Jump to content

Multiple DLLHost.EXE Processes


van692
 Share

Recommended Posts

I have a PC that appears to be infected with something.  Whenever using the internet numerous dllhost.exe processes start until CPU usage spikes at 100%.  I have tried running virus scans (using Vipre antivirus) and also ran Malwarebytes normally and in safe mode several times, but the issue remains.  I have been reading some of the other topics that sound like this issue as well that you've been able to help.  I hope you're able to help me as well. 

 

Link to post
Share on other sites

Here's the ComboFix log:

 

ComboFix 14-08-29.03 - Molly 08/29/2014  17:01:39.2.2 - x64
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.1.1033.18.6142.4194 [GMT -5:00]
Running from: c:\users\Molly\Desktop\ComboFix.exe
AV: ThreatTrack Security VIPRE *Disabled/Updated* {FFE93D16-FD09-0282-C7D3-8B1731B6A051}
SP: ThreatTrack Security VIPRE *Disabled/Updated* {4488DCF2-DB33-0D0C-FD63-B0654A31EAEC}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\uninstall.exe
c:\users\Molly\AppData\Local\.#
c:\windows\SysWow64\u
c:\windows\wininit.ini
.
.
CLSID={AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} - infected with Poweliks and removed.
You should verify if current CLSID data is correct:
.
HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}
    (Default)    REG_SZ    Thumbnail Cache Class Factory for Out of Proc Server
    AppID    REG_SZ    {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}
.
HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32
    (Default)    REG_SZ    c:\windows\system32\thumbcache.dll
    ThreadingModel    REG_SZ    Apartment
.
.
(((((((((((((((((((((((((   Files Created from 2014-07-28 to 2014-08-29  )))))))))))))))))))))))))))))))
.
.
2014-08-29 22:18 . 2014-08-29 22:18 -------- d-----w- c:\users\Molly\AppData\Local\temp
2014-08-29 22:18 . 2014-08-29 22:18 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-08-29 13:35 . 2014-08-29 13:35 -------- d-----w- c:\program files\Ventrilo
2014-08-29 13:34 . 2014-08-29 13:34 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard
2014-08-29 11:50 . 2014-08-29 11:50 -------- d--h--w- c:\programdata\CanonBJ
2014-08-29 03:44 . 2014-08-29 03:44 -------- d-----w- c:\program files (x86)\Battle.net
2014-08-29 03:29 . 2014-08-29 11:49 -------- d-----w- c:\users\Test
2014-08-28 20:42 . 2014-08-29 21:08 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-08-28 20:40 . 2014-05-12 12:26 64216 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-08-28 20:40 . 2014-05-12 12:26 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-08-28 20:40 . 2014-08-28 20:40 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-08-28 17:36 . 2014-08-28 17:36 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2014-08-28 17:30 . 2014-07-02 10:14 3826628 ----a-w- c:\windows\system32\nvcoproc.bin
2014-08-28 15:49 . 2014-08-28 17:06 -------- d-----w- c:\users\Molly\AppData\Local\NVIDIA
2014-08-28 13:44 . 2014-08-23 01:05 304128 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-28 13:44 . 2014-08-23 00:42 390144 ----a-w- c:\windows\system32\gdi32.dll
2014-08-28 13:44 . 2014-08-22 23:38 2782208 ----a-w- c:\windows\system32\win32k.sys
2014-08-16 08:04 . 2014-06-26 22:17 171152 ----a-w- c:\windows\system32\infocardapi.dll
2014-08-16 08:04 . 2014-06-26 22:17 99480 ----a-w- c:\windows\SysWow64\infocardapi.dll
2014-08-16 08:04 . 2014-06-26 22:17 8856 ----a-w- c:\windows\SysWow64\icardres.dll
2014-08-16 08:04 . 2014-06-26 22:17 8848 ----a-w- c:\windows\system32\icardres.dll
2014-08-16 08:04 . 2014-06-26 22:17 1389200 ----a-w- c:\windows\system32\icardagt.exe
2014-08-16 08:04 . 2014-06-26 22:17 619664 ----a-w- c:\windows\SysWow64\icardagt.exe
2014-08-16 08:03 . 2014-06-06 04:29 35480 ----a-w- c:\windows\system32\TsWpfWrp.exe
2014-08-16 08:03 . 2014-06-06 04:28 35480 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
2014-08-15 11:49 . 2014-06-14 00:56 901568 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
2014-08-15 11:49 . 2014-06-14 00:51 47104 ----a-w- c:\windows\system32\cdd.dll
2014-08-15 11:47 . 2014-07-24 17:50 469504 ----a-w- c:\program files (x86)\Internet Explorer\ieinstal.exe
2014-08-15 11:47 . 2014-07-08 00:46 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-08-15 11:47 . 2014-07-08 01:12 2048 ----a-w- c:\windows\system32\tzres.dll
2014-08-15 11:47 . 2014-06-02 21:30 3137536 ----a-w- c:\windows\system32\msi.dll
2014-08-15 11:47 . 2014-06-02 10:31 2263552 ----a-w- c:\windows\SysWow64\msi.dll
2014-08-15 11:47 . 2014-06-02 21:29 2280448 ----a-w- c:\windows\system32\authui.dll
2014-08-15 11:47 . 2014-06-02 10:30 1993728 ----a-w- c:\windows\SysWow64\authui.dll
2014-08-15 11:47 . 2014-06-02 20:29 87552 ----a-w- c:\windows\system32\consent.exe
