MSB13 Posted July 21, 2014 ID:855812 Share Posted July 21, 2014 I have run several scans but still get popups on many browser windows. Please help me get rid of unwanted junk. - thanks The FRST file is below:Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-07-2014 01Ran by markb_000 (administrator) on ACCELARE_8F9 on 21-07-2014 12:44:19Running from C:\Users\markb_000\DesktopPlatform: Windows 8.1 (X64) OS Language: English (United States)Internet Explorer Version 11Boot Mode: Normal The only official download link for FRST:Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated.See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe(ASUS) C:\Program Files\ASUS\P4G\InsOnSrv.exe() C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe(Microsoft Corporation) C:\Windows\System32\dasHost.exe(Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe(ASUS) C:\Program Files\ASUS\P4G\InsOnWMI.exe(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SynptSync64.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS VivoBook\vivokey.exe(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe(ASUSTek Computer INC.) C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(Intel Corporation) C:\Windows\System32\igfxsrvc.exe(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe(Microsoft) C:\Users\markb_000\AppData\Local\Apps\2.0\HTPZ00X9.D6A\X7WBDVLZ.PM5\yamm..tion_c3bce3770c238a49_0001.0000_5370e5be369b498b\Yammer.Notifier.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\EXCEL.EXE(Microsoft Corporation) C:\Windows\splwow64.exe(Microsoft Corporation) C:\Windows\System32\mstsc.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe(Microsoft Corporation) C:\Program Files\Windows Defender\MpCmdRun.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe(Hewlett-Packard Development Company, L.P.) C:\Users\markb_000\AppData\Local\HP\ALM-Client\ahp0516\ALM-Client.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\lync.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\UcMapi.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [27024 2013-01-18] (Intel Corporation)HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13263072 2012-12-12] (Realtek Semiconductor)HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1257184 2012-12-12] (Realtek Semiconductor)HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2013-05-01] (ASUSTek Computer Inc.)HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe [3576784 2012-12-19] (ASUS Cloud Corporation)HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-07-03] (RealNetworks, Inc.)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)HKLM-x32\...\RunOnce: [Malwarebytes Anti-Malware (cleanup)] - "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware\mbamdor.exe" "C:\ProgramData\Malwarebytes\Malwarebytes Anti-Malware" [54072 2014-05-12] (Malwarebytes Corporation)Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)HKLM\...\Policies\Explorer\Run: [btvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [131712 2013-01-25] ( (Qualcomm Atheros Commnucations))HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Lync] => C:\Program Files\Microsoft Office 15\root\office15\lync.exe [18997408 2014-06-20] (Microsoft Corporation)HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [skyDrive] => C:\Users\markb_000\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257224 2014-05-15] (Microsoft Corporation)HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Office Timeline Performance Helper] => C:\Program Files (x86)\OfficeTimeline2013\OfficeTimelineStartup.exe [17152 2014-03-25] (OfficeTimeline LLC)HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Yammer Notifier] => C:\Users\markb_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Corporation\Yammer\Yammer Notifier.appref-ms silentHKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [GoToMeeting] => C:\Users\markb_000\AppData\Local\Citrix\GoToMeeting\1350\g2mstart.exe [40304 2014-03-11] (Citrix Online, a division of Citrix Systems, Inc.)HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\MountPoints2: {17ce6ba3-8e21-11e3-be83-240a64480402} - "E:\VZW_Software_upgrade_assistant.exe" AppInit_DLLs: C:\PROGRA~2\GS_X64~1.ENA => C:\Program Files (x86)\GS_x64.Enabler [2759168 2014-01-14] ()Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnkShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (RealNetworks, Inc.)Startup: C:\Users\markb_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnkShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No FileShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No FileShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No FileShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers: !AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: !AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: !AsusWSShellExt_U -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No FileShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No FileShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No FileShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No FileShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.comHKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JSSearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JSSearchScopes: HKLM-x32 - DefaultScope value is missing.SearchScopes: HKLM-x32 - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01SearchScopes: HKLM-x32 - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}SearchScopes: HKCU - DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll (RealDownloader)BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)BHO: No Name -> {433450CD-9515-34D1-FB34-59ED33BC499F} -> No FileBHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)BHO-x32: No Name -> {433450CD-9515-34D1-FB34-59ED33BC499F} -> No FileBHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)DPF: HKLM-x32 {EBF1BFCB-F60B-4DCB-9C96-E53C543CB645} http://ahp0516:8080/qcbin/ALM-Platform-Loader.11.cabDPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cabHandler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)Tcpip\Parameters: [DhcpNameServer] 172.25.0.92 172.25.0.95 172.29.0.60 172.29.0.65 FireFox:========FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @real.com/nppl3260;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpplugin;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\markb_000\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)FF Plugin ProgramFiles/Appdata: C:\Users\markb_000\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)FF HKLM-x32\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-07-03] Chrome: =======CHR HomePage: hxxp://www.msn.com/?pc=AV01CHR StartupUrls: "https://www.google.com/"CHR Extension: (Google Docs) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-02]CHR Extension: (Google Drive) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-02]CHR Extension: (YouTube) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-02]CHR Extension: (Google Search) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-02]CHR Extension: (PSdrunner) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhiclajnaaecdmfpbonaomipadfjjale [2014-04-29]CHR Extension: (Best Save) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gecgipfabdickgidpmbicneamekgbaej [2014-01-13]CHR Extension: (RealPlayer Downloader) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-01-13]CHR Extension: (YTBookaMark) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\jamidkfmgekehonmdfjpopiigaejmifp [2014-01-13]CHR Extension: (Google Wallet) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-02]CHR Extension: (Gmail) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-02]CHR Extension: (YTBookaMark) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\jamidkfmgekehonmdfjpopiigaejmifp\1.1 [2014-01-13]CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10]CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTIONCHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 ASUS InstantOn; C:\Program Files\ASUS\P4G\InsOnSrv.exe [277120 2013-03-26] (ASUS)R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [72192 2012-12-19] () [File not signed]R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [227456 2013-01-25] (Qualcomm Atheros Commnucations)R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)R2 DptfParticipantProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [31632 2013-01-18] (Intel Corporation)R2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [33168 2013-01-18] (Intel Corporation)R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [39824 2013-01-18] (Intel Corporation)R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation)R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193576 2012-07-30] (Intel Corporation)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)S3 McAWFwk; C:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-24] (McAfee, Inc.)S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed]S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed]R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-07-03] (RealNetworks, Inc.)R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-10] () [File not signed]R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation)R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation)R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-01-25] (Atheros) [File not signed] ==================== Drivers (Whitelisted) ==================== S3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-04-16] (ASUS Corporation)S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-25] (Qualcomm Atheros)R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)R3 DptfDevDram; C:\Windows\system32\DRIVERS\DptfDevDram.sys [107920 2013-01-18] (Intel Corporation)R3 DptfDevFan; C:\Windows\system32\DRIVERS\DptfDevFan.sys [43408 2013-01-18] (Intel Corporation)R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [65424 2013-01-18] (Intel Corporation)R3 DptfDevPch; C:\Windows\system32\DRIVERS\DptfDevPch.sys [97680 2013-01-18] (Intel Corporation)R3 DptfDevProc; C:\Windows\system32\DRIVERS\DptfDevProc.sys [229776 2013-01-18] (Intel Corporation)R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [363920 2013-01-18] (Intel Corporation)R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation)R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation)R3 irstrtdv; C:\Windows\System32\drivers\irstrtdv.sys [43800 2012-07-30] (Intel Corporation)R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-01] ( )U0 louh; C:\Windows\System32\drivers\odovsqev.sys [79064 2014-07-13] (Malwarebytes Corporation)R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-13] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [18304 2013-03-26] (ASUSTek Computer Inc.)U0 ptvevf; C:\Windows\System32\drivers\ywxci.sys [79064 2014-07-13] (Malwarebytes Corporation)R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated)R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-21 11:45 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll2014-07-21 11:45 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe2014-07-21 11:45 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe2014-07-21 11:45 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe2014-07-21 11:43 - 2014-07-21 11:45 - 00004116 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_65-b20.log2014-07-15 17:52 - 2014-07-15 17:52 - 00000000 ___SH () C:\DkHyperbootSync2014-07-15 15:43 - 2014-07-15 15:46 - 00039429 _____ () C:\Users\markb_000\Desktop\Addition.txt2014-07-15 15:39 - 2014-07-21 12:44 - 00027313 _____ () C:\Users\markb_000\Desktop\FRST.txt2014-07-15 15:38 - 2014-07-21 12:45 - 00000000 ____D () C:\FRST2014-07-15 15:34 - 2014-07-15 15:34 - 02086912 _____ (Farbar) C:\Users\markb_000\Desktop\FRST64.exe2014-07-13 11:07 - 2014-07-13 11:07 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\odovsqev.sys2014-07-13 09:57 - 2014-07-13 09:57 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\ywxci.sys2014-07-12 15:43 - 2014-07-12 15:44 - 00167054 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1 (1).xlsx2014-07-10 08:06 - 2014-06-26 16:55 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe2014-07-10 08:06 - 2014-06-26 16:55 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl2014-07-10 08:03 - 2014-07-10 08:03 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel2014-07-10 02:35 - 2014-04-13 23:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll2014-07-10 02:16 - 2014-06-18 21:39 - 23464448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll2014-07-10 02:16 - 2014-06-18 20:16 - 17276416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll2014-07-10 02:16 - 2014-06-18 19:46 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll2014-07-10 02:16 - 2014-06-18 18:57 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll2014-07-10 02:16 - 2014-06-16 18:26 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\osk.exe2014-07-10 02:16 - 2014-06-16 18:24 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe2014-07-10 02:16 - 2014-06-06 10:20 - 04190720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys2014-07-10 02:15 - 2014-06-18 20:48 - 02768384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll2014-07-10 02:15 - 2014-06-18 20:09 - 00452608 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll2014-07-10 02:15 - 2014-06-18 19:51 - 05721088 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll2014-07-10 02:15 - 2014-06-18 19:50 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll2014-07-10 02:15 - 2014-06-18 19:48 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll2014-07-10 02:15 - 2014-06-18 19:39 - 00608768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe2014-07-10 02:15 - 2014-06-18 19:33 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll2014-07-10 02:15 - 2014-06-18 19:32 - 02179072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll2014-07-10 02:15 - 2014-06-18 19:27 - 02040832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl2014-07-10 02:15 - 2014-06-18 19:12 - 00367616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll2014-07-10 02:15 - 2014-06-18 18:59 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll2014-07-10 02:15 - 2014-06-18 18:58 - 02266112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll2014-07-10 02:15 - 2014-06-18 18:58 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll2014-07-10 02:15 - 2014-06-18 18:52 - 04254720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll2014-07-10 02:15 - 2014-06-18 18:51 - 13527040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll2014-07-10 02:15 - 2014-06-18 18:49 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll2014-07-10 02:15 - 2014-06-18 18:45 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl2014-07-10 02:15 - 2014-06-18 18:35 - 11742208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll2014-07-10 02:15 - 2014-06-18 18:34 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll2014-07-10 02:15 - 2014-06-18 18:15 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll2014-07-10 02:15 - 2014-06-18 18:13 - 01791488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll2014-07-10 02:15 - 2014-06-18 18:09 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll2014-07-10 02:15 - 2014-06-18 18:07 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll2014-07-10 02:15 - 2014-06-06 09:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll2014-07-10 02:15 - 2014-06-06 08:18 - 00488960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll2014-07-10 02:15 - 2014-05-29 23:03 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys2014-07-10 02:15 - 2014-05-29 08:02 - 00565576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys2014-07-10 02:15 - 2014-05-29 03:55 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll2014-07-10 02:15 - 2014-05-29 02:40 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll2014-07-10 02:15 - 2014-05-29 02:37 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll2014-07-10 02:15 - 2014-05-29 01:34 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll2014-07-10 02:15 - 2014-05-29 01:27 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll2014-07-10 02:14 - 2014-06-30 18:45 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll2014-07-10 02:14 - 2014-06-28 03:48 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll2014-07-10 02:14 - 2014-06-28 03:07 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll2014-07-10 02:14 - 2014-05-30 23:40 - 13287936 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll2014-07-10 02:14 - 2014-05-30 22:36 - 00923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll2014-07-10 02:14 - 2014-05-30 22:32 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll2014-07-10 02:13 - 2014-05-31 06:07 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe2014-07-10 02:13 - 2014-05-31 06:06 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll2014-07-10 02:13 - 2014-05-30 23:30 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll2014-07-10 02:13 - 2014-05-30 23:12 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll2014-07-10 02:13 - 2014-05-30 23:06 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll2014-07-10 02:13 - 2014-05-30 23:03 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll2014-07-10 02:13 - 2014-05-30 23:01 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll2014-07-10 02:13 - 2014-05-30 22:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll2014-07-10 02:13 - 2014-05-30 22:54 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll2014-07-10 02:13 - 2014-05-30 22:48 - 03463680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll2014-07-10 02:13 - 2014-05-30 22:37 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll2014-07-10 02:13 - 2014-05-30 22:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll2014-07-10 02:06 - 2014-07-10 02:06 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe2014-07-03 17:25 - 2014-07-03 17:25 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\RealNetworks2014-07-03 12:23 - 2014-07-03 12:23 - 00001058 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk2014-07-03 12:23 - 2014-07-03 12:23 - 00000000 ____D () C:\Program Files (x86)\RealNetworks2014-07-03 12:22 - 2014-07-03 12:22 - 00000000 ____D () C:\ProgramData\RealNetworks2014-07-03 12:18 - 2014-07-16 14:25 - 00003356 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-03 12:18 - 2014-07-16 14:25 - 00003302 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-02 10:11 - 2014-07-02 10:21 - 924643538 _____ () C:\Users\markb_000\Desktop\Magura+Final+Slideshow-HD.mp42014-06-23 14:01 - 2014-06-23 14:01 - 00000000 ____D () C:\Users\markb_000\AppData\Local\HP ==================== One Month Modified Files and Folders ======= 2014-07-21 12:47 - 2013-12-02 17:32 - 00000930 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job2014-07-21 12:46 - 2014-07-15 15:39 - 00027313 _____ () C:\Users\markb_000\Desktop\FRST.txt2014-07-21 12:45 - 2014-07-15 15:38 - 00000000 ____D () C:\FRST2014-07-21 12:07 - 2014-02-10 15:06 - 00000612 _____ () C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-1002.job2014-07-21 12:02 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\sru2014-07-21 12:00 - 