Corrupted files

ThirdTimesTheCharm · February 8, 2014

Hello.. I've been thinking I had an issue for a short time now. I use Google Chrome and it was having trouble finding my preferences. I rarely go on the web, though. I spend most of my pc time playing SWTOR. Yesterday, while trying to download the latest version of CCleaner, I ran into some trouble. The DL got sent to some "Free Download Manager", which I don't recognize as any program I've ever had. I was unable to retrieve it. Now worried, I started looking around and it turns out all my Chrome files were all corrupted. Reacting to that I opened my Malwarebytes Pro and ran the flash scan, it found nothing. Tried to run Kasperski 2013 and it's files were all corrupted as well. I removed them both and reinstalled them. Then, found a "White Smoke" extension on my chrome that doesn't belong there.

Now, I'm here because you guys have been the most reliable source for removing issues from my computers for about 5 or 6 years. Thanks a million, in advance

Heres my dds files.

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer:

Run by David at 22:51:44 on 2014-02-07

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3563.1928 [GMT -5:00]

.

AV: Kaspersky Anti-Virus *Enabled/Updated* {2EAA32A5-1EE1-1B22-95DA-337730C6E984}

SP: Kaspersky Anti-Virus *Enabled/Updated* {95CBD341-38DB-14AC-AF6A-08054B41A339}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Spybot - Search and Destroy *Enabled/Outdated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe

C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskhost.exe

C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Program Files\IDT\WDM\sttray64.exe

C:\Windows\WebCam\S6000\S6000Mnt.exe

C:\Windows\system32\taskeng.exe

c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler.exe

C:\Program Files (x86)\Google\Update\1.3.22.3\GoogleCrashHandler64.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

C:\Windows\System32\svchost.exe -k secsvcs

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe

C:\Windows\system32\taskeng.exe

C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtblfs.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mWinlogon: Userinit = userinit.exe,

BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll

BHO: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll

BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\AMD\SteadyVideo\SteadyVideo.dll

BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -

BHO: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll

BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll

mRun: [s6000Mnt] C:\Windows\SysWOW64\Rundll32.exe S6000Rmv.dll,WinMainRmv /StartStillMnt

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe"

dRun: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

uPolicies-Explorer: NoDriveTypeAutoRun = dword:145

mPolicies-Explorer: NoActiveDesktop = dword:1

mPolicies-Explorer: NoActiveDesktopChanges = dword:1

mPolicies-Explorer: NoDriveTypeAutoRun = dword:60

mPolicies-System: ConsentPromptBehaviorAdmin = dword:0

mPolicies-System: ConsentPromptBehaviorUser = dword:3

mPolicies-System: EnableLUA = dword:0

mPolicies-System: EnableUIADesktopToggle = dword:0

mPolicies-System: PromptOnSecureDesktop = dword:0

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe

IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll

IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204

IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDHelper.dll

.

INFO: HKLM has more than 50 listed domains.

If you wish to scan all of them, select the 'Force scan all domains' option.

.

TCP: NameServer = 192.168.1.1 71.250.0.12

TCP: Interfaces\{209AE36B-46B0-4194-AB86-8D141B254291} : DHCPNameServer = 192.168.1.1 71.250.0.12

TCP: Interfaces\{209AE36B-46B0-4194-AB86-8D141B254291}\2456C6B696E6F554E68616E6365646F575962756C6563737F5732334145333 : DHCPNameServer = 192.168.2.1

TCP: Interfaces\{209AE36B-46B0-4194-AB86-8D141B254291}\3786F62756C616E6 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{209AE36B-46B0-4194-AB86-8D141B254291}\44D2C496E6B6 : DHCPNameServer = 192.168.0.1

TCP: Interfaces\{209AE36B-46B0-4194-AB86-8D141B254291}\4646D2772747 : DHCPNameServer = 192.168.1.1

TCP: Interfaces\{209AE36B-46B0-4194-AB86-8D141B254291}\74249494 : DHCPNameServer = 8.8.8.8 8.8.4.4

TCP: Interfaces\{BB694403-0888-453D-B641-49D9F062C05B} : DHCPNameServer = 192.168.1.1 71.250.0.12

Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll

Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\AMD\SteadyVideo\VideoMIMEFilter.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

Notify: SDWinLogon - SDWinLogon.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.107\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

mASetup: {F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} - msiexec /fu {F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1} /qn

x64-BHO: IEVkbdBHO Class: {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\ievkbd.dll

x64-BHO: SteadyVideoBHO Class: {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll

x64-BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll

x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

x64-BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} -

x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll

x64-BHO: FilterBHO Class: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtbbho.dll

x64-BHO: HP Network Check Helper: {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll

x64-Run: [sysTrayApp] C:\Program Files\IDT\WDM\sttray64.exe

x64-RunOnce: [NCPluginUpdater] "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update

x64-IE: {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe

x64-IE: {4248FE82-7FCB-46AC-B270-339F08212110} - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\ievkbd.dll

x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtbbho.dll

x64-Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll

x64-Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll

x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-Notify: klogon - C:\Windows\System32\klogon.dll

x64-SSODL: WebCheck - <orphaned>

x64-mASetup: {6032497A-4479-462B-ADB8-A0A372BB9A23} - msiexec /fu {6032497A-4479-462B-ADB8-A0A372BB9A23} /qn

Hosts: 127.0.0.1 ads.mcafee.com

Hosts: 127.0.0.1 directads.mcafee.com

Hosts: 127.0.0.1 analytics.microsoft.com

Hosts: 127.0.0.1 metrics.bitdefender.com

Hosts: 127.0.0.1 metrics.mcafee.com

.

Note: multiple HOSTS entries found. Please refer to Attach.txt

.

============= SERVICES / DRIVERS ===============

.

R0 amd_sata;amd_sata;C:\Windows\System32\drivers\amd_sata.sys [2011-6-17 79488]

R0 amd_xata;amd_xata;C:\Windows\System32\drivers\amd_xata.sys [2011-6-17 40064]

R1 kl2;kl2;C:\Windows\System32\drivers\kl2.sys [2011-3-4 11864]

R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2011-3-10 29488]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-12-19 204288]

R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2012-12-19 361984]

R2 AODDriver4.2;AODDriver4.2;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2012-4-9 57472]

R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe [2011-4-24 206448]

R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2013-4-22 822504]

R2 HP Support Assistant Service;HP Support Assistant Service;C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe [2013-11-4 92160]

R2 HPAuto;HP Auto;C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [2011-2-17 682040]

R2 HPClientSvc;HP Client Services;C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe [2010-10-11 346168]

R2 HPDrvMntSvc.exe;HP Quick Synchronization Service;C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe [2013-5-13 270624]

R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2012-3-5 35200]

R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-2-15 2424424]

R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-14 418376]

R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-14 701512]

R2 RadeonPro Support Service;RadeonPro Support Service;C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe [2013-2-5 20608]

R2 SDScannerService;Spybot-S&D 2 Scanner Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2013-2-23 1103392]

R2 SDWSCService;Spybot-S&D 2 Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2013-2-23 168384]

R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-6-26 523944]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\drivers\AtihdW76.sys [2012-11-6 96256]

R3 clwvd;CyberLink WebCam Virtual Driver;C:\Windows\System32\drivers\clwvd.sys [2010-7-28 31088]

R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-6-21 25928]

R3 netr28x;Ralink 802.11n Extensible Wireless Driver;C:\Windows\System32\drivers\netr28x.sys [2012-12-6 2350176]

R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2012-2-15 339048]

R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-2-15 539240]

R3 S6000KNT;S6000KNT_WebCam Driver;C:\Windows\System32\drivers\S6000KNT.sys [2013-2-13 3293400]

R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2013-6-26 767144]

R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2013-6-26 273576]

R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2013-6-26 28840]

R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2013-6-26 23208]

R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-6-26 207528]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2012-2-15 53376]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]

S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]

S2 SDUpdateService;Spybot-S&D 2 Updating Service;C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2013-2-23 1369624]

S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]

S3 amdiox64;AMD IO Driver;C:\Windows\System32\drivers\amdiox64.sys [2012-2-15 46136]

S3 GamesAppIntegrationService;GamesAppIntegrationService;C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [2013-11-8 227936]

S3 GamesAppService;GamesAppService;C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe [2010-10-12 206072]

S3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2009-11-2 22544]

S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-2-13 19456]

S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]

S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]

S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]

S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-2-13 57856]

S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-2-13 30208]

S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-4-25 1255736]

S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184]

.

=============== File Associations ===============

.

ShellExec: Opera.exe: open="C:\Program Files (x86)\Opera\Launcher.exe" "%1"

.

=============== Created Last 30 ================

.

