Infected with LV Maintenance

najiwench · March 27, 2014

Hi there, seems I have contracted this virus.

Here are the files:

dds.txt:

DDS (Ver_2012-11-20.01) - NTFS_AMD64

Internet Explorer: 10.0.9200.16843 BrowserJavaVersion: 10.40.2

Run by Jami at 16:04:20 on 2014-03-27

Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.8112.5891 [GMT -7:00]

.

AV: Trend Micro Titanium Maximum Security *Enabled/Updated* {B7599298-8445-728A-A5C7-A26A082C8BDA}

AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

SP: Trend Micro Titanium Maximum Security *Enabled/Updated* {0C38737C-A27F-7D04-9F77-991873ABC167}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\system32\atiesrxx.exe

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\dwm.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\atieclxx.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

C:\Program Files\Trend Micro\AMSP\AMSP_LogServer.exe

C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe

C:\Windows\system32\dashost.exe

C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt

C:\Windows\System32\svchost.exe -k HPZ12

C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

C:\Windows\Explorer.EXE

C:\Program Files (x86)\PasswordBox\pbbtnService.exe

C:\Windows\System32\svchost.exe -k HPZ12

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\taskhostex.exe

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe

C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\loggingserver.exe

C:\Windows\system32\svchost.exe -k HPService

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Windows\System32\WUDFHost.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe

C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe

C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

C:\PROGRA~2\Raptr\raptr.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe

C:\PROGRA~2\Raptr\raptr_im.exe

C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe

C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files (x86)\Raptr\raptr_ep64.exe

C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

C:\Windows\system32\vssvc.exe

C:\Windows\system32\taskhost.exe

C:\Windows\System32\svchost.exe -k swprv

C:\Windows\SYSTEM32\notepad.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\System32\cscript.exe

.

============== Pseudo HJT Report ===============

.

mStart Page = about:blank

uProxyServer = hxxp=127.0.0.1:47145;https=127.0.0.1:47145

uProxyOverride = <-loopback>

mWinlogon: Userinit = userinit.exe,

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - <orphaned>

BHO: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20013\1.0.1221\1.0.1221\TmopIEPlg32.dll

BHO: TSToolbarBHO: {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll

BHO: PasswordBox Helper: {5DB69B97-934B-451D-94DB-32EF802A01CD} - C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll

BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll

BHO: AVG SafeGuard toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\17.3.2.101\AVG SafeGuard toolbar_toolbar.dll

BHO: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\7.5.1137\7.5.1137\TmBpIe32.dll

BHO: PrintEco: {BEB54677-E12F-44E7-AC7E-48241B866B5F} - C:\Program Files (x86)\PrintEco\PrintEco Office\adxloader.dll

BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll

TB: Trend Micro Toolbar: {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll

TB: AVG SafeGuard toolbar: {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG SafeGuard toolbar\17.3.2.101\AVG SafeGuard toolbar_toolbar.dll

TB: QuickShare Widget: {ae07101b-46d4-4a98-af68-0333ea26e113} -

uRun: [steam] "C:\Program Files (x86)\Steam\Steam.exe" -silent

uRun: [EA Core] "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent

uRun: [Fitbit Connect] "C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe" /autorun

uRun: [Messenger (Yahoo!)] "C:\PROGRA~2\Yahoo!\Messenger\YahooMessenger.exe" -quiet

uRun: [iLivid] "C:\Users\Jami\AppData\Local\iLivid\iLivid.exe" -autorun

uRun: [ContentExplorer] "C:\Users\Jami\AppData\Roaming\ContentExplorer\ContentExplorer.exe"

uRun: [LVMaintenance] C:\Users\Jami\AppData\Roaming\LVMaintenance\LVMaintenance.exe

uRun: [Raptr] C:\PROGRA~2\Raptr\raptrstub.exe --startup

uRun: [HydraVisionDesktopManager] "C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe"

mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

mRun: [ASUS Easy Update] C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe

mRun: [ASUS AiChargerPlus Execute] C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe

mRun: [ASUSPRP] "C:\Program Files (x86)\ASUS\APRP\APRP.EXE"

mRun: [AMD AVT] Cmd.exe /c start "AMD Accelerated Video Transcoding device initialization" /min "C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe" aml

mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"

mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"

mRun: [Fitbit Connect] "C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe" /autorun

mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"

mRun: [vProt] "C:\Program Files (x86)\AVG SafeGuard toolbar\vprot.exe"

mRun: [Carbonite Backup] C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe

mRun: [HP Software Update] C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe

mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"

mRun: [startCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe" MSRun

StartupFolder: C:\Users\Jami\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip

StartupFolder: C:\Users\Jami\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\OPENOF~1.LNK - C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe

StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\HPDIGI~1.LNK - C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

Trusted Zone: clonewarsadventures.com

Trusted Zone: freerealms.com

Trusted Zone: soe.com

Trusted Zone: sony.com

TCP: NameServer = 209.18.47.61 209.18.47.62

TCP: Interfaces\{5816852B-5C92-4444-B820-A2B886E88934} : DHCPNameServer = 209.18.47.61 209.18.47.62

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\7.5.1137\7.5.1137\TmBpIe32.dll

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20013\1.0.1221\1.0.1221\TmopIEPlg32.dll

Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll

Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll

Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\17.3.0\ViProtocol.dll

Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll

SSODL: WebCheck - <orphaned>

mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome

IFEO: bitguard.exe - tasklist.exe

IFEO: bprotect.exe - tasklist.exe

IFEO: bpsvc.exe - tasklist.exe

IFEO: browsemngr.exe - tasklist.exe

IFEO: browserdefender.exe - tasklist.exe

x64-mStart Page = about:blank

x64-BHO: TmIEPlugInBHO Class: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\module\20013\1.0.1221\1.0.1221\TmopIEPlg.dll

x64-BHO: QuickShare WidgetEngine: {31ad400d-1b06-4e33-a59a-90c2c140cba0} -

x64-BHO: TmBpIeBHO Class: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\module\20002\7.5.1137\7.5.1137\TmBpIe64.dll

x64-BHO: PrintEco: {BEB54677-E12F-44E7-AC7E-48241B866B5F} - C:\Program Files (x86)\PrintEco\PrintEco Office\adxloader64.dll

x64-TB: QuickShare Widget: {ae07101b-46d4-4a98-af68-0333ea26e113} -

x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s

x64-Run: [Trend Micro Titanium] "C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe" -set Silent "1" SplashURL ""

x64-Run: [etMonitor] C:\Windows\etMon.exe

x64-Run: [Trend Micro Client Framework] "C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe"

x64-Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\7.5.1137\7.5.1137\TmBpIe64.dll

x64-Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20013\1.0.1221\1.0.1221\TmopIEPlg.dll

x64-Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - <orphaned>

x64-Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - <orphaned>

x64-Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - <orphaned>

x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>

x64-SSODL: WebCheck - <orphaned>

x64-IFEO: bitguard.exe - tasklist.exe

x64-IFEO: bprotect.exe - tasklist.exe

x64-IFEO: bpsvc.exe - tasklist.exe

x64-IFEO: browsemngr.exe - tasklist.exe

x64-IFEO: browserdefender.exe - tasklist.exe

.

Note: multiple IFEO entries found. Please refer to Attach.txt

.

================= FIREFOX ===================

.

FF - ProfilePath - C:\Users\Jami\AppData\Roaming\Mozilla\Firefox\Profiles\at73luqo.default\

FF - plugin: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll

FF - plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\17.3.0\npsitesafety.dll

FF - plugin: C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll

FF - plugin: C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll

FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll

FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrlui.dll

FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll

FF - plugin: C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll

FF - plugin: C:\Users\Jami\AppData\Local\Roblox\Versions\version-a70065f9195a4a76\NPRobloxProxy.dll

FF - plugin: C:\Users\Jami\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll

FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll

FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll

FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll

FF - plugin: C:\Windows\SysWOW64\npmproxy.dll

.

============= SERVICES / DRIVERS ===============

.

R0 amd_sata;amd_sata;C:\Windows\System32\Drivers\amd_sata.sys [2013-1-7 79016]

R0 amd_xata;amd_xata;C:\Windows\System32\Drivers\amd_xata.sys [2013-1-7 26280]

R0 TMEBC;TMEBC;C:\Windows\System32\Drivers\TMEBC64.sys [2013-2-24 46392]

R1 tmevtmgr;tmevtmgr;C:\Windows\System32\Drivers\tmevtmgr.sys [2013-2-24 77184]

R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2012-10-17 239616]

R2 AMD FUEL Service;AMD FUEL Service;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2013-12-6 344064]

R2 Amsp;Trend Micro Solution Platform;C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe [2013-2-24 310952]

R2 AODDriver4.2.0;AODDriver4.2.0;C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys [2013-9-19 59648]

R2 asComSvc;ASUS Com Service;C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [2012-12-12 920736]

R2 asHmComSvc;ASUS HM Com Service;C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [2012-12-12 951936]

R2 AsSysCtrlService;ASUS System Control Service;C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [2012-12-12 149120]

R2 Fabs;FABS - Helping agent for MAGIX media database;C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe [2011-5-24 1840128]

R2 Fitbit Connect;Fitbit Connect Service;C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [2013-2-25 1239584]

R2 PasswordBox;PasswordBox;C:\Program Files (x86)\PasswordBox\pbbtnService.exe [2013-11-1 67584]

R2 tmusa;Trend Micro Osprey Driver;C:\Windows\System32\Drivers\tmusa.sys [2013-2-24 92456]

R2 vToolbarUpdater17.3.0;vToolbarUpdater17.3.0;C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\17.3.0\ToolbarUpdater.exe [2014-1-10 1772056]

R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;C:\Windows\System32\Drivers\AtihdW86.sys [2013-9-24 215040]

R3 AU8168;AU 8168 NT Driver;C:\Windows\System32\Drivers\au630x64.sys [2013-9-23 792648]

R3 tmeevw;tmeevw;C:\Windows\System32\Drivers\tmeevw.sys [2013-2-24 94520]

R3 tmnciesc;tmnciesc;C:\Windows\System32\Drivers\tmnciesc.sys [2013-2-24 210232]

R3 usbfilter;AMD USB Filter Driver;C:\Windows\System32\Drivers\usbfilter.sys [2013-1-7 57000]

R3 WUDFWpdMtp;WUDFWpdMtp;C:\Windows\System32\Drivers\WUDFRd.sys [2012-7-25 198656]

S0 tmel;tmel;C:\Windows\System32\Drivers\tmel.sys [2013-2-24 34224]

S3 DCamUSBET;ET USB 2760 Camera;C:\Windows\System32\Drivers\etDevice64.sys [2007-7-23 527744]

S3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);C:\Windows\System32\Drivers\ssudbus.sys [2013-2-6 102936]

S3 FiltUSBET;ET USB Device Lower Filter;C:\Windows\System32\Drivers\etFilter64.sys [2007-6-14 281088]

S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe [2011-4-26 2702848]

S3 RTL8168;Realtek 8168 NT Driver;C:\Windows\System32\Drivers\Rt630x64.sys [2012-12-12 690832]

S3 ScanUSBET;ET USB Still Image Capture Device;C:\Windows\System32\Drivers\etScan64.sys [2007-7-23 9216]

S3 ssudmdm;SAMSUNG Mobile USB Modem Drivers (DEVGURU Ver.);C:\Windows\System32\Drivers\ssudmdm.sys [2013-2-6 203544]

S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\Drivers\usbaapl64.sys [2012-12-13 54784]

.

=============== File Associations ===============

.

FileExt: .txt: txtfile=C:\Windows\System32\NOTEPAD.EXE %1 [userChoice]

.

=============== Created Last 30 ================

.

2014-03-27 22:52:40 -------- d-----w- C:\FRST

2014-03-27 20:02:08 -------- d-----w- C:\Users\Jami\AppData\Local\Macromedia

2014-03-27 20:01:13 -------- d-----w- C:\Users\Jami\AppData\Local\Mozilla

2014-03-23 21:26:18 -------- d-----w- C:\Program Files\ATI Technologies

2014-03-23 21:25:26 -------- d-----w- C:\Windows\LastGood.Tmp

2014-03-23 21:24:34 -------- d-----w- C:\ProgramData\Package Cache

2014-03-23 21:21:42 -------- d-----w- C:\AMD

2014-03-23 21:17:56 -------- d-----w- C:\Users\Jami\AppData\Roaming\library_dir

2014-03-23 21:17:30 -------- d-----w- C:\Users\Jami\AppData\Roaming\Raptr

2014-03-23 21:17:18 -------- d-----w- C:\Program Files (x86)\Raptr

2014-03-15 02:25:29 254640 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10236.bin

2014-03-11 14:25:54 -------- d-----w- C:\Users\Jami\AppData\Roaming\LVMaintenance

2014-03-10 01:41:25 -------- d-----w- C:\Users\Jami\AppData\Roaming\Pogo Games

2014-03-08 14:37:40 -------- d-----w- C:\Program Files (x86)\PrintEco

2014-03-08 14:36:42 -------- d-----w- C:\Users\Jami\AppData\Roaming\ContentExplorer

2014-03-08 14:34:36 -------- d-----w- C:\Users\Jami\AppData\Local\FlvtoYoutubeDownloader

2014-03-08 14:34:35 -------- d-----w- C:\Users\Jami\AppData\Roaming\FlvtoConverter

2014-03-08 14:32:39 -------- d-----w- C:\Users\Jami\AppData\Local\Flvto Youtube Downloader

2014-03-06 18:03:15 -------- d-----w- C:\Program Files (x86)\Western Digital

2014-03-06 18:02:54 -------- d-----w- C:\Users\Jami\AppData\Roaming\com.wd.WDMyCloud

.

==================== Find3M ====================

.

2014-03-08 14:37:47 238128 ----a-w- C:\Windows\RegBootClean64.exe

2014-03-04 22:52:34 78304 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

2014-03-04 22:52:34 694240 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe

2014-02-23 08:13:41 2241536 ----a-w- C:\Windows\System32\wininet.dll

2014-02-23 08:13:31 915968 ----a-w- C:\Windows\System32\uxtheme.dll

2014-02-23 08:13:31 53760 ----a-w- C:\Windows\System32\UXInit.dll

2014-02-23 08:11:59 3960320 ----a-w- C:\Windows\System32\jscript9.dll

2014-02-23 08:11:52 67072 ----a-w- C:\Windows\System32\iesetup.dll

2014-02-23 08:11:52 136704 ----a-w- C:\Windows\System32\iesysprep.dll

2014-02-23 06:54:46 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll

2014-02-23 06:54:37 44032 ----a-w- C:\Windows\SysWow64\UXInit.dll

2014-02-23 06:53:22 2877952 ----a-w- C:\Windows\SysWow64\jscript9.dll

2014-02-23 06:53:18 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll

2014-02-23 06:53:18 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll

2014-02-23 06:35:36 2706432 ----a-w- C:\Windows\System32\mshtml.tlb

2014-02-23 06:31:25 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb

2014-02-23 04:06:33 534528 ----a-w- C:\Windows\SysWow64\uxtheme.dll

2014-02-08 04:34:42 4036608 ----a-w- C:\Windows\System32\win32k.sys

2014-02-05 23:41:39 595968 ----a-w- C:\Windows\System32\qedit.dll

2014-02-05 23:37:51 496640 ----a-w- C:\Windows\SysWow64\qedit.dll

2014-01-31 00:48:33 1339392 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll

2014-01-31 00:06:01 1628160 ----a-w- C:\Windows\System32\WindowsCodecs.dll

2014-01-12 23:30:39 2032640 ----a-w- C:\Windows\SysWow64\d3d10warp.dll

2014-01-12 23:30:18 2238976 ----a-w- C:\Windows\System32\d3d10warp.dll

.

============= FINISH: 16:04:36.97 ===============

attach.txt:

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2012-11-20.01)

.

Microsoft Windows 8

Boot Device: \Device\HarddiskVolume2

Install Date: 2/24/2013 9:21:23 PM

System Uptime: 3/27/2014 3:36:49 PM (1 hours ago)

.

Motherboard: ASUSTeK COMPUTER INC. | | CM1855

Processor: AMD FX-8120 Eight-Core Processor | Socket 942 | 3100/200mhz

.

==== Disk Partitions =========================

.

C: is FIXED (NTFS) - 150 GiB total, 14.2 GiB free.

D: is FIXED (NTFS) - 764 GiB total, 764.161 GiB free.

E: is CDROM (UDF)

F: is Removable

G: is Removable

H: is Removable

I: is Removable

J: is FIXED (FAT32) - 32 GiB total, 31.748 GiB free.

.

==== Disabled Device Manager Items =============

.

Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}

Description: Officejet J4680 series

Device ID: ROOT\MULTIFUNCTION\0000

Manufacturer: HP

Name: Officejet J4680 series

PNP Device ID: ROOT\MULTIFUNCTION\0000

Service:

.

==== System Restore Points ===================

.

No restore point in system.

.

==== Image File Execution Options =============

.

IFEO: bitguard.exe - tasklist.exe

IFEO: bprotect.exe - tasklist.exe

IFEO: bpsvc.exe - tasklist.exe

IFEO: browsemngr.exe - tasklist.exe

IFEO: browserdefender.exe - tasklist.exe

IFEO: browsermngr.exe - tasklist.exe

IFEO: browserprotect.exe - tasklist.exe

IFEO: browsersafeguard.exe - tasklist.exe

IFEO: bundlesweetimsetup.exe - tasklist.exe

IFEO: cltmngsvc.exe - tasklist.exe

IFEO: delta babylon.exe - tasklist.exe

IFEO: delta tb.exe - tasklist.exe

IFEO: delta2.exe - tasklist.exe

IFEO: deltainstaller.exe - tasklist.exe

IFEO: deltasetup.exe - tasklist.exe

IFEO: deltatb.exe - tasklist.exe

IFEO: deltatb_2501-c733154b.exe - tasklist.exe

IFEO: dprotectsvc.exe - tasklist.exe

IFEO: iminentsetup.exe - tasklist.exe

IFEO: protectedsearch.exe - tasklist.exe

IFEO: rjatydimofu.exe - tasklist.exe

IFEO: searchprotection.exe - tasklist.exe

IFEO: searchprotector.exe - tasklist.exe

IFEO: snapdo.exe - tasklist.exe

IFEO: stinst32.exe - tasklist.exe

IFEO: stinst64.exe - tasklist.exe

IFEO: sweetimsetup.exe - tasklist.exe

IFEO: tbdelta.exetoolbar783881609.exe - tasklist.exe

IFEO: utiljumpflip.exe - tasklist.exe

x64-IFEO: bitguard.exe - tasklist.exe

x64-IFEO: bprotect.exe - tasklist.exe

x64-IFEO: bpsvc.exe - tasklist.exe

x64-IFEO: browsemngr.exe - tasklist.exe

x64-IFEO: browserdefender.exe - tasklist.exe

x64-IFEO: browsermngr.exe - tasklist.exe

x64-IFEO: browserprotect.exe - tasklist.exe

x64-IFEO: browsersafeguard.exe - tasklist.exe

x64-IFEO: bundlesweetimsetup.exe - tasklist.exe

x64-IFEO: cltmngsvc.exe - tasklist.exe

x64-IFEO: delta babylon.exe - tasklist.exe

x64-IFEO: delta tb.exe - tasklist.exe

x64-IFEO: delta2.exe - tasklist.exe

x64-IFEO: deltainstaller.exe - tasklist.exe

x64-IFEO: deltasetup.exe - tasklist.exe

x64-IFEO: deltatb.exe - tasklist.exe

x64-IFEO: deltatb_2501-c733154b.exe - tasklist.exe

x64-IFEO: dprotectsvc.exe - tasklist.exe

x64-IFEO: iminentsetup.exe - tasklist.exe

x64-IFEO: protectedsearch.exe - tasklist.exe

x64-IFEO: rjatydimofu.exe - tasklist.exe

x64-IFEO: searchprotection.exe - tasklist.exe

x64-IFEO: searchprotector.exe - tasklist.exe

x64-IFEO: snapdo.exe - tasklist.exe

x64-IFEO: stinst32.exe - tasklist.exe

x64-IFEO: stinst64.exe - tasklist.exe

x64-IFEO: sweetimsetup.exe - tasklist.exe

x64-IFEO: tbdelta.exetoolbar783881609.exe - tasklist.exe

x64-IFEO: utiljumpflip.exe - tasklist.exe

.

==== Installed Programs ======================

.

???

????

4660_4680_Help

64 Bit HP CIO Components Installer

Adobe Flash Player 12 Plugin

Adobe Reader X (10.1.8) MUI

Adobe Shockwave Player 12.0

AI Suite II

AMD Accelerated Video Transcoding

AMD APP SDK Runtime

AMD Catalyst Control Center

AMD Catalyst Install Manager

AMD Fuel

Apple Application Support

Apple Mobile Device Support

Apple Software Update

ASUS Music Maker

ASUS MX Suite

ASUS Video easy

ASUSDVD

AVG SafeGuard toolbar

Bonjour

Bonjour Print Services

bpd_scan

BPDSoftware

BPDSoftware_Ini

BufferChm

Carbonite

Catalyst Control Center - Branding

Catalyst Control Center Graphics Previews Common

Catalyst Control Center InstallProxy

Catalyst Control Center Localization All

ccc-utility64

CCC Help Chinese Standard

CCC Help Chinese Traditional

CCC Help Czech

CCC Help Danish

CCC Help Dutch

CCC Help English

CCC Help Finnish

CCC Help French

CCC Help German

CCC Help Greek

CCC Help Hungarian

CCC Help Italian

CCC Help Japanese

CCC Help Korean

CCC Help Norwegian

CCC Help Polish

CCC Help Portuguese

CCC Help Russian

CCC Help Spanish

CCC Help Swedish

CCC Help Thai

CCC Help Turkish

ContentExplorer

CopyTrans Suite Remove Only

Curse Client

D3DX10

Destinations

DeviceDiscovery

DocProc

Fax

Firebird SQL Server - MAGIX Edition

Fitbit Connect

Fotogalerie

Galeria de Fotografias

Galerie de photos

Galería de fotos

Google Chrome

Google Update Helper

GPBaseService2

HP Customer Participation Program 14.0

HP Imaging Device Functions 14.0

HP OfficeJet J4600 All-In-One Series

HP Solution Center 14.0

HP Update

HPProductAssistant

HPSSupply

HydraVision

iTunes

J4680

Java 7 Update 40

Java Auto Updater

LINE

LK Maintenance

Malwarebytes Anti-Malware version 1.75.0.1300

MarketResearch

Microsoft Application Error Reporting

Microsoft Money Plus

Microsoft Money Shared Libraries

Microsoft Silverlight

Microsoft SkyDrive

Microsoft SQL Server 2005 Compact Edition [ENU]

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319

Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219

Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727

Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727

Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727

Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727

Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727

Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727

Microsoft WSE 3.0 Runtime

Movie Maker

Mozilla Firefox 28.0 (x86 en-US)

Mozilla Maintenance Service

MSVCRT

MSVCRT110

MSVCRT110_amd64

MSXML 4.0 SP3 Parser

MSXML 4.0 SP3 Parser (KB2758694)

Network64

OCR Software by I.R.I.S. 14.0

OpenOffice.org 3.4.1

OPERATION MANIA

Origin

Overlord

Photo Common

Photo Gallery

PhotoFiltre 7

Plants vs. Zombies: Game of the Year

PrintEco Office

ProductContext

QuickShare

Quit Keeper

Raccolta foto

Raptr

Realtek Ethernet Controller Driver

ROBLOX Player for Jami

ROBLOX Studio 2013 for Jami

S?????? f?t???af???

Scan

Shop for HP Supplies

Sid Meier's Civilization III: Complete

Sid Meier's Civilization IV

Sid Meier's Civilization V

SolutionCenter

Status

Steam

swMSM

The Sims 2

The Sims 2 Nightlife

The Sims 2 Open For Business

The Sims 2 Pets

The Sims™ 2 Seasons

The Sims™ 3

Toolbox

TrayApp

Trend Micro Titanium

Trend Micro Titanium Maximum Security

Unity Web Player

Ventrilo Client

WD My Cloud

WebReg

Windows Live

Windows Live ???

Windows Live Communications Platform

Windows Live Essentials

Windows Live Installer

Windows Live Photo Common

Windows Live PIMT Platform

Windows Live SOXE

Windows Live SOXE Definitions

Windows Live UX Platform

Windows Live UX Platform Language Pack

Wizard101

World of Warcraft

Yahoo! Messenger

Yahoo! Software Update

Zuma's Revenge

.

==== Event Viewer Messages From Past Week ========

.

3/27/2014 9:28:43 AM, Error: Service Control Manager [7038] - The WerSvc service was unable to log on as NT AUTHORITY\SYSTEM with the currently configured password due to the following error: The request is not supported. To ensure that the service is configured properly, use the Services snap-in in Microsoft Management Console (MMC).

3/22/2014 1:06:14 PM, Error: Schannel [36888] - A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 70. The Windows SChannel error state is 11.

.

==== End Of File ===========================

kevinf80 · March 27, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Run Malwarebytes, Open > Settings Tab > Scanner Settings > Under action for PUP > Select: Show in Results List and Check for removal.

Please Update and run a Quick scan

Make sure that everything is checked, and click Remove Selected on any found items.

Post the produced log

Next,

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Next,

Download AdwCleaner by Xplode from here: http://www.bleepingcomputer.com/download/adwcleaner/ and save to your Desktop.

Double click on AdwCleaner.exe to run the tool.
Vista/Windows 7/8 users right-click and select Run As Administrator
Click on the Scan button.
AdwCleaner will begin...be patient as the scan may take some time to complete.
When it's done you'll see: Pending: Uncheck any elements you don't want removed.
Now click on the Report button...a logfile (AdwCleaner[R0].txt) will open in Notepad for review.
Look over the log especially under Files/Folders for any program you want to save.
If there's a program you want to save, just uncheck it from AdwCleaner.
If you're not sure, post the log for review.
If you're ready to clean it all up.....click the Clean button.
After rebooting, a logfile report (AdwCleaner[s0].txt) will open automatically.
Copy and paste the contents of that logfile in your next reply.
A copy of that logfile will also be saved in the C:\AdwCleaner folder.
Items that are deleted are moved to the Quarantine Folder: C:\AdwCleaner\Quarantine
To restore an item that has been deleted (if necessary):
Go to Tools > Quarantine Manager > check what you want restored > now click on Restore.

Next,

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Let me see those logs..

Kevin

najiwench · March 28, 2014

Ok, working on everything but first here is the AdwCleaner report, not sure what to remove from this one:

# AdwCleaner v3.022 - Report created 27/03/2014 at 19:11:16

# Updated 13/03/2014 by Xplode

# Operating System : Windows 8 (64 bits)

# Username : Jami - JAMIPC

# Running from : C:\Users\Jami\Desktop\AdwCleaner.exe

# Option : Scan

***** [ Services ] *****

Service Found : vToolbarUpdater17.3.0

***** [ Files / Folders ] *****

Folder Found : C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj

Folder Found : C:\Users\Kids\AppData\Local\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj

Folder Found : C:\Users\Kids\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Folder Found : C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj

Folder Found : C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Folder Found C:\Program Files (x86)\AVG SafeGuard toolbar

Folder Found C:\Program Files (x86)\Common Files\AVG Secure Search

Folder Found C:\ProgramData\AVG SafeGuard toolbar

Folder Found C:\ProgramData\BitGuard

Folder Found C:\ProgramData\Browser Manager

Folder Found C:\ProgramData\BrowserProtect

Folder Found C:\Users\Jami\AppData\Local\AVG SafeGuard toolbar

Folder Found C:\Users\Jami\AppData\LocalLow\AVG SafeGuard toolbar

Folder Found C:\Users\Kids\AppData\Local\AVG SafeGuard toolbar

Folder Found C:\Users\Kids\AppData\LocalLow\AVG SafeGuard toolbar

Folder Found C:\Users\Linda\AppData\Local\AVG SafeGuard toolbar

Folder Found C:\Users\Linda\AppData\LocalLow\AVG SafeGuard toolbar

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\AVG SafeGuard toolbar

Key Found : HKCU\Software\Classes\iLivid.torrent

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Found : [x64] HKCU\Software\AVG SafeGuard toolbar

Key Found : HKLM\Software\AVG SafeGuard toolbar

Key Found : HKLM\Software\AVG Security Toolbar

Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Found : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI

Key Found : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI.1

Key Found : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj

Key Found : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj.1

Key Found : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Found : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Found : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\heoldelcflnigdllmlopiefhkkobendj

Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar

Key Found : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Key Found : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Value Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [iLivid]

Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

Value Found : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Value Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16843

-\\ Mozilla Firefox v28.0 (en-US)

[ File : C:\Users\Jami\AppData\Roaming\Mozilla\Firefox\Profiles\at73luqo.default\prefs.js ]

-\\ Google Chrome v33.0.1750.154

[ File : C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : homepage

[ File : C:\Users\Kids\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : homepage

[ File : C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found : homepage

Found : search_url

Found : keyword

*************************

AdwCleaner[R0].txt - [8476 octets] - [27/03/2014 19:11:16]

########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [8536 octets] ##########

kevinf80 · March 28, 2014

Remove all entries via the clean option...

najiwench · March 28, 2014

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org

Database version: v2014.03.27.07

Windows 8 x64 NTFS

Internet Explorer 10.0.9200.16843

Jami :: JAMIPC [administrator]

3/27/2014 6:38:00 PM

mbam-log-2014-03-27 (18-38-00).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 293256

Time elapsed: 6 minute(s), 46 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

najiwench · March 28, 2014

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.3 (03.23.2014:1)

OS: Windows 8 x64

Ran by Jami on Thu 03/27/2014 at 18:58:02.32

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113}

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\scripthelper.exe

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\AppID\viprotocol.dll

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{058F0E48-61CA-4964-9FBA-1978A1BB060D}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{18F33C35-8EF2-40D7-8BA4-932B0121B472}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{933B95E2-E7B7-4AD9-B952-7AC336682AE3}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\ilivid

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\smartbar

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\softonic

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\AppDataLow\software\lyricspal

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.bandobjectattribute

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.dockingpanel

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.iesmartbar

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.iesmartbarbandobject

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.smartbardisplaystate

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\iesmartbar.smartbarmenuform

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\protocols\handler\viprotocol

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\s

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\scripthelper.scripthelperapi.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Classes\viprotocol.viprotocolole.1

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\quickshare_rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\quickshare_rasmancs

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Jami\appdata\local\ilivid"

Successfully deleted: [Folder] "C:\Users\Jami\appdata\locallow\datamngr"

Successfully deleted: [Folder] "C:\Users\Jami\appdata\locallow\smartbar"

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Thu 03/27/2014 at 19:05:01.20

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

najiwench · March 28, 2014

# AdwCleaner v3.022 - Report created 28/03/2014 at 13:00:17

# Updated 13/03/2014 by Xplode

# Operating System : Windows 8 (64 bits)

# Username : Jami - JAMIPC

# Running from : C:\Users\Jami\Desktop\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

Service Deleted : vToolbarUpdater17.3.0

***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\AVG SafeGuard toolbar

[#] Folder Deleted : C:\ProgramData\BitGuard

[#] Folder Deleted : C:\ProgramData\Browser Manager

[#] Folder Deleted : C:\ProgramData\BrowserProtect

Folder Deleted : C:\Program Files (x86)\AVG SafeGuard toolbar

Folder Deleted : C:\Program Files (x86)\Common Files\AVG Secure Search

Folder Deleted : C:\Users\Jami\AppData\Local\AVG SafeGuard toolbar

Folder Deleted : C:\Users\Jami\AppData\LocalLow\AVG SafeGuard toolbar

Folder Deleted : C:\Users\Kids\AppData\Local\AVG SafeGuard toolbar

Folder Deleted : C:\Users\Kids\AppData\LocalLow\AVG SafeGuard toolbar

Folder Deleted : C:\Users\Linda\AppData\Local\AVG SafeGuard toolbar

Folder Deleted : C:\Users\Linda\AppData\LocalLow\AVG SafeGuard toolbar

Folder Deleted : C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj

Folder Deleted : C:\Users\Kids\AppData\Local\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj

Folder Deleted : C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Default\Extensions\heoldelcflnigdllmlopiefhkkobendj

Folder Deleted : C:\Users\Kids\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Folder Deleted : C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

***** [ Shortcuts ] *****

***** [ Registry ] *****

Value Deleted : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar]

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\heoldelcflnigdllmlopiefhkkobendj

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\ndibdjnfmopecpmkdieinmbadjfpblof

Key Deleted : HKCU\Software\Classes\iLivid.torrent

Value Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Run [iLivid]

Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI

Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.BrowserWndAPI.1

Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj

Key Deleted : HKLM\SOFTWARE\Classes\AVG SafeGuard toolbar.PugiObj.1

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitguard.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bprotect.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsemngr.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserdefender.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browsermngr.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\browserprotect.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bundlesweetimsetup.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cltmngsvc.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta babylon.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta tb.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\delta2.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltainstaller.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltasetup.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deltatb_2501-c733154b.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iminentsetup.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sweetimsetup.exe

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbdelta.exetoolbar783881609.exe

Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [vProt]

Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin

Key Deleted : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WajamUpdater

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{408CFAD9-8F13-4747-8EC7-770A339C7237}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{07CAC314-E962-4F78-89AB-DD002F2490EE}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}]

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{56561B2A-FB5D-363A-9631-4C03D6054209}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{A717364F-69F3-3A24-ADD5-3901A57F880E}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE07101B-46D4-4A98-AF68-0333EA26E113}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CCB08265-B35D-30B2-A6AF-6986CA957358}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{CD92622E-49B9-33B7-98D1-EC51049457D7}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E041E037-FA4B-364A-B440-7A1051EA0301}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{431532BD-0AE1-4ABC-BE8C-919F3D1332E2}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}

Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31AD400D-1B06-4E33-A59A-90C2C140CBA0}

Value Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{AE07101B-46D4-4A98-AF68-0333EA26E113}]

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}

Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706}

Key Deleted : HKCU\Software\AVG SafeGuard toolbar

Key Deleted : HKLM\Software\AVG SafeGuard toolbar

Key Deleted : HKLM\Software\AVG Security Toolbar

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG SafeGuard toolbar

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16843

-\\ Mozilla Firefox v28.0 (en-US)

[ File : C:\Users\Jami\AppData\Roaming\Mozilla\Firefox\Profiles\at73luqo.default\prefs.js ]

-\\ Google Chrome v33.0.1750.154

[ File : C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage

[ File : C:\Users\Kids\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage

[ File : C:\Users\Linda\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted : homepage

Deleted : search_url

Deleted : keyword

*************************

AdwCleaner[R0].txt - [8684 octets] - [27/03/2014 19:11:16]

AdwCleaner[R1].txt - [8744 octets] - [28/03/2014 12:57:39]

AdwCleaner[s0].txt - [8760 octets] - [28/03/2014 13:00:17]

########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [8820 octets] ##########

najiwench · March 28, 2014

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014

Ran by Jami (administrator) on JAMIPC on 28-03-2014 13:12:55

Running from C:\Users\Jami\Desktop

Windows 8 (X64) OS Language: English(US)

Internet Explorer Version 10

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version:

Download link for 64-Bit Version:

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\system32\atiesrxx.exe

(AMD) C:\Windows\system32\atieclxx.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiWatchDog.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\AMSP_LogServer.exe

(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

() C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Carbonite, Inc. (www.carbonite.com)) C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe

(Fitbit, Inc.) C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe

(Microsoft Corporation) C:\Windows\system32\dashost.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(PasswordBox, Inc.) C:\Program Files (x86)\PasswordBox\pbbtnService.exe

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\AsRoutineController.exe

(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AI Suite II\EPU\EPUHelp.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe

(Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmWrk\uiSeAgnt.exe

(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\ymsgr_tray.exe

(ContentExplorer) C:\Users\Jami\AppData\Roaming\ContentExplorer\ContentExplorer.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe

(AMD) C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe

(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Carbonite, Inc.) C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe

(Raptr, Inc) C:\Program Files (x86)\Raptr\raptr_im.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe

(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqbam08.exe

(Hewlett-Packard) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe

(Raptr Inc.) C:\Program Files (x86)\Raptr\raptr_ep64.exe

() C:\Users\Jami\AppData\Roaming\LVMaintenance\LVMaintenance.exe

(MAGIX AG) C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] - C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [6839952 2012-08-31] (Realtek Semiconductor)

HKLM\...\Run: [Trend Micro Titanium] - C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe [1382568 2013-09-16] (Trend Micro Inc.)

HKLM\...\Run: [etMonitor] - C:\Windows\etMon.exe

HKLM\...\Run: [Trend Micro Client Framework] - C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [216928 2013-08-29] (Trend Micro Inc.)

HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)

HKLM-x32\...\Run: [ASUS Easy Update] - C:\Program Files (x86)\ASUS\ASUS Easy Update\ALU.exe [195200 2012-05-24] (ASUSTeK Computer Inc.)

HKLM-x32\...\Run: [ASUS AiChargerPlus Execute] - C:\Program Files (x86)\InstallShield Installation Information\{E6931688-DA2B-4E16-8539-3D323D69C677}\AiChargerPlus.exe [550272 2012-08-20] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2012-12-12] (ASUSTek Computer Inc.)

HKLM-x32\...\Run: [AMD AVT] - C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [20992 2012-03-19] ()

HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [91432 2012-03-28] (CyberLink Corp.)

HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-06] (Apple Inc.)

HKLM-x32\...\Run: [Fitbit Connect] - C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [3093024 2013-02-25] (Fitbit, Inc.)

HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)

HKLM-x32\...\Run: [Carbonite Backup] - C:\Program Files (x86)\Carbonite\Carbonite Backup\CarboniteUI.exe [1056264 2013-10-10] (Carbonite, Inc.)

HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)

HKLM-x32\...\Run: [] - [X]

HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-02-06] (Apple Inc.)

HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\Run: [steam] - C:\Program Files (x86)\Steam\Steam.exe [1815464 2014-01-07] (Valve Corporation)

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\Run: [EA Core] - "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\Run: [Fitbit Connect] - C:\Program Files (x86)\Fitbit Connect\Fitbit Connect.exe [3093024 2013-02-25] (Fitbit, Inc.)

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\Run: [Messenger (Yahoo!)] - C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\Run: [ContentExplorer] - C:\Users\Jami\AppData\Roaming\ContentExplorer\ContentExplorer.exe [443152 2014-03-03] (ContentExplorer)

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\Run: [LVMaintenance] - C:\Users\Jami\AppData\Roaming\LVMaintenance\LVMaintenance.exe [76560 2014-02-14] ()

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\Run: [Raptr] - C:\Program Files (x86)\Raptr\raptrstub.exe [55360 2014-03-06] (Raptr, Inc)

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\Run: [HydraVisionDesktopManager] - C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe [393216 2012-08-28] (AMD)

HKU\S-1-5-21-1638031616-1474997356-39108045-1002\...\MountPoints2: {ceb3222c-58bf-11e2-be6a-806e6f6e6963} - "E:\Autorun.exe"

IFEO\bpsvc.exe: [Debugger] tasklist.exe

IFEO\browsersafeguard.exe: [Debugger] tasklist.exe

IFEO\dprotectsvc.exe: [Debugger] tasklist.exe

IFEO\protectedsearch.exe: [Debugger] tasklist.exe

IFEO\rjatydimofu.exe: [Debugger] tasklist.exe

IFEO\searchprotection.exe: [Debugger] tasklist.exe

IFEO\searchprotector.exe: [Debugger] tasklist.exe

IFEO\snapdo.exe: [Debugger] tasklist.exe

IFEO\stinst32.exe: [Debugger] tasklist.exe

IFEO\stinst64.exe: [Debugger] tasklist.exe

IFEO\utiljumpflip.exe: [Debugger] tasklist.exe

Startup: C:\Users\Jami\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

Startup: C:\Users\Jami\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk

ShortcutTarget: OpenOffice.org 3.4.1.lnk -> C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.

ProxyServer: http=127.0.0.1:29080;https=127.0.0.1:29080

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.com

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

SearchScopes: HKLM - DefaultScope value is missing.

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS

BHO: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20013\1.0.1221\1.0.1221\TmopIEPlg.dll (Trend Micro Inc.)

BHO: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe64.dll (Trend Micro Inc.)

BHO: PrintEco - {BEB54677-E12F-44E7-AC7E-48241B866B5F} - C:\Program Files (x86)\PrintEco\PrintEco Office\adxloader64.dll ()

BHO-x32: TmIEPlugInBHO Class - {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - C:\Program Files\Trend Micro\AMSP\Module\20013\1.0.1221\1.0.1221\TmopIEPlg32.dll (Trend Micro Inc.)

BHO-x32: TSToolbarBHO - {43C6D902-A1C5-45c9-91F6-FD9E90337E18} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

BHO-x32: PasswordBox Helper - {5DB69B97-934B-451D-94DB-32EF802A01CD} - C:\Program Files (x86)\PasswordBox\Application\pbbtn.dll (PasswordBox, Inc.)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: TmBpIeBHO Class - {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll (Trend Micro Inc.)

BHO-x32: PrintEco - {BEB54677-E12F-44E7-AC7E-48241B866B5F} - C:\Program Files (x86)\PrintEco\PrintEco Office\adxloader.dll ()

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM-x32 - Trend Micro Toolbar - {CCAC5586-44D7-4c43-B64A-F042461A97D2} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe64.dll (Trend Micro Inc.)

Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20013\1.0.1221\1.0.1221\TmopIEPlg.dll (Trend Micro Inc.)

Handler: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - No File

Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - No File

Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\TmBpIe32.dll (Trend Micro Inc.)

Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\Module\20013\1.0.1221\1.0.1221\TmopIEPlg32.dll (Trend Micro Inc.)

Handler-x32: tmtb - {04EAF3FB-4BAC-4B5A-A37D-A1CF210A5A42} - C:\Program Files\Trend Micro\Titanium\UIFramework\ToolbarIE.dll (Trend Micro Inc.)

Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.)

Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

FireFox:

========

FF ProfilePath: C:\Users\Jami\AppData\Roaming\Mozilla\Firefox\Profiles\at73luqo.default

FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()

FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.40.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.40.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @oberon-media.com/ONCAdapter - C:\Program Files (x86)\Common Files\Oberon Media\NCAdapter\1.0.0.14\npapicomadapter.dll (Oberon-Media )

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @TrendMicro.com/FFExtension - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension\components\npToolbarChrome.dll (Trend Micro Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @nsroblox.roblox.com/launcher - C:\Program Files (x86)\Roblox\Versions\version-bd188fd437234e9b\\NPRobloxProxy.dll ( ROBLOX Corporation)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Jami\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF HKLM\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension

FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension [2014-03-07]

FF HKLM-x32\...\Firefox\Extensions: [tmbepff-7.5@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension

FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\firefoxextension [2014-03-07]

FF HKLM-x32\...\Firefox\Extensions: [{22181a4d-af90-4ca3-a569-faed9118d6bc}] - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension

FF Extension: Trend Micro Toolbar - C:\Program Files\Trend Micro\Titanium\UIFramework\Toolbar\firefoxextension [2013-02-24]

FF HKLM-x32\...\Firefox\Extensions: [{21541D23-FDA1-4bf3-8AF2-8F623BF70B07}] - C:\Program Files\Trend Micro\AMSP\module\20013\FxExt\firefoxextension\

FF Extension: Trend Micro Osprey Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20013\FxExt\firefoxextension\ []

FF HKLM-x32\...\Firefox\Extensions: [firefox@printecosoftware.com] - C:\Program Files (x86)\PrintEco\PrintEco Office\firefox@printecosoftware.com.xpi

FF Extension: PrintEco - C:\Program Files (x86)\PrintEco\PrintEco Office\firefox@printecosoftware.com.xpi [2014-03-04]

Chrome:

=======

CHR Extension: (Theme Creator) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\akpelnjfckgfiplcikojhomllgombffc [2013-10-20]

CHR Extension: (Fotor Photo Editor) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbckhhmjfnmedpakkaaflpnmkamdppf [2013-10-20]

CHR Extension: (Games) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\bgeknbdakknlclbcpnigjcijckeddmde [2013-10-20]

CHR Extension: (Gravity Guy) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\bjlgidnccmkehcefagofppjbnhogbjmm [2013-10-20]

CHR Extension: (TrendMicro BEP Extension) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmiabdepfhhiieiipmeecdmeljggmfee [2013-08-07]

CHR Extension: (Classic Games) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpckajjkmjncafjlkielcgheibdlnfgc [2013-11-20]

CHR Extension: (Gun Bros) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\ciamkmigckbgfajcieiflmkedohjjohh [2013-11-20]

CHR Extension: (Where’s My Water?) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\dppkanhlnhknbjopeodjbhgmnjppdijc [2013-10-20]

CHR Extension: (Rush Team) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecdnoeebfjlplfkljdedokbcmebojbpb [2013-11-20]

CHR Extension: (UNO HD) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbiocfeggkcomnebamodmbngedojipdp [2013-10-20]

CHR Extension: (Gangnam Style Game) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdbdhcafljkcahgefanhpdahdnpfkaok [2013-11-20]

CHR Extension: (Star Stable Online) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnlmdkpemkkigkgelegknllpmfclakkk [2013-11-01]

CHR Extension: (Sniper Team) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\hclgbbaloijjnkpigapgmocdpoblnlec [2014-03-05]

CHR Extension: (Marvel Comics) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\hjhfaknohpjconjoefidanhihokmkice [2013-10-20]

CHR Extension: (HD Parking) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\imkdooliglceibodeofbaodappohpdop [2013-10-20]

CHR Extension: (Blocks) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdnglanfhhkanekkdmakmbegnojgpmnm [2013-10-20]

CHR Extension: (Where Is My Water) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgklcgpnkamlodmgnponcegackdgfkhd [2013-10-20]

CHR Extension: (Plants vs Zombies) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmcegpfdgcoclcdfkjahiimlikdpnina [2013-12-30]

CHR Extension: (Need for Speed World) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\mnnelgnkomjdakpkjpkfehdipjifjmbk [2014-03-05]

CHR Extension: (Where’s My Water) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfdakejncginkgjhklbahbangbmohobn [2013-10-20]

CHR Extension: (Google Wallet) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Adblock Pro) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\ocifcklkibdehekfnmflempfgjhbedch [2013-12-11]

CHR Extension: (Canvas Rider) - C:\Users\Jami\AppData\Local\Google\Chrome\User Data\Default\Extensions\poknhlcknimnnbfcombaooklofipaibk [2014-03-05]

CHR HKLM\...\Chrome\Extension: [bmiabdepfhhiieiipmeecdmeljggmfee] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\chrome_tmbep.crx [2013-10-08]

CHR HKLM-x32\...\Chrome\Extension: [bmiabdepfhhiieiipmeecdmeljggmfee] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.5.1137\7.5.1137\chrome_tmbep.crx [2013-10-08]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-12-06] (Advanced Micro Devices, Inc.)

R2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.19\atkexComSvc.exe [920736 2012-06-01] ()

R2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.20\aaHMSvc.exe [951936 2012-06-01] (ASUSTeK Computer Inc.)

R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.13\AsSysCtrlService.exe [149120 2012-08-21] (ASUSTeK Computer Inc.)

R2 Fitbit Connect; C:\Program Files (x86)\Fitbit Connect\FitbitConnectService.exe [1239584 2013-02-25] (Fitbit, Inc.)

R2 HPSLPSVC; C:\Users\Jami\AppData\Local\Temp\7zS4A63\hpslpsvc64.dll [1039360 2013-07-19] (Hewlett-Packard Co.)

R2 PasswordBox; C:\Program Files (x86)\PasswordBox\pbbtnService.exe [67584 2013-11-01] (PasswordBox, Inc.)

S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16048 2013-10-25] (Microsoft Corporation)

R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad [X]

==================== Drivers (Whitelisted) ====================

R3 AiChargerPlus; C:\Windows\SysWow64\drivers\AiChargerPlus.sys [14848 2012-04-19] (ASUSTek Computer Inc.)

R2 AODDriver4.2.0; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [59648 2013-09-19] (Advanced Micro Devices)

R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-24] ()

R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-02] ()

R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [215040 2013-09-24] (Advanced Micro Devices)

R3 AU8168; C:\Windows\system32\DRIVERS\au630x64.sys [792648 2013-09-23] (Realtek )

S3 DCamUSBET; C:\Windows\system32\DRIVERS\etDevice64.sys [527744 2007-07-23] (eMPIA Technology, Inc.)

S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows ® Win 7 DDK provider)

S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows ® Win 7 DDK provider)

S3 FiltUSBET; C:\Windows\system32\DRIVERS\etFilter64.sys [281088 2007-06-14] (eMPIA Technology Inc.)

S3 ScanUSBET; C:\Windows\system32\DRIVERS\etScan64.sys [9216 2007-07-23] (eMPIA Technology, Inc.)

R1 tmactmon; C:\Windows\system32\DRIVERS\tmactmon.sys [109072 2013-09-04] (Trend Micro Inc.)

R0 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [175528 2013-09-04] (Trend Micro Inc.)

R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [46392 2012-08-24] (Trend Micro Inc.)

R3 tmeevw; C:\Windows\system32\DRIVERS\tmeevw.sys [94520 2012-12-07] (Trend Micro Inc.)

S0 tmel; C:\Windows\System32\DRIVERS\tmel.sys [34224 2012-07-26] (Trend Micro Inc.)

R1 tmevtmgr; C:\Windows\system32\DRIVERS\tmevtmgr.sys [77184 2013-09-04] (Trend Micro Inc.)

R3 tmnciesc; C:\Windows\system32\DRIVERS\tmnciesc.sys [210232 2012-07-05] (Trend Micro Inc.)

R2 tmusa; C:\Windows\system32\DRIVERS\tmusa.sys [92456 2012-12-26] (Trend Micro Inc.)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-03-28 13:12 - 2014-03-28 13:12 - 00022754 _____ () C:\Users\Jami\Desktop\FRST.txt

2014-03-28 13:00 - 2014-03-28 13:00 - 00002823 _____ () C:\Users\Jami\Desktop\instructions.txt

2014-03-28 12:59 - 2014-03-28 12:59 - 00007311 _____ () C:\Users\Jami\Desktop\reports.txt

2014-03-28 10:07 - 2014-03-28 10:07 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (19).exe

2014-03-28 10:07 - 2014-03-28 10:07 - 00001322 _____ () C:\Users\Jami\Desktop\ROBLOX Player.lnk

2014-03-28 10:07 - 2014-03-28 10:07 - 00001141 _____ () C:\Users\Jami\Desktop\ROBLOX Studio 2013.lnk

2014-03-28 10:07 - 2014-03-28 10:07 - 00000000 ____D () C:\ProgramData\Roblox

2014-03-28 10:07 - 2014-03-28 10:07 - 00000000 ____D () C:\Program Files (x86)\Roblox

2014-03-28 09:36 - 2014-03-28 09:36 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (18).exe

2014-03-28 09:36 - 2014-03-28 09:36 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (17).exe

2014-03-28 09:35 - 2014-03-28 09:35 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (16).exe

2014-03-28 09:35 - 2014-03-28 09:35 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (15).exe

2014-03-28 09:33 - 2014-03-28 09:33 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (14).exe

2014-03-28 09:30 - 2014-03-28 09:30 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (13).exe

2014-03-27 21:18 - 2014-03-27 21:18 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (12).exe

2014-03-27 19:09 - 2014-03-28 13:01 - 00000000 ____D () C:\AdwCleaner

2014-03-27 19:06 - 2014-03-27 19:06 - 01950720 _____ () C:\Users\Jami\Desktop\AdwCleaner.exe

2014-03-27 19:05 - 2014-03-27 19:05 - 00006393 _____ () C:\Users\Jami\Desktop\JRT.txt

2014-03-27 18:56 - 2014-03-27 18:56 - 01038974 _____ (Thisisu) C:\Users\Jami\Desktop\JRT.exe

2014-03-27 16:04 - 2014-03-27 16:06 - 00008283 _____ () C:\Users\Jami\Desktop\attach.txt

2014-03-27 16:04 - 2014-03-27 16:05 - 00020805 _____ () C:\Users\Jami\Desktop\dds.txt

2014-03-27 16:03 - 2014-03-27 16:03 - 00688992 ____R (Swearware) C:\Users\Jami\Downloads\dds.scr

2014-03-27 15:53 - 2014-03-27 15:54 - 00036665 _____ () C:\Users\Jami\Downloads\Addition.txt

2014-03-27 15:52 - 2014-03-28 13:12 - 00000000 ____D () C:\FRST

2014-03-27 15:52 - 2014-03-27 15:54 - 00055109 _____ () C:\Users\Jami\Downloads\FRST.txt

2014-03-27 15:52 - 2014-03-27 15:52 - 02157056 _____ (Farbar) C:\Users\Jami\Desktop\FRST64.exe

2014-03-27 15:51 - 2014-03-27 15:52 - 01145856 _____ (Farbar) C:\Users\Jami\Downloads\FRST.exe

2014-03-27 15:41 - 2014-03-27 15:41 - 01057016 _____ (Bleeping Computer, LLC) C:\Users\Jami\Downloads\rkill64.exe

2014-03-27 15:41 - 2014-03-27 15:41 - 00001904 _____ () C:\Users\Jami\Desktop\Rkill.txt

2014-03-27 15:40 - 2014-03-27 15:40 - 01933048 _____ (Bleeping Computer, LLC) C:\Users\Jami\Downloads\rkill.exe

2014-03-27 13:02 - 2014-03-27 13:02 - 00000000 ____D () C:\Users\Jami\AppData\Local\Macromedia

2014-03-27 13:01 - 2014-03-27 13:01 - 00001154 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk

2014-03-27 13:01 - 2014-03-27 13:01 - 00000000 ____D () C:\Users\Jami\AppData\Local\Mozilla

2014-03-27 13:00 - 2014-03-27 13:01 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox

2014-03-27 13:00 - 2014-03-27 13:00 - 00282880 _____ (Mozilla) C:\Users\Jami\Downloads\Firefox Setup Stub 28.0.exe

2014-03-26 17:41 - 2014-03-26 17:41 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (11).exe

2014-03-26 17:40 - 2014-03-26 17:40 - 00633712 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (10).exe

2014-03-25 17:00 - 2014-03-25 17:00 - 00591616 ____R () C:\Users\Jami\Money Backup_2014-03-25_170039.mbf

2014-03-25 10:15 - 2014-03-25 10:15 - 00000073 _____ () C:\Users\Jami\Desktop\AFNI.txt

2014-03-25 10:12 - 2014-03-25 10:12 - 00576268 ____R () C:\Users\Jami\Money Backup_2014-03-25_101159.mbf

2014-03-24 11:13 - 2014-03-24 11:13 - 00611054 ____R () C:\Users\Jami\Money Backup_2014-03-24_111319.mbf

2014-03-23 16:02 - 2014-03-23 16:02 - 00000318 _____ () C:\Users\Jami\Desktop\Curse Client.appref-ms

2014-03-23 16:02 - 2014-03-23 16:02 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse

2014-03-23 14:54 - 2014-03-23 14:54 - 00402696 _____ () C:\Users\Jami\Downloads\setup (1).exe

2014-03-23 14:26 - 2014-03-23 14:26 - 00060777 _____ () C:\Windows\SysWOW64\CCCInstall_201403231426475854.log

2014-03-23 14:26 - 2014-03-23 14:26 - 00000000 ____D () C:\ProgramData\ATI

2014-03-23 14:26 - 2014-03-23 14:26 - 00000000 ____D () C:\Program Files\ATI Technologies

2014-03-23 14:25 - 2014-03-23 14:25 - 00000103 _____ () C:\Windows\setupact.log

2014-03-23 14:25 - 2014-03-23 14:25 - 00000000 ____D () C:\Windows\LastGood.Tmp

2014-03-23 14:25 - 2014-03-23 14:25 - 00000000 _____ () C:\Windows\setuperr.log

2014-03-23 14:24 - 2014-03-23 14:24 - 00000000 ____D () C:\ProgramData\Package Cache

2014-03-23 14:21 - 2014-03-23 14:21 - 00000000 ____D () C:\AMD

2014-03-23 14:18 - 2014-03-23 14:18 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved

2014-03-23 14:17 - 2014-03-28 13:04 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\Raptr

2014-03-23 14:17 - 2014-03-23 14:18 - 00000000 ____D () C:\Program Files (x86)\Raptr

2014-03-23 14:17 - 2014-03-23 14:17 - 01007930 _____ () C:\Users\Jami\Downloads\amddriverdownload_installer.exe

2014-03-23 14:17 - 2014-03-23 14:17 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\library_dir

2014-03-22 23:50 - 2014-03-22 23:51 - 40893773 _____ () C:\Users\Jami\Downloads\DefaultDan.zip

2014-03-22 10:46 - 2014-03-22 10:46 - 00633712 _____ (ROBLOX Corporation) C:\Users\Linda\Downloads\RobloxPlayerLauncher (8).exe

2014-03-22 10:45 - 2014-03-22 10:46 - 00633712 _____ (ROBLOX Corporation) C:\Users\Linda\Downloads\RobloxPlayerLauncher (7).exe

2014-03-22 03:19 - 2014-03-22 03:19 - 00633712 _____ (ROBLOX Corporation) C:\Users\Linda\Downloads\RobloxPlayerLauncher (6).exe

2014-03-22 02:41 - 2014-03-22 03:16 - 00000000 ____D () C:\Users\Linda\Documents\kids

2014-03-21 01:42 - 2014-03-21 01:42 - 01070496 _____ (Unity Technologies ApS) C:\Users\Linda\Downloads\UnityWebPlayer (3).exe

2014-03-21 01:42 - 2014-03-21 01:42 - 00000000 ____D () C:\Users\Linda\AppData\Local\Unity

2014-03-21 01:41 - 2014-03-21 01:41 - 01070496 _____ (Unity Technologies ApS) C:\Users\Linda\Downloads\UnityWebPlayer (2).exe

2014-03-20 22:39 - 2014-03-20 22:39 - 00000000 ____D () C:\Users\Kids\AppData\Roaming\HpUpdate

2014-03-20 09:37 - 2014-03-20 09:37 - 00002354 _____ () C:\Users\Jami\Downloads\invite.ics

2014-03-19 04:16 - 2014-03-19 04:16 - 01070496 _____ (Unity Technologies ApS) C:\Users\Linda\Downloads\UnityWebPlayer (1).exe

2014-03-17 17:22 - 2014-03-18 15:00 - 00000000 ____D () C:\Users\Jami\Desktop\Schedules

2014-03-15 06:42 - 2014-03-15 06:43 - 00000000 ____D () C:\Users\Jami\Desktop\serra band boosters

2014-03-15 03:19 - 2014-03-15 03:19 - 01070496 _____ (Unity Technologies ApS) C:\Users\Linda\Downloads\UnityWebPlayer.exe

2014-03-14 17:48 - 2014-03-14 17:48 - 00381488 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-03-11 17:51 - 2014-02-23 01:13 - 02241536 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-03-11 17:51 - 2014-02-23 01:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-03-11 17:51 - 2014-02-23 01:13 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll

2014-03-11 17:51 - 2014-02-23 01:13 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll

2014-03-11 17:51 - 2014-02-23 01:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-03-11 17:51 - 2014-02-23 01:12 - 19273216 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-03-11 17:51 - 2014-02-23 01:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-03-11 17:51 - 2014-02-23 01:12 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-03-11 17:51 - 2014-02-23 01:11 - 15404032 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-03-11 17:51 - 2014-02-23 01:11 - 03960320 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-03-11 17:51 - 2014-02-23 01:11 - 02648576 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-03-11 17:51 - 2014-02-23 01:11 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll

2014-03-11 17:51 - 2014-02-23 01:11 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll

2014-03-11 17:51 - 2014-02-23 01:11 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-03-11 17:51 - 2014-02-23 01:11 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-03-11 17:51 - 2014-02-23 01:11 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-03-11 17:51 - 2014-02-22 23:54 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-03-11 17:51 - 2014-02-22 23:54 - 01140736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-03-11 17:51 - 2014-02-22 23:54 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 14358016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 02877952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 02049024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-03-11 17:51 - 2014-02-22 23:53 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-03-11 17:51 - 2014-02-22 23:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-03-11 17:51 - 2014-02-22 23:31 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-03-11 17:51 - 2014-02-22 21:06 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll

2014-03-11 17:51 - 2014-02-07 21:34 - 04036608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-03-11 17:51 - 2014-02-05 16:41 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-03-11 17:51 - 2014-02-05 16:37 - 00496640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-03-11 17:51 - 2014-01-30 17:48 - 01339392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll

2014-03-11 17:51 - 2014-01-30 17:06 - 01628160 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll

2014-03-11 17:51 - 2013-12-06 23:36 - 19751936 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-03-11 17:51 - 2013-12-06 22:15 - 17560576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll

2014-03-11 17:51 - 2013-10-25 00:34 - 00035856 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdBoot.sys

2014-03-11 17:51 - 2013-10-24 15:34 - 00248240 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdFilter.sys

2014-03-11 07:25 - 2014-03-11 07:25 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\LVMaintenance

2014-03-09 18:41 - 2014-03-09 18:41 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\Pogo Games

2014-03-08 21:07 - 2014-03-08 21:07 - 00402696 _____ () C:\Users\Jami\Downloads\setup.exe

2014-03-08 07:37 - 2014-03-08 07:37 - 00000000 ____D () C:\Users\Jami\Documents\Add-in Express

2014-03-08 07:37 - 2014-03-08 07:37 - 00000000 ____D () C:\Program Files (x86)\PrintEco

2014-03-08 07:36 - 2014-03-08 07:37 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\ContentExplorer

2014-03-08 07:34 - 2014-03-08 07:36 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\FlvtoConverter

2014-03-08 07:34 - 2014-03-08 07:34 - 00000000 ____D () C:\Users\Jami\AppData\Local\FlvtoYoutubeDownloader

2014-03-08 07:33 - 2014-03-12 17:48 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flvto Youtube Downloader

2014-03-08 07:32 - 2014-03-12 17:48 - 00000000 ____D () C:\Users\Jami\AppData\Local\Flvto Youtube Downloader

2014-03-08 07:31 - 2014-03-08 07:31 - 00678032 _____ (Hotger) C:\Users\Jami\Downloads\FYDMystart.exe

2014-03-08 07:31 - 2014-03-08 07:31 - 00622736 _____ (Hotger) C:\Users\Jami\Downloads\FYDLoad.exe

2014-03-07 20:32 - 2014-03-27 15:38 - 00000000 ____D () C:\Users\Jami\Desktop\World of Warcraft

2014-03-07 20:32 - 2014-03-07 20:32 - 00000913 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk

2014-03-06 11:47 - 2014-03-06 11:48 - 00010240 ___SH () C:\Users\Public\Thumbs.db

2014-03-06 11:03 - 2014-03-06 11:03 - 00001079 _____ () C:\Users\Public\Desktop\WD My Cloud.lnk

2014-03-06 11:03 - 2014-03-06 11:03 - 00000000 ____D () C:\Program Files (x86)\Western Digital

2014-03-06 11:02 - 2014-03-06 11:02 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\com.wd.WDMyCloud

2014-03-06 10:57 - 2014-03-06 10:57 - 64458736 _____ () C:\Users\Jami\Downloads\WDMyCloud_win (1).exe

2014-03-06 10:11 - 2014-03-06 10:12 - 83293072 _____ (Blizzard Entertainment) C:\Users\Jami\Downloads\World-of-Warcraft-Setup-enUS.exe

2014-02-27 21:37 - 2014-03-24 21:52 - 00000000 ____D () C:\Users\Jami\Documents\andrea folder

2014-02-27 08:27 - 2014-02-27 08:27 - 00543088 _____ (ROBLOX Corporation) C:\Users\Jami\Downloads\RobloxPlayerLauncher (9).exe

==================== One Month Modified Files and Folders =======

2014-03-28 13:13 - 2014-03-28 13:12 - 00022754 _____ () C:\Users\Jami\Desktop\FRST.txt

2014-03-28 13:12 - 2014-03-27 15:52 - 00000000 ____D () C:\FRST

2014-03-28 13:08 - 2013-02-24 22:28 - 00003594 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1638031616-1474997356-39108045-1002

2014-03-28 13:05 - 2012-07-25 22:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM

2014-03-28 13:04 - 2014-03-23 14:17 - 00000000 ____D () C:\Users\Jami\AppData\Roaming\Raptr

2014-03-28 13:03 - 2013-02-24 22:30 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-03-28 13:03 - 2013-01-07 04:52 - 01759139 _____ () C:\Windows\WindowsUpdate.log

2014-03-28 13:03 - 2012-07-26 00:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-03-28 13:01 - 2014-03-27 19:09 - 00000000 ____D () C:\AdwCleaner

2014-03-28 13:00 - 2014-03-28 13:00 - 00002823 _____ () C:\Users\Jami\Desktop\instructions.txt

2014-03-28 13:00 - 2012-07-26 01:12 - 00000000 ____D () C:\Windows\system32\sru

2014-03-28 12:59 - 2014-03-28 12:59 - 00007311 _____ () C:\Users\Jami\Desktop\reports.txt

2014-03-28 12:48 - 2013-05-29 09:01 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-03-28 12:17 - 2013-02-24 22:30 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-03-28 10:50 - 2012-07-25 22:26 - 00000154 _____ () C:\Windows\win.ini