2013-12-01 19:12 - 00005004 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for ACCELARE_8F9-markb_000 ACCELARE_8F92014-07-21 11:58 - 2013-12-19 10:31 - 01246050 _____ () C:\WINDOWS\WindowsUpdate.log2014-07-21 11:57 - 2013-11-27 16:51 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3360600101-872847150-3038642983-10022014-07-21 11:47 - 2014-01-04 21:11 - 00000000 ____D () C:\ProgramData\Oracle2014-07-21 11:45 - 2014-07-21 11:43 - 00004116 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_65-b20.log2014-07-21 11:45 - 2014-01-04 21:11 - 00000000 ____D () C:\Program Files (x86)\Java2014-07-21 11:40 - 2013-12-19 10:57 - 00003814 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{BED9303B-00AE-447C-A08C-276597FF66A7}2014-07-18 09:54 - 2013-11-27 16:44 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Packages2014-07-18 08:47 - 2013-12-02 17:32 - 00000926 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job2014-07-18 00:56 - 2014-01-12 22:50 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\vlc2014-07-17 13:53 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\FxsTmp2014-07-17 13:44 - 2013-08-22 10:46 - 00341078 _____ () C:\WINDOWS\setupact.log2014-07-17 09:14 - 2014-04-02 08:24 - 00003378 _____ () C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-17 09:14 - 2014-04-02 08:24 - 00003324 _____ () C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-16 14:25 - 2014-07-03 12:18 - 00003356 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-16 14:25 - 2014-07-03 12:18 - 00003302 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-16 10:14 - 2014-01-13 15:11 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Deployment2014-07-15 17:52 - 2014-07-15 17:52 - 00000000 ___SH () C:\DkHyperbootSync2014-07-15 15:46 - 2014-07-15 15:43 - 00039429 _____ () C:\Users\markb_000\Desktop\Addition.txt2014-07-15 15:35 - 2013-12-19 10:54 - 00000000 ____D () C:\Users\markb_000\Downloads\Cleaning2014-07-15 15:34 - 2014-07-15 15:34 - 02086912 _____ (Farbar) C:\Users\markb_000\Desktop\FRST64.exe2014-07-14 20:24 - 2013-11-14 03:28 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI2014-07-14 17:02 - 2014-01-13 18:32 - 00002294 ____H () C:\Users\markb_000\Documents\Default.rdp2014-07-13 12:11 - 2014-04-29 17:19 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys2014-07-13 11:07 - 2014-07-13 11:07 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\odovsqev.sys2014-07-13 11:07 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\L2Schemas2014-07-13 09:57 - 2014-07-13 09:57 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\ywxci.sys2014-07-12 15:44 - 2014-07-12 15:43 - 00167054 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1 (1).xlsx2014-07-11 03:02 - 2014-07-21 11:45 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll2014-07-11 02:56 - 2014-07-21 11:45 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe2014-07-11 02:56 - 2014-07-21 11:45 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe2014-07-11 02:55 - 2014-07-21 11:45 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe2014-07-11 02:52 - 2013-12-01 19:15 - 00000000 __RDO () C:\Users\markb_000\SkyDrive2014-07-10 11:40 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\rescache2014-07-10 08:10 - 2014-01-14 16:08 - 00003474 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update12014-07-10 08:10 - 2014-01-14 16:08 - 00003464 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update22014-07-10 08:08 - 2013-12-02 17:33 - 00002165 _____ () C:\Users\Public\Desktop\Google Chrome.lnk2014-07-10 08:08 - 2013-11-27 16:44 - 00000062 _____ () C:\Users\markb_000\AppData\Roaming\sp_data.sys2014-07-10 08:06 - 2013-08-22 10:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT2014-07-10 08:06 - 2013-08-22 10:44 - 00474072 _____ () C:\WINDOWS\system32\FNTCACHE.DAT2014-07-10 08:05 - 2013-11-14 03:20 - 00408344 _____ () C:\WINDOWS\PFRO.log2014-07-10 08:04 - 2013-08-22 09:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI2014-07-10 08:03 - 2014-07-10 08:03 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel2014-07-10 08:03 - 2013-11-14 03:17 - 00000000 ____D () C:\Program Files\Windows Journal2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ToastData2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\WinStore2014-07-10 02:48 - 2012-07-26 03:59 - 00000000 ____D () C:\WINDOWS\CbsTemp2014-07-10 02:45 - 2013-11-21 17:13 - 00000000 ____D () C:\WINDOWS\system32\MRT2014-07-10 02:38 - 2013-11-21 17:13 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe2014-07-10 02:38 - 2013-08-22 10:46 - 00000440 _____ () C:\WINDOWS\setuperr.log2014-07-10 02:06 - 2014-07-10 02:06 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe2014-07-09 21:17 - 2013-11-27 16:48 - 00000000 ____D () C:\Users\markb_000\AppData\Local\CrashDumps2014-07-09 15:17 - 2014-04-11 12:53 - 00171617 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1.xlsx2014-07-09 14:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\Help2014-07-09 14:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\addins2014-07-09 14:12 - 2012-07-26 04:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP2014-07-08 16:28 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM2014-07-08 15:51 - 2014-02-10 15:06 - 00003628 _____ () C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-10022014-07-03 17:25 - 2014-07-03 17:25 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\RealNetworks2014-07-03 12:55 - 2012-07-26 04:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports2014-07-03 12:23 - 2014-07-03 12:23 - 00001058 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk2014-07-03 12:23 - 2014-07-03 12:23 - 00000000 ____D () C:\Program Files (x86)\RealNetworks2014-07-03 12:23 - 2014-01-12 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks2014-07-03 12:22 - 2014-07-03 12:22 - 00000000 ____D () C:\ProgramData\RealNetworks2014-07-03 12:22 - 2014-01-12 22:45 - 00000000 ____D () C:\Program Files (x86)\Real2014-07-03 12:21 - 2014-04-02 08:18 - 00278600 _____ (Progressive Networks) C:\WINDOWS\SysWOW64\pncrt.dll2014-07-03 12:21 - 2014-04-02 08:18 - 00201800 _____ (RealNetworks, Inc.) C:\WINDOWS\SysWOW64\rmoc3260.dll2014-07-03 12:21 - 2014-01-12 22:43 - 00000000 ____D () C:\ProgramData\Real2014-07-03 12:20 - 2014-04-02 08:18 - 00505416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll2014-07-03 12:20 - 2014-04-02 08:18 - 00353864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll2014-07-03 12:06 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\NDF2014-07-02 10:21 - 2014-07-02 10:11 - 924643538 _____ () C:\Users\markb_000\Desktop\Magura+Final+Slideshow-HD.mp42014-07-02 09:00 - 2013-12-01 19:18 - 00000000 ____D () C:\Users\markb_000\Documents\Admin2014-07-01 16:24 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\Web2014-06-30 18:45 - 2014-07-10 02:14 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll2014-06-28 03:48 - 2014-07-10 02:14 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll2014-06-28 03:07 - 2014-07-10 02:14 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll2014-06-26 16:55 - 2014-07-10 08:06 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe2014-06-26 16:55 - 2014-07-10 08:06 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl2014-06-25 21:43 - 2014-05-21 11:00 - 00000000 ____D () C:\Users\markb_000\Documents\OneNote Notebooks2014-06-24 11:54 - 2014-06-09 08:43 - 00002990 _____ () C:\WINDOWS\System32\Tasks\Synaptics TouchPad Enhancements2014-06-23 14:01 - 2014-06-23 14:01 - 00000000 ____D () C:\Users\markb_000\AppData\Local\HP2014-06-23 12:01 - 2014-02-12 14:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 20132014-06-21 23:05 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel2014-06-21 22:30 - 2013-11-27 16:58 - 00000000 ____D () C:\Program Files\Microsoft Office 152014-06-21 08:41 - 2014-06-09 13:23 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Windows Live Files to move or delete:====================C:\ProgramData\SetStretch.exeC:\ProgramData\SetStretch.VBS Some content of TEMP:====================C:\Users\markb_000\AppData\Local\Temp\DseShExt-x64.dllC:\Users\markb_000\AppData\Local\Temp\DseShExt-x86.dllC:\Users\markb_000\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exeC:\Users\markb_000\AppData\Local\Temp\lowproc.exeC:\Users\markb_000\AppData\Local\Temp\neoNCSetup64.exeC:\Users\markb_000\AppData\Local\Temp\OfficeSetup.exeC:\Users\markb_000\AppData\Local\Temp\Quarantine.exeC:\Users\markb_000\AppData\Local\Temp\SCC.dllC:\Users\markb_000\AppData\Local\Temp\SDShelEx-win32.dllC:\Users\markb_000\AppData\Local\Temp\SDShelEx-x64.dllC:\Users\markb_000\AppData\Local\Temp\stubhelper.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-21 11:57 ==================== End Of Log ============================ The Addition file is here: This is a little older because I have scanned twice Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-07-2014 01Ran by markb_000 at 2014-07-15 15:43:16Running from C:\Users\markb_000\DesktopBoot Mode: Normal========================================================== ==================== Security Center ======================== AV: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} ==================== Installed Programs ====================== ASUS VivoBook (HKLM\...\{04FDBE69-F9FD-42A2-9008-E5CE7F60C6BE}) (Version: 1.0.28 - ASUS)64 Bit HP CIO Components Installer (Version: 7.2.4 - Hewlett-Packard) HiddenAdobe Reader X (10.1.10) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.10 - Adobe Systems Incorporated)Alcor Micro USB Card Reader (HKLM-x32\...\AmUStor) (Version: 3.9.145.62246 - Alcor Micro Corp.)Alcor Micro USB Card Reader (x32 Version: 3.9.145.62246 - Alcor Micro Corp.) HiddenASUS Live Update (HKLM-x32\...\{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}) (Version: 3.2.5 - ASUS)ASUS Power4Gear Hybrid (HKLM\...\{9B6239BF-4E85-4590-8D72-51E30DB1A9AA}) (Version: 3.0.1 - ASUS)ASUS S Series Product Demo (HKLM-x32\...\{387AA3E2-B9FE-4DA1-A097-A0D2213E8794}) (Version: 1.0.0 - ASUS)ASUS Screen Saver (HKLM\...\{0FBEEDF8-30FA-4FA3-B31F-C9C7E7E8DFA2}) (Version: 1.0.1 - ASUS)ASUS Splendid Video Enhancement Technology (HKLM-x32\...\{0969AF05-4FF6-4C00-9406-43599238DE0D}) (Version: 2.01.0005 - ASUS)ASUS USB Charger Plus (HKLM-x32\...\{A859E3E5-C62F-4BFA-AF1D-2B95E03166AF}) (Version: 2.1.5 - ASUS)ASUS WebStorage Sync Agent (HKLM-x32\...\ASUS WebStorage) (Version: 1.1.18.159 - ASUS Cloud Corporation)AsusVibe2.0 (HKLM-x32\...\Asus Vibe2.0) (Version: 2.0.12.309 - ASUSTEK)Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.7 - Atheros Communications Inc.)ATK Package (HKLM-x32\...\{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}) (Version: 1.0.0028 - ASUS)Camtasia Studio 8 (HKLM-x32\...\{A7727F03-5311-4A12-9A63-2ACD20BA0497}) (Version: 8.2.1.1423 - TechSmith Corporation)Cisco WebEx Meetings (HKCU\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)Citrix Online Launcher (HKLM-x32\...\{AC7E7905-8C59-4806-A96D-30936A2B1FC5}) (Version: 1.0.168 - Citrix)D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenExpressCache (HKLM\...\{2EBEFDA8-F905-4C39-AC1C-D5ABE7B3E0AE}) (Version: 1.0.86 - Diskeeper Corporation)Galería de fotos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenGalerie de photos (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenGoogle Chrome (HKLM-x32\...\Google Chrome) (Version: 32.0.1700.102 - Google Inc.)Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) HiddenGoToMeeting 6.3.0.1468 (HKCU\...\GoToMeeting) (Version: 6.3.0.1468 - CitrixOnline)Intel® Dynamic Platform and Thermal Framework (HKLM-x32\...\FFD10ECE-F715-4a86-9BD8-F6F47DA5DA1C) (Version: 6.0.7.1084 - Intel Corporation)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.1.0.1252 - Intel Corporation)Intel® Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 10.18.10.3308 - Intel Corporation)Intel® Rapid Start Technology (HKLM-x32\...\3D073343-CEEB-4ce7-85AC-A69A7631B5D6) (Version: 2.1.0.1002 - Intel Corporation)Intel® SDK for OpenCL - CPU Only Runtime Package (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)Intel® Trusted Connect Service Client (Version: 1.24.388.1 - Intel Corporation) HiddenJava 7 Update 51 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86417051FF}) (Version: 7.0.510 - Oracle)Java 7 Update 51 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.510 - Oracle)Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) HiddenJuniper Networks Network Connect 7.1.10 (HKLM-x32\...\Juniper Network Connect 7.1.10) (Version: 7.1.10.21187 - Juniper Networks)Juniper Networks, Inc. Setup Client (HKCU\...\Juniper_Setup_Client) (Version: 7.1.10.21853 - Juniper Networks, Inc.)Juniper Networks, Inc. Setup Client Activex Control (HKLM-x32\...\Juniper_Setup_Client Activex Control) (Version: 2.1.1.1 - Juniper Networks, Inc.)Juniper Terminal Services Client (HKCU\...\Juniper_Term_Services) (Version: 7.1.10.21187 - Juniper Networks)Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) HiddenMicrosoft Office 365 ProPlus - en-us (HKLM\...\O365ProPlusRetail - en-us) (Version: 15.0.4623.1003 - Microsoft Corporation)Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.0.4041.0512 - Microsoft Corporation)Microsoft Project Professional 2013 - en-us (HKLM\...\ProjectProRetail - en-us) (Version: 15.0.4623.1003 - Microsoft Corporation)Microsoft SharePoint Designer 2013 - en-us (HKLM\...\SPDRetail - en-us) (Version: 15.0.4623.1003 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visio Professional 2013 - en-us (HKLM\...\VisioProRetail - en-us) (Version: 15.0.4623.1003 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50325 - Microsoft Corporation)Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.50330 - Microsoft Corporation) HiddenMovie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenMSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) HiddenMSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) HiddenMSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) HiddenMyBitCast 2.0 (HKLM-x32\...\MyBitCast) (Version: 2.0 - ASUS)Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Licensing Component (Version: 15.0.4623.1003 - Microsoft Corporation) HiddenOffice 15 Click-to-Run Localization Component (x32 Version: 15.0.4623.1003 - Microsoft Corporation) HiddenOffice Timeline 2013 (HKLM-x32\...\{7CC4518B-972C-4476-8099-804479AB1011}) (Version: 2.1.19 - Office Timeline)Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenPhoto Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenQualcomm Atheros Bluetooth Suite (64) (HKLM\...\{A84A4FB1-D703-48DB-89E0-68B6499D2801}) (Version: 8.0.0.220 - Qualcomm Atheros Communications)Qualcomm Atheros Client Installation Program (HKLM-x32\...\{28006915-2739-4EBE-B5E8-49B25D32EB33}) (Version: 10.0 - Qualcomm Atheros)RealDownloader (x32 Version: 17.0.11 - RealNetworks, Inc.) HiddenRealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) HiddenRealNetworks - Microsoft Visual C++ 2010 Runtime (Version: 10.0 - RealNetworks, Inc) HiddenRealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) HiddenRealPlayer Cloud (HKLM-x32\...\RealPlayer 17.0) (Version: 17.0.10 - RealNetworks)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6809 - Realtek Semiconductor Corp.)RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) HiddenShared C Run-time for x64 (HKLM\...\{EF79C448-6946-4D71-8134-03407888C054}) (Version: 10.0.0 - McAfee)Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.8.21 - Synaptics Incorporated)UpdateService (x32 Version: 1.0.0 - RealNetworks, Inc.) HiddenVisual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)VLC media player 2.0.0 (HKLM-x32\...\VLC media player) (Version: 2.0.0 - VideoLAN)Windows Live (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live 程式集 (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWindows Live 软件包 (x32 Version: 16.4.3505.0912 - Microsoft Corporation) HiddenWinFlash (HKLM-x32\...\{8F21291E-0444-4B1D-B9F9-4370A73E346D}) (Version: 2.42.0 - ASUS)WinRAR 5.01 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)Yammer Notifier (HKCU\...\8c3c8c06fefda92b) (Version: 1.0.0.498 - Microsoft Corporation)影像中心 (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden照片库 (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden ==================== Restore Points ========================= 08-07-2014 20:47:01 Scheduled Checkpoint ==================== Hosts content: ========================== 2013-08-22 09:25 - 2014-07-14 18:15 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTaskTask: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsListTask: {0C95D654-D1EA-4ED2-A954-B7561913D25F} - System32\Tasks\ASUS Splendid ACMON => C:\Program Files (x86)\ASUS\Splendid\ACMON.exe [2012-11-28] (ASUS)Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTaskTask: {22617951-D869-4307-A059-C3016E61B9D9} - System32\Tasks\ASUS Live Update2 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2013-08-15] (ASUSTeK Computer Inc.)Task: {22BC7738-6CA3-4832-8B4A-1323C66F20B4} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-06-20] (Microsoft Corporation)Task: {258C1D29-786F-4318-B6CA-C1598DAD0CD8} - System32\Tasks\Real Player online update program => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [2014-07-03] (RealNetworks, Inc.)Task: {2B94A4F3-8444-4EF3-92FE-D3937308C3DF} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office 15\root\Office15\msoia.exe [2014-06-20] (Microsoft Corporation)Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulateTask: {2F24BA86-610A-4471-8D08-2388B9AAC5A7} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-ValidationTask: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)Task: {385F2053-746D-48E2-83B0-B07B885F7F12} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-3360600101-872847150-3038642983-1002 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exeTask: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)Task: {3C0DE7F1-0AD7-4D9A-8BAE-83A8F29B10CD} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauservTask: {3C536191-B3EB-4A33-A411-E02D57B94898} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-08-28] (Synaptics Incorporated)Task: {3C7B28AE-5136-4840-BE0E-3203210041FB} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-02] (Google Inc.)Task: {45536827-5E71-4276-AB79-31B23B390889} - System32\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-1002 => C:\Users\markb_000\AppData\Local\Citrix\GoToMeeting\1468\g2mupdate.exe [2014-07-08] (Citrix Online, a division of Citrix Systems, Inc.)Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalanceTask: {5842E122-E54C-4B5D-9ECE-B50531E5E613} - System32\Tasks\ASUS P4G => C:\Program Files\ASUS\P4G\BatteryLife.exe [2013-03-26] (ASUS)Task: {5A20C7FF-C6ED-43FA-B5A2-9A4B724F0A85} - System32\Tasks\ASUS USB Charger Plus => C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe [2012-09-18] (ASUSTek Computer Inc.)Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play CleanupTask: {6AE6A37E-1D69-462B-9F82-CCD4D73B50A9} - System32\Tasks\Microsoft Office 15 Sync Maintenance for ACCELARE_8F9-markb_000 ACCELARE_8F9 => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2014-06-20] (Microsoft Corporation)Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance TaskTask: {718E1BDD-2692-45C7-A949-EACF0A6721DB} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-1002 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-06-10] (RealNetworks, Inc.)Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTaskTask: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryStateTask: {7B8BC1EE-6A62-4900-BB96-7EE18E4D985A} - System32\Tasks\ASUS Vivokey => C:\Program Files\ASUS\ASUS VivoBook\vivokey.exe [2013-03-14] (ASUSTek Computer Inc.)Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance TaskTask: {8A36F309-BC3C-4D4A-B360-2FDB692B2E50} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-1002 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2014-06-10] (RealNetworks, Inc.)Task: {8A926C38-709D-4ABA-9585-F41497329E22} - System32\Tasks\ASUS Splendid ColorU => C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe [2013-02-26] (ASUSTeK Computer Inc.)Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTaskTask: {8DEDDD21-CDBF-4AB9-B3C7-AFEEE9C8E35F} - \TidyNetwork Update No Task File <==== ATTENTIONTask: {8F660173-F011-4750-BB26-F1432D62FF9A} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-1002 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2014-06-10] (RealNetworks, Inc.)Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance WorkTask: {A4030640-A4E5-4AF7-8AF2-7229B6A601B8} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-ManagementTask: {AEB90DD5-CAEF-45A8-80CD-9B7EAB47B4F9} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUploadTask: {B1108CB7-C021-4F9A-9026-2E0EA9A81B6B} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2014-06-20] (Microsoft Corporation)Task: {B3A73AAF-131F-4603-97CC-328089F37A13} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-07-10] (Microsoft Corporation)Task: {B4629756-E60C-446E-87C9-1F07178F70E7} - System32\Tasks\ASUS Patch for Touch Panel => C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe [2013-01-09] (ASUSTek Computer INC.)Task: {B54B85F6-8CE8-4A52-9314-E99F55D39131} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-02-22] (Microsoft Corporation)Task: {B704058F-82D7-4169-946A-CCE41A203CAF} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-12-02] (Google Inc.)Task: {BF05C032-354B-4AFD-8C69-4090889692B1} - System32\Tasks\ASUS Live Update1 => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2013-08-15] (ASUSTeK Computer Inc.)Task: {C5A7A978-AAEE-4134-AD49-8740478B5EDC} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-05-13] (Microsoft Corporation)Task: {C988C4E0-98AB-4B45-B257-D3E4E8F025D4} - System32\Tasks\Microsoft\Windows\DiskFootprint\DiagnosticsTask: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTaskTask: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensingTask: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon SynchronizationTask: {DA7F1403-6F5C-4D97-B2FD-283AA825D5AB} - System32\Tasks\AsusVibeSchedule => C:\Program Files (x86)\Asus\AsusVibe\AsusVibeLauncher.exe [2013-01-04] ()Task: {DBCE170D-68F2-4425-A504-0B6BF594947E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-1002 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2014-06-10] (RealNetworks, Inc.)Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRETask: {E7C8DA08-50B1-4C9D-8D23-4A13FA0C90CA} - System32\Tasks\Adobe online update program => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)Task: {EF22219C-4F8B-43BA-B8F0-267F2454D3E4} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2013-07-02] (Oracle Corporation)Task: {FB94ABAA-8A91-4A38-A4E3-831B7AE18EEE} - System32\Tasks\ASUS Live Update => C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe [2013-08-15] (ASUSTeK Computer Inc.)Task: C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-1002.job => C:\Users\markb_000\AppData\Local\Citrix\GoToMeeting\1468\g2mupdate.exeTask: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2012-12-19 02:10 - 2012-12-19 02:10 - 00072192 _____ () C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe2014-05-04 10:05 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll2014-06-10 17:50 - 2014-06-10 17:50 - 00039568 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe2014-06-10 22:03 - 2014-06-10 22:03 - 00023552 _____ () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe2013-03-26 17:38 - 2013-03-26 17:38 - 00031360 _____ () C:\Program Files\ASUS\P4G\DevMng.dll2013-03-26 17:38 - 2013-03-26 17:38 - 00064312 _____ () C:\Program Files\ASUS\P4G\plctrl.dll2014-03-21 08:46 - 2014-06-20 03:34 - 08890536 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll2013-10-01 14:02 - 2013-10-01 14:02 - 00094208 _____ () C:\Windows\system32\IccLibDll_x64.dll2013-01-25 03:09 - 2013-01-25 03:09 - 00011264 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\ActivateDesktopDebugger\ActivateDesktopDebugger.dll2013-01-25 03:05 - 2013-01-25 03:05 - 00084992 _____ () C:\Program Files (x86)\Bluetooth Suite\Modules\Map\MAP.dll2013-01-25 03:12 - 2013-01-25 03:12 - 00012928 _____ () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe2014-07-03 12:20 - 2014-07-03 12:20 - 00861784 _____ () c:\program files (x86)\real\realplayer\RPDS\Plugins\cldplin.dll2013-08-29 22:11 - 2012-06-25 13:41 - 01198912 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll2014-04-13 16:23 - 2014-06-20 03:34 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\AppVIsvStream32.dll2014-04-13 16:17 - 2014-06-20 03:30 - 00316584 _____ () C:\Program Files\Microsoft Office 15\root\office15\AppVIsvStream32.dll2014-03-21 08:50 - 2014-06-20 03:33 - 01032360 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\ADDINS\UmOutlookAddin.dll2014-03-21 08:49 - 2014-05-26 12:22 - 00321704 _____ () C:\Program Files\Microsoft Office 15\root\office15\msfad.dll2014-03-21 08:46 - 2014-06-20 03:34 - 08890536 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\1033\GrooveIntlResource.dll2013-04-27 11:24 - 2013-04-27 11:24 - 00071680 _____ () C:\Program Files (x86)\ASUS\ASUS Live Update\checkmetro.dll2014-03-21 08:46 - 2014-06-20 03:34 - 08890536 _____ () C:\Program Files\Microsoft Office 15\root\Office15\1033\GrooveIntlResource.dll2014-01-28 21:51 - 2014-01-23 01:56 - 00715544 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\libglesv2.dll2014-01-28 21:51 - 2014-01-23 01:56 - 00100120 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\libegl.dll2014-01-28 21:51 - 2014-01-23 01:56 - 04055320 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\pdf.dll2014-01-28 21:51 - 2014-01-23 01:57 - 00399640 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ppGoogleNaClPluginChrome.dll2014-01-28 21:51 - 2014-01-23 01:55 - 01634584 _____ () C:\Program Files (x86)\Google\Chrome\Application\32.0.1700.102\ffmpegsumo.dll2014-02-20 05:32 - 2014-02-20 05:32 - 13632904 _____ () C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\PepperFlash\12.0.0.70\pepflashplayer.dll2014-04-13 16:17 - 2014-06-20 03:30 - 00316584 _____ () C:\Program Files\Microsoft Office 15\Root\Office15\AppVIsvStream32.dll2014-03-21 08:41 - 2014-04-13 16:20 - 00122024 _____ () C:\Program Files\Microsoft Office 15\root\Office15\JitV.dll2014-04-13 16:17 - 2014-06-20 03:30 - 00316584 _____ () C:\Program Files\Microsoft Office 15\root\Office15\AppVIsvStream32.dll2014-03-18 14:45 - 2014-03-18 14:45 - 00016896 ____N () C:\Users\markb_000\AppData\Local\HP\ALM-Client\ahp0516\QCClient.PerformanceMonitor.XmlSerializers.dll ==================== Alternate Data Streams (whitelisted) ========= AlternateDataStreams: C:\ProgramData\TEMP:373E1720AlternateDataStreams: C:\Users\markb_000\SkyDrive:ms-properties ==================== Safe Mode (whitelisted) =================== ==================== EXE Association (whitelisted) ============= ==================== MSCONFIG/TASK MANAGER disabled items ========= HKLM\...\StartupApproved\Run32: => "ATUninstallIcon"HKLM\...\StartupApproved\Run32: => "ATLauncher"HKLM\...\StartupApproved\Run32: => "SunJavaUpdateSched"HKLM\...\StartupApproved\Run32: => "TkBellExe"HKCU\...\StartupApproved\Run: => "GoToMeeting" ==================== Faulty Device Manager Devices ============= Name: Bluetooth Audio DeviceDescription: Bluetooth Audio DeviceClass Guid: {4d36e96c-e325-11ce-bfc1-08002be10318}Manufacturer: Qualcomm Atheros CommunicationsService: BTATH_A2DPProblem: : This device cannot start. (Code10)Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard. Name: Virtual Bluetooth Support (Include Audio)Description: Virtual Bluetooth Support (Include Audio)Class Guid: {c7c038ad-1f2d-44d4-b2fe-d912be20e6d5}Manufacturer: Qualcomm Atheros CommunicationsService: AthBTPortProblem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)Resolution: Update the driver Name: Bluetooth LWFLT DeviceDescription: Bluetooth LWFLT DeviceClass Guid: {c7c038ad-1f2d-44d4-b2fe-d912be20e6d5}Manufacturer: Qualcomm Atheros CommunicationsService: BTATH_LWFLTProblem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)Resolution: Update the driver ==================== Event log errors: ========================= Application errors:==================Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 454) (User: )Description: svchost (952628) Instance: Database recovery/restore failed with unexpected error -501. Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 465) (User: )Description: svchost (952628) Instance: Corruption was detected during soft recovery in logfile C:\ProgramData\Microsoft\Windows\AppRepository\edb.log. The failing checksum record is located at position END. Data not matching the log-file fill pattern first appeared in sector 106 (0x0000006A). This logfile has been damaged and is unusable. Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 477) (User: )Description: svchost (952628) Instance: The log range read from the file "C:\ProgramData\Microsoft\Windows\AppRepository\edb.log" at offset 434176 (0x000000000006a000) for 4096 (0x00001000) bytes failed verification due to a range checksum mismatch. The expected checksum was 12682998550611800067 (0xb0030ffc0002b003) and the actual checksum was 7493734695197386292 (0x67ff18007442a634). The read operation will fail with error -501 (0xfffffe0b). If this condition persists then please restore the logfile from a previous backup. Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 465) (User: )Description: svchost (952628) Instance: Corruption was detected during soft recovery in logfile C:\ProgramData\Microsoft\Windows\AppRepository\edb.log. The failing checksum record is located at position END. Data not matching the log-file fill pattern first appeared in sector 106 (0x0000006A). This logfile has been damaged and is unusable. Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 477) (User: )Description: svchost (952628) Instance: The log range read from the file "C:\ProgramData\Microsoft\Windows\AppRepository\edb.log" at offset 434176 (0x000000000006a000) for 4096 (0x00001000) bytes failed verification due to a range checksum mismatch. The expected checksum was 12682998550611800067 (0xb0030ffc0002b003) and the actual checksum was 7493734695197386292 (0x67ff18007442a634). The read operation will fail with error -501 (0xfffffe0b). If this condition persists then please restore the logfile from a previous backup. Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 454) (User: )Description: svchost (947552) Instance: Database recovery/restore failed with unexpected error -501. Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 465) (User: )Description: svchost (947552) Instance: Corruption was detected during soft recovery in logfile C:\ProgramData\Microsoft\Windows\AppRepository\edb.log. The failing checksum record is located at position END. Data not matching the log-file fill pattern first appeared in sector 106 (0x0000006A). This logfile has been damaged and is unusable. Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 477) (User: )Description: svchost (947552) Instance: The log range read from the file "C:\ProgramData\Microsoft\Windows\AppRepository\edb.log" at offset 434176 (0x000000000006a000) for 4096 (0x00001000) bytes failed verification due to a range checksum mismatch. The expected checksum was 12682998550611800067 (0xb0030ffc0002b003) and the actual checksum was 7493734695197386292 (0x67ff18007442a634). The read operation will fail with error -501 (0xfffffe0b). If this condition persists then please restore the logfile from a previous backup. Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 465) (User: )Description: svchost (947552) Instance: Corruption was detected during soft recovery in logfile C:\ProgramData\Microsoft\Windows\AppRepository\edb.log. The failing checksum record is located at position END. Data not matching the log-file fill pattern first appeared in sector 106 (0x0000006A). This logfile has been damaged and is unusable. Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 477) (User: )Description: svchost (947552) Instance: The log range read from the file "C:\ProgramData\Microsoft\Windows\AppRepository\edb.log" at offset 434176 (0x000000000006a000) for 4096 (0x00001000) bytes failed verification due to a range checksum mismatch. The expected checksum was 12682998550611800067 (0xb0030ffc0002b003) and the actual checksum was 7493734695197386292 (0x67ff18007442a634). The read operation will fail with error -501 (0xfffffe0b). If this condition persists then please restore the logfile from a previous backup. System errors:=============Error: (07/10/2014 08:21:20 PM) (Source: Schannel) (EventID: 4116) (User: ACCELARE_8F9)Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is sip.accelare.com. The SSL connection request has failed. The attached data contains the server certificate. Error: (07/10/2014 08:21:20 PM) (Source: Schannel) (EventID: 4120) (User: ACCELARE_8F9)Description: A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 43. The Windows SChannel error state is 552. Error: (07/10/2014 08:03:28 AM) (Source: DCOM) (EventID: 10010) (User: ACCELARE_8F9)Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9} Error: (07/10/2014 08:03:28 AM) (Source: DCOM) (EventID: 10010) (User: ACCELARE_8F9)Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9} Error: (07/10/2014 08:03:22 AM) (Source: DCOM) (EventID: 10010) (User: ACCELARE_8F9)Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9} Error: (07/10/2014 08:03:22 AM) (Source: DCOM) (EventID: 10010) (User: ACCELARE_8F9)Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9} Error: (07/10/2014 08:03:22 AM) (Source: DCOM) (EventID: 10010) (User: ACCELARE_8F9)Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9} Error: (07/10/2014 08:03:22 AM) (Source: DCOM) (EventID: 10010) (User: ACCELARE_8F9)Description: {4545DEA0-2DFC-4906-A728-6D986BA399A9} Error: (07/10/2014 02:38:25 AM) (Source: BTHUSB) (EventID: 17) (User: )Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded. Error: (07/09/2014 09:19:31 PM) (Source: Schannel) (EventID: 4116) (User: ACCELARE_8F9)Description: The certificate received from the remote server does not contain the expected name. It is therefore not possible to determine whether we are connecting to the correct server. The server name we were expecting is sip.accelare.com. The SSL connection request has failed. The attached data contains the server certificate. Microsoft Office Sessions:=========================Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 454) (User: )Description: svchost952628Instance: -501 Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 465) (User: )Description: svchost952628Instance: C:\ProgramData\Microsoft\Windows\AppRepository\edb.logEND106 (0x0000006A) Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 477) (User: )Description: svchost952628Instance: C:\ProgramData\Microsoft\Windows\AppRepository\edb.log434176 (0x000000000006a000)4096 (0x00001000)-501 (0xfffffe0b)12682998550611800067 (0xb0030ffc0002b003)7493734695197386292 (0x67ff18007442a634) Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 465) (User: )Description: svchost952628Instance: C:\ProgramData\Microsoft\Windows\AppRepository\edb.logEND106 (0x0000006A) Error: (07/15/2014 10:00:06 AM) (Source: ESENT) (EventID: 477) (User: )Description: svchost952628Instance: C:\ProgramData\Microsoft\Windows\AppRepository\edb.log434176 (0x000000000006a000)4096 (0x00001000)-501 (0xfffffe0b)12682998550611800067 (0xb0030ffc0002b003)7493734695197386292 (0x67ff18007442a634) Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 454) (User: )Description: svchost947552Instance: -501 Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 465) (User: )Description: svchost947552Instance: C:\ProgramData\Microsoft\Windows\AppRepository\edb.logEND106 (0x0000006A) Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 477) (User: )Description: svchost947552Instance: C:\ProgramData\Microsoft\Windows\AppRepository\edb.log434176 (0x000000000006a000)4096 (0x00001000)-501 (0xfffffe0b)12682998550611800067 (0xb0030ffc0002b003)7493734695197386292 (0x67ff18007442a634) Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 465) (User: )Description: svchost947552Instance: C:\ProgramData\Microsoft\Windows\AppRepository\edb.logEND106 (0x0000006A) Error: (07/15/2014 08:43:03 AM) (Source: ESENT) (EventID: 477) (User: )Description: svchost947552Instance: C:\ProgramData\Microsoft\Windows\AppRepository\edb.log434176 (0x000000000006a000)4096 (0x00001000)-501 (0xfffffe0b)12682998550611800067 (0xb0030ffc0002b003)7493734695197386292 (0x67ff18007442a634) CodeIntegrity Errors:=================================== Date: 2014-07-10 11:37:48.128 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:37:48.017 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:37:47.785 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:37:47.650 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:37:47.439 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:37:47.272 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:37:47.071 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:37:46.862 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:24:15.060 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. Date: 2014-07-10 11:24:14.943 Description: Code Integrity determined that a process (\Device\HarddiskVolume4\Program Files\Windows Defender\MsMpEng.exe) attempted to load \Device\HarddiskVolume4\Program Files\Microsoft Silverlight\xapauthenticodesip.dll that did not meet the Custom 3 / Antimalware signing level requirements. ==================== Memory info =========================== Percentage of memory in use: 81%Total physical RAM: 6029.71 MBAvailable physical RAM: 1104.43 MBTotal Pagefile: 9733.22 MBAvailable Pagefile: 2320.05 MBTotal Virtual: 131072 MBAvailable Virtual: 131071.8 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:185.96 GB) (Free:129.46 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive d: (Data) (Fixed) (Total:258.34 GB) (Free:258.18 GB) NTFS ==================== MBR & Partition Table ================== ========================================================Disk: 0 (Size: 466 GB) (Disk ID: 0FE4DC0A) Partition: GPT Partition Type. ========================================================Disk: 1 (Size: 22 GB) (Disk ID: C1EC253E) Partition: GPT Partition Type. ==================== End Of Log ============================ Link to post Share on other sites More sharing options...
