jb1321 Posted July 16, 2014 ID:853772 Share Posted July 16, 2014 Every time I start up Steam, or while browsing the internet a pop up hijacks my browser. telling me to update my Java/ Flash player or otherwise "my video down loader". I've been trying for a day or so to find an anti-virus to get rid of it, but no such luck. Nothing I run has found it. Things I have tried:adware cleanertdsskillermalwarebytes free/trial/ chameleonhitmanpro I could use some help, Thanks. (oh, I should probably say that I ran this scan while in Safe mode on my laptop. symptoms from the adware are still active) Here is the Frst scan results: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-07-2014 01Ran by Jacob Baran (administrator) on GLADIUS on 16-07-2014 16:47:31Running from C:\Users\Jacob Baran\DesktopPlatform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11Boot Mode: Normal The only official download link for FRST:Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated.See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Malwarebytes Corporation) D:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [synTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1861416 2009-10-09] (Synaptics Incorporated)HKLM\...\Run: [RunDLLEntry] => C:\Windows\system32\AmbRunE.dll [17920 2009-02-26] (Creative Technology Ltd.)HKLM\...\Run: [AmIcoSinglun64] => C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe [323584 2009-09-01] (AlcorMicro Co., Ltd.)HKLM-x32\...\Run: [ATKOSD2] => C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [6998656 2009-10-26] (ASUS)HKLM-x32\...\Run: [ATKMEDIA] => C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2009-08-19] (ASUS)HKLM-x32\...\Run: [HControlUser] => C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)HKLM-x32\...\Run: [VolPanel] => C:\Program Files (x86)\Creative\SB Audigy\Volume Panel\VolPanlu.exe [237693 2008-12-29] (Creative Technology Ltd)HKLM-x32\...\Run: [updReg] => C:\Windows\UpdReg.EXE [90112 2000-05-11] (Creative Technology Ltd.)HKLM-x32\...\Run: [bCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)HKLM-x32\...\Run: [] => [X]HKLM-x32\...\Run: [avast] => C:\Program Files\Alwil Software\Avast5\avastUI.exe [4858968 2013-05-09] (AVAST Software)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-11-02] (Apple Inc.)HKLM-x32\...\Run: [EEventManager] => C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe [1058400 2012-01-26] (SEIKO EPSON CORPORATION)HKLM-x32\...\Run: [FUFAXRCV] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXRCV.exe [502952 2012-07-09] (SEIKO EPSON CORPORATION)HKLM-x32\...\Run: [FUFAXSTM] => C:\Program Files (x86)\Epson Software\FAX Utility\FUFAXSTM.exe [863400 2012-07-09] (SEIKO EPSON CORPORATION)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-12-06] (Advanced Micro Devices, Inc.)HKU\S-1-5-21-1967562993-2040120075-1452459400-1000\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-09-14] (Apple Inc.)HKU\S-1-5-21-1967562993-2040120075-1452459400-1000\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-09-15] (Apple Inc.)HKU\S-1-5-21-1967562993-2040120075-1452459400-1000\...\Run: [Akamai NetSession Interface] => C:\Users\Jacob Baran\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)HKU\S-1-5-21-1967562993-2040120075-1452459400-1000\...\Run: [AppleIEDAV] => C:\Program Files (x86)\Common Files\Apple\Internet Services\AppleIEDAV.exe [1315144 2013-09-04] (Apple Inc.)HKU\S-1-5-21-1967562993-2040120075-1452459400-1000\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJIE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)HKU\S-1-5-21-1967562993-2040120075-1452459400-1000\...\Run: [DAEMON Tools Lite] => C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe [3696912 2014-03-04] (Disc Soft Ltd)HKU\S-1-5-21-1967562993-2040120075-1452459400-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnkShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\FancyStart daemon.lnkShortcutTarget: FancyStart daemon.lnk -> C:\Windows\Installer\{2B81872B-A054-48DA-BE3B-FA5C164C303A}\_C4A2FC3E3722966204FDD8.exe ()ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\Alwil Software\Avast5\ashShA64.dll (AVAST Software) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearchHKCU\Software\Microsoft\Internet Explorer\Main,Start Page = StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeSearchScopes: HKLM-x32 - DefaultScope value is missing.SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ASUTSearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll (RealDownloader)BHO: avast! Online Security -> {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)BHO: No Name -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> No FileBHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO: No Name -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> No FileBHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)BHO-x32: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Google Dictionary Compression sdch -> {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} -> C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)BHO-x32: SingleInstance Class -> {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} -> C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll (Yahoo! Inc)Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE64.dll (AVAST Software)Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software)Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileDPF: HKLM-x32 {000F1EA4-5E08-4564-A29B-29076F63A37A} http://launch.soe.com/plugin/web/SOEWebInstaller.cabDPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cabDPF: HKLM-x32 {82E5DF24-51E8-47CD-864A-F4BD5005AA73} https://www.icloud.com/system/iCloud.cabHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Microsoft Corporation)Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)Winsock: Catalog5 01 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [327168] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox:========FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll ()FF Plugin: @microsoft.com/GENUINE - disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ()FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF Plugin-x32: @microsoft.com/GENUINE - disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @nexon.net/NxGame - C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)FF Plugin-x32: @real.com/nppl3260;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpplugin;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)FF Plugin-x32: @soe.sony.com/installer,version=1.0.3 - C:\Windows\Downloaded Program Files\npsoe.dll ()FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Jacob Baran\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Jacob Baran\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Jacob Baran\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Jacob Baran\AppData\Local\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKCU: @yahoo.com/BrowserPlus,version=2.9.8 - C:\Users\Jacob Baran\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)FF Plugin HKCU: facebook.com/fbDesktopPlugin - C:\Users\Jacob Baran\AppData\Local\Facebook\Messenger\2.1.4814.0\npFbDesktopPlugin.dll (Facebook, Inc.)FF Plugin HKCU: pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)FF Plugin HKCU: thehappycloud.com/HappyCloudPlugin - C:\ProgramData\HappyCloud\Application\npHappyCloudPlugin.dll (The Happy Cloud)FF Plugin ProgramFiles/Appdata: C:\Users\Jacob Baran\AppData\Roaming\mozilla\plugins\npgoogletalk.dll (Google)FF Plugin ProgramFiles/Appdata: C:\Users\Jacob Baran\AppData\Roaming\mozilla\plugins\npo1d.dll (Google)FF HKLM-x32\...