UPDATEFLASHPLAYER_.exe virus

Spaz1 · June 6, 2014

Hello,

So I opened one of these UPDATEFLASHPLAYER .EXE files saying I had a court date coming up. I probably tried to unzip the file 4 times in total, and now my computer is a mess. I can not even use my computer unless in safe mode, hence I am using my IPad to post this message. Please help.

Spaz1 · June 8, 2014

Please help

kevinf80 · June 8, 2014

Hello and

P2P/Piracy Warning:

If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.
Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.
If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy.

Download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system (32 bit or 64 bit). If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

Kevin...

Spaz1 · June 8, 2014

here is the FRST.txt log

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:06-06-2014

Ran by McBride (administrator) on MCBRIDE-PC on 08-06-2014 13:21:15

Running from C:\Users\McBride\Downloads

Platform: Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English(US)

Internet Explorer Version 9

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Agere Systems) C:\Windows\System32\agrsmsvc.exe

(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(TOSHIBA) C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe

(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe

(Intuit) C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(TOSHIBA Corporation) C:\Windows\System32\TODDSrv.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe

(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TEco.exe

(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe

(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe

(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe

(TOSHIBA Corporation) C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe

(Sun Microsystems, Inc.) C:\Program Files\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe

(Google Inc.) C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

(Microsoft Corporation) C:\Windows\ehome\ehtray.exe

() C:\Users\McBride\AppData\Local\vuvuqpdj.exe

(Global Trade) C:\Users\McBride\AppData\Roaming\Ivytcuib\goipe.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe

(Intuit Inc.) C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

(Dropbox, Inc.) C:\Users\McBride\AppData\Roaming\Dropbox\bin\Dropbox.exe

(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Microsoft Corporation) C:\Windows\ehome\ehsched.exe

(TOSHIBA CORPORATION) C:\Program Files\TOSHIBA\ConfigFree\CFSwMgr.exe

(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe

(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Google Inc.) C:\Users\McBride\AppData\Local\Google\Chrome\Application\chrome.exe

(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

(Google Inc.) C:\Users\McBride\AppData\Local\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Users\McBride\AppData\Roaming\Ydmyuv\koixgu.exe

(Microsoft Corporation) C:\Windows\System32\cmd.exe

(Microsoft Corporation) C:\Windows\ehome\mcupdate.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\McUICnt.exe

(McAfee, Inc.) C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe

(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] => [X]

HKLM\...\Run: [startCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [61440 2009-04-22] (Advanced Micro Devices, Inc.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6965792 2009-03-12] (Realtek Semiconductor)

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1451304 2009-03-18] (Synaptics Incorporated)

HKLM\...\Run: [TPwrMain] => C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [468320 2009-03-06] (TOSHIBA Corporation)

HKLM\...\Run: [HSON] => C:\Program Files\TOSHIBA\TBS\HSON.exe [55160 2009-03-09] (TOSHIBA Corporation)

HKLM\...\Run: [smoothView] => C:\Program Files\Toshiba\SmoothView\SmoothView.exe [448376 2008-12-18] (TOSHIBA Corporation)

HKLM\...\Run: [00TCrdMain] => C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [729088 2009-03-23] (TOSHIBA Corporation)

HKLM\...\Run: [TWebCamera] => C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe [2513472 2009-04-16] (TOSHIBA)

HKLM\...\Run: [Teco] => C:\Program Files\TOSHIBA\TECO\Teco.exe [1318912 2009-04-14] (TOSHIBA Corporation)

HKLM\...\Run: [NDSTray.exe] => C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe [299008 2009-05-13] (TOSHIBA CORPORATION)

HKLM\...\Run: [cfFncEnabler.exe] => C:\Program Files\TOSHIBA\ConfigFree\cfFncEnabler.exe [16384 2009-03-24] (Toshiba Corporation)

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)

HKLM\...\Run: [TosSENotify] => C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe [1007616 2009-03-24] (TOSHIBA Corporation)

HKLM\...\Run: [hpqSRMon] => C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150016 2008-08-20] (Hewlett-Packard)

HKLM\...\Run: [HP Software Update] => C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [54840 2007-05-08] (Hewlett-Packard)

HKLM\...\Run: [TPCHWMsg] => C:\Program Files\TOSHIBA\TPHM\TPCHWMsg.exe [570736 2009-04-09] (TOSHIBA Corporation)

HKLM\...\Run: [ToshibaServiceStation] => C:\Program Files\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe [1283384 2009-04-01] (TOSHIBA Corporation)

HKLM\...\Run: [QuickTime Task] => C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)

HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)

HKLM\...\Run: [sunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)

HKLM\...\Run: [skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-12] (Realtek Semiconductor Corp.)

HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [152392 2014-02-21] (Apple Inc.)

HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [swg] => C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2009-06-15] (Google Inc.)

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [135680 2008-07-03] (Microsoft Corporation)

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [Google Update] => C:\Users\McBride\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2010-07-28] (Google Inc.)

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [abkvowdb] => C:\Users\McBride\AppData\Local\vuvuqpdj.exe [161792 2014-06-02] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [cjctaxli] => C:\Users\McBride\AppData\Local\uruxvwwx.exe [208896 2014-06-02] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [dhqxtfta] => C:\Users\McBride\AppData\Local\xlksvnnb.exe [208896 2014-06-02] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [Pupeynfur] => C:\Users\McBride\AppData\Roaming\Ivytcuib\goipe.exe [324608 2013-06-15] (Global Trade)

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [tnfmfkbp] => C:\Users\McBride\AppData\Local\qcbksdiq.exe [212992 2014-06-02] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [dlaliccx] => C:\Users\McBride\AppData\Local\drohihjp.exe [212992 2014-06-02] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [beuvdecp] => C:\Users\McBride\AppData\Local\qhcpvoki.exe [212992 2014-06-02] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [sulegbps] => C:\Users\McBride\AppData\Local\jfbcgkuj.exe [212992 2014-06-02] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [sjvrjhgb] => C:\Users\McBride\AppData\Local\veciwsxq.exe [155648 2014-06-06] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [udkngdbm] => C:\Users\McBride\AppData\Local\xduxouwe.exe [151552 2014-06-08] ()

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\Run: [Peryoxoku] => C:\Users\McBride\AppData\Roaming\Ydmyuv\koixgu.exe [280679 2013-09-18] (Microsoft Corporation)

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\MountPoints2: F - F:\LaunchU3.exe -a

HKU\S-1-5-21-3871051671-912311258-1205727755-1000\...\MountPoints2: {15c958cc-9a5e-11df-997e-001e33ca16b8} - F:\LaunchU3.exe -a

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk

ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\3.8.130\SSScheduler.exe (McAfee, Inc.)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Office.lnk

ShortcutTarget: Microsoft Office.lnk -> C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk

ShortcutTarget: QuickBooks Update Agent.lnk -> C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)

Startup: C:\Users\McBride\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk

ShortcutTarget: Dropbox.lnk -> C:\Users\McBride\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=TSHB&bmod=TSHB

URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

SearchScopes: HKLM - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSHB

SearchScopes: HKLM - {1D1DF1E0-FB07-4748-9923-6CAC92E5A9D3} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSHB

SearchScopes: HKLM - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSHB

SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSHB_en___US349

SearchScopes: HKCU - {1D1DF1E0-FB07-4748-9923-6CAC92E5A9D3} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSHB

SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7TSHB_en___US349

BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

BHO: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files\McAfee Security Scan\3.8.130\McAfeeMSS_IE.dll (McAfee, Inc.)

BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7725.1624\swg.dll (Google Inc.)

BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)

BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (Yahoo! Inc.)

Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL (Microsoft Corporation)

Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)

Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\system32\mscoree.dll (Microsoft Corporation)

Winsock: Catalog5 05 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 71.242.0.12

FireFox:

========

FF ProfilePath: C:\Users\McBride\AppData\Roaming\Mozilla\Firefox\Profiles\yg0n17j0.default

FF Homepage: Google.com

FF NetworkProxy: "http", "127.0.0.1"

FF NetworkProxy: "http_port", 5643

FF NetworkProxy: "no_proxies_on", "localhost,127.0.0.1"

FF NetworkProxy: "type", 0

FF Plugin: @Apple.com/iTunes,version=1.0 - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @google.com/npPicasa2,version=2.0.0 - C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)

FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=10.7.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.7.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @mcafee.com/McAfeeMssPlugin - C:\Program Files\McAfee Security Scan\3.8.130\npMcAfeeMss.dll (McAfee, Inc.)

FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\McBride\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\McBride\AppData\Local\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\McBride\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)

FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll (Apple Inc.)

FF Extension: Microsoft .NET Framework Assistant - C:\Users\McBride\AppData\Roaming\Mozilla\Firefox\Profiles\yg0n17j0.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi [2012-07-07]

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []

FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009-10-09]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2

FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009-10-09]

Chrome:

=======

CHR HomePage: hxxp://www.google.com/

CHR StartupUrls: "hxxp://www.google.com/"

CHR Plugin: (Remoting Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Users\McBride\AppData\Local\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Users\McBride\AppData\Local\Google\Chrome\Application\35.0.1916.114\pdf.dll ()

CHR Plugin: (Shockwave Flash) - C:\Users\McBride\AppData\Local\Google\Chrome\Application\35.0.1916.114\gcswf32.dll No File

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Java Deployment Toolkit 6.0.290.11) - C:\Program Files\Java\jre6\bin\new_plugin\npdeployJava1.dll (Sun Microsystems, Inc.)

CHR Plugin: (Java Platform SE 6 U29) - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll (Apple Inc.)

CHR Plugin: (Picasa) - C:\Program Files\Picasa2\npPicasa2.dll (Google, Inc.)

CHR Plugin: (Picasa) - C:\Program Files\Picasa2\npPicasa3.dll (Google, Inc.)

CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Google Update) - C:\Users\McBride\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File

CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\McBride\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]

CHR Extension: (Autodesk Homestyler) - C:\Users\McBride\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdmmkfaghgcicheaimnpffeeekheafkb [2011-09-05]

CHR Extension: (Google Wallet) - C:\Users\McBride\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-20]

CHR StartMenuInternet: Google Chrome - C:\Users\McBride\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 camsvc; C:\Program Files\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe [20544 2009-04-16] (TOSHIBA)

R2 ConfigFree Service; C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe [46448 2009-03-10] (TOSHIBA CORPORATION)

S3 GameConsoleService; C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe [238328 2009-11-13] (WildTangent, Inc.)

R3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.130\McCHSvc.exe [235216 2013-09-06] (McAfee, Inc.)

R2 RSELSVC; C:\Program Files\TOSHIBA\RSelect\RSelSvc.exe [57344 2009-02-19] (TOSHIBA Corporation)

R2 TMachInfo; C:\Program Files\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [62776 2009-04-01] (TOSHIBA Corporation)

R2 TOSHIBA eco Utility Service; C:\Program Files\TOSHIBA\TECO\TecoService.exe [176128 2009-04-14] (TOSHIBA Corporation)

R2 TOSHIBA HDD SSD Alert Service; C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [73728 2009-03-17] (TOSHIBA Corporation)

R2 TPCHSrv; C:\Program Files\TOSHIBA\TPHM\TPCHSrv.exe [656752 2009-04-09] (TOSHIBA Corporation)

==================== Drivers (Whitelisted) ====================

R3 PGEffect; C:\Windows\System32\DRIVERS\pgeffect.sys [22272 2009-03-18] (TOSHIBA Corporation)

R3 rtl819xp; C:\Windows\System32\DRIVERS\rtl819xp.sys [500224 2009-03-09] (Realtek Semiconductor Corporation )

R1 RtlProt; C:\Windows\System32\DRIVERS\rtlprot.sys [25896 2007-04-23] (Windows ® Codename Longhorn DDK provider)

R2 TVALZFL; C:\Windows\System32\DRIVERS\TVALZFL.sys [12920 2009-03-20] (TOSHIBA Corporation)

S3 IpInIp; system32\DRIVERS\ipinip.sys [X]

S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]

S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-06-08 13:21 - 2014-06-08 13:27 - 00024895 _____ () C:\Users\McBride\Downloads\FRST.txt

2014-06-08 13:20 - 2014-06-08 13:22 - 00000000 ____D () C:\FRST

2014-06-08 13:18 - 2014-06-08 13:18 - 01063424 _____ (Farbar) C:\Users\McBride\Downloads\FRST.exe

2014-06-08 13:16 - 2014-06-08 13:17 - 02072576 _____ (Farbar) C:\Users\McBride\Downloads\FRST64.exe

2014-06-08 13:16 - 2014-06-08 13:16 - 00000810 _____ () C:\Windows\Tasks\Security Center Update - 687410095.job

2014-06-08 13:16 - 2014-06-08 13:16 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Ydmyuv

2014-06-08 13:15 - 2014-06-08 13:15 - 00151552 _____ () C:\Users\McBride\AppData\Local\xduxouwe.exe

2014-06-06 10:29 - 2014-06-06 10:29 - 00155648 _____ () C:\Users\McBride\AppData\Local\veciwsxq.exe

2014-06-06 10:28 - 2014-06-06 10:28 - 00113168 _____ () C:\Users\McBride\AppData\Local\pbekucqs.exe

2014-06-03 01:47 - 2014-06-03 02:00 - 00000808 _____ () C:\Windows\Tasks\Security Center Update - 219287187.job

2014-06-03 01:47 - 2014-06-03 01:47 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Nogoew

2014-06-03 00:26 - 2014-06-03 00:33 - 00002326 _____ () C:\Users\McBride\Desktop\Rkill.txt

2014-06-03 00:25 - 2014-06-03 00:25 - 01940216 _____ (Bleeping Computer, LLC) C:\Users\McBride\Downloads\rkill.exe

2014-06-03 00:13 - 2014-06-03 00:13 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Ocbopae

2014-06-02 22:28 - 2014-06-02 22:28 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Howomoos

2014-06-02 22:11 - 2014-06-02 22:11 - 00000917 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-02 21:49 - 2014-06-02 21:49 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Nuylub

2014-06-02 20:23 - 2014-06-02 20:23 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Mexemye

2014-06-02 18:13 - 2014-06-02 18:13 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Horeep

2014-06-02 17:57 - 2014-06-02 17:57 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Tyiscuha

2014-06-02 17:33 - 2014-06-02 17:33 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Apxoazot

2014-06-02 17:32 - 2014-06-02 17:32 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Qapuqa

2014-06-02 17:32 - 2014-06-02 17:32 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Orymom

2014-06-02 17:05 - 2014-06-02 17:05 - 00212992 _____ () C:\Users\McBride\AppData\Local\jfbcgkuj.exe

2014-06-02 16:00 - 2014-06-02 16:00 - 00212992 _____ () C:\Users\McBride\AppData\Local\qhcpvoki.exe

2014-06-02 15:40 - 2014-06-02 15:40 - 00212992 _____ () C:\Users\McBride\AppData\Local\drohihjp.exe

2014-06-02 15:23 - 2014-06-02 15:23 - 00212992 _____ () C:\Users\McBride\AppData\Local\qcbksdiq.exe

2014-06-02 14:43 - 2014-06-02 14:43 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Viduapta

2014-06-02 14:31 - 2014-06-02 14:31 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Ubulycoc

2014-06-02 14:10 - 2014-06-02 14:10 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Iwgisi

2014-06-02 13:54 - 2014-06-02 13:54 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Gelyizoh

2014-06-02 12:52 - 2014-06-02 12:52 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Eqhiqui

2014-06-02 12:46 - 2014-06-02 12:46 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Pyripux

2014-06-02 12:37 - 2014-06-02 12:37 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Ivytcuib

2014-06-02 11:50 - 2014-06-02 11:50 - 00068782 _____ () C:\Users\McBride\AppData\Local\mdwbroxh

2014-06-02 11:49 - 2014-06-02 11:49 - 00208896 _____ () C:\Users\McBride\AppData\Local\xlksvnnb.exe

2014-06-02 11:43 - 2014-06-02 11:43 - 00208896 _____ () C:\Users\McBride\AppData\Local\uruxvwwx.exe

2014-06-02 11:27 - 2014-06-02 11:27 - 00088520 _____ () C:\Users\McBride\Downloads\ID_Court_Notice_DN7429 (1).zip

2014-06-02 11:26 - 2014-06-02 11:26 - 00161792 _____ () C:\Users\McBride\AppData\Local\vuvuqpdj.exe

2014-05-15 07:13 - 2014-05-05 19:32 - 12347392 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-05-15 07:13 - 2014-05-05 19:14 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-05-15 07:13 - 2014-05-05 19:14 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-05-14 07:15 - 2014-03-25 09:26 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll

2014-05-09 15:53 - 2014-05-09 15:53 - 00000000 ____D () C:\Program Files\Mozilla Firefox

==================== One Month Modified Files and Folders =======

2014-06-08 13:31 - 2009-10-04 19:49 - 00000000 ____D () C:\Users\McBride\AppData\Local\Temp

2014-06-08 13:27 - 2014-06-08 13:21 - 00024895 _____ () C:\Users\McBride\Downloads\FRST.txt

2014-06-08 13:27 - 2009-06-15 22:03 - 01442443 _____ () C:\Windows\WindowsUpdate.log

2014-06-08 13:22 - 2014-06-08 13:20 - 00000000 ____D () C:\FRST

2014-06-08 13:18 - 2014-06-08 13:18 - 01063424 _____ (Farbar) C:\Users\McBride\Downloads\FRST.exe

2014-06-08 13:17 - 2014-06-08 13:16 - 02072576 _____ (Farbar) C:\Users\McBride\Downloads\FRST64.exe

2014-06-08 13:16 - 2014-06-08 13:16 - 00000810 _____ () C:\Windows\Tasks\Security Center Update - 687410095.job

2014-06-08 13:16 - 2014-06-08 13:16 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Ydmyuv

2014-06-08 13:15 - 2014-06-08 13:15 - 00151552 _____ () C:\Users\McBride\AppData\Local\xduxouwe.exe

2014-06-08 13:10 - 2013-12-27 01:54 - 00000000 ___RD () C:\Users\McBride\Desktop\Dropbox

2014-06-08 13:10 - 2012-10-29 09:37 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Dropbox

2014-06-08 13:09 - 2014-05-06 23:52 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\DropboxMaster

2014-06-08 13:07 - 2006-11-02 09:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-06-08 13:07 - 2006-11-02 08:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

2014-06-08 13:07 - 2006-11-02 08:47 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

2014-06-06 10:45 - 2010-07-28 12:00 - 00001356 _____ () C:\Users\McBride\AppData\Local\d3d9caps.dat

2014-06-06 10:45 - 2010-01-02 22:58 - 00327680 ____R () C:\Users\McBride\Hedgerow Homeowners Association.QBW.TLG

2014-06-06 10:45 - 2009-10-31 13:24 - 107114496 ____R () C:\Users\McBride\Hedgerow Homeowners Association.QBW

2014-06-06 10:45 - 2009-10-04 19:49 - 00000000 ____D () C:\Users\McBride

2014-06-06 10:29 - 2014-06-06 10:29 - 00155648 _____ () C:\Users\McBride\AppData\Local\veciwsxq.exe

2014-06-06 10:28 - 2014-06-06 10:28 - 00113168 _____ () C:\Users\McBride\AppData\Local\pbekucqs.exe

2014-06-06 10:27 - 2006-11-02 08:37 - 00000000 ___RD () C:\Users\Public\Recorded TV

2014-06-03 02:05 - 2006-11-02 09:01 - 00032628 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

2014-06-03 02:00 - 2014-06-03 01:47 - 00000808 _____ () C:\Windows\Tasks\Security Center Update - 219287187.job

2014-06-03 01:51 - 2010-07-28 13:59 - 00000916 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3871051671-912311258-1205727755-1000UA.job

2014-06-03 01:47 - 2014-06-03 01:47 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Nogoew

2014-06-03 01:18 - 2008-01-20 22:47 - 00284506 _____ () C:\Windows\PFRO.log

2014-06-03 00:33 - 2014-06-03 00:26 - 00002326 _____ () C:\Users\McBride\Desktop\Rkill.txt

2014-06-03 00:25 - 2014-06-03 00:25 - 01940216 _____ (Bleeping Computer, LLC) C:\Users\McBride\Downloads\rkill.exe

2014-06-03 00:13 - 2014-06-03 00:13 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Ocbopae

2014-06-03 00:10 - 2010-08-05 17:02 - 00087608 _____ () C:\Users\McBride\AppData\Roaming\inst.exe

2014-06-03 00:10 - 2010-08-05 17:02 - 00047360 _____ (VSO Software) C:\Users\McBride\AppData\Roaming\pcouffin.sys

2014-06-03 00:10 - 2010-08-05 17:02 - 00007887 _____ () C:\Users\McBride\AppData\Roaming\pcouffin.cat

2014-06-03 00:10 - 2010-08-05 17:02 - 00000033 _____ () C:\Users\McBride\AppData\Roaming\pcouffin.log

2014-06-03 00:10 - 2010-08-05 17:02 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Vso

2014-06-02 22:28 - 2014-06-02 22:28 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Howomoos

2014-06-02 22:11 - 2014-06-02 22:11 - 00000917 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-06-02 22:11 - 2010-07-28 11:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware

2014-06-02 22:11 - 2010-07-28 11:49 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware

2014-06-02 21:49 - 2014-06-02 21:49 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Nuylub

2014-06-02 21:23 - 2012-09-23 15:33 - 00002593 _____ () C:\Users\McBride\Desktop\Gingerbread.lnk

2014-06-02 21:16 - 2012-07-22 18:58 - 00002595 _____ () C:\Users\McBride\Desktop\Bunbun.lnk

2014-06-02 20:23 - 2014-06-02 20:23 - 00000000 ____D () C:\Users\McBride\AppData\Roaming\Mexemye

2014-06-02 18:21 - 2009-10-31 13:58 - 00000354 _____ () C:\Users\McBride\Hedgerow Homeowners Association.QBW.ND

2014-06-02 18:14 - 2006-11-02 06:33 - 00759542 _____ () C:\Windows\system32\PerfStringBackup.INI