deeprybka Posted July 21, 2014 ID:855884 Share Posted July 21, 2014 Hi & My name is Jürgen and I will be assisting you with your Malware related problems. Before we move on, please read the following points carefully. My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.Please read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.Perform everything in the correct order. Sometimes one step requires the previous one.If you have any problems while you are follow my instructions, Stop there and tell me the exact nature of your problem.Do not run any other scans without instruction or Add/ Remove Software unless I tell you to do so. This would change the output of our tools and could be confusing for me.Post all Logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.Step 1 Please download AdwCleaner (by Xplode) and save it to your Desktop.Double click on AdwCleaner.exe to run the tool. Vista/Windows 7/8 users right-click and select "Run As Administrator"Click on the Scan button.After the scan has finished, click on the Clean button.Press OK when asked to close all programs and follow the onscreen prompts.After rebooting, a log file (that is saved in C:\AdwCleaner[s#].txt) will open automatically. Copy and paste the contents of that logfile in your next reply.Step 2 Scan with Malwarebytes AntimalwarePlease update the database by clicking on the "Update Now" button.Following the update and click "Settings" and go to "Detection and Protection"Make sure "Scan for Rootkits" is checked.Click on Dashboard, then click on Scan Now to start the scan. (If Malware or Potentially Unwanted Programs [PUPs] are found, you will receive a prompt so that you can decide what you want to do. I suggest "Quarantine". Click the button: Apply All Actions.)A window with an option to view the detailed log will appear. Click on "View Detailed Log".After viewing the results, please click on the "Copy to Clipboard" button and then OK.Return to our forum. Paste your log into your next reply.Step 3 Please download the ESET Online Scanner and save it to your Desktop.Disable the realtime-protection of your antivirus and anti-malware programs because they might interfere with the scan.Start esetsmartinstaller_enu.exe with administartor privileges.Select the option Yes, I accept the Terms of Use and click on Start.Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.Now click on Advanced Settings and select the following:Scan for potentially unwanted applicationsScan for potentially unsafe applicationsEnable Anti-Stealth TechnologyClick on Start. The virus signature database will begin to download. This may take some time.When completed the Online Scan will begin automatically. Note: This scan might take a long time! Please be patient.When completed select Uninstall application on close if you so wish, but make sure you copy the logfile first!Now click on FinishA log file is created at C:\Program Files\ESET\EsetOnlineScanner\log.txt. Copy and paste the content of this log file in your next reply.Note: Do not forget to re-enable your antivirus application after running the above scan! Step 4 Start FRST with administator privileges.Make sure the following option is checked: Press the Scan button.When finished, FRST will produce two logs (FRST.txt and Addition.txt) in the same directory the tool was run from. Please copy and paste these logs in your next reply.Can you please tell me which problems still persist now? Link to post Share on other sites More sharing options...
MSB13 Posted July 21, 2014 Author ID:855940 Share Posted July 21, 2014 Step 1 - AdWCleaner log file # AdwCleaner v3.216 - Report created 21/07/2014 at 17:02:48# Updated 17/07/2014 by Xplode# Operating System : Windows 8.1 (64 bits)# Username : markb_000 - ACCELARE_8F9# Running from : C:\Users\markb_000\Desktop\AdwCleaner.exe# Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\Users\Accelare\AppData\Local\Google\Chrome\User Data\Default\Extensions\jamidkfmgekehonmdfjpopiigaejmifpFolder Deleted : C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jamidkfmgekehonmdfjpopiigaejmifpFolder Deleted : C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jamidkfmgekehonmdfjpopiigaejmifpFolder Deleted : C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\jamidkfmgekehonmdfjpopiigaejmifpFile Deleted : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Search.lnkFile Deleted : C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_continuetosave.info_0.localstorage-journalFile Deleted : C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_www.superfish.com_0.localstorage ***** [ Shortcuts ] ***** ***** [ Registry ] ***** ***** [ Browsers ] ***** -\\ Internet Explorer v11.0.9600.17126 -\\ Google Chrome v32.0.1700.102 [ File : C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\preferences ] Deleted [Extension] : jamidkfmgekehonmdfjpopiigaejmifp ************************* AdwCleaner[R0].txt - [4386 octets] - [23/05/2014 08:46:18]AdwCleaner[R1].txt - [1777 octets] - [21/07/2014 16:51:56]AdwCleaner[s0].txt - [4406 octets] - [23/05/2014 08:51:20]AdwCleaner[s1].txt - [1714 octets] - [21/07/2014 17:02:48] ########## EOF - C:\AdwCleaner\AdwCleaner[s1].txt - [1774 octets] ########## Step 2 - Malwarebytes - log file Malwarebytes Anti-Malwarewww.malwarebytes.org Scan Date: 7/21/2014Scan Time: 5:12:40 PMLogfile: Administrator: Yes Version: 2.00.2.1012Malware Database: v2014.07.21.09Rootkit Database: v2014.07.17.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: Disabled OS: Windows 8.1CPU: x64File System: NTFSUser: markb_000 Scan Type: Threat ScanResult: CompletedObjects Scanned: 345622Time Elapsed: 25 min, 56 sec Memory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: WarnPUM: Enabled Processes: 0(No malicious items detected) Modules: 0(No malicious items detected) Registry Keys: 0(No malicious items detected) Registry Values: 0(No malicious items detected) Registry Data: 0(No malicious items detected) Folders: 0(No malicious items detected) Files: 2PUP.Optional.Superfish.A, C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, Quarantined, [9a07ecb457247bbb7088ddf709f940c0], PUP.Optional.Superfish.A, C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage-journal, Quarantined, [a3fe3a66cab1a393cb2d4e861be7f10f], Physical Sectors: 0(No malicious items detected) (end) Step 3 I am on this step - not sure how to disable my antivirus or antimalware I am using Malwarebytes and Windows DefenderI will post the rest when I figure that out (or hear from you with directions)Thanks Link to post Share on other sites More sharing options...
MSB13 Posted July 22, 2014 Author ID:856048 Share Posted July 22, 2014 Here is the rest step 3 ESET C:\Program Files (x86)\GS.Enabler a variant of Win32/SProtector.I potentially unwanted application C:\Program Files (x86)\GS_x64.Enabler a variant of Win64/SProtector.A potentially unwanted application C:\Users\markb_000\AppData\Local\Microsoft\Windows\INetCache\IE\VQX5R0WZ\stubinst_pkg_en-us[1].cab Win32/OpenCandy potentially unsafe application C:\Users\markb_000\AppData\Local\Temp\is-J6C4T.tmp\OptProCrash.dll a variant of Win32/SProtector.E potentially unwanted application C:\Users\markb_000\AppData\Local\Temp\{F06AD35D-7C1F-4B79-9C72-8B2D066AC5DE}\setup.exe multiple threats C:\Users\markb_000\Desktop\cbsidlm-cbsi183-Download_App-PBF-75864009.exe a variant of Win32/CNETInstaller.B potentially unwanted application C:\Users\markb_000\Downloads\vlcmediaplayer-setup.exe Win32/DownloadAdmin.G potentially unwanted application C:\Windows\Temp\0f0fee5d.ftf.ftf a variant of Win32/SProtector.D potentially unwanted application STEP 4 FRST Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-07-2014 Ran by markb_000 (administrator) on ACCELARE_8F9 on 21-07-2014 23:11:45 Running from C:\Users\markb_000\Desktop Platform: Windows 8.1 (X64) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS) C:\Program Files\ASUS\P4G\InsOnSrv.exe () C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe (Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe (Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe (Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe (Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS) C:\Program Files\ASUS\P4G\InsOnWMI.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SynptSync64.exe (ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS VivoBook\vivokey.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (ASUSTek Computer INC.) C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\lync.exe (Microsoft) C:\Users\markb_000\AppData\Local\Apps\2.0\HTPZ00X9.D6A\X7WBDVLZ.PM5\yamm..tion_c3bce3770c238a49_0001.0000_5370e5be369b498b\Yammer.Notifier.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\UcMapi.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\WINWORD.EXE (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe () C:\Program Files\Microsoft Office 15\root\office15\lynchtmlconv.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20315_x64__8wekyb3d8bbwe\livecomm.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [27024 2013-01-18] (Intel Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13263072 2012-12-12] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1257184 2012-12-12] (Realtek Semiconductor) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2013-05-01] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe [3576784 2012-12-19] (ASUS Cloud Corporation) HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-07-03] (RealNetworks, Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer\Run: [btvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [131712 2013-01-25] ( (Qualcomm Atheros Commnucations)) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Lync] => C:\Program Files\Microsoft Office 15\root\office15\lync.exe [18997408 2014-06-20] (Microsoft Corporation) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [skyDrive] => C:\Users\markb_000\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257224 2014-05-15] (Microsoft Corporation) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Office Timeline Performance Helper] => C:\Program Files (x86)\OfficeTimeline2013\OfficeTimelineStartup.exe [17152 2014-03-25] (OfficeTimeline LLC) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Yammer Notifier] => C:\Users\markb_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Corporation\Yamme (the data entry has 35 more characters). HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [GoToMeeting] => C:\Users\markb_000\AppData\Local\Citrix\GoToMeeting\1350\g2mstart.exe [40304 2014-03-11] (Citrix Online, a division of Citrix Systems, Inc.) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\MountPoints2: {17ce6ba3-8e21-11e3-be83-240a64480402} - "E:\VZW_Software_upgrade_assistant.exe" AppInit_DLLs: C:\PROGRA~2\GS_X64~1.ENA => C:\Program Files (x86)\GS_x64.Enabler [2759168 2014-01-14] () Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (RealNetworks, Inc.) Startup: C:\Users\markb_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: !AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: !AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: !AsusWSShellExt_U -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01 SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS SearchScopes: HKLM-x32 - DefaultScope value is missing. SearchScopes: HKLM-x32 - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKLM-x32 - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms} SearchScopes: HKCU - DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms} BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll (RealDownloader) BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: No Name -> {433450CD-9515-34D1-FB34-59ED33BC499F} -> No File BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: No Name -> {433450CD-9515-34D1-FB34-59ED33BC499F} -> No File BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {EBF1BFCB-F60B-4DCB-9C96-E53C543CB645} http://ahp0516:8080/qcbin/ALM-Platform-Loader.11.cab DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 10.10.152.1 FireFox: ======== FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\markb_000\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online) FF Plugin ProgramFiles/Appdata: C:\Users\markb_000\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC) FF HKLM-x32\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-07-03] Chrome: ======= CHR HomePage: hxxp://www.msn.com/?pc=AV01 CHR StartupUrls: "https://www.google.com/" CHR Extension: (Google Docs) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-02] CHR Extension: (Google Drive) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-02] CHR Extension: (YouTube) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-02] CHR Extension: (Google Search) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-02] CHR Extension: (PSdrunner) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhiclajnaaecdmfpbonaomipadfjjale [2014-04-29] CHR Extension: (Best Save) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gecgipfabdickgidpmbicneamekgbaej [2014-01-13] CHR Extension: (RealPlayer Downloader) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-01-13] CHR Extension: (Google Wallet) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-02] CHR Extension: (Gmail) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-02] CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10] CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION ==================== Services (Whitelisted) ================= R2 ASUS InstantOn; C:\Program Files\ASUS\P4G\InsOnSrv.exe [277120 2013-03-26] (ASUS) R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [72192 2012-12-19] () [File not signed] R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [227456 2013-01-25] (Qualcomm Atheros Commnucations) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation) R2 DptfParticipantProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [31632 2013-01-18] (Intel Corporation) R2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [33168 2013-01-18] (Intel Corporation) R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [39824 2013-01-18] (Intel Corporation) R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation) R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193576 2012-07-30] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) R4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 McAWFwk; C:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-24] (McAfee, Inc.) S2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed] S2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed] R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] () R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-07-03] (RealNetworks, Inc.) R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-10] () [File not signed] R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation) R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-01-25] (Atheros) [File not signed] ==================== Drivers (Whitelisted) ==================== S3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-04-16] (ASUS Corporation) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-25] (Qualcomm Atheros) R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) R3 DptfDevDram; C:\Windows\system32\DRIVERS\DptfDevDram.sys [107920 2013-01-18] (Intel Corporation) R3 DptfDevFan; C:\Windows\system32\DRIVERS\DptfDevFan.sys [43408 2013-01-18] (Intel Corporation) R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [65424 2013-01-18] (Intel Corporation) R3 DptfDevPch; C:\Windows\system32\DRIVERS\DptfDevPch.sys [97680 2013-01-18] (Intel Corporation) R3 DptfDevProc; C:\Windows\system32\DRIVERS\DptfDevProc.sys [229776 2013-01-18] (Intel Corporation) R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [363920 2013-01-18] (Intel Corporation) R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation) R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation) R3 irstrtdv; C:\Windows\System32\drivers\irstrtdv.sys [43800 2012-07-30] (Intel Corporation) R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-01] ( ) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-21] (Malwarebytes Corporation) R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [18304 2013-03-26] (ASUSTek Computer Inc.) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-21 23:11 - 2014-07-21 23:11 - 00000000 ____D () C:\Users\markb_000\Desktop\FRST-OlderVersion 2014-07-21 23:09 - 2014-07-21 23:09 - 00001271 _____ () C:\Users\markb_000\Desktop\eset.txt 2014-07-21 17:59 - 2014-07-21 17:59 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-07-21 17:50 - 2014-07-21 17:51 - 02347384 _____ (ESET) C:\Users\markb_000\Desktop\esetsmartinstaller_enu.exe 2014-07-21 17:09 - 2014-07-21 17:09 - 00003356 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-21 16:49 - 2014-07-21 16:49 - 01354223 _____ () C:\Users\markb_000\Desktop\AdwCleaner.exe 2014-07-21 11:45 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2014-07-21 11:45 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe 2014-07-21 11:45 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe 2014-07-21 11:45 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe 2014-07-21 11:43 - 2014-07-21 11:45 - 00004116 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-15 15:43 - 2014-07-15 15:46 - 00039429 _____ () C:\Users\markb_000\Desktop\Addition.txt 2014-07-15 15:39 - 2014-07-21 23:11 - 00026457 _____ () C:\Users\markb_000\Desktop\FRST.txt 2014-07-15 15:38 - 2014-07-21 23:11 - 00000000 ____D () C:\FRST 2014-07-15 15:34 - 2014-07-21 23:11 - 02090496 _____ (Farbar) C:\Users\markb_000\Desktop\FRST64.exe 2014-07-12 15:43 - 2014-07-12 15:44 - 00167054 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1 (1).xlsx 2014-07-10 08:06 - 2014-06-26 16:55 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-07-10 08:06 - 2014-06-26 16:55 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-10 08:03 - 2014-07-10 08:03 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2014-07-10 02:35 - 2014-04-13 23:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll 2014-07-10 02:16 - 2014-06-18 21:39 - 23464448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-07-10 02:16 - 2014-06-18 20:16 - 17276416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-07-10 02:16 - 2014-06-18 19:46 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2014-07-10 02:16 - 2014-06-18 18:57 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2014-07-10 02:16 - 2014-06-16 18:26 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\osk.exe 2014-07-10 02:16 - 2014-06-16 18:24 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe 2014-07-10 02:16 - 2014-06-06 10:20 - 04190720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-07-10 02:15 - 2014-06-18 20:48 - 02768384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-07-10 02:15 - 2014-06-18 20:09 - 00452608 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll 2014-07-10 02:15 - 2014-06-18 19:51 - 05721088 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-07-10 02:15 - 2014-06-18 19:50 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2014-07-10 02:15 - 2014-06-18 19:48 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2014-07-10 02:15 - 2014-06-18 19:39 - 00608768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-07-10 02:15 - 2014-06-18 19:33 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-07-10 02:15 - 2014-06-18 19:32 - 02179072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-07-10 02:15 - 2014-06-18 19:27 - 02040832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2014-07-10 02:15 - 2014-06-18 19:12 - 00367616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll 2014-07-10 02:15 - 2014-06-18 18:59 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2014-07-10 02:15 - 2014-06-18 18:58 - 02266112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-07-10 02:15 - 2014-06-18 18:58 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2014-07-10 02:15 - 2014-06-18 18:52 - 04254720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-07-10 02:15 - 2014-06-18 18:51 - 13527040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-07-10 02:15 - 2014-06-18 18:49 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-07-10 02:15 - 2014-06-18 18:45 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2014-07-10 02:15 - 2014-06-18 18:35 - 11742208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-07-10 02:15 - 2014-06-18 18:34 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-07-10 02:15 - 2014-06-18 18:15 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2014-07-10 02:15 - 2014-06-18 18:13 - 01791488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-07-10 02:15 - 2014-06-18 18:09 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-07-10 02:15 - 2014-06-18 18:07 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2014-07-10 02:15 - 2014-06-06 09:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll 2014-07-10 02:15 - 2014-06-06 08:18 - 00488960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll 2014-07-10 02:15 - 2014-05-29 23:03 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys 2014-07-10 02:15 - 2014-05-29 08:02 - 00565576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2014-07-10 02:15 - 2014-05-29 03:55 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll 2014-07-10 02:15 - 2014-05-29 02:40 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll 2014-07-10 02:15 - 2014-05-29 02:37 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll 2014-07-10 02:15 - 2014-05-29 01:34 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll 2014-07-10 02:15 - 2014-05-29 01:27 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2014-07-10 02:14 - 2014-06-30 18:45 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2014-07-10 02:14 - 2014-06-28 03:48 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2014-07-10 02:14 - 2014-06-28 03:07 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2014-07-10 02:14 - 2014-05-30 23:40 - 13287936 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2014-07-10 02:14 - 2014-05-30 22:36 - 00923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2014-07-10 02:14 - 2014-05-30 22:32 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2014-07-10 02:13 - 2014-05-31 06:07 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2014-07-10 02:13 - 2014-05-31 06:06 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll 2014-07-10 02:13 - 2014-05-30 23:30 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2014-07-10 02:13 - 2014-05-30 23:12 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-07-10 02:13 - 2014-05-30 23:06 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll 2014-07-10 02:13 - 2014-05-30 23:03 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2014-07-10 02:13 - 2014-05-30 23:01 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-07-10 02:13 - 2014-05-30 22:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll 2014-07-10 02:13 - 2014-05-30 22:54 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2014-07-10 02:13 - 2014-05-30 22:48 - 03463680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2014-07-10 02:13 - 2014-05-30 22:37 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll 2014-07-10 02:13 - 2014-05-30 22:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll 2014-07-10 02:06 - 2014-07-10 02:06 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe 2014-07-03 17:25 - 2014-07-03 17:25 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\RealNetworks 2014-07-03 12:23 - 2014-07-03 12:23 - 00001058 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk 2014-07-03 12:23 - 2014-07-03 12:23 - 00000000 ____D () C:\Program Files (x86)\RealNetworks 2014-07-03 12:22 - 2014-07-03 12:22 - 00000000 ____D () C:\ProgramData\RealNetworks 2014-07-03 12:18 - 2014-07-21 17:09 - 00003302 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-02 10:11 - 2014-07-02 10:21 - 924643538 _____ () C:\Users\markb_000\Desktop\Magura+Final+Slideshow-HD.mp4 2014-06-23 14:01 - 2014-06-23 14:01 - 00000000 ____D () C:\Users\markb_000\AppData\Local\HP ==================== One Month Modified Files and Folders ======= 2014-07-21 23:13 - 2014-07-15 15:39 - 00026457 _____ () C:\Users\markb_000\Desktop\FRST.txt 2014-07-21 23:11 - 2014-07-21 23:11 - 00000000 ____D () C:\Users\markb_000\Desktop\FRST-OlderVersion 2014-07-21 23:11 - 2014-07-15 15:38 - 00000000 ____D () C:\FRST 2014-07-21 23:11 - 2014-07-15 15:34 - 02090496 _____ (Farbar) C:\Users\markb_000\Desktop\FRST64.exe 2014-07-21 23:09 - 2014-07-21 23:09 - 00001271 _____ () C:\Users\markb_000\Desktop\eset.txt 2014-07-21 23:07 - 2014-02-10 15:06 - 00000612 _____ () C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-1002.job 2014-07-21 23:00 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-07-21 22:53 - 2014-01-12 22:50 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\vlc 2014-07-21 22:52 - 2013-12-19 10:31 - 01307828 _____ () C:\WINDOWS\WindowsUpdate.log 2014-07-21 22:47 - 2013-12-02 17:32 - 00000930 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-21 21:26 - 2013-11-27 16:48 - 00000000 ____D () C:\Users\markb_000\AppData\Local\CrashDumps 2014-07-21 20:16 - 2013-11-14 03:28 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-07-21 17:59 - 2014-07-21 17:59 - 00000000 ____D () C:\Program Files (x86)\ESET 2014-07-21 17:51 - 2014-07-21 17:50 - 02347384 _____ (ESET) C:\Users\markb_000\Desktop\esetsmartinstaller_enu.exe 2014-07-21 17:44 - 2013-12-19 10:57 - 00003814 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{BED9303B-00AE-447C-A08C-276597FF66A7} 2014-07-21 17:29 - 2013-12-01 19:12 - 00005004 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for ACCELARE_8F9-markb_000 ACCELARE_8F9 2014-07-21 17:13 - 2013-11-27 16:51 - 00003596 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3360600101-872847150-3038642983-1002 2014-07-21 17:11 - 2014-04-29 17:19 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-07-21 17:09 - 2014-07-21 17:09 - 00003356 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-21 17:09 - 2014-07-03 12:18 - 00003302 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-21 17:09 - 2014-01-14 16:08 - 00003474 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update1 2014-07-21 17:09 - 2014-01-14 16:08 - 00003464 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update2 2014-07-21 17:09 - 2013-12-02 17:33 - 00002165 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-07-21 17:09 - 2013-12-01 19:15 - 00000000 __RDO () C:\Users\markb_000\SkyDrive 2014-07-21 17:09 - 2013-11-27 16:44 - 00000062 _____ () C:\Users\markb_000\AppData\Roaming\sp_data.sys 2014-07-21 17:08 - 2014-01-13 15:11 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Deployment 2014-07-21 17:07 - 2013-12-02 17:32 - 00000926 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-21 17:05 - 2013-11-14 03:20 - 00410492 _____ () C:\WINDOWS\PFRO.log 2014-07-21 17:05 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\L2Schemas 2014-07-21 17:05 - 2013-08-22 10:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-07-21 17:05 - 2013-08-22 09:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2014-07-21 17:03 - 2014-05-23 08:43 - 00000000 ____D () C:\AdwCleaner 2014-07-21 16:49 - 2014-07-21 16:49 - 01354223 _____ () C:\Users\markb_000\Desktop\AdwCleaner.exe 2014-07-21 14:03 - 2013-11-27 16:44 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Packages 2014-07-21 11:47 - 2014-01-04 21:11 - 00000000 ____D () C:\ProgramData\Oracle 2014-07-21 11:45 - 2014-07-21 11:43 - 00004116 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-21 11:45 - 2014-01-04 21:11 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-17 13:53 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\FxsTmp 2014-07-17 13:44 - 2013-08-22 10:46 - 00341078 _____ () C:\WINDOWS\setupact.log 2014-07-17 09:14 - 2014-04-02 08:24 - 00003378 _____ () C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-17 09:14 - 2014-04-02 08:24 - 00003324 _____ () C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-15 15:46 - 2014-07-15 15:43 - 00039429 _____ () C:\Users\markb_000\Desktop\Addition.txt 2014-07-15 15:35 - 2013-12-19 10:54 - 00000000 ____D () C:\Users\markb_000\Downloads\Cleaning 2014-07-14 17:02 - 2014-01-13 18:32 - 00002294 ____H () C:\Users\markb_000\Documents\Default.rdp 2014-07-12 15:44 - 2014-07-12 15:43 - 00167054 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1 (1).xlsx 2014-07-11 03:02 - 2014-07-21 11:45 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-21 11:45 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-21 11:45 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-21 11:45 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe 2014-07-10 11:40 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\rescache 2014-07-10 08:06 - 2013-08-22 10:44 - 00474072 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-07-10 08:03 - 2014-07-10 08:03 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2014-07-10 08:03 - 2013-11-14 03:17 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\WinStore 2014-07-10 02:48 - 2012-07-26 03:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2014-07-10 02:45 - 2013-11-21 17:13 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-07-10 02:38 - 2013-11-21 17:13 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2014-07-10 02:38 - 2013-08-22 10:46 - 00000440 _____ () C:\WINDOWS\setuperr.log 2014-07-10 02:06 - 2014-07-10 02:06 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe 2014-07-09 15:17 - 2014-04-11 12:53 - 00171617 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1.xlsx 2014-07-09 14:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\Help 2014-07-09 14:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\addins 2014-07-09 14:12 - 2012-07-26 04:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP 2014-07-08 16:28 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-07-08 15:51 - 2014-02-10 15:06 - 00003628 _____ () C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-1002 2014-07-03 17:25 - 2014-07-03 17:25 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\RealNetworks 2014-07-03 12:55 - 2012-07-26 04:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports 2014-07-03 12:23 - 2014-07-03 12:23 - 00001058 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk 2014-07-03 12:23 - 2014-07-03 12:23 - 00000000 ____D () C:\Program Files (x86)\RealNetworks 2014-07-03 12:23 - 2014-01-12 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks 2014-07-03 12:22 - 2014-07-03 12:22 - 00000000 ____D () C:\ProgramData\RealNetworks 2014-07-03 12:22 - 2014-01-12 22:45 - 00000000 ____D () C:\Program Files (x86)\Real 2014-07-03 12:21 - 2014-04-02 08:18 - 00278600 _____ (Progressive Networks) C:\WINDOWS\SysWOW64\pncrt.dll 2014-07-03 12:21 - 2014-04-02 08:18 - 00201800 _____ (RealNetworks, Inc.) C:\WINDOWS\SysWOW64\rmoc3260.dll 2014-07-03 12:21 - 2014-01-12 22:43 - 00000000 ____D () C:\ProgramData\Real 2014-07-03 12:20 - 2014-04-02 08:18 - 00505416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll 2014-07-03 12:20 - 2014-04-02 08:18 - 00353864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll 2014-07-03 12:15 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\Web 2014-07-03 12:06 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\NDF 2014-07-02 10:21 - 2014-07-02 10:11 - 924643538 _____ () C:\Users\markb_000\Desktop\Magura+Final+Slideshow-HD.mp4 2014-07-02 09:00 - 2013-12-01 19:18 - 00000000 ____D () C:\Users\markb_000\Documents\Admin 2014-06-30 18:45 - 2014-07-10 02:14 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2014-06-28 03:48 - 2014-07-10 02:14 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2014-06-28 03:07 - 2014-07-10 02:14 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2014-06-26 16:55 - 2014-07-10 08:06 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-06-26 16:55 - 2014-07-10 08:06 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-06-25 21:43 - 2014-05-21 11:00 - 00000000 ____D () C:\Users\markb_000\Documents\OneNote Notebooks 2014-06-24 11:54 - 2014-06-09 08:43 - 00002990 _____ () C:\WINDOWS\System32\Tasks\Synaptics TouchPad Enhancements 2014-06-23 14:01 - 2014-06-23 14:01 - 00000000 ____D () C:\Users\markb_000\AppData\Local\HP 2014-06-23 12:01 - 2014-02-12 14:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 2014-06-21 23:05 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel 2014-06-21 22:30 - 2013-11-27 16:58 - 00000000 ____D () C:\Program Files\Microsoft Office 15 2014-06-21 08:41 - 2014-06-09 13:23 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Windows Live Files to move or delete: ==================== C:\ProgramData\SetStretch.exe C:\ProgramData\SetStretch.VBS Some content of TEMP: ==================== C:\Users\markb_000\AppData\Local\Temp\DseShExt-x64.dll C:\Users\markb_000\AppData\Local\Temp\DseShExt-x86.dll C:\Users\markb_000\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe C:\Users\markb_000\AppData\Local\Temp\lowproc.exe C:\Users\markb_000\AppData\Local\Temp\neoNCSetup64.exe C:\Users\markb_000\AppData\Local\Temp\OfficeSetup.exe C:\Users\markb_000\AppData\Local\Temp\Quarantine.exe C:\Users\markb_000\AppData\Local\Temp\SCC.dll C:\Users\markb_000\AppData\Local\Temp\SDShelEx-win32.dll C:\Users\markb_000\AppData\Local\Temp\SDShelEx-x64.dll C:\Users\markb_000\AppData\Local\Temp\stubhelper.dll ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-21 11:57 ==================== End Of Log ============================ I am still getting popups when I go to certain websites. I always get them at bestbuy.com as example Link to post Share on other sites More sharing options...
deeprybka Posted July 22, 2014 ID:856204 Share Posted July 22, 2014 Hi, please delete your temporary files using "Disk Cleanup". http://windows.microsoft.com/en-us/windows/delete-files-using-disk-cleanup#delete-files-using-disk-cleanup=windows-8 Step 1 Please download the attached fixlist and save it in the same directory as FRST.Start FRST with Administrator privileges.Press the Fix button.When finished, a log file (Fixlog.txt) pops up and is saved to the same location the tool was run from. Please copy and paste its contents in your next reply.fixlist.txt After the reboot: Step 2 Start FRST with administator privileges.Press the Scan button.When finished, FRST will produce a log (FRST.txt) in the same directory the tool was run from. Please copy and paste the log in your next reply.Can you please tell me which problems still persist now? Link to post Share on other sites More sharing options...