\Firefox\Extensions: [{97E22097-9A2F-45b1-8DAF-36AD648C7EF4}] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\ExtFF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\Alwil Software\Avast5\WebRep\FFFF Extension: avast! Online Security - C:\Program Files\Alwil Software\Avast5\WebRep\FF [2011-05-11]FF HKLM-x32\...\Firefox\Extensions: [quickprint@hp.com] - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtensionFF Extension: SmartPrintButton - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\QPExtension [2013-01-03]FF HKLM-x32\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-06-16] Chrome: =======CHR Extension: (Google Docs) - C:\Users\Jacob Baran\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-15]CHR Extension: (Google Drive) - C:\Users\Jacob Baran\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-07-25]CHR Extension: (YouTube) - C:\Users\Jacob Baran\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-25]CHR Extension: (Google Search) - C:\Users\Jacob Baran\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-25]CHR Extension: (Skype Click to Call) - C:\Users\Jacob Baran\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2014-07-16]CHR Extension: (Google Wallet) - C:\Users\Jacob Baran\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]CHR Extension: (Gmail) - C:\Users\Jacob Baran\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-25]CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10]CHR HKLM-x32\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files (x86)\Skype\Toolbars\ChromeExtension\skype_chrome_extension.crx [2014-04-11]CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= S2 avast! Antivirus; C:\Program Files\Alwil Software\Avast5\AvastSvc.exe [46808 2013-05-09] (AVAST Software)S3 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [477960 2014-04-01] (BitRaider, LLC)S2 c2cautoupdatesvc; C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [1390720 2014-04-11] (Microsoft Corporation)S2 c2cpnrsvc; C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [1764992 2014-04-11] (Microsoft Corporation)S3 Creative ALchemy AL6 Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [79360 2010-05-17] (Creative Labs) [File not signed]S3 Creative Audio Engine Licensing Service; C:\Program Files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [79360 2010-05-17] (Creative Labs) [File not signed]S3 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed]S2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)S2 HiPatchService; C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe [9216 2014-02-28] (Hi-Rez Studios) [File not signed]S2 MBAMScheduler; D:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)S2 MBAMService; D:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)S2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]S3 NgVpnMgr; C:\Windows\system32\ngvpnmgr.exe [510024 2010-07-20] (Aventail Corporation)S2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]S2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()S2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-06-16] (RealNetworks, Inc.)S2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-10] () [File not signed]S2 UNS; C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2314240 2009-09-30] (Intel Corporation) [File not signed]S2 wuauserv; C:\Windows\SysWOW64\wuaueng.dll [2428952 2012-06-02] (Microsoft Corporation) ==================== Drivers (Whitelisted) ==================== S3 AmUStor; C:\Windows\System32\drivers\AmUStor.SYS [44032 2009-08-21] (Alcor Micro, Corp.) [File not signed]U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-13] (Microsoft Corporation)S2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-05-09] (AVAST Software)S2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-05-09] (AVAST Software)R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-05-09] (AVAST Software)S0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-05-09] ()S1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1025808 2013-05-09] (AVAST Software)S1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378432 2013-05-09] (AVAST Software)S1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-05-09] (AVAST Software)S0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [189936 2013-05-09] ()S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2010-10-20] () [File not signed]S3 BRDriver64; C:\ProgramData\BitRaider\BRDriver64.sys [75048 2014-04-01] (BitRaider)S1 HWiNFO32; C:\Windows\system32\drivers\HWiNFO64A.SYS [31648 2014-02-18] (REALiX)R3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [35328 2010-10-20] () [File not signed]S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-16] (Malwarebytes Corporation)S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)S3 NgFilter; C:\Windows\System32\DRIVERS\ngfilter.sys [26136 2010-07-20] (Aventail Corporation)S3 NgLog; C:\Windows\System32\DRIVERS\nglog.sys [31256 2010-07-20] (Aventail Corporation)R3 NgVpn; C:\Windows\System32\DRIVERS\ngvpn.sys [98840 2010-07-20] (Aventail Corporation)S3 NgWfp; C:\Windows\System32\DRIVERS\ngwfp.sys [28696 2010-07-20] (Aventail Corporation)S3 NMgamingmsFltr; C:\Windows\System32\drivers\NMgamingms.sys [11264 2009-07-24] (Primax Ltd)S3 pbfilter; C:\Program Files\PeerBlock\pbfilter.sys [24176 2010-11-06] ()S3 s616bus; C:\Windows\System32\DRIVERS\s616bus.sys [108296 2007-04-03] (MCCI Corporation)S3 s616mdfl; C:\Windows\System32\DRIVERS\s616mdfl.sys [19720 2007-04-03] (MCCI Corporation)S3 s616mdm; C:\Windows\System32\DRIVERS\s616mdm.sys [144648 2007-04-03] (MCCI Corporation)S3 s616mgmt; C:\Windows\System32\DRIVERS\s616mgmt.sys [126216 2007-04-03] (MCCI Corporation)S3 s616nd5; C:\Windows\System32\DRIVERS\s616nd5.sys [31496 2007-04-03] (MCCI Corporation)S3 s616obex; C:\Windows\System32\DRIVERS\s616obex.sys [123656 2007-04-03] (MCCI Corporation)S3 s616unic; C:\Windows\System32\DRIVERS\s616unic.sys [130312 2007-04-03] (MCCI Corporation)S3 SNP2UVC; C:\Windows\System32\DRIVERS\snp2uvc.sys [1806400 2009-06-05] ()R0 sptd; C:\Windows\System32\Drivers\sptd.sys [386680 2014-07-11] (Duplex Secure Ltd.)U3 TrueSight; C:\Windows\System32\drivers\TrueSight.sys [30312 2014-07-16] ()S2 TurboB; C:\Windows\System32\DRIVERS\TurboB.sys [13784 2009-08-06] ()S3 BCMH43XX; system32\DRIVERS\bcmwlhigh664.sys [X]S3 catchme; \??