2014-02-08 03:35:08 -------- d-----w- C:\Users\David\AppData\Local\Opera Software

2014-02-08 03:35:06 -------- d-----w- C:\Users\David\AppData\Roaming\Opera Software

2014-02-08 02:11:54 -------- d-----w- C:\ProgramData\Kaspersky Lab

2014-02-08 02:11:54 -------- d-----w- C:\Program Files (x86)\Kaspersky Lab

2014-02-08 02:05:01 75888 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{96915471-1996-4D5C-A101-75B69623E6DC}\offreg.dll

2014-02-08 01:54:00 10315576 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{96915471-1996-4D5C-A101-75B69623E6DC}\mpengine.dll

2014-02-07 22:26:28 -------- d-----w- C:\04055f4155269a291a49431553

2014-01-24 04:03:55 -------- d-----w- C:\Users\David\AppData\Local\Overwolf

2014-01-15 05:11:47 99840 ----a-w- C:\Windows\System32\drivers\usbccgp.sys

2014-01-15 05:11:47 7808 ----a-w- C:\Windows\System32\drivers\usbd.sys

2014-01-15 05:11:47 53248 ----a-w- C:\Windows\System32\drivers\usbehci.sys

2014-01-15 05:11:47 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys

2014-01-15 05:11:47 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys

2014-01-15 05:11:47 3156480 ----a-w- C:\Windows\System32\win32k.sys

2014-01-15 05:11:47 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys

2014-01-15 05:11:47 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys

2014-01-15 05:11:45 376768 ----a-w- C:\Windows\System32\drivers\netio.sys

2014-01-12 05:17:55 0 ----a-w- C:\Windows\SysWow64\sho1192.tmp

.

==================== Find3M ====================

.

2014-02-08 03:50:19 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2014-02-08 03:50:19 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2014-01-16 14:59:44 270496 ------w- C:\Windows\System32\MpSigStub.exe

2013-12-15 05:50:21 0 ----a-w- C:\Windows\SysWow64\sho91AE.tmp

2013-12-05 06:38:20 0 ----a-w- C:\Windows\SysWow64\sho820D.tmp

2013-11-23 18:26:20 417792 ----a-w- C:\Windows\SysWow64\WMPhoto.dll

2013-11-23 17:47:34 465920 ----a-w- C:\Windows\System32\WMPhoto.dll

2013-11-12 02:23:09 2048 ----a-w- C:\Windows\System32\tzres.dll

2013-11-12 02:07:29 2048 ----a-w- C:\Windows\SysWow64\tzres.dll

.

============= FINISH: 22:52:39.58 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 7 Home Premium

Boot Device: \Device\HarddiskVolume1

Install Date: 4/23/2012 5:45:50 PM

System Uptime: 2/7/2014 9:00:54 PM (1 hours ago)

.

Motherboard: Hewlett-Packard | | 169B

Processor: AMD A6-3420M APU with Radeon HD Graphics | Socket FS1 | 1500/100mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 441 GiB total, 315.568 GiB free.

D: is FIXED (NTFS) - 21 GiB total, 2.246 GiB free.

E: is FIXED (FAT32) - 4 GiB total, 1.08 GiB free.

F: is CDROM (CDFS)

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP226: 1/21/2014 8:19:08 PM - Windows Update

RP227: 1/28/2014 5:30:17 PM - Windows Update

RP228: 2/4/2014 5:20:49 PM - Windows Update

RP229: 2/7/2014 5:26:02 PM - Windows Update

RP230: 2/7/2014 8:39:15 PM - Restore Operation

RP231: 2/7/2014 8:53:24 PM - Windows Update

.

==== Hosts File Hijack ======================

.

Hosts: 127.0.0.1 ads.mcafee.com

Hosts: 127.0.0.1 directads.mcafee.com

Hosts: 127.0.0.1 analytics.microsoft.com

Hosts: 127.0.0.1 metrics.bitdefender.com

Hosts: 127.0.0.1 metrics.mcafee.com

Hosts: 127.0.0.1 om.symantec.com

Hosts: 127.0.0.1 ads.bleepingcomputer.com

Hosts: 127.0.0.1 sdc.mcafee.com

Hosts: 127.0.0.1 wdcs.trendmicro.com

Hosts: 127.0.0.1 www.spywareinfo.com

.

==== Installed Programs ======================

.

7-Zip 9.21

Adobe Flash Player 12 ActiveX

Adobe Flash Player 12 Plugin

Adobe Reader X (10.1.9) MUI

Adobe Shockwave Player 12.0

Age of Empires III

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Install Manager

AMD Drag and Drop Transcoding

AMD Fuel

AMD Media Foundation Decoders

AMD Steady Video Plug-In

AMD VISION Engine Control Center

Bejeweled 3

Blackhawk Striker 2

Blio

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

CCleaner

Chuzzle Deluxe

Cradle of Rome 2

CyberLink YouCam

D3DX10

Defraggler

Dora's World Adventure

ESU for Microsoft Windows 7 SP1

Eusing Free Registry Cleaner

Evernote v. 4.2.3

Fallout Mod Manager 0.13.21

Fallout: New Vegas

Farm Frenzy

Farmscapes

FATE

Final Drive Fury

Fraps

Google Chrome

Google Drive

Google Update Helper

Hewlett-Packard ACLM.NET v1.2.2.3

Hoyle Card Games

HP Application Assistant

HP Auto

HP Client Services

HP Customer Experience Enhancements

HP Documentation

HP Games

HP Launch Box

HP MovieStore

HP On Screen Display

HP Power Manager

HP Quick Launch

HP QuickWeb

HP Recovery Manager

HP Security Assistant

HP Setup

HP Setup Manager

HP Software Framework

HP Support Assistant

HP Webcam-101

IDT Audio

Java 7 Update 45 (64-bit)

Jewel Match 3

Jewel Quest Mysteries: The Seventh Gate Collector's Edition

John Deere Drive Green

Junk Mail filter update

Kaspersky Anti-Virus 2012

Letters from Nowhere 2

Luxor HD

Mah Jong Medley

Malwarebytes Anti-Malware version 1.75.0.1300

Mesh Runtime

Microsoft .NET Framework 4.5.1

Microsoft Application Error Reporting

Microsoft Mouse and Keyboard Center

Microsoft Office 2010

Microsoft Office Click-to-Run 2010

Microsoft Office Starter 2010 - English

Microsoft Silverlight

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft WSE 3.0 Runtime

MSVCRT

MSVCRT_amd64

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

Nexus Mod Manager

NVIDIA Texture Tools 2 - 64 bit

OI App Manager

opensource

Opera 12.15

Opera Stable 19.0.1326.59

Parsec

Penguins!

Plants vs. Zombies - Game of the Year

PlayReady PC Runtime x86

Poker Superstars III

Polar Bowler

Polar Golfer

RadeonPro 1.0 (Build 1.1.1.0)

Ralink RT2860 Wireless LAN Card

Realtek Ethernet Controller Driver

Realtek PCIE Card Reader

RollerCoaster Tycoon 3: Platinum

SAMSUNG Mobile Modem Driver Set

Samsung Mobile phone USB driver Drive Software

SAMSUNG Mobile USB Modem 1.0 Software

SAMSUNG Mobile USB Modem Software

Samsung PC Studio 3 USB Driver Installer

Skype™ 5.10

Speccy

Spybot - Search & Destroy

SpywareBlaster 5.0

Star Wars: The Old Republic

Steam

Stronghold

Stronghold 2

Stronghold Crusader Extreme

Stronghold Legends

swMSM

Synaptics TouchPad Driver

TeamSpeak 3 Client

The Elder Scrolls V: Skyrim

The Treasures of Mystery Island: The Ghost Ship

Torchlight

Unity Web Player

Update Installer for WildTangent Games App

Virtual Villagers 4 - The Tree of Life

WildTangent Games App (HP Games)

Windows Live Communications Platform

Windows Live Essentials

Windows Live ID Sign-in Assistant

Windows Live Installer

Windows Live Language Selector

Windows Live Mail

Windows Live Mesh

Windows Live Mesh ActiveX Control for Remote Connections

Windows Live Messenger

Windows Live MIME IFilter

Windows Live Movie Maker

Windows Live Photo Common

Windows Live Photo Gallery

Windows Live PIMT Platform

Windows Live Remote Client

Windows Live Remote Client Resources

Windows Live Remote Service

Windows Live Remote Service Resources

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Windows Live Writer

Windows Live Writer Resources

WinRAR 4.20 (64-bit)

Zuma's Revenge

.

==== Event Viewer Messages From Past Week ========

.

2/7/2014 9:31:56 PM, Error: Service Control Manager [7001] - The Spybot-S&D 2 Updating Service service depends on the Secondary Logon service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.

.

==== End Of File ===========================

Tomk1 · February 14, 2014

Hi ThirdTimesTheCharm,

Welcome to Malwarebytes Forum

My name is Tomk1. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.

The fixes are specific to your problem and should only be used for the issues on this machine.

Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.

It's often worth reading through these instructions and printing them for ease of reference.

If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.

Please reply to this thread. Do not start a new topic.

Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, feel free to create a new one.

Let's start like this:

Step 1

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista or Seven, right-mouse click it and select Run as Administrator.
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Step 2

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on AdwCleaner.exe to run the tool.
Click on Scan button. Wait until is finished.
Click on Clean.
Confirm each time with Ok.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the content of that logfile with your next answer.
You can find the logfile at C:\AdwCleaner\AdwCleaner[s0].txt as well.

In your next reply, post the following log files:

Junkware Removal Tool log
AdwCleaner log

ThirdTimesTheCharm · February 14, 2014

Hey ok, here they are

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.1 (02.04.2014:1)

OS: Windows 7 Home Premium x64

Ran by David on Fri 02/14/2014 at 18:36:26.05

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\speedypc software

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\speedypc software

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasmancs

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{D9315171-CAF0-4A43-801F-865AD632B66D}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{D9315171-CAF0-4A43-801F-865AD632B66D}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

~~~ Files

Successfully deleted: [File] C:\Windows\syswow64\sho1192.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho18E4.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho766F.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho820D.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho8893.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho91AE.tmp

Successfully deleted: [File] C:\Windows\syswow64\sho990C.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoB1B.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoC883.tmp

Successfully deleted: [File] C:\Windows\syswow64\shoD50F.tmp

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\speedypc software"

Successfully deleted: [Folder] "C:\Users\David\AppData\Roaming\drivercure"

Successfully deleted: [Folder] "C:\Users\David\AppData\Roaming\speedypc software"

Successfully deleted: [Folder] "C:\Users\David\appdata\local\cre"

Successfully deleted: [Folder] "C:\Program Files (x86)\eusing free registry cleaner"

Successfully deleted: [Folder] "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\free registry cleaner"

Successfully deleted: [Folder] "C:\Users\David\AppData\Roaming\microsoft\windows\start menu\programs\free registry cleaner"

Successfully deleted: [Empty Folder] C:\Users\David\appdata\local\{053E2635-2033-48BB-9EAC-97255CDCC9BD}

Successfully deleted: [Empty Folder] C:\Users\David\appdata\local\{1962646A-595C-4A59-9034-B515B2D8993C}

Successfully deleted: [Empty Folder] C:\Users\David\appdata\local\{21BE77AA-52E4-403F-8419-5D8E0809961F}

Successfully deleted: [Empty Folder] C:\Users\David\appdata\local\{48937671-AD2A-4CC1-A954-C46F5A333940}

Successfully deleted: [Empty Folder] C:\Users\David\appdata\local\{82636963-3190-4A60-8179-177593DC2E4D}

Successfully deleted: [Empty Folder] C:\Users\David\appdata\local\{A76A629F-FEA5-44B9-BE2D-4E5ED99E1372}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 02/14/2014 at 18:49:59.39

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v3.018 - Report created 14/02/2014 at 18:54:03

# Updated 28/01/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : David - DAVID-HP

# Running from : C:\Users\David\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3}

***** [ Browsers ] *****

-\\ Internet Explorer v0.0.0.0

-\\ Google Chrome v32.0.1700.107

[ File : C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [1041 octets] - [14/02/2014 18:52:30]

AdwCleaner[s0].txt - [962 octets] - [14/02/2014 18:54:03]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1021 octets] ##########

Tomk1 · February 15, 2014

Good. That took care of some misc. garbage.

Now let's dig a little deeper:

Download ComboFix from here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link --> http://forums.whatthetech.com/How_Disable_your_Security_Programs_t96260.html
Double click on ComboFix.exe & follow the prompts.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

ThirdTimesTheCharm · February 15, 2014

having quite a bit of trouble now... I'm trying to post the combofix report but it's not going well

ThirdTimesTheCharm · February 15, 2014

ok.. it appears looking at the log that Windows defender, which should always be disabled was enabled. I actually uninstalled Spybot S&D because I couldn't find any correct information on how to disable it. Now, I cannot paste the combofix.txt to this reply. It causes chrome to go unresponsive. What to do from here?

Tomk1 · February 15, 2014

Can you attach the .txt file?

ThirdTimesTheCharm · February 15, 2014

I could not see how to attach it here so I attached it to the email reply.

Tomk1 · February 15, 2014

Who did you email it to?

To attach, click on the More Reply Options button on the lower right.

In the new window you should see Attach Files on the lower left. Click the Browse button and select the file. Then click the Attach This File button. Then click Add Reply button.

ThirdTimesTheCharm · February 15, 2014

here it is

ComboFix.txt

Tomk1 · February 15, 2014

I'm not seeing the problem there.

Let's get a different look:

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.
Press Scan button.
It will produce a log called FRST.txt in the same directory the tool is run from.
Please copy and paste log back here.
The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

ThirdTimesTheCharm · February 15, 2014

here they are

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-02-2014 01

Ran by David (administrator) on DAVID-HP on 15-02-2014 16:41:34

Running from C:\Users\David\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe

(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe

(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Mr. John aka japamd) C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Hewlett-Packard) C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe

(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Microsoft Corporation) c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.22.5\GoogleCrashHandler64.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Kaspersky Lab ZAO) C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe

(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe

(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe

(Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [sysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1664000 2012-10-24] (IDT, Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [AVP] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe [206448 2014-02-07] (Kaspersky Lab ZAO)

Winlogon\Notify\klogon: C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {D9315171-CAF0-4A43-801F-865AD632B66D} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms}

SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}

SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}

SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://www.ebay.com/sch/i.html?_nkw={searchTerms}

BHO: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\ievkbd.dll (Kaspersky Lab ZAO)

BHO: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll No File

BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\x64\klwtbbho.dll (Kaspersky Lab ZAO)

BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)

BHO-x32: IEVkbdBHO Class - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll (Kaspersky Lab ZAO)

BHO-x32: SteadyVideoBHO Class - {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} - C:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Safe Money Plugin - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\IEExt\OnlineBanking\online_banking_bho.dll No File

BHO-x32: FilterBHO Class - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll (Kaspersky Lab ZAO)

BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - C:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 71.250.0.12

Chrome:

=======

CHR Extension: (Google Docs) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-02-07]

CHR Extension: (Google Drive) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-02-07]

CHR Extension: (YouTube) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-02-07]

CHR Extension: (Google Search) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-02-07]

CHR Extension: (Kaspersky URL Advisor) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj [2013-02-18]

CHR Extension: (AdBlock) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-02-15]

CHR Extension: (Virtual Keyboard) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh [2013-02-18]

CHR Extension: (Google Wallet) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-24]

CHR Extension: (Gmail) - C:\Users\David\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-02-07]

CHR HKCU\...\Chrome\Extension: [jgjgoboealkonoikjklgigbgconjnfbc] - C:\Users\David\AppData\Local\CRE\jgjgoboealkonoikjklgigbgconjnfbc.crx [2014-02-07]

CHR HKLM-x32\...\Chrome\Extension: [dchlnpcodkpfdpacogkljefecpegganj] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ChromeExt\urladvisor.crx [2011-06-20]

CHR HKLM-x32\...\Chrome\Extension: [jagncdcchgajhfhijbbhecadmaiegcmh] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ChromeExt\virtkbd.crx [2011-06-20]

CHR HKLM-x32\...\Chrome\Extension: [jgjgoboealkonoikjklgigbgconjnfbc] - C:\Users\David\AppData\Local\CRE\jgjgoboealkonoikjklgigbgconjnfbc.crx [2011-06-20]

CHR HKLM-x32\...\Chrome\Extension: [pjldcfjmnllhmgjclecdnfampinooman] - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\ChromeExt\ab.crx [2011-06-20]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2012-12-19] (Advanced Micro Devices, Inc.)

R2 AVP; C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe [206448 2014-02-07] (Kaspersky Lab ZAO)

S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227936 2013-11-08] (WildTangent)

R2 HPAuto; C:\Program Files\Hewlett-Packard\HP Auto\HPAuto.exe [682040 2011-02-17] (Hewlett-Packard)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 RadeonPro Support Service; C:\Program Files (x86)\RadeonPro\RadeonProSupport.exe [20608 2013-01-08] (Mr. John aka japamd)

==================== Drivers (Whitelisted) ====================

R0 KL1; C:\Windows\System32\DRIVERS\kl1.sys [460888 2011-03-04] (Kaspersky Lab ZAO)

R1 kl2; C:\Windows\System32\DRIVERS\kl2.sys [11864 2011-03-04] (Kaspersky Lab ZAO)

R1 KLIF; C:\Windows\System32\DRIVERS\klif.sys [637272 2014-02-07] (Kaspersky Lab)

R1 KLIM6; C:\Windows\System32\DRIVERS\klim6.sys [29488 2011-03-10] (Kaspersky Lab ZAO)