MSB13 Posted July 22, 2014 Author ID:856272 Share Posted July 22, 2014 Step 1 - Fixlist.txt below: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-07-2014 Ran by markb_000 at 2014-07-22 11:08:18 Run:1 Running from C:\Users\markb_000\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** AppInit_DLLs: C:\PROGRA~2\GS_X64~1.ENA => C:\Program Files (x86)\GS_x64.Enabler [2759168 2014-01-14] () CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION CHR HKCU\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION C:\Program Files (x86)\GS_x64.Enabler C:\Program Files (x86)\GS.Enabler C:\Users\markb_000\Downloads\vlcmediaplayer-setup.exe C:\Users\markb_000\Desktop\cbsidlm-cbsi183-Download_App-PBF-75864009.exe C:\ProgramData\SetStretch.exe C:\ProgramData\SetStretch.VBS AlternateDataStreams: C:\ProgramData\TEMP:373E1720 Reboot: ***************** "C:\PROGRA~2\GS_X64~1.ENA" => Value Data removed successfully. 'HKLM\SOFTWARE\Policies\Google' => Key deleted successfully. 'HKCU\SOFTWARE\Policies\Google' => Key deleted successfully. C:\Program Files (x86)\GS_x64.Enabler => Moved successfully. C:\Program Files (x86)\GS.Enabler => Moved successfully. C:\Users\markb_000\Downloads\vlcmediaplayer-setup.exe => Moved successfully. C:\Users\markb_000\Desktop\cbsidlm-cbsi183-Download_App-PBF-75864009.exe => Moved successfully. C:\ProgramData\SetStretch.exe => Moved successfully. C:\ProgramData\SetStretch.VBS => Moved successfully. C:\ProgramData\TEMP => ":373E1720" ADS removed successfully. The system needed a reboot. ==== End of Fixlog ==== Step 2 - FRST.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-07-2014 Ran by markb_000 (administrator) on ACCELARE_8F9 on 22-07-2014 11:15:11 Running from C:\Users\markb_000\Desktop Platform: Windows 8.1 (X64) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe (ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe (ASUS) C:\Program Files\ASUS\P4G\InsOnSrv.exe () C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe (Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe (Microsoft Corporation) C:\Windows\System32\dasHost.exe (Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe (Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe (Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe (Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe (Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe (Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe () C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe (Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe (ASUS) C:\Program Files\ASUS\P4G\InsOnWMI.exe (ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe (ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SynptSync64.exe (ASUSTek Computer INC.) C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe (ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS VivoBook\vivokey.exe (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20315_x64__8wekyb3d8bbwe\livecomm.exe (Microsoft Corporation) C:\Windows\System32\SkyDrive.exe (Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe () C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe (Intel Corporation) C:\Windows\System32\igfxsrvc.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\lync.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Microsoft) C:\Users\markb_000\AppData\Local\Apps\2.0\HTPZ00X9.D6A\X7WBDVLZ.PM5\yamm..tion_c3bce3770c238a49_0001.0000_5370e5be369b498b\Yammer.Notifier.exe (RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\MSOSYNC.EXE (ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\UcMapi.exe (Microsoft Corporation) C:\Windows\WinStore\WSHost.exe (Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe (Microsoft Corporation) C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_6.3.9600.17200_none_fa7026dd9b04586e\TiWorker.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [27024 2013-01-18] (Intel Corporation) HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13263072 2012-12-12] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1257184 2012-12-12] (Realtek Semiconductor) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2013-05-01] (ASUSTek Computer Inc.) HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe [3576784 2012-12-19] (ASUS Cloud Corporation) HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-07-03] (RealNetworks, Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer\Run: [btvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [131712 2013-01-25] ( (Qualcomm Atheros Commnucations)) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Lync] => C:\Program Files\Microsoft Office 15\root\office15\lync.exe [18997408 2014-06-20] (Microsoft Corporation) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [skyDrive] => C:\Users\markb_000\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257224 2014-05-15] (Microsoft Corporation) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Office Timeline Performance Helper] => C:\Program Files (x86)\OfficeTimeline2013\OfficeTimelineStartup.exe [17152 2014-03-25] (OfficeTimeline LLC) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Yammer Notifier] => C:\Users\markb_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Corporation\Yamme (the data entry has 35 more characters). HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [GoToMeeting] => C:\Users\markb_000\AppData\Local\Citrix\GoToMeeting\1350\g2mstart.exe [40304 2014-03-11] (Citrix Online, a division of Citrix Systems, Inc.) HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\MountPoints2: {17ce6ba3-8e21-11e3-be83-240a64480402} - "E:\VZW_Software_upgrade_assistant.exe" Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (RealNetworks, Inc.) Startup: C:\Users\markb_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnk ShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers: !AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: !AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: !AsusWSShellExt_U -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.) ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No File ShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No File ShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No File ShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No File ShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.com HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01 SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS SearchScopes: HKLM-x32 - DefaultScope value is missing. SearchScopes: HKLM-x32 - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKLM-x32 - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms} SearchScopes: HKCU - DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01 SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms} BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll (RealDownloader) BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation) BHO: No Name -> {433450CD-9515-34D1-FB34-59ED33BC499F} -> No File BHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations) BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation) BHO-x32: No Name -> {433450CD-9515-34D1-FB34-59ED33BC499F} -> No File BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {EBF1BFCB-F60B-4DCB-9C96-E53C543CB645} http://ahp0516:8080/qcbin/ALM-Platform-Loader.11.cab DPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 172.25.0.92 172.25.0.95 172.29.0.60 172.29.0.65 FireFox: ======== FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\markb_000\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online) FF Plugin ProgramFiles/Appdata: C:\Users\markb_000\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC) FF HKLM-x32\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-07-03] Chrome: ======= CHR HomePage: hxxp://www.msn.com/?pc=AV01 CHR StartupUrls: "https://www.google.com/" CHR Extension: (Google Docs) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-02] CHR Extension: (Google Drive) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-02] CHR Extension: (YouTube) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-02] CHR Extension: (Google Search) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-02] CHR Extension: (PSdrunner) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\fhiclajnaaecdmfpbonaomipadfjjale [2014-04-29] CHR Extension: (Best Save) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gecgipfabdickgidpmbicneamekgbaej [2014-01-13] CHR Extension: (RealPlayer Downloader) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-01-13] CHR Extension: (Google Wallet) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-02] CHR Extension: (Gmail) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-02] CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10] ==================== Services (Whitelisted) ================= R2 ASUS InstantOn; C:\Program Files\ASUS\P4G\InsOnSrv.exe [277120 2013-03-26] (ASUS) R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [72192 2012-12-19] () [File not signed] R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [227456 2013-01-25] (Qualcomm Atheros Commnucations) R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation) R2 DptfParticipantProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [31632 2013-01-18] (Intel Corporation) R2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [33168 2013-01-18] (Intel Corporation) R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [39824 2013-01-18] (Intel Corporation) R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation) R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation) R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193576 2012-07-30] (Intel Corporation) R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation) S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 McAWFwk; C:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-24] (McAfee, Inc.) R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed] R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed] R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] () R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-07-03] (RealNetworks, Inc.) R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-10] () [File not signed] R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation) R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation) R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-01-25] (Atheros) [File not signed] ==================== Drivers (Whitelisted) ==================== S3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-04-16] (ASUS Corporation) S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-25] (Qualcomm Atheros) R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation) R3 DptfDevDram; C:\Windows\system32\DRIVERS\DptfDevDram.sys [107920 2013-01-18] (Intel Corporation) R3 DptfDevFan; C:\Windows\system32\DRIVERS\DptfDevFan.sys [43408 2013-01-18] (Intel Corporation) R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [65424 2013-01-18] (Intel Corporation) R3 DptfDevPch; C:\Windows\system32\DRIVERS\DptfDevPch.sys [97680 2013-01-18] (Intel Corporation) R3 DptfDevProc; C:\Windows\system32\DRIVERS\DptfDevProc.sys [229776 2013-01-18] (Intel Corporation) R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [363920 2013-01-18] (Intel Corporation) R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation) R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation) R3 irstrtdv; C:\Windows\System32\drivers\irstrtdv.sys [43800 2012-07-30] (Intel Corporation) R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-01] ( ) R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [18304 2013-03-26] (ASUSTek Computer Inc.) R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated) R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-21 23:11 - 2014-07-21 23:11 - 00000000 ____D () C:\Users\markb_000\Desktop\FRST-OlderVersion 2014-07-21 23:09 - 2014-07-21 23:09 - 00001271 _____ () C:\Users\markb_000\Desktop\eset.txt 2014-07-21 17:50 - 2014-07-21 17:51 - 02347384 _____ (ESET) C:\Users\markb_000\Desktop\esetsmartinstaller_enu.exe 2014-07-21 17:09 - 2014-07-21 17:09 - 00003356 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-21 16:49 - 2014-07-21 16:49 - 01354223 _____ () C:\Users\markb_000\Desktop\AdwCleaner.exe 2014-07-21 11:45 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2014-07-21 11:45 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe 2014-07-21 11:45 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe 2014-07-21 11:45 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe 2014-07-21 11:43 - 2014-07-21 11:45 - 00004116 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-15 15:43 - 2014-07-15 15:46 - 00039429 _____ () C:\Users\markb_000\Desktop\Addition.txt 2014-07-15 15:39 - 2014-07-22 11:15 - 00025983 _____ () C:\Users\markb_000\Desktop\FRST.txt 2014-07-15 15:38 - 2014-07-22 11:15 - 00000000 ____D () C:\FRST 2014-07-15 15:34 - 2014-07-21 23:11 - 02090496 _____ (Farbar) C:\Users\markb_000\Desktop\FRST64.exe 2014-07-12 15:43 - 2014-07-12 15:44 - 00167054 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1 (1).xlsx 2014-07-10 08:06 - 2014-06-26 16:55 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-07-10 08:06 - 2014-06-26 16:55 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-10 08:03 - 2014-07-10 08:03 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2014-07-10 02:35 - 2014-04-13 23:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll 2014-07-10 02:16 - 2014-06-18 21:39 - 23464448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll 2014-07-10 02:16 - 2014-06-18 20:16 - 17276416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll 2014-07-10 02:16 - 2014-06-18 19:46 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll 2014-07-10 02:16 - 2014-06-18 18:57 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll 2014-07-10 02:16 - 2014-06-16 18:26 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\osk.exe 2014-07-10 02:16 - 2014-06-16 18:24 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe 2014-07-10 02:16 - 2014-06-06 10:20 - 04190720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys 2014-07-10 02:15 - 2014-06-18 20:48 - 02768384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll 2014-07-10 02:15 - 2014-06-18 20:09 - 00452608 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll 2014-07-10 02:15 - 2014-06-18 19:51 - 05721088 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll 2014-07-10 02:15 - 2014-06-18 19:50 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll 2014-07-10 02:15 - 2014-06-18 19:48 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll 2014-07-10 02:15 - 2014-06-18 19:39 - 00608768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe 2014-07-10 02:15 - 2014-06-18 19:33 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll 2014-07-10 02:15 - 2014-06-18 19:32 - 02179072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll 2014-07-10 02:15 - 2014-06-18 19:27 - 02040832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl 2014-07-10 02:15 - 2014-06-18 19:12 - 00367616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll 2014-07-10 02:15 - 2014-06-18 18:59 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll 2014-07-10 02:15 - 2014-06-18 18:58 - 02266112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll 2014-07-10 02:15 - 2014-06-18 18:58 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll 2014-07-10 02:15 - 2014-06-18 18:52 - 04254720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll 2014-07-10 02:15 - 2014-06-18 18:51 - 13527040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll 2014-07-10 02:15 - 2014-06-18 18:49 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll 2014-07-10 02:15 - 2014-06-18 18:45 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl 2014-07-10 02:15 - 2014-06-18 18:35 - 11742208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll 2014-07-10 02:15 - 2014-06-18 18:34 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll 2014-07-10 02:15 - 2014-06-18 18:15 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll 2014-07-10 02:15 - 2014-06-18 18:13 - 01791488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll 2014-07-10 02:15 - 2014-06-18 18:09 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll 2014-07-10 02:15 - 2014-06-18 18:07 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll 2014-07-10 02:15 - 2014-06-06 09:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll 2014-07-10 02:15 - 2014-06-06 08:18 - 00488960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll 2014-07-10 02:15 - 2014-05-29 23:03 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys 2014-07-10 02:15 - 2014-05-29 08:02 - 00565576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys 2014-07-10 02:15 - 2014-05-29 03:55 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll 2014-07-10 02:15 - 2014-05-29 02:40 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll 2014-07-10 02:15 - 2014-05-29 02:37 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll 2014-07-10 02:15 - 2014-05-29 01:34 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll 2014-07-10 02:15 - 2014-05-29 01:27 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll 2014-07-10 02:14 - 2014-06-30 18:45 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2014-07-10 02:14 - 2014-06-28 03:48 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2014-07-10 02:14 - 2014-06-28 03:07 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2014-07-10 02:14 - 2014-05-30 23:40 - 13287936 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll 2014-07-10 02:14 - 2014-05-30 22:36 - 00923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll 2014-07-10 02:14 - 2014-05-30 22:32 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll 2014-07-10 02:13 - 2014-05-31 06:07 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe 2014-07-10 02:13 - 2014-05-31 06:06 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll 2014-07-10 02:13 - 2014-05-30 23:30 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll 2014-07-10 02:13 - 2014-05-30 23:12 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll 2014-07-10 02:13 - 2014-05-30 23:06 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll 2014-07-10 02:13 - 2014-05-30 23:03 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll 2014-07-10 02:13 - 2014-05-30 23:01 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll 2014-07-10 02:13 - 2014-05-30 22:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll 2014-07-10 02:13 - 2014-05-30 22:54 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll 2014-07-10 02:13 - 2014-05-30 22:48 - 03463680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll 2014-07-10 02:13 - 2014-05-30 22:37 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll 2014-07-10 02:13 - 2014-05-30 22:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll 2014-07-10 02:06 - 2014-07-10 02:06 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe 2014-07-03 17:25 - 2014-07-03 17:25 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\RealNetworks 2014-07-03 12:23 - 2014-07-03 12:23 - 00001058 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk 2014-07-03 12:23 - 2014-07-03 12:23 - 00000000 ____D () C:\Program Files (x86)\RealNetworks 2014-07-03 12:22 - 2014-07-03 12:22 - 00000000 ____D () C:\ProgramData\RealNetworks 2014-07-03 12:18 - 2014-07-21 17:09 - 00003302 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-02 10:11 - 2014-07-02 10:21 - 924643538 _____ () C:\Users\markb_000\Desktop\Magura+Final+Slideshow-HD.mp4 2014-06-23 14:01 - 2014-06-23 14:01 - 00000000 ____D () C:\Users\markb_000\AppData\Local\HP ==================== One Month Modified Files and Folders ======= 2014-07-22 11:16 - 2014-07-15 15:39 - 00025983 _____ () C:\Users\markb_000\Desktop\FRST.txt 2014-07-22 11:15 - 2014-07-15 15:38 - 00000000 ____D () C:\FRST 2014-07-22 11:13 - 2013-12-02 17:32 - 00003902 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA 2014-07-22 11:13 - 2013-12-02 17:32 - 00003666 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore 2014-07-22 11:13 - 2013-12-02 17:32 - 00000930 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job 2014-07-22 11:13 - 2013-12-02 17:32 - 00000926 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job 2014-07-22 11:12 - 2014-01-14 16:08 - 00003474 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update1 2014-07-22 11:12 - 2014-01-14 16:08 - 00003464 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update2 2014-07-22 11:12 - 2013-12-02 17:33 - 00002165 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-07-22 11:12 - 2013-12-01 19:15 - 00000000 __RDO () C:\Users\markb_000\SkyDrive 2014-07-22 11:12 - 2013-12-01 19:12 - 00005006 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for ACCELARE_8F9-markb_000 ACCELARE_8F9 2014-07-22 11:12 - 2013-11-27 16:44 - 00000062 _____ () C:\Users\markb_000\AppData\Roaming\sp_data.sys 2014-07-22 11:11 - 2014-01-13 15:11 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Deployment 2014-07-22 11:10 - 2013-11-14 03:20 - 00410846 _____ () C:\WINDOWS\PFRO.log 2014-07-22 11:10 - 2013-08-22 10:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT 2014-07-22 11:10 - 2013-08-22 09:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI 2014-07-22 11:07 - 2014-02-10 15:06 - 00000612 _____ () C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-1002.job 2014-07-22 11:00 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\sru 2014-07-22 09:18 - 2013-12-19 10:31 - 01398442 _____ () C:\WINDOWS\WindowsUpdate.log 2014-07-22 08:16 - 2013-12-19 10:57 - 00003814 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{BED9303B-00AE-447C-A08C-276597FF66A7} 2014-07-22 07:58 - 2014-04-29 17:19 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys 2014-07-22 00:29 - 2013-11-27 16:51 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3360600101-872847150-3038642983-1002 2014-07-22 00:11 - 2014-01-12 22:50 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\vlc 2014-07-21 23:11 - 2014-07-21 23:11 - 00000000 ____D () C:\Users\markb_000\Desktop\FRST-OlderVersion 2014-07-21 23:11 - 2014-07-15 15:34 - 02090496 _____ (Farbar) C:\Users\markb_000\Desktop\FRST64.exe 2014-07-21 23:09 - 2014-07-21 23:09 - 00001271 _____ () C:\Users\markb_000\Desktop\eset.txt 2014-07-21 21:26 - 2013-11-27 16:48 - 00000000 ____D () C:\Users\markb_000\AppData\Local\CrashDumps 2014-07-21 20:16 - 2013-11-14 03:28 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI 2014-07-21 17:51 - 2014-07-21 17:50 - 02347384 _____ (ESET) C:\Users\markb_000\Desktop\esetsmartinstaller_enu.exe 2014-07-21 17:09 - 2014-07-21 17:09 - 00003356 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-21 17:09 - 2014-07-03 12:18 - 00003302 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-21 17:05 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\L2Schemas 2014-07-21 17:03 - 2014-05-23 08:43 - 00000000 ____D () C:\AdwCleaner 2014-07-21 16:49 - 2014-07-21 16:49 - 01354223 _____ () C:\Users\markb_000\Desktop\AdwCleaner.exe 2014-07-21 14:03 - 2013-11-27 16:44 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Packages 2014-07-21 11:47 - 2014-01-04 21:11 - 00000000 ____D () C:\ProgramData\Oracle 2014-07-21 11:45 - 2014-07-21 11:43 - 00004116 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-21 11:45 - 2014-01-04 21:11 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-17 13:53 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\FxsTmp 2014-07-17 13:44 - 2013-08-22 10:46 - 00341078 _____ () C:\WINDOWS\setupact.log 2014-07-17 09:14 - 2014-04-02 08:24 - 00003378 _____ () C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-17 09:14 - 2014-04-02 08:24 - 00003324 _____ () C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-1002 2014-07-15 15:46 - 2014-07-15 15:43 - 00039429 _____ () C:\Users\markb_000\Desktop\Addition.txt 2014-07-15 15:35 - 2013-12-19 10:54 - 00000000 ____D () C:\Users\markb_000\Downloads\Cleaning 2014-07-14 17:02 - 2014-01-13 18:32 - 00002294 ____H () C:\Users\markb_000\Documents\Default.rdp 2014-07-12 15:44 - 2014-07-12 15:43 - 00167054 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1 (1).xlsx 2014-07-11 03:02 - 2014-07-21 11:45 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-21 11:45 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-21 11:45 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-21 11:45 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe 2014-07-10 11:40 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\rescache 2014-07-10 08:06 - 2013-08-22 10:44 - 00474072 _____ () C:\WINDOWS\system32\FNTCACHE.DAT 2014-07-10 08:03 - 2014-07-10 08:03 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel 2014-07-10 08:03 - 2013-11-14 03:17 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ToastData 2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility 2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\WinStore 2014-07-10 02:48 - 2012-07-26 03:59 - 00000000 ____D () C:\WINDOWS\CbsTemp 2014-07-10 02:45 - 2013-11-21 17:13 - 00000000 ____D () C:\WINDOWS\system32\MRT 2014-07-10 02:38 - 2013-11-21 17:13 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe 2014-07-10 02:38 - 2013-08-22 10:46 - 00000440 _____ () C:\WINDOWS\setuperr.log 2014-07-10 02:06 - 2014-07-10 02:06 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe 2014-07-09 15:17 - 2014-04-11 12:53 - 00171617 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1.xlsx 2014-07-09 14:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\Help 2014-07-09 14:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\addins 2014-07-09 14:12 - 2012-07-26 04:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP 2014-07-08 16:28 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM 2014-07-08 15:51 - 2014-02-10 15:06 - 00003628 _____ () C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-1002 2014-07-03 17:25 - 2014-07-03 17:25 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\RealNetworks 2014-07-03 12:55 - 2012-07-26 04:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports 2014-07-03 12:23 - 2014-07-03 12:23 - 00001058 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk 2014-07-03 12:23 - 2014-07-03 12:23 - 00000000 ____D () C:\Program Files (x86)\RealNetworks 2014-07-03 12:23 - 2014-01-12 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks 2014-07-03 12:22 - 2014-07-03 12:22 - 00000000 ____D () C:\ProgramData\RealNetworks 2014-07-03 12:22 - 2014-01-12 22:45 - 00000000 ____D () C:\Program Files (x86)\Real 2014-07-03 12:21 - 2014-04-02 08:18 - 00278600 _____ (Progressive Networks) C:\WINDOWS\SysWOW64\pncrt.dll 2014-07-03 12:21 - 2014-04-02 08:18 - 00201800 _____ (RealNetworks, Inc.) C:\WINDOWS\SysWOW64\rmoc3260.dll 2014-07-03 12:21 - 2014-01-12 22:43 - 00000000 ____D () C:\ProgramData\Real 2014-07-03 12:20 - 2014-04-02 08:18 - 00505416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll 2014-07-03 12:20 - 2014-04-02 08:18 - 00353864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll 2014-07-03 12:15 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\Web 2014-07-03 12:06 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\NDF 2014-07-02 10:21 - 2014-07-02 10:11 - 924643538 _____ () C:\Users\markb_000\Desktop\Magura+Final+Slideshow-HD.mp4 2014-07-02 09:00 - 2013-12-01 19:18 - 00000000 ____D () C:\Users\markb_000\Documents\Admin 2014-06-30 18:45 - 2014-07-10 02:14 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll 2014-06-28 03:48 - 2014-07-10 02:14 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll 2014-06-28 03:07 - 2014-07-10 02:14 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll 2014-06-26 16:55 - 2014-07-10 08:06 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe 2014-06-26 16:55 - 2014-07-10 08:06 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl 2014-06-25 21:43 - 2014-05-21 11:00 - 00000000 ____D () C:\Users\markb_000\Documents\OneNote Notebooks 2014-06-24 11:54 - 2014-06-09 08:43 - 00002990 _____ () C:\WINDOWS\System32\Tasks\Synaptics TouchPad Enhancements 2014-06-23 14:01 - 2014-06-23 14:01 - 00000000 ____D () C:\Users\markb_000\AppData\Local\HP 2014-06-23 12:01 - 2014-02-12 14:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 Some content of TEMP: ==================== C:\Users\markb_000\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-22 00:29 ==================== End Of Log ============================ I am still seeing issues. On this page I am getting popups from Browser Shop (Tried to insert a screenshot but was not able to) I also keep getting new browser tabs opening. I just had one open with this url - http://www.computerlivehelp.co/clh/support-for-windows7.php Thanks Link to post Share on other sites More sharing options...
deeprybka Posted July 22, 2014 ID:856275 Share Posted July 22, 2014 Which browser? Link to post Share on other sites More sharing options...