\C:\ComboFix\catchme.sys [X]S3 EagleX64; \??\C:\Windows\system32\drivers\EagleX64.sys [X]U3 tmlwf; U3 tmwfp; S3 X6va006; \??\C:\Users\JACOBB~1\AppData\Local\Temp\006189F.tmp [X] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-16 16:47 - 2014-07-16 16:47 - 00000000 _____ () C:\Users\Jacob Baran\Desktop\FRST.txt2014-07-16 16:41 - 2014-07-16 16:41 - 02086912 _____ (Farbar) C:\Users\Jacob Baran\Desktop\FRST64.exe2014-07-16 16:36 - 2014-07-16 16:36 - 00033496 _____ () C:\ComboFix.txt2014-07-16 16:25 - 2014-07-16 16:36 - 00000000 ____D () C:\ComboFix2014-07-16 16:21 - 2014-07-16 16:21 - 05221447 ____R (Swearware) C:\Users\Jacob Baran\Downloads\ComboFix.exe2014-07-16 16:21 - 2014-07-16 16:21 - 01452640 _____ () C:\Users\Jacob Baran\Downloads\java_installer.exe2014-07-16 08:52 - 2014-07-16 15:45 - 00002658 _____ () C:\Users\Jacob Baran\Desktop\Rkill.txt2014-07-16 08:49 - 2014-07-16 09:27 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\CrashDumps2014-07-16 01:13 - 2014-07-16 01:13 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\SUPERAntiSpyware.com2014-07-16 01:12 - 2014-07-16 02:04 - 00000000 ____D () C:\Users\Jacob Baran\Desktop\super2014-07-16 01:08 - 2014-07-16 01:09 - 20108152 _____ (SUPERAntiSpyware) C:\Users\Jacob Baran\Downloads\SUPERAntiSpyware.exe2014-07-16 00:39 - 2014-07-16 15:58 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys2014-07-16 00:39 - 2014-07-16 00:39 - 00000000 ____D () C:\ProgramData\RogueKiller2014-07-16 00:18 - 2014-07-16 00:18 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\Jacob Baran\Desktop\rkill.exe2014-07-16 00:04 - 2014-07-16 00:04 - 00065232 _____ (Malwarebytes) C:\Users\Jacob Baran\Downloads\regassassin-setup-1.03.exe2014-07-16 00:02 - 2014-07-16 00:18 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)2014-07-16 00:00 - 2014-07-16 00:01 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Jacob Baran\Downloads\mbar-1.07.0.1012.exe2014-07-15 23:55 - 2014-07-15 23:55 - 00000000 _____ () C:\autoexec.bat2014-07-15 23:54 - 2014-07-15 23:54 - 00000000 ____D () C:\Program Files\Enigma Software Group2014-07-15 23:52 - 2014-07-16 00:03 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP2014-07-15 23:13 - 2014-07-15 23:13 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jacob Baran\Downloads\mbam-setup-2.0.2.1012.exe2014-07-15 18:15 - 2014-07-15 18:17 - 00027751 _____ () C:\Users\Jacob Baran\Downloads\Turn 04 Submission - Jacob Baran (1).xlsx2014-07-15 18:15 - 2014-07-15 18:15 - 02122787 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern (4).xlsx2014-07-15 17:44 - 2011-06-26 01:45 - 00256000 _____ () C:\Windows\PEV.exe2014-07-15 17:44 - 2010-11-07 12:20 - 00208896 _____ () C:\Windows\MBR.exe2014-07-15 17:44 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe2014-07-15 17:44 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe2014-07-15 17:44 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe2014-07-15 17:44 - 2000-08-30 19:00 - 00098816 _____ () C:\Windows\sed.exe2014-07-15 17:44 - 2000-08-30 19:00 - 00080412 _____ () C:\Windows\grep.exe2014-07-15 17:44 - 2000-08-30 19:00 - 00068096 _____ () C:\Windows\zip.exe2014-07-15 17:37 - 2014-07-16 16:36 - 00000000 ____D () C:\Qoobox2014-07-15 17:37 - 2014-07-15 18:05 - 00000000 ____D () C:\Windows\erdnt2014-07-15 17:19 - 2014-07-15 17:19 - 00000000 ____D () C:\Windows\ERUNT2014-07-15 16:54 - 2014-07-15 16:54 - 00004145 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b19.log2014-07-15 16:53 - 2014-07-15 16:53 - 00918952 _____ (Oracle Corporation) C:\Users\Jacob Baran\Downloads\chromeinstall-7u65.exe2014-07-15 14:22 - 2014-07-16 15:26 - 00065536 _____ () C:\Windows\system32\Ikeext.etl2014-07-15 11:36 - 2014-07-15 11:36 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\AVAST Software2014-07-15 02:39 - 2014-07-15 02:39 - 00000000 ____D () C:\ProgramData\AVAST Software2014-07-15 02:22 - 2014-07-15 02:22 - 00062310 _____ () C:\Users\Jacob Baran\Downloads\Addition.txt2014-07-15 02:21 - 2014-07-15 02:22 - 00232510 _____ () C:\Users\Jacob Baran\Downloads\FRST.txt2014-07-15 02:20 - 2014-07-16 16:47 - 00000000 ____D () C:\FRST2014-07-14 15:51 - 2014-07-14 15:52 - 02124079 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern (3).xlsx2014-07-14 14:43 - 2014-07-16 08:53 - 00000000 ____D () C:\Users\Jacob Baran\Downloads\antimaterial rifles2014-07-14 12:36 - 2014-07-16 09:20 - 00000672 _____ () C:\Windows\setupact.log2014-07-14 12:36 - 2014-07-15 17:58 - 00595556 _____ () C:\Windows\PFRO.log2014-07-14 12:36 - 2014-07-14 12:36 - 00000000 _____ () C:\Windows\setuperr.log2014-07-14 08:52 - 2014-07-14 08:52 - 00021215 _____ () C:\Users\Jacob Baran\Downloads\Turn 04 Submission - Jacob Baran.xlsx2014-07-14 08:50 - 2014-07-14 08:50 - 02643293 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern (2).xlsx2014-07-14 08:49 - 2014-07-15 22:52 - 00003350 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1967562993-2040120075-1452459400-10002014-07-14 08:49 - 2014-07-15 22:52 - 00003228 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1967562993-2040120075-1452459400-10002014-07-13 22:41 - 2014-07-13 22:42 - 11185664 _____ (SurfRight B.V.) C:\Users\Jacob Baran\Downloads\HitmanPro_x64 (1).exe2014-07-13 14:14 - 2014-07-13 22:52 - 00000668 _____ () C:\Windows\system32\.crusader2014-07-13 13:54 - 2014-07-13 14:14 - 00000000 ____D () C:\ProgramData\HitmanPro2014-07-11 17:53 - 2014-07-11 17:59 - 61681664 _____ () C:\Users\Jacob Baran\Downloads\calibre-64bit-1.44.0.msi2014-07-11 15:18 - 2014-07-11 15:18 - 00001956 _____ () C:\Users\Public\Desktop\DAEMON Tools Lite.lnk2014-07-11 15:18 - 2014-07-11 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite2014-07-11 15:18 - 2014-07-11 15:18 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite2014-07-10 12:27 - 2014-07-10 12:27 - 00000222 _____ () C:\Users\Jacob Baran\Desktop\Awesomenauts.url2014-07-08 15:51 - 2014-06-29 21:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2014-07-08 15:51 - 2014-06-29 21:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2014-07-08 15:50 - 2014-06-20 15:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-07-08 15:50 - 2014-06-20 14:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-07-08 