost_interprocess"

Successfully deleted: [Folder] "C:\Users\Laurie\AppData\Roaming\getrighttogo"

~~~ FireFox

Successfully deleted the following from C:\Users\Laurie\AppData\Roaming\mozilla\firefox\profiles\k4qc5cj9.default\prefs.js

user_pref("extensions.trusted-ads.TrustAd", "{\"r\":[{\"t\":\"FQDN\",\"r\":\"trustedads.adtrustmedia.com\",\"c\":[{\"i\":\"1\",\"s\":[\"display.clickpoint.com\",\"www.africawi

Emptied folder: C:\Users\Laurie\AppData\Roaming\mozilla\firefox\profiles\k4qc5cj9.default\minidumps [3 files]

~~~ Chrome

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\hbcennhacfaagdopikcegfcobcadeocj

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\icdlfehblmklkikfigmjhbmmpmkmpooj

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\pfndaklgolladniicklehhancnlgocpp

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Google\Chrome\Extensions\mhkaekfpcppmmioggniknbnbdbcigpkk

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Sat 02/08/2014 at 23:06:42.50

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

zalloy · February 9, 2014

# AdwCleaner v3.018 - Report created 08/02/2014 at 23:10:45

# Updated 28/01/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Laurie - ZINCS-HP

# Running from : C:\Users\Laurie\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\boost_interprocess

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [OpenDNS Updater]

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5}

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16428

-\\ Mozilla Firefox v27.0 (en-US)

[ File : C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\k4qc5cj9.default\prefs.js ]

[ File : C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\n8eu6h0m.Zalloy\prefs.js ]

-\\ Google Chrome v32.0.1700.107

[ File : C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [2586 octets] - [16/11/2013 09:16:49]

AdwCleaner[R1].txt - [1523 octets] - [08/02/2014 23:09:51]

AdwCleaner[s0].txt - [2663 octets] - [16/11/2013 09:19:15]

AdwCleaner[s1].txt - [1452 octets] - [08/02/2014 23:10:45]

########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [1512 octets] ##########

zalloy · February 9, 2014

And from Eset:

C:\Program Files (x86)\NCH Software\Pixillion\pixillion.exe a variant of Win32/Toolbar.Conduit.J potentially unwanted application

C:\Program Files (x86)\NCH Software\Pixillion\pixsetup_v2.31.exe a variant of Win32/Toolbar.Conduit.J potentially unwanted application

C:\Program Files (x86)\NCH Software\Pixillion\uninst.exe a variant of Win32/Toolbar.Conduit.J potentially unwanted application

C:\Program Files (x86)\NCH Software\Prism\prism.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Program Files (x86)\NCH Software\Prism\prismsetup_v1.79.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Program Files (x86)\NCH Software\Prism\uninst.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Program Files (x86)\NCH Software\Scribe\essetup (1)_v5.32.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Program Files (x86)\NCH Software\Scribe\scribe.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Program Files (x86)\NCH Software\Scribe\uninst.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Program Files (x86)\NCH Software\Switch\switch.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Program Files (x86)\NCH Software\Switch\switchsetup_v4.17.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Program Files (x86)\NCH Software\Switch\uninst.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\ProgramData\NCH Software\FlexiServer\Web\fstasetup.exe a variant of Win32/Toolbar.Conduit.J potentially unwanted application

C:\Users\All Users\NCH Software\FlexiServer\Web\fstasetup.exe a variant of Win32/Toolbar.Conduit.J potentially unwanted application

C:\Users\Laurie\AppData\Local\SupportSoft\ComcastUI\Laurie\CACHE\5599fea7-b9d0-4c48-84c3-66d697784679.exe a variant of Win32/Toolbar.Visicom.B potentially unwanted application

C:\Users\Laurie\Documents\Downloads\avira_free_antivirus_en(1).exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\Laurie\Documents\Downloads\avira_free_antivirus_en.exe a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application

C:\Users\Laurie\Documents\Downloads\cbsidlm-tr1_10a-WinGuggle-SEO-10795752.exe Win32/DownloadAdmin.G potentially unwanted application

C:\Users\Laurie\Documents\Downloads\cbsidlm-tr1_5-JumpStart_World_Kindergarten-10655635.exe Win32/DownloadAdmin.G potentially unwanted application

C:\Users\Laurie\Documents\Downloads\cbsidlm-tr1_6-Active_Ports-29653.exe Win32/DownloadAdmin.G potentially unwanted application

C:\Users\Laurie\Documents\Downloads\ccsetup322.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application

C:\Users\Laurie\Documents\Downloads\ccsetup327.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Documents\Downloads\dfsetup210.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application

C:\Users\Laurie\Documents\Downloads\essetup (1).exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Users\Laurie\Documents\Downloads\ffsetup.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Users\Laurie\Documents\Downloads\hgsetup.exe a variant of Win32/Toolbar.Conduit.K potentially unwanted application

C:\Users\Laurie\Documents\Downloads\ipscan-win32-3.0-beta6.exe Java/AngryIPScan.A potentially unsafe application

C:\Users\Laurie\Documents\Downloads\TuneUpInst-2.4.6.4.exe Win32/OpenCandy potentially unsafe application

C:\Users\Laurie\Documents\Downloads\wpsetup.exe a variant of Win32/Toolbar.Conduit.J potentially unwanted application

C:\Users\Laurie\Documents\Downloads\zaSetupWeb_102_074_000(1).exe Win32/Toolbar.Conduit potentially unwanted application

C:\Users\Laurie\Documents\Downloads\zaSetupWeb_102_074_000.exe Win32/Toolbar.Conduit potentially unwanted application

C:\Users\Laurie\Documents\Downloads\zaSuiteSetupWeb_102_057_000.exe Win32/Toolbar.Conduit potentially unwanted application

C:\Users\Laurie\Documents\Intel Drivers\Norton SecurityPack\ccsetup407.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Documents\Vuze Downloads\CCleaner Professional + Business Edition 4.02.4115 Final Multilanguage - SceneDL (PimpRG)\ccsetup402.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\ccsetup327.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\ccsetup328.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\ccsetup400.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\ccsetup402.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\ccsetup403.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\ccsetup404.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\ccsetup405.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\dfsetup212.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application

C:\Users\Laurie\Downloads\dfsetup213.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application

C:\Users\Laurie\Downloads\dfsetup214.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application

C:\Users\Laurie\Downloads\dfsetup215(1).exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\dfsetup215.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\DriverIdentifier.exe a variant of Win32/OpenInstall potentially unwanted application

C:\Users\Laurie\Downloads\hgsetup.exe a variant of Win32/Toolbar.Conduit.H potentially unwanted application

C:\Users\Laurie\Downloads\rcsetup148.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Laurie\Downloads\TuneUpInst-3.0.0.34.exe Win32/OpenCandy potentially unsafe application

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Coupons.com\ldrtbCoup.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Coupons.com\tbCoup.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Quizulous_v3b\ldrtbQui0.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Quizulous_v3b\ldrtbQuiz.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Quizulous_v3b\tbQui0.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Quizulous_v3b\tbQui1.dll a variant of Win32/Toolbar.Conduit.Y potentially unwanted application

C:\Windows\System32\config\systemprofile\AppData\LocalLow\Quizulous_v3b\tbQuiz.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Coupons.com\ldrtbCoup.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Coupons.com\tbCoup.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Quizulous_v3b\ldrtbQui0.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Quizulous_v3b\ldrtbQuiz.dll a variant of Win32/Toolbar.Conduit.P potentially unwanted application

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Quizulous_v3b\tbQui0.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Quizulous_v3b\tbQui1.dll a variant of Win32/Toolbar.Conduit.Y potentially unwanted application

C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Quizulous_v3b\tbQuiz.dll a variant of Win32/Toolbar.Conduit.B potentially unwanted application

zalloy · February 9, 2014

And FRST.txt (part 1):

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 09-02-2014 02

Ran by Laurie (administrator) on ZINCS-HP on 09-02-2014 12:30:38

Running from C:\Users\Laurie\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(CrypKey (Canada) Ltd.) C:\Windows\system32\crypserv.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Common Files\Nuance\dgnsvc.exe

(Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

(Gladinet, INC) C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

() C:\Program Files (x86)\Nuance\Nuance Cloud Connector\WOSVSSSvr.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(White Sky, Inc.) C:\Program Files (x86)\Constant Guard Protection Suite\IDVaultSvc.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\EKAiOHostService.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe

(The Nielsen Company) C:\Program Files (x86)\NetRatingsNetSight\NetSight\NielsenUpdate.exe

(Interactive Brands Inc.) C:\Program Files (x86)\PDF Suite 2012\HelperService.exe

(Interactive Brands Inc.) C:\Program Files (x86)\PDF Suite 2012\ConversionService.exe

() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe

(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

(Cisco Systems, Inc.) C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

() C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe

(Cloudmark, Inc.) C:\Program Files (x86)\Cloudmark\Desktop\Service\cdswin.exe

(White Sky, Inc.) C:\Program Files (x86)\Constant Guard Protection Suite\IDVault.exe

(Bartels Media GmbH) C:\Program Files (x86)\PhraseExpress\phraseexpress.exe

(Nicolas Kruse) C:\Program Files (x86)\Nettalk6\Nettalk.exe

(The Nielsen Company) C:\Program Files (x86)\NetRatingsNetSight\NetSight\nielsenonline.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(The Nielsen Company) C:\Program Files (x86)\NetRatingsNetSight\NetSight\nielsenonline.exe

(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Create 7\PdfCreate7Hook.exe

(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe

(Secure By Design Inc.) C:\Program Files (x86)\Ninite Updater\NiniteUpdater.exe

(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Secure By Design Inc.) C:\Users\Laurie\AppData\Local\Temp\a1e85e99-9140-11e3-893e-6805ca1e2e3b\Ninite.exe

(The Nielsen Company) C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\NielsenOnline64.exe

(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

(Plex, Inc.) C:\Program Files (x86)\Plex\Plex Media Server\PlexDlnaServer.exe

(Microsoft Corporation) C:\Windows\System32\taskmgr.exe

(Python Software Foundation) C:\Program Files (x86)\Plex\Plex Media Server\PlexScriptHost.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\system32\mspaint.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13662936 2013-10-24] (Realtek Semiconductor)

HKLM-x32\...\Run: [NielsenOnline] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\NielsenOnline.exe [91688 2013-10-30] (The Nielsen Company)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)

HKLM-x32\...\Run: [switchBoard] - C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-07-13] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [PDF7 Registry Controller] - C:\Program Files (x86)\Nuance\PDF Create 7\RegistryController.exe [138528 2011-04-29] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [OmniPage Preload] - C:\Program Files (x86)\Nuance\OmniPage18\OmniPage18.exe [2983200 2011-05-10] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [PDFHook] - C:\Program Files (x86)\Nuance\PDF Create 7\pdfcreate7hook.exe [606496 2011-04-29] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [Nuance OmniPage 18-reminder] - C:\Program Files (x86)\Nuance\OmniPage18\Ereg\Ereg.exe [333088 2010-10-27] (Nuance Communications, Inc.)

HKLM-x32\...\Run: [EKStatusMonitor] - C:\PROGRAM FILES (X86)\KODAK\AIO\STATUSMONITOR\EKStatusMonitor.EXE [2784256 2012-06-19] (Eastman Kodak Company)

HKLM-x32\...\Run: [Ninite Updater] - C:\Program Files (x86)\Ninite Updater\NiniteUpdater.exe [254160 2013-01-30] (Secure By Design Inc.)

HKLM-x32\...\Run: [TkBellExe] - C:\Program Files (x86)\Real\RealPlayer\update\realsched.exe [295512 2013-09-11] (RealNetworks, Inc.)

HKLM-x32\...\Run: [Conime] - %windir%\system32\conime.exe

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

HKLM Group Policy restriction on software: *.ppt.scr <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.wav.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.avi.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.doc.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.gif.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.docx.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.pub.scr <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg.com <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.txt.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt.com <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.txt.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.rar.com <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.rar.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.doc.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wav.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx.com <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.gif.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.avi.com <====== ATTENTION

HKLM Group Policy restriction on software: *.avi.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp.com <====== ATTENTION

HKLM Group Policy restriction on software: *.xls.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.xls.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.png.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt.pif <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wav.com <====== ATTENTION

HKLM Group Policy restriction on software: *.jpg.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.gif.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf.exe <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.wav.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg.scr <====== ATTENTION

HKLM Group Policy restriction on software: *‮* <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.pdf.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wma.com <====== ATTENTION

HKLM Group Policy restriction on software: *.pub.pif <====== ATTENTION

HKLM Group Policy restriction on software: C:\Users\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.divx.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3.pif <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.png.com <====== ATTENTION

HKLM Group Policy restriction on software: *.xlsx.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.7z.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.txt.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.xls.com <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.ppt.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.wma.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.pub.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wma.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.7z.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.png.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.mp3.scr <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.divx.com <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4.com <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.zip.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.mp4.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.xls.exe <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.rar.pif <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx.com <====== ATTENTION

HKLM Group Policy restriction on software: *.zip.pif <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.docx.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\*\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.doc.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.rtf.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.doc.com <====== ATTENTION

HKLM Group Policy restriction on software: *.png.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.txt.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.avi.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv.scr <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\Microsoft\Windows\Start Menu\Programs\Startup\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx.pif <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\*.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.wma.pif <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*.com <====== ATTENTION

HKLM Group Policy restriction on software: *.bmp.scr <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\*.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.wmv.com <====== ATTENTION

HKLM Group Policy restriction on software: *.7z.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.divx.exe <====== ATTENTION

HKLM Group Policy restriction on software: *.pub.com <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*\*.com <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.pptx.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.rar.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.zip.com <====== ATTENTION

HKLM Group Policy restriction on software: *:\$Recycle.Bin\*\*\*.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.docx.com <====== ATTENTION

HKLM Group Policy restriction on software: *.jpeg.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.docx.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.gif.pif <====== ATTENTION

HKLM Group Policy restriction on software: *.zip.scr <====== ATTENTION

HKLM Group Policy restriction on software: *.7z.com <====== ATTENTION

HKLM Group Policy restriction on software: *.divx.pif <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\mjusbsp\cdloader2.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\mjusbsp\magicjacksplash.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\cis31.exe <====== ATTENTION

HKLM Group Policy restriction on software: %programdata%\cis31.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\mjusbsp\magicjack.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\mjusbsp\magicjacksplash.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\mjusbsp\magicjackloader.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\mjusbsp\magicjackloader.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\mjusbsp\magicjackloader.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Roaming\mjusbsp\magicjack.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\mjusbsp\cdloader2.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\mjusbsp\magicjacksplash.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\Local\mjusbsp\cdloader2.exe <====== ATTENTION

HKLM Group Policy restriction on software: %userprofile%\AppData\LocalLow\mjusbsp\magicjack.exe <====== ATTENTION

HKU\.DEFAULT\...\RunOnce: [KodakHomeCenter] - C:\Program Files (x86)\Kodak\AiO\Center\AiOHomeCenter.exe [2234840 2012-06-18] (Eastman Kodak Company)

HKU\.DEFAULT\...\RunOnce: [DeleteEngineAfterUpdate] - reg DELETE HKCU\Software\AppDataLow\Software\ConduitEngine /f

HKU\S-1-5-21-3877766120-1356258156-1109172098-1001\...\Run: [Plex Media Server] - C:\Program Files (x86)\Plex\Plex Media Server\Plex Media Server.exe [4277896 2013-12-23] (Plex, Inc.)