R3 klmouflt; C:\Windows\System32\DRIVERS\klmouflt.sys [22544 2009-11-02] (Kaspersky Lab)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 S6000KNT; C:\Windows\System32\Drivers\S6000KNT.sys [3293400 2010-12-24] (Windows ® Win 7 DDK provider)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)

S3 catchme; \??\C:\ComboFix\catchme.sys [X]

S3 WinRing0_1_2_0; \??\C:\Program Files (x86)\Razer\Razer Game Booster\Driver\WinRing0x64.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-15 16:41 - 2014-02-15 16:42 - 00012284 _____ () C:\Users\David\Desktop\FRST.txt

2014-02-15 16:41 - 2014-02-15 16:41 - 00000000 ____D () C:\FRST

2014-02-15 16:40 - 2014-02-15 16:40 - 02152960 _____ (Farbar) C:\Users\David\Desktop\FRST64.exe

2014-02-14 21:04 - 2014-02-14 21:04 - 01324381 _____ () C:\ComboFix.txt

2014-02-14 20:44 - 2014-02-14 21:05 - 00000000 ____D () C:\ComboFix

2014-02-14 20:44 - 2011-06-26 01:45 - 00256000 _____ () C:\Windows\PEV.exe

2014-02-14 20:44 - 2010-11-07 12:20 - 00208896 _____ () C:\Windows\MBR.exe

2014-02-14 20:44 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe

2014-02-14 20:44 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe

2014-02-14 20:44 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe

2014-02-14 20:44 - 2000-08-30 19:00 - 00098816 _____ () C:\Windows\sed.exe

2014-02-14 20:44 - 2000-08-30 19:00 - 00080412 _____ () C:\Windows\grep.exe

2014-02-14 20:44 - 2000-08-30 19:00 - 00068096 _____ () C:\Windows\zip.exe

2014-02-14 20:05 - 2014-02-14 20:05 - 00000000 ____D () C:\Users\David\Documents\ProcAlyzer Dumps

2014-02-14 19:53 - 2014-02-14 21:04 - 00000000 ____D () C:\Qoobox

2014-02-14 19:53 - 2014-02-14 21:02 - 00000000 ____D () C:\Windows\erdnt

2014-02-14 19:51 - 2014-02-14 19:52 - 05183211 ____R (Swearware) C:\Users\David\Desktop\ComboFix.exe

2014-02-14 19:04 - 2014-02-14 19:04 - 00001109 _____ () C:\Users\David\Desktop\AdwCleaner[s0].txt

2014-02-14 18:52 - 2014-02-14 18:54 - 00000000 ____D () C:\AdwCleaner

2014-02-14 18:49 - 2014-02-14 18:49 - 00003875 _____ () C:\Users\David\Desktop\JRT.txt

2014-02-14 18:36 - 2014-02-14 18:36 - 00000000 ____D () C:\Windows\ERUNT

2014-02-14 18:34 - 2014-02-14 18:34 - 01166132 _____ () C:\Users\David\Desktop\AdwCleaner.exe

2014-02-14 18:33 - 2014-02-14 18:34 - 01037530 _____ (Thisisu) C:\Users\David\Desktop\JRT.exe

2014-02-14 18:10 - 2014-02-14 18:10 - 00021739 _____ () C:\Users\David\Desktop\dds.txt

2014-02-14 18:10 - 2014-02-14 18:10 - 00007036 _____ () C:\Users\David\Desktop\attach.txt

2014-02-14 18:08 - 2014-02-14 18:08 - 00688992 ____R (Swearware) C:\Users\David\Desktop\dds.scr

2014-02-12 06:34 - 2014-02-12 06:37 - 00000000 ____D () C:\Program Files (x86)\GUM8CD3.tmp

2014-02-11 23:40 - 2013-12-21 04:39 - 00600064 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-02-11 23:40 - 2013-12-21 02:56 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-02-11 23:38 - 2014-02-01 04:20 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-11 23:38 - 2014-02-01 04:19 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-11 23:38 - 2014-02-01 04:19 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 19274240 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 15403520 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-11 23:38 - 2014-02-01 04:18 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-11 23:38 - 2014-02-01 02:58 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-11 23:38 - 2014-02-01 02:58 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 14359040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-11 23:38 - 2014-02-01 02:57 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-11 23:38 - 2014-02-01 02:40 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-11 23:38 - 2014-02-01 02:34 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-11 17:18 - 2013-12-31 18:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls

2014-02-11 17:18 - 2013-12-31 18:04 - 00420008 _____ () C:\Windows\system32\locale.nls

2014-02-11 17:18 - 2013-12-05 21:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

2014-02-11 17:18 - 2013-12-05 21:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll

2014-02-11 17:18 - 2013-12-05 21:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll

2014-02-11 17:18 - 2013-12-05 21:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll

2014-02-11 17:18 - 2013-12-03 21:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll

2014-02-11 17:18 - 2013-12-03 21:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll

2014-02-11 17:18 - 2013-12-03 21:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll

2014-02-11 17:18 - 2013-12-03 21:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll

2014-02-11 17:18 - 2013-12-03 21:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll

2014-02-11 17:18 - 2013-12-03 21:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe

2014-02-11 17:18 - 2013-12-03 21:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe

2014-02-11 17:18 - 2013-12-03 21:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe

2014-02-11 17:18 - 2013-12-03 21:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe

2014-02-11 17:18 - 2013-12-03 21:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll

2014-02-11 17:18 - 2013-12-03 21:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll

2014-02-11 17:18 - 2013-12-03 21:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll

2014-02-11 17:18 - 2013-12-03 21:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll

2014-02-11 17:18 - 2013-12-03 21:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll

2014-02-11 17:18 - 2013-12-03 20:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe

2014-02-11 17:18 - 2013-12-03 20:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe

2014-02-11 17:18 - 2013-12-03 20:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe

2014-02-11 17:18 - 2013-12-03 20:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe

2014-02-11 17:17 - 2013-12-24 18:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll

2014-02-11 17:17 - 2013-12-24 17:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll

2014-02-11 17:17 - 2013-11-26 03:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll

2014-02-11 17:17 - 2013-11-22 17:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll

2014-02-10 17:22 - 2014-02-12 06:26 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForDavid.job

2014-02-10 17:22 - 2014-02-11 17:15 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForDavid

2014-02-07 22:50 - 2014-02-07 22:50 - 17890696 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2014-02-07 22:38 - 2014-02-07 22:38 - 00002259 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-07 22:37 - 2014-02-07 22:37 - 00847344 _____ (Google Inc.) C:\Users\David\Downloads\ChromeSetup.exe

2014-02-07 22:35 - 2014-02-07 22:35 - 00001133 _____ () C:\Users\Public\Desktop\Opera 19.lnk

2014-02-07 22:35 - 2014-02-07 22:35 - 00000000 ____D () C:\Users\David\AppData\Roaming\Opera Software

2014-02-07 22:35 - 2014-02-07 22:35 - 00000000 ____D () C:\Users\David\AppData\Local\Opera Software

2014-02-07 22:22 - 2014-02-07 22:22 - 00001833 _____ () C:\Users\Public\Desktop\Opera.lnk

2014-02-07 21:13 - 2014-02-07 21:52 - 00153053 _____ () C:\Windows\system32\Drivers\klin.dat

2014-02-07 21:13 - 2014-02-07 21:52 - 00107384 _____ () C:\Windows\system32\Drivers\klick.dat

2014-02-07 21:11 - 2014-02-15 15:00 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2014-02-07 21:11 - 2014-02-07 21:52 - 00637272 _____ (Kaspersky Lab) C:\Windows\system32\Drivers\klif.sys

2014-02-07 21:11 - 2014-02-07 21:11 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab

2014-02-07 17:26 - 2014-02-07 17:27 - 00000000 ____D () C:\04055f4155269a291a49431553

2014-01-23 23:03 - 2014-01-23 23:03 - 00000000 ____D () C:\Users\David\AppData\Local\Overwolf

==================== One Month Modified Files and Folders =======

2014-02-15 16:42 - 2014-02-15 16:41 - 00012284 _____ () C:\Users\David\Desktop\FRST.txt

2014-02-15 16:41 - 2014-02-15 16:41 - 00000000 ____D () C:\FRST

2014-02-15 16:40 - 2014-02-15 16:40 - 02152960 _____ (Farbar) C:\Users\David\Desktop\FRST64.exe

2014-02-15 16:40 - 2013-03-18 05:56 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-02-15 16:26 - 2013-06-30 05:48 - 01550383 _____ () C:\Windows\WindowsUpdate.log

2014-02-15 15:50 - 2013-03-07 20:07 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-02-15 15:00 - 2014-02-07 21:11 - 00000000 ____D () C:\ProgramData\Kaspersky Lab

2014-02-15 14:53 - 2009-07-13 23:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-02-15 14:53 - 2009-07-13 23:45 - 00032064 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-02-15 14:46 - 2013-03-18 05:56 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-02-15 14:45 - 2014-01-14 06:27 - 00002072 _____ () C:\Windows\setupact.log

2014-02-15 14:45 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-02-14 21:05 - 2014-02-14 20:44 - 00000000 ____D () C:\ComboFix

2014-02-14 21:04 - 2014-02-14 21:04 - 01324381 _____ () C:\ComboFix.txt

2014-02-14 21:04 - 2014-02-14 19:53 - 00000000 ____D () C:\Qoobox

2014-02-14 21:04 - 2012-04-25 01:44 - 00000000 ____D () C:\Users\David\AppData\Local\Apps\2.0

2014-02-14 21:04 - 2009-07-13 22:20 - 00000000 __RHD () C:\Users\Default

2014-02-14 21:02 - 2014-02-14 19:53 - 00000000 ____D () C:\Windows\erdnt

2014-02-14 20:58 - 2009-07-13 21:34 - 00000215 _____ () C:\Windows\system.ini

2014-02-14 20:57 - 2014-01-14 06:27 - 00002280 _____ () C:\Windows\PFRO.log

2014-02-14 20:17 - 2012-04-23 16:52 - 00003926 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{F0050964-46A8-4D83-AF84-5BA10EEE3A80}

2014-02-14 20:05 - 2014-02-14 20:05 - 00000000 ____D () C:\Users\David\Documents\ProcAlyzer Dumps

2014-02-14 20:05 - 2013-02-23 00:09 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-02-14 19:52 - 2014-02-14 19:51 - 05183211 ____R (Swearware) C:\Users\David\Desktop\ComboFix.exe

2014-02-14 19:04 - 2014-02-14 19:04 - 00001109 _____ () C:\Users\David\Desktop\AdwCleaner[s0].txt

2014-02-14 18:54 - 2014-02-14 18:52 - 00000000 ____D () C:\AdwCleaner

2014-02-14 18:49 - 2014-02-14 18:49 - 00003875 _____ () C:\Users\David\Desktop\JRT.txt

2014-02-14 18:36 - 2014-02-14 18:36 - 00000000 ____D () C:\Windows\ERUNT

2014-02-14 18:34 - 2014-02-14 18:34 - 01166132 _____ () C:\Users\David\Desktop\AdwCleaner.exe

2014-02-14 18:34 - 2014-02-14 18:33 - 01037530 _____ (Thisisu) C:\Users\David\Desktop\JRT.exe

2014-02-14 18:10 - 2014-02-14 18:10 - 00021739 _____ () C:\Users\David\Desktop\dds.txt

2014-02-14 18:10 - 2014-02-14 18:10 - 00007036 _____ () C:\Users\David\Desktop\attach.txt

2014-02-14 18:08 - 2014-02-14 18:08 - 00688992 ____R (Swearware) C:\Users\David\Desktop\dds.scr

2014-02-12 06:37 - 2014-02-12 06:34 - 00000000 ____D () C:\Program Files (x86)\GUM8CD3.tmp

2014-02-12 06:35 - 2013-03-18 05:56 - 00003892 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-02-12 06:35 - 2013-03-18 05:56 - 00003640 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-02-12 06:27 - 2007-01-01 20:25 - 00000000 ____D () C:\Windows\Panther

2014-02-12 06:26 - 2014-02-10 17:22 - 00000332 _____ () C:\Windows\Tasks\HPCeeScheduleForDavid.job

2014-02-11 23:42 - 2013-02-19 19:09 - 00776230 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI

2014-02-11 23:42 - 2009-07-14 00:13 - 00776230 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-02-11 17:28 - 2013-02-12 17:24 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt

2014-02-11 17:28 - 2012-05-01 15:26 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log

2014-02-11 17:15 - 2014-02-10 17:22 - 00003186 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForDavid

2014-02-10 23:35 - 2013-03-24 06:02 - 00000000 ____D () C:\Users\David\AppData\Roaming\TS3Client

2014-02-08 07:19 - 2012-06-27 01:55 - 00003218 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForDAVID-HP$

2014-02-08 07:19 - 2012-05-01 15:12 - 00000342 _____ () C:\Windows\Tasks\HPCeeScheduleForDAVID-HP$.job

2014-02-07 22:50 - 2014-02-07 22:50 - 17890696 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

2014-02-07 22:50 - 2013-03-07 20:07 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-02-07 22:50 - 2012-10-09 06:34 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-02-07 22:50 - 2011-10-25 23:12 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-02-07 22:38 - 2014-02-07 22:38 - 00002259 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2014-02-07 22:38 - 2013-03-18 05:56 - 00000000 ____D () C:\Program Files (x86)\Google

2014-02-07 22:37 - 2014-02-07 22:37 - 00847344 _____ (Google Inc.) C:\Users\David\Downloads\ChromeSetup.exe

2014-02-07 22:35 - 2014-02-07 22:35 - 00001133 _____ () C:\Users\Public\Desktop\Opera 19.lnk

2014-02-07 22:35 - 2014-02-07 22:35 - 00000000 ____D () C:\Users\David\AppData\Roaming\Opera Software

2014-02-07 22:35 - 2014-02-07 22:35 - 00000000 ____D () C:\Users\David\AppData\Local\Opera Software

2014-02-07 22:35 - 2013-05-31 17:34 - 00000000 ____D () C:\Program Files (x86)\Opera

2014-02-07 22:22 - 2014-02-07 22:22 - 00001833 _____ () C:\Users\Public\Desktop\Opera.lnk

2014-02-07 22:22 - 2013-05-31 17:34 - 00000000 ____D () C:\Users\David\AppData\Roaming\Opera

2014-02-07 22:22 - 2013-05-31 17:34 - 00000000 ____D () C:\Users\David\AppData\Local\Opera

2014-02-07 22:09 - 2012-04-25 01:44 - 00000000 ____D () C:\Users\David\AppData\Local\Google

2014-02-07 21:52 - 2014-02-07 21:13 - 00153053 _____ () C:\Windows\system32\Drivers\klin.dat

2014-02-07 21:52 - 2014-02-07 21:13 - 00107384 _____ () C:\Windows\system32\Drivers\klick.dat

2014-02-07 21:52 - 2014-02-07 21:11 - 00637272 _____ (Kaspersky Lab) C:\Windows\system32\Drivers\klif.sys

2014-02-07 21:11 - 2014-02-07 21:11 - 00000000 ____D () C:\Program Files (x86)\Kaspersky Lab

2014-02-07 20:58 - 2013-05-31 17:52 - 00000000 ____D () C:\Users\hedev

2014-02-07 20:55 - 2012-05-07 11:01 - 00002019 _____ () C:\Users\Public\Desktop\Adobe Reader X.lnk

2014-02-07 20:45 - 2013-06-29 04:16 - 00000000 ____D () C:\ProgramData\Licenses

2014-02-07 20:45 - 2012-10-09 06:34 - 00000000 ____D () C:\Windows\system32\Macromed

2014-02-07 20:45 - 2012-04-23 16:45 - 00000000 ____D () C:\Users\David

2014-02-07 20:45 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration

2014-02-07 17:27 - 2014-02-07 17:26 - 00000000 ____D () C:\04055f4155269a291a49431553

2014-02-04 20:13 - 2012-04-25 01:44 - 00000000 ____D () C:\Users\David\AppData\Local\Deployment

2014-02-01 04:20 - 2014-02-11 23:38 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-01 04:19 - 2014-02-11 23:38 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-01 04:19 - 2014-02-11 23:38 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 19274240 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 15403520 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-01 04:18 - 2014-02-11 23:38 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-01 02:58 - 2014-02-11 23:38 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-01 02:58 - 2014-02-11 23:38 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 14359040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 13760512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-01 02:57 - 2014-02-11 23:38 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-01 02:40 - 2014-02-11 23:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-01 02:34 - 2014-02-11 23:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-01-23 23:03 - 2014-01-23 23:03 - 00000000 ____D () C:\Users\David\AppData\Local\Overwolf

2014-01-16 09:59 - 2010-11-20 22:27 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-02-09 05:38

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-02-2014 01

Ran by David at 2014-02-15 16:43:03

Running from C:\Users\David\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

AV: Kaspersky Anti-Virus (Enabled - Up to date) {2EAA32A5-1EE1-1B22-95DA-337730C6E984}

AS: Kaspersky Anti-Virus (Enabled - Up to date) {95CBD341-38DB-14AC-AF6A-08054B41A339}

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.21 (x32 Version: 9.21.00.0 - Igor Pavlov)

Adobe Flash Player 12 ActiveX (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Flash Player 12 Plugin (x32 Version: 12.0.0.44 - Adobe Systems Incorporated)

Adobe Reader X (10.1.9) MUI (x32 Version: 10.1.9 - Adobe Systems Incorporated)

Adobe Shockwave Player 12.0 (x32 Version: 12.0.4.144 - Adobe Systems, Inc.)

Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios)

Age of Empires III (x32 Version: 1.00.0000 - Microsoft Game Studios) Hidden

AMD Accelerated Video Transcoding (Version: 12.5.100.21219 - Advanced Micro Devices, Inc.) Hidden

AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden

AMD Catalyst Install Manager (Version: 8.0.903.0 - Advanced Micro Devices, Inc.)

AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden

AMD Fuel (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

AMD Media Foundation Decoders (Version: 1.0.71219.1540 - Advanced Micro Devices, Inc.) Hidden

AMD Steady Video Plug-In (Version: 1.00.0000 - AMD) Hidden

AMD VISION Engine Control Center (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden

Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden

Blio (x32 Version: 2.2.8188 - K-NFB Reading Technology, Inc.)

Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Graphics Previews Common (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center InstallProxy (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

Catalyst Control Center Localization All (x32 Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Standard (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Chinese Traditional (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Czech (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Danish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Dutch (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help English (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Finnish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help French (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help German (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Greek (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Hungarian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Italian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Japanese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Korean (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Norwegian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Polish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Portuguese (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Russian (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Spanish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Swedish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Thai (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

CCC Help Turkish (x32 Version: 2012.1219.1520.27485 - Advanced Micro Devices, Inc.) Hidden

ccc-utility64 (Version: 2012.1219.1521.27485 - Advanced Micro Devices, Inc.) Hidden

CCleaner (Version: 4.07 - Piriform)

Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden

Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden

CyberLink YouCam (x32 Version: 3.5.0.4422 - CyberLink Corp.)

CyberLink YouCam (x32 Version: 3.5.0.4422 - CyberLink Corp.) Hidden

D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden

Defraggler (Version: 2.16 - Piriform)

Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden

ESU for Microsoft Windows 7 SP1 (x32 Version: 2.1.1 - Hewlett-Packard)

Eusing Free Registry Cleaner (x32 Version: - Eusing Software)

Evernote v. 4.2.3 (x32 Version: 4.2.3.22 - Evernote Corp.)

Fallout Mod Manager 0.13.21 (x32 Version: - Q, Timeslip)

Fallout: New Vegas (x32 Version: - Bethesda Softworks)

Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden

Farmscapes (x32 Version: 2.2.0.98 - WildTangent) Hidden

FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden

Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden

Fraps (x32 Version: - )

Google Chrome (x32 Version: 32.0.1700.107 - Google Inc.)

Google Drive (x32 Version: 1.13.5782.599 - Google, Inc.)

Google Update Helper (x32 Version: 1.3.22.5 - Google Inc.) Hidden

Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden

Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden

HP Application Assistant (Version: 1.0.409.3882 - Hewlett-Packard)

HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden

HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden

HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden

HP Documentation (x32 Version: 1.1.0.0 - Hewlett-Packard)

HP Games (x32 Version: 1.0.2.5 - WildTangent)

HP Launch Box (Version: 1.0.11 - Hewlett-Packard Company)

HP MovieStore (x32 Version: 2.1.091 - Hewlett-Packard) Hidden

HP MovieStore (x32 Version: 2.1.21091.0 - Hewlett-Packard Company)

HP On Screen Display (x32 Version: 1.3.5 - Hewlett-Packard Company)

HP Power Manager (x32 Version: 1.4.7 - Hewlett-Packard Company)

HP Quick Launch (x32 Version: 2.7.2 - Hewlett-Packard Company)

HP QuickWeb (x32 Version: 3.1.1.10197 - Hewlett-Packard Company)

HP Recovery Manager (x32 Version: 2.0.0 - Hewlett-Packard) Hidden

HP Security Assistant (Version: 1.0.12 - Hewlett-Packard)

HP Setup (x32 Version: 9.0.15076.3891 - Hewlett-Packard Company)

HP Setup Manager (x32 Version: 1.2.14901.3869 - Hewlett-Packard Company)

HP Software Framework (x32 Version: 4.5.10.1 - Hewlett-Packard Company)

HP Support Assistant (x32 Version: 7.4.45.4 - Hewlett-Packard Company)

HP Webcam-101 (x32 Version: 2.17.13.0 - Alcor)

IDT Audio (x32 Version: 1.0.6433.0 - IDT)

Java 7 Update 45 (64-bit) (Version: 7.0.450 - Oracle)

Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden

Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden

John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden

Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Kaspersky Anti-Virus 2012 (x32 Version: 12.0.0.374 - Kaspersky Lab)

Kaspersky Anti-Virus 2012 (x32 Version: 12.0.0.374 - Kaspersky Lab) Hidden

Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden

Luxor HD (x32 Version: 2.2.0.98 - WildTangent) Hidden

Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden

Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300 - Malwarebytes Corporation)

Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden

Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden

Microsoft Mouse and Keyboard Center (Version: 2.2.173.0 - Microsoft Corporation)

Microsoft Mouse and Keyboard Center (Version: 2.2.173.0 - Microsoft Corporation) Hidden

Microsoft Office 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden

Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)

Microsoft Office Starter 2010 - English (x32 Version: 14.0.5139.5005 - Microsoft Corporation)

Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)

Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)

Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319 - Microsoft Corporation)

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)

Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.) Hidden

MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden

MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)

MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)

Nexus Mod Manager (Version: 0.44.1 - Black Tree Gaming)

NVIDIA Texture Tools 2 - 64 bit (x32 Version: 2.0 - )

OI App Manager (x32 Version: - Optimum Installer)

opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden

Opera 12.15 (x32 Version: 12.15.1748 - Opera Software ASA)

Opera Stable 19.0.1326.59 (x32 Version: 19.0.1326.59 - Opera Software ASA)

Parsec (HKCU Version: 1.0.0.25 - Parsec)

Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden

Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden

PlayReady PC Runtime x86 (x32 Version: 1.3.0 - Microsoft Corporation)

Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden

Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden

Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden

RadeonPro 1.0 (Build 1.1.1.0) (x32 Version: - )

Ralink RT2860 Wireless LAN Card (x32 Version: 1.2.0.41 - Ralink)

Realtek Ethernet Controller Driver (x32 Version: 7.46.610.2011 - Realtek)

Realtek PCIE Card Reader (x32 Version: 6.1.7601.84 - Realtek Semiconductor Corp.)

RollerCoaster Tycoon 3: Platinum (x32 Version: 2.2.0.98 - WildTangent) Hidden

SAMSUNG Mobile Modem Driver Set (Version: - )

Samsung Mobile phone USB driver Drive Software (Version: - )

SAMSUNG Mobile USB Modem 1.0 Software (Version: - )

SAMSUNG Mobile USB Modem Software (Version: - )

Samsung PC Studio 3 USB Driver Installer (x32 Version: 3.2.0.70701 - Samsung Electronics Co., Ltd.)

Skype™ 5.10 (x32 Version: 5.10.116 - Skype Technologies S.A.)

Speccy (Version: 1.16 - Piriform)

SpywareBlaster 5.0 (x32 Version: 5.0.0 - BrightFort LLC)

Star Wars: The Old Republic (x32 Version: 1.00 - Electronic Arts, Inc.)

Steam (x32 Version: 1.0.0.0 - Valve Corporation)

Stronghold (x32 Version: 1.20.0000 - Firefly Studios)

Stronghold 2 (x32 Version: 1.40.1000 - Firefly Studios)

Stronghold Crusader Extreme (x32 Version: 1.20.0000 - Firefly Studios)

Stronghold Legends (x32 Version: 1.20.0000 - Firefly Studios)

swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden

Synaptics TouchPad Driver (Version: 16.2.17.0 - Synaptics Incorporated)

TeamSpeak 3 Client (Version: 3.0.13.1 - TeamSpeak Systems GmbH)

The Elder Scrolls V: Skyrim (x32 Version: - Bethesda Game Studios)

The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden

Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden

Unity Web Player (HKCU Version: - Unity Technologies ApS)

Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden

Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden

WildTangent Games App (HP Games) (x32 Version: 4.0.5.32 - WildTangent) Hidden

Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Essentials (x32 Version: 15.4.3538.0513 - Microsoft Corporation)

Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden

Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden

Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2 - Microsoft Corporation)

Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden

Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden

Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden

Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

WinRAR 4.20 (64-bit) (Version: 4.20.0 - win.rar GmbH)

Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Restore Points =========================

07-02-2014 22:26:02 Windows Update

08-02-2014 01:39:15 Restore Operation

08-02-2014 01:53:24 Windows Update

11-02-2014 22:15:40 Windows Update

12-02-2014 04:37:18 Windows Update

15-02-2014 01:44:44 ComboFix created restore point

==================== Hosts content: ==========================

2013-02-22 23:58 - 2014-02-14 20:58 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts

127.0.0.1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {05856EA6-8359-4F9D-BA85-2724AB754486} - System32\Tasks\HPCeeScheduleForDAVID-HP$ => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)

Task: {1CDE27DC-BA01-4CD6-956D-BDADB82A94D3} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2013-05-13] (Microsoft)

Task: {2481F22C-EF88-48FD-A7FD-4CB47BB22B65} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)

Task: {2E20D111-322C-4636-A39A-2563F04A48CD} - System32\Tasks\Synaptics TouchPad Enhancements => \Program Files\Synaptics\SynTP\SynTPEnh.exe [2012-09-28] (Synaptics Incorporated)

Task: {3BB9FE89-FF86-43F5-A9E7-A936F8DF89D0} - System32\Tasks\{967630D4-94E1-4BC8-9FD4-A4358F26BBE2} => C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe [2013-11-19] (BioWare)

Task: {48F2000A-8373-45D5-974B-2D3AFD578F00} - System32\Tasks\HPCeeScheduleForDavid => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)

Task: {4FB11216-521F-4D88-B897-4A5A56A8C0D8} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-20] (Adobe Systems Incorporated)

Task: {521BA654-6AE8-4706-9D73-D2E1D16497FC} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {75167648-6718-4938-A1B6-BCA0F6F90975} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-08-22] (CyberLink)

Task: {77373059-7E03-4F65-B389-3E412DD677DE} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)

Task: {7FFF4D31-2FD5-4A6D-AFB5-713B7403D6EE} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(No) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe [2013-12-12] (Hewlett-Packard)

Task: {80FD6D90-3D9C-4048-9CA3-959C1E75A3B2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)

Task: {8351EF43-1928-4D6F-A5A0-3EBB46DC4373} - System32\Tasks\Razer_Game_Booster_AutoUpdate => C:\Program Files (x86)\Razer\Razer Game Booster\AutoUpdate.exe

Task: {8B654CD1-25F3-4200-934E-9219DDCD2368} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(Yes) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe [2013-12-12] (Hewlett-Packard)

Task: {953BC360-723E-4154-80C6-CA18A53F2ABA} - System32\Tasks\SidebarExecute => C:\Program Files\Windows Sidebar\sidebar.exe

Task: {9754796B-49E2-4F5D-BFEA-2A42CF3E1995} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-18] (Google Inc.)

Task: {9CB96597-3CC7-40ED-8CB4-E1680EFE2346} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2013-05-13] (Microsoft Corporation)

Task: {A1A41F7F-49F3-4034-B96D-9F7B4DE6E62E} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-10-21] (Piriform Ltd)

Task: {AEFAFE8B-AA2E-4413-BD2F-B00B728A5DEC} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-03-18] (Google Inc.)

Task: {B9C20318-6AF7-489C-A231-D25F9B5D0837} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2013-12-12] (Hewlett-Packard Company)

Task: {C2464FB5-3B63-4B4D-98D8-B028F96428C9} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2013-05-13] (Microsoft Corporation)

Task: {CDC7994A-7A8B-4816-8273-48446D79B241} - System32\Tasks\{9F4A97ED-3634-4938-90C8-8A12AA2AB1A4} => C:\Program Files (x86)\Electronic Arts\BioWare\Star Wars - The Old Republic\launcher.exe [2013-11-19] (BioWare)

Task: {D50CC32E-7694-4200-AC02-8087398C59B2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-11-22] (Hewlett-Packard)

Task: {F5FFBF98-C544-49CB-903A-1B47D2D7758A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-11-22] (Hewlett-Packard)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\HPCeeScheduleForDAVID-HP$.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

Task: C:\Windows\Tasks\HPCeeScheduleForDavid.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2011-04-24 23:13 - 2011-04-24 23:13 - 02118032 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\QtCore4.dll

2011-04-24 23:13 - 2011-04-24 23:13 - 07008656 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\QtGui4.dll

2011-04-24 23:13 - 2011-04-24 23:13 - 02089360 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\QtDeclarative4.dll

2011-04-24 23:13 - 2011-04-24 23:13 - 01270160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\QtScript4.dll

2011-04-24 23:13 - 2011-04-24 23:13 - 00192912 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\QtSql4.dll

2011-04-24 23:13 - 2011-04-24 23:13 - 00758160 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\QtNetwork4.dll

2011-04-20 19:56 - 2011-04-20 19:56 - 00025088 _____ () C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2012\imageformats\qgif4.dll

2014-01-03 01:59 - 2014-02-10 12:04 - 00430080 _____ () C:\Windows\mod_frst.exe

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:5C321E34

==================== Safe Mode (whitelisted) ===================

==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

MSCONFIG\startupreg: Game Fire => C:\Program Files (x86)\Smart PC Utilities\Game Fire\GFTray.exe /START

MSCONFIG\startupreg: Google Update => "C:\Users\David\AppData\Local\Google\Update\GoogleUpdate.exe" /c

MSCONFIG\startupreg: HP Quick Launch => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe

MSCONFIG\startupreg: HPOSD => C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe

MSCONFIG\startupreg: HPQuickWebProxy => "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"

MSCONFIG\startupreg: SDTray => "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe"

MSCONFIG\startupreg: SetDefault => C:\Program Files\Hewlett-Packard\HP LaunchBox\SetDefault.exe

MSCONFIG\startupreg: Sidebar => C:\Program Files\Windows Sidebar\sidebar.exe /autoRun

MSCONFIG\startupreg: StartCCC => "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (02/15/2014 02:47:10 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2014 07:00:55 AM) (Source: Chrome) (User: NT AUTHORITY)

Description: Chrome has encountered a fatal error.

ver=32.0.1700.107;lang=;id=;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\4703e0f2-7c0f-4a6b-9b98-d06174171a1e.dmp

Error: (02/15/2014 06:54:52 AM) (Source: Chrome) (User: NT AUTHORITY)

Description: Chrome has encountered a fatal error.

ver=32.0.1700.107;lang=;id=;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\b7b66f45-eb95-4481-b355-d8562f0b4857.dmp

Error: (02/15/2014 06:39:29 AM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2014 08:59:16 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2014 08:52:08 PM) (Source: CVHSVC) (User: )

Description: Information only.

(Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: The server name or address could not be resolved

Error: (02/14/2014 08:42:52 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2014 08:20:59 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2014 06:56:54 PM) (Source: WinMgmt) (User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

System errors:

=============

Error: (02/15/2014 02:45:27 PM) (Source: EventLog) (User: )

Description: The previous system shutdown at 7:39:35 AM on ‎2/‎15/‎2014 was unexpected.

Error: (02/15/2014 06:37:46 AM) (Source: EventLog) (User: )

Description: The previous system shutdown at 1:27:22 AM on ‎2/‎15/‎2014 was unexpected.

Error: (02/14/2014 09:00:26 PM) (Source: Service Control Manager) (User: )

Description: The HP Support Assistant Service service failed to start due to the following error:

%%31

Error: (02/14/2014 08:56:41 PM) (Source: Service Control Manager) (User: )

Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (02/14/2014 08:56:02 PM) (Source: Application Popup) (User: )

Description: \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.

Error: (02/14/2014 08:52:40 PM) (Source: Service Control Manager) (User: )

Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (02/14/2014 07:26:51 PM) (Source: Service Control Manager) (User: )

Description: The Spybot-S&D 2 Updating Service service depends on the Secondary Logon service which failed to start because of the following error:

%%1058

Error: (02/14/2014 06:56:49 PM) (Source: Service Control Manager) (User: )

Description: The Spybot-S&D 2 Updating Service service depends on the Secondary Logon service which failed to start because of the following error:

%%1058

Error: (02/14/2014 06:56:21 PM) (Source: EventLog) (User: )

Description: The previous system shutdown at 6:55:10 PM on ‎2/‎14/‎2014 was unexpected.

Microsoft Office Sessions:

=========================

Error: (02/15/2014 02:47:10 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/15/2014 07:00:55 AM) (Source: Chrome)(User: NT AUTHORITY)

Description: Chrome has encountered a fatal error.

ver=32.0.1700.107;lang=;id=;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\4703e0f2-7c0f-4a6b-9b98-d06174171a1e.dmp

Error: (02/15/2014 06:54:52 AM) (Source: Chrome)(User: NT AUTHORITY)

Description: Chrome has encountered a fatal error.

ver=32.0.1700.107;lang=;id=;is_machine=1;oop=1;upload=1;minidump=C:\Program Files (x86)\Google\CrashReports\b7b66f45-eb95-4481-b355-d8562f0b4857.dmp

Error: (02/15/2014 06:39:29 AM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2014 08:59:16 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2014 08:52:08 PM) (Source: CVHSVC)(User: )

Description: (Patch task for {90140011-0066-0409-0000-0000000FF1CE}): DownloadLatest Failed: The server name or address could not be resolved

Error: (02/14/2014 08:42:52 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2014 08:20:59 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/14/2014 06:56:54 PM) (Source: WinMgmt)(User: )

Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

CodeIntegrity Errors:

===================================

Date: 2014-02-14 20:56:02.071

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-02-14 20:56:02.009

Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.

Date: 2014-01-22 20:49:01.937

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-01-22 20:49:01.937

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-01-22 20:49:01.937

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-01-22 20:29:59.235

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-01-22 20:29:59.235

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-01-22 20:29:59.235

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\KLELAMX64\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-12-04 22:29:19.059

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-12-04 22:29:19.059

Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\ELAMBKUP\klelam.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Percentage of memory in use: 25%

Total physical RAM: 3562.91 MB

Available physical RAM: 2668.29 MB

Total Pagefile: 8904.09 MB

Available Pagefile: 7451.94 MB

Total Virtual: 8192 MB

Available Virtual: 8191.83 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:440.78 GB) (Free:314.04 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Drive d: (Recovery) (Fixed) (Total:20.82 GB) (Free:2.25 GB) NTFS ==>[system with boot components (obtained from reading drive)]

Drive e: (HP_TOOLS) (Fixed) (Total:3.96 GB) (Free:1.08 GB) FAT32

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: B0B9757B)

Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=441 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=21 GB) - (Type=07 NTFS)

Partition 4: (Not Active) - (Size=4 GB) - (Type=0C)

==================== End Of Log ============================

Tomk1 · February 15, 2014

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it and select copy. Paste this into the open notepad. Save it on the desktop as fixlist.txt

AlternateDataStreams: C:\ProgramData\Temp:5C321E34CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to the operating system

Run FRST/FRST64 and press the Fix button just once and wait.
If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
When finished FRST will generate a log on the Desktop (Fixlog.txt). Please post it to your reply.

ThirdTimesTheCharm · February 15, 2014

It didn't restart...

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-02-2014 01

Ran by David at 2014-02-15 18:29:45 Run:1

Running from C:\Users\David\Desktop

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

AlternateDataStreams: C:\ProgramData\Temp:5C321E34

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

*****************

C:\ProgramData\Temp => ":5C321E34" ADS removed successfully.

HKLM\SOFTWARE\Policies\Google => Key deleted successfully.

==== End of Fixlog ====

Tomk1 · February 15, 2014

Let's try one more tool,

Download RogueKiller and save it to your desktop.
Quit all other programs
Start RogueKiller.exe
Wait until the Prescan has finished ...
Click on Scan
Wait for the end of the scan
A report will be created on your desktop.
Click on the Delete button
Next click on the ShortcutsFix
another report will be created on your desktop.

Please post: All RKreport.txt text files located on your desktop.

ThirdTimesTheCharm · February 15, 2014

RogueKiller V8.8.7 _x64_ [Feb 11 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : David [Admin rights]

Mode : Scan -- Date : 02/15/2014 18:59:58

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> FOUND

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST950032 5AS SATA Disk Device +++++

--- User ---

[MBR] 3c76095dcbb3890a2da436ef3d21bff3

[bSP] 4d418d3c667ba0ecd9b5e11daf380f57 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 451361 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 924796928 | Size: 21315 Mo

3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 968450048 | Size: 4063 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] 15253e84d3099f1e7c11d78750ef9d71

[bSP] 4d418d3c667ba0ecd9b5e11daf380f57 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 77824 Mo

1 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 159793152 | Size: 4000 Mo

2 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 167985152 | Size: 2000 Mo

3 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 172081152 | Size: 25000 Mo

Finished : << RKreport[0]_S_02152014_185958.txt >>

RogueKiller V8.8.7 _x64_ [Feb 11 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : David [Admin rights]

Mode : Remove -- Date : 02/15/2014 19:00:20

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 8 ¤¤¤

[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED

[HJ POL][PUM] HKLM\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)

[HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> REPLACED (1)