2014-08-15 11:47 . 2014-06-02 21:30 503296 ----a-w- c:\windows\system32\msihnd.dll
2014-08-15 11:47 . 2014-06-02 21:29 45056 ----a-w- c:\windows\system32\appinfo.dll
2014-08-15 11:47 . 2014-06-02 10:31 332800 ----a-w- c:\windows\SysWow64\msihnd.dll
2014-08-05 18:20 . 2014-08-05 18:20 -------- d-----w- c:\program files (x86)\REDRAGON GAMING MOUSE
2014-08-01 23:37 . 2014-08-01 23:37 0 ----a-w- c:\windows\system32\oxwvet.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-08-28 22:12 . 2010-06-24 16:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-08-16 08:16 . 2006-11-02 12:35 99218768 ----a-w- c:\windows\system32\mrt.exe
2014-08-11 20:31 . 2014-05-17 22:55 1515296 ----a-w- c:\windows\system32\nvhdagenco6420103.dll
2014-07-03 14:22 . 2014-07-03 14:21 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2014-07-02 20:48 . 2014-05-17 22:54 75040 ----a-w- c:\windows\system32\OpenCL.dll
2014-07-02 20:48 . 2014-05-17 22:54 61912 ----a-w- c:\windows\SysWow64\OpenCL.dll
2014-07-02 20:48 . 2014-05-17 22:52 14498552 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2014-07-02 20:48 . 2014-05-17 22:52 17555104 ----a-w- c:\windows\system32\nvd3dumx.dll
2014-07-02 20:48 . 2014-05-17 22:51 3196816 ----a-w- c:\windows\system32\nvapi64.dll
2014-07-02 18:55 . 2014-05-17 22:55 6783776 ----a-w- c:\windows\system32\nvcpl.dll
2014-07-02 18:55 . 2014-05-17 22:55 3522392 ----a-w- c:\windows\system32\nvsvc64.dll
2014-07-02 18:55 . 2014-05-17 22:55 935368 ----a-w- c:\windows\system32\nvvsvc.exe
2014-07-02 18:55 . 2014-05-17 22:55 62808 ----a-w- c:\windows\system32\nvshext.dll
2014-07-02 18:55 . 2014-05-17 22:55 386520 ----a-w- c:\windows\system32\nvmctray.dll
2014-06-06 08:59 . 2014-07-09 15:43 506880 ----a-w- c:\windows\SysWow64\qedit.dll
2014-06-06 07:13 . 2014-07-09 15:43 620032 ----a-w- c:\windows\system32\qedit.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Medialink Utilty"="c:\program files (x86)\Medialink\MWN-USB150N\UI.exe" [2009-08-21 2281488]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Gateway Photo Frame"="c:\program files (x86)\Gateway Photo Frame\ButtonMonitor.exe" [2009-05-05 123904]
"LchDrvKey"="LchDrvKey.exe" [2007-03-29 36864]
"LedKey"="CNYHKey.exe" [2008-04-24 339968]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-10-28 49208]
"SBAMTray"="c:\program files (x86)\VIPRE\SBAMTray.exe" [2013-09-06 3216272]
"PerditiongmmouseRun"="c:\program files (x86)\REDRAGON GAMING MOUSE\pdmon.exe" [2013-11-18 3234304]
"IJNetworkScanUtility"="c:\program files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE" [2010-01-19 124256]
.
c:\users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CurseClientStartup.ccip [2014-8-29 0]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-8-24 1148944]
NETGEAR WG311T Smart Wizard.lnk - c:\program files (x86)\NETGEAR\WG311T\wlancfg5.exe /HIDE [2006-9-14 1503232]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBAMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBPIMSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - GFIUTIL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ    hpqcxs08 hpqddsvc
.
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost  - NetSvcs
Themes
.
Contents of the 'Scheduled Tasks' folder
.
2014-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-05 03:00]
.
2014-08-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-02-05 03:00]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Bluetooth Connection Assistant"="LBTWIZ.EXE -silent" [X]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-03-30 7574048]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-03-30 1833504]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 134160]
"Launch LCore"="c:\program files\Logitech Gaming Software\LCore.exe" [2014-04-15 10396440]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-08-09 2403288]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300
mDefault_Page_URL = hxxp://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
Handler: vipresg - {47BE2E5B-703B-444F-ABD3-05717D2191C6} - c:\program files (x86)\VIPRE\VSG.dll
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
SafeBoot-WudfPf
SafeBoot-WudfRd
HKLM-Run-SBRegRebootCleaner - c:\program files (x86)\Sunbelt Software\VIPRE\SBRC.exe
HKLM-Run-Nvtmru - c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_206_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.13"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_206.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
Completion time: 2014-08-29  17:26:30
ComboFix-quarantined-files.txt  2014-08-29 22:26
.
Pre-Run: 478,184,337,408 bytes free
Post-Run: 479,578,456,064 bytes free
.
- - End Of File - - 8E6CE460B2622FA95F1BCFFF3257F6B9
EF932EAA6EF4C94E66A7F6CEEC7EB422
 