MSB13 Posted July 22, 2014 Author ID:856316 Share Posted July 22, 2014 Chrome - version 32.0.1700.102 m Opened a few pages with Internet Explorer and it seems to work as expected (no popups) Link to post Share on other sites More sharing options...
deeprybka Posted July 22, 2014 ID:856330 Share Posted July 22, 2014 Please do thishttps://support.google.com/chrome/answer/3296214?hl=en Link to post Share on other sites More sharing options...
MSB13 Posted July 22, 2014 Author ID:856366 Share Posted July 22, 2014 This seems to have corrected the issue. Thank you I am nervous that my popups will come back since they have been around for a couple of weeks. They would be bad for a day or so and then not bother me and then they would return. Thank you for your help. I will keep your directions in case I find myself in the same situation. Link to post Share on other sites More sharing options...
deeprybka Posted July 22, 2014 ID:856369 Share Posted July 22, 2014 Hi, please run FRST again... Start FRST with administator privileges.Press the Scan button.When finished, FRST will produce a log (FRST.txt) in the same directory the tool was run from. Please copy and paste the log in your next reply. Link to post Share on other sites More sharing options...
MSB13 Posted July 22, 2014 Author ID:856471 Share Posted July 22, 2014 Just ran another scan - log is below Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-07-2014Ran by markb_000 (administrator) on ACCELARE_8F9 on 22-07-2014 18:16:12Running from C:\Users\markb_000\DesktopPlatform: Windows 8.1 (X64) OS Language: English (United States)Internet Explorer Version 11Boot Mode: Normal The only official download link for FRST:Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated.See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe(ASUS) C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe(ASUS) C:\Program Files\ASUS\P4G\InsOnSrv.exe() C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\AdminService.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe(Intel Corporation) C:\Windows\System32\DptfParticipantProcessorService.exe(Microsoft Corporation) C:\Windows\System32\dasHost.exe(Intel Corporation) C:\Windows\System32\DptfPolicyConfigTDPService.exe(Intel Corporation) C:\Windows\System32\DptfPolicyLpmService.exe(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Common Files\dsNcService.exe(Diskeeper Corporation) C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Intel Corporation) C:\Windows\SysWOW64\irstrtsv.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe(Atheros) C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe(ASUS) C:\Program Files\ASUS\P4G\InsOnWMI.exe(ASUS) C:\Program Files\ASUS\P4G\BatteryLife.exe(ASUS) C:\Program Files (x86)\ASUS\Splendid\ACMON.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\USBChargerPlus\USBChargerPlus.exe(ASUSTek Computer Inc.) C:\Program Files\ASUS\ASUS VivoBook\vivokey.exe(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\Splendid\ColorUService.exe(ASUSTek Computer INC.) C:\ProgramData\AsTouchPanel\AsPatchTouchPanel64.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\SynptSync64.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe(ASUSTek Computer Inc.) C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe(Qualcomm Atheros Commnucations) C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe(Intel Corporation) C:\Windows\System32\DptfPolicyLpmServiceHelper.exe() C:\Program Files (x86)\Bluetooth Suite\ActivateDesktop.exe(Intel Corporation) C:\Windows\System32\igfxsrvc.exe(Intel Corporation) C:\Windows\System32\hkcmd.exe(Intel Corporation) C:\Windows\System32\igfxpers.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\lync.exe(Microsoft) C:\Users\markb_000\AppData\Local\Apps\2.0\HTPZ00X9.D6A\X7WBDVLZ.PM5\yamm..tion_c3bce3770c238a49_0001.0000_5370e5be369b498b\Yammer.Notifier.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE15\CSISYNCCLIENT.EXE(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\UcMapi.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe(Microsoft Corporation) C:\Program Files\Microsoft Office 15\root\office15\OUTLOOK.EXE(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe(Hewlett-Packard Development Company, L.P.) C:\Users\markb_000\AppData\Local\HP\ALM-Client\ahp0516\ALM-Client.exe(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe(Juniper Networks) C:\Program Files (x86)\Juniper Networks\Network Connect 7.1.10\dsNetworkConnect.exe(Microsoft Corporation) C:\Windows\SysWOW64\SearchProtocolHost.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [DptfPolicyLpmServiceHelper] => C:\WINDOWS\system32\DptfPolicyLpmServiceHelper.exe [27024 2013-01-18] (Intel Corporation)HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [13263072 2012-12-12] (Realtek Semiconductor)HKLM\...\Run: [RtHDVBg] => C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [1257184 2012-12-12] (Realtek Semiconductor)HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2014-05-08] (Adobe Systems Incorporated)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [ASUSPRP] => C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3187360 2013-05-01] (ASUSTek Computer Inc.)HKLM-x32\...\Run: [ASUSWebStorage] => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSPanel.exe [3576784 2012-12-19] (ASUS Cloud Corporation)HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-07-03] (RealNetworks, Inc.)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation)Winlogon\Notify\igfxcui: C:\WINDOWS\system32\igfxdev.dll (Intel Corporation)HKLM\...\Policies\Explorer\Run: [btvStack] => C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe [131712 2013-01-25] ( (Qualcomm Atheros Commnucations))HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Lync] => C:\Program Files\Microsoft Office 15\root\office15\lync.exe [18997408 2014-06-20] (Microsoft Corporation)HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [skyDrive] => C:\Users\markb_000\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [257224 2014-05-15] (Microsoft Corporation)HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Office Timeline Performance Helper] => C:\Program Files (x86)\OfficeTimeline2013\OfficeTimelineStartup.exe [17152 2014-03-25] (OfficeTimeline LLC)HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [Yammer Notifier] => C:\Users\markb_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft Corporation\Yamme (the data entry has 35 more characters).HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\Run: [GoToMeeting] => C:\Users\markb_000\AppData\Local\Citrix\GoToMeeting\1350\g2mstart.exe [40304 2014-03-11] (Citrix Online, a division of Citrix Systems, Inc.)HKU\S-1-5-21-3360600101-872847150-3038642983-1002\...\MountPoints2: {17ce6ba3-8e21-11e3-be83-240a64480402} - "E:\VZW_Software_upgrade_assistant.exe" Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnkShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (RealNetworks, Inc.)Startup: C:\Users\markb_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Send to OneNote.lnkShortcutTarget: Send to OneNote.lnk -> C:\Program Files\Microsoft Office 15\root\office15\ONENOTEM.EXE (Microsoft Corporation)ShellIconOverlayIdentifiers: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No FileShellIconOverlayIdentifiers: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No FileShellIconOverlayIdentifiers: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No FileShellIconOverlayIdentifiers: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers: !AsusWSShellExt_B -> {6D4133E5-0742-4ADC-8A8C-9303440F7190} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: !AsusWSShellExt_O -> {64174815-8D98-4CE6-8646-4C039977D808} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: !AsusWSShellExt_U -> {1C5AB7B1-0B38-4EC4-9093-7FD277E2AF4D} => C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\ASUSWSShellExt64.dll (ASUS Cloud Corporation.)ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => No FileShellIconOverlayIdentifiers-x32: SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => No FileShellIconOverlayIdentifiers-x32: SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => No FileShellIconOverlayIdentifiers-x32: SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => No FileShellIconOverlayIdentifiers-x32: SkyDrivePro1 (ErrorConflict) -> {8BA85C75-763B-4103-94EB-9470F12FE0F7} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers-x32: SkyDrivePro2 (SyncInProgress) -> {CD55129A-B1A1-438E-A425-CEBC7DC684EE} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)ShellIconOverlayIdentifiers-x32: SkyDrivePro3 (InSync) -> {E768CD3B-BDDC-436D-9C13-E1B39CA257B1} => C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)GroupPolicy: Group Policy on Chrome detected <======= ATTENTION ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.comHKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.msn.com/?pc=AV01SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JSSearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JSSearchScopes: HKLM-x32 - DefaultScope value is missing.SearchScopes: HKLM-x32 - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01SearchScopes: HKLM-x32 - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}SearchScopes: HKCU - DefaultScope {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {632F07F3-19A1-4d16-A23F-E6CE9486BAB5} URL = http://www.bing.com/search?q={searchTerms}&FORM=AVASDF&PC=AV01SearchScopes: HKCU - {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = http://us.yhs4.search.yahoo.com/yhs/search?hspart=avast&hsimp=yhs-001&type={partner_id}&p={searchTerms}BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll (RealDownloader)BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)BHO: No Name -> {433450CD-9515-34D1-FB34-59ED33BC499F} -> No FileBHO: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO: CIESpeechBHO Class -> {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} -> C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)BHO: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\Office15\OCHelper.dll (Microsoft Corporation)BHO-x32: No Name -> {433450CD-9515-34D1-FB34-59ED33BC499F} -> No FileBHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\Office15\GROOVEEX.DLL (Microsoft Corporation)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)DPF: HKLM-x32 {EBF1BFCB-F60B-4DCB-9C96-E53C543CB645} http://ahp0516:8080/qcbin/ALM-Platform-Loader.11.cabDPF: HKLM-x32 {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cabHandler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)Hosts: 12.8.181.48 south.avmed.orgTcpip\Parameters: [DhcpNameServer] 172.25.0.92 172.25.0.95 172.29.0.60 172.29.0.65 FireFox:========FF Plugin: @java.com/DTPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42 - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/Lync,version=15.0 - C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @real.com/nppl3260;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=17.0.11 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpplugin;version=17.0.11.0 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\markb_000\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)FF Plugin ProgramFiles/Appdata: C:\Users\markb_000\AppData\Roaming\mozilla\plugins\npatgpc.dll (Cisco WebEx LLC)FF HKLM-x32\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-07-03] Chrome: =======CHR HomePage: hxxp://www.msn.com/?pc=AV01CHR StartupUrls: "https://www.google.com/"CHR Extension: (Google Docs) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-12-02]CHR Extension: (Google Drive) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-12-02]CHR Extension: (YouTube) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-12-02]CHR Extension: (Google Search) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-12-02]CHR Extension: (Best Save) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\gecgipfabdickgidpmbicneamekgbaej [2014-01-13]CHR Extension: (RealPlayer Downloader) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-01-13]CHR Extension: (Google Wallet) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-02]CHR Extension: (Gmail) - C:\Users\markb_000\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-12-02]CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10] ==================== Services (Whitelisted) ================= R2 ASUS InstantOn; C:\Program Files\ASUS\P4G\InsOnSrv.exe [277120 2013-03-26] (ASUS)R2 Asus WebStorage Windows Service; C:\Program Files (x86)\ASUS\WebStorage Sync Agent\1.1.18.159\AsusWSWinService.exe [72192 2012-12-19] () [File not signed]R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [227456 2013-01-25] (Qualcomm Atheros Commnucations)R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)R2 DptfParticipantProcessorService; C:\Windows\system32\DptfParticipantProcessorService.exe [31632 2013-01-18] (Intel Corporation)R2 DptfPolicyConfigTDPService; C:\Windows\system32\DptfPolicyConfigTDPService.exe [33168 2013-01-18] (Intel Corporation)R2 DptfPolicyLpmService; C:\Windows\system32\DptfPolicyLpmService.exe [39824 2013-01-18] (Intel Corporation)R2 ExpressCache; C:\Program Files\Diskeeper Corporation\ExpressCache\ExpressCache.exe [79664 2012-03-30] (Diskeeper Corporation)R2 Intel® ME Service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)R2 irstrtsv; C:\Windows\SysWOW64\irstrtsv.exe [193576 2012-07-30] (Intel Corporation)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)S4 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)S3 McAWFwk; C:\Program Files\Common Files\mcafee\ActWiz\McAWFwk.exe [334608 2013-07-24] (McAfee, Inc.)R2 Net Driver HPZ12; C:\Windows\System32\HPZinw12.dll [71680 2010-01-18] (Hewlett-Packard) [File not signed]R2 Pml Driver HPZ12; C:\Windows\System32\HPZipm12.dll [89600 2010-01-18] (Hewlett-Packard) [File not signed]R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-07-03] (RealNetworks, Inc.)R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-10] () [File not signed]R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation)R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation)R2 ZAtheros Bt and Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2013-01-25] (Atheros) [File not signed] ==================== Drivers (Whitelisted) ==================== S3 ATP; C:\Windows\System32\drivers\AsusTP.sys [65784 2013-04-16] (ASUS Corporation)S3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [77464 2013-01-25] (Qualcomm Atheros)R3 BthLEEnum; C:\Windows\System32\drivers\BthLEEnum.sys [226304 2013-12-04] (Microsoft Corporation)R3 DptfDevDram; C:\Windows\system32\DRIVERS\DptfDevDram.sys [107920 2013-01-18] (Intel Corporation)R3 DptfDevFan; C:\Windows\system32\DRIVERS\DptfDevFan.sys [43408 2013-01-18] (Intel Corporation)R3 DptfDevGen; C:\Windows\system32\DRIVERS\DptfDevGen.sys [65424 2013-01-18] (Intel Corporation)R3 DptfDevPch; C:\Windows\system32\DRIVERS\DptfDevPch.sys [97680 2013-01-18] (Intel Corporation)R3 DptfDevProc; C:\Windows\system32\DRIVERS\DptfDevProc.sys [229776 2013-01-18] (Intel Corporation)R3 DptfManager; C:\Windows\system32\DRIVERS\DptfManager.sys [363920 2013-01-18] (Intel Corporation)R1 excfs; C:\Windows\System32\DRIVERS\excfs.sys [23344 2012-03-30] (Diskeeper Corporation)R0 excsd; C:\Windows\System32\DRIVERS\excsd.sys [95024 2012-03-30] (Diskeeper Corporation)R3 irstrtdv; C:\Windows\System32\drivers\irstrtdv.sys [43800 2012-07-30] (Intel Corporation)R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-01] ( )R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)S3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)R2 plctrl; C:\Program Files\ASUS\P4G\plctrl.sys [18304 2013-03-26] (ASUSTek Computer Inc.)R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-08-28] (Synaptics Incorporated)R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-07-21 23:11 - 2014-07-21 23:11 - 00000000 ____D () C:\Users\markb_000\Desktop\FRST-OlderVersion2014-07-21 23:09 - 2014-07-21 23:09 - 00001271 _____ () C:\Users\markb_000\Desktop\eset.txt2014-07-21 17:50 - 2014-07-21 17:51 - 02347384 _____ (ESET) C:\Users\markb_000\Desktop\esetsmartinstaller_enu.exe2014-07-21 17:09 - 2014-07-21 17:09 - 00003356 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-21 16:49 - 2014-07-21 16:49 - 01354223 _____ () C:\Users\markb_000\Desktop\AdwCleaner.exe2014-07-21 11:45 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll2014-07-21 11:45 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe2014-07-21 11:45 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe2014-07-21 11:45 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe2014-07-21 11:43 - 2014-07-21 11:45 - 00004116 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_65-b20.log2014-07-15 15:43 - 2014-07-15 15:46 - 00039429 _____ () C:\Users\markb_000\Desktop\Addition.txt2014-07-15 15:39 - 2014-07-22 18:16 - 00025831 _____ () C:\Users\markb_000\Desktop\FRST.txt2014-07-15 15:38 - 2014-07-22 18:16 - 00000000 ____D () C:\FRST2014-07-15 15:34 - 2014-07-21 23:11 - 02090496 _____ (Farbar) C:\Users\markb_000\Desktop\FRST64.exe2014-07-12 15:43 - 2014-07-12 15:44 - 00167054 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1 (1).xlsx2014-07-10 08:06 - 2014-06-26 16:55 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe2014-07-10 08:06 - 2014-06-26 16:55 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl2014-07-10 08:03 - 2014-07-10 08:03 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel2014-07-10 02:35 - 2014-04-13 23:29 - 01018880 _____ (Microsoft Corporation) C:\WINDOWS\system32\termsrv.dll2014-07-10 02:16 - 2014-06-18 21:39 - 23464448 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll2014-07-10 02:16 - 2014-06-18 20:16 - 17276416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll2014-07-10 02:16 - 2014-06-18 19:46 - 00250880 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll2014-07-10 02:16 - 2014-06-18 18:57 - 00225280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll2014-07-10 02:16 - 2014-06-16 18:26 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\osk.exe2014-07-10 02:16 - 2014-06-16 18:24 - 00834048 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe2014-07-10 02:16 - 2014-06-06 10:20 - 04190720 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys2014-07-10 02:15 - 2014-06-18 20:48 - 02768384 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll2014-07-10 02:15 - 2014-06-18 20:09 - 00452608 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll2014-07-10 02:15 - 2014-06-18 19:51 - 05721088 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll2014-07-10 02:15 - 2014-06-18 19:50 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll2014-07-10 02:15 - 2014-06-18 19:48 - 00292864 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll2014-07-10 02:15 - 2014-06-18 19:39 - 00608768 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe2014-07-10 02:15 - 2014-06-18 19:33 - 00631808 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll2014-07-10 02:15 - 2014-06-18 19:32 - 02179072 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll2014-07-10 02:15 - 2014-06-18 19:27 - 02040832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl2014-07-10 02:15 - 2014-06-18 19:12 - 00367616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll2014-07-10 02:15 - 2014-06-18 18:59 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll2014-07-10 02:15 - 2014-06-18 18:58 - 02266112 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll2014-07-10 02:15 - 2014-06-18 18:58 - 00239616 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll2014-07-10 02:15 - 2014-06-18 18:52 - 04254720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll2014-07-10 02:15 - 2014-06-18 18:51 - 13527040 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll2014-07-10 02:15 - 2014-06-18 18:49 - 00526336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll2014-07-10 02:15 - 2014-06-18 18:45 - 01964544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl2014-07-10 02:15 - 2014-06-18 18:35 - 11742208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll2014-07-10 02:15 - 2014-06-18 18:34 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll2014-07-10 02:15 - 2014-06-18 18:15 - 00846336 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll2014-07-10 02:15 - 2014-06-18 18:13 - 01791488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll2014-07-10 02:15 - 2014-06-18 18:09 - 01139200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll2014-07-10 02:15 - 2014-06-18 18:07 - 00704512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll2014-07-10 02:15 - 2014-06-06 09:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll2014-07-10 02:15 - 2014-06-06 08:18 - 00488960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll2014-07-10 02:15 - 2014-05-29 23:03 - 00563200 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\afd.sys2014-07-10 02:15 - 2014-05-29 08:02 - 00565576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\cng.sys2014-07-10 02:15 - 2014-05-29 03:55 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\system32\adtschema.dll2014-07-10 02:15 - 2014-05-29 02:40 - 00735232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\adtschema.dll2014-07-10 02:15 - 2014-05-29 02:37 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll2014-07-10 02:15 - 2014-05-29 01:34 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll2014-07-10 02:15 - 2014-05-29 01:27 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll2014-07-10 02:14 - 2014-06-30 18:45 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll2014-07-10 02:14 - 2014-06-28 03:48 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll2014-07-10 02:14 - 2014-06-28 03:07 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll2014-07-10 02:14 - 2014-05-30 23:40 - 13287936 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll2014-07-10 02:14 - 2014-05-30 22:36 - 00923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll2014-07-10 02:14 - 2014-05-30 22:32 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll2014-07-10 02:13 - 2014-05-31 06:07 - 00054776 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe2014-07-10 02:13 - 2014-05-31 06:06 - 00555736 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.appcore.dll2014-07-10 02:13 - 2014-05-30 23:30 - 11792384 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll2014-07-10 02:13 - 2014-05-30 23:12 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll2014-07-10 02:13 - 2014-05-30 23:06 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll2014-07-10 02:13 - 2014-05-30 23:03 - 00827392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll2014-07-10 02:13 - 2014-05-30 23:01 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll2014-07-10 02:13 - 2014-05-30 22:56 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll2014-07-10 02:13 - 2014-05-30 22:54 - 00666624 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll2014-07-10 02:13 - 2014-05-30 22:48 - 03463680 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll2014-07-10 02:13 - 2014-05-30 22:37 - 01054208 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.appcore.dll2014-07-10 02:13 - 2014-05-30 22:35 - 00828928 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.appcore.dll2014-07-10 02:06 - 2014-07-10 02:06 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe2014-07-03 17:25 - 2014-07-03 17:25 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\RealNetworks2014-07-03 12:23 - 2014-07-03 12:23 - 00001058 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk2014-07-03 12:23 - 2014-07-03 12:23 - 00000000 ____D () C:\Program Files (x86)\RealNetworks2014-07-03 12:22 - 2014-07-03 12:22 - 00000000 ____D () C:\ProgramData\RealNetworks2014-07-03 12:18 - 2014-07-21 17:09 - 00003302 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-02 10:11 - 2014-07-02 10:21 - 924643538 _____ () C:\Users\markb_000\Desktop\Magura+Final+Slideshow-HD.mp42014-06-23 14:01 - 2014-06-23 14:01 - 00000000 ____D () C:\Users\markb_000\AppData\Local\HP ==================== One Month Modified Files and Folders ======= 2014-07-22 18:16 - 2014-07-15 15:39 - 00025831 _____ () C:\Users\markb_000\Desktop\FRST.txt2014-07-22 18:16 - 2014-07-15 15:38 - 00000000 ____D () C:\FRST2014-07-22 18:07 - 2014-02-10 15:06 - 00000612 _____ () C:\WINDOWS\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-1002.job2014-07-22 18:00 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\sru2014-07-22 17:28 - 2013-12-01 19:12 - 00005006 _____ () C:\WINDOWS\System32\Tasks\Microsoft Office 15 Sync Maintenance for ACCELARE_8F9-markb_000 ACCELARE_8F92014-07-22 17:18 - 2013-12-02 17:32 - 00000930 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job2014-07-22 14:47 - 2013-11-27 16:51 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3360600101-872847150-3038642983-10022014-07-22 14:38 - 2013-11-14 03:28 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI2014-07-22 14:36 - 2013-12-02 17:33 - 00002165 _____ () C:\Users\Public\Desktop\Google Chrome.lnk2014-07-22 14:35 - 2014-04-02 08:24 - 00003378 _____ () C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-22 14:35 - 2014-04-02 08:24 - 00003324 _____ () C:\WINDOWS\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-22 14:35 - 2014-01-14 16:08 - 00003474 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update12014-07-22 14:35 - 2014-01-14 16:08 - 00003464 _____ () C:\WINDOWS\System32\Tasks\ASUS Live Update22014-07-22 14:35 - 2013-12-01 19:15 - 00000000 __RDO () C:\Users\markb_000\SkyDrive2014-07-22 14:35 - 2013-11-27 16:44 - 00000062 _____ () C:\Users\markb_000\AppData\Roaming\sp_data.sys2014-07-22 14:34 - 2014-01-13 15:11 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Deployment2014-07-22 14:34 - 2013-12-02 17:32 - 00000926 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job2014-07-22 14:34 - 2013-08-22 10:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT2014-07-22 14:33 - 2013-08-22 09:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI2014-07-22 14:18 - 2013-12-19 10:57 - 00003814 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{BED9303B-00AE-447C-A08C-276597FF66A7}2014-07-22 13:56 - 2013-11-27 16:44 - 00000000 ____D () C:\Users\markb_000\AppData\Local\Packages2014-07-22 11:35 - 2013-12-19 10:31 - 01400083 _____ () C:\WINDOWS\WindowsUpdate.log2014-07-22 11:13 - 2013-12-02 17:32 - 00003902 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA2014-07-22 11:13 - 2013-12-02 17:32 - 00003666 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore2014-07-22 11:10 - 2013-11-14 03:20 - 00410846 _____ () C:\WINDOWS\PFRO.log2014-07-22 07:58 - 2014-04-29 17:19 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys2014-07-22 00:11 - 2014-01-12 22:50 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\vlc2014-07-21 23:11 - 2014-07-21 23:11 - 00000000 ____D () C:\Users\markb_000\Desktop\FRST-OlderVersion2014-07-21 23:11 - 2014-07-15 15:34 - 02090496 _____ (Farbar) C:\Users\markb_000\Desktop\FRST64.exe2014-07-21 23:09 - 2014-07-21 23:09 - 00001271 _____ () C:\Users\markb_000\Desktop\eset.txt2014-07-21 21:26 - 2013-11-27 16:48 - 00000000 ____D () C:\Users\markb_000\AppData\Local\CrashDumps2014-07-21 17:51 - 2014-07-21 17:50 - 02347384 _____ (ESET) C:\Users\markb_000\Desktop\esetsmartinstaller_enu.exe2014-07-21 17:09 - 2014-07-21 17:09 - 00003356 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-21 17:09 - 2014-07-03 12:18 - 00003302 _____ () C:\WINDOWS\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3360600101-872847150-3038642983-10022014-07-21 17:05 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\L2Schemas2014-07-21 17:03 - 2014-05-23 08:43 - 00000000 ____D () C:\AdwCleaner2014-07-21 16:49 - 2014-07-21 16:49 - 01354223 _____ () C:\Users\markb_000\Desktop\AdwCleaner.exe2014-07-21 11:47 - 2014-01-04 21:11 - 00000000 ____D () C:\ProgramData\Oracle2014-07-21 11:45 - 2014-07-21 11:43 - 00004116 _____ () C:\WINDOWS\SysWOW64\jupdate-1.7.0_65-b20.log2014-07-21 11:45 - 2014-01-04 21:11 - 00000000 ____D () C:\Program Files (x86)\Java2014-07-17 13:53 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\FxsTmp2014-07-17 13:44 - 2013-08-22 10:46 - 00341078 _____ () C:\WINDOWS\setupact.log2014-07-15 15:46 - 2014-07-15 15:43 - 00039429 _____ () C:\Users\markb_000\Desktop\Addition.txt2014-07-15 15:35 - 2013-12-19 10:54 - 00000000 ____D () C:\Users\markb_000\Downloads\Cleaning2014-07-14 17:02 - 2014-01-13 18:32 - 00002294 ____H () C:\Users\markb_000\Documents\Default.rdp2014-07-12 15:44 - 2014-07-12 15:43 - 00167054 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1 (1).xlsx2014-07-11 03:02 - 2014-07-21 11:45 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll2014-07-11 02:56 - 2014-07-21 11:45 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe2014-07-11 02:56 - 2014-07-21 11:45 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe2014-07-11 02:55 - 2014-07-21 11:45 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe2014-07-10 11:40 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\rescache2014-07-10 08:06 - 2013-08-22 10:44 - 00474072 _____ () C:\WINDOWS\system32\FNTCACHE.DAT2014-07-10 08:03 - 2014-07-10 08:03 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel2014-07-10 08:03 - 2013-11-14 03:17 - 00000000 ____D () C:\Program Files\Windows Journal2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\WINDOWS\ToastData2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility2014-07-10 08:03 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\WinStore2014-07-10 02:48 - 2012-07-26 03:59 - 00000000 ____D () C:\WINDOWS\CbsTemp2014-07-10 02:45 - 2013-11-21 17:13 - 00000000 ____D () C:\WINDOWS\system32\MRT2014-07-10 02:38 - 2013-11-21 17:13 - 96441528 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe2014-07-10 02:38 - 2013-08-22 10:46 - 00000440 _____ () C:\WINDOWS\setuperr.log2014-07-10 02:06 - 2014-07-10 02:06 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSReset.exe2014-07-09 15:17 - 2014-04-11 12:53 - 00171617 _____ () C:\Users\markb_000\Downloads\Billable Time Template v1.xlsx2014-07-09 14:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\Help2014-07-09 14:12 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\addins2014-07-09 14:12 - 2012-07-26 04:12 - 00000000 ___HD () C:\WINDOWS\ELAMBKUP2014-07-08 16:28 - 2013-08-22 09:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM2014-07-08 15:51 - 2014-02-10 15:06 - 00003628 _____ () C:\WINDOWS\System32\Tasks\G2MUpdateTask-S-1-5-21-3360600101-872847150-3038642983-10022014-07-03 17:25 - 2014-07-03 17:25 - 00000000 ____D () C:\Users\markb_000\AppData\Roaming\RealNetworks2014-07-03 12:55 - 2012-07-26 04:12 - 00000000 ____D () C:\WINDOWS\LiveKernelReports2014-07-03 12:23 - 2014-07-03 12:23 - 00001058 _____ () C:\Users\Public\Desktop\RealPlayer Cloud.lnk2014-07-03 12:23 - 2014-07-03 12:23 - 00000000 ____D () C:\Program Files (x86)\RealNetworks2014-07-03 12:23 - 2014-01-12 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RealNetworks2014-07-03 12:22 - 2014-07-03 12:22 - 00000000 ____D () C:\ProgramData\RealNetworks2014-07-03 12:22 - 2014-01-12 22:45 - 00000000 ____D () C:\Program Files (x86)\Real2014-07-03 12:21 - 2014-04-02 08:18 - 00278600 _____ (Progressive Networks) C:\WINDOWS\SysWOW64\pncrt.dll2014-07-03 12:21 - 2014-04-02 08:18 - 00201800 _____ (RealNetworks, Inc.) C:\WINDOWS\SysWOW64\rmoc3260.dll2014-07-03 12:21 - 2014-01-12 22:43 - 00000000 ____D () C:\ProgramData\Real2014-07-03 12:20 - 2014-04-02 08:18 - 00505416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcp71.dll2014-07-03 12:20 - 2014-04-02 08:18 - 00353864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr71.dll2014-07-03 12:15 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\Web2014-07-03 12:06 - 2013-08-22 11:36 - 00000000 ____D () C:\WINDOWS\system32\NDF2014-07-02 10:21 - 2014-07-02 10:11 - 924643538 _____ () C:\Users\markb_000\Desktop\Magura+Final+Slideshow-HD.mp42014-07-02 09:00 - 2013-12-01 19:18 - 00000000 ____D () C:\Users\markb_000\Documents\Admin2014-06-30 18:45 - 2014-07-10 02:14 - 00688128 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll2014-06-28 03:48 - 2014-07-10 02:14 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll2014-06-28 03:07 - 2014-07-10 02:14 - 00385536 _____ (Microsoft Corporation) C:\WINDOWS\system32\devinv.dll2014-06-26 16:55 - 2014-07-10 08:06 - 00703968 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe2014-06-26 16:55 - 2014-07-10 08:06 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl2014-06-25 21:43 - 2014-05-21 11:00 - 00000000 ____D () C:\Users\markb_000\Documents\OneNote Notebooks2014-06-24 11:54 - 2014-06-09 08:43 - 00002990 _____ () C:\WINDOWS\System32\Tasks\Synaptics TouchPad Enhancements2014-06-23 14:01 - 2014-06-23 14:01 - 00000000 ____D () C:\Users\markb_000\AppData\Local\HP2014-06-23 12:01 - 2014-02-12 14:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office 2013 Some content of TEMP:====================C:\Users\markb_000\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-07-22 14:47 ==================== End Of Log ============================ Link to post Share on other sites More sharing options...
deeprybka Posted July 22, 2014 ID:856474 Share Posted July 22, 2014 That's it! Your logs look clean to me at the moment. We're gonna clean up everything now, close security holes on your computer and in the end I'll provide you with a list of security tips so you hopefully will not need our help anymore in the future. My help is free for everybody. If you want to support me fighting against malware or buy me a beer for the assistance you received, then you can consider a donation: . Thank you! Clean Up Now we remove all the tools we used (including their logs and quarantine folders), restore your settings and delete old and infected system restorepoints:You can uninstall programs that you had to install (e.g. MBAM or ESET Onlinescanner) in the control panel if you so wish.Download DelFix (by Xplode) and save it to your Desktop.Close all running programs and start delfix.exe.Make sure that all available options are checked.Click on RunDelFix should remove all our tools and delete itself afterwards. I don't need the log file.If there is still something left you can delete it manually.Closing security holes Many infections happen via drive-by downloads that run unnoticed in the background while the user visits an infected website. To achieve this malware exploits security holes in installed software (e.g. browser or its plugins). Older versions of such software often have lots of known exploitable holes. Therefor it's very important to always keep your software up-to-date. The following software is outdated. Make sure you remove all old versions and install the current one instead if you need the program: Adobe Reader X Java 7 Update 51 (64-bit) Java 7 Update 51 Google Chrome Tips I recommend to read and follow the "16 simple and easy ways to keep your computer safe and secure on the Internet" (Link) by Lawrence Abrams. Link to post Share on other sites More sharing options...
MSB13 Posted July 23, 2014 Author ID:856842 Share Posted July 23, 2014 Thank you for all your help Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 23, 2014 Root Admin ID:856969 Share Posted July 23, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts