Help with computer Infection

cj5362 · March 19, 2014

Hello,

I've been having multiple problems with my computer security, which all started a month ago. I noticed that it was running strangely: my McAfee firewall kept resetting to the lowest setting and there were multiple suspicious processes running in my task manager.

I was running the firewall with McAfee Anti-Virus in Monitored Access mode but changed it to Stealth so that I would have to decide which programs could access my computer. About two weeks ago, I noticed that it was changing from Stealth mode to Smart Access mode (the lowest setting) automatically. I kept changing it back to Stealth and not too long after, every time it would change back to Smart Access.

I downloaded Spybot and ran it. It found something called "Wajam," so I had it resolve the issue.

A few days later, I contacted McAfee and paid the McAfee Tech Masters to remotely log into my computer to try to resolve these issues. They didn't find anything. The problems continued, so the next week I called McAfee Tech Support and again they remotely took control of my computer, and uninstalled and reinstalled the virus software. But the problems persisted.

A few days ago, I found out about Malwarebytes, and downloaded and ran the trial version. It found one issue - "PUP.Optional.Wajam.A" came up again, so I had the program take action on it.

Through this whole process, I had been keeping track of my processes running in Task Manager, and had seen that there were multiple processes running that did not have any information listed other than the "image name": csrss.exe, rundll32.exe, tpnumlkd.exe, virtscrl.exe. and winlogon.exe. I did a search on these processes and their potential to be malicious, and came across this forum.

When I talked with McAfee Tech Masters, I pointed out the mysterious processes that were running in my Task Manager and the tech I was speaking with just said they weren't an issue.

I finally deinstalled McAfee and downloaded the trial version of Avast Internet Security. I started the Avast's firewall, setting it to private. Immediately, I noticed that rundll32.exe was trying to connect to the internet. I blocked access.

I would really appreciate any help to rid my computer of these issues. I use my computer for work, and all of these issues have really hurt my productivity. Thanks so much in advance!

Psychotic · March 19, 2014

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Scan with FRST in normal mode

Please download Farbar's Recovery Scan Tool to your desktop: FRST 32bit or FRST 64bit (If not sure: Start --> Computer (right click) --> properties)

Run FRST.
Don´t change one of the checkboxes and hit Scan.
Logfiles are created on your desktop.
Poste the FRST.txt and (after the first scan only!) the Addition.txt.

Scan with TDSS-Killer

Please read and follow these instructions carefully. We do not want it to fix anything yet (if found), we need to see a report first.

Download TDSSKiller.zip and extract to your desktop

Execute TDSSKiller.exe by doubleclicking on it.
Press Start Scan
If Malicious objects are found, do NOT select Copy to quarantine. Change the action to Skip, and save the log.
Once complete, a log will be produced at the root drive which is typically C:\ ,for example, C:\TDSSKiller.<version_date_time>log.txt

Please post the contents of that log in your next reply.

cj5362 · March 19, 2014

Thanks for your help. Here are the log files:

__________________

FRST:

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014

Ran by Brian (administrator) on BG on 19-03-2014 12:17:03

Running from C:\Users\Brian\Desktop

Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Lenovo.) C:\windows\system32\ibmpmsvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Lenovo.) C:\Windows\System32\TpShocks.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe

(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe

(Microsoft Corporation) C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe

(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe

(Microsoft Corporation) C:\windows\SysWOW64\svchost.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe

(Spotify Ltd) C:\Users\Brian\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe

(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe

(Lenovo Group Limited) C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe

(Dropbox, Inc.) C:\Users\Brian\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Nitro PDF Software) C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe

(Nalpeiron Ltd.) C:\Windows\SysWOW64\NLSSRV32.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe

(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe

(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe

(Dolby Laboratories Inc.) C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe

(Intel Corporation) C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe

(Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe

(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe

(Lenovo Group Limited) C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe

(Macrovision Europe Ltd.) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE

(Intel Corporation) C:\windows\system32\igfxext.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE

(Lenovo) C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe

(Microsoft Corporation) C:\windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PrivacyIconClient.exe

(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\sfzone\SafeZoneBrowser.exe

(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe

(AVAST Software) C:\Program Files\AVAST Software\Avast\sfzone\SafeZoneBrowser.exe

(Microsoft Corporation) C:\windows\system32\taskmgr.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12480616 2012-04-17] (Realtek Semiconductor)

HKLM\...\Run: [RtHDVBg_Dolby] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1158248 2012-03-09] (Realtek Semiconductor)

HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916112 2012-04-08] (Synaptics Incorporated)

HKLM\...\Run: [TpShocks] - C:\windows\system32\TpShocks.exe [382528 2012-02-25] (Lenovo.)

HKLM\...\Run: [LENOVO.TPKNRRES] - C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [290160 2012-06-01] (Lenovo Group Limited)

HKLM\...\Run: [Acronis Scheduler2 Service] - C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [358200 2011-01-28] (Acronis)

HKLM-x32\...\Run: [uSB3MON] - C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-04-19] (Intel Corporation)

HKLM-x32\...\Run: [iMSS] - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2012-02-28] (Intel Corporation)

HKLM-x32\...\Run: [Dolby Advanced Audio v2] - C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe [507744 2011-12-20] (Dolby Laboratories Inc.)

HKLM-x32\...\Run: [PWMTRV] - rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor

HKLM-x32\...\Run: [Fastboot] - C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1091376 2012-01-17] (Lenovo)

HKLM-x32\...\Run: [intel AppUp(SM) center] - C:\Program Files (x86)\Intel\IntelAppStore\bin\ismagent.exe [155488 2012-07-12] (Intel Corporation)

HKLM-x32\...\Run: [Lenovo Registration] - C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe [4351712 2011-07-13] (Lenovo, Inc.)

HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [620152 2006-10-22] (Adobe Systems Inc.)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-01-20] (Apple Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)

HKLM-x32\...\Run: [TrueImageMonitor.exe] - C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5111464 2011-01-28] (Acronis)

HKLM-x32\...\Run: [hpqSRMon] - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)

HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-01-20] (Apple Inc.)

HKLM-x32\...\Run: [KiesTrayAgent] - C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [311616 2014-02-07] (Samsung Electronics Co., Ltd.)

HKLM-x32\...\Run: [AvastUI.exe] - C:\Program Files\AVAST Software\Avast\AvastUI.exe [3767096 2014-03-18] (AVAST Software)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKLM\...\Policies\Explorer: [NoControlPanel] 0

HKU\.DEFAULT\...\RunOnce: [{90140000-0011-0000-0000-0000000FF1CE}] - C:\windows\system32\cmd.exe /C del "C:\ProgramData\Microsoft Help\Rgstrtn.lck" /Q /A:H

HKU\S-1-5-21-4266057503-3983920057-3671705298-1000\...\Run: [spotify Web Helper] - C:\Users\Brian\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1104384 2013-09-05] (Spotify Ltd)

HKU\S-1-5-21-4266057503-3983920057-3671705298-1000\...\Run: [AmazonMP3DownloaderHelper] - C:\Users\Brian\AppData\Local\Program Files\Amazon\MP3 Downloader\AmazonMP3DownloaderHelper.exe [400704 2013-05-09] ()

HKU\S-1-5-21-4266057503-3983920057-3671705298-1000\...\Run: [KiesPreload] - C:\Program Files (x86)\Samsung\Kies\Kies.exe [1564992 2014-02-07] (Samsung)

HKU\S-1-5-21-4266057503-3983920057-3671705298-1000\...\MountPoints2: {dc0782c6-103f-11e2-bb98-806e6f6e6963} - Q:\LenovoQDrive.exe

Startup: C:\Users\Brian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\Brian\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/welcome/thinkpad

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com/welcome/thinkpad

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKCU - DefaultScope {2F9D3D87-34AE-4F95-8B0B-9FE9D85694AD} URL = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms}

SearchScopes: HKCU - {2F9D3D87-34AE-4F95-8B0B-9FE9D85694AD} URL = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms}

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENP_enUS505

BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)

BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)

Toolbar: HKLM-x32 - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)

Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)

Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)

Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

FireFox:

========

FF ProfilePath: C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\0thrw3k5.default

FF SearchEngineOrder.1: Secure Search

FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)

FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)

FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @mcafee.com/MVT - C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll No File

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @nitropdf.com/NitroPDF - C:\Program Files (x86)\Nitro PDF\Professional 7\npnitromozilla.dll ( )

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Users\Brian\AppData\Local\Program Files\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10181.dll (Amazon.com, Inc.)

FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\McSiteAdvisor.xml

FF Extension: Huntsy: Add Job - C:\Users\Brian\AppData\Roaming\Mozilla\Firefox\Profiles\0thrw3k5.default\Extensions\huntsyproduction@huntsy.com.xpi [2013-04-23]

FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}.xpi [2014-02-15]

FF HKLM-x32\...\Firefox\Extensions: [VIP1X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access Client\

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-04-14]

FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF

FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-03-18]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2013-04-14]

==================== Services (Whitelisted) =================

R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-03-18] (AVAST Software)

R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [113704 2014-03-18] (AVAST Software)

R2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1363616 2014-01-03] (Microsoft Corporation)

R2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1748640 2014-01-03] (Microsoft Corporation)

S3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [320576 2012-05-15] (Lenovo.)

R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776 2012-01-17] (Lenovo)

R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2012-02-28] (Intel Corporation)

R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [133992 2011-07-12] (Lenovo Group Limited)

S3 LSCWinService; C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [1674720 2013-09-25] ()

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)

R2 NitroDriverReadSpool2; C:\Program Files\Common Files\Nitro PDF\Professional\7.0\NitroPDFDriverService2x64.exe [216072 2012-05-24] (Nitro PDF Software)

R2 OfficeSvc; C:\Program Files\Microsoft Office 15\ClientX64\integratedoffice.exe [1907896 2013-10-31] (Microsoft Corporation)

S3 SUService; C:\Program Files (x86)\Lenovo\System Update\SUService.exe [22376 2013-06-26] ()

==================== Drivers (Whitelisted) ====================

R1 aswKbd; C:\windows\system32\drivers\aswKbd.sys [28184 2014-03-18] (AVAST Software)

R2 aswMonFlt; C:\windows\system32\drivers\aswMonFlt.sys [78648 2014-03-18] (AVAST Software)

R1 aswNdisFlt; C:\Windows\System32\DRIVERS\aswNdisFlt.sys [440672 2014-03-18] (AVAST Software)

R1 aswRdr; C:\windows\system32\drivers\aswRdr2.sys [92544 2014-03-18] (AVAST Software)

R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-03-18] ()

R1 aswSnx; C:\windows\system32\drivers\aswSnx.sys [1038072 2014-03-18] (AVAST Software)

R1 aswSP; C:\windows\system32\drivers\aswSP.sys [421704 2014-03-18] (AVAST Software)

R3 aswStm; C:\windows\system32\drivers\aswStm.sys [80184 2014-03-18] (AVAST Software)

R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [207904 2014-03-18] ()

S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70416 2012-01-17] (Windows ® Win 7 DDK provider)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)

R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)

S3 MFE_RR; \??\C:\Users\Brian\AppData\Local\Temp\mfe_rr.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-03-19 12:17 - 2014-03-19 12:17 - 00024174 _____ () C:\Users\Brian\Desktop\FRST.txt

2014-03-19 12:11 - 2014-03-19 12:15 - 00026818 _____ () C:\Users\Brian\Desktop\Addition_old.txt

2014-03-19 12:10 - 2014-03-19 12:14 - 00051831 _____ () C:\Users\Brian\Desktop\FRST_old.txt

2014-03-19 12:10 - 2014-03-19 12:14 - 00000000 ____D () C:\FRST

2014-03-19 12:05 - 2014-03-19 12:06 - 04110135 _____ () C:\Users\Brian\Desktop\tdsskiller.zip

2014-03-19 12:05 - 2014-03-19 12:05 - 02157056 _____ (Farbar) C:\Users\Brian\Desktop\FRST64.exe

2014-03-19 11:35 - 2014-03-19 11:35 - 00688992 _____ (Swearware) C:\Users\Brian\Downloads\dds.com

2014-03-18 20:18 - 2014-03-18 20:18 - 00002043 _____ () C:\Users\Public\Desktop\avast! SafeZone.lnk

2014-03-18 20:18 - 2014-03-18 20:18 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk

2014-03-18 20:18 - 2014-03-18 20:18 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\AVAST Software

2014-03-18 20:17 - 2014-03-18 20:18 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update

2014-03-18 20:17 - 2014-03-18 20:17 - 01038072 _____ (AVAST Software) C:\windows\system32\Drivers\aswSnx.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00440672 _____ (AVAST Software) C:\windows\system32\Drivers\aswNdisFlt.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00421704 _____ (AVAST Software) C:\windows\system32\Drivers\aswSP.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00334136 _____ (AVAST Software) C:\windows\system32\aswBoot.exe

2014-03-18 20:17 - 2014-03-18 20:17 - 00207904 _____ () C:\windows\system32\Drivers\aswVmm.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00092544 _____ (AVAST Software) C:\windows\system32\Drivers\aswRdr2.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00080184 _____ (AVAST Software) C:\windows\system32\Drivers\aswStm.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00078648 _____ (AVAST Software) C:\windows\system32\Drivers\aswMonFlt.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00065776 _____ () C:\windows\system32\Drivers\aswRvrt.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00043152 _____ (AVAST Software) C:\windows\avastSS.scr

2014-03-18 20:17 - 2014-03-18 20:17 - 00028184 _____ (AVAST Software) C:\windows\system32\Drivers\aswKbd.sys

2014-03-18 20:17 - 2014-03-18 20:17 - 00000000 ____D () C:\Program Files\AVAST Software

2014-03-18 20:16 - 2014-03-18 20:16 - 00000000 ____D () C:\ProgramData\AVAST Software

2014-03-18 20:15 - 2014-03-18 18:55 - 123721280 _____ (AVAST Software) C:\Users\Brian\Desktop\avast_internet_security_setup(1).exe

2014-03-18 20:02 - 2014-03-18 20:02 - 03218352 _____ (McAfee, Inc.) C:\Users\Brian\Desktop\MCPR(1).exe

2014-03-16 10:05 - 2014-03-16 10:05 - 00001124 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-03-16 10:05 - 2014-03-16 10:05 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\Malwarebytes

2014-03-16 10:05 - 2014-03-16 10:05 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-03-16 10:04 - 2014-03-16 10:05 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware

2014-03-16 10:04 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys

2014-03-15 00:06 - 2014-03-15 01:08 - 00000000 ____D () C:\windows\Microsoft Antimalware

2014-03-14 20:30 - 2014-03-01 02:05 - 23133696 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-03-14 20:30 - 2014-03-01 01:17 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-03-14 20:30 - 2014-03-01 01:16 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2014-03-14 20:30 - 2014-03-01 00:58 - 02765824 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-03-14 20:30 - 2014-03-01 00:52 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-03-14 20:30 - 2014-03-01 00:51 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2014-03-14 20:30 - 2014-03-01 00:42 - 00053760 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-03-14 20:30 - 2014-03-01 00:40 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-03-14 20:30 - 2014-03-01 00:37 - 00574976 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-03-14 20:30 - 2014-03-01 00:33 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2014-03-14 20:30 - 2014-03-01 00:33 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2014-03-14 20:30 - 2014-03-01 00:32 - 00708608 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2014-03-14 20:30 - 2014-03-01 00:30 - 17074688 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2014-03-14 20:30 - 2014-03-01 00:23 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2014-03-14 20:30 - 2014-03-01 00:17 - 00218624 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-03-14 20:30 - 2014-03-01 00:11 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2014-03-14 20:30 - 2014-03-01 00:02 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-03-14 20:30 - 2014-02-28 23:54 - 05768704 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-03-14 20:30 - 2014-02-28 23:52 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2014-03-14 20:30 - 2014-02-28 23:51 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2014-03-14 20:30 - 2014-02-28 23:47 - 02168320 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2014-03-14 20:30 - 2014-02-28 23:43 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2014-03-14 20:30 - 2014-02-28 23:43 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2014-03-14 20:30 - 2014-02-28 23:42 - 00627200 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-03-14 20:30 - 2014-02-28 23:40 - 00440832 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2014-03-14 20:30 - 2014-02-28 23:38 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2014-03-14 20:30 - 2014-02-28 23:37 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2014-03-14 20:30 - 2014-02-28 23:35 - 02041856 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-03-14 20:30 - 2014-02-28 23:18 - 13051904 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-03-14 20:30 - 2014-02-28 23:16 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2014-03-14 20:30 - 2014-02-28 23:14 - 04244480 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2014-03-14 20:30 - 2014-02-28 23:10 - 02334208 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-03-14 20:30 - 2014-02-28 23:03 - 00524288 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2014-03-14 20:30 - 2014-02-28 23:00 - 01964032 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2014-03-14 20:30 - 2014-02-28 22:57 - 11266048 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2014-03-14 20:30 - 2014-02-28 22:38 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-03-14 20:30 - 2014-02-28 22:32 - 01820160 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2014-03-14 20:30 - 2014-02-28 22:27 - 01156096 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2014-03-14 20:30 - 2014-02-28 22:25 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2014-03-14 20:30 - 2014-02-28 22:25 - 00703488 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2014-03-14 20:30 - 2014-02-06 21:23 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2014-03-14 20:30 - 2014-01-28 22:32 - 00484864 _____ (Microsoft Corporation) C:\windows\system32\wer.dll

2014-03-14 20:30 - 2014-01-28 22:06 - 00381440 _____ (Microsoft Corporation) C:\windows\SysWOW64\wer.dll

2014-03-14 20:30 - 2014-01-27 22:32 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\wwansvc.dll

2014-03-14 20:29 - 2014-02-03 22:32 - 01424384 _____ (Microsoft Corporation) C:\windows\system32\WindowsCodecs.dll

2014-03-14 20:29 - 2014-02-03 22:32 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll

2014-03-14 20:29 - 2014-02-03 22:04 - 01230336 _____ (Microsoft Corporation) C:\windows\SysWOW64\WindowsCodecs.dll

2014-03-14 20:29 - 2014-02-03 22:04 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll

2014-03-10 07:34 - 2014-03-10 07:34 - 00008755 _____ () C:\Users\Brian\Desktop\03_10_14 - Lecturer Univ Maryland College Park.txt

2014-03-07 08:31 - 2014-03-07 08:31 - 00002697 _____ () C:\Users\Public\Desktop\Skype.lnk

2014-03-07 08:31 - 2014-03-07 08:31 - 00000000 ____D () C:\Users\Brian\AppData\Local\Skype

2014-03-04 20:25 - 2014-03-04 20:29 - 00000000 ____D () C:\Program Files\stinger

2014-03-04 20:14 - 2014-03-04 20:14 - 03218352 _____ (McAfee, Inc.) C:\Users\Brian\Downloads\MCPR.exe

2014-03-04 20:08 - 2014-03-04 20:08 - 00000022 _____ () C:\Users\Brian\Downloads\mctriage.zip

2014-03-04 20:06 - 2014-03-04 20:06 - 00000000 ____D () C:\ProgramData\Citrix

2014-03-04 20:02 - 2014-03-04 20:02 - 00103832 _____ () C:\Users\Brian\GoToAssistDownloadHelper.exe

2014-03-04 20:02 - 2014-03-04 20:02 - 00000000 ____D () C:\Users\Brian\AppData\Local\Citrix

2014-03-04 20:02 - 2014-03-04 20:02 - 00000000 ____D () C:\Program Files (x86)\Citrix

2014-03-04 18:54 - 2014-03-04 18:54 - 00000000 ____D () C:\Users\Brian\Desktop\Tor Browser

2014-03-04 18:03 - 2014-03-04 19:18 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\gnupg

2014-03-04 18:03 - 2014-03-04 18:03 - 00000000 ____D () C:\ProgramData\GNU

2014-03-04 18:03 - 2014-03-04 18:03 - 00000000 ____D () C:\Program Files (x86)\GNU

2014-03-04 16:03 - 2014-03-04 16:03 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\Ulead Systems

2014-03-04 15:22 - 2014-03-04 16:02 - 00000000 ____D () C:\Users\Brian\Desktop\Burn Folder

2014-03-02 23:22 - 2014-03-02 23:22 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\McAfee

2014-03-02 23:21 - 2014-03-02 23:21 - 00541592 _____ (McAfee, Inc.) C:\Users\Brian\Downloads\MVTInstaller.exe

2014-03-02 22:56 - 2009-06-10 17:00 - 00000824 _____ () C:\windows\system32\Drivers\etc\hosts.20140302-215644.backup

2014-03-02 22:31 - 2014-03-04 20:32 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy

2014-03-02 22:31 - 2014-03-04 20:32 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy

2014-03-02 16:05 - 2014-03-02 16:05 - 00007607 _____ () C:\Users\Brian\AppData\Local\Resmon.ResmonCfg

2014-02-28 19:57 - 2014-02-28 19:57 - 00000000 ____D () C:\!KillBox

2014-02-28 19:33 - 2014-03-01 07:58 - 00000000 ____D () C:\Users\Brian\AppData\Local\LogMeIn Rescue Applet

2014-02-28 19:33 - 2014-02-28 19:33 - 01282400 _____ (LogMeIn, Inc.) C:\Users\Brian\Downloads\Support-LogMeInRescue.exe

2014-02-28 19:07 - 2014-02-28 19:07 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\TechCheck

2014-02-28 19:07 - 2000-05-22 02:00 - 00244416 _____ (Microsoft Corporation) C:\windows\SysWOW64\Msflxgrd.ocx

2014-02-28 19:07 - 2000-05-22 02:00 - 00203976 _____ (Microsoft Corporation) C:\windows\SysWOW64\RICHTX32.OCX

2014-02-28 19:06 - 2014-02-28 19:06 - 03992792 _____ () C:\Users\Brian\Downloads\McAfee_TechCheck.exe

2014-02-27 04:03 - 2014-02-28 04:01 - 00775124 _____ () C:\windows\SysWOW64\PerfStringBackup.INI

2014-02-25 22:12 - 2014-03-04 20:44 - 00004948 _____ () C:\windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for BG-Brian BG

2014-02-24 15:41 - 2013-12-20 02:35 - 00105472 _____ () C:\Users\Brian\Desktop\COMM 1000 - Public Speaking - Roster and Grading, Section 4.xls

2014-02-19 16:13 - 2014-02-19 16:13 - 09901416 _____ () C:\Users\Brian\Downloads\saSetup.exe

2014-02-17 15:43 - 2014-02-17 15:43 - 00000000 ___HD () C:\Users\Public\Documents\CrashDump

2014-02-17 15:36 - 2014-02-17 15:36 - 00000000 ___HD () C:\Users\Public\Documents\NativeFus_Log

2014-02-17 15:36 - 2014-02-17 15:36 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\Samsung

2014-02-17 15:36 - 2014-02-17 15:36 - 00000000 ____D () C:\Users\Brian\AppData\Local\Samsung

2014-02-17 15:35 - 2014-02-17 15:35 - 00000000 ____D () C:\Users\Brian\Documents\samsung

2014-02-17 15:23 - 2014-02-07 17:33 - 04659712 _____ (Dmitry Streblechenko) C:\windows\SysWOW64\Redemption.dll

2014-02-17 15:23 - 2014-01-23 19:31 - 00821824 _____ (Devguru Co., Ltd.) C:\windows\SysWOW64\dgderapi.dll

2014-02-17 15:22 - 2014-02-17 15:27 - 00000000 ____D () C:\Program Files (x86)\Samsung

2014-02-17 15:21 - 2014-02-17 15:27 - 00000000 ____D () C:\ProgramData\Samsung

2014-02-17 15:20 - 2014-02-17 15:20 - 00000000 ____D () C:\Users\Brian\AppData\Local\Downloaded Installations

2014-02-17 15:19 - 2014-02-17 15:20 - 75211320 _____ (Samsung Electronics Co., Ltd.) C:\Users\Brian\Downloads\KiesSetup.exe

==================== One Month Modified Files and Folders =======

2014-03-19 12:17 - 2014-03-19 12:17 - 00024174 _____ () C:\Users\Brian\Desktop\FRST.txt

2014-03-19 12:15 - 2014-03-19 12:11 - 00026818 _____ () C:\Users\Brian\Desktop\Addition_old.txt

2014-03-19 12:14 - 2014-03-19 12:10 - 00051831 _____ () C:\Users\Brian\Desktop\FRST_old.txt

2014-03-19 12:14 - 2014-03-19 12:10 - 00000000 ____D () C:\FRST

2014-03-19 12:06 - 2014-03-19 12:05 - 04110135 _____ () C:\Users\Brian\Desktop\tdsskiller.zip

2014-03-19 12:05 - 2014-03-19 12:05 - 02157056 _____ (Farbar) C:\Users\Brian\Desktop\FRST64.exe

2014-03-19 11:35 - 2014-03-19 11:35 - 00688992 _____ (Swearware) C:\Users\Brian\Downloads\dds.com

2014-03-19 11:34 - 2014-02-05 09:32 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird

2014-03-19 10:56 - 2012-10-07 01:33 - 02004671 _____ () C:\windows\WindowsUpdate.log

2014-03-19 09:05 - 2009-07-14 01:13 - 00782510 _____ () C:\windows\system32\PerfStringBackup.INI

2014-03-19 09:05 - 2009-07-14 00:45 - 00031472 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-03-19 09:05 - 2009-07-14 00:45 - 00031472 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-03-19 09:02 - 2012-10-14 00:27 - 00000000 ___RD () C:\Users\Brian\Desktop\Dropbox

2014-03-19 09:02 - 2012-10-14 00:25 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\Dropbox

2014-03-19 09:01 - 2012-10-12 17:39 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\Nitro PDF

2014-03-19 08:58 - 2009-07-14 01:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-03-19 08:58 - 2009-07-14 00:51 - 00090971 _____ () C:\windows\setupact.log

2014-03-18 20:20 - 2010-11-20 23:47 - 00903040 _____ () C:\windows\PFRO.log

2014-03-18 20:18 - 2014-03-18 20:18 - 00002043 _____ () C:\Users\Public\Desktop\avast! SafeZone.lnk

2014-03-18 20:18 - 2014-03-18 20:18 - 00001983 _____ () C:\Users\Public\Desktop\avast! Internet Security.lnk

2014-03-18 20:18 - 2014-03-18 20:18 - 00000000 ____D () C:\Users\Brian\AppData\Roaming\AVAST Software

2014-03-18 20:18 - 2014-03-18 20:17 - 00004182 _____ () C:\windows\System32\Tasks\avast! Emergency Update