HKU\S-1-5-21-3877766120-1356258156-1109172098-1001\...\Run: [GoogleChromeAutoLaunch_E76C975296F20119B357F0CF28EB7223] - C:\Program Files (x86)\Google\Chrome\Application\chrome.exe [866632 2014-02-01] (Google Inc.)

HKU\S-1-5-21-3877766120-1356258156-1109172098-1001\...\Run: [GoogleDriveSync] - C:\Program Files (x86)\Google\Drive\googledrivesync.exe [21822128 2014-01-30] (Google)

HKU\S-1-5-21-3877766120-1356258156-1109172098-1001\...\Run: [TWC.Win7] - C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exe [53584 2014-01-22] ()

HKU\S-1-5-21-3877766120-1356258156-1109172098-1001\...\Policies\Explorer: [NoInstrumentation] 1

Startup: C:\Users\Laurie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nettalk.lnk

ShortcutTarget: Nettalk.lnk -> C:\Program Files (x86)\Nettalk6\Nettalk.exe (Nicolas Kruse)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

URLSearchHook: HKCU - (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM - {31FFE585-89DE-4774-982F-B48BE6BD24D3} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}

SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}

SearchScopes: HKCU - DefaultScope Comcast URL = http://search.xfinity.com/?cat=subweb&con=mmchrome&q={searchTerms}&cid=xfstart_tech_search

SearchScopes: HKCU - Comcast URL = http://search.xfinity.com/?cat=subweb&con=mmchrome&q={searchTerms}&cid=xfstart_tech_search

SearchScopes: HKCU - {6b0d4c9d-c6eb-4a9a-981c-ac3f9d8373c0} URL = http://search.xfinity.com/?cat=subweb&con=mmchrome&cid=xfstart_tech_search&q={searchTerms}

SearchScopes: HKCU - {7FEC9D41-B753-41EE-8F57-6E887C0E4827} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=994519&p={searchTerms}

SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-1/4?mpre=http://shop.ebay.com/?_nkw={searchTerms}

BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)

BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)

BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Constant Guard Protection Suite - {B84CDBE7-1B46-494B-A188-01D4C52DEB61} - C:\ProgramData\White Sky, Inc\ID Vault\IEBHO1.13.1211.1\NativeBHO.dll (WhiteSky)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - The Weather Channel Toolbar - {2E5E800E-6AC0-411E-940A-369530A35E43} - C:\Windows\SysWow64\TwcToolbarIe7.dll ()

Toolbar: HKLM-x32 - No Name - {11aa5c56-b4e2-4b8f-803a-d340415532f3} - No File

Toolbar: HKLM-x32 - No Name - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - No File

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)

Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

DPF: HKLM-x32 {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} http://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll

Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\amd64\puresp4.dll (Cisco Systems, Inc.)

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files (x86)\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Hosts: 127.0.0.1 localhost

Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76

Tcpip\..\Interfaces\{4AAE8CCC-600E-457C-AA28-C0D50643B0CA}: [NameServer]208.67.222.222,208.67.220.220

Tcpip\..\Interfaces\{C92ED2A1-DD1B-4AB0-ABFC-F7CBA6D0159A}: [NameServer]75.75.75.75,75.75.76.76

zalloy · February 9, 2014

And FRST.txt (part 2):

FireFox:

========

FF ProfilePath: C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\n8eu6h0m.Zalloy

FF SelectedSearchEngine: Yahoo

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_44.dll ()

FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_44.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF Plugin-x32: @microsoft.com/GENUINE - C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @millisecond.com/npInquisit,version=3.0 - C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3050.dll (Millisecond Software)

FF Plugin-x32: @nielsen/FirefoxTracker - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\FirefoxAddOns\npfirefoxtracker.dll (Nielsen)

FF Plugin-x32: @nullsoft.com/winampDetector;version=1 - C:\Program Files (x86)\Winamp Detect\npwachk.dll (Nullsoft, Inc.)

FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)

FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\Laurie\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)

FF Plugin HKCU: @hulu.com/Hulu Desktop - C:\Users\Laurie\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll (Hulu LLC)

FF Plugin HKCU: @millisecond.com/npInquisit,version=3.0 - C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3050.dll (Millisecond Software)

FF Extension: PrivDog - C:\Users\Laurie\AppData\Roaming\Mozilla\Firefox\Profiles\n8eu6h0m.Zalloy\Extensions\PrivDog@AdTrustMedia.com.xpi [2013-11-12]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-10-03]

FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-10-03]

FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-09-11]

FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-09-28]

FF HKLM-x32\...\Firefox\Extensions: [{C3949AC2-4B17-43ee-B4F1-D26B9D42404D}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext

FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-09-28]

FF HKLM-x32\...\Firefox\Extensions: [FFPDFConverter2012@ib.com] - C:\Program Files (x86)\PDF Suite 2012\firefoxextension2012

FF Extension: PDF Suite 2012 Converter For Firefox - C:\Program Files (x86)\PDF Suite 2012\firefoxextension2012 [2012-08-12]

FF HKLM-x32\...\Firefox\Extensions: [netsight@nielsen.com] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\FirefoxAddOns\netsight@nielsen.xpi

FF Extension: Nielsen NetSight - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\FirefoxAddOns\netsight@nielsen.xpi [2014-02-08]

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-04-16]

FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\

FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext\ []

FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF

FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2013-11-14]

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn\

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn\ []

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-04-16]

Chrome:

=======

CHR HomePage:

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\pdf.dll ()

CHR Plugin: (NielsenOnline) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgceplfonlgodadnpognljgdjlcnpjnh\1.7.2_0\chrometracker.dll No File

CHR Plugin: (Conduit Chrome Plugin) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpijjmpahflnipadmlpgbjmagmjchkk\10.11.21.5_0\plugins/ConduitChromeApiPlugin.dll No File

CHR Plugin: (Conduit Radio Plugin) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojpijjmpahflnipadmlpgbjmagmjchkk\10.11.21.5_0\plugins/np-cwmp.dll No File

CHR Plugin: (Authorware Web Player) - C:\Program Files (x86)\Mozilla Firefox\plugins\np32asw.dll No File

CHR Plugin: (CouponNetwork Coupon Activator Netscape Plugin v. 5.0.0.0) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll No File

CHR Plugin: (Coupons Inc., Coupon Printer Manager ) - C:\Program Files (x86)\Mozilla Firefox\plugins\npCouponPrinter.dll No File

CHR Plugin: (Coupons Inc., Coupon Printer Manager ) - C:\Program Files (x86)\Mozilla Firefox\plugins\npMozCouponPrinter.dll No File

CHR Plugin: (RealPlayer G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files (x86)\Mozilla Firefox\plugins\nppl3260.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin6.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files (x86)\Mozilla Firefox\plugins\npqtplugin7.dll No File

CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprjplug.dll No File

CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files (x86)\Mozilla Firefox\plugins\nprpplugin.dll No File

CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Users\Laurie\AppData\Roaming\Mozilla\plugins\np-mswmp.dll No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL No File

CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File

CHR Plugin: (Java Platform SE 7 U9) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Inquisit Web Edition) - C:\Program Files (x86)\Millisecond Software\Inquisit 3.0 Mozilla Plugin\npInquisit_3050.dll (Millisecond Software)

CHR Plugin: (Nielsen FirefoxTracker Plug-in) - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter1\FirefoxAddOns\npfirefoxtracker.dll No File

CHR Plugin: (VLC Web Plugin) - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (RealNetworks Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)

CHR Plugin: (RealPlayer HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)

CHR Plugin: (Hulu Desktop) - C:\Users\Laurie\AppData\Local\HuluDesktop\instances\0.9.14.1\nphdplg.dll (Hulu LLC)

CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_4_402_287.dll No File

CHR Plugin: (Java Deployment Toolkit 7.0.70.11) - C:\Windows\SysWOW64\npDeployJava1.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

CHR Extension: (Your Second Phone) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\afgcliennfocnaoenlkmlhoakpaflpgo [2012-11-08]

CHR Extension: (myPlex Queue Extension) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\agmheakklldmclgmkfnncddgkiibboil [2012-11-08]

CHR Extension: (Quttera URL Scanner) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\akakpmcaifloabilokpjlaipdkoofldh [2012-11-08]

CHR Extension: (reddit companion) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\algjnflpgoopkdijmkalfcifomdhmcbe [2012-11-20]

CHR Extension: (Google Docs) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-11-14]

CHR Extension: (Google Drive) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2012-11-08]

CHR Extension: (WOT) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2012-11-08]

CHR Extension: (YouTube) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2012-11-08]

CHR Extension: (DuckDuckGo for Chrome) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpphkkgodbfncbcpgopijlfakfgmclao [2013-12-01]

CHR Extension: (Look of Disapproval) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\cmomlddchhdnchpieaalgkpgaafohlbn [2013-12-07]

CHR Extension: (Google Search) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2012-11-08]

CHR Extension: (HelloSign for Gmail) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\dciflieigdmogpmamcgbigingaodhnil [2014-01-11]

CHR Extension: (Tampermonkey) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\dhdgffkkebhmkfjojejmpbldmpobfkfo [2013-09-13]

CHR Extension: (Ark Browser Plugin) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\edppjepaddkecolndfomijbbccbepinm [2014-01-07]

CHR Extension: (XFINITY Constant Guard Protection Suite) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\faknfdmfmhcmgphbfjhgmomfcihmocmp [2014-01-12]

CHR Extension: (AdBlock) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-11-08]

CHR Extension: (Dictionary by Dictionary.com) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\gikhgcaliglmioibbockkmjknfnepbdh [2014-01-11]

CHR Extension: (Who just called me) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\glhcgdibajkpglmfokkdonkhlekfepkk [2012-11-08]

CHR Extension: (Rapportive) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\hihakjfhbmlmjdnnhegiciffjplmdhin [2013-12-07]

CHR Extension: (Crackle) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibfamoapbmmmlknoopmmfofgladlinic [2013-12-18]

CHR Extension: (Cloud Reader) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdipabjmbhpdkjaihfjoikhjjeneebd [2012-11-08]

CHR Extension: (RealDownloader) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-01-05]

CHR Extension: (World Weather) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\jefnaahehlimdapgicdacbgklnedgoje [2012-11-08]

CHR Extension: (Nielsen) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\jgceplfonlgodadnpognljgdjlcnpjnh [2012-11-08]

CHR Extension: (Reddit Enhancement Suite) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\kbmfpngjjgdllneeigpgjifpgocmfgmb [2012-12-09]

CHR Extension: (The Great Suspender) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\klbibkeccnjlkjkiokjodocebajanakg [2013-10-14]

CHR Extension: (WorkFlowy) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\koegeopamaoljbmhnfjbclbocehhgmkm [2014-01-11]

CHR Extension: (SaferChrome) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lgpkjjingioekjianemgdobchenebhek [2012-11-08]

CHR Extension: (Skype Click to Call) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-10-03]

CHR Extension: (Norton Identity Protection) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2013-11-14]

CHR Extension: (AutoPager Chrome) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmgagnmbebdebebbcleklifnobamjonh [2013-09-13]

CHR Extension: (USA Live TV) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmmeaepdaebmaapbobonajamkacmecif [2012-11-08]

CHR Extension: (Doom + Hexen + Heretic, the originals) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\negldoenmhdionjghohdjipppiicoedl [2012-11-08]

CHR Extension: (Google Wallet) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-13]

CHR Extension: (Advanced Scientific Calci) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\okoiphachmdeohichmbglbllbhhphhcp [2014-01-11]

CHR Extension: (Gmail) - C:\Users\Laurie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2012-11-08]

CHR HKLM-x32\...\Chrome\Extension: [bakaaanikglogbgdnnkhieaaadpnkggc] - C:\Users\Laurie\AppData\Local\Temp\tbch.crx [2012-11-08]

CHR HKLM-x32\...\Chrome\Extension: [bejbohlohkkgompgecdcbbglkpjfjgdj] - C:\Users\Laurie\AppData\Local\Temp\crx21EB.tmp [2012-11-08]

CHR HKLM-x32\...\Chrome\Extension: [dpbpjieokaijmjdlpgineaneljocdggi] - C:\Users\Laurie\AppData\Local\Temp\dpbpjieokaijmjdlpgineaneljocdggi.crx [2012-11-08]

CHR HKLM-x32\...\Chrome\Extension: [gclijllifhfpomppedeljakfegbcpojn] - C:\Users\Laurie\AppData\Local\Temp\tbch.crx [2012-11-08]

CHR HKLM-x32\...\Chrome\Extension: [ghnpfkmgeiojiaheaiefkilmjinpoccb] - C:\Users\Laurie\AppData\Local\Temp\ghnpfkmgeiojiaheaiefkilmjinpoccb.crx [2012-11-08]

CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]

CHR HKLM-x32\...\Chrome\Extension: [jgceplfonlgodadnpognljgdjlcnpjnh] - C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\extension.crx [2013-12-20]

CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-09-16]

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\Exts\Chrome.crx [2014-01-23]

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2011-07-13] (Advanced Micro Devices, Inc.)

R2 Crypkey License; C:\Windows\system32\crypserv.exe [122880 2008-05-07] (CrypKey (Canada) Ltd.)

R2 GladFileMonSvc; C:\Program Files (x86)\Nuance\Nuance Cloud Connector\GladFileMonSvc.exe [29552 2011-05-09] (Gladinet, INC)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 N360; C:\Program Files (x86)\Norton Security Suite\Engine\21.1.0.18\N360.exe [264360 2013-10-18] (Symantec Corporation)

R2 NielsenUpdate; C:\Program Files (x86)\NetRatingsNetSight\NetSight\NielsenUpdate.exe [2838568 2013-10-30] (The Nielsen Company)

R2 PDF Suite 2012 Helper Service; C:\Program Files (x86)\PDF Suite 2012\HelperService.exe [815496 2012-07-31] (Interactive Brands Inc.)

R2 PDF Suite 2012 Service; C:\Program Files (x86)\PDF Suite 2012\ConversionService.exe [724360 2012-07-31] (Interactive Brands Inc.)

R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()

S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2010-06-25] (CACE Technologies, Inc.)

R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2013-10-16] (Realtek Semiconductor)

==================== Drivers (Whitelisted) ====================

R1 AntiLog32; C:\Windows\system32\drivers\AntiLog64.sys [49240 2014-01-11] (Zemana Ltd.)