15:50 - 2014-06-18 20:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-07-08 15:50 - 2014-06-18 20:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-07-08 15:50 - 2014-06-18 20:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2014-07-08 15:50 - 2014-06-18 19:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-07-08 15:50 - 2014-06-18 19:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-07-08 15:50 - 2014-06-18 19:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-07-08 15:50 - 2014-06-18 19:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2014-07-08 15:50 - 2014-06-18 19:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2014-07-08 15:50 - 2014-06-18 19:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-07-08 15:50 - 2014-06-18 19:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-07-08 15:50 - 2014-06-18 19:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-07-08 15:50 - 2014-06-18 19:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-07-08 15:50 - 2014-06-18 19:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2014-07-08 15:50 - 2014-06-18 19:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2014-07-08 15:50 - 2014-06-18 19:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-07-08 15:50 - 2014-06-18 19:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2014-07-08 15:50 - 2014-06-18 19:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-07-08 15:50 - 2014-06-18 18:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2014-07-08 15:50 - 2014-06-18 18:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-07-08 15:50 - 2014-06-18 18:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2014-07-08 15:50 - 2014-06-18 18:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-07-08 15:50 - 2014-06-18 18:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-07-08 15:50 - 2014-06-18 18:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-07-08 15:50 - 2014-06-18 18:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-07-08 15:50 - 2014-06-18 18:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-07-08 15:50 - 2014-06-18 18:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-07-08 15:50 - 2014-06-18 18:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2014-07-08 15:50 - 2014-06-18 18:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2014-07-08 15:50 - 2014-06-18 18:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-07-08 15:50 - 2014-06-18 18:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-07-08 15:50 - 2014-06-18 18:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-07-08 15:50 - 2014-06-18 18:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-07-08 15:50 - 2014-06-18 18:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-07-08 15:50 - 2014-06-18 18:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2014-07-08 15:50 - 2014-06-18 18:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-07-08 15:50 - 2014-06-18 18:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-07-08 15:50 - 2014-06-18 18:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2014-07-08 15:50 - 2014-06-18 18:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-07-08 15:50 - 2014-06-18 18:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2014-07-08 15:50 - 2014-06-18 18:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2014-07-08 15:50 - 2014-06-18 17:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-07-08 15:50 - 2014-06-18 17:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-07-08 15:50 - 2014-06-18 17:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-07-08 15:50 - 2014-06-18 17:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-07-08 15:50 - 2014-06-18 17:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-07-08 15:50 - 2014-06-18 17:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-07-08 15:50 - 2014-06-18 17:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2014-07-08 15:50 - 2014-06-18 17:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-07-08 15:50 - 2014-06-18 17:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-07-08 15:50 - 2014-06-18 17:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-07-08 15:50 - 2014-06-18 17:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-07-08 15:50 - 2014-06-18 17:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-07-08 15:50 - 2014-06-18 17:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-07-08 15:50 - 2014-06-18 17:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-07-08 15:50 - 2014-06-17 21:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe2014-07-08 15:50 - 2014-06-17 20:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe2014-07-08 15:50 - 2014-06-17 20:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-07-08 15:50 - 2014-06-06 05:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll2014-07-08 15:50 - 2014-06-06 04:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll2014-07-08 15:50 - 2014-05-30 03:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll2014-07-08 15:50 - 2014-05-30 03:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll2014-07-08 15:50 - 2014-05-30 03:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll2014-07-08 15:50 - 2014-05-30 03:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll2014-07-08 15:50 - 2014-05-30 03:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll2014-07-08 15:50 - 2014-05-30 03:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll2014-07-08 15:50 - 2014-05-30 03:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll2014-07-08 15:50 - 2014-05-30 02:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll2014-07-08 15:50 - 2014-05-30 02:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll2014-07-08 15:50 - 2014-05-30 02:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2014-07-08 15:50 - 2014-05-30 02:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2014-07-08 15:50 - 2014-05-30 02:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll2014-07-08 15:50 - 2014-05-30 02:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll2014-07-08 15:50 - 2014-05-30 02:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll2014-07-08 15:50 - 2014-05-30 01:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys2014-07-08 15:49 - 2014-06-05 09:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2014-07-08 15:49 - 2014-06-05 09:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2014-07-08 15:49 - 2014-06-05 09:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2014-07-06 15:54 - 2014-07-06 15:54 - 00021154 _____ () C:\Users\Jacob Baran\Downloads\Turn 03 Submission - Jacob Baran.xlsx2014-07-06 15:52 - 2014-07-06 15:52 - 03373994 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern (1).xlsx2014-07-01 17:44 - 2014-07-01 18:18 - 00032723 _____ () C:\Users\Jacob Baran\Downloads\Turn 02 Submission - Jacob Baran.xlsx2014-06-29 13:39 - 2014-06-29 13:39 - 02850830 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern.xlsx2014-06-28 11:38 - 2014-06-28 11:38 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\Adobe2014-06-27 15:29 - 2014-06-27 15:29 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\BigHugeEngine2014-06-27 14:07 - 2014-06-27 14:07 - 00000000 ____D () C:\Users\Jacob Baran\Documents\Reus2014-06-27 11:35 - 2014-06-27 11:35 - 00000222 _____ () C:\Users\Jacob Baran\Desktop\Kingdoms of Amalur Reckoning.url2014-06-24 00:34 - 2014-06-24 00:41 - 00000000 ____D () C:\Users\Jacob Baran\Documents\PlanetExplorers2014-06-23 01:41 - 2014-06-23 01:41 - 00002039 _____ () C:\Users\Public\Desktop\Hi-Rez Diagnostics and Support.lnk2014-06-23 01:41 - 2014-06-23 01:41 - 00002030 _____ () C:\Users\Public\Desktop\Smite.lnk2014-06-23 01:41 - 2014-06-23 01:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios2014-06-23 01:39 - 2014-06-23 01:40 - 39967251 _____ (Hi-Rez Studios) C:\Users\Jacob Baran\Downloads\InstallHiRezGamesEnglish (1).exe2014-06-21 12:34 - 2014-06-21 12:34 - 00019264 _____ () C:\Users\Jacob Baran\Downloads\Turn_01_Submission_-_Jacob_Baran.xlsx2014-06-21 12:33 - 2014-06-21 12:33 - 03280153 _____ () C:\Users\Jacob Baran\Downloads\Jacob_Baran_-_Azoth_Stern (1).xlsx2014-06-17 16:37 - 2014-06-17 16:37 - 00015041 _____ () C:\Users\Jacob Baran\Downloads\Action List.xlsx2014-06-17 16:29 - 2014-07-15 23:07 - 00000000 ____D () C:\Users\Jacob Baran\Documents\Always Dark2014-06-17 16:26 - 2014-06-17 16:27 - 02529875 _____ () C:\Users\Jacob Baran\Downloads\Jacob_Baran_-_Azoth_Stern.xlsx2014-06-17 16:22 - 2014-06-17 16:22 - 00356792 _____ () C:\Users\Jacob Baran\Downloads\Turn 00 Workbook.xlsx2014-06-16 21:31 - 2014-06-16 21:31 - 00001046 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk2014-06-16 21:31 - 2014-06-16 21:31 - 00000000 ____D () C:\ProgramData\RealNetworks2014-06-16 21:31 - 2014-06-16 21:31 - 00000000 ____D () C:\Program Files (x86)\RealNetworks2014-06-16 18:35 - 2014-07-16 16:07 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2014-06-16 18:33 - 2014-07-16 16:03 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2014-06-16 18:33 - 2014-07-15 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-06-16 18:33 - 2014-06-16 18:33 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-06-16 18:33 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys2014-06-16 17:51 - 2014-04-24 21:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll2014-06-16 17:51 - 2014-04-24 21:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll2014-06-16 17:51 - 2014-04-04 21:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys2014-06-16 17:51 - 2014-04-04 21:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS2014-06-16 17:51 - 2014-03-26 09:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll2014-06-16 17:51 - 2014-03-26 09:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll2014-06-16 17:51 - 2014-03-26 09:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll2014-06-16 17:51 - 2014-03-26 09:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll2014-06-16 17:51 - 2014-03-26 09:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll2014-06-16 17:51 - 2014-03-26 09:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll2014-06-16 17:51 - 2014-03-26 09:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll2014-06-16 17:51 - 2014-03-26 09:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll ==================== One Month Modified Files and Folders ======= 2014-07-16 16:47 - 2014-07-16 16:47 - 00000000 _____ () C:\Users\Jacob Baran\Desktop\FRST.txt2014-07-16 16:47 - 2014-07-15 02:20 - 00000000 ____D () C:\FRST2014-07-16 16:41 - 2014-07-16 16:41 - 02086912 _____ (Farbar) C:\Users\Jacob Baran\Desktop\FRST64.exe2014-07-16 16:36 - 2014-07-16 16:36 - 00033496 _____ () C:\ComboFix.txt2014-07-16 16:36 - 2014-07-16 16:25 - 00000000 ____D () C:\ComboFix2014-07-16 16:36 - 2014-07-15 17:37 - 00000000 ____D () C:\Qoobox2014-07-16 16:34 - 2009-07-13 21:34 - 00000215 _____ () C:\Windows\system.ini2014-07-16 16:21 - 2014-07-16 16:21 - 05221447 ____R (Swearware) C:\Users\Jacob Baran\Downloads\ComboFix.exe2014-07-16 16:21 - 2014-07-16 16:21 - 01452640 _____ () C:\Users\Jacob Baran\Downloads\java_installer.exe2014-07-16 16:07 - 2014-06-16 18:35 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2014-07-16 16:03 - 2014-06-16 18:33 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2014-07-16 15:58 - 2014-07-16 00:39 - 00030312 _____ () C:\Windows\system32\Drivers\TrueSight.sys2014-07-16 15:49 - 2014-05-25 01:10 - 00000000 ____D () C:\AdwCleaner2014-07-16 15:48 - 2013-01-01 17:19 - 00000000 ____D () C:\TDSSKiller_Quarantine2014-07-16 15:45 - 2014-07-16 08:52 - 00002658 _____ () C:\Users\Jacob Baran\Desktop\Rkill.txt2014-07-16 15:26 - 2014-07-15 14:22 - 00065536 _____ () C:\Windows\system32\Ikeext.etl2014-07-16 09:31 - 2013-01-15 16:02 - 01599288 _____ () C:\Windows\WindowsUpdate.log2014-07-16 09:31 - 2010-05-17 20:32 - 00000912 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-07-16 09:30 - 2009-07-13 23:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02014-07-16 09:30 - 2009-07-13 23:45 - 00018736 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02014-07-16 09:28 - 2014-03-17 22:33 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-07-16 09:27 - 2014-07-16 08:49 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\CrashDumps2014-07-16 09:22 - 2014-05-22 09:54 - 00003372 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-1967562993-2040120075-1452459400-10002014-07-16 09:22 - 2013-04-25 17:25 - 00003250 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-1967562993-2040120075-1452459400-10002014-07-16 09:21 - 2010-05-17 20:32 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-07-16 09:20 - 2014-07-14 12:36 - 00000672 _____ () C:\Windows\setupact.log2014-07-16 09:20 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-07-16 09:13 - 2012-03-07 16:03 - 00000952 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1967562993-2040120075-1452459400-1000UA.job2014-07-16 09:13 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\tracing2014-07-16 08:58 - 2011-09-21 15:44 - 00000932 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967562993-2040120075-1452459400-1000UA.job2014-07-16 08:53 - 2014-07-14 14:43 - 00000000 ____D () C:\Users\Jacob Baran\Downloads\antimaterial rifles2014-07-16 02:04 - 2014-07-16 01:12 - 00000000 ____D () C:\Users\Jacob Baran\Desktop\super2014-07-16 01:13 - 2014-07-16 01:13 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\SUPERAntiSpyware.com2014-07-16 01:09 - 2014-07-16 01:08 - 20108152 _____ (SUPERAntiSpyware) C:\Users\Jacob Baran\Downloads\SUPERAntiSpyware.exe2014-07-16 00:58 - 2011-01-23 16:07 - 00000000 ____D () C:\Program Files (x86)\Wizards of the Coast2014-07-16 00:54 - 2012-01-12 00:21 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\{d360cff4-45f2-eff5-25eb-ffb64325adfc}2014-07-16 00:39 - 2014-07-16 00:39 - 00000000 ____D () C:\ProgramData\RogueKiller2014-07-16 00:18 - 2014-07-16 00:18 - 01942776 _____ (Bleeping Computer, LLC) C:\Users\Jacob Baran\Desktop\rkill.exe2014-07-16 00:18 - 2014-07-16 00:02 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)2014-07-16 00:14 - 2011-01-07 16:58 - 00000000 ____D () C:\Program Files (x86)\Steam2014-07-16 00:04 - 2014-07-16 00:04 - 00065232 _____ (Malwarebytes) C:\Users\Jacob Baran\Downloads\regassassin-setup-1.03.exe2014-07-16 00:03 - 2014-07-15 23:52 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP2014-07-16 00:01 - 2014-07-16 00:00 - 14349744 _____ (Malwarebytes Corp.) C:\Users\Jacob Baran\Downloads\mbar-1.07.0.1012.exe2014-07-15 23:55 - 2014-07-15 23:55 - 00000000 _____ () C:\autoexec.bat2014-07-15 23:54 - 2014-07-15 23:54 - 00000000 ____D () C:\Program Files\Enigma Software Group2014-07-15 23:14 - 2014-06-16 18:33 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-07-15 23:14 - 2013-01-13 04:25 - 00000785 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2014-07-15 23:13 - 2014-07-15 23:13 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Jacob Baran\Downloads\mbam-setup-2.0.2.1012.exe2014-07-15 23:07 - 2014-06-17 16:29 - 00000000 ____D () C:\Users\Jacob Baran\Documents\Always Dark2014-07-15 22:52 - 2014-07-14 08:49 - 00003350 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1967562993-2040120075-1452459400-10002014-07-15 22:52 - 2014-07-14 08:49 - 00003228 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1967562993-2040120075-1452459400-10002014-07-15 18:17 - 2014-07-15 18:15 - 00027751 _____ () C:\Users\Jacob Baran\Downloads\Turn 04 Submission - Jacob Baran (1).xlsx2014-07-15 18:15 - 2014-07-15 18:15 - 02122787 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern (4).xlsx2014-07-15 18:05 - 2014-07-15 17:37 - 00000000 ____D () C:\Windows\erdnt2014-07-15 17:58 - 2014-07-14 12:36 - 00595556 _____ () C:\Windows\PFRO.log2014-07-15 17:58 - 2009-07-13 21:34 - 95682560 _____ () C:\Windows\system32\config\software.bak2014-07-15 17:58 - 2009-07-13 21:34 - 25165824 _____ () C:\Windows\system32\config\system.bak2014-07-15 17:58 - 2009-07-13 21:34 - 00786432 _____ () C:\Windows\system32\config\default.bak2014-07-15 17:58 - 2009-07-13 21:34 - 00262144 _____ () C:\Windows\system32\config\security.bak2014-07-15 17:58 - 2009-07-13 21:34 - 00262144 _____ () C:\Windows\system32\config\sam.bak2014-07-15 17:19 - 2014-07-15 17:19 - 00000000 ____D () C:\Windows\ERUNT2014-07-15 17:01 - 2010-07-16 09:59 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\Mozilla2014-07-15 16:58 - 2010-07-14 19:30 - 00000000 ____D () C:\Program Files (x86)\Java2014-07-15 16:55 - 2014-04-01 02:35 - 00000000 ____D () C:\ProgramData\Oracle2014-07-15 16:54 - 2014-07-15 16:54 - 00004145 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b19.log2014-07-15 16:53 - 2014-07-15 16:53 - 00918952 _____ (Oracle Corporation) C:\Users\Jacob Baran\Downloads\chromeinstall-7u65.exe2014-07-15 14:23 - 2012-10-30 14:32 - 00004184 _____ () C:\Windows\System32\Tasks\avast! Emergency Update2014-07-15 14:20 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PLA2014-07-15 13:53 - 2009-07-13 23:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk2014-07-15 13:24 - 2012-10-21 03:14 - 00000000 ____D () C:\ProgramData\xqrzlsqfbsfujpc2014-07-15 12:55 - 2010-06-26 14:13 - 00001935 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk2014-07-15 12:55 - 2010-06-26 14:13 - 00000000 _____ () C:\Windows\SysWOW64\config.nt2014-07-15 12:53 - 2010-06-26 11:09 - 00000000 ____D () C:\Users\Jacob Baran2014-07-15 12:52 - 2010-10-11 16:39 - 00000000 ____D () C:\ProgramData\Aventail2014-07-15 12:51 - 2014-06-11 18:24 - 00000000 ____D () C:\Users\Administrator.Gladius2014-07-15 12:51 - 2011-11-09 14:32 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\Akamai2014-07-15 12:51 - 2011-01-07 17:11 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Steam2014-07-15 12:51 - 2011-01-07 16:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steam2014-07-15 12:51 - 2010-06-26 14:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus2014-07-15 12:51 - 2009-07-14 02:44 - 00000000 ___RD () C:\Users\Public\Recorded TV2014-07-15 12:51 - 2009-07-14 00:32 - 00000000 ____D () C:\Program Files\Windows Defender2014-07-15 12:51 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\registration2014-07-15 12:50 - 2010-06-28 08:11 - 00000000 ____D () C:\ProgramData\Real2014-07-15 12:49 - 2010-06-26 14:13 - 00000000 ____D () C:\Program Files\Alwil Software2014-07-15 11:36 - 2014-07-15 11:36 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\AVAST Software2014-07-15 04:14 - 2013-06-02 23:34 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\Media Player Classic2014-07-15 02:39 - 2014-07-15 02:39 - 00000000 ____D () C:\ProgramData\AVAST Software2014-07-15 02:22 - 2014-07-15 02:22 - 00062310 _____ () C:\Users\Jacob Baran\Downloads\Addition.txt2014-07-15 02:22 - 2014-07-15 02:21 - 00232510 _____ () C:\Users\Jacob Baran\Downloads\FRST.txt2014-07-14 16:29 - 2010-07-10 17:25 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\PMB Files2014-07-14 16:29 - 2010-07-10 17:25 - 00000000 ____D () C:\ProgramData\PMB Files2014-07-14 15:52 - 2014-07-14 15:51 - 02124079 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern (3).xlsx2014-07-14 14:43 - 2010-08-22 22:11 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\Skype2014-07-14 12:36 - 2014-07-14 12:36 - 00000000 _____ () C:\Windows\setuperr.log2014-07-14 12:30 - 2010-06-29 23:19 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\DAEMON Tools Lite2014-07-14 12:30 - 2010-06-28 16:44 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\Azureus2014-07-14 08:52 - 2014-07-14 08:52 - 00021215 _____ () C:\Users\Jacob Baran\Downloads\Turn 04 Submission - Jacob Baran.xlsx2014-07-14 08:50 - 2014-07-14 08:50 - 02643293 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern (2).xlsx2014-07-13 22:52 - 2014-07-13 14:14 - 00000668 _____ () C:\Windows\system32\.crusader2014-07-13 22:42 - 2014-07-13 22:41 - 11185664 _____ (SurfRight B.V.) C:\Users\Jacob Baran\Downloads\HitmanPro_x64 (1).exe2014-07-13 20:12 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache2014-07-13 14:18 - 2010-05-17 20:47 - 00002018 _____ () C:\Windows\system32\ServiceFilter.ini2014-07-13 14:14 - 2014-07-13 13:54 - 00000000 ____D () C:\ProgramData\HitmanPro2014-07-13 13:32 - 2009-07-14 00:13 - 00879912 _____ () C:\Windows\system32\PerfStringBackup.INI2014-07-11 18:25 - 2013-10-28 01:27 - 00000000 ____D () C:\Users\Jacob Baran\Documents\Calibre Library2014-07-11 18:00 - 2013-10-28 01:27 - 00000932 _____ () C:\Users\Public\Desktop\calibre 64bit - E-book management.lnk2014-07-11 18:00 - 2013-10-28 01:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\calibre 64bit - E-book Management2014-07-11 18:00 - 2013-10-28 01:27 - 00000000 ____D () C:\Program Files\Calibre22014-07-11 17:59 - 2014-07-11 17:53 - 61681664 _____ () C:\Users\Jacob Baran\Downloads\calibre-64bit-1.44.0.msi2014-07-11 15:32 - 2010-06-29 23:19 - 00000000 ____D () C:\ProgramData\DAEMON Tools Lite2014-07-11 15:24 - 2010-05-17 20:47 - 00002727 _____ () C:\Windows\system32\AutoRunFilter.ini2014-07-11 15:18 - 2014-07-11 15:18 - 00001956 _____ () C:\Users\Public\Desktop\DAEMON Tools Lite.lnk2014-07-11 15:18 - 2014-07-11 15:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DAEMON Tools Lite2014-07-11 15:18 - 2014-07-11 15:18 - 00000000 ____D () C:\Program Files (x86)\DAEMON Tools Lite2014-07-11 15:18 - 2010-06-29 23:20 - 00386680 _____ (Duplex Secure Ltd.) C:\Windows\system32\Drivers\sptd.sys2014-07-11 12:13 - 2012-03-07 16:03 - 00000930 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1967562993-2040120075-1452459400-1000Core.job2014-07-11 03:27 - 2014-04-01 01:24 - 00000000 ____D () C:\ProgramData\BitRaider2014-07-10 12:27 - 2014-07-10 12:27 - 00000222 _____ () C:\Users\Jacob Baran\Desktop\Awesomenauts.url2014-07-10 01:42 - 2014-05-14 11:10 - 00000000 ____D () C:\Users\Jacob Baran\Documents\Kingdom Hearts2014-07-09 08:52 - 2009-07-14 00:32 - 00000000 ____D () C:\Windows\system32\FxsTmp2014-07-09 08:49 - 2009-07-13 23:45 - 00492632 _____ () C:\Windows\system32\FNTCACHE.DAT2014-07-09 08:46 - 2014-05-06 03:00 - 00000000 ___SD () C:\Windows\system32\CompatTel2014-07-09 08:46 - 2009-07-14 02:45 - 00000000 ____D () C:\Program Files\Windows Journal2014-07-09 08:46 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism2014-07-09 08:46 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\Dism2014-07-09 01:53 - 2010-05-17 20:13 - 00000000 ____D () C:\ProgramData\Microsoft Help2014-07-09 01:51 - 2013-12-15 06:20 - 00000000 ____D () C:\Windows\system32\MRT2014-07-09 01:49 - 2010-06-26 12:56 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2014-07-08 15:28 - 2014-03-17 22:33 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2014-07-08 15:28 - 2012-04-04 09:48 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-07-08 15:28 - 2011-05-15 22:47 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-07-06 15:54 - 2014-07-06 15:54 - 00021154 _____ () C:\Users\Jacob Baran\Downloads\Turn 03 Submission - Jacob Baran.xlsx2014-07-06 15:52 - 2014-07-06 15:52 - 03373994 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern (1).xlsx2014-07-04 14:57 - 2013-12-28 19:08 - 00000722 _____ () C:\Users\Jacob Baran\Desktop\CCleaner.lnk2014-07-04 14:57 - 2011-01-05 22:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner2014-07-04 14:57 - 2010-06-29 23:26 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CCleaner2014-07-02 22:58 - 2010-06-28 08:14 - 00002202 _____ () C:\Users\Jacob Baran\Desktop\remember to read.txt2014-07-01 18:18 - 2014-07-01 17:44 - 00032723 _____ () C:\Users\Jacob Baran\Downloads\Turn 02 Submission - Jacob Baran.xlsx2014-06-30 10:58 - 2011-09-21 15:44 - 00000880 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1967562993-2040120075-1452459400-1000Core.job2014-06-29 21:09 - 2014-07-08 15:51 - 00519168 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2014-06-29 21:04 - 2014-07-08 15:51 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2014-06-29 13:39 - 2014-06-29 13:39 - 02850830 _____ () C:\Users\Jacob Baran\Downloads\Jacob Baran - Azoth Stern.xlsx2014-06-28 11:38 - 2014-06-28 11:38 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\Adobe2014-06-27 15:29 - 2014-06-27 15:29 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Local\BigHugeEngine2014-06-27 14:07 - 2014-06-27 14:07 - 00000000 ____D () C:\Users\Jacob Baran\Documents\Reus2014-06-27 11:35 - 2014-06-27 11:35 - 00000222 _____ () C:\Users\Jacob Baran\Desktop\Kingdoms of Amalur Reckoning.url2014-06-24 00:41 - 2014-06-24 00:34 - 00000000 ____D () C:\Users\Jacob Baran\Documents\PlanetExplorers2014-06-23 01:41 - 2014-06-23 01:41 - 00002039 _____ () C:\Users\Public\Desktop\Hi-Rez Diagnostics and Support.lnk2014-06-23 01:41 - 2014-06-23 01:41 - 00002030 _____ () C:\Users\Public\Desktop\Smite.lnk2014-06-23 01:41 - 2014-06-23 01:41 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios2014-06-23 01:41 - 2013-11-19 01:55 - 00000000 ____D () C:\ProgramData\Hi-Rez Studios2014-06-23 01:41 - 2013-11-19 01:55 - 00000000 ____D () C:\Program Files (x86)\Hi-Rez Studios2014-06-23 01:41 - 2010-05-17 20:25 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information2014-06-23 01:40 - 2014-06-23 01:39 - 39967251 _____ (Hi-Rez Studios) C:\Users\Jacob Baran\Downloads\InstallHiRezGamesEnglish (1).exe2014-06-21 19:50 - 2011-01-07 18:30 - 00000000 ____D () C:\Users\Jacob Baran\Documents\My Games2014-06-21 12:34 - 2014-06-21 12:34 - 00019264 _____ () C:\Users\Jacob Baran\Downloads\Turn_01_Submission_-_Jacob_Baran.xlsx2014-06-21 12:33 - 2014-06-21 12:33 - 03280153 _____ () C:\Users\Jacob Baran\Downloads\Jacob_Baran_-_Azoth_Stern (1).xlsx2014-06-20 15:14 - 2014-07-08 15:50 - 00266424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-06-20 14:39 - 2014-07-08 15:50 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-06-18 20:39 - 2014-07-08 15:50 - 23464448 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-06-18 20:06 - 2014-07-08 15:50 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-06-18 20:06 - 2014-07-08 15:50 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2014-06-18 19:48 - 2014-07-08 15:50 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-06-18 19:42 - 2014-07-08 15:50 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-06-18 19:42 - 2014-07-08 15:50 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-06-18 19:41 - 2014-07-08 15:50 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2014-06-18 19:41 - 2014-07-08 15:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2014-06-18 19:32 - 2014-07-08 15:50 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-06-18 19:31 - 2014-07-08 15:50 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-06-18 19:26 - 2014-07-08 15:50 - 00598016 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-06-18 19:24 - 2014-07-08 15:50 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-06-18 19:24 - 2014-07-08 15:50 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2014-06-18 19:23 - 2014-07-08 15:50 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2014-06-18 19:16 - 2014-07-08 15:50 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-06-18 19:14 - 2014-07-08 15:50 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2014-06-18 19:09 - 2014-07-08 15:50 - 00452608 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-06-18 18:59 - 2014-07-08 15:50 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2014-06-18 18:56 - 2014-07-08 15:50 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-06-18 18:53 - 2014-07-08 15:50 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2014-06-18 18:51 - 2014-07-08 15:50 - 05721088 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-06-18 18:50 - 2014-07-08 15:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-06-18 18:48 - 2014-07-08 15:50 - 00292864 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-06-18 18:39 - 2014-07-08 15:50 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-06-18 18:38 - 2014-07-08 15:50 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-06-18 18:37 - 2014-07-08 15:50 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-06-18 18:36 - 2014-07-08 15:50 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2014-06-18 18:35 - 2014-07-08 15:50 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2014-06-18 18:33 - 2014-07-08 15:50 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-06-18 18:32 - 2014-07-08 15:50 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-06-18 18:28 - 2014-07-08 15:50 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-06-18 18:28 - 2014-07-08 15:50 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-06-18 18:27 - 2014-07-08 15:50 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-06-18 18:27 - 2014-07-08 15:50 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2014-06-18 18:25 - 2014-07-08 15:50 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-06-18 18:23 - 2014-07-08 15:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-06-18 18:22 - 2014-07-08 15:50 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2014-06-18 18:12 - 2014-07-08 15:50 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-06-18 18:06 - 2014-07-08 15:50 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2014-06-18 18:01 - 2014-07-08 15:50 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2014-06-18 17:59 - 2014-07-08 15:50 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-06-18 17:58 - 2014-07-08 15:50 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-06-18 17:58 - 2014-07-08 15:50 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-06-18 17:52 - 2014-07-08 15:50 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-06-18 17:51 - 2014-07-08 15:50 - 13527040 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-06-18 17:49 - 2014-07-08 15:50 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-06-18 17:46 - 2014-07-08 15:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2014-06-18 17:45 - 2014-07-08 15:50 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-06-18 17:35 - 2014-07-08 15:50 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-06-18 17:34 - 2014-07-08 15:50 - 01393664 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-06-18 17:15 - 2014-07-08 15:50 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-06-18 17:13 - 2014-07-08 15:50 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-06-18 17:09 - 2014-07-08 15:50 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-06-18 17:07 - 2014-07-08 15:50 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-06-17 21:18 - 2014-07-08 15:50 - 00692736 _____ (Microsoft Corporation) C:\Windows\system32\osk.exe2014-06-17 20:51 - 2014-07-08 15:50 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe2014-06-17 20:10 - 2014-07-08 15:50 - 03157504 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-06-17 16:37 - 2014-06-17 16:37 - 00015041 _____ () C:\Users\Jacob Baran\Downloads\Action List.xlsx2014-06-17 16:27 - 2014-06-17 16:26 - 02529875 _____ () C:\Users\Jacob Baran\Downloads\Jacob_Baran_-_Azoth_Stern.xlsx2014-06-17 16:22 - 2014-06-17 16:22 - 00356792 _____ () C:\Users\Jacob Baran\Downloads\Turn 00 Workbook.xlsx2014-06-17 13:47 - 2011-12-18 22:29 - 00000000 ___RD () C:\Program Files (x86)\Skype2014-06-17 13:47 - 2010-08-22 22:10 - 00000000 ____D () C:\ProgramData\Skype2014-06-16 21:35 - 2012-03-18 23:23 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\RealNetworks2014-06-16 21:31 - 2014-06-16 21:31 - 00001046 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk2014-06-16 21:31 - 2014-06-16 21:31 - 00000000 ____D () C:\ProgramData\RealNetworks2014-06-16 21:31 - 2014-06-16 21:31 - 00000000 ____D () C:\Program Files (x86)\RealNetworks2014-06-16 21:31 - 2013-01-07 01:58 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks2014-06-16 21:30 - 2014-03-30 04:22 - 00505416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcp71.dll2014-06-16 21:30 - 2014-03-30 04:22 - 00353864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll2014-06-16 21:30 - 2014-03-30 04:22 - 00278600 _____ (Progressive Networks) C:\Windows\SysWOW64\pncrt.dll2014-06-16 21:30 - 2014-03-30 04:22 - 00201800 _____ (RealNetworks, Inc.) C:\Windows\SysWOW64\rmoc3260.dll2014-06-16 18:35 - 2011-12-08 22:30 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\Malwarebytes2014-06-16 18:33 - 2014-06-16 18:33 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-06-16 18:33 - 2012-06-21 12:50 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware2014-06-16 18:33 - 2011-12-08 22:30 - 00000000 ____D () C:\ProgramData\Malwarebytes2014-06-16 18:12 - 2014-04-27 14:34 - 00000000 ____D () C:\Users\Jacob Baran\AppData\Roaming\SpaceEngineers Files to move or delete:====================C:\ProgramData\hash.datC:\Users\Jacob Baran\jagex_cl_runescape_LIVE.datC:\Users\Jacob Baran\jagex_runescape_preferences.datC:\Users\Jacob Baran\jagex_runescape_preferences2.datC:\Users\Jacob Baran\jagex__preferences3.dat ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-08 15:09 ==================== End Of Log ============================ Link to post Share on other sites More sharing options...
jb1321 Posted July 17, 2014 Author ID:854156 Share Posted July 17, 2014 My roommate found he had the same infection, and we think we traced it back to our router. After resetting the router to factory settings, we are no longer getting popups. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted August 22, 2014 Root Admin ID:869674 Share Posted August 22, 2014 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts