CostMin Extension

lakeeffect1000 · July 9, 2014

I keep running into problems with CostMin extension becoming un-deleted every time I open Chrome.

Psychotic · July 9, 2014

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
Perform everything in the correct order. Sometimes one step requires the previous one.
If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

Scan with aswMBR

Please download aswMBR ( 4.5MB ) to your desktop.

Double click the aswMBR.exe icon, and click Run.
There will be a short delay before the next dialog box comes up. Please just wait a minute or two.
When asked if you'd like to "download the latest Avast! virus definitions", click Yes.
Typically this is about a 100MB download so depending on your connection speed it can take a short while to download and become ready.
Click the Scan button to start the scan once the update has finished downloading
On completion of the scan, click the save log button, save it to your desktop, then copy and paste it in your next reply.

Note: There will also be a file on your desktop named MBR.dat do not delete this for now. It is an actual backup of the MBR (master boot record).

lakeeffect1000 · July 9, 2014

Run date: 2014-07-09 17:22:37

-----------------------------

17:22:37.541 OS Version: Windows x64 6.1.7601 Service Pack 1

17:22:37.541 Number of processors: 4 586 0x2502

17:22:37.542 ComputerName: JAMES-PC UserName: James

17:22:38.016 Initialize success

17:22:38.043 VM: initialized successfully

17:22:38.046 VM: Intel CPU BiosDisabled

17:22:40.553 VM: supported disk I/O ataport.SYS

17:26:00.957 AVAST engine defs: 14070900

17:31:15.200 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

17:31:15.216 Disk 0 Vendor: OCZ-VERTEX3 2.25 Size: 228936MB BusType: 11

17:31:15.231 Disk 0 MBR read successfully

17:31:15.231 Disk 0 MBR scan

17:31:15.231 Disk 0 Windows 7 default MBR code

17:31:15.231 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

17:31:15.247 Disk 0 default boot code

17:31:15.278 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 228834 MB offset 206848

17:31:15.340 Disk 0 scanning C:\Windows\system32\drivers

17:31:21.783 Service scanning

17:31:38.562 Modules scanning

17:31:38.573 Disk 0 trace - called modules:

17:31:38.581 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys

17:31:38.587 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80049ee060]

17:31:38.592 3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa80048ecb10]

17:31:38.597 5 hpdskflt.sys[fffff88001998189] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80047b41f0]

17:31:39.031 AVAST engine scan C:\Windows

17:31:40.076 AVAST engine scan C:\Windows\system32

17:35:00.119 AVAST engine scan C:\Windows\system32\drivers

17:35:07.949 AVAST engine scan C:\Users\James

17:35:41.736 File: C:\Users\James\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CDLRKCY0\VOPackage[1].exe **INFECTED** Win32:Dropper-gen [Drp]

17:37:51.505 File: C:\Users\James\AppData\Local\Temp\repuh3f3.rox.exe **INFECTED** Win32:Dropper-gen [Drp]

17:38:21.310 AVAST engine scan C:\ProgramData

17:38:50.879 Scan finished successfully

17:41:27.098 Disk 0 MBR has been saved successfully to "C:\Users\James\Desktop\MBR.dat"

17:41:27.135 The log file has been saved successfully to "C:\Users\James\Desktop\aswMBR.txt"

Psychotic · July 11, 2014

Fix with FRST (normal mode)

WARNING: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Download the attached fixlist.txt and save it to the location where FRST is saved to.
Run FRST.exe (on 64bit, run FRST64.exe) and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.

Full System Scan with Malwarebytes Antimalware

If not existing, please download Malwarebytes Anti-Malware to your desktop.
Double-click the downloaded setup file and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
- Launch Malwarebytes Anti-Malware
- A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
Click Finish.

If the program is already installed:

Run Malwarebytes Antimalware
On the Dashboard, click the 'Update Now >>' link
After the update completes, click the 'Scan Now >>' button.
Or, on the Dashboard, click the Scan Now >> button.
If an update is available, click the Update Now button.
A Threat Scan will begin.
When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
In most cases, a restart will be required.
Wait for the prompt to restart the computer to appear, then click on Yes.

After the restart once you are back at your desktop, open MBAM once more.
Click on the History tab > Application Logs.
Double click on the scan log which shows the Date and time of the scan just performed.
Click 'Copy to Clipboard'
Paste the contents of the clipboard into your reply.

fixlist.txt

AdvancedSetup · July 16, 2014

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

AdvancedSetup · July 16, 2014

Topic reopened per user request

lakeeffect1000 · July 18, 2014

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 7/18/2014

Scan Time: 10:46:26 AM

Logfile: malwarebyteslog.txt

Administrator: Yes

Version: 2.00.2.1012

Malware Database: v2014.07.18.06

Rootkit Database: v2014.07.17.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: James

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 372779

Time Elapsed: 6 min, 22 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 0

(No malicious items detected)

Physical Sectors: 0

(No malicious items detected)

(end)

Psychotic · July 19, 2014

Scan with ESET Online Scan

Please go to here to run the online scannner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activex control to install
Click Start
Make sure that the option Remove found threats is unticked
Click on Advanced Settings and ensure these options are ticked:
- Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

[*]Click Scan[*]Wait for the scan to finish[*]If any threats were found, click the 'List of found threats' , then click Export to text file.... [*]Save it to your desktop, then please copy and paste that log as a reply to this topic.

lakeeffect1000 · July 19, 2014

C:\Program Files (x86)\SupTab\SupTab.dll Win32/Thinknice.B potentially unwanted application deleted - quarantined

C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\00\00000000 a variant of Win32/4Shared.U potentially unwanted application deleted - quarantined

C:\Users\James\AppData\Local\Temp\51m1k2rz.slp.exe Win32/AdWare.Linkular.AH application cleaned by deleting - quarantined

Larusso · July 20, 2014

Hy there.

Psychotic is on vacation and asked me to jump in here.

Are there any open issues ?

lakeeffect1000 · July 20, 2014

I just wanted to ensure that based on my last post that everything looks good, to me it seems to.

Larusso · July 21, 2014

Hy again.

Your logs appears to be clean

Let me check fresh FRST Logs to make sure there is nothing left.

Please re-run FRST.
Place a checkmark next to Addition.txt and hit Scan.
Logfiles are created on your desktop.
Post the FRST.txt and the Addition.txt.

lakeeffect1000 · July 22, 2014

Run date: 2014-07-22 12:25:54

-----------------------------

12:25:54.289 OS Version: Windows x64 6.1.7601 Service Pack 1

12:25:54.289 Number of processors: 4 586 0x2502

12:25:54.290 ComputerName: JAMES-PC UserName: James

12:25:54.878 Initialize success

12:25:54.921 VM: initialized successfully

12:25:54.925 VM: Intel CPU BiosDisabled

12:26:00.144 VM: supported disk I/O ataport.SYS

12:44:07.697 AVAST engine defs: 14072200

13:16:01.560 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0

13:16:01.564 Disk 0 Vendor: OCZ-VERTEX3 2.25 Size: 228936MB BusType: 11

13:16:01.578 Disk 0 MBR read successfully

13:16:01.581 Disk 0 MBR scan

13:16:01.621 Disk 0 Windows 7 default MBR code

13:16:01.625 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048

13:16:01.629 Disk 0 default boot code

13:16:01.660 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 228834 MB offset 206848

13:16:01.726 Disk 0 scanning C:\Windows\system32\drivers

13:16:08.154 Service scanning

13:16:23.636 Modules scanning

13:16:23.645 Disk 0 trace - called modules:

13:16:23.652 ntoskrnl.exe CLASSPNP.SYS disk.sys hpdskflt.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys

13:16:23.658 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004a0c060]

13:16:23.663 3 CLASSPNP.SYS[fffff880019aa43f] -> nt!IofCallDriver -> [0xfffffa80048f7b10]

13:16:23.668 5 hpdskflt.sys[fffff88001951189] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80047b41f0]

13:16:24.099 AVAST engine scan C:\Windows

13:16:25.222 AVAST engine scan C:\Windows\system32

13:19:42.950 AVAST engine scan C:\Windows\system32\drivers

13:19:50.347 AVAST engine scan C:\Users\James

13:20:14.757 File: C:\Users\James\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CDLRKCY0\VOPackage[1].exe **INFECTED** Win32:Dropper-gen [Drp]

13:22:10.503 File: C:\Users\James\AppData\Local\Temp\repuh3f3.rox.exe **INFECTED** Win32:Dropper-gen [Drp]

13:22:52.903 AVAST engine scan C:\ProgramData

13:23:01.181 Scan finished successfully

13:46:56.119 Disk 0 MBR has been saved successfully to "C:\Users\James\Desktop\MBR.dat"

13:46:56.159 The log file has been saved successfully to "C:\Users\James\Desktop\aswMBR1.txt"

Larusso · July 22, 2014

You ran aswMBR.exe instead of FRST.exe

Please read my instructions carefully

lakeeffect1000 · July 23, 2014

Sorry.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-07-2014 01

Ran by James (administrator) on JAMES-PC on 23-07-2014 09:17:30

Running from C:\Users\James\Downloads

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe

(AMD) C:\Windows\System32\atiesrxx.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe

(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe

(AMD) C:\Windows\System32\atieclxx.exe

(Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\sqlservr.exe

(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Hewlett-Packard ) C:\Program Files\Hewlett-Packard\HPToneControl\HPToneCtl.exe

(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe

(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

(Microsoft Corporation) C:\Program Files\Microsoft Team Foundation Server 12.0\Application Tier\TFSJobAgent\TFSJobAgent.exe

(Validity Sensors, Inc.) C:\Windows\System32\valWBFPolicyService.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(AVAST Software) C:\Users\James\Downloads\aswmbr.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1271072 2014-03-11] (Microsoft Corporation)

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated)

HKLM\...\Run: [CnxtCoInstallerDefer] => C:\Program Files\CONEXANT\PREINSTALL\SETUP539CAFB11\KESLYN.EXE [1574528 2010-12-15] (Conexant Systems, Inc.)

HKLM\...\Run: [sysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-07-22] (IDT, Inc.)

HKLM\...\Run: [HPToneControl] => C:\Program Files\Hewlett-Packard\HPToneControl\HPTonectl.exe [107832 2009-08-19] (Hewlett-Packard )

HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch

HKLM-x32\...\Run: [startCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-09-09] (Advanced Micro Devices, Inc.)

HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2014-05-08] (Adobe Systems Incorporated)

Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)

HKU\.DEFAULT\...\RunOnce: [sPReview] => C:\Windows\System32\SPReview\SPReview.exe [301568 2014-06-14] (Microsoft Corporation)

HKU\S-1-5-19\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-19-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-20\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-20-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-82-1036420768-1044797643-1061213386-2937092688-4282445334-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)

GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1BF874133F88CF01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US

HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.asp.net/mvc/tutorials/mvc-5/introduction/creating-a-connection-string

https://mail.google.com/mail/u/0/#inbox

http://msdn.microsoft.com/en-us/data/jj206878.aspx

http://connect.microsoft.com/VisualStudio/feedback/details/809897/cannot-add-data-connections-in-vs2013-express-for-windows

http://www.bing.com/search?q=is+localdb+native+to+visual+studio+express+2013&qs=n&form=QBRE&pq=is+localdb+native+to+visual+studio+express+2013&sc=0-18&sp=-1&sk=&cvid=5a2caef2ec3f4cf0bf163af507698e1a

http://stackoverflow.com/questions/20980626/how-to-create-a-localdb-on-visual-studio-2013-that-doesnt-require-sql-server-in

http://www.visualstudio.com/downloads/download-visual-studio-vs#d-team-foundation-server-express

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank

BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)

Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:

========

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @Skype Technologies S.A..com/Skype Web Plugin - C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin64.dll (Skype)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @Skype Technologies S.A..com/Skype Web Plugin - C:\Program Files (x86)\SkypeWebPlugin\npSkypeWebPlugin.dll (Skype)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll No File

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

Chrome:

=======

CHR Extension: (Google Drive) - C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-06-14]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-14]

CHR Extension: (YouTube) - C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-06-14]

CHR Extension: (Google Search) - C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-06-14]

CHR Extension: (Google Wallet) - C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-06-14]

CHR Extension: (Gmail) - C:\Users\James\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-06-14]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2014-03-11] (Microsoft Corporation)

R2 MSSQL$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\sqlservr.exe [194240 2014-05-15] (Microsoft Corporation)

R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [347872 2014-03-11] (Microsoft Corporation)

S4 SQLAgent$SQLEXPRESS; c:\Program Files\Microsoft SQL Server\MSSQL11.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [613056 2014-05-15] (Microsoft Corporation)

R2 TFSJobAgent; C:\Program Files\Microsoft Team Foundation Server 12.0\Application Tier\TfsJobAgent\TfsJobAgent.exe [51376 2014-03-23] (Microsoft Corporation)

R2 valWBFPolicyService; C:\Windows\system32\valWBFPolicyService.exe [35328 2013-10-12] (Validity Sensors, Inc.)

S3 VsEtwService120; C:\Program Files (x86)\Microsoft Visual Studio 12.0\Common7\Packages\Debugger\Services\VsEtwService.exe [87736 2014-04-30] (Microsoft Corporation)

R2 W3SVC; C:\Windows\system32\inetsrv\iisw3adm.dll [453120 2010-11-20] (Microsoft Corporation)

S3 WMSVC; C:\Windows\system32\inetsrv\wmsvc.exe [10752 2009-07-13] (Microsoft Corporation)

S2 gupdate; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svc [X]

S3 gupdatem; "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvc [X]

==================== Drivers (Whitelisted) ====================

S3 iscFlash; c:\SwSetup\SP55299\iscflashx64.sys [45632 2010-10-15] (Insyde Software)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-22] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)

R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [268512 2014-01-25] (Microsoft Corporation)

R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133928 2014-03-11] (Microsoft Corporation)

S4 RsFx0201; C:\Windows\System32\DRIVERS\RsFx0201.sys [337088 2014-05-15] (Microsoft Corporation)

U3 aswMBR; \??\C:\Users\James\AppData\Local\Temp\aswMBR.sys [X]

U3 aswVmm; \??\C:\Users\James\AppData\Local\Temp\aswVmm.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-07-23 09:17 - 2014-07-23 09:17 - 00000000 ____D () C:\Users\James\Downloads\FRST-OlderVersion

2014-07-22 13:46 - 2014-07-22 13:46 - 00002408 _____ () C:\Users\James\Desktop\aswMBR1.txt

2014-07-19 19:53 - 2014-07-19 19:53 - 00000414 _____ () C:\Users\James\Downloads\eset.txt

2014-07-19 18:28 - 2014-07-19 18:28 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-07-19 18:26 - 2014-07-19 18:27 - 02347384 _____ (ESET) C:\Users\James\Downloads\esetsmartinstaller_enu.exe

2014-07-16 07:21 - 2014-07-16 07:21 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-16 07:21 - 2014-07-16 07:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-16 07:21 - 2014-07-16 07:21 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-07-16 07:21 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2014-07-16 07:21 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2014-07-16 07:20 - 2014-07-16 07:21 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\James\Downloads\mbam-setup-2.0.2.1012.exe

2014-07-16 07:08 - 2014-07-16 07:08 - 00001349 _____ () C:\Users\James\Downloads\fixlist.txt

2014-07-09 17:41 - 2014-07-22 13:46 - 00000512 _____ () C:\Users\James\Desktop\MBR.dat

2014-07-09 17:41 - 2014-07-09 17:41 - 00002407 _____ () C:\Users\James\Desktop\aswMBR.txt

2014-07-09 17:22 - 2014-07-09 17:22 - 05185536 _____ (AVAST Software) C:\Users\James\Downloads\aswmbr.exe

2014-07-09 09:58 - 2014-07-09 09:58 - 00000000 ____D () C:\ProgramData\Hewlett-Packard

2014-07-09 09:39 - 2014-07-22 13:04 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-09 09:39 - 2014-07-16 07:21 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-07-09 09:39 - 2014-07-09 09:46 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-07-09 09:38 - 2014-07-16 07:45 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-09 09:38 - 2014-07-09 09:46 - 00000000 ____D () C:\Users\James\Desktop\mbar

2014-07-09 09:38 - 2014-07-09 09:38 - 14349744 _____ (Malwarebytes Corp.) C:\Users\James\Downloads\mbar-1.07.0.1012.exe

2014-07-09 09:38 - 2014-07-09 09:38 - 00204496 _____ (Malwarebytes) C:\Users\James\Downloads\startuplite-setup-1.07.exe

2014-07-09 09:32 - 2014-07-09 09:32 - 00076588 _____ () C:\Users\James\Downloads\Addition (1).txt

2014-07-09 09:23 - 2014-07-23 09:17 - 00012476 _____ () C:\Users\James\Downloads\FRST.txt

2014-07-09 09:23 - 2014-07-09 09:24 - 00076588 _____ () C:\Users\James\Downloads\Addition.txt

2014-07-09 09:22 - 2014-07-23 09:17 - 02091520 _____ (Farbar) C:\Users\James\Downloads\FRST64.exe

2014-07-09 09:22 - 2014-07-23 09:17 - 00000000 ____D () C:\FRST

2014-07-09 09:13 - 2014-07-09 09:13 - 00065232 _____ (Malwarebytes) C:\Users\James\Downloads\regassassin-setup-1.03.exe

2014-07-08 14:46 - 2014-06-29 22:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll

2014-07-08 14:46 - 2014-06-29 22:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll

2014-07-08 14:46 - 2014-06-20 16:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll

2014-07-08 14:46 - 2014-06-20 15:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll

2014-07-08 14:46 - 2014-06-18 21:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll

2014-07-08 14:46 - 2014-06-18 21:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb

2014-07-08 14:46 - 2014-06-18 21:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll

2014-07-08 14:46 - 2014-06-18 20:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll

2014-07-08 14:46 - 2014-06-18 20:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll

2014-07-08 14:46 - 2014-06-18 20:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll

2014-07-08 14:46 - 2014-06-18 20:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll

2014-07-08 14:46 - 2014-06-18 20:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll

2014-07-08 14:46 - 2014-06-18 20:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll

2014-07-08 14:46 - 2014-06-18 20:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll

2014-07-08 14:46 - 2014-06-18 20:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll

2014-07-08 14:46 - 2014-06-18 20:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe

2014-07-08 14:46 - 2014-06-18 20:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe

2014-07-08 14:46 - 2014-06-18 20:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll

2014-07-08 14:46 - 2014-06-18 20:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll

2014-07-08 14:46 - 2014-06-18 20:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe

2014-07-08 14:46 - 2014-06-18 20:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll

2014-07-08 14:46 - 2014-06-18 19:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll

2014-07-08 14:46 - 2014-06-18 19:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb

2014-07-08 14:46 - 2014-06-18 19:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll

2014-07-08 14:46 - 2014-06-18 19:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll

2014-07-08 14:46 - 2014-06-18 19:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll

2014-07-08 14:46 - 2014-06-18 19:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll

2014-07-08 14:46 - 2014-06-18 19:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe

2014-07-08 14:46 - 2014-06-18 19:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll

2014-07-08 14:46 - 2014-06-18 19:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll

2014-07-08 14:46 - 2014-06-18 19:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll

2014-07-08 14:46 - 2014-06-18 19:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll

2014-07-08 14:46 - 2014-06-18 19:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll

2014-07-08 14:46 - 2014-06-18 19:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll

2014-07-08 14:46 - 2014-06-18 19:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll

2014-07-08 14:46 - 2014-06-18 19:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll

2014-07-08 14:46 - 2014-06-18 19:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl

2014-07-08 14:46 - 2014-06-18 19:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll

2014-07-08 14:46 - 2014-06-18 19:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll

2014-07-08 14:46 - 2014-06-18 19:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe

2014-07-08 14:46 - 2014-06-18 19:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll

2014-07-08 14:46 - 2014-06-18 19:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll

2014-07-08 14:46 - 2014-06-18 19:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-08 14:46 - 2014-06-18 19:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll

2014-07-08 14:46 - 2014-06-18 18:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll

2014-07-08 14:46 - 2014-06-18 18:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll

2014-07-08 14:46 - 2014-06-18 18:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll

2014-07-08 14:46 - 2014-06-18 18:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll

2014-07-08 14:46 - 2014-06-18 18:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll

2014-07-08 14:46 - 2014-06-18 18:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll

2014-07-08 14:46 - 2014-06-18 18:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll

2014-07-08 14:46 - 2014-06-18 18:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl

2014-07-08 14:46 - 2014-06-18 18:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll

2014-07-08 14:46 - 2014-06-18 18:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll

2014-07-08 14:46 - 2014-06-18 18:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll

2014-07-08 14:46 - 2014-06-18 18:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll

2014-07-08 14:46 - 2014-06-18 18:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll

2014-07-08 14:46 - 2014-06-18 18:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll

2014-07-08 14:46 - 2014-06-17 22:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe

2014-07-08 14:46 - 2014-06-17 21:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe

2014-07-08 14:46 - 2014-06-17 21:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys

2014-07-08 14:46 - 2014-06-06 06:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll

2014-07-08 14:46 - 2014-06-06 05:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll

2014-07-08 14:46 - 2014-05-30 04:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll

2014-07-08 14:46 - 2014-05-30 04:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll

2014-07-08 14:46 - 2014-05-30 04:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll

2014-07-08 14:46 - 2014-05-30 04:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll

2014-07-08 14:46 - 2014-05-30 04:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll

2014-07-08 14:46 - 2014-05-30 04:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll

2014-07-08 14:46 - 2014-05-30 04:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll

2014-07-08 14:46 - 2014-05-30 03:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll

2014-07-08 14:46 - 2014-05-30 03:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll

2014-07-08 14:46 - 2014-05-30 03:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll

2014-07-08 14:46 - 2014-05-30 03:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll

2014-07-08 14:46 - 2014-05-30 03:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll

2014-07-08 14:46 - 2014-05-30 03:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll

2014-07-08 14:46 - 2014-05-30 03:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll

2014-07-08 14:46 - 2014-05-30 02:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys

2014-07-08 14:45 - 2014-06-05 10:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll

2014-07-08 14:45 - 2014-06-05 10:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll

2014-07-08 14:45 - 2014-06-05 10:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll

2014-07-07 01:07 - 2014-07-07 01:07 - 00000000 ____D () C:\Program Files (x86)\predm

2014-07-07 01:04 - 2014-07-19 19:47 - 00000000 ____D () C:\Program Files (x86)\SupTab

2014-07-07 01:04 - 2014-07-07 01:09 - 00000258 __RSH () C:\ProgramData\ntuser.pol

2014-07-07 01:04 - 2014-07-07 01:06 - 00000000 ____D () C:\ProgramData\d76b26a3592eb7d3

2014-07-07 01:04 - 2014-07-07 01:04 - 00003360 _____ () C:\Windows\System32\Tasks\EnergoTech Update

2014-07-07 01:04 - 2014-07-07 01:04 - 00000000 ____D () C:\Users\James\AppData\Local\Torch

2014-07-07 01:04 - 2014-07-07 01:04 - 00000000 ____D () C:\Users\James\AppData\Local\Packages

2014-07-07 01:04 - 2014-07-07 01:04 - 00000000 ____D () C:\Users\James\AppData\Local\Comodo

2014-07-07 01:04 - 2014-07-07 01:04 - 00000000 ____D () C:\Users\James\AppData\Local\Chromatic Browser

2014-07-07 01:04 - 2014-07-07 01:04 - 00000000 ____D () C:\Users\Guest

2014-07-07 01:04 - 2014-07-07 01:04 - 00000000 ____D () C:\Users\Administrator

2014-07-07 01:04 - 2014-07-07 01:04 - 00000000 ____D () C:\ProgramData\EnergoTech

2014-07-03 14:34 - 2014-07-03 14:34 - 00000000 ____H () C:\Windows\system32\Drivers\Msft_User_WpdFs_01_09_00.Wdf

2014-06-30 23:03 - 2014-05-15 14:59 - 00096448 _____ (Microsoft Corporation) C:\Windows\system32\perf-MSSQL$SQLEXPRESS-sqlctr11.2.5058.0.dll

2014-06-30 23:03 - 2014-05-15 14:58 - 00083136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\perf-MSSQL$SQLEXPRESS-sqlctr11.2.5058.0.dll

2014-06-23 23:09 - 2012-02-11 12:43 - 00253016 _____ (Microsoft Corporation) C:\Windows\system32\SQSRVRES.DLL

2014-06-23 21:50 - 2014-06-23 21:50 - 00000000 ____D () C:\Users\James\AppData\Local\Adobe_Systems_Incorporate

2014-06-23 21:49 - 2014-07-07 01:30 - 00000000 ____D () C:\Users\James\Documents\My Digital Editions

2014-06-23 21:49 - 2014-06-23 21:49 - 00002188 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Digital Editions 3.0.lnk

2014-06-23 21:49 - 2014-06-23 21:49 - 00002176 _____ () C:\Users\Public\Desktop\Adobe Digital Editions 3.0.lnk

2014-06-23 21:49 - 2014-06-23 21:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe

2014-06-23 21:48 - 2014-06-23 21:48 - 00001782 _____ () C:\Users\James\Downloads\ProgrammingC50BuildingWindows08Weband9781449359683.acsm

==================== One Month Modified Files and Folders =======

2014-07-23 09:17 - 2014-07-23 09:17 - 00000000 ____D () C:\Users\James\Downloads\FRST-OlderVersion

2014-07-23 09:17 - 2014-07-09 09:23 - 00012476 _____ () C:\Users\James\Downloads\FRST.txt

2014-07-23 09:17 - 2014-07-09 09:22 - 02091520 _____ (Farbar) C:\Users\James\Downloads\FRST64.exe

2014-07-23 09:17 - 2014-07-09 09:22 - 00000000 ____D () C:\FRST

2014-07-23 09:16 - 2014-06-15 23:55 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2014-07-23 09:16 - 2014-06-14 16:22 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-23 09:16 - 2014-06-14 16:22 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-22 13:46 - 2014-07-22 13:46 - 00002408 _____ () C:\Users\James\Desktop\aswMBR1.txt

2014-07-22 13:46 - 2014-07-09 17:41 - 00000512 _____ () C:\Users\James\Desktop\MBR.dat

2014-07-22 13:04 - 2014-07-09 09:39 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-22 12:28 - 2009-07-14 00:45 - 00014464 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-22 12:28 - 2009-07-14 00:45 - 00014464 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-22 12:26 - 2009-07-14 01:13 - 00986544 _____ () C:\Windows\system32\PerfStringBackup.INI

2014-07-22 12:24 - 2014-06-14 17:53 - 01065473 _____ () C:\Windows\WindowsUpdate.log

2014-07-22 12:21 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2014-07-22 12:21 - 2009-07-14 00:51 - 00030651 _____ () C:\Windows\setupact.log

2014-07-19 19:53 - 2014-07-19 19:53 - 00000414 _____ () C:\Users\James\Downloads\eset.txt

2014-07-19 19:47 - 2014-07-07 01:04 - 00000000 ____D () C:\Program Files (x86)\SupTab

2014-07-19 18:28 - 2014-07-19 18:28 - 00000000 ____D () C:\Program Files (x86)\ESET

2014-07-19 18:27 - 2014-07-19 18:26 - 02347384 _____ (ESET) C:\Users\James\Downloads\esetsmartinstaller_enu.exe

2014-07-18 10:45 - 2014-06-14 21:50 - 00127414 _____ () C:\Windows\PFRO.log

2014-07-16 07:45 - 2014-07-09 09:38 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2014-07-16 07:21 - 2014-07-16 07:21 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2014-07-16 07:21 - 2014-07-16 07:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2014-07-16 07:21 - 2014-07-16 07:21 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-07-16 07:21 - 2014-07-16 07:20 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\James\Downloads\mbam-setup-2.0.2.1012.exe

2014-07-16 07:21 - 2014-07-09 09:39 - 00000000 ____D () C:\ProgramData\Malwarebytes

2014-07-16 07:08 - 2014-07-16 07:08 - 00001349 _____ () C:\Users\James\Downloads\fixlist.txt

2014-07-10 12:03 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache

2014-07-09 17:41 - 2014-07-09 17:41 - 00002407 _____ () C:\Users\James\Desktop\aswMBR.txt

2014-07-09 17:22 - 2014-07-09 17:22 - 05185536 _____ (AVAST Software) C:\Users\James\Downloads\aswmbr.exe

2014-07-09 09:58 - 2014-07-09 09:58 - 00000000 ____D () C:\ProgramData\Hewlett-Packard

2014-07-09 09:58 - 2009-07-13 23:20 - 00000000 __RHD () C:\Users\Public\Libraries

2014-07-09 09:46 - 2014-07-09 09:39 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)

2014-07-09 09:46 - 2014-07-09 09:38 - 00000000 ____D () C:\Users\James\Desktop\mbar

2014-07-09 09:38 - 2014-07-09 09:38 - 14349744 _____ (Malwarebytes Corp.) C:\Users\James\Downloads\mbar-1.07.0.1012.exe

2014-07-09 09:38 - 2014-07-09 09:38 - 00204496 _____ (Malwarebytes) C:\Users\James\Downloads\startuplite-setup-1.07.exe

2014-07-09 09:32 - 2014-07-09 09:32 - 00076588 _____ () C:\Users\James\Downloads\Addition (1).txt

2014-07-09 09:24 - 2014-07-09 09:23 - 00076588 _____ () C:\Users\James\Downloads\Addition.txt

2014-07-09 09:13 - 2014-07-09 09:13 - 00065232 _____ (Malwarebytes) C:\Users\James\Downloads\regassassin-setup-1.03.exe

2014-07-09 09:03 - 2009-07-14 00:45 - 00275712 _____ () C:\Windows\system32\FNTCACHE.DAT

2014-07-09 09:02 - 2014-06-14 23:02 - 00000000 ___SD () C:\Windows\system32\CompatTel

2014-07-09 09:02 - 2009-07-14 03:45 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-09 09:02 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism

2014-07-09 09:02 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\system32\Dism

2014-07-09 08:59 - 2014-06-14 17:05 - 00000000 ____D () C:\Windows\system32\MRT

2014-07-09 08:58 - 2014-06-14 17:05 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2014-07-08 16:40 - 2014-06-15 23:55 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe

2014-07-08 16:40 - 2014-06-15 23:55 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl

2014-07-08 16:40 - 2014-06-15 23:55 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater

2014-07-07 01:30 - 2014-06-23 21:49 - 00000000 ____D () C:\Users\James\Documents\My Digital Editions

2014-07-07 01:09 - 2014-07-07 01:04 - 00000258 __RSH () C:\ProgramData\ntuser.pol

2014-07-07 01:07 - 2014-07-07 01:07 - 00000000 ____D () C:\Program Files (x86)\predm

2014-07-07 01:06 - 2014-07-07 01:04 - 00000000 ____D () C:\ProgramData\d76b26a3592eb7d3