Infected file that MBAR cannot remediate

sewerurchin · February 24, 2014

My friend's laptop was infected with a general assortment of PUPs, which I was able to clean up using MBAM, RogueKiller and ADWCleaner. Everything seemed fine, but I decided to run MBAR just to be on the safe side. It came up with the following error:

Infected file C:\Windows\assembly\NativeImages_v2.0.50727_32\HD-Agent\11e546b4dbe1a96aba6bf088e51de388\HD-Agent.ni.exe could not be remediated because backup file is not available.

This file is stored or hidden in a way which is keeping me from being able to locate it. Otherwise, I would have uploaded it to VirusTotal.

TIA. Log follows:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.16518 BrowserJavaVersion: 10.51.2
Run by Tracey at 19:40:06 on 2014-02-23
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3835.1291 [GMT -5:00]
.
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\WLANExt.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Windows\system32\taskhost.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Windows\system32\Dwm.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
C:\Program Files (x86)\BlueStacks\HD-Agent.exe
C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\BlueStacks\HD-Service.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\BlueStacks\HD-Network.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Program Files (x86)\BlueStacks\HD-BlockDevice.exe
C:\Program Files (x86)\BlueStacks\HD-SharedFolder.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\System32\WUDFHost.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
C:\Windows\splwow64.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.exe
C:\Windows\system32\taskhost.exe
F:\1. OurPCGuy.com\1. Primary Tools\Anti-Virus-Malware-Rootkit\3. Rootkit\mbar-1.07.0.1009.exe
C:\Windows\SysWOW64\cmd.exe
C:\Users\Tracey\Desktop\mbar\mbar.exe
C:\Program Files (x86)\Everything\Everything.exe
C:\Windows\explorer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll
BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll
TB: avast! Online Security: {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
uRun: [EPSON NX510 Series] C:\Windows\System32\spool\DRIVERS\x64\3\E_IATIFIA.EXE /FU "C:\Windows\TEMP\E_S75BD.tmp" /EF "HKCU"
uRun: [Xvid] C:\Program Files (x86)\Xvid\CheckUpdate.exe
uRunOnce: [Application Restart #1] C:\Users\Tracey\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\Tracey\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session
mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [EEventManager] C:\PROGRA~2\EPSONS~1\EVENTM~1\EEventManager.exe
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [blueStacks Agent] C:\Program Files (x86)\BlueStacks\HD-Agent.exe
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [AvastUI.exe] "C:\Program Files\AVAST Software\Avast\AvastUI.exe" /nogui
mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
StartupFolder: C:\Users\Tracey\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EPSONA~1.LNK - E:\Common\EpsonReg\EpsonReg.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\KODAKE~1.LNK - C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll

TCP: NameServer = 192.168.1.1
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}\46F677E64796D656 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}\46F677E64796D656 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}\5435D46343 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}\5435D46343 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}\64B4056533 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}\64B4056533 : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}\876696E696479777966696 : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}\876696E696479777966696 : DHCPNameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{C05AD519-926E-46DA-A286-D6B3A0E85834} : NameServer = 208.67.222.222,208.67.220.220
TCP: Interfaces\{C05AD519-926E-46DA-A286-D6B3A0E85834} : DHCPNameServer = 208.67.222.222 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
x64-BHO: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: TidyNetwork: {449455CD-F9E3-308B-DFB5-F4796087A995} -
x64-BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll
x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
x64-TB: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
x64-TB: FindWide Toolbar: {3D055F23-8C44-4A99-A8CD-1FF357F43760} -
x64-TB: avast! Online Security: {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-Run: [synTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
x64-Run: [HPWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\DelayedAppStarter.exe 120 C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe /hidden
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Tracey\AppData\Roaming\Mozilla\Firefox\Profiles\6p6x4w0l.default-1393190247822\
FF - plugin: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;avast! Revert;C:\Windows\System32\drivers\aswRvrt.sys [2013-7-20 65776]
R0 aswVmm;avast! VM Monitor;C:\Windows\System32\drivers\aswVmm.sys [2013-7-20 207904]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2013-7-20 1038072]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2013-7-20 421704]
R1 SASKUTIL;SASKUTIL;C:\Program Files\SUPERAntiSpyware\saskutil64.sys [2011-7-12 12368]
R2 !SASCORE;SAS Core Service;C:\Program Files\SUPERAntiSpyware\SASCore64.exe [2013-10-10 144152]
R2 AERTFilters;Andrea RT Filters Service;C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe [2010-11-20 98208]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2010-11-20 202752]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2013-7-20 78648]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2014-2-23 50344]
R2 BstHdAndroidSvc;BlueStacks Android Service;C:\Program Files (x86)\BlueStacks\HD-Service.exe [2013-11-18 398096]
R2 BstHdDrv;BlueStacks Hypervisor;C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [2013-11-18 77584]
R2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [2013-11-18 385808]
R2 CinemaNow Service;CinemaNow Service;C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe [2010-5-21 140272]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2013-4-22 822504]
R2 HP Wireless Assistant Service;HP Wireless Assistant Service;C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe [2010-6-18 103992]
R2 HPWMISVC;HPWMISVC;C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe [2010-11-9 26680]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-10 418376]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-10 701512]
R2 RtVOsdService;RtVOsdService Installer;C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe [2010-6-24 315392]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2013-6-26 523944]
R2 TeamViewer8;TeamViewer 8;C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe [2013-7-19 5093216]
R3 aswStm;aswStm;C:\Windows\System32\drivers\aswStm.sys [2014-2-23 80184]
R3 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.EXE [2013-12-16 247968]
R3 mbamchameleon;mbamchameleon;C:\Windows\System32\drivers\mbamchameleon.sys [2014-2-23 91352]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-12-10 25928]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-2-23 119000]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-11-20 347680]
R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2013-6-26 767144]
R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2013-6-26 273576]
R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2013-6-26 28840]
R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2013-6-26 23208]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2013-6-26 207528]
R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\drivers\usbfilter.sys [2010-11-20 38456]
S1 SASDIFSV;SASDIFSV;C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys [2011-7-22 14928]
S2 BBSvc;BingBar Service;C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.EXE [2013-12-16 193696]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 HP Support Assistant Service;HP Support Assistant Service;"C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" --> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [?]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
S3 hitmanpro37;HitmanPro 3.7 Support Driver;C:\Windows\System32\drivers\hitmanpro37.sys [2013-7-20 32000]
S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-2-13 111616]
S3 netw5v64;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 64 Bit;C:\Windows\System32\drivers\netw5v64.sys [2009-6-10 5434368]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2010-11-20 245792]
S3 SrvHsfHDA;SrvHsfHDA;C:\Windows\System32\drivers\VSTAZL6.SYS [2009-7-13 292864]
S3 SrvHsfV92;SrvHsfV92;C:\Windows\System32\drivers\VSTDPV6.SYS [2009-7-13 1485312]
S3 SrvHsfWinac;SrvHsfWinac;C:\Windows\System32\drivers\VSTCNXT6.SYS [2009-7-13 740864]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-8-31 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-8-31 1255736]
S3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;C:\Windows\System32\drivers\yk62x64.sys [2009-6-10 389120]
.
=============== Created Last 30 ================
.
2014-02-24 00:04:13   --------   d-----w-   C:\Windows\ERUNT
2014-02-23 23:38:38   --------   d-----w-   C:\Program Files (x86)\Everything
2014-02-23 22:58:10   --------   d-----w-   C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-23 22:58:09   119000   ----a-w-   C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-02-23 22:57:43   91352   ----a-w-   C:\Windows\System32\drivers\mbamchameleon.sys
2014-02-23 22:46:23   75888   ----a-w-   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7B6BB83B-CF56-41E3-9F98-032F749A0434}\offreg.dll
2014-02-23 22:38:25   --------   d-----w-   C:\Users\Tracey\AppData\Roaming\SUPERAntiSpyware.com
2014-02-23 22:37:26   --------   d-----w-   C:\ProgramData\SUPERAntiSpyware.com
2014-02-23 21:49:26   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