S3 AODDriver4.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [55424 2011-06-24] (Advanced Micro Devices)

R1 BHDrvx64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\BASHDefs\20140121.001\BHDrvx64.sys [1526488 2013-12-17] (Symantec Corporation)

R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1501000.012\ccSetx64.sys [162392 2013-09-25] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-20] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-20] (Symantec Corporation)

R0 gfibto; C:\Windows\System32\drivers\gfibto.sys [14456 2013-06-08] (GFI Software)

R1 IDSVia64; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\IPSDefs\20140207.001\IDSvia64.sys [521944 2014-01-20] (Symantec Corporation)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

S3 MREMP50; C:\Program Files (x86)\Common Files\Motive\MREMP50.sys [21248 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))

S3 MREMP50a64; C:\Program Files\Common Files\Motive\MREMP50a64.sys [43008 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))

S3 MRESP50; C:\Program Files (x86)\Common Files\Motive\MRESP50.sys [20096 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))

S3 MRESP50a64; C:\Program Files\Common Files\Motive\MRESP50a64.sys [40960 2012-06-11] (Printing Communications Assoc., Inc. (PCAUSA))

R3 NAVENG; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20140208.009\ENG64.SYS [126040 2013-12-18] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton Security Suite\NortonData\21.1.0.18\Definitions\VirusDefs\20140208.009\EX64.SYS [2099288 2013-12-18] (Symantec Corporation)

R1 NetworkX; C:\Windows\system32\ckldrv.sys [28664 2008-03-17] ()

R1 nnfwdk; C:\Program Files (x86)\NetRatingsNetSight\NetSight\meter7\nnfwdk64.sys [26664 2013-12-18] (The Nielsen Company)

R2 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.)

S3 prwntdrv; C:\Windows\system32\prwntdrv.sys [16776 2010-08-25] ()

S3 prwntdrv; C:\Windows\SysWOW64\prwntdrv.sys [13704 2010-08-25] ()

S3 pwdrvio; C:\Windows\system32\pwdrvio.sys [19936 2010-04-09] ()

S3 pwdspio; C:\Windows\system32\pwdspio.sys [13280 2010-04-09] ()

S3 rspSanity; C:\Windows\System32\DRIVERS\rspSanity64.sys [29752 2010-08-23] (Resplendence Software Projects Sp.)

S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)

R3 SRTSP; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSP64.SYS [858200 2013-09-26] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1501000.012\SRTSPX64.SYS [36952 2013-09-09] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\N360x64\1501000.012\SYMDS64.SYS [493656 2013-09-09] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\N360x64\1501000.012\SYMEFA64.SYS [1147480 2013-09-26] (Symantec Corporation)

R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-14] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\N360x64\1501000.012\Ironx64.SYS [264280 2013-09-26] (Symantec Corporation)

R1 SymNetS; C:\Windows\system32\drivers\N360x64\1501000.012\SYMNETS.SYS [590936 2013-09-25] (Symantec Corporation)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

U2 ccEvtMgr;

U2 ccSetMgr;

S3 keycrypt; system32\DRIVERS\KeyCrypt64.sys [X]

S3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [X]

S3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [X]

U3 navapsvc;

U3 SAVRT;

U1 SAVRTPEL;

U3 TlntSvr;

S3 WUSB54GSCv2.NTamd64; system32\DRIVERS\WUSB54GSCV2_AMD64.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-09 12:30 - 2014-02-09 12:31 - 00057926 _____ () C:\Users\Laurie\Desktop\FRST.txt

2014-02-09 12:25 - 2014-02-09 12:30 - 00000000 ____D () C:\FRST

2014-02-09 12:25 - 2014-02-09 12:25 - 02170880 _____ (Farbar) C:\Users\Laurie\Desktop\FRST64.exe

2014-02-09 12:24 - 2014-02-09 12:24 - 00008267 _____ () C:\Users\Laurie\Desktop\eset.txt

2014-02-09 10:22 - 2014-02-09 10:22 - 02347384 _____ (ESET) C:\Users\Laurie\Desktop\esetsmartinstaller_enu (1).exe

2014-02-09 08:24 - 2014-02-09 08:24 - 02347384 _____ (ESET) C:\Users\Laurie\Desktop\esetsmartinstaller_enu.exe

2014-02-08 23:14 - 2014-02-08 23:14 - 00003364 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3877766120-1356258156-1109172098-1001

2014-02-08 23:14 - 2014-02-08 23:14 - 00000000 ____D () C:\ProgramData\boost_interprocess

2014-02-08 23:06 - 2014-02-08 23:06 - 00001869 _____ () C:\Users\Laurie\Desktop\JRT.txt

2014-02-08 22:34 - 2014-02-08 22:34 - 01166132 _____ () C:\Users\Laurie\Desktop\AdwCleaner.exe

2014-02-08 22:34 - 2014-02-08 22:34 - 01037530 _____ (Thisisu) C:\Users\Laurie\Desktop\JRT.exe

2014-02-08 22:15 - 2014-02-08 22:54 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-02-08 22:15 - 2014-02-08 22:33 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-02-08 22:15 - 2014-02-08 22:33 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-02-08 22:15 - 2014-02-08 22:15 - 00000000 ____D () C:\Users\Laurie\Desktop\MBAM-AR

2014-02-08 22:14 - 2014-02-08 22:14 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Laurie\Desktop\mbar-1.07.0.1009.exe

2014-02-08 17:38 - 2014-02-08 17:38 - 00003127 _____ () C:\Users\Laurie\Desktop\RKreport[0]_S_02082014_173818.txt

2014-02-08 17:34 - 2014-02-08 17:34 - 00000930 _____ () C:\Users\Laurie\Desktop\NTREGOPT.lnk

2014-02-08 17:34 - 2014-02-08 17:34 - 00000911 _____ () C:\Users\Laurie\Desktop\ERUNT.lnk

2014-02-08 17:34 - 2014-02-08 17:34 - 00000000 ____D () C:\Program Files (x86)\ERUNT

2014-02-08 17:33 - 2014-02-08 17:33 - 00002740 _____ () C:\Users\Laurie\Desktop\Rkill.txt

2014-02-08 16:35 - 2014-02-08 16:35 - 04403200 _____ () C:\Users\Laurie\Desktop\RogueKillerX64.exe

2014-02-08 16:35 - 2014-02-08 16:35 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Laurie\Desktop\rkill.exe

2014-02-08 16:35 - 2014-02-08 16:35 - 00791393 _____ (Lars Hederer ) C:\Users\Laurie\Desktop\erunt-setup.exe

2014-02-07 17:50 - 2014-02-07 17:50 - 00027093 _____ () C:\Users\Laurie\Desktop\dds.txt

2014-02-07 17:46 - 2014-02-07 17:46 - 00688992 ____R (Swearware) C:\Users\Laurie\Desktop\dds.com

2014-02-07 17:40 - 2014-02-07 17:41 - 00065325 _____ () C:\Users\Laurie\Desktop\CheckResults.txt

2014-02-07 14:42 - 2014-02-07 14:42 - 00353352 _____ (Malwarebytes Corporation) C:\Users\Laurie\Desktop\mbam-check-2.0.0.1000.exe

2014-02-07 07:52 - 2014-02-07 07:52 - 00001082 _____ () C:\Users\Public\Desktop\Google Drive.lnk

2014-02-05 22:22 - 2014-02-05 22:35 - 00000000 ____D () C:\ProgramData\Cloudmark

2014-02-05 22:22 - 2014-02-05 22:23 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\Cloudmark

2014-02-05 22:22 - 2014-02-05 22:22 - 00000000 ____D () C:\Program Files (x86)\Cloudmark

2014-02-05 17:23 - 2014-02-05 17:23 - 00599089 _____ () C:\Users\Laurie\Documents\Balance Sheet - Rent

2014-02-05 13:03 - 2014-02-05 13:03 - 00000000 ____D () C:\Users\Laurie\AppData\Local\Skype

2014-02-04 22:07 - 2014-02-04 22:07 - 00001072 _____ () C:\Users\Public\Desktop\VLC media player.lnk

2014-02-04 13:41 - 2014-02-04 13:41 - 23642336 _____ (Cloudmark, Inc.) C:\Users\Laurie\Downloads\CloudmarkDesktopOne1.5.0.exe

2014-01-30 15:34 - 2014-01-30 15:34 - 00000736 _____ () C:\Users\Laurie\Downloads\LeadFerret_vCard_Margaret_Castillo.vcf

2014-01-28 09:05 - 2014-01-28 09:05 - 13318496 _____ (Bartels Media GmbH ) C:\Users\Laurie\Downloads\PhraseExpressSetup (5).exe

2014-01-28 09:04 - 2014-02-03 18:33 - 00002104 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-01-28 09:01 - 2014-02-04 18:06 - 00002771 _____ () C:\Users\Public\Desktop\Desktop Weather.lnk

2014-01-28 09:00 - 2014-02-05 18:25 - 00003342 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3877766120-1356258156-1109172098-1001

2014-01-25 11:08 - 2014-01-25 11:08 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-01-25 11:08 - 2014-01-25 11:08 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-25 11:08 - 2014-01-25 11:08 - 00000000 ____D () C:\Program Files\iTunes

2014-01-25 11:08 - 2014-01-25 11:08 - 00000000 ____D () C:\Program Files\iPod

2014-01-25 11:04 - 2014-01-25 11:04 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\DropboxMaster

2014-01-25 11:03 - 2014-01-25 11:03 - 00002697 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-01-25 11:02 - 2014-02-09 11:52 - 00000540 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3877766120-1356258156-1109172098-1001.job

2014-01-25 11:02 - 2014-02-03 19:03 - 00003572 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3877766120-1356258156-1109172098-1001

2014-01-18 21:54 - 2014-01-18 21:54 - 00002223 _____ () C:\Users\Laurie\Desktop\HP Support Assistant.lnk

2014-01-18 21:52 - 2014-01-18 21:52 - 00000000 ____D () C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}

2014-01-17 14:25 - 2014-01-17 14:25 - 00020480 _____ () C:\Users\Laurie\Downloads\vcfviewer-1.1.exe

2014-01-17 14:13 - 2014-01-17 14:13 - 00000669 _____ () C:\Users\Laurie\Downloads\LeadFerret_vCard_Steve_Lagnado.vcf

2014-01-17 13:07 - 2014-02-08 23:14 - 00000000 ___RD () C:\Users\Laurie\Google Drive

2014-01-17 13:07 - 2014-01-17 13:07 - 00001704 _____ () C:\Users\Laurie\Desktop\Google Drive.lnk

2014-01-17 13:04 - 2014-02-07 07:52 - 00002044 _____ () C:\Users\Public\Desktop\Google Slides.lnk

2014-01-17 13:04 - 2014-02-07 07:52 - 00002042 _____ () C:\Users\Public\Desktop\Google Sheets.lnk

2014-01-17 13:04 - 2014-02-07 07:52 - 00002032 _____ () C:\Users\Public\Desktop\Google Docs.lnk

2014-01-17 13:03 - 2014-01-17 13:03 - 00819136 _____ (Google Inc.) C:\Users\Laurie\Downloads\googledrivesync.exe

2014-01-16 20:39 - 2014-01-16 20:49 - 00000000 ____D () C:\Users\Laurie\Documents\EllaSchool

2014-01-16 09:40 - 2014-01-16 09:40 - 00000000 ____D () C:\Program Files (x86)\LG Electronics

2014-01-16 09:38 - 2014-01-16 09:39 - 11412680 _____ (LG Electronics) C:\Users\Laurie\Downloads\LGUnitedMobileDriver_S50MAN310AP22_ML_WHQL_Ver_3.10.1.exe

2014-01-14 20:21 - 2014-01-14 20:21 - 63048176 _____ (Plex, Inc.) C:\Users\Laurie\Downloads\Plex-Media-Server-0.9.818.290-11b7fdd-en-US (1).exe

2014-01-14 16:33 - 2013-11-26 20:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys

2014-01-14 16:33 - 2013-11-26 20:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys

2014-01-14 16:33 - 2013-11-26 20:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys

2014-01-14 16:33 - 2013-11-26 20:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys

2014-01-14 16:33 - 2013-11-26 20:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys

2014-01-14 16:33 - 2013-11-26 20:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys

2014-01-14 16:33 - 2013-11-26 20:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys

2014-01-14 16:33 - 2013-11-26 06:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

2014-01-14 16:33 - 2013-11-26 05:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-01-14 16:30 - 2014-01-14 16:30 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-01-14 16:30 - 2014-01-14 16:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-01-14 16:30 - 2014-01-14 16:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-01-14 16:30 - 2014-01-14 16:30 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-01-14 16:30 - 2014-01-14 16:29 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-01-14 16:30 - 2014-01-14 16:29 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-01-14 16:30 - 2014-01-14 16:29 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-01-14 16:30 - 2014-01-14 16:29 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll

2014-01-11 10:48 - 2014-01-11 10:48 - 00000892 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk

2014-01-11 10:48 - 2014-01-11 10:48 - 00000000 ____D () C:\Program Files\Calibre2

2014-01-11 10:35 - 2014-01-11 10:35 - 59711488 _____ () C:\Users\Laurie\Downloads\calibre-64bit-1.19.0.msi

2014-01-11 10:29 - 2014-01-11 10:29 - 00002305 _____ () C:\Users\Laurie\Desktop\Chrome App Launcher.lnk

2014-01-11 10:29 - 2014-01-11 10:29 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome

2014-01-11 10:15 - 2014-01-11 10:15 - 00049240 _____ (Zemana Ltd.) C:\Windows\system32\Drivers\AntiLog64.sys

2014-01-11 10:15 - 2014-01-11 10:15 - 00000000 ____D () C:\Windows\SysWOW64\ZALSDK_uninst

2014-01-11 10:15 - 2014-01-11 10:15 - 00000000 ____D () C:\Users\Laurie\AppData\Local\Zemana

2014-01-11 10:15 - 2013-10-16 13:03 - 10674488 _____ (Zemana Ltd.) C:\Windows\SysWOW64\ZALSDKCore.dll

2014-01-11 10:14 - 2014-01-11 10:14 - 20602120 _____ (White Sky, Inc.) C:\Users\Laurie\Downloads\constantguard (1).exe

2014-01-11 10:14 - 2014-01-11 10:14 - 00002267 _____ () C:\Users\Public\Desktop\Constant Guard.lnk

==================== One Month Modified Files and Folders =======

2014-02-09 12:31 - 2014-02-09 12:30 - 00057926 _____ () C:\Users\Laurie\Desktop\FRST.txt

2014-02-09 12:30 - 2014-02-09 12:25 - 00000000 ____D () C:\FRST

2014-02-09 12:29 - 2011-08-17 10:54 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-09 12:25 - 2014-02-09 12:25 - 02170880 _____ (Farbar) C:\Users\Laurie\Desktop\FRST64.exe

2014-02-09 12:24 - 2014-02-09 12:24 - 00008267 _____ () C:\Users\Laurie\Desktop\eset.txt

2014-02-09 11:58 - 2012-05-08 10:39 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-09 11:52 - 2014-01-25 11:02 - 00000540 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3877766120-1356258156-1109172098-1001.job

2014-02-09 11:29 - 2011-08-17 10:54 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-09 10:27 - 2011-07-23 16:55 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\ID Vault

2014-02-09 10:22 - 2014-02-09 10:22 - 02347384 _____ (ESET) C:\Users\Laurie\Desktop\esetsmartinstaller_enu (1).exe

2014-02-09 08:24 - 2014-02-09 08:24 - 02347384 _____ (ESET) C:\Users\Laurie\Desktop\esetsmartinstaller_enu.exe

2014-02-09 03:00 - 2011-07-21 15:13 - 01944671 _____ () C:\Windows\WindowsUpdate.log