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> [0x2] The system cannot find the file specified.

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : ConsentPromptBehaviorAdmin (0) -> REPLACED (2)

[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> REPLACED (1)

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤

--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST950032 5AS SATA Disk Device +++++

--- User ---

[MBR] 3c76095dcbb3890a2da436ef3d21bff3

[bSP] 4d418d3c667ba0ecd9b5e11daf380f57 : Windows 7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo

1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 451361 Mo

2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 924796928 | Size: 21315 Mo

3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 968450048 | Size: 4063 Mo

User = LL1 ... OK!

User != LL2 ... KO!

--- LL2 ---

[MBR] 15253e84d3099f1e7c11d78750ef9d71

[bSP] 4d418d3c667ba0ecd9b5e11daf380f57 : Windows 7/8 MBR Code

Partition table:

0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 77824 Mo

1 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 159793152 | Size: 4000 Mo

2 - [ACTIVE] FAT16 (0x06) [VISIBLE] Offset (sectors): 167985152 | Size: 2000 Mo

3 - [XXXXXX] FAT16 (0x06) [VISIBLE] Offset (sectors): 172081152 | Size: 25000 Mo

Finished : << RKreport[0]_D_02152014_190020.txt >>

RKreport[0]_S_02152014_185958.txt

RogueKiller V8.8.7 _x64_ [Feb 11 2014] by Tigzy

mail : tigzyRK<at>gmail<dot>com

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : David [Admin rights]

Mode : Shortcuts HJfix -- Date : 02/15/2014 19:00:57

| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ File attributes restored: ¤¤¤

Desktop: Success 0 / Fail 0

Quick launch: Success 0 / Fail 0

Programs: Success 0 / Fail 0

Start menu: Success 0 / Fail 0

User folder: Success 0 / Fail 0

My documents: Success 0 / Fail 0

My favorites: Success 0 / Fail 0

My pictures: Success 0 / Fail 0

My music: Success 0 / Fail 0

My videos: Success 0 / Fail 0

Local drives: Success 14 / Fail 7

Backup: [NOT FOUND]

Drives:

[C:] \Device\HarddiskVolume2 -- 0x3 --> Restored

[D:] \Device\HarddiskVolume3 -- 0x3 --> Restored

[E:] \Device\HarddiskVolume4 -- 0x3 --> Restored

[F:] \Device\CdRom0 -- 0x5 --> Skipped

[Q:] \Device\SftVol -- 0x3 --> Restored

¤¤¤ Infection : ¤¤¤

Finished : << RKreport[0]_SC_02152014_190057.txt >>

RKreport[0]_D_02152014_190020.txt;RKreport[0]_S_02152014_185958.txt

ThirdTimesTheCharm · February 16, 2014

Ok so.. it does seems like its running better but somethings are still weird. Like every time I turn it on all my Icons are moved around.

Tomk1 · February 17, 2014

Sorry I haven't replied sooner. ISP was down all weekend.

Now that I think we have the garbage all off... let's see if we can restore files that may be corrupted.

Download Windows Repair (All in One) from this site

Install the program then run it.

NOTE 1. In Windows Vista, 7 and 8 right click on the program, click "Run As Administrator".
NOTE 2. Disable your antivirus program before running Windows Repair.

Go to Step 2 and allow it to run CheckDisk by clicking on Do It button:

Once that is done then go to Step 3 and allow it to run System File Check by clicking on Do It button:

Go to Step 4 and under "System Restore" click on Create button:

Go to Start Repairs tab and click Start button.

Leave all checkmarks as they're.
NOTE for Windows 8 users. Reset Registry Permissions is NOT checked by design.

Click on Start button.

Post Windows Repair log (_windows_repair_log.txt) which is located in the following folder:
64-bit systems - C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\Logs
32-bit systems - C:\Program Files\Tweaking.com\Windows Repair (All in One)\Logs

ThirdTimesTheCharm · February 18, 2014

System Variables

--------------------------------------------------------------------------------

OS: Windows 7 Home Premium

OS Architecture: 64-bit

OS Version: 6.1.7601

OS Service Pack: Service Pack 1

Computer Name: DAVID-HP

Windows Drive: C:\

Windows Path: C:\Windows

Current Profile: C:\Users\David

Current Profile SID: S-1-5-21-4201675084-2931941455-1995591251-1001

Current Profile Classes: S-1-5-21-4201675084-2931941455-1995591251-1001_Classes

Profiles Location: C:\Users

Profiles Location 2: C:\Windows\ServiceProfiles

Local Settings AppData: C:\Users\David\AppData\Local

--------------------------------------------------------------------------------

Starting Repairs...

Start (2/18/2014 6:20:22 AM)

01 - Reset Registry Permissions 01/03

HKEY_CURRENT_USER & Sub Keys

Start (2/18/2014 6:20:22 AM)

Running Repair Under Current User Account

Done (2/18/2014 6:20:33 AM)

01 - Reset Registry Permissions 02/03

HKEY_LOCAL_MACHINE & Sub Keys

Start (2/18/2014 6:20:33 AM)

Running Repair Under System Account

Done (2/18/2014 6:22:53 AM)

01 - Reset Registry Permissions 03/03

HKEY_CLASSES_ROOT & Sub Keys

Start (2/18/2014 6:22:53 AM)

Running Repair Under System Account

Done (2/18/2014 6:23:39 AM)

03 - Register System Files

Start (2/18/2014 6:23:39 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:24:44 AM)

04 - Repair WMI

Start (2/18/2014 6:24:44 AM)

Running Repair Under Current User Account

Done (2/18/2014 6:29:06 AM)

05 - Repair Windows Firewall

Start (2/18/2014 6:29:06 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:29:47 AM)

06 - Repair Internet Explorer

Start (2/18/2014 6:29:48 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:30:48 AM)

07 - Repair MDAC/MS Jet

Start (2/18/2014 6:30:48 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:31:18 AM)

08 - Repair Hosts File

Start (2/18/2014 6:31:18 AM)

Running Repair Under System Account

Done (2/18/2014 6:31:20 AM)

09 - Remove Policies Set By Infections

Start (2/18/2014 6:31:20 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:31:25 AM)

11 - Repair Icons

Start (2/18/2014 6:31:25 AM)

Running Repair Under System Account

Done (2/18/2014 6:31:27 AM)

12 - Repair Winsock & DNS Cache

Start (2/18/2014 6:31:27 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:31:59 AM)

14 - Repair Proxy Settings

Start (2/18/2014 6:31:59 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:32:03 AM)

16 - Repair Windows Updates

Start (2/18/2014 6:32:03 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:32:42 AM)

17 - Repair CD/DVD Missing/Not Working

Start (2/18/2014 6:32:42 AM)

iTunes not found, not applying UpperFilters iTunes Reg Key

Done (2/18/2014 6:32:42 AM)

18 - Repair Volume Shadow Copy Service

Start (2/18/2014 6:32:42 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:32:55 AM)

20 - Repair MSI (Windows Installer)

Start (2/18/2014 6:32:55 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:08 AM)

22.01 - Repair bat Association

Start (2/18/2014 6:33:08 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:13 AM)

22.02 - Repair cmd Association

Start (2/18/2014 6:33:13 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:18 AM)

22.03 - Repair com Association

Start (2/18/2014 6:33:18 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:22 AM)

22.04 - Repair Directory Association

Start (2/18/2014 6:33:22 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:27 AM)

22.05 - Repair Drive Association

Start (2/18/2014 6:33:27 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:32 AM)

22.06 - Repair exe Association

Start (2/18/2014 6:33:32 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:37 AM)

22.07 - Repair Folder Association

Start (2/18/2014 6:33:37 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:41 AM)

22.08 - Repair inf Association

Start (2/18/2014 6:33:41 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:46 AM)

22.09 - Repair lnk (Shortcuts) Association

Start (2/18/2014 6:33:46 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:51 AM)

22.10 - Repair msc Association

Start (2/18/2014 6:33:51 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:33:55 AM)

22.11 - Repair reg Association

Start (2/18/2014 6:33:56 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:34:00 AM)

22.12 - Repair scr Association

Start (2/18/2014 6:34:00 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:34:05 AM)

23 - Repair Windows Safe Mode

Start (2/18/2014 6:34:05 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:34:10 AM)

24 - Repair Print Spooler

Start (2/18/2014 6:34:10 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:34:27 AM)

25 - Restore Important Windows Services

Start (2/18/2014 6:34:27 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:34:40 AM)

26 - Set Windows Services To Default Startup

Start (2/18/2014 6:34:40 AM)

Running Repair Under Current User Account

Running Repair Under System Account

Done (2/18/2014 6:34:53 AM)

Skipping Repair.

Repair is for Windows v6.2 (Windows 8 & Newer) or higher.

Current version: 6.1

Skipping Repair.

Repair is for Windows v6.2 (Windows 8 & Newer) or higher.

Current version: 6.1

Cleaning up empty logs...

All Selected Repairs Done.

Done (2/18/2014 6:34:53 AM)

Total Repair Time: 00:14:31

...YOU MUST RESTART YOUR SYSTEM...

Running Repair Under Current User Account

Tomk1 · February 18, 2014

When system file check ran, did it replace some files?

How do things seem to be running now?

ThirdTimesTheCharm · February 18, 2014

I do think it did replace some files.... My icons have stopped moving around but gauging how much better its running is a little tough since it turned back on many of the services that I had shut down to gain performance. Seems pretty smooth though.

Tomk1 · February 18, 2014

Well how about you post me a new set of DDS logs to give a final look.

I'm honestly not expecting much as nothing was really showing originally. Assuming I'm correct, and that you don't notice any more problems... I'll have some cleanup procedures for you.

ThirdTimesTheCharm · February 18, 2014

awesome...

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer:

Run by David at 17:46:54 on 2014-02-18

Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3563.2129 [GMT -5:00]

.

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k netsvcs

C:\Program Files\IDT\WDM\STacSV64.exe

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\system32\atieclxx.exe

C:\Windows\System32\spoolsv.exe