Need help with LV Maintenance malware

Chocula · March 16, 2014

Hello,

First time here and after searching google for a while, I can't find anywhere with a solution to this virus, "LV (or LK) Maintenance." Any help would be gladly appreciated, and I can buy Malwarebytes if necessary.

Thanks!

Chocula · March 16, 2014

Here are the DDS files

attach.txt

dds.txt

kevinf80 · March 16, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Please download RKill from here: http://www.bleepingcomputer.com/download/rkill/

There are three buttons to choose from with different names on, select the first one and save it to your desktop.

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7, right-click on it and Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
A log pops up at the end of the run. This log file is located at C:\rkill.log. Please post this in your next reply.
If you do not see the black box flash on the screen delete the icon from the desktop and go back to the link for the download, select the next button and try to run the tool again, continue to repeat this process using the remaining buttons until the tool runs. You will find further links if you scroll down the page with other names, try them one at a time.
If the tool does not run from any of the links provided, please let me know.

Next,

Run Malwarebytes, Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick scan

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced log,

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Kevin...

Let me see those logs...

Kevin

Chocula · March 16, 2014

Thanks for your help, Kevin!

Here is the RKill log

Rkill 2.6.5 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

More Information about Rkill can be found at this link:

http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 03/16/2014 11:52:47 AM in x64 mode.

Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Active Proxy Server Detected

* Proxy Disabled.

* ProxyOverride value deleted.

* ProxyServer value deleted.

* AutoConfigURL value deleted.

* Proxy settings were backed up to Registry file.

Checking Registry for malware related settings:

* No issues found in the Registry.

Backup Registry file created at:

C:\Users\Windows7\Desktop\rkill\rkill-03-16-2014-11-52-53.reg

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 03/16/2014 11:54:50 AM

Execution time: 0 hours(s), 2 minute(s), and 3 seconds(s)

Scanning with malware bytes now, will post when finished.

-Alex

Chocula · March 16, 2014

Malwarebytes quick scan log

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.03.16.02

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 11.0.9600.16521

Windows7 :: WINDOWS7-PC [administrator]

3/16/2014 11:58:53 AM

mbam-log-2014-03-16 (11-58-53).txt

Scan type: Quick scan

Scan options disabled:

Objects scanned: 266578

Time elapsed: 8 minute(s), 59 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

Chocula · March 16, 2014

FRST logs

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014

Ran by Windows7 (administrator) on WINDOWS7-PC on 16-03-2014 12:12:38

Running from C:\Users\Windows7\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe

(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(Microsoft Corporation) C:\Program Files\Zune\ZuneLauncher.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe

(Microsoft Corporation) C:\Windows\System32\StikyNot.exe

(ContentExplorer) C:\Users\Windows7\AppData\Roaming\ContentExplorer\ContentExplorer.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.141\SSScheduler.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe

(PACE Anti-Piracy, Inc.) C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

() C:\Windows\SysWOW64\PnkBstrA.exe

(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\LBTWiz.exe

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Valve Corporation) C:\Program Files (x86)\Steam\Steam.exe

(Valve Corporation) C:\Program Files (x86)\Common Files\Steam\SteamService.exe

(Microsoft Corporation) C:\Windows\system32\consent.exe

(Google Inc.) C:\Users\Windows7\AppData\Local\Google\Chrome\Application\chrome.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe

(Avid Technology, Inc.) C:\Program Files (x86)\Avid\Pro Tools\ProTools.exe

(Microsoft Corporation) C:\Windows\splwow64.exe

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MpCmdRun.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Zune Launcher] - C:\Program Files\Zune\ZuneLauncher.exe [163552 2011-08-05] (Microsoft Corporation)

HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)

HKLM\...\Run: [bluetooth Connection Assistant] - LBTWIZ.EXE -silent

HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1266912 2013-10-23] (Microsoft Corporation)

HKLM\...\Run: [Nvtmru] - C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-10-17] (NVIDIA Corporation)

HKLM\...\Run: [shadowPlay] - C:\Windows\system32\nvspcap64.dll [1063200 2013-10-17] (NVIDIA Corporation)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [bCSSync] - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [91520 2010-01-21] (Microsoft Corporation)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)

HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-03-07] (AVAST Software)

Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\Run: [Google Update] - C:\Users\Windows7\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-12-28] (Google Inc.)

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\Run: [steam] - C:\Program Files (x86)\Steam\Steam.exe [1821888 2014-02-25] (Valve Corporation)

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\Run: [QuickScanner] - C:\Program Files (x86)\Defender Pro Quick Scanner\quickscan.exe

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\Run: [ContentExplorer] - C:\Users\Windows7\AppData\Roaming\ContentExplorer\ContentExplorer.exe [443152 2014-03-03] (ContentExplorer)

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\Run: [LVMaintenance] - C:\Users\Windows7\AppData\Roaming\LVMaintenance\LVMaintenance.exe [76560 2014-02-14] ()

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: G - G:\MotorolaDeviceManagerSetup.exe -a

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {19249079-faa5-11e1-a247-001ec9567ba0} - F:\TL-Bootstrap.exe

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {2ca60528-8526-11e3-b66d-001ec9567ba0} - G:\MotorolaDeviceManagerSetup.exe -a

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {7b757d2a-8014-11e1-a30b-001ec9567ba0} - F:\TL-Bootstrap.exe

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {dc476382-5853-11e2-a6e8-001ec9567ba0} - F:\TL-Bootstrap.exe

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {f6033999-8d1b-11e2-88a0-001ec9567ba0} - F:\TL-Bootstrap.exe

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:55092;https=127.0.0.1:55092

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC0F73FA6AAC5CC01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us

URLSearchHook: HKCU - (No Name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No File

URLSearchHook: HKCU - (No Name) - {37483b40-c254-4a72-bda4-22ee90182c1e} - No File

SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2801948

SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2801948

SearchScopes: HKCU - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2801948

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&r=513

SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www1.delta-search.com/?q={searchTerms}&affID=119776&babsrc=SP_ss&mntrId=5847001E4CCC9666

SearchScopes: HKCU - {6D84FB6D-4DA5-42E7-9D4C-1D465325BA0B} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=714647&p={searchTerms}

SearchScopes: HKCU - {78DFEACC-11D3-4AD4-8296-90C3DC806D6A} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=5CE476D6-9AF1-4EFD-830D-00773A85A8C1&apn_sauid=9A1B9EAB-4FEB-4476-B952-2F69119E3946

SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2801948

BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.141\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU - No Name - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File

Tcpip\Parameters: [DhcpNameServer] 76.14.0.8 76.14.0.9 76.14.96.14

FireFox:

========

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @esn.me/esnsonar,version=0.70.4 - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF Plugin-x32: @esn/esnlaunch,version=1.110.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.118.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.132.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.132.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=1.140.0 - C:\Program Files (x86)\Battlelog Web Plugins\1.140.0\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.1.4 - C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll No File

FF Plugin-x32: @esn/esnlaunch,version=2.3.0 - C:\Program Files (x86)\Battlelog Web Plugins\2.3.0\npesnlaunch.dll (ESN Social Software AB)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.141\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @TrendMicro.com/FFExtension - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll No File

FF Plugin-x32: @videolan.org/vlc,version=2.0.8 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Windows7\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Windows7\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.)

FF Extension: GoPhotoIt - C:\Users\Windows7\AppData\Roaming\Mozilla\Firefox\profiles\extensions\gophoto@gophoto.it.xpi [2012-07-31]

Chrome:

=======

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\Windows7\AppData\Local\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\Windows7\AppData\Local\Google\Chrome\Application\33.0.1750.154\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Users\Windows7\AppData\Local\Google\Chrome\Application\33.0.1750.154\gcswf32.dll No File

CHR Plugin: (Skype Toolbars) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (ESN Launch Mozilla Plugin) - C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll No File

CHR Plugin: (ESN Sonar API) - C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

CHR Plugin: (Java Platform SE 6 U31) - C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

CHR Plugin: (Google Update) - C:\Users\Windows7\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Extension: (Next BART) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\afjcmjlimnlfgakomlhhhbpooidhcfge [2012-03-11]

CHR Extension: (Audiotool) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\bkgoccjhfjgjedhkiefaclppgbmoobnk [2012-03-11]

CHR Extension: (YouTube) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2011-12-28]

CHR Extension: (http://soundcloud.com/you/sets) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\bnlifnialbodhopmdagpppeegneabnah [2013-03-19]

CHR Extension: (Google Search) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2011-12-28]

CHR Extension: (Alex Bacey) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\dnknkgccldocdogpnhbaddbdhhjiindo [2012-01-01]

CHR Extension: (AdBlock) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2012-07-22]

CHR Extension: (avast! Online Security) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-03-08]

CHR Extension: (http://sfbay.craigslist.org/) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbnhcodhbkmcnigfjgnlbbkplbimdpgn [2012-01-05]

CHR Extension: (Alarm Clock Radio) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\kipdhcpepbpjaoggihaloebfjfafagmi [2012-01-02]

CHR Extension: (Google Maps) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\lneaknkopdijkpnocmklfnjbeapigfbh [2012-03-11]

CHR Extension: (https://www.dropbox.com/home) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\mpnpalcochkcnfmmkpebfcjiajjcefbe [2013-03-19]

CHR Extension: (Google Wallet) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-21]

CHR Extension: (Gmail) - C:\Users\Windows7\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2011-12-28]

CHR HKCU\...\Chrome\Extension: [gclijllifhfpomppedeljakfegbcpojn] - C:\Users\Windows7\AppData\Local\CRE\gclijllifhfpomppedeljakfegbcpojn.crx [2012-07-24]

CHR HKLM-x32\...\Chrome\Extension: [bejbohlohkkgompgecdcbbglkpjfjgdj] - C:\Users\Windows7\AppData\Local\Temp\ccex.crx [2011-12-13]

CHR HKLM-x32\...\Chrome\Extension: [gclijllifhfpomppedeljakfegbcpojn] - C:\Users\Windows7\AppData\Local\CRE\gclijllifhfpomppedeljakfegbcpojn.crx [2012-07-24]

CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-03-07]

CHR HKLM-x32\...\Chrome\Extension: [kkfggacklibaabdomphfdpcodjgihgon] - C:\Program Files (x86)\FirstRowSportApp.com\stv10.crx [2014-03-07]

CHR StartMenuInternet: Google Chrome - C:\Users\Windows7\AppData\Local\Google\Chrome\Application\chrome.exe

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-03-07] (AVAST Software)

S3 digiSPTIService64; C:\Program Files\Avid\Pro Tools\digisptiservice64.exe [190464 2013-09-12] (Avid Technology, Inc.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.141\McCHSvc.exe [289256 2014-01-15] (McAfee, Inc.)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-10-23] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [348376 2013-10-23] (Microsoft Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15122208 2013-10-17] (NVIDIA Corporation)

R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [76888 2013-09-29] ()

==================== Drivers (Whitelisted) ====================

R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [78648 2014-03-07] (AVAST Software)

R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [92544 2014-03-07] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-03-07] ()

R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1038072 2014-03-07] (AVAST Software)

R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [421704 2014-03-07] (AVAST Software)

R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [80184 2014-03-07] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-03-07] ()

R3 DGUSBAP; C:\Windows\System32\DRIVERS\dgmbx2.sys [192528 2010-06-22] (Avid Technology, Inc.)

R3 iLokDrvr; C:\Windows\System32\DRIVERS\iLokDrvr.sys [25808 2013-04-11] ()

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 MBX2DFU; C:\Windows\System32\DRIVERS\dgmbx2fu.sys [31120 2010-06-22] (Avid Technology, Inc.)

S3 MBX2MIDK; C:\Windows\System32\drivers\mbx2midk.sys [32400 2008-12-04] (Digidesign, A Division of Avid Technology, Inc.)

R3 mlkumidi; C:\Windows\System32\drivers\mlkumidi.sys [57408 2012-08-29] (MusicLab, Inc.)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [248240 2013-09-27] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [134944 2013-09-27] (Microsoft Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-09-27] (NVIDIA Corporation)

S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

S1 OMCI; \??\C:\Windows\SYSTEM32\DRIVERS\OMCI.SYS [X]

U3 swmidi;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-03-16 12:12 - 2014-03-16 12:12 - 00000000 ____D () C:\Users\Windows7\Desktop\FRST-OlderVersion

2014-03-16 12:11 - 2014-03-16 12:11 - 02157056 _____ (Farbar) C:\Users\Windows7\Downloads\FRST64 (1).exe

2014-03-16 11:52 - 2014-03-16 11:52 - 00000000 ____D () C:\Users\Windows7\Desktop\rkill

2014-03-16 11:44 - 2014-03-16 11:45 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Windows7\Downloads\rkill.com

2014-03-15 19:22 - 2014-03-15 19:22 - 00020246 _____ () C:\Users\Windows7\Desktop\dds.txt

2014-03-15 19:22 - 2014-03-15 19:22 - 00012312 _____ () C:\Users\Windows7\Desktop\attach.txt

2014-03-15 19:18 - 2014-03-15 19:18 - 00688992 ____R (Swearware) C:\Users\Windows7\Downloads\dds.scr

2014-03-15 19:05 - 2014-03-15 19:05 - 00000000 ____D () C:\Users\Windows7\AppData\Local\PaceAP

2014-03-15 17:49 - 2014-03-15 17:50 - 00053305 _____ () C:\Users\Windows7\Downloads\FRST.txt

2014-03-15 17:46 - 2014-03-15 17:46 - 02157056 _____ (Farbar) C:\Users\Windows7\Downloads\FRST64.exe

2014-03-15 17:34 - 2014-03-15 17:34 - 04110135 _____ () C:\Users\Windows7\Downloads\tdsskiller (1).zip

2014-03-15 17:34 - 2014-03-15 17:34 - 00208216 _____ (Kaspersky Lab, GERT) C:\Windows\system32\Drivers\57518854.sys

2014-03-13 12:05 - 2014-03-16 11:54 - 00002644 _____ () C:\Users\Windows7\Desktop\Rkill.txt

2014-03-13 12:04 - 2014-03-13 12:04 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Windows7\Downloads\iExplore.exe

2014-03-13 12:01 - 2014-03-13 12:01 - 04110135 _____ () C:\Users\Windows7\Downloads\tdsskiller.zip

2014-03-13 12:00 - 2014-03-13 12:00 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Windows7\Desktop\iexplorer.exe

2014-03-12 23:15 - 2014-02-06 18:23 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-03-12 23:15 - 2014-01-28 19:32 - 00484864 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll

2014-03-12 23:15 - 2014-01-28 19:06 - 00381440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wer.dll

2014-03-12 23:15 - 2014-01-27 19:32 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll

2014-03-12 23:14 - 2014-02-28 23:05 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-03-12 23:14 - 2014-02-28 22:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-03-12 23:14 - 2014-02-28 22:16 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-03-12 23:14 - 2014-02-28 21:58 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-03-12 23:14 - 2014-02-28 21:52 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-03-12 23:14 - 2014-02-28 21:51 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-03-12 23:14 - 2014-02-28 21:42 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-03-12 23:14 - 2014-02-28 21:40 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-03-12 23:14 - 2014-02-28 21:37 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-03-12 23:14 - 2014-02-28 21:33 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-03-12 23:14 - 2014-02-28 21:33 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-03-12 23:14 - 2014-02-28 21:32 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-03-12 23:14 - 2014-02-28 21:30 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-03-12 23:14 - 2014-02-28 21:23 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-03-12 23:14 - 2014-02-28 21:17 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-03-12 23:14 - 2014-02-28 21:11 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-03-12 23:14 - 2014-02-28 21:02 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-03-12 23:14 - 2014-02-28 20:54 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-03-12 23:14 - 2014-02-28 20:52 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-03-12 23:14 - 2014-02-28 20:51 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-03-12 23:14 - 2014-02-28 20:47 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-03-12 23:14 - 2014-02-28 20:43 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-03-12 23:14 - 2014-02-28 20:43 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-03-12 23:14 - 2014-02-28 20:42 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-03-12 23:14 - 2014-02-28 20:40 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-03-12 23:14 - 2014-02-28 20:38 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-03-12 23:14 - 2014-02-28 20:37 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-03-12 23:14 - 2014-02-28 20:35 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-03-12 23:14 - 2014-02-28 20:18 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-03-12 23:14 - 2014-02-28 20:16 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-03-12 23:14 - 2014-02-28 20:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-03-12 23:14 - 2014-02-28 20:10 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-03-12 23:14 - 2014-02-28 20:03 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-03-12 23:14 - 2014-02-28 20:00 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-03-12 23:14 - 2014-02-28 19:57 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-03-12 23:14 - 2014-02-28 19:38 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-03-12 23:14 - 2014-02-28 19:32 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-03-12 23:14 - 2014-02-28 19:27 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-03-12 23:14 - 2014-02-28 19:25 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-03-12 23:14 - 2014-02-28 19:25 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-03-12 23:14 - 2014-02-03 19:32 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-03-12 23:14 - 2014-02-03 19:04 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-03-12 23:13 - 2014-02-03 19:32 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-03-12 23:13 - 2014-02-03 19:04 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2014-03-12 16:33 - 2014-03-15 18:36 - 00000000 ____D () C:\Users\Windows7\Desktop\Sequostati

2014-03-12 14:47 - 2014-03-15 17:59 - 00000000 ____D () C:\Users\Windows7\Desktop\Symbiotic

2014-03-09 00:03 - 2014-03-09 00:03 - 00036186 _____ () C:\Users\Windows7\Desktop\Addition.txt

2014-03-09 00:02 - 2014-03-16 12:12 - 00022727 _____ () C:\Users\Windows7\Desktop\FRST.txt

2014-03-09 00:02 - 2014-03-16 12:12 - 00000000 ____D () C:\FRST

2014-03-09 00:01 - 2014-03-16 12:12 - 02157056 _____ (Farbar) C:\Users\Windows7\Desktop\FRST64.exe

2014-03-08 21:15 - 2014-03-08 21:15 - 00000000 ____D () C:\Users\Windows7\Documents\AVS4YOU

2014-03-08 18:38 - 2014-03-08 23:42 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\LVMaintenance

2014-03-07 20:53 - 2014-03-16 11:31 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-03-07 20:53 - 2014-03-07 20:53 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-03-07 20:53 - 2014-03-07 20:53 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\AVAST Software

2014-03-07 20:53 - 2014-03-07 20:52 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-03-07 20:53 - 2014-03-07 20:52 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-03-07 20:53 - 2014-03-07 20:52 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-03-07 20:53 - 2014-03-07 20:52 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-03-07 20:53 - 2014-03-07 20:52 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-03-07 20:53 - 2014-03-07 20:52 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys

2014-03-07 20:53 - 2014-03-07 20:52 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-03-07 20:53 - 2014-03-07 20:52 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-03-07 20:52 - 2014-03-07 20:52 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-03-07 20:52 - 2014-03-07 20:52 - 00000000 ____D () C:\Program Files\AVAST Software

2014-03-07 20:50 - 2014-03-07 20:50 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-03-07 20:49 - 2014-03-07 20:50 - 87640360 _____ (AVAST Software) C:\Users\Windows7\Downloads\avast_free_antivirus_setup.exe

2014-03-07 19:02 - 2014-03-07 19:02 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-03-07 19:02 - 2014-03-07 19:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-03-07 19:02 - 2013-04-04 15:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-03-07 19:01 - 2014-03-07 19:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Windows7\Downloads\mbam-setup-1.75.0.1300 (1).exe

2014-03-05 15:55 - 2014-03-05 15:55 - 00000000 ____D () C:\Users\Windows7\AppData\Local\iConvertor

2014-03-05 15:44 - 2014-03-05 15:44 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\systweak

2014-03-05 15:44 - 2012-01-20 15:14 - 00018816 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe

2014-03-05 15:43 - 2014-03-05 15:43 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\ContentExplorer

2014-03-03 17:35 - 2014-03-03 17:36 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-03-03 17:35 - 2014-03-03 17:36 - 00000000 ____D () C:\Program Files\iTunes

2014-03-03 17:35 - 2014-03-03 17:36 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-03-03 17:35 - 2014-03-03 17:35 - 00000000 ____D () C:\Program Files\iPod

2014-03-03 17:30 - 2014-03-03 17:30 - 00000000 ____D () C:\Program Files (x86)\QuickTime

2014-02-27 19:49 - 2014-02-27 19:51 - 00000000 ____D () C:\b762cb65fc9ef65bd7588685611ea492

2014-02-27 12:05 - 2014-02-27 12:05 - 00147112 _____ () C:\Users\Windows7\Desktop\Inherit_Fixation 112813.gp5

2014-02-27 12:05 - 2014-02-27 12:05 - 00000219 _____ () C:\Users\Windows7\Desktop\Left 4 Dead 2.url

2014-02-27 03:05 - 2014-02-27 03:05 - 00000000 ____D () C:\a39c3d9609bd0ec23ba4f3a2

2014-02-26 14:11 - 2014-02-26 14:13 - 00000000 ____D () C:\5ccba043a8bafa7e65cce5f179

2014-02-26 13:35 - 2014-02-26 13:36 - 00000000 ____D () C:\0375be4dd0189d1491c3c7cf

2014-02-25 13:42 - 2014-02-25 13:43 - 00289928 _____ () C:\Windows\Minidump\022514-45349-01.dmp

2014-02-20 21:40 - 2014-02-24 14:31 - 00019380 _____ () C:\Users\Windows7\Desktop\022014.gpx

2014-02-20 09:55 - 2014-02-20 09:56 - 00291304 _____ () C:\Windows\Minidump\022014-31215-01.dmp

2014-02-19 10:39 - 2014-02-19 10:39 - 00000000 ____D () C:\Users\Default\AppData\Local\Google

2014-02-19 10:39 - 2014-02-19 10:39 - 00000000 ____D () C:\Users\Default User\AppData\Local\Google

2014-02-18 15:57 - 2014-02-18 15:59 - 00001068 _____ () C:\Users\Windows7\Desktop\bass.mid

2014-02-16 23:10 - 2014-02-16 23:31 - 00016664 _____ () C:\Users\Windows7\Desktop\021614.gpx

==================== One Month Modified Files and Folders =======

2014-03-16 12:12 - 2014-03-16 12:12 - 00000000 ____D () C:\Users\Windows7\Desktop\FRST-OlderVersion

2014-03-16 12:12 - 2014-03-09 00:02 - 00022727 _____ () C:\Users\Windows7\Desktop\FRST.txt

2014-03-16 12:12 - 2014-03-09 00:02 - 00000000 ____D () C:\FRST

2014-03-16 12:12 - 2014-03-09 00:01 - 02157056 _____ (Farbar) C:\Users\Windows7\Desktop\FRST64.exe

2014-03-16 12:11 - 2014-03-16 12:11 - 02157056 _____ (Farbar) C:\Users\Windows7\Downloads\FRST64 (1).exe

2014-03-16 12:06 - 2013-10-06 22:07 - 00000000 ____D () C:\Users\Public\Pro Tools

2014-03-16 12:05 - 2014-01-21 15:57 - 00028594 _____ () C:\Windows\mlkumidi.log

2014-03-16 11:54 - 2014-03-13 12:05 - 00002644 _____ () C:\Users\Windows7\Desktop\Rkill.txt

2014-03-16 11:52 - 2014-03-16 11:52 - 00000000 ____D () C:\Users\Windows7\Desktop\rkill

2014-03-16 11:49 - 2009-07-13 22:13 - 00779306 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-03-16 11:45 - 2014-03-16 11:44 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Windows7\Downloads\rkill.com

2014-03-16 11:45 - 2011-12-28 14:25 - 01063684 _____ () C:\Windows\WindowsUpdate.log

2014-03-16 11:44 - 2011-12-28 16:02 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\uTorrent

2014-03-16 11:42 - 2011-12-28 15:58 - 00000920 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3617554679-211012756-3022158845-1000UA.job

2014-03-16 11:38 - 2014-01-23 11:21 - 00000902 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-03-16 11:37 - 2009-07-13 21:45 - 00013776 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-03-16 11:37 - 2009-07-13 21:45 - 00013776 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-03-16 11:32 - 2012-02-11 11:28 - 00000000 ____D () C:\Program Files (x86)\Steam

2014-03-16 11:31 - 2014-03-07 20:53 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update

2014-03-16 11:30 - 2014-01-23 11:21 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-03-16 11:30 - 2013-10-06 21:00 - 00000000 ____D () C:\ProgramData\PACE

2014-03-16 11:30 - 2011-12-28 15:06 - 00000000 ____D () C:\ProgramData\NVIDIA

2014-03-16 11:30 - 2009-07-13 22:08 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-03-16 11:30 - 2009-07-13 22:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-03-16 11:30 - 2009-07-13 21:51 - 00208142 _____ () C:\Windows\setupact.log

2014-03-15 19:30 - 2013-02-27 23:41 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-03-15 19:22 - 2014-03-15 19:22 - 00020246 _____ () C:\Users\Windows7\Desktop\dds.txt

2014-03-15 19:22 - 2014-03-15 19:22 - 00012312 _____ () C:\Users\Windows7\Desktop\attach.txt

2014-03-15 19:18 - 2014-03-15 19:18 - 00688992 ____R (Swearware) C:\Users\Windows7\Downloads\dds.scr

2014-03-15 19:05 - 2014-03-15 19:05 - 00000000 ____D () C:\Users\Windows7\AppData\Local\PaceAP

2014-03-15 18:36 - 2014-03-12 16:33 - 00000000 ____D () C:\Users\Windows7\Desktop\Sequostati

2014-03-15 17:59 - 2014-03-12 14:47 - 00000000 ____D () C:\Users\Windows7\Desktop\Symbiotic

2014-03-15 17:50 - 2014-03-15 17:49 - 00053305 _____ () C:\Users\Windows7\Downloads\FRST.txt

2014-03-15 17:46 - 2014-03-15 17:46 - 02157056 _____ (Farbar) C:\Users\Windows7\Downloads\FRST64.exe

2014-03-15 17:45 - 2011-12-28 16:00 - 00002382 _____ () C:\Users\Windows7\Desktop\Google Chrome.lnk

2014-03-15 17:34 - 2014-03-15 17:34 - 04110135 _____ () C:\Users\Windows7\Downloads\tdsskiller (1).zip

2014-03-15 17:34 - 2014-03-15 17:34 - 00208216 _____ (Kaspersky Lab, GERT) C:\Windows\system32\Drivers\57518854.sys

2014-03-13 12:04 - 2014-03-13 12:04 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Windows7\Downloads\iExplore.exe

2014-03-13 12:01 - 2014-03-13 12:01 - 04110135 _____ () C:\Users\Windows7\Downloads\tdsskiller.zip

2014-03-13 12:00 - 2014-03-13 12:00 - 02237968 _____ (Kaspersky Lab ZAO) C:\Users\Windows7\Desktop\iexplorer.exe

2014-03-13 10:47 - 2009-07-13 21:45 - 00455776 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-03-13 10:46 - 2013-10-02 16:45 - 00000000 ____D () C:\Users\UpdatusUser.Windows7-PC

2014-03-13 01:01 - 2012-03-27 15:48 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-03-12 15:30 - 2013-02-27 23:41 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-03-12 15:30 - 2013-02-27 23:41 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-03-12 15:30 - 2013-02-27 23:41 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-03-09 00:18 - 2011-12-28 17:23 - 00736910 _____ () C:\Windows\PFRO.log

2014-03-09 00:03 - 2014-03-09 00:03 - 00036186 _____ () C:\Users\Windows7\Desktop\Addition.txt

2014-03-08 23:42 - 2014-03-08 18:38 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\LVMaintenance

2014-03-08 21:15 - 2014-03-08 21:15 - 00000000 ____D () C:\Users\Windows7\Documents\AVS4YOU

2014-03-08 21:14 - 2012-08-15 09:57 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\AVS4YOU

2014-03-07 23:42 - 2011-12-28 15:58 - 00000868 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3617554679-211012756-3022158845-1000Core.job

2014-03-07 20:53 - 2014-03-07 20:53 - 00001966 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk

2014-03-07 20:53 - 2014-03-07 20:53 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\AVAST Software

2014-03-07 20:52 - 2014-03-07 20:53 - 01038072 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSnx.sys

2014-03-07 20:52 - 2014-03-07 20:53 - 00421704 _____ (AVAST Software) C:\Windows\system32\Drivers\aswSP.sys

2014-03-07 20:52 - 2014-03-07 20:53 - 00334136 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe

2014-03-07 20:52 - 2014-03-07 20:53 - 00207904 _____ () C:\Windows\system32\Drivers\aswVmm.sys

2014-03-07 20:52 - 2014-03-07 20:53 - 00092544 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys

2014-03-07 20:52 - 2014-03-07 20:53 - 00080184 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys

2014-03-07 20:52 - 2014-03-07 20:53 - 00078648 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys

2014-03-07 20:52 - 2014-03-07 20:53 - 00065776 _____ () C:\Windows\system32\Drivers\aswRvrt.sys

2014-03-07 20:52 - 2014-03-07 20:52 - 00043152 _____ (AVAST Software) C:\Windows\avastSS.scr

2014-03-07 20:52 - 2014-03-07 20:52 - 00000000 ____D () C:\Program Files\AVAST Software

2014-03-07 20:50 - 2014-03-07 20:50 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-03-07 20:50 - 2014-03-07 20:49 - 87640360 _____ (AVAST Software) C:\Users\Windows7\Downloads\avast_free_antivirus_setup.exe

2014-03-07 19:02 - 2014-03-07 19:02 - 00001109 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-03-07 19:02 - 2014-03-07 19:02 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-03-07 19:01 - 2014-03-07 19:01 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Windows7\Downloads\mbam-setup-1.75.0.1300 (1).exe

2014-03-06 16:19 - 2012-05-21 11:16 - 00000000 ____D () C:\Users\Windows7\Desktop\School

2014-03-06 14:45 - 2011-12-28 16:08 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\vlc

2014-03-05 15:55 - 2014-03-05 15:55 - 00000000 ____D () C:\Users\Windows7\AppData\Local\iConvertor

2014-03-05 15:44 - 2014-03-05 15:44 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\systweak

2014-03-05 15:44 - 2012-08-16 13:21 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AVS4YOU

2014-03-05 15:44 - 2012-08-15 09:55 - 00000000 ____D () C:\Program Files (x86)\AVS4YOU

2014-03-05 15:44 - 2011-12-28 15:57 - 00116368 _____ () C:\Users\Windows7\AppData\Local\GDIPFONTCACHEV1.DAT

2014-03-05 15:43 - 2014-03-05 15:43 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\ContentExplorer

2014-03-04 16:30 - 2013-06-04 10:11 - 00000016 _____ () C:\Users\Windows7\AppData\Roaming\msregsvv.dll

2014-03-04 16:30 - 2013-06-04 10:11 - 00000016 _____ () C:\ProgramData\autobk.inc

2014-03-03 17:36 - 2014-03-03 17:35 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-03-03 17:36 - 2014-03-03 17:35 - 00000000 ____D () C:\Program Files\iTunes

2014-03-03 17:36 - 2014-03-03 17:35 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-03-03 17:36 - 2012-09-11 20:24 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-03-03 17:35 - 2014-03-03 17:35 - 00000000 ____D () C:\Program Files\iPod

2014-03-03 17:31 - 2012-06-15 12:05 - 00000000 ____D () C:\ProgramData\Apple

2014-03-03 17:30 - 2014-03-03 17:30 - 00000000 ____D () C:\Program Files (x86)\QuickTime

2014-02-28 23:05 - 2014-03-12 23:14 - 23133696 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-02-28 22:17 - 2014-03-12 23:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-02-28 22:16 - 2014-03-12 23:14 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-02-28 21:58 - 2014-03-12 23:14 - 02765824 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-02-28 21:52 - 2014-03-12 23:14 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-02-28 21:51 - 2014-03-12 23:14 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-02-28 21:42 - 2014-03-12 23:14 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-02-28 21:40 - 2014-03-12 23:14 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-02-28 21:37 - 2014-03-12 23:14 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-02-28 21:33 - 2014-03-12 23:14 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-02-28 21:33 - 2014-03-12 23:14 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-02-28 21:32 - 2014-03-12 23:14 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-02-28 21:30 - 2014-03-12 23:14 - 17074688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-02-28 21:23 - 2014-03-12 23:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-02-28 21:17 - 2014-03-12 23:14 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-02-28 21:11 - 2014-03-12 23:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-02-28 21:02 - 2014-03-12 23:14 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-02-28 20:54 - 2014-03-12 23:14 - 05768704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-02-28 20:52 - 2014-03-12 23:14 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-02-28 20:51 - 2014-03-12 23:14 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-02-28 20:47 - 2014-03-12 23:14 - 02168320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-02-28 20:43 - 2014-03-12 23:14 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-02-28 20:43 - 2014-03-12 23:14 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-02-28 20:42 - 2014-03-12 23:14 - 00627200 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-02-28 20:40 - 2014-03-12 23:14 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-02-28 20:38 - 2014-03-12 23:14 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-02-28 20:37 - 2014-03-12 23:14 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-02-28 20:35 - 2014-03-12 23:14 - 02041856 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-02-28 20:18 - 2014-03-12 23:14 - 13051904 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-02-28 20:16 - 2014-03-12 23:14 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-02-28 20:14 - 2014-03-12 23:14 - 04244480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-02-28 20:10 - 2014-03-12 23:14 - 02334208 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-02-28 20:03 - 2014-03-12 23:14 - 00524288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-02-28 20:00 - 2014-03-12 23:14 - 01964032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-02-28 19:57 - 2014-03-12 23:14 - 11266048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-02-28 19:38 - 2014-03-12 23:14 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-02-28 19:32 - 2014-03-12 23:14 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-02-28 19:27 - 2014-03-12 23:14 - 01156096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-02-28 19:25 - 2014-03-12 23:14 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-02-28 19:25 - 2014-03-12 23:14 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-02-27 19:51 - 2014-02-27 19:49 - 00000000 ____D () C:\b762cb65fc9ef65bd7588685611ea492

2014-02-27 16:13 - 2012-03-11 22:47 - 01079296 ___SH () C:\Users\Windows7\Desktop\Thumbs.db

2014-02-27 12:05 - 2014-02-27 12:05 - 00147112 _____ () C:\Users\Windows7\Desktop\Inherit_Fixation 112813.gp5

2014-02-27 12:05 - 2014-02-27 12:05 - 00000219 _____ () C:\Users\Windows7\Desktop\Left 4 Dead 2.url

2014-02-27 12:05 - 2013-11-29 01:47 - 00144806 _____ () C:\Users\Windows7\Desktop\Inherit_Fixation 112813.gpx

2014-02-27 03:05 - 2014-02-27 03:05 - 00000000 ____D () C:\a39c3d9609bd0ec23ba4f3a2

2014-02-26 14:13 - 2014-02-26 14:11 - 00000000 ____D () C:\5ccba043a8bafa7e65cce5f179

2014-02-26 13:36 - 2014-02-26 13:35 - 00000000 ____D () C:\0375be4dd0189d1491c3c7cf

2014-02-25 13:43 - 2014-02-25 13:42 - 00289928 _____ () C:\Windows\Minidump\022514-45349-01.dmp

2014-02-25 13:42 - 2011-12-28 14:45 - 614924873 _____ () C:\Windows\MEMORY.DMP

2014-02-25 13:42 - 2011-12-28 14:45 - 00000000 ____D () C:\Windows\Minidump

2014-02-24 14:31 - 2014-02-20 21:40 - 00019380 _____ () C:\Users\Windows7\Desktop\022014.gpx

2014-02-20 23:29 - 2013-10-06 20:16 - 00000000 ____D () C:\Users\Windows7\AppData\Roaming\Download Manager

2014-02-20 09:56 - 2014-02-20 09:55 - 00291304 _____ () C:\Windows\Minidump\022014-31215-01.dmp

2014-02-19 10:39 - 2014-02-19 10:39 - 00000000 ____D () C:\Users\Default\AppData\Local\Google

2014-02-19 10:39 - 2014-02-19 10:39 - 00000000 ____D () C:\Users\Default User\AppData\Local\Google

2014-02-19 10:39 - 2014-01-23 11:22 - 00002040 _____ () C:\Users\Public\Desktop\Google Sheets.lnk

2014-02-19 10:39 - 2014-01-23 11:22 - 00002030 _____ () C:\Users\Public\Desktop\Google Docs.lnk

2014-02-18 15:59 - 2014-02-18 15:57 - 00001068 _____ () C:\Users\Windows7\Desktop\bass.mid

2014-02-16 23:31 - 2014-02-16 23:10 - 00016664 _____ () C:\Users\Windows7\Desktop\021614.gpx

2014-02-15 10:03 - 2013-08-14 16:00 - 00000000 ____D () C:\Windows\system32\MRT

2014-02-15 10:01 - 2012-01-01 16:36 - 88567024 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

Some content of TEMP:

====================

C:\Users\Windows7\AppData\Local\Temp\DeleteInstall.exe

C:\Users\Windows7\AppData\Local\Temp\installerdll157529.dll

C:\Users\Windows7\AppData\Local\Temp\installerdll185453.dll

C:\Users\Windows7\AppData\Local\Temp\installerdll399222.dll

C:\Users\Windows7\AppData\Local\Temp\installerdll401047.dll

C:\Users\Windows7\AppData\Local\Temp\installerdll411936.dll

C:\Users\Windows7\AppData\Local\Temp\JavaIC.dll

C:\Users\Windows7\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe

C:\Users\Windows7\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\jre-7u13-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe

C:\Users\Windows7\AppData\Local\Temp\L6GPInst.dll

C:\Users\Windows7\AppData\Local\Temp\LMkRstPt.exe

C:\Users\Windows7\AppData\Local\Temp\msscct32.dll

C:\Users\Windows7\AppData\Local\Temp\mssinstaller.exe

C:\Users\Windows7\AppData\Local\Temp\nvSCPAPI.dll

C:\Users\Windows7\AppData\Local\Temp\nvSCPAPI64.dll

C:\Users\Windows7\AppData\Local\Temp\nvSCPAPISvr.exe

C:\Users\Windows7\AppData\Local\Temp\nvStereoApiI64.dll

C:\Users\Windows7\AppData\Local\Temp\nvStInst.exe

C:\Users\Windows7\AppData\Local\Temp\OriginLauncher399222.exe

C:\Users\Windows7\AppData\Local\Temp\ose00000.exe

C:\Users\Windows7\AppData\Local\Temp\rootsupd.exe

C:\Users\Windows7\AppData\Local\Temp\SearchProtectionSetup.exe

C:\Users\Windows7\AppData\Local\Temp\Setup.exe

C:\Users\Windows7\AppData\Local\Temp\SHSetup.exe

C:\Users\Windows7\AppData\Local\Temp\sonarinst.exe

C:\Users\Windows7\AppData\Local\Temp\switchsetup.exe

C:\Users\Windows7\AppData\Local\Temp\tbNCH_.dll

C:\Users\Windows7\AppData\Local\Temp\tbuTo0.dll

C:\Users\Windows7\AppData\Local\Temp\uninst.exe

C:\Users\Windows7\AppData\Local\Temp\uninst1.exe

C:\Users\Windows7\AppData\Local\Temp\utt8029.tmp.exe

C:\Users\Windows7\AppData\Local\Temp\vcredist_x64.exe

C:\Users\Windows7\AppData\Local\Temp\vcredist_x86.exe

C:\Users\Windows7\AppData\Local\Temp\vlc-2.0.8-win32.exe

C:\Users\Windows7\AppData\Local\Temp\vlc-2.1.2-win32.exe

C:\Users\Windows7\AppData\Local\Temp\WindowsInstaller-KB893803-v2-x86.exe

C:\Users\Windows7\AppData\Local\Temp\winzipdusetup.exe

C:\Users\Windows7\AppData\Local\Temp\YontooSetup-Silent.exe

C:\Users\Windows7\AppData\Local\Temp\_is4F47.exe

C:\Users\Windows7\AppData\Local\Temp\_is6348.exe

C:\Users\Windows7\AppData\Local\Temp\{F19F7819-D9D0-4097-80D2-5B2E254E0B1C}-24.0.1312.56_24.0.1312.52_chrome_updater.exe

C:\Users\Windows7\AppData\Local\Temp\~SpUnin~.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit

C:\Windows\System32\wininit.exe => MD5 is legit

C:\Windows\SysWOW64\wininit.exe => MD5 is legit

C:\Windows\explorer.exe => MD5 is legit

C:\Windows\SysWOW64\explorer.exe => MD5 is legit

C:\Windows\System32\svchost.exe => MD5 is legit

C:\Windows\SysWOW64\svchost.exe => MD5 is legit

C:\Windows\System32\services.exe => MD5 is legit

C:\Windows\System32\User32.dll => MD5 is legit

C:\Windows\SysWOW64\User32.dll => MD5 is legit

C:\Windows\System32\userinit.exe => MD5 is legit

C:\Windows\SysWOW64\userinit.exe => MD5 is legit

C:\Windows\System32\rpcss.dll => MD5 is legit

C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-03-12 15:48

==================== End Of Log ============================

Addition.txt

kevinf80 · March 16, 2014

Download attached fixlist.txt file and save it to the Desktop, or the folder you saved FRST into.

NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.

The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.

Next,

Ther are two security systems running with anti-virus components, Avast and Microsoft Security Essentials. That is not good and will cause issues for your system, one of those should be UNinstalled asap...

Next,

Download Zoek.zip from here http://www.hijackthis.nl/smeenk/220813/zoek.zip and save the zip file to your Desktop.

Double click zip file and extract to your Desktop:

you will now have 3 versions of the tool on the Desktop:

%7Boption%7D http://i121.photobucket.com/albums/o239/kevinf80/Zoek%20Scanner/Zoeke.jpg[/img]

Before running Zoek make sure all Browsers are closed and Security is turned OFF. Check at the following link: http://www.bleepingcomputer.com/forums/t/114351/how-to-temporarily-disable-your-anti-virus-firewall-and-anti-malware-programs/]

Double click on each in turn until one version of Zoek will run (accept UAC) The following window will open:

Copy and paste the following script from the code box and paste into the field.

standardsearch;autoruns;autoclean;emptyclsid;emptyalltemp;installedprogs;

Select the "Run Script" tab. The following window will open:

Please be patient and do not use the PC when the scan is in progress.

When complete you maybe asked to re-boot your PC, if so please do

Post the produced logs in your next reply…..

Kevin

fixlist.txt

Chocula · March 16, 2014

Here's the Fixlog from FRST

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 13-03-2014

Ran by Windows7 at 2014-03-16 13:54:04 Run:1

Running from C:\Users\Windows7\Desktop

Boot Mode: Normal

==============================================

Content of fixlist:

*****************

Start

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\Run: [LVMaintenance] - C:\Users\Windows7\AppData\Roaming\LVMaintenance\LVMaintenance.exe [76560 2014-02-14] ()

C:\Users\Windows7\AppData\Roaming\LVMaintenance

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: G - G:\MotorolaDeviceManagerSetup.exe -a

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {19249079-faa5-11e1-a247-001ec9567ba0} - F:\TL-Bootstrap.exe

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {2ca60528-8526-11e3-b66d-001ec9567ba0} - G:\MotorolaDeviceManagerSetup.exe -a

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {7b757d2a-8014-11e1-a30b-001ec9567ba0} - F:\TL-Bootstrap.exe

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {dc476382-5853-11e2-a6e8-001ec9567ba0} - F:\TL-Bootstrap.exe

HKU\S-1-5-21-3617554679-211012756-3022158845-1000\...\MountPoints2: {f6033999-8d1b-11e2-88a0-001ec9567ba0} - F:\TL-Bootstrap.exe

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:55092;https=127.0.0.1:55092

URLSearchHook: HKCU - (No Name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No File

URLSearchHook: HKCU - (No Name) - {37483b40-c254-4a72-bda4-22ee90182c1e} - No File

SearchScopes: HKLM-x32 - DefaultScope {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://websearch.ask...J&o=&src=crm&q={searchTerms}&locale=&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=5CE476D6-9AF1-4EFD-830D-00773A85A8C1&apn_sauid=9A1B9EAB-4FEB-4476-B952-2F69119E3946

SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.condui...ultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2801948