2014-02-08 23:23 - 2009-07-13 23:45 - 00024608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-08 23:23 - 2009-07-13 23:45 - 00024608 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-08 23:23 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF

2014-02-08 23:15 - 2013-06-08 20:54 - 00000000 ____D () C:\ID Vault

2014-02-08 23:14 - 2014-02-08 23:14 - 00003364 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3877766120-1356258156-1109172098-1001

2014-02-08 23:14 - 2014-02-08 23:14 - 00000000 ____D () C:\ProgramData\boost_interprocess

2014-02-08 23:14 - 2014-01-17 13:07 - 00000000 ___RD () C:\Users\Laurie\Google Drive

2014-02-08 23:14 - 2013-11-25 18:36 - 00003232 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3877766120-1356258156-1109172098-1001

2014-02-08 23:12 - 2013-11-20 11:01 - 00296806 _____ () C:\Windows\PFRO.log

2014-02-08 23:12 - 2013-11-20 11:01 - 00001736 _____ () C:\Windows\error.log

2014-02-08 23:12 - 2013-11-20 11:01 - 00000392 _____ () C:\Windows\errord.log

2014-02-08 23:12 - 2013-11-20 09:42 - 00005299 _____ () C:\Windows\setupact.log

2014-02-08 23:12 - 2012-06-01 10:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service

2014-02-08 23:12 - 2011-07-21 16:41 - 00000000 ____D () C:\ProgramData\Kodak

2014-02-08 23:12 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-08 23:11 - 2013-11-16 09:16 - 00000000 ____D () C:\AdwCleaner

2014-02-08 23:06 - 2014-02-08 23:06 - 00001869 _____ () C:\Users\Laurie\Desktop\JRT.txt

2014-02-08 22:54 - 2014-02-08 22:15 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-02-08 22:34 - 2014-02-08 22:34 - 01166132 _____ () C:\Users\Laurie\Desktop\AdwCleaner.exe

2014-02-08 22:34 - 2014-02-08 22:34 - 01037530 _____ (Thisisu) C:\Users\Laurie\Desktop\JRT.exe

2014-02-08 22:33 - 2014-02-08 22:15 - 00119000 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-02-08 22:33 - 2014-02-08 22:15 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-02-08 22:15 - 2014-02-08 22:15 - 00000000 ____D () C:\Users\Laurie\Desktop\MBAM-AR

2014-02-08 22:14 - 2014-02-08 22:14 - 12589848 _____ (Malwarebytes Corp.) C:\Users\Laurie\Desktop\mbar-1.07.0.1009.exe

2014-02-08 18:46 - 2012-06-30 09:41 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-02-08 18:46 - 2011-07-23 16:55 - 00000000 ____D () C:\Program Files (x86)\Constant Guard Protection Suite

2014-02-08 17:38 - 2014-02-08 17:38 - 00003127 _____ () C:\Users\Laurie\Desktop\RKreport[0]_S_02082014_173818.txt

2014-02-08 17:35 - 2012-08-18 06:58 - 00000000 ____D () C:\Windows\erdnt

2014-02-08 17:34 - 2014-02-08 17:34 - 00000930 _____ () C:\Users\Laurie\Desktop\NTREGOPT.lnk

2014-02-08 17:34 - 2014-02-08 17:34 - 00000911 _____ () C:\Users\Laurie\Desktop\ERUNT.lnk

2014-02-08 17:34 - 2014-02-08 17:34 - 00000000 ____D () C:\Program Files (x86)\ERUNT

2014-02-08 17:33 - 2014-02-08 17:33 - 00002740 _____ () C:\Users\Laurie\Desktop\Rkill.txt

2014-02-08 16:35 - 2014-02-08 16:35 - 04403200 _____ () C:\Users\Laurie\Desktop\RogueKillerX64.exe

2014-02-08 16:35 - 2014-02-08 16:35 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Laurie\Desktop\rkill.exe

2014-02-08 16:35 - 2014-02-08 16:35 - 00791393 _____ (Lars Hederer ) C:\Users\Laurie\Desktop\erunt-setup.exe

2014-02-07 21:54 - 2013-12-20 21:41 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForLaurie

2014-02-07 21:54 - 2013-12-20 21:41 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForLaurie.job

2014-02-07 17:50 - 2014-02-07 17:50 - 00027093 _____ () C:\Users\Laurie\Desktop\dds.txt

2014-02-07 17:50 - 2013-03-28 14:09 - 00009363 _____ () C:\Users\Laurie\Desktop\attach.txt

2014-02-07 17:46 - 2014-02-07 17:46 - 00688992 ____R (Swearware) C:\Users\Laurie\Desktop\dds.com

2014-02-07 17:41 - 2014-02-07 17:40 - 00065325 _____ () C:\Users\Laurie\Desktop\CheckResults.txt

2014-02-07 14:42 - 2014-02-07 14:42 - 00353352 _____ (Malwarebytes Corporation) C:\Users\Laurie\Desktop\mbam-check-2.0.0.1000.exe

2014-02-07 07:52 - 2014-02-07 07:52 - 00001082 _____ () C:\Users\Public\Desktop\Google Drive.lnk

2014-02-07 07:52 - 2014-01-17 13:04 - 00002044 _____ () C:\Users\Public\Desktop\Google Slides.lnk

2014-02-07 07:52 - 2014-01-17 13:04 - 00002042 _____ () C:\Users\Public\Desktop\Google Sheets.lnk

2014-02-07 07:52 - 2014-01-17 13:04 - 00002032 _____ () C:\Users\Public\Desktop\Google Docs.lnk

2014-02-05 22:35 - 2014-02-05 22:22 - 00000000 ____D () C:\ProgramData\Cloudmark

2014-02-05 22:23 - 2014-02-05 22:22 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\Cloudmark

2014-02-05 22:22 - 2014-02-05 22:22 - 00000000 ____D () C:\Program Files (x86)\Cloudmark

2014-02-05 18:25 - 2014-01-28 09:00 - 00003342 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3877766120-1356258156-1109172098-1001

2014-02-05 18:25 - 2013-11-27 18:34 - 00003210 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3877766120-1356258156-1109172098-1001

2014-02-05 17:23 - 2014-02-05 17:23 - 00599089 _____ () C:\Users\Laurie\Documents\Balance Sheet - Rent

2014-02-05 14:47 - 2013-10-03 16:42 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\Skype

2014-02-05 13:03 - 2014-02-05 13:03 - 00000000 ____D () C:\Users\Laurie\AppData\Local\Skype

2014-02-05 01:03 - 2012-02-10 10:37 - 00003218 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForZINCS-HP$

2014-02-05 01:03 - 2012-02-10 10:37 - 00000342 _____ () C:\Windows\Tasks\HPCeeScheduleForZINCS-HP$.job

2014-02-04 22:07 - 2014-02-04 22:07 - 00001072 _____ () C:\Users\Public\Desktop\VLC media player.lnk

2014-02-04 22:07 - 2011-07-30 22:07 - 00000000 ____D () C:\Program Files (x86)\VideoLAN

2014-02-04 22:06 - 2013-10-11 08:55 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-02-04 22:06 - 2011-07-23 15:33 - 00002092 _____ () C:\Users\Public\Desktop\Mozilla Thunderbird.lnk

2014-02-04 22:05 - 2013-06-17 18:09 - 00000000 ____D () C:\Program Files (x86)\MediaMonkey

2014-02-04 22:04 - 2013-03-03 17:40 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-02-04 22:04 - 2013-03-02 14:30 - 00001153 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-02-04 22:04 - 2012-05-08 10:39 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-04 22:04 - 2012-05-08 10:39 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-04 22:04 - 2011-07-23 16:26 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-04 18:06 - 2014-01-28 09:01 - 00002771 _____ () C:\Users\Public\Desktop\Desktop Weather.lnk

2014-02-04 13:41 - 2014-02-04 13:41 - 23642336 _____ (Cloudmark, Inc.) C:\Users\Laurie\Downloads\CloudmarkDesktopOne1.5.0.exe

2014-02-04 03:00 - 2013-03-03 18:00 - 00000440 _____ () C:\Windows\Tasks\Defraggler Volume C Task.job

2014-02-03 19:04 - 2011-09-28 15:37 - 00001024 _____ () C:\Users\Laurie\Desktop\Dropbox.lnk

2014-02-03 19:04 - 2011-09-28 15:35 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox

2014-02-03 19:03 - 2014-01-25 11:02 - 00003572 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3877766120-1356258156-1109172098-1001

2014-02-03 19:03 - 2013-10-04 19:04 - 00002438 _____ () C:\Users\Laurie\Desktop\GoToMeeting Quick Connect.lnk

2014-02-03 19:03 - 2013-02-13 18:48 - 00000997 _____ () C:\Users\Public\Desktop\Pidgin.lnk

2014-02-03 19:03 - 2011-07-27 13:07 - 00000000 ____D () C:\Program Files (x86)\Pidgin

2014-02-03 18:33 - 2014-01-28 09:04 - 00002104 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-01 13:06 - 2011-09-03 11:33 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software

2014-01-30 15:34 - 2014-01-30 15:34 - 00000736 _____ () C:\Users\Laurie\Downloads\LeadFerret_vCard_Margaret_Castillo.vcf

2014-01-29 12:58 - 2012-02-22 12:39 - 00000000 ____D () C:\Users\Laurie\Documents\PhraseExpress

2014-01-28 09:06 - 2012-02-22 12:39 - 00000000 ____D () C:\Program Files (x86)\PhraseExpress

2014-01-28 09:05 - 2014-01-28 09:05 - 13318496 _____ (Bartels Media GmbH ) C:\Users\Laurie\Downloads\PhraseExpressSetup (5).exe

2014-01-28 09:01 - 2012-03-18 16:54 - 00000000 ____D () C:\Users\Laurie\AppData\Local\Downloaded Installations

2014-01-28 09:01 - 2012-03-06 10:21 - 00000000 ____D () C:\Program Files (x86)\The Weather Channel

2014-01-28 08:49 - 2013-08-02 14:43 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\Nettalk

2014-01-25 11:08 - 2014-01-25 11:08 - 00001785 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-01-25 11:08 - 2014-01-25 11:08 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-01-25 11:08 - 2014-01-25 11:08 - 00000000 ____D () C:\Program Files\iTunes

2014-01-25 11:08 - 2014-01-25 11:08 - 00000000 ____D () C:\Program Files\iPod

2014-01-25 11:08 - 2011-07-23 13:46 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-01-25 11:04 - 2014-01-25 11:04 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\DropboxMaster

2014-01-25 11:04 - 2011-09-28 15:34 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\Dropbox

2014-01-25 11:03 - 2014-01-25 11:03 - 00002697 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-01-25 11:03 - 2013-10-03 16:41 - 00000000 ___RD () C:\Program Files (x86)\Skype

2014-01-25 11:03 - 2013-10-03 16:41 - 00000000 ____D () C:\ProgramData\Skype

2014-01-25 10:58 - 2011-07-23 13:43 - 00000000 ____D () C:\ProgramData\Apple

2014-01-18 21:54 - 2014-01-18 21:54 - 00002223 _____ () C:\Users\Laurie\Desktop\HP Support Assistant.lnk

2014-01-18 21:52 - 2014-01-18 21:52 - 00000000 ____D () C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}

2014-01-18 21:52 - 2011-05-26 19:06 - 00000000 ____D () C:\ProgramData\Hewlett-Packard

2014-01-18 21:52 - 2011-05-26 19:05 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard

2014-01-18 21:51 - 2011-09-16 06:41 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\hpqLog

2014-01-18 21:51 - 2011-02-10 17:39 - 00000000 ____D () C:\swsetup

2014-01-17 15:33 - 2011-07-25 21:14 - 00000000 ____D () C:\Users\Laurie\AppData\Local\CrashDumps

2014-01-17 14:25 - 2014-01-17 14:25 - 00020480 _____ () C:\Users\Laurie\Downloads\vcfviewer-1.1.exe

2014-01-17 14:13 - 2014-01-17 14:13 - 00000669 _____ () C:\Users\Laurie\Downloads\LeadFerret_vCard_Steve_Lagnado.vcf

2014-01-17 13:07 - 2014-01-17 13:07 - 00001704 _____ () C:\Users\Laurie\Desktop\Google Drive.lnk

2014-01-17 13:07 - 2011-07-21 15:14 - 00000000 ____D () C:\Users\Laurie

2014-01-17 13:04 - 2011-07-23 13:30 - 00000000 ____D () C:\Users\Laurie\AppData\Local\Google

2014-01-17 13:03 - 2014-01-17 13:03 - 00819136 _____ (Google Inc.) C:\Users\Laurie\Downloads\googledrivesync.exe

2014-01-17 13:03 - 2011-08-17 10:53 - 00000000 ____D () C:\Program Files (x86)\Google

2014-01-17 01:36 - 2011-11-11 16:48 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2014-01-17 01:36 - 2011-07-29 06:25 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log

2014-01-17 01:35 - 2011-07-29 06:24 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\HP Support Assistant

2014-01-17 01:35 - 2011-07-25 15:17 - 00000000 ____D () C:\Users\Laurie\AppData\Roaming\HpUpdate

2014-01-16 20:49 - 2014-01-16 20:39 - 00000000 ____D () C:\Users\Laurie\Documents\EllaSchool

2014-01-16 16:42 - 2013-01-27 20:20 - 00000000 ____D () C:\Users\Laurie\Documents\My Kindle Content

2014-01-16 09:40 - 2014-01-16 09:40 - 00000000 ____D () C:\Program Files (x86)\LG Electronics

2014-01-16 09:40 - 2011-05-26 19:10 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information

2014-01-16 09:39 - 2014-01-16 09:38 - 11412680 _____ (LG Electronics) C:\Users\Laurie\Downloads\LGUnitedMobileDriver_S50MAN310AP22_ML_WHQL_Ver_3.10.1.exe

2014-01-14 20:26 - 2012-09-09 12:31 - 00000000 ____D () C:\ProgramData\Package Cache

2014-01-14 20:25 - 2012-08-24 14:33 - 00000000 ____D () C:\Program Files (x86)\Plex

2014-01-14 20:21 - 2014-01-14 20:21 - 63048176 _____ (Plex, Inc.) C:\Users\Laurie\Downloads\Plex-Media-Server-0.9.818.290-11b7fdd-en-US (1).exe

2014-01-14 17:19 - 2009-07-13 23:45 - 04995408 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-01-14 16:36 - 2013-07-30 11:05 - 00000000 ____D () C:\Windows\system32\MRT

2014-01-14 16:34 - 2011-07-23 13:31 - 86054176 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-01-14 16:30 - 2014-01-14 16:30 - 00312744 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe

2014-01-14 16:30 - 2014-01-14 16:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe

2014-01-14 16:30 - 2014-01-14 16:30 - 00189352 _____ (Oracle Corporation) C:\Windows\system32\java.exe

2014-01-14 16:30 - 2014-01-14 16:30 - 00108968 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge-64.dll

2014-01-14 16:29 - 2014-01-14 16:30 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe

2014-01-14 16:29 - 2014-01-14 16:30 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe

2014-01-14 16:29 - 2014-01-14 16:30 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe

2014-01-14 16:29 - 2014-01-14 16:30 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll