Help ran MB found threats

Stonemommy4 · July 10, 2014

Hi,

been having some issues lately, cleaning here and their and can't seem to keep from being attacked, so this time Im reaching out and asking for help please.

here is my report just done a few moments ago and this is after ccleaner has been ran prior to.

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 7/10/2014

Scan Time: 5:41:58 PM

Logfile: 71014-mglog.txt

Administrator: Yes

Version: 2.00.2.1012

Malware Database: v2014.07.10.07

Rootkit Database: v2014.07.09.01

License: Free

Malware Protection: Disabled

Malicious Website Protection: Disabled

Self-protection: Disabled

OS: Windows 7 Service Pack 1

CPU: x64

File System: NTFS

User: Robin

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 297053

Time Elapsed: 22 min, 8 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Enabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 1

PUP.Optional.Datamngr.A, C:\Users\Robin\AppData\LocalLow\DataMngr, Quarantined, [3c433766d8a39b9b58c812919b67ab55],

Files: 2

PUP.Optional.Datamngr.A, C:\Users\Robin\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}, Quarantined, [3c433766d8a39b9b58c812919b67ab55],

PUP.Optional.Datamngr.A, C:\Users\Robin\AppData\LocalLow\DataMngr\{7CA1F051-A4FB-4143-B263-02B41E571EED}64, Quarantined, [3c433766d8a39b9b58c812919b67ab55],

Physical Sectors: 0

(No malicious items detected)

(end)

Stonemommy4 · July 10, 2014

OK started reading and see you need this frst info too so ran and here you go

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2014 01

Ran by Robin (administrator) on ROBIN-PC on 10-07-2014 19:06:22

Running from C:\Users\Robin\Downloads

Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)

Internet Explorer Version 11

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\System32\wlanext.exe

(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe

(Broadcom Corporation.) C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe

(Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe

() C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe

(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe

(Lexmark International, Inc.) C:\Windows\System32\spool\drivers\x64\3\lxdiserv.exe

( ) C:\Windows\System32\lxdicoms.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.4.0.13\n360.exe

(NTI Corporation) C:\Program Files (x86)\NTI\NTI Backup Now EZ\BackupNowEZSvr.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Zone\Engine\2.0.97.14\nz.exe

() C:\Windows\SysWOW64\PSIService.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe

(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler64.exe

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE

(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe

(Symantec Corporation) C:\Program Files (x86)\Norton Zone\Engine\2.0.97.14\nz.exe

(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.4.0.13\n360.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe

(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

(Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe

(Lenovo (Beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe

(Lenovo(beijing) Limited) C:\Program Files (x86)\Lenovo\Energy Management\utility.exe

(Intel Corporation) C:\Windows\System32\igfxtray.exe

(Intel Corporation) C:\Windows\System32\hkcmd.exe

(Intel Corporation) C:\Windows\System32\igfxpers.exe

(Microsoft Corporation) C:\Windows\System32\StikyNot.exe

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe

(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe

(CyberLink) C:\Program Files (x86)\Lenovo\YouCam\YCMMirage.exe

(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe

(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe

(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe

(Siber Systems) C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe

(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE

(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe

(Microsoft Corporation) C:\Windows\System32\SnippingTool.exe

(Microsoft Corporation) C:\Windows\System32\wisptis.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe

(Siber Systems Inc.) C:\Program Files (x86)\Siber Systems\AI RoboForm\Chrome\rf-chrome-nm-host.exe

(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

(Microsoft Corporation) C:\Windows\System32\prevhost.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2538280 2010-12-22] (Synaptics Incorporated)

HKLM\...\Run: [intelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-07-27] (Intel® Corporation)

HKLM\...\Run: [Lenovo EE Boot Optimizer] => C:\Program Files (x86)\Lenovo\Boot Optimizer\PopWnd.exe [114688 2012-03-09] (Lenovo)

HKLM\...\Run: [updatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)

HKLM\...\Run: [Energy Management] => C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe [9769888 2012-03-09] (Lenovo (Beijing) Limited)

HKLM\...\Run: [EnergyUtility] => C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe [5908928 2012-03-09] (Lenovo(beijing) Limited)

HKLM-x32\...\Run: [updateP2GShortCut] => C:\Program Files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe [222504 2010-07-26] (CyberLink Corp.)

HKLM-x32\...\Run: [updatePRCShortCut] => C:\Program Files\Lenovo\OneKey App\OneKey Recovery\MUITransfer\MUIStartMenu.exe [222504 2009-05-13] (CyberLink Corp.)

HKLM-x32\...\Run: [] => [X]

HKLM-x32\...\Run: [Malwarebytes Anti-Exploit] => C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae.exe [382608 2014-06-04] (Malwarebytes Corporation)

Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)

HKU\S-1-5-21-448268370-1532745791-1850709367-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)

HKU\S-1-5-21-448268370-1532745791-1850709367-1000\...\MountPoints2: {4e2e5bfc-ee3a-11e1-bbf4-7ce9d3c724ef} - E:\SISetup.exe

HKU\S-1-5-21-448268370-1532745791-1850709367-1000\...\MountPoints2: {b2721c3b-acb8-11e1-a509-7ce9d3c724ef} - G:\LaunchU3.exe -a

HKU\S-1-5-21-448268370-1532745791-1850709367-1000\...\MountPoints2: {bd7ee60e-a679-11e2-a79f-7ce9d3c724ef} - H:\LaunchU3.exe -a

AppInit_DLLs-x32: C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll => "C:\PROGRA~2\SEARCH~1\Datamngr\datamngr.dll" File Not Found

ShellIconOverlayIdentifiers: 1NZOverlayExcluded -> {32427327-aea5-4bef-811a-b1bd00daf4b4} => C:\Program Files (x86)\Norton Zone\Engine64\2.0.97.14\NZOvrlay.dll (Symantec Corporation)

ShellIconOverlayIdentifiers: 1NZOverlayPending -> {2cfec48b-08ec-4361-8575-7c0da17ab7a5} => C:\Program Files (x86)\Norton Zone\Engine64\2.0.97.14\NZOvrlay.dll (Symantec Corporation)

ShellIconOverlayIdentifiers: 1NZOverlaySynced -> {a9e700bc-92b0-403e-96b3-b87b06ff9d3a} => C:\Program Files (x86)\Norton Zone\Engine64\2.0.97.14\NZOvrlay.dll (Symantec Corporation)

ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.4.0.13\buShell.dll (Symantec Corporation)

ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.4.0.13\buShell.dll (Symantec Corporation)

ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.4.0.13\buShell.dll (Symantec Corporation)

ShellIconOverlayIdentifiers: VeriFace Enc -> {771C7324-DA80-49D3-8017-753B0AF60951} => C:\windows\system32\IcnOvrly.dll ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xC7E9397218F9CE01

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.roboform.com/

HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/

HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.lenovo.com/

SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKCU - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =

SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2102} URL = http://dts.search-results.com/sr?src=ieb&appid=0&systemid=102&sr=0&q={searchTerms}

SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=NIS&chn=retail&geo=US&ver=21&locale=en_US&gct=kwd&qsrc=2869

BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine64\21.4.0.13\coIEPlg.dll (Symantec Corporation)

BHO: RoboForm Toolbar Helper - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll (Siber Systems Inc.)

BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)

BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360\Engine\21.4.0.13\coIEPlg.dll (Symantec Corporation)

BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360\Engine\21.4.0.13\IPS\IPSBHO.DLL (Symantec Corporation)

BHO-x32: RoboForm Toolbar Helper - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)

BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)

BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)

BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)

Toolbar: HKLM - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll (Siber Systems Inc.)

Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.4.0.13\coIEPlg.dll (Symantec Corporation)

Toolbar: HKLM-x32 - &RoboForm Toolbar - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll (Siber Systems Inc.)

Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.4.0.13\coIEPlg.dll (Symantec Corporation)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

Toolbar: HKCU - &RoboForm Toolbar - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Siber Systems\AI RoboForm\RoboForm-x64.dll (Siber Systems Inc.)

Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.4.0.13\coIEPlg.dll (Symantec Corporation)

DPF: HKLM-x32 {0D221D00-A6ED-477C-8A91-41F3B660A832} http://www.bc3.beltone.com/ReportServer/Reserved.ReportViewerWebControl.axd?ExecutionID=5tgiq445wiysgdye0j21ej55&ControlID=40c7f30fc4904dc7a1bbf978de7068ff&Culture=1033&UICulture=9&ReportStack=1&OpType=PrintCab

DPF: HKLM-x32 {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com//activex/ractrl.cab?lmi=1007

Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:

========

FF Plugin: @microsoft.com/GENUINE - disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin-x32: @microsoft.com/GENUINE - disabled No File

FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)

FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2012-06-03]

FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.2.0.38\IPSFF

FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.2.0.38\IPSFF [2014-04-29]

FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.2.0.38\coFFPlgn

FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.2.0.38\coFFPlgn [2014-07-10]

FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:

=======

CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll No File

CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin7.dll No File

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)

CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll No File

CHR Plugin: (Java Platform SE 7 U13) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()

CHR Plugin: (Java Deployment Toolkit 7.0.130.20) - C:\windows\SysWOW64\npDeployJava1.dll No File

CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-06-11]

CHR Extension: (Yulia Brodskaya) - C:\Users\Robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jlgdloilieclkegafohackmhffbmdpko [2014-06-28]

CHR Extension: (Norton Identity Protection) - C:\Users\Robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2012-07-25]

CHR Extension: (Google Wallet) - C:\Users\Robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (RoboForm) - C:\Users\Robin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnlccmojcmeohlpggmfnbbiapkmbliob [2014-03-15]

CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.4.0.13\Exts\Chrome.crx [2014-07-08]

CHR HKLM-x32\...\Chrome\Extension: [pnlccmojcmeohlpggmfnbbiapkmbliob] - C:\Program Files (x86)\Siber Systems\AI RoboForm\Chrome\rf-chrome.crx [2014-03-15]

==================== Services (Whitelisted) =================

R2 btwdins; C:\Program Files\Lenovo\Bluetooth Software\btwdins.exe [956192 2011-02-15] (Broadcom Corporation.)

S3 CorelCreatorMessages; C:\windows\system32\CorelCreatorMessages.exe [105984 2012-04-25] (Global Graphics Software Ltd) [File not signed]

R2 GsServer; C:\Program Files\Siber Systems\GoodSync\Gs-Server.exe [8117904 2014-02-14] ()

R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [248832 2009-05-21] (Hewlett-Packard Co.) [File not signed]

R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [133120 2009-05-21] (Hewlett-Packard Co.) [File not signed]

R2 HPSLPSVC; C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL [1039360 2010-10-22] (Hewlett-Packard Co.) [File not signed]

R2 lxdi_device; C:\windows\system32\lxdicoms.exe [876976 2007-04-26] ( )

R2 lxdi_device; C:\windows\SysWOW64\lxdicoms.exe [517040 2007-04-26] ( )

R2 MbaeSvc; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae-svc.exe [360592 2014-06-04] (Malwarebytes Corporation)

S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-27] ()

R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.4.0.13\N360.exe [265040 2014-06-27] (Symantec Corporation)

S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]

R2 NTI BackupNowEZSvr; C:\Program Files (x86)\NTI\NTI Backup Now EZ\BackupNowEZSvr.exe [46224 2012-12-26] (NTI Corporation)

R2 NZ; C:\Program Files (x86)\Norton Zone\Engine\2.0.97.14\NZ.exe [521504 2014-06-19] (Symantec Corporation)

S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]

U2 ProtexisLicensing; C:\windows\SysWOW64\PSIService.exe [177704 2007-06-05] ()

==================== Drivers (Whitelisted) ====================

R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.2.0.38\Definitions\BASHDefs\20140703.001\BHDrvx64.sys [1530160 2014-05-10] (Symantec Corporation)

R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1504000.00D\ccSetx64.sys [162392 2014-02-24] (Symantec Corporation)

R1 ccSet_NZ; C:\Windows\system32\drivers\NZx64\0200610.00E\ccSetx64.sys [162392 2013-09-25] (Symantec Corporation)

R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)

R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)

R1 ESProtectionDriver; C:\Program Files (x86)\Malwarebytes Anti-Exploit\mbae64.sys [62392 2014-06-04] ()

R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.2.0.38\Definitions\IPSDefs\20140709.001\IDSvia64.sys [525016 2014-05-22] (Symantec Corporation)

R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-10] (Malwarebytes Corporation)

S3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2011-04-27] (Marvell Semiconductor, Inc.)

R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.2.0.38\Definitions\VirusDefs\20140710.001\ENG64.SYS [126040 2014-07-09] (Symantec Corporation)

R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.2.0.38\Definitions\VirusDefs\20140710.001\EX64.SYS [2099288 2014-07-09] (Symantec Corporation)

R3 S6000KNT; C:\Windows\System32\Drivers\S6000KNT.sys [3293272 2010-12-23] (Windows ® Win 7 DDK provider)

R0 SMR410; C:\Windows\System32\drivers\SMR410.SYS [96856 2014-07-10] (Symantec Corporation)

R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1504000.00D\SRTSP64.SYS [875736 2014-02-12] (Symantec Corporation)

R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1504000.00D\SRTSPX64.SYS [36952 2013-10-30] (Symantec Corporation)

R0 SymDS; C:\Windows\System32\drivers\N360x64\1504000.00D\SYMDS64.SYS [493656 2013-10-30] (Symantec Corporation)

R0 SymEFA; C:\Windows\System32\drivers\N360x64\1504000.00D\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)

R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-04-29] (Symantec Corporation)

R1 SymIRON; C:\Windows\system32\drivers\N360x64\1504000.00D\Ironx64.SYS [264280 2013-10-30] (Symantec Corporation)

R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1504000.00D\SYMNETS.SYS [593112 2014-02-17] (Symantec Corporation)

U2 CLKMSVC10_3A60B698;

U2 CLKMSVC10_C3B3B687;

U2 DriverService;

U2 IAStorDataMgrSvc;

U2 idealife Update Service;

U3 IGRS;

U2 IviRegMgr;

U2 nvUpdatusService;

U2 Oasis2Service;

U2 PCCarerServic;

U2 ReadyComm.DirectRouter;

U2 RichVideo;

U2 RtLedService;

U2 SoftwareService;

U2 Stereo Service;

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-07-10 19:06 - 2014-07-10 19:06 - 00024767 _____ () C:\Users\Robin\Downloads\FRST.txt

2014-07-10 19:05 - 2014-07-10 19:06 - 00000000 ____D () C:\FRST

2014-07-10 19:04 - 2014-07-10 19:04 - 02084864 _____ (Farbar) C:\Users\Robin\Downloads\FRST64.exe

2014-07-10 17:35 - 2014-07-10 17:35 - 00379920 _____ () C:\Users\Robin\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-10 12:17 - 2014-07-10 12:44 - 00000000 ____D () C:\NPE

2014-07-10 12:15 - 2014-07-10 12:15 - 00096856 _____ (Symantec Corporation) C:\windows\system32\Drivers\SMR410.SYS

2014-07-10 01:56 - 2014-07-10 01:56 - 00302011 _____ () C:\Users\Robin\Downloads\WindowsUpdateDiagnostic.diagcab

2014-07-09 03:33 - 2014-07-09 03:33 - 00000000 ____D () C:\windows\System32\Tasks\Norton 360

2014-07-08 23:10 - 2014-06-29 22:09 - 00519168 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2014-07-08 23:10 - 2014-06-29 22:04 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2014-07-08 23:10 - 2014-06-17 22:18 - 00692736 _____ (Microsoft Corporation) C:\windows\system32\osk.exe

2014-07-08 23:10 - 2014-06-17 21:51 - 00646144 _____ (Microsoft Corporation) C:\windows\SysWOW64\osk.exe

2014-07-08 23:10 - 2014-06-17 21:10 - 03157504 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2014-07-08 23:10 - 2014-06-06 06:10 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll

2014-07-08 23:10 - 2014-06-06 05:44 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll

2014-07-08 23:10 - 2014-05-30 04:08 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll

2014-07-08 23:10 - 2014-05-30 04:08 - 00340992 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll

2014-07-08 23:10 - 2014-05-30 04:08 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll

2014-07-08 23:10 - 2014-05-30 04:08 - 00307200 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll

2014-07-08 23:10 - 2014-05-30 04:08 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll

2014-07-08 23:10 - 2014-05-30 04:08 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll

2014-07-08 23:10 - 2014-05-30 04:08 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll

2014-07-08 23:10 - 2014-05-30 03:52 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll

2014-07-08 23:10 - 2014-05-30 03:52 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll

2014-07-08 23:10 - 2014-05-30 03:52 - 00247808 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll

2014-07-08 23:10 - 2014-05-30 03:52 - 00220160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll

2014-07-08 23:10 - 2014-05-30 03:52 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll

2014-07-08 23:10 - 2014-05-30 03:52 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll

2014-07-08 23:10 - 2014-05-30 03:52 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll

2014-07-08 23:10 - 2014-05-30 02:45 - 00497152 _____ (Microsoft Corporation) C:\windows\system32\Drivers\afd.sys

2014-07-08 23:09 - 2014-06-20 16:14 - 00266424 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2014-07-08 23:09 - 2014-06-20 15:39 - 00240824 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2014-07-08 23:09 - 2014-06-18 21:39 - 23464448 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-07-08 23:09 - 2014-06-18 21:06 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-07-08 23:09 - 2014-06-18 21:06 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2014-07-08 23:09 - 2014-06-18 20:48 - 02768384 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-07-08 23:09 - 2014-06-18 20:42 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2014-07-08 23:09 - 2014-06-18 20:42 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-07-08 23:09 - 2014-06-18 20:41 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2014-07-08 23:09 - 2014-06-18 20:41 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2014-07-08 23:09 - 2014-06-18 20:32 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-07-08 23:09 - 2014-06-18 20:31 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-07-08 23:09 - 2014-06-18 20:26 - 00598016 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-07-08 23:09 - 2014-06-18 20:24 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2014-07-08 23:09 - 2014-06-18 20:24 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2014-07-08 23:09 - 2014-06-18 20:23 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2014-07-08 23:09 - 2014-06-18 20:16 - 17276416 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2014-07-08 23:09 - 2014-06-18 20:14 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2014-07-08 23:09 - 2014-06-18 20:09 - 00452608 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-07-08 23:09 - 2014-06-18 19:59 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2014-07-08 23:09 - 2014-06-18 19:56 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2014-07-08 23:09 - 2014-06-18 19:53 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-07-08 23:09 - 2014-06-18 19:51 - 05721088 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-07-08 23:09 - 2014-06-18 19:50 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-07-08 23:09 - 2014-06-18 19:48 - 00292864 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-07-08 23:09 - 2014-06-18 19:39 - 00608768 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-07-08 23:09 - 2014-06-18 19:38 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2014-07-08 23:09 - 2014-06-18 19:37 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2014-07-08 23:09 - 2014-06-18 19:36 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2014-07-08 23:09 - 2014-06-18 19:35 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2014-07-08 23:09 - 2014-06-18 19:33 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-07-08 23:09 - 2014-06-18 19:32 - 02179072 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2014-07-08 23:09 - 2014-06-18 19:28 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2014-07-08 23:09 - 2014-06-18 19:28 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2014-07-08 23:09 - 2014-06-18 19:27 - 02040832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-07-08 23:09 - 2014-06-18 19:27 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2014-07-08 23:09 - 2014-06-18 19:25 - 00442368 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2014-07-08 23:09 - 2014-06-18 19:23 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2014-07-08 23:09 - 2014-06-18 19:22 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2014-07-08 23:09 - 2014-06-18 19:12 - 00367616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2014-07-08 23:09 - 2014-06-18 19:06 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-07-08 23:09 - 2014-06-18 19:01 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2014-07-08 23:09 - 2014-06-18 18:59 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2014-07-08 23:09 - 2014-06-18 18:58 - 02266112 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-07-08 23:09 - 2014-06-18 18:58 - 00239616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2014-07-08 23:09 - 2014-06-18 18:52 - 04254720 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2014-07-08 23:09 - 2014-06-18 18:51 - 13527040 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-07-08 23:09 - 2014-06-18 18:49 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2014-07-08 23:09 - 2014-06-18 18:46 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2014-07-08 23:09 - 2014-06-18 18:45 - 01964544 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2014-07-08 23:09 - 2014-06-18 18:35 - 11742208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2014-07-08 23:09 - 2014-06-18 18:34 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-07-08 23:09 - 2014-06-18 18:15 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2014-07-08 23:09 - 2014-06-18 18:13 - 01791488 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2014-07-08 23:09 - 2014-06-18 18:09 - 01139200 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2014-07-08 23:09 - 2014-06-18 18:07 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2014-07-08 23:08 - 2014-06-05 10:45 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll

2014-07-08 23:08 - 2014-06-05 10:26 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll

2014-07-08 23:08 - 2014-06-05 10:25 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll

2014-07-05 23:28 - 2014-07-05 23:28 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-07-05 23:28 - 2014-07-05 23:28 - 00000822 _____ () C:\ProgramData\Desktop\CCleaner.lnk

2014-07-05 23:24 - 2014-07-05 23:25 - 04812672 _____ (Piriform Ltd) C:\Users\Robin\Downloads\ccsetup415.exe

2014-06-29 08:16 - 2014-06-29 08:16 - 00252623 _____ () C:\Users\Robin\Documents\qbreport629-50793.xps

2014-06-28 20:02 - 2014-06-28 20:02 - 01765104 _____ () C:\ProgramData\SPLEBF.tmp

2014-06-25 11:46 - 2014-06-25 11:47 - 16656408 _____ (Siber Systems) C:\Users\Robin\Downloads\RoboForm-Setup-cnetc.exe

2014-06-23 13:52 - 2014-06-23 13:52 - 00000000 ____D () C:\Users\Robin\Documents\Receipt Alien Skin Software_files

2014-06-23 13:48 - 2014-06-23 13:48 - 00000000 ____D () C:\Users\Robin\.AS

2014-06-23 13:47 - 2014-06-23 13:47 - 00000000 ____D () C:\Program Files\Alien Skin

2014-06-23 13:46 - 2014-06-23 13:46 - 51857528 _____ (Alien Skin Software, LLC) C:\Users\Robin\Downloads\eye-candy-7.1.0.1192.exe

2014-06-20 23:36 - 2014-06-20 23:31 - 03294900 _____ () C:\Users\Robin\Documents\Resourceandperformancereport-6-20-14.html

2014-06-17 22:42 - 2014-06-17 22:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-06-17 22:42 - 2014-05-07 15:02 - 00098216 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll

2014-06-17 22:42 - 2014-05-07 14:59 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe

2014-06-17 22:42 - 2014-05-07 14:59 - 00175528 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe

2014-06-17 22:42 - 2014-05-07 14:58 - 00175528 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe

2014-06-17 22:36 - 2014-06-17 22:36 - 00918952 _____ (Oracle Corporation) C:\Users\Robin\Downloads\chromeinstall-7u60.exe

2014-06-13 13:16 - 2014-07-10 16:20 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit

2014-06-13 13:16 - 2014-06-17 13:05 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Exploit

2014-06-13 13:16 - 2014-06-13 13:16 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Exploit.lnk

2014-06-13 13:16 - 2014-06-13 13:16 - 00001102 _____ () C:\ProgramData\Desktop\Malwarebytes Anti-Exploit.lnk

2014-06-13 13:16 - 2014-06-13 13:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit

2014-06-13 13:13 - 2014-06-13 13:14 - 02650408 _____ (Malwarebytes ) C:\Users\Robin\Downloads\mbae-setup-1.03.1.1220.exe

2014-06-10 20:25 - 2014-05-08 05:32 - 03178496 _____ (Microsoft Corporation) C:\windows\system32\rdpcorets.dll

2014-06-10 20:25 - 2014-05-08 05:32 - 00016384 _____ (Microsoft Corporation) C:\windows\system32\RdpGroupPolicyExtension.dll

2014-06-10 20:25 - 2014-04-24 22:34 - 00801280 _____ (Microsoft Corporation) C:\windows\system32\usp10.dll

2014-06-10 20:25 - 2014-04-24 22:06 - 00626688 _____ (Microsoft Corporation) C:\windows\SysWOW64\usp10.dll

2014-06-10 20:25 - 2014-04-04 22:47 - 01903552 _____ (Microsoft Corporation) C:\windows\system32\Drivers\tcpip.sys

2014-06-10 20:25 - 2014-04-04 22:47 - 00288192 _____ (Microsoft Corporation) C:\windows\system32\Drivers\FWPKCLNT.SYS

2014-06-10 20:25 - 2014-03-26 10:44 - 02002432 _____ (Microsoft Corporation) C:\windows\system32\msxml6.dll

2014-06-10 20:25 - 2014-03-26 10:44 - 01882112 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll

2014-06-10 20:25 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml6r.dll

2014-06-10 20:25 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll

2014-06-10 20:25 - 2014-03-26 10:27 - 01389056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6.dll

2014-06-10 20:25 - 2014-03-26 10:27 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll

2014-06-10 20:25 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml6r.dll

2014-06-10 20:25 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll

2014-06-10 11:14 - 2014-06-10 11:14 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-06-10 11:14 - 2014-06-10 11:14 - 00001783 _____ () C:\ProgramData\Desktop\iTunes.lnk

2014-06-10 11:14 - 2014-06-10 11:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-10 11:13 - 2014-07-02 10:05 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-10 11:13 - 2014-06-10 11:14 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-10 11:13 - 2014-06-10 11:14 - 00000000 ____D () C:\Program Files\iTunes

2014-06-10 11:13 - 2014-06-10 11:13 - 00000000 ____D () C:\Program Files\iPod

==================== One Month Modified Files and Folders =======

2014-07-10 19:06 - 2014-07-10 19:06 - 00024767 _____ () C:\Users\Robin\Downloads\FRST.txt

2014-07-10 19:06 - 2014-07-10 19:05 - 00000000 ____D () C:\FRST

2014-07-10 19:04 - 2014-07-10 19:04 - 02084864 _____ (Farbar) C:\Users\Robin\Downloads\FRST64.exe

2014-07-10 18:26 - 2013-09-01 13:56 - 00000000 ____D () C:\Users\Robin\AppData\Local\Deployment

2014-07-10 18:13 - 2012-03-09 01:25 - 00000912 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job

2014-07-10 17:35 - 2014-07-10 17:35 - 00379920 _____ () C:\Users\Robin\AppData\Local\GDIPFONTCACHEV1.DAT

2014-07-10 17:35 - 2014-04-25 22:36 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware

2014-07-10 17:34 - 2014-04-25 22:37 - 00122584 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys

2014-07-10 17:07 - 2012-03-09 00:37 - 01525700 _____ () C:\windows\WindowsUpdate.log

2014-07-10 16:20 - 2014-06-13 13:16 - 00000000 ____D () C:\ProgramData\Malwarebytes Anti-Exploit

2014-07-10 16:17 - 2012-03-09 01:15 - 01983446 _____ () C:\FaceProv.log

2014-07-10 13:15 - 2013-08-29 15:25 - 00000000 ____D () C:\Users\Robin\AppData\Local\NPE

2014-07-10 12:45 - 2012-03-09 01:25 - 00000908 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job

2014-07-10 12:45 - 2012-03-09 01:17 - 00679009 _____ () C:\windows\system32\fastboot.set

2014-07-10 12:44 - 2014-07-10 12:17 - 00000000 ____D () C:\NPE

2014-07-10 12:25 - 2009-07-14 00:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2014-07-10 12:25 - 2009-07-14 00:45 - 00021280 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2014-07-10 12:21 - 2009-07-14 01:13 - 00782510 _____ () C:\windows\system32\PerfStringBackup.INI

2014-07-10 12:17 - 2013-08-29 05:53 - 00012245 _____ () C:\windows\setupact.log

2014-07-10 12:17 - 2009-07-14 01:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT

2014-07-10 12:16 - 2010-11-20 23:47 - 01344478 _____ () C:\windows\PFRO.log

2014-07-10 12:15 - 2014-07-10 12:15 - 00096856 _____ (Symantec Corporation) C:\windows\system32\Drivers\SMR410.SYS

2014-07-10 03:02 - 2013-10-26 07:58 - 00000000 ____D () C:\Users\Robin\Documents\PersonalRelated

2014-07-10 01:56 - 2014-07-10 01:56 - 00302011 _____ () C:\Users\Robin\Downloads\WindowsUpdateDiagnostic.diagcab

2014-07-10 00:32 - 2012-08-04 11:16 - 00000000 ____D () C:\Users\Robin\Documents\CCleaner

2014-07-09 12:27 - 2012-05-29 19:09 - 00000000 ____D () C:\Users\Robin\Documents\Outlook Files

2014-07-09 11:30 - 2013-09-20 11:09 - 00000000 ____D () C:\Users\Robin\AppData\Local\8A423D2B-06DC-40D9-9A59-775D53071926.aplzod

2014-07-09 03:33 - 2014-07-09 03:33 - 00000000 ____D () C:\windows\System32\Tasks\Norton 360

2014-07-09 03:28 - 2014-04-29 22:19 - 00003206 _____ () C:\windows\System32\Tasks\Norton WSC Integration

2014-07-09 03:28 - 2014-04-29 22:17 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360

2014-07-09 03:28 - 2014-04-29 22:17 - 00000000 ____D () C:\windows\system32\Drivers\N360x64

2014-07-09 03:25 - 2014-04-28 22:31 - 00000000 ___SD () C:\windows\system32\CompatTel

2014-07-09 03:25 - 2011-09-28 23:37 - 00000000 ____D () C:\Program Files\Windows Journal

2014-07-09 03:25 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\SysWOW64\Dism

2014-07-09 03:25 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\system32\Dism

2014-07-09 03:09 - 2012-05-29 18:36 - 00000000 ____D () C:\ProgramData\Microsoft Help

2014-07-09 03:07 - 2013-07-17 16:42 - 00000000 ____D () C:\windows\system32\MRT

2014-07-09 03:03 - 2012-05-26 11:40 - 96441528 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe

2014-07-09 02:41 - 2012-05-28 14:23 - 00000000 ____D () C:\Users\Robin\Documents\Beltone

2014-07-07 23:28 - 2013-10-04 23:46 - 00000000 ____D () C:\Users\Robin\Documents\CDO-YAHOOGroup

2014-07-07 22:31 - 2012-07-25 23:22 - 00000000 ____D () C:\Users\Robin\AppData\Local\CrashDumps

2014-07-07 21:09 - 2014-04-30 08:10 - 00000000 ____D () C:\windows\System32\Tasks\Norton Zone

2014-07-07 21:09 - 2014-04-30 08:09 - 00000000 ____D () C:\windows\system32\Drivers\NZx64

2014-07-07 21:09 - 2014-04-30 08:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Zone

2014-07-07 15:10 - 2009-07-14 01:32 - 00000000 ____D () C:\windows\system32\FxsTmp

2014-07-07 12:33 - 2012-05-28 09:50 - 00000000 ____D () C:\Program Files (x86)\AIM

2014-07-06 22:13 - 2013-10-02 19:40 - 00000000 ____D () C:\Users\Robin\Documents\BCBS-HSA

2014-07-06 22:09 - 2012-08-20 13:55 - 00000000 ____D () C:\Users\Robin\Documents\Girl Stuff

2014-07-05 23:28 - 2014-07-05 23:28 - 00000822 _____ () C:\Users\Public\Desktop\CCleaner.lnk

2014-07-05 23:28 - 2014-07-05 23:28 - 00000822 _____ () C:\ProgramData\Desktop\CCleaner.lnk

2014-07-05 23:28 - 2012-07-22 21:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner

2014-07-05 23:28 - 2012-07-22 21:39 - 00000000 ____D () C:\Program Files\CCleaner

2014-07-05 23:25 - 2014-07-05 23:24 - 04812672 _____ (Piriform Ltd) C:\Users\Robin\Downloads\ccsetup415.exe

2014-07-04 23:25 - 2012-07-22 20:52 - 06447074 _____ () C:\windows\system32\PsBoot.log

2014-07-04 23:24 - 2012-07-22 20:52 - 00000000 _____ () C:\windows\system32\defragLog.log

2014-07-02 15:04 - 2012-06-01 06:01 - 00000000 ____D () C:\ProgramData\Lx_cats

2014-07-02 10:05 - 2014-06-10 11:13 - 00000000 ____D () C:\Program Files (x86)\iTunes

2014-06-29 22:09 - 2014-07-08 23:10 - 00519168 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll

2014-06-29 22:04 - 2014-07-08 23:10 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll

2014-06-29 08:16 - 2014-06-29 08:16 - 00252623 _____ () C:\Users\Robin\Documents\qbreport629-50793.xps

2014-06-28 22:38 - 2012-05-31 06:02 - 00000000 ____D () C:\Users\Robin\AppData\Local\Paint.NET

2014-06-28 22:37 - 2012-05-31 06:03 - 00001188 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Paint.NET.lnk

2014-06-28 22:37 - 2012-05-31 06:03 - 00000000 ____D () C:\Program Files\Paint.NET

2014-06-28 20:02 - 2014-06-28 20:02 - 01765104 _____ () C:\ProgramData\SPLEBF.tmp

2014-06-25 11:51 - 2014-03-15 23:24 - 00004128 _____ () C:\windows\System32\Tasks\Open URL by RoboForm

2014-06-25 11:51 - 2014-03-15 23:24 - 00003492 _____ () C:\windows\System32\Tasks\Run RoboForm TaskBar Icon

2014-06-25 11:51 - 2014-03-15 23:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm

2014-06-25 11:47 - 2014-06-25 11:46 - 16656408 _____ (Siber Systems) C:\Users\Robin\Downloads\RoboForm-Setup-cnetc.exe

2014-06-23 13:54 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\Resources

2014-06-23 13:52 - 2014-06-23 13:52 - 00000000 ____D () C:\Users\Robin\Documents\Receipt Alien Skin Software_files

2014-06-23 13:49 - 2012-08-30 20:36 - 00000000 ____D () C:\Users\Robin\AppData\Roaming\Alien Skin

2014-06-23 13:48 - 2014-06-23 13:48 - 00000000 ____D () C:\Users\Robin\.AS

2014-06-23 13:48 - 2012-08-30 20:46 - 00000000 ____D () C:\ProgramData\Alien Skin

2014-06-23 13:48 - 2012-08-30 20:35 - 00000000 ____D () C:\Users\Robin\AppData\Local\Alien Skin

2014-06-23 13:48 - 2012-05-27 08:16 - 00000000 ____D () C:\Users\Robin

2014-06-23 13:47 - 2014-06-23 13:47 - 00000000 ____D () C:\Program Files\Alien Skin

2014-06-23 13:47 - 2012-07-09 00:02 - 00000000 ____D () C:\Program Files (x86)\Alien Skin

2014-06-23 13:47 - 2012-06-01 10:04 - 00000000 ____D () C:\Users\Robin\Documents\My PSP Files

2014-06-23 13:46 - 2014-06-23 13:46 - 51857528 _____ (Alien Skin Software, LLC) C:\Users\Robin\Downloads\eye-candy-7.1.0.1192.exe

2014-06-20 23:31 - 2014-06-20 23:36 - 03294900 _____ () C:\Users\Robin\Documents\Resourceandperformancereport-6-20-14.html

2014-06-20 16:14 - 2014-07-08 23:09 - 00266424 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll

2014-06-20 15:39 - 2014-07-08 23:09 - 00240824 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll

2014-06-18 21:39 - 2014-07-08 23:09 - 23464448 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll

2014-06-18 21:06 - 2014-07-08 23:09 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb

2014-06-18 21:06 - 2014-07-08 23:09 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll

2014-06-18 20:48 - 2014-07-08 23:09 - 02768384 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll

2014-06-18 20:42 - 2014-07-08 23:09 - 00548352 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll

2014-06-18 20:42 - 2014-07-08 23:09 - 00066048 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll

2014-06-18 20:41 - 2014-07-08 23:09 - 00083968 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll

2014-06-18 20:41 - 2014-07-08 23:09 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll

2014-06-18 20:32 - 2014-07-08 23:09 - 00051200 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll

2014-06-18 20:31 - 2014-07-08 23:09 - 00033792 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll

2014-06-18 20:26 - 2014-07-08 23:09 - 00598016 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll

2014-06-18 20:24 - 2014-07-08 23:09 - 00139264 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe

2014-06-18 20:24 - 2014-07-08 23:09 - 00111616 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe

2014-06-18 20:23 - 2014-07-08 23:09 - 00752640 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll

2014-06-18 20:16 - 2014-07-08 23:09 - 17276416 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll

2014-06-18 20:14 - 2014-07-08 23:09 - 00940032 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe

2014-06-18 20:09 - 2014-07-08 23:09 - 00452608 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll

2014-06-18 19:59 - 2014-07-08 23:09 - 00038400 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll

2014-06-18 19:56 - 2014-07-08 23:09 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb

2014-06-18 19:53 - 2014-07-08 23:09 - 00195584 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll

2014-06-18 19:51 - 2014-07-08 23:09 - 05721088 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll

2014-06-18 19:50 - 2014-07-08 23:09 - 00085504 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll

2014-06-18 19:48 - 2014-07-08 23:09 - 00292864 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll

2014-06-18 19:39 - 2014-07-08 23:09 - 00608768 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe

2014-06-18 19:38 - 2014-07-08 23:09 - 00455168 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll

2014-06-18 19:37 - 2014-07-08 23:09 - 00061952 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll

2014-06-18 19:36 - 2014-07-08 23:09 - 00051200 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll

2014-06-18 19:35 - 2014-07-08 23:09 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll

2014-06-18 19:33 - 2014-07-08 23:09 - 00631808 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll

2014-06-18 19:32 - 2014-07-08 23:09 - 02179072 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll

2014-06-18 19:28 - 2014-07-08 23:09 - 00043008 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll

2014-06-18 19:28 - 2014-07-08 23:09 - 00032768 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll

2014-06-18 19:27 - 2014-07-08 23:09 - 02040832 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl

2014-06-18 19:27 - 2014-07-08 23:09 - 01249280 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll

2014-06-18 19:25 - 2014-07-08 23:09 - 00442368 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll

2014-06-18 19:23 - 2014-07-08 23:09 - 00112128 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe

2014-06-18 19:22 - 2014-07-08 23:09 - 00592896 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll

2014-06-18 19:12 - 2014-07-08 23:09 - 00367616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll

2014-06-18 19:06 - 2014-07-08 23:09 - 00032256 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll

2014-06-18 19:01 - 2014-07-08 23:09 - 00164864 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll

2014-06-18 18:59 - 2014-07-08 23:09 - 00069632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll

2014-06-18 18:58 - 2014-07-08 23:09 - 02266112 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll

2014-06-18 18:58 - 2014-07-08 23:09 - 00239616 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll

2014-06-18 18:52 - 2014-07-08 23:09 - 04254720 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll

2014-06-18 18:51 - 2014-07-08 23:09 - 13527040 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll

2014-06-18 18:49 - 2014-07-08 23:09 - 00526336 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll

2014-06-18 18:46 - 2014-07-08 23:09 - 01068032 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll

2014-06-18 18:45 - 2014-07-08 23:09 - 01964544 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl

2014-06-18 18:35 - 2014-07-08 23:09 - 11742208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll

2014-06-18 18:34 - 2014-07-08 23:09 - 01393664 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll

2014-06-18 18:15 - 2014-07-08 23:09 - 00846336 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll

2014-06-18 18:13 - 2014-07-08 23:09 - 01791488 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll

2014-06-18 18:09 - 2014-07-08 23:09 - 01139200 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll

2014-06-18 18:07 - 2014-07-08 23:09 - 00704512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll

2014-06-18 10:08 - 2012-03-09 01:25 - 00003908 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA

2014-06-18 10:08 - 2012-03-09 01:25 - 00003656 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore

2014-06-17 22:43 - 2013-10-28 06:14 - 00000000 ____D () C:\ProgramData\Oracle

2014-06-17 22:42 - 2014-06-17 22:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java

2014-06-17 22:42 - 2012-10-13 14:07 - 00000000 ____D () C:\Program Files (x86)\Java

2014-06-17 22:36 - 2014-06-17 22:36 - 00918952 _____ (Oracle Corporation) C:\Users\Robin\Downloads\chromeinstall-7u60.exe

2014-06-17 22:18 - 2014-07-08 23:10 - 00692736 _____ (Microsoft Corporation) C:\windows\system32\osk.exe

2014-06-17 21:51 - 2014-07-08 23:10 - 00646144 _____ (Microsoft Corporation) C:\windows\SysWOW64\osk.exe

2014-06-17 21:10 - 2014-07-08 23:10 - 03157504 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys

2014-06-17 13:05 - 2014-06-13 13:16 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Exploit

2014-06-17 13:05 - 2012-06-01 05:55 - 00000000 ____D () C:\Program Files (x86)\Lexmark 3500-4500 Series

2014-06-13 13:16 - 2014-06-13 13:16 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Exploit.lnk

2014-06-13 13:16 - 2014-06-13 13:16 - 00001102 _____ () C:\ProgramData\Desktop\Malwarebytes Anti-Exploit.lnk

2014-06-13 13:16 - 2014-06-13 13:16 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Exploit

2014-06-13 13:14 - 2014-06-13 13:13 - 02650408 _____ (Malwarebytes ) C:\Users\Robin\Downloads\mbae-setup-1.03.1.1220.exe

2014-06-11 08:47 - 2013-08-23 16:29 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk

2014-06-10 21:25 - 2009-07-13 23:20 - 00000000 ____D () C:\windows\rescache

2014-06-10 11:14 - 2014-06-10 11:14 - 00001783 _____ () C:\Users\Public\Desktop\iTunes.lnk

2014-06-10 11:14 - 2014-06-10 11:14 - 00001783 _____ () C:\ProgramData\Desktop\iTunes.lnk

2014-06-10 11:14 - 2014-06-10 11:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes

2014-06-10 11:14 - 2014-06-10 11:13 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69

2014-06-10 11:14 - 2014-06-10 11:13 - 00000000 ____D () C:\Program Files\iTunes

2014-06-10 11:13 - 2014-06-10 11:13 - 00000000 ____D () C:\Program Files\iPod

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed

C:\Windows\System32\wininit.exe => File is digitally signed

C:\Windows\SysWOW64\wininit.exe => File is digitally signed

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\SysWOW64\explorer.exe => File is digitally signed

C:\Windows\System32\svchost.exe => File is digitally signed

C:\Windows\SysWOW64\svchost.exe => File is digitally signed

C:\Windows\System32\services.exe => File is digitally signed

C:\Windows\System32\User32.dll => File is digitally signed

C:\Windows\SysWOW64\User32.dll => File is digitally signed

C:\Windows\System32\userinit.exe => File is digitally signed

C:\Windows\SysWOW64\userinit.exe => File is digitally signed

C:\Windows\System32\rpcss.dll => File is digitally signed

C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-07-08 21:05

==================== End Of Log ============================

Stonemommy4 · July 10, 2014

won't let my paste the second report

addition

so i attached it, sorry

hope you can see it

Addition.txt

Stonemommy4 · July 11, 2014

ok i have to work on my computer so doing process list in post "Windows 7 user with wicked attack"

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Rkill 2.6.7 by Lawrence Abrams (Grinler)

http://www.bleepingcomputer.com/

More Information about Rkill can be found at this link:

http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 07/11/2014 12:27:15 AM in x64 mode.

Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* C:\Users\Robin\Downloads\FRST64.exe (PID: 2560) [uP-HEUR]

1 proccess terminated!

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 07/11/2014 12:28:07 AM

Execution time: 0 hours(s), 0 minute(s), and 52 seconds(s)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

MB ran again

<?xml version="1.0" encoding="UTF-16" ?>

<mbam-log>

</header>

<malware-database>v2014.07.11.02</malware-database>

<rootkit-database>v2014.07.09.01</rootkit-database>

<file-protection>disabled</file-protection>

<web-protection>disabled</web-protection>

<self-protection>disabled</self-protection>

</engine>

<osversion>Windows 7 Service Pack 1</osversion>

<username>Robin</username>

</system>

<type>threat</type>

<result>completed</result>

</summary>

<memory>enabled</memory>

<startup>enabled</startup>

<filesystem>enabled</filesystem>

<archives>enabled</archives>

<rootkits>enabled</rootkits>

<deeprootkit>disabled</deeprootkit>

<heuristics>enabled</heuristics>

<pup>enabled</pup>

<pum>enabled</pum>

</options>

<items>

</items>

</mbam-log>

Stonemommy4 · July 11, 2014

RogueKiller V9.2.1.0 (x64) [Jun 23 2014] by Adlice Software

mail : http://www.adlice.com/contact/

Feedback : http://forum.adlice.com

Website : http://www.adlice.com/softwares/roguekiller/

Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version

Started in : Normal mode

User : Robin [Admin rights]

Mode : Scan -- Date : 07/11/2014 01:19:14

¤¤¤ Bad processes : 1 ¤¤¤

[Proc.Hidden] -- [x] -> KILLED [TermThr]

¤¤¤ Registry Entries : 5 ¤¤¤

[suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\NPEService -> FOUND

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND

[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> FOUND

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND

[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> FOUND

¤¤¤ Scheduled tasks : 6 ¤¤¤

[suspicious.Path] \\05-12-13-picturefile -- C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe ("C:\Users\Robin\AppData\Roaming\Nero\Nero BackItUp 5\Files\05-12-13-picturefile.nji") -> FOUND

[suspicious.Path] \\6-1-12-Lenovo-fullbackup -- C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe ("C:\Users\Robin\AppData\Roaming\Nero\Nero BackItUp 5\Files\6-1-12-Lenovo-fullbackup.nji") -> FOUND

[suspicious.Path] \\6-1-12-newcompRobinfb -- C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe ("C:\Users\Robin\AppData\Roaming\Nero\Nero BackItUp 5\Files\6-1-12-newcompRobinfb.nji") -> FOUND

[suspicious.Path] \\6-1-12manuallybackeduplenovo -- C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe ("C:\Users\Robin\AppData\Roaming\Nero\Nero BackItUp 5\Files\6-1-12manuallybackeduplenovo.nji") -> FOUND

[suspicious.Path] \\FB-12-9-12-stm4 -- C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe ("C:\Users\Robin\AppData\Roaming\Nero\Nero BackItUp 5\Files\FB-12-9-12-stm4.nji") -> FOUND

[suspicious.Path] \\Robin -- C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBCore.exe ("C:\Users\Robin\AppData\Roaming\Nero\Nero BackItUp 5\Files\Robin.nji") -> FOUND

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 0 ¤¤¤

¤¤¤ Antirootkit : 1 (Driver: LOADED) ¤¤¤

[Filter(Kernel.Filter)] \Driver\Disk @ \Device\Harddisk0\DR0 : \Driver\LHDmgr @ Unknown (\SystemRoot\System32\Drivers\mup.sys)

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤

+++++ PhysicalDrive0: WDC WD5000BPVT-24HXZT3 +++++

--- User ---

[MBR] f49a6e5573bdfe95c254903fd78923aa

[bSP] 871337e1eb72ecfa941c413415b292c9 : Windows Vista/7/8 MBR Code

Partition table:

0 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 2048 | Size: 200 MB

1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 411648 | Size: 431938 MB

2 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 885020672 | Size: 29692 MB

3 - [XXXXXX] COMPAQ (0x12) [VISIBLE] Offset (sectors): 945829888 | Size: 15109 MB

User = LL1 ... OK

User = LL2 ... OK

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Here is Junkware report

Junkware Removal Tool (JRT) by Thisisu

Version: 6.1.4 (04.06.2014:1)

OS: Windows 7 Home Premium x64

Ran by Robin on Fri 07/11/2014 at 1:24:26.12

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

Successfully repaired: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_DLLs

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasapi32

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\au__rasmancs

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}

Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess"

Successfully deleted: [Empty Folder] C:\Users\Robin\appdata\local\{669951FF-C63D-4B4B-833A-DBB03687B1EA}

Successfully deleted: [Empty Folder] C:\Users\Robin\appdata\local\{DC9E5890-967B-493E-A717-FC88EA3D76EA}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan was completed on Fri 07/11/2014 at 1:31:19.91

End of JRT log

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# AdwCleaner v3.215 - Report created 11/07/2014 at 01:34:23

# Updated 09/07/2014 by Xplode

# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)

# Username : Robin - ROBIN-PC

# Running from : C:\Users\Robin\Downloads\AdwCleaner.exe

# Option : Scan

***** [ Services ] *****

***** [ Files / Folders ] *****

File Found : C:\Users\Robin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\jZip.lnk

Folder Found : C:\Program Files (x86)\jZip

Folder Found : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\jZip

Folder Found : C:\Users\Robin\AppData\Local\jZip

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Found : HKLM\SOFTWARE\Classes\jZip.file

Key Found : HKLM\Software\jZip

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}

Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\jZip_RASAPI32

Key Found : HKLM\SOFTWARE\Microsoft\Tracing\jZip_RASMANCS

Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\jZip

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}

Key Found : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2102}

Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{2318C2B1-4965-11D4-9B18-009027A5CD4F}]

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17207

-\\ Google Chrome v35.0.1916.153

[ File : C:\Users\Robin\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Found [search Provider] : hxxp://dts.search-results.com/sr?src=crb&appid=0&systemid=102&sr=0&q={searchTerms}

Found [search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}

Found [search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R0].txt - [4107 octets] - [31/08/2013 10:01:09]

AdwCleaner[R1].txt - [882 octets] - [31/08/2013 10:23:47]

AdwCleaner[R2].txt - [2312 octets] - [11/07/2014 01:34:23]

AdwCleaner[s0].txt - [4268 octets] - [31/08/2013 10:02:46]

AdwCleaner[s1].txt - [942 octets] - [31/08/2013 10:24:54]

########## EOF - C:\AdwCleaner\AdwCleaner[R2].txt - [2491 octets] ##########

Stonemommy4 · July 11, 2014

ESET report

C:\Nero Local Autobackup\20130110_182411_Local Autobackup\C\Users\Robin\Downloads\ccsetup320.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application

C:\Nero Local Autobackup\20130110_182411_Local Autobackup\C\Users\Robin\Downloads\jZipV1 (1).exe probably a variant of Win32/Toolbar.SearchSuite.J potentially unwanted application

C:\Nero Local Autobackup\20130110_220614_Local Autobackup\C\Users\Robin\Downloads\ccsetup320.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application

C:\Nero Local Autobackup\20130110_220614_Local Autobackup\C\Users\Robin\Downloads\jZipV1 (1).exe probably a variant of Win32/Toolbar.SearchSuite.J potentially unwanted application

C:\Users\Robin\Downloads\ccsetup320.exe Win32/Bundled.Toolbar.Google.E potentially unsafe application

C:\Users\Robin\Downloads\ccsetup414.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Robin\Downloads\ccsetup415.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application

C:\Users\Robin\Downloads\jZipV1 (1).exe probably a variant of Win32/Toolbar.SearchSuite.J potentially unwanted application

Stonemommy4 · July 11, 2014

ok last step and hopefully someone will read this today...

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 10-07-2014 01

Ran by Robin (administrator) on ROBIN-PC on 11-07-2014 08:41:39