2014-02-23 21:49:26   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
2014-02-23 21:49:26   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
2014-02-23 21:49:26   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
2014-02-23 21:49:26   159744   ----a-w-   C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
2014-02-23 21:29:49   --------   d-----w-   C:\ProgramData\Oracle
2014-02-23 21:29:20   96168   ----a-w-   C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-23 21:12:06   --------   d-----w-   C:\Users\Tracey\AppData\Roaming\AVAST Software
2014-02-23 21:07:19   80184   ----a-w-   C:\Windows\System32\drivers\aswStm.sys
2014-02-23 20:44:18   --------   d-----w-   C:\AdwCleaner
2014-02-23 20:19:30   --------   d-----w-   C:\Users\Tracey\AppData\Roaming\Hard Disk Sentinel
2014-02-21 17:40:43   10536864   ----a-w-   C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{7B6BB83B-CF56-41E3-9F98-032F749A0434}\mpengine.dll
2014-02-16 16:28:57   75376   ----a-w-   C:\Program Files (x86)\Mozilla Firefox\breakpadinjector.dll
2014-02-16 16:28:57   272496   ----a-w-   C:\Program Files (x86)\Mozilla Firefox\browser\components\browsercomps.dll
2014-02-16 16:28:57   20080   ----a-w-   C:\Program Files (x86)\Mozilla Firefox\AccessibleMarshal.dll
2014-02-13 18:54:19   548864   ----a-w-   C:\Windows\System32\vbscript.dll
2014-02-13 18:54:19   454656   ----a-w-   C:\Windows\SysWow64\vbscript.dll
2014-02-13 18:52:57   4244480   ----a-w-   C:\Windows\SysWow64\jscript9.dll
2014-02-13 18:52:56   5768704   ----a-w-   C:\Windows\System32\jscript9.dll
2014-02-13 18:48:26   1882112   ----a-w-   C:\Windows\System32\msxml3.dll
2014-02-13 18:48:25   2048   ----a-w-   C:\Windows\SysWow64\msxml3r.dll
2014-02-13 18:48:25   1237504   ----a-w-   C:\Windows\SysWow64\msxml3.dll
2014-02-13 18:48:24   2048   ----a-w-   C:\Windows\System32\msxml3r.dll
2014-02-07 22:15:12   --------   d-----w-   C:\Users\Tracey\AppData\Local\Google
2014-02-07 22:09:13   --------   d-----w-   C:\Program Files\iPod
2014-02-07 22:09:12   --------   d-----w-   C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-07 22:09:12   --------   d-----w-   C:\Program Files\iTunes
2014-02-07 22:09:12   --------   d-----w-   C:\Program Files (x86)\iTunes
2014-02-06 23:08:38   --------   d-----w-   C:\Program Files (x86)\BlueStacks
2014-01-29 22:34:33   --------   d-----w-   C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}
.
==================== Find3M ====================
.
2014-02-23 21:07:02   92544   ----a-w-   C:\Windows\System32\drivers\aswRdr2.sys
2014-02-23 21:07:02   78648   ----a-w-   C:\Windows\System32\drivers\aswMonFlt.sys
2014-02-23 21:07:02   65776   ----a-w-   C:\Windows\System32\drivers\aswRvrt.sys
2014-02-23 21:07:02   43152   ----a-w-   C:\Windows\avastSS.scr
2014-02-23 21:07:02   207904   ----a-w-   C:\Windows\System32\drivers\aswVmm.sys
2014-02-23 21:07:02   1038072   ----a-w-   C:\Windows\System32\drivers\aswSnx.sys
2014-02-20 21:49:23   71048   ----a-w-   C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-20 21:49:23   692616   ----a-w-   C:\Windows\SysWow64\FlashPlayerApp.exe
2014-02-06 11:30:46   2724864   ----a-w-   C:\Windows\System32\mshtml.tlb
2014-02-06 11:30:12   4096   ----a-w-   C:\Windows\System32\ieetwcollectorres.dll
2014-02-06 11:07:39   66048   ----a-w-   C:\Windows\System32\iesetup.dll
2014-02-06 11:06:47   48640   ----a-w-   C:\Windows\System32\ieetwproxystub.dll
2014-02-06 10:49:03   139264   ----a-w-   C:\Windows\System32\ieUnatt.exe
2014-02-06 10:48:45   111616   ----a-w-   C:\Windows\System32\ieetwcollector.exe
2014-02-06 10:48:11   708608   ----a-w-   C:\Windows\System32\jscript9diag.dll
2014-02-06 10:20:26   2724864   ----a-w-   C:\Windows\SysWow64\mshtml.tlb
2014-02-06 10:01:36   61952   ----a-w-   C:\Windows\SysWow64\iesetup.dll
2014-02-06 10:00:46   51200   ----a-w-   C:\Windows\SysWow64\ieetwproxystub.dll
2014-02-06 09:50:32   2041856   ----a-w-   C:\Windows\System32\inetcpl.cpl
2014-02-06 09:47:22   112128   ----a-w-   C:\Windows\SysWow64\ieUnatt.exe
2014-02-06 09:46:27   553472   ----a-w-   C:\Windows\SysWow64\jscript9diag.dll
2014-02-06 09:24:52   2334208   ----a-w-   C:\Windows\System32\wininet.dll
2014-02-06 09:09:30   1964032   ----a-w-   C:\Windows\SysWow64\inetcpl.cpl
2014-02-06 08:41:35   1820160   ----a-w-   C:\Windows\SysWow64\wininet.dll
2013-12-24 23:09:41   1987584   ----a-w-   C:\Windows\SysWow64\d3d10warp.dll
2013-12-24 22:48:32   2565120   ----a-w-   C:\Windows\System32\d3d10warp.dll
2013-12-18 11:13:56   270496   ------w-   C:\Windows\System32\MpSigStub.exe
2013-12-04 02:27:33   485888   ----a-w-   C:\Windows\System32\secproc_isv.dll
2013-12-04 02:27:33   123392   ----a-w-   C:\Windows\System32\secproc_ssp_isv.dll
2013-12-04 02:27:33   123392   ----a-w-   C:\Windows\System32\secproc_ssp.dll
2013-12-04 02:27:16   488448   ----a-w-   C:\Windows\System32\secproc.dll
2013-12-04 02:26:32   528384   ----a-w-   C:\Windows\System32\msdrm.dll
2013-12-04 02:16:51   658432   ----a-w-   C:\Windows\System32\RMActivate_isv.exe
2013-12-04 02:16:51   626176   ----a-w-   C:\Windows\System32\RMActivate.exe
2013-12-04 02:16:50   552960   ----a-w-   C:\Windows\System32\RMActivate_ssp_isv.exe
2013-12-04 02:16:48   553984   ----a-w-   C:\Windows\System32\RMActivate_ssp.exe
2013-12-04 02:03:20   87040   ----a-w-   C:\Windows\SysWow64\secproc_ssp_isv.dll
2013-12-04 02:03:20   87040   ----a-w-   C:\Windows\SysWow64\secproc_ssp.dll
2013-12-04 02:03:20   423936   ----a-w-   C:\Windows\SysWow64\secproc_isv.dll
2013-12-04 02:03:08   428032   ----a-w-   C:\Windows\SysWow64\secproc.dll
2013-12-04 02:02:06   390144   ----a-w-   C:\Windows\SysWow64\msdrm.dll
2013-12-04 01:54:14   510976   ----a-w-   C:\Windows\SysWow64\RMActivate_ssp.exe
2013-12-04 01:54:10   594944   ----a-w-   C:\Windows\SysWow64\RMActivate_isv.exe
2013-12-04 01:54:09   572416   ----a-w-   C:\Windows\SysWow64\RMActivate.exe
2013-12-04 01:54:06   508928   ----a-w-   C:\Windows\SysWow64\RMActivate_ssp_isv.exe
2013-11-27 01:41:37   343040   ----a-w-   C:\Windows\System32\drivers\usbhub.sys
2013-11-27 01:41:15   99840   ----a-w-   C:\Windows\System32\drivers\usbccgp.sys
2013-11-27 01:41:11   53248   ----a-w-   C:\Windows\System32\drivers\usbehci.sys
2013-11-27 01:41:11   325120   ----a-w-   C:\Windows\System32\drivers\usbport.sys
2013-11-27 01:41:09   25600   ----a-w-   C:\Windows\System32\drivers\usbohci.sys
2013-11-27 01:41:06   30720   ----a-w-   C:\Windows\System32\drivers\usbuhci.sys
2013-11-27 01:41:03   7808   ----a-w-   C:\Windows\System32\drivers\usbd.sys
2013-11-26 11:40:00   376768   ----a-w-   C:\Windows\System32\drivers\netio.sys
2013-11-26 10:32:56   3156480   ----a-w-   C:\Windows\System32\win32k.sys
2013-11-26 08:16:50   3419136   ----a-w-   C:\Windows\SysWow64\d2d1.dll
.
============= FINISH: 19:43:24.79 ===============

kevinf80 · February 24, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Please download SystemLook from the following link below and save it to your Desktop. Use the correct version 32bit or 64bit.

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefindHD-Agent.ni.exe:regfindHD-AgentHD-Agent*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Run Malwarebytes, Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick scan

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced log

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

sewerurchin · February 24, 2014

Here is everything except Addition.txt. I can't figure out how to attach it to my reply (sorry).

SystemLook 30.07.11 by jpshortstuff
Log created at 08:40 on 24/02/2014 by Tracey
Administrator - Elevation successful

========== filefind ==========

Searching for "HD-Agent.ni.exe"
C:\Windows\assembly\NativeImages_v2.0.50727_32\HD-Agent\11e546b4dbe1a96aba6bf088e51de388\HD-Agent.ni.exe --a---- 701952 bytes [19:37 15/02/2014] [19:37 15/02/2014] AC6374B1111BAE7A68AE4094A3DBF079

========== regfind ==========

Searching for "HD-Agent"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\IL\637522eb\60373663\e8]
"DisplayName"="HD-Agent,0.8.2.3018,,"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Fusion\NativeImagesIndex\v2.0.50727_32\NI\74baadb4\637522eb\dc]
"DisplayName"="HD-Agent,0.8.2.3018,,"
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727\NGENService\Roots\C:/Program Files (x86)/BlueStacks/HD-Agent.exe]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\HD-Agent_RASAPI32]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Tracing\HD-Agent_RASMANCS]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"BlueStacks Agent"="C:\Program Files (x86)\BlueStacks\HD-Agent.exe"

Searching for "HD-Agent*"
No data found.

-= EOF =-

Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.24.04

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
Tracey :: SPONGEBOB [administrator]

Protection: Enabled

2/24/2014 8:44:46 AM
mbam-log-2014-02-24 (08-44-46).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 263265
Time elapsed: 7 minute(s), 39 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 3
C:\ProgramData\Malwarebytes' Anti-Malware (portable)\HD-Agent.ni.exe-k.mbam (Spyware.Zbot.ED) -> Quarantined and deleted successfully.
C:\ProgramData\Malwarebytes' Anti-Malware (portable)\HD-Agent.ni.exe-r.mbam (Spyware.Zbot.ED) -> Quarantined and deleted successfully.
C:\ProgramData\Malwarebytes' Anti-Malware (portable)\HD-Agent.ni.exe-u.mbam (Spyware.Zbot.ED) -> Quarantined and deleted successfully.

(end)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by Tracey on Mon 02/24/2014 at 9:06:30.49
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Mon 02/24/2014 at 9:14:56.80
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-02-2014 02
Ran by Tracey (administrator) on SPONGEBOB on 24-02-2014 09:17:29
Running from C:\Users\Tracey\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe
(AMD) C:\Windows\system32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BBSvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe
(CinemaNow, Inc.) C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemanowSvc.exe
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE
(SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe
(BlueStack Systems, Inc.) C:\Program Files (x86)\BlueStacks\HD-Agent.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Service.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsdService.exe
(Realtek Semiconductor Corp.) C:\Program Files\Realtek\RtVOsd\RtVOsd.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe
(Microsoft Corporation) C:\Windows\splwow64.exe
(Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\SeaPort.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2012-12-11] (Synaptics Incorporated)
HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6489704 2012-12-11] (Realtek Semiconductor)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-06-18] (Hewlett-Packard Company)
HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-06-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [EEventManager] - C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [673616 2009-04-07] (SEIKO EPSON CORPORATION)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [586296 2010-11-09] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [blueStacks Agent] - C:\Program Files (x86)\BlueStacks\HD-Agent.exe [623376 2013-11-18] (BlueStack Systems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.)
HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-02-23] (AVAST Software)
HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\runonceex: [] -
HKU\S-1-5-19\...\Run: [sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-20\...\Run: [sidebar] - %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun
HKU\S-1-5-21-2710805990-1295866557-2246538379-1001\...\Run: [EPSON NX510 Series] - C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIFIA.EXE [223232 2009-11-04] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-2710805990-1295866557-2246538379-1001\...\Run: [Xvid] - C:\Program Files (x86)\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
HKU\S-1-5-21-2710805990-1295866557-2246538379-1001\...\RunOnce: [Application Restart #1] - C:\Users\Tracey\AppData\Local\Pokki\Engine\pokki.exe --disable-internal-flash --noerrdialogs --no-message-box --disable-extensions --disable-web-security --disable-web-resources --disable-client-side-phishing-detection --enable-file-cookies --disable-sync --disable-breakpad --disable-bundled-ppapi-flash --disable-sync-tabs --disable-speech-input --disable-custom-jumplist --process-per-tab --debug-devtools-frontend="C:\Users\Tracey\AppData\Local\Pokki\Engine\inspector" --no-first-run --lang=en-US --disable-component-update --disable-prompt-on-repost --no-startup-window --disable-translate --disable-logging --disable-desktop-notifications --disable-gpu-process-prelaunch --flag-switches-begin --flag-switches-end --restore-last-session
HKU\S-1-5-21-2710805990-1295866557-2246538379-1001\...\Policies\system: [LogonHoursAction] 2
HKU\S-1-5-21-2710805990-1295866557-2246538379-1001\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\Tracey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Epson all-in-one Registration.lnk
ShortcutTarget: Epson all-in-one Registration.lnk -> E:\Common\EpsonReg\EpsonReg.exe (No File)
GroupPolicyUsers\S-1-5-21-2710805990-1295866557-2246538379-1003\User: Group Policy restriction detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE2A71A618289CD01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - DefaultScope {CE5250CF-2D84-4052-A9F0-75250C35B162} URL = https://www.google.com/search?q={searchTerms}
SearchScopes: HKCU - {126669E4-7327-4D9A-8F07-F2C5E3BAE8B0} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10883
SearchScopes: HKCU - {CE5250CF-2D84-4052-A9F0-75250C35B162} URL = https://www.google.com/search?q={searchTerms}
BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: TidyNetwork - {449455CD-F9E3-308B-DFB5-F4796087A995} - C:\Program Files (x86)\TidyNetwork\petn64.dll No File
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\amd64\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - FindWide Toolbar - {3D055F23-8C44-4A99-A8CD-1FF357F43760} - C:\Program Files (x86)\TNT2\Profiles\10883\passport64.dll No File
Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.3.124.0\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
Tcpip\..\Interfaces\{315D5B2F-3DCF-4951-A897-FB2CA40ED8FB}: [NameServer]208.67.222.222,208.67.220.220
Tcpip\..\Interfaces\{C05AD519-926E-46DA-A286-D6B3A0E85834}: [NameServer]208.67.222.222,208.67.220.220

FireFox:
========
FF ProfilePath: C:\Users\Tracey\AppData\Roaming\Mozilla\Firefox\Profiles\6p6x4w0l.default-1393190247822
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @soft-xpansion/npsxpdf - C:\Program Files (x86)\Common Files\soft Xpansion\np-sxpdf.dll (soft Xpansion)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-07-20]

Chrome:
=======

==================== Services (Whitelisted) =================

R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [144152 2013-10-10] (SUPERAntiSpyware.com)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-02-23] (AVAST Software)
S2 BstHdAndroidSvc; C:\Program Files (x86)\BlueStacks\HD-Service.exe [398096 2013-11-18] (BlueStack Systems, Inc.)
R2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [385808 2013-11-18] (BlueStack Systems, Inc.)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
S3 WinDefend; %ProgramFiles(x86)%\Windows Defender\mpsvc.dll [X]

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-02-23] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-02-23] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-02-23] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-02-23] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-02-23] (AVAST Software)
S3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-02-23] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2014-01-22] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-02-23] ()
R2 BstHdDrv; C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [77584 2013-11-18] (BlueStack Systems)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32000 2013-07-20] ()
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [91352 2014-02-23] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [27520 2007-05-14] (Research In Motion Limited)
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S2 avgntflt; system32\DRIVERS\avgntflt.sys [X]
S1 avkmgr; system32\DRIVERS\avkmgr.sys [X]
S3 lmimirr; system32\DRIVERS\lmimirr.sys [X]
S3 MBAMSwissArmy; \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-24 09:17 - 2014-02-24 09:17 - 00017277 _____ () C:\Users\Tracey\Desktop\FRST.txt
2014-02-24 09:17 - 2014-02-24 09:17 - 00000000 ____D () C:\FRST
2014-02-24 09:05 - 2014-02-24 09:05 - 02155520 _____ (Farbar) C:\Users\Tracey\Downloads\FRST64.exe
2014-02-24 09:05 - 2014-02-24 09:05 - 02155520 _____ (Farbar) C:\Users\Tracey\Desktop\FRST64.exe
2014-02-24 09:05 - 2014-02-24 09:04 - 01037734 _____ (Thisisu) C:\Users\Tracey\Desktop\JRT.exe
2014-02-24 09:04 - 2014-02-24 09:04 - 01037734 _____ (Thisisu) C:\Users\Tracey\Downloads\JRT.exe
2014-02-24 08:39 - 2014-02-24 08:39 - 00165376 _____ () C:\Users\Tracey\Downloads\SystemLook_x64.exe
2014-02-23 19:43 - 2014-02-23 19:43 - 00025236 _____ () C:\Users\Tracey\Desktop\dds.txt
2014-02-23 19:43 - 2014-02-23 19:43 - 00007279 _____ () C:\Users\Tracey\Desktop\attach.txt
2014-02-23 19:39 - 2014-02-23 19:36 - 00688992 ____R (Swearware) C:\Users\Tracey\Desktop\dds.com
2014-02-23 19:37 - 2013-04-16 16:47 - 00008653 _____ () C:\Users\Tracey\Downloads\Occupational Employment and Wages for Nannies at My Next Move.htm
2014-02-23 19:36 - 2014-02-23 19:36 - 00688992 _____ (Swearware) C:\Users\Tracey\Downloads\dds.com
2014-02-23 19:04 - 2014-02-23 19:04 - 00000000 ____D () C:\Windows\ERUNT
2014-02-23 18:53 - 2014-02-23 18:59 - 00000000 ____D () C:\Users\Tracey\Desktop\RK_Quarantine
2014-02-23 18:38 - 2014-02-23 19:37 - 00000000 ____D () C:\Program Files (x86)\Everything
2014-02-23 18:38 - 2014-02-23 18:38 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Everything
2014-02-23 17:58 - 2014-02-24 08:53 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-23 17:57 - 2014-02-23 19:52 - 00000000 ____D () C:\Users\Tracey\Desktop\mbar
2014-02-23 17:57 - 2014-02-23 17:57 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-23 17:38 - 2014-02-23 17:38 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\SUPERAntiSpyware.com
2014-02-23 17:37 - 2014-02-23 17:37 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2014-02-23 17:37 - 2014-02-23 17:37 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2014-02-23 16:48 - 2014-02-23 16:49 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-02-23 16:46 - 2014-02-23 16:46 - 41404760 _____ (Apple Inc.) C:\Users\Tracey\Downloads\QuickTimeInstaller.exe
2014-02-23 16:44 - 2014-02-23 16:44 - 18126032 _____ (Adobe Systems Inc.) C:\Users\Tracey\Downloads\AdobeAIRInstaller.exe
2014-02-23 16:35 - 2014-02-23 16:35 - 24677393 _____ () C:\Users\Tracey\Downloads\vlc-2.1.3-win32.exe
2014-02-23 16:31 - 2014-02-23 16:31 - 29141928 _____ (Oracle Corporation) C:\Users\Tracey\Downloads\jre-7u51-windows-i586.exe
2014-02-23 16:29 - 2014-02-23 16:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-23 16:29 - 2013-12-18 21:09 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-23 16:29 - 2013-12-18 21:04 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-02-23 16:29 - 2013-12-18 21:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-02-23 16:29 - 2013-12-18 21:03 - 00174504 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-02-23 16:28 - 2014-02-23 16:29 - 00005765 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-23 16:26 - 2014-02-23 16:26 - 00921000 _____ (Oracle Corporation) C:\Users\Tracey\Downloads\jxpiinstall(1).exe
2014-02-23 16:17 - 2014-02-23 16:17 - 00000000 ____D () C:\Users\Tracey\Desktop\Old Firefox Data
2014-02-23 16:12 - 2014-02-23 16:12 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\AVAST Software
2014-02-23 16:07 - 2014-02-23 16:07 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-02-23 15:44 - 2014-02-23 15:49 - 00000000 ____D () C:\AdwCleaner
2014-02-23 15:19 - 2014-02-23 15:19 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\Hard Disk Sentinel
2014-02-23 15:00 - 2014-02-23 15:01 - 01241834 _____ () C:\Users\Tracey\Downloads\adwcleaner.exe
2014-02-21 14:44 - 2014-02-21 14:44 - 00000209 _____ () C:\Users\Daesha\Desktop\magcontour.URL
2014-02-16 11:28 - 2014-02-16 11:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-13 13:54 - 2013-12-21 04:53 - 00548864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-02-13 13:54 - 2013-12-21 03:56 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-02-13 13:53 - 2014-02-06 07:16 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-13 13:53 - 2014-02-06 06:30 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-13 13:53 - 2014-02-06 06:30 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-13 13:53 - 2014-02-06 06:12 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-13 13:53 - 2014-02-06 06:07 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-13 13:53 - 2014-02-06 06:06 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-13 13:53 - 2014-02-06 05:57 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-13 13:53 - 2014-02-06 05:56 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-13 13:53 - 2014-02-06 05:52 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-13 13:53 - 2014-02-06 05:49 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-13 13:53 - 2014-02-06 05:48 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-13 13:53 - 2014-02-06 05:48 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-13 13:53 - 2014-02-06 05:32 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-13 13:53 - 2014-02-06 05:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-13 13:53 - 2014-02-06 05:17 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-13 13:53 - 2014-02-06 05:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-13 13:53 - 2014-02-06 05:00 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-13 13:53 - 2014-02-06 04:57 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-13 13:53 - 2014-02-06 04:57 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-13 13:53 - 2014-02-06 04:52 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-13 13:53 - 2014-02-06 04:52 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-13 13:53 - 2014-02-06 04:50 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-13 13:53 - 2014-02-06 04:49 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-13 13:53 - 2014-02-06 04:47 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-13 13:53 - 2014-02-06 04:46 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-13 13:53 - 2014-02-06 04:25 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-13 13:53 - 2014-02-06 04:24 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-13 13:53 - 2014-02-06 04:22 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-13 13:53 - 2014-02-06 04:13 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-13 13:53 - 2014-02-06 04:09 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-13 13:53 - 2014-02-06 04:03 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-13 13:53 - 2014-02-06 03:55 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-13 13:53 - 2014-02-06 03:41 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-13 13:53 - 2014-02-06 03:40 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-13 13:53 - 2014-02-06 03:36 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-13 13:53 - 2014-02-06 03:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-02-13 13:52 - 2014-02-06 05:38 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-13 13:52 - 2014-02-06 05:11 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-13 13:52 - 2014-02-06 04:25 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-13 13:48 - 2013-12-31 18:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls
2014-02-13 13:48 - 2013-12-31 18:04 - 00420008 _____ () C:\Windows\system32\locale.nls
2014-02-13 13:48 - 2013-12-05 21:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-02-13 13:48 - 2013-12-05 21:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-02-13 13:48 - 2013-12-05 21:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-02-13 13:48 - 2013-12-05 21:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-02-13 13:47 - 2013-12-24 18:09 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-02-13 13:47 - 2013-12-24 17:48 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-02-13 13:47 - 2013-12-03 21:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll
2014-02-13 13:47 - 2013-12-03 21:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll
2014-02-13 13:47 - 2013-12-03 21:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll
2014-02-13 13:47 - 2013-12-03 21:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll
2014-02-13 13:47 - 2013-12-03 21:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll
2014-02-13 13:47 - 2013-12-03 21:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe
2014-02-13 13:47 - 2013-12-03 21:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe
2014-02-13 13:47 - 2013-12-03 21:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe
2014-02-13 13:47 - 2013-12-03 21:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe
2014-02-13 13:47 - 2013-12-03 21:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll
2014-02-13 13:47 - 2013-12-03 21:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll
2014-02-13 13:47 - 2013-12-03 21:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll
2014-02-13 13:47 - 2013-12-03 21:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll
2014-02-13 13:47 - 2013-12-03 21:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll
2014-02-13 13:47 - 2013-12-03 20:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe
2014-02-13 13:47 - 2013-12-03 20:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe
2014-02-13 13:47 - 2013-12-03 20:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe
2014-02-13 13:47 - 2013-12-03 20:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe
2014-02-13 13:47 - 2013-11-26 03:16 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2014-02-13 13:47 - 2013-11-22 17:48 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-02-07 17:16 - 2014-02-07 17:37 - 1418629266 _____ () C:\Users\Tracey\Downloads\AdobeCS6eng.exe
2014-02-07 17:15 - 2014-02-07 17:15 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyWordTool
2014-02-07 17:15 - 2014-02-07 17:15 - 00000000 ____D () C:\Users\Tracey\AppData\Local\Google
2014-02-07 17:10 - 2014-02-07 17:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-07 17:09 - 2014-02-07 17:10 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-07 17:09 - 2014-02-07 17:09 - 00000000 ____D () C:\Program Files\iTunes
2014-02-07 17:09 - 2014-02-07 17:09 - 00000000 ____D () C:\Program Files\iPod
2014-02-07 17:09 - 2014-02-07 17:09 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-02-06 18:16 - 2014-02-06 18:16 - 00001819 _____ () C:\Users\Public\Desktop\Apps.lnk
2014-02-06 18:15 - 2014-02-06 18:15 - 00001807 _____ () C:\Users\Public\Desktop\Start BlueStacks.lnk
2014-02-06 18:08 - 2014-02-06 18:08 - 00000000 ____D () C:\Program Files (x86)\BlueStacks
2014-02-06 12:49 - 2014-02-06 12:49 - 00000000 ____D () C:\Users\Daesha\AppData\Roaming\TeamViewer
2014-01-29 17:34 - 2014-01-29 17:34 - 00000000 ____D () C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}

==================== One Month Modified Files and Folders =======

2014-02-24 09:17 - 2014-02-24 09:17 - 00017277 _____ () C:\Users\Tracey\Desktop\FRST.txt
2014-02-24 09:17 - 2014-02-24 09:17 - 00000000 ____D () C:\FRST
2014-02-24 09:06 - 2009-07-13 23:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-24 09:06 - 2009-07-13 23:45 - 00023248 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-24 09:05 - 2014-02-24 09:05 - 02155520 _____ (Farbar) C:\Users\Tracey\Downloads\FRST64.exe
2014-02-24 09:05 - 2014-02-24 09:05 - 02155520 _____ (Farbar) C:\Users\Tracey\Desktop\FRST64.exe
2014-02-24 09:04 - 2014-02-24 09:05 - 01037734 _____ (Thisisu) C:\Users\Tracey\Desktop\JRT.exe
2014-02-24 09:04 - 2014-02-24 09:04 - 01037734 _____ (Thisisu) C:\Users\Tracey\Downloads\JRT.exe
2014-02-24 09:03 - 2010-11-20 03:42 - 01816956 _____ () C:\Windows\WindowsUpdate.log
2014-02-24 08:59 - 2013-07-20 12:45 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-02-24 08:56 - 2012-08-31 04:26 - 00688522 _____ () C:\Windows\PFRO.log
2014-02-24 08:56 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-24 08:56 - 2009-07-13 23:51 - 00120168 _____ () C:\Windows\setupact.log
2014-02-24 08:53 - 2014-02-23 17:58 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-02-24 08:49 - 2012-08-31 09:05 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-24 08:39 - 2014-02-24 08:39 - 00165376 _____ () C:\Users\Tracey\Downloads\SystemLook_x64.exe
2014-02-24 08:29 - 2009-07-14 00:13 - 00727334 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-23 19:52 - 2014-02-23 17:57 - 00000000 ____D () C:\Users\Tracey\Desktop\mbar
2014-02-23 19:43 - 2014-02-23 19:43 - 00025236 _____ () C:\Users\Tracey\Desktop\dds.txt
2014-02-23 19:43 - 2014-02-23 19:43 - 00007279 _____ () C:\Users\Tracey\Desktop\attach.txt
2014-02-23 19:39 - 2013-04-16 16:47 - 00000000 ____D () C:\Users\Tracey\Downloads\Occupational Employment and Wages for Nannies at My Next Move_files
2014-02-23 19:37 - 2014-02-23 18:38 - 00000000 ____D () C:\Program Files (x86)\Everything
2014-02-23 19:36 - 2014-02-23 19:39 - 00688992 ____R (Swearware) C:\Users\Tracey\Desktop\dds.com
2014-02-23 19:36 - 2014-02-23 19:36 - 00688992 _____ (Swearware) C:\Users\Tracey\Downloads\dds.com
2014-02-23 19:04 - 2014-02-23 19:04 - 00000000 ____D () C:\Windows\ERUNT
2014-02-23 18:59 - 2014-02-23 18:53 - 00000000 ____D () C:\Users\Tracey\Desktop\RK_Quarantine
2014-02-23 18:38 - 2014-02-23 18:38 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Everything
2014-02-23 17:57 - 2014-02-23 17:57 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-02-23 17:38 - 2014-02-23 17:38 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\SUPERAntiSpyware.com
2014-02-23 17:38 - 2012-12-10 16:11 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-02-23 17:37 - 2014-02-23 17:37 - 00001808 _____ () C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
2014-02-23 17:37 - 2014-02-23 17:37 - 00000000 ____D () C:\ProgramData\SUPERAntiSpyware.com
2014-02-23 16:56 - 2009-07-14 00:32 - 00000000 ____D () C:\Program Files\Windows Sidebar
2014-02-23 16:56 - 2009-07-14 00:32 - 00000000 ____D () C:\Program Files (x86)\Windows Sidebar
2014-02-23 16:49 - 2014-02-23 16:48 - 00000000 ____D () C:\Program Files (x86)\QuickTime
2014-02-23 16:46 - 2014-02-23 16:46 - 41404760 _____ (Apple Inc.) C:\Users\Tracey\Downloads\QuickTimeInstaller.exe
2014-02-23 16:44 - 2014-02-23 16:44 - 18126032 _____ (Adobe Systems Inc.) C:\Users\Tracey\Downloads\AdobeAIRInstaller.exe
2014-02-23 16:42 - 2012-08-30 21:20 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\vlc
2014-02-23 16:35 - 2014-02-23 16:35 - 24677393 _____ () C:\Users\Tracey\Downloads\vlc-2.1.3-win32.exe
2014-02-23 16:31 - 2014-02-23 16:31 - 29141928 _____ (Oracle Corporation) C:\Users\Tracey\Downloads\jre-7u51-windows-i586.exe
2014-02-23 16:29 - 2014-02-23 16:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-23 16:29 - 2014-02-23 16:28 - 00005765 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-02-23 16:29 - 2012-08-30 20:52 - 00000000 ____D () C:\Program Files (x86)\Java
2014-02-23 16:26 - 2014-02-23 16:26 - 00921000 _____ (Oracle Corporation) C:\Users\Tracey\Downloads\jxpiinstall(1).exe
2014-02-23 16:17 - 2014-02-23 16:17 - 00000000 ____D () C:\Users\Tracey\Desktop\Old Firefox Data
2014-02-23 16:12 - 2014-02-23 16:12 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\AVAST Software
2014-02-23 16:07 - 2014-02-23 16:07 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2014-02-23 16:07 - 2013-12-10 14:21 - 00003192 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForTracey
2014-02-23 16:07 - 2013-12-10 14:21 - 00000336 _____ () C:\Windows\Tasks\HPCeeScheduleForTracey.job
2014-02-23 16:07 - 2013-07-20 12:46 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys
2014-02-23 16:07 - 2013-07-20 12:45 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys
2014-02-23 16:07 - 2013-07-20 12:45 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2014-02-23 16:07 - 2013-07-20 12:45 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys
2014-02-23 16:07 - 2013-07-20 12:45 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2014-02-23 16:07 - 2013-07-20 12:45 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2014-02-23 16:07 - 2013-07-20 12:45 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys
2014-02-23 16:07 - 2013-07-20 12:45 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr
2014-02-23 16:04 - 2013-07-20 12:45 - 00000000 _____ () C:\Windows\SysWOW64\config.nt
2014-02-23 16:04 - 2013-07-20 12:43 - 00000000 ____D () C:\ProgramData\AVAST Software
2014-02-23 15:50 - 2013-07-19 07:39 - 00000000 ____D () C:\Users\Tracey\AppData\Local\Pokki
2014-02-23 15:49 - 2014-02-23 15:44 - 00000000 ____D () C:\AdwCleaner
2014-02-23 15:19 - 2014-02-23 15:19 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\Hard Disk Sentinel
2014-02-23 15:01 - 2014-02-23 15:00 - 01241834 _____ () C:\Users\Tracey\Downloads\adwcleaner.exe
2014-02-21 14:44 - 2014-02-21 14:44 - 00000209 _____ () C:\Users\Daesha\Desktop\magcontour.URL
2014-02-20 17:25 - 2012-09-01 14:52 - 00000000 ____D () C:\Users\Daesha\AppData\Roaming\SoftGrid Client
2014-02-20 17:21 - 2012-09-12 16:25 - 00000000 ____D () C:\Users\Daesha\AppData\Roaming\Skype
2014-02-20 16:49 - 2012-08-31 09:05 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-02-20 16:49 - 2012-08-31 09:05 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-02-20 16:49 - 2012-08-31 09:05 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-02-19 15:16 - 2012-08-30 21:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-02-16 11:29 - 2014-02-16 11:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-02-16 08:31 - 2013-08-14 16:39 - 00000000 ____D () C:\Windows\system32\MRT
2014-02-16 08:27 - 2012-08-30 22:01 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-02-13 13:52 - 2012-08-30 20:48 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\SoftGrid Client
2014-02-10 15:53 - 2013-07-19 19:59 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\QuickScan
2014-02-09 08:39 - 2009-07-14 00:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD
2014-02-07 17:37 - 2014-02-07 17:16 - 1418629266 _____ () C:\Users\Tracey\Downloads\AdobeCS6eng.exe
2014-02-07 17:15 - 2014-02-07 17:15 - 00000000 ____D () C:\Users\Tracey\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MyWordTool
2014-02-07 17:15 - 2014-02-07 17:15 - 00000000 ____D () C:\Users\Tracey\AppData\Local\Google
2014-02-07 17:14 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\Resources
2014-02-07 17:10 - 2014-02-07 17:10 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-02-07 17:10 - 2014-02-07 17:09 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-02-07 17:09 - 2014-02-07 17:09 - 00000000 ____D () C:\Program Files\iTunes
2014-02-07 17:09 - 2014-02-07 17:09 - 00000000 ____D () C:\Program Files\iPod
2014-02-07 17:09 - 2014-02-07 17:09 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-02-07 17:03 - 2013-07-17 20:06 - 00000000 ____D () C:\ProgramData\Apple
2014-02-06 18:20 - 2013-11-05 15:41 - 00000000 ____D () C:\ProgramData\BlueStacksSetup
2014-02-06 18:16 - 2014-02-06 18:16 - 00001819 _____ () C:\Users\Public\Desktop\Apps.lnk
2014-02-06 18:16 - 2009-07-13 22:20 - 00000000 __RHD () C:\Users\Public\Libraries
2014-02-06 18:15 - 2014-02-06 18:15 - 00001807 _____ () C:\Users\Public\Desktop\Start BlueStacks.lnk
2014-02-06 18:09 - 2013-11-05 15:37 - 00000000 ____D () C:\ProgramData\BlueStacks
2014-02-06 18:08 - 2014-02-06 18:08 - 00000000 ____D () C:\Program Files (x86)\BlueStacks
2014-02-06 18:07 - 2012-09-01 14:49 - 00000000 ____D () C:\Users\Daesha\AppData\Local\Mozilla
2014-02-06 12:49 - 2014-02-06 12:49 - 00000000 ____D () C:\Users\Daesha\AppData\Roaming\TeamViewer
2014-02-06 07:16 - 2014-02-13 13:53 - 23170048 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-02-06 06:30 - 2014-02-13 13:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-02-06 06:30 - 2014-02-13 13:53 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-02-06 06:12 - 2014-02-13 13:53 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-02-06 06:07 - 2014-02-13 13:53 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-02-06 06:06 - 2014-02-13 13:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-02-06 05:57 - 2014-02-13 13:53 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-02-06 05:56 - 2014-02-13 13:53 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-02-06 05:52 - 2014-02-13 13:53 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-02-06 05:49 - 2014-02-13 13:53 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-02-06 05:48 - 2014-02-13 13:53 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-02-06 05:48 - 2014-02-13 13:53 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-02-06 05:38 - 2014-02-13 13:52 - 17103872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-02-06 05:32 - 2014-02-13 13:53 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-02-06 05:20 - 2014-02-13 13:53 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-02-06 05:17 - 2014-02-13 13:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-02-06 05:11 - 2014-02-13 13:52 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-02-06 05:01 - 2014-02-13 13:53 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-02-06 05:00 - 2014-02-13 13:53 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-02-06 04:57 - 2014-02-13 13:53 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-02-06 04:57 - 2014-02-13 13:53 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-02-06 04:52 - 2014-02-13 13:53 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-02-06 04:52 - 2014-02-13 13:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-02-06 04:50 - 2014-02-13 13:53 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-02-06 04:49 - 2014-02-13 13:53 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-02-06 04:47 - 2014-02-13 13:53 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-02-06 04:46 - 2014-02-13 13:53 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-02-06 04:25 - 2014-02-13 13:53 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-02-06 04:25 - 2014-02-13 13:52 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-02-06 04:24 - 2014-02-13 13:53 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-02-06 04:22 - 2014-02-13 13:53 - 13051392 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-02-06 04:13 - 2014-02-13 13:53 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-02-06 04:09 - 2014-02-13 13:53 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-02-06 04:03 - 2014-02-13 13:53 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-02-06 03:55 - 2014-02-13 13:53 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-02-06 03:41 - 2014-02-13 13:53 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-02-06 03:40 - 2014-02-13 13:53 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-02-06 03:36 - 2014-02-13 13:53 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-02-06 03:34 - 2014-02-13 13:53 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-01-29 17:34 - 2014-01-29 17:34 - 00000000 ____D () C:\ProgramData\{18165758-115C-4DC0-9EC2-FF89F725767F}
2014-01-29 17:34 - 2010-07-10 22:09 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-01-29 17:32 - 2010-07-10 23:08 - 00000000 ____D () C:\ProgramData\Hewlett-Packard
2014-01-29 17:31 - 2010-07-11 00:56 - 00000000 ____D () C:\Windows\System32\Tasks\Hewlett-Packard
2014-01-29 17:31 - 2009-09-06 19:40 - 00000000 ____D () C:\SwSetup
2014-01-28 16:04 - 2013-02-12 20:01 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-01-28 16:04 - 2012-10-23 15:25 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log

Some content of TEMP:
====================
C:\Users\Daesha\AppData\Local\Temp\qeixxwad.dll
C:\Users\Tracey\AppData\Local\Temp\ntdll_dump.dll
C:\Users\Tracey\AppData\Local\Temp\Quarantine.exe
C:\Users\Tracey\AppData\Local\Temp\_isD5E6.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-01-22 15:24

==================== End Of Log ============================

kevinf80 · February 24, 2014

Can you upload the the following to VirusTotal, I check the MD5 shown in System Look and it returns suspicious, the file in question is normally very safe: http://www.processadvisory.com/process/hd-agent-ni-exe

Go to http://www.virustotal.com/

Click the Choose file button
Navigate to the file C:\Windows\assembly\NativeImages_v2.0.50727_32\HD-Agent\11e546b4dbe1a96aba6bf088e51de388\HD-Agent.ni.exe or just copy/paste it in.
Click the Scan it tab
If you get a message saying File has already been analyzed: click Reanalyze file now
Copy and paste the results back here please.

Thanks,

Kevin

sewerurchin · February 24, 2014

It says that C:\Windows\assembly\NativeImages_v2.0.50727_32 does not exist.

When I look in C:\Windows\assembly, I don't see anything that looks like a folder.

I have 'Show hidden files, folders and drives' selected.

I have 'Hide protected operating system files' unchecked.

kevinf80 · February 24, 2014

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

Next,

We need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete:

Run Eset Online Scanner

**Note** You will need to use Internet explorer for this scan - Vista and win 7 right click on IE shortcut and run as admin

Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
click on the Run ESET Online Scanner button
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the add/on to be installed
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings, ensure the options
Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
wait for the virus definitions to be downloaded
Wait for the scan to finish

When the scan is complete

If no threats were found
put a checkmark in "Uninstall application on close"
close program
report to me that nothing was found

If threats were found

click on "list of threats found"
click on "export to text file" and save it as ESET SCAN and save to the desktop
Click on back
put a checkmark in "Uninstall application on close"
click on finish

close program

copy and paste the report in next reply

Next,

Download Security Check by screen317 from either of the following:

http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe

Save it to your Desktop. (If your security alerts either accept the alert, or turn the security off while Secuirity Check runs)

Double click SecurityCheck.exe (Vista or Windows 7 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me see those logs, also give an update on any remaining issues or concerns...

Kevin..

fixlist.txt

sewerurchin · February 25, 2014

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 24-02-2014 01
Ran by Tracey at 2014-02-24 20:08:42 Run:1
Running from C:\Users\Tracey\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Start
C:\Users\Daesha\AppData\Local\Temp\qeixxwad.dll
C:\Users\Tracey\AppData\Local\Temp\ntdll_dump.dll
C:\Users\Tracey\AppData\Local\Temp\Quarantine.exe
C:\Users\Tracey\AppData\Local\Temp\_isD5E6.exe
C:\Windows\assembly\NativeImages_v2.0.50727_32\HD-Agent\11e546b4dbe1a96aba6bf088e51de388\HD-Agent.ni.exe
End
*****************

C:\Users\Daesha\AppData\Local\Temp\qeixxwad.dll => Moved successfully.
C:\Users\Tracey\AppData\Local\Temp\ntdll_dump.dll => Moved successfully.
C:\Users\Tracey\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Tracey\AppData\Local\Temp\_isD5E6.exe => Moved successfully.
C:\Windows\assembly\NativeImages_v2.0.50727_32\HD-Agent\11e546b4dbe1a96aba6bf088e51de388\HD-Agent.ni.exe => Moved successfully.

==== End of Fixlog ====

ESET Online Scanner Log

C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir   Win32/Toolbar.Conduit.Y potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\optimizer pro\OptimizerPro.exe.vir   a variant of Win32/SpeedingUpMyPC application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\optimizer pro\OptProCrash.dll.vir   a variant of Win32/SProtector.E potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\optimizer pro\OptProCrashSvc.dll.vir   a variant of Win32/SProtector.F potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\optimizer pro\OptProCrash_x64.dll.vir   a variant of Win64/SProtector.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Daesha\AppData\LocalLow\KeyBar_1.14\hk64tbKeyB.dll.vir   Win64/Toolbar.Conduit.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Daesha\AppData\LocalLow\KeyBar_1.14\hktbKeyB.dll.vir   Win32/Toolbar.Conduit.W potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Daesha\AppData\LocalLow\KeyBar_1.14\ldrtbKeyB.dll.vir   a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Daesha\AppData\LocalLow\KeyBar_1.14\tbKeyB.dll.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Tracey\AppData\LocalLow\KeyBar_1.14\hk64tbKeyB.dll.vir   Win64/Toolbar.Conduit.A potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Tracey\AppData\LocalLow\KeyBar_1.14\hktbKeyB.dll.vir   Win32/Toolbar.Conduit.W potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Tracey\AppData\LocalLow\KeyBar_1.14\ldrtbKeyB.dll.vir   a variant of Win32/Toolbar.Conduit.P potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Tracey\AppData\LocalLow\KeyBar_1.14\tbKeyB.dll.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application
C:\AdwCleaner\Quarantine\C\Users\Tracey\AppData\LocalLow\KeyBar_1.14\plugins\{5E1360DC-8FA8-40df-A8CD-FC3831B3634B}\3.6.12\bin\PriceGongIE.dll.vir   a variant of Win32/PriceGong.A potentially unwanted application
C:\Users\Daesha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\86H6N63X\Xvid_RocketFuelInstaller.exe   a variant of Win32/Verti.A potentially unwanted application

=============================

When I run Security Check, it displays the following message:

UNSUPPORTED OPERATING SYSTEM! ABORTED!

This laptop is running Windows 7 Home Premium SP1.

kevinf80 · February 25, 2014

Yes that sometimes happen with Security Check, re-boot your PC and run Security Check again, also this please:

Download OTM from either of the following links and save to your Desktop: (If your security alerts to OTM, either accept the alert or turn off security to allow OTM to run)

http://oldtimer.geekstogo.com/OTM.exe.
http://www.itxassociates.com/OT-Tools/OTM.com
http://www.itxassociates.com/OT-Tools/OTM.exe

Double click OTM.exe to start the tool. Vista or Windows 7 users accepy UAC alert. Be aware all processes will be stopped during run, also Desktop will disappear, this will be put back on completion.... If your security alerts to OTM either, accept the alert or turn off security until OTM completes...

Copy the text from the code box belowbelow to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy). Ensure to start with and include the colon before Files :Files
```
:FilesC:\Users\Daesha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\86H6N63X\Xvid_RocketFuelInstaller.exe:Commands[EmptyTemp]
```
Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
Click the red button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

If the machine reboots, the Results log can be found here:

c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log

Where mmddyyyy_hhmmss is the date of the tool run.

Let me know how your system is responding, also if any remaining issues or concerns...

Kevin

sewerurchin · February 26, 2014

Results of screen317's Security Check version 0.99.79
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 51
Adobe Flash Player 12.0.0.70 Flash Player out of Date!
Mozilla Firefox (27.0.1)
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
AVAST Software Avast AvastSvc.exe
AVAST Software Avast AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 22% Defragment your hard drive soon! (Do NOT defrag if SSD!)
````````````````````End of Log``````````````````````

==========================================================================================

OTM

==========================================================================================

All processes killed
========== FILES ==========
C:\Users\Daesha\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\86H6N63X\Xvid_RocketFuelInstaller.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Daesha
->Temp folder emptied: 194008723 bytes
->Temporary Internet Files folder emptied: 390091439 bytes
->Java cache emptied: 143112 bytes
->FireFox cache emptied: 454764466 bytes
->Flash cache emptied: 115751 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 57472 bytes

User: Default User

User: Master

User: Public

User: Tracey
->Temp folder emptied: 11423618 bytes
->Temporary Internet Files folder emptied: 54495875 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 19641512 bytes
->Flash cache emptied: 57964 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 758240 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 115696 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 753 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 42287513 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 743 bytes
RecycleBin emptied: 153377 bytes

Total Files Cleaned = 1,114.00 mb

OTM by OldTimer - Version 3.1.21.0 log created on 02262014_105904

Files moved on Reboot...
C:\Users\Tracey\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Tracey\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

Registry entries deleted on Reboot...

sewerurchin · February 26, 2014

Hi,

Now that HD-Agent.ni.exe has been made visible, MBAM Pro has found it (in the FRST Quarantine) and flagged it as Spyware.Zbot.ED.

Just thought that you might like to know.

kevinf80 · February 26, 2014

Run Malwarebytes, Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick scan

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced log, also let me know if there are any remaining issues or concerns...

Kevin

sewerurchin · February 27, 2014

I just have a few questions:

- Why wasn't I able to see the original file, the one that MBAR couldn't remmediate?

- What was the nature of the infection that it was carrying?

- It looked like it might be part of a program called 'BlueStacks'. Will this program still run correctly

given what has been done? Should I just uninstall it?

Tx

==============================================================================================

Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.26.10

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
Tracey :: SPONGEBOB [administrator]

Protection: Enabled

2/26/2014 8:08:54 PM
mbam-log-2014-02-26 (20-08-54).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 255847
Time elapsed: 5 minute(s), 58 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

kevinf80 · February 27, 2014

If you have no remaining issues or concerns other than the questions are we ok to clean up?

- Why wasn't I able to see the original file, the one that MBAR couldn't remmediate? - Not sure, can only assume it was hidden.

- What was the nature of the infection that it was carrying? - Not sure again, a typical Spy.Zbot. is a trojan that steals passwords and other sensitive information. The trojan serves as a backdoor. It can be controlled remotely. It will be hidden and protected.

- It looked like it might be part of a program called 'BlueStacks'. Will this program still run correctly. - You should know that answer, does the program run and do what is expected?

- given what has been done? Should I just uninstall it? - Definitely uninstall it. Then, if you know and trust the program install it again, see what happens...

Kevin

sewerurchin · February 28, 2014

Hi,

Things look good. I ran MBAR and Kaspersky rescue disk and both came up clean.

Looks like I am ready to finish up. Just a couple of more questions:

- Since MBAR found this file and MBAM didn't, is this infection considered a rootkit?

- Besides (once again) explaining to her safe practices for accessing the Internet, is there anything in particular

that I can do to help protect her from this type of infection?

Thank you for all of your help.

kevinf80 · February 28, 2014

Your Questions....

- Since MBAR found this file and MBAM didn't, is this infection considered a rootkit? > The infection is classed as a Trojan, brief explanation follows:

A Trojan horse, or Trojan, is malware that appears to perform a desirable function for the user prior to run or install, instead it will facilitate unauthorized access of the user's computer system. "It is a harmful piece of software that looks legitimate. Users are typically tricked into loading and executing it on their systems"

A rootkit is software that enables continued privileged access to a computer, while actively hiding its presence from administrators by subverting standard operating system functionality or other applications. Typically, a hacker installs a rootkit on a computer after first obtaining user-level access, either by exploiting a known vulnerability or cracking a password. Once a rootkit is installed, it allows an attacker to mask the active intrusion and to gain privileged access to a computer by circumventing normal authentication and authorization mechanisms. Although rootkits can serve a variety of ends, they have gained notoriety primarily as malware, appropriating computing resources or stealing passwords without the knowledge of administrators and users of affected systems. Rootkits can target firmware, a hypervisor, the kernel or, most commonly, user-mode applications.

- Besides (once again) explaining to her safe practices for accessing the Internet, is there anything in particular that I can do to help protect her from this type of infection? > Common sense is the key factor, keep security and system updated. Only use reputable sites for downloads, be aware that the majority of free software may come loaded with unwanted extras.. Read the following link to fully understand PC security and best practices, you may find it very useful....

http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629

To clean up...

We need to remove FRST, first it is very important to deal with its own Quarantine folder by using FRST itself..

OK, we continue:

Delete any fixlist.txt file previously used, continue:

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt). That will confirm the removal action, delete if successful.

Next,

Delete FRST.exe from your Desktop or the folder it was saved to, navigate to and delete its folder C:\FRST

Next,

Uninstall adwcleaner.exe

Please close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Uninstall
Click Yes at Would you like to Uninstall Adwcleaner

Next,

Download "Delfix by Xplode" and save it to your desktop.

"Delfix link mirror"

Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator

Make Sure the following items are checked:

    Remove disinfection tools
    Purge System Restore
    Reset system settings

Now click on "Run" and wait patiently until the tool has completed.

The tool will create a log when it has completed. We don't need you to post this.

Any tools or logs left on the Desktop or downloads folder can be deleted....

Next,

Go here http://www.adobe.com/shockwave/welcome/ and have Adobe Flashplayer checked. Accept new version if required.

There maybe an offer of Google Chrome etc, untick those options if offered...

Next,

Defrag the HD, instructions here if required: http://windows.microsoft.com/en-gb/windows/improve-performance-defragmenting-hard-disk#1TC=windows-7

Let me know if those steps complete ok, if no remaining issues can we close out..

Thanks,

Kevin

fixlist.txt

sewerurchin · March 1, 2014

Everything looks good. Thank you very much for seeing this through.

I've made a small donation - sorry that I cannot afford more.

kevinf80 · March 1, 2014

Good to hear all is well, also thank you for the donation, very much appreciated...

Take care,

Kevin....

AdvancedSetup · March 5, 2014

Glad we could help.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Infected file that MBAR cannot remediate

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information