Link to post
Share on other sites

Here's the Malwarebytes Log:

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 8/29/2014
Scan Time: 5:29:00 PM
Logfile: MalwareBytesResults.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.29.07
Rootkit Database: v2014.08.21.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows Vista Service Pack 2
CPU: x64
File System: NTFS
User: Molly

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 353839
Time Elapsed: 10 min, 36 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

Link to post
Share on other sites

Here's the FRST log:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 29-08-2014 01
Ran by Molly (administrator) on MOLLY-PC on 29-08-2014 17:49:52
Running from C:\Users\Molly\Desktop
Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(ATI Technologies Inc.) C:\Windows\System32\Ati2evxx.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
(ThreatTrack Security, Inc.) C:\Program Files (x86)\VIPRE\SBPIMSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Logitech Inc.) C:\Program Files\Logitech\SetPoint\LBTWiz.exe
(Logitech Inc.) C:\Program Files\Logitech Gaming Software\LCore.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
() C:\Program Files (x86)\Medialink\MWN-USB150N\UI.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPoint\SetPoint.exe
() C:\Program Files (x86)\NETGEAR\WG311T\wlancfg5.exe
(IOI) C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe
(Creative) C:\Windows\CNYHKey.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
() C:\Program Files (x86)\REDRAGON GAMING MOUSE\PDMon.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
() C:\Windows\mHotkey.exe
(Chicony) C:\Windows\ModLEDKey.exe
() C:\Program Files\Logitech\SetPoint\x86\SetPoint32.exe
(Chicony) C:\Windows\ChiFuncExt.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
(ThreatTrack Security, Inc.) C:\Program Files (x86)\VIPRE\SBAMSvc.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7574048 2009-03-30] (Realtek Semiconductor)
HKLM\...\Run: [skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-30] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => C:\Windows\KHALMNPR.EXE [134160 2007-09-21] (Logitech, Inc.)
HKLM\...\Run: [bluetooth Connection Assistant] => LBTWIZ.EXE -silent
HKLM\...\Run: [sBRegRebootCleaner] => "C:\Program Files (x86)\Sunbelt Software\VIPRE\SBRC.exe"
HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"
HKLM\...\Run: [Launch LCore] => C:\Program Files\Logitech Gaming Software\LCore.exe [10396440 2014-04-14] (Logitech Inc.)
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2403288 2014-08-08] (NVIDIA Corporation)
HKLM-x32\...\Run: [Gateway Photo Frame] => C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe [123904 2009-05-05] (IOI)
HKLM-x32\...\Run: [LchDrvKey] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] ()
HKLM-x32\...\Run: [LedKey] => C:\Windows\CNYHKey.exe [339968 2008-04-23] (Creative)
HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe [58656 2011-04-20] (Apple Inc.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [sBAMTray] => C:\Program Files (x86)\VIPRE\SBAMTray.exe [3216272 2013-09-05] (ThreatTrack Security, Inc.)
HKLM-x32\...\Run: [PerditiongmmouseRun] => C:\Program Files (x86)\REDRAGON GAMING MOUSE\pdmon.exe [3234304 2013-11-18] ()
HKLM-x32\...\Run: [iJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.EXE [124256 2010-01-18] (CANON INC.)
HKU\S-1-5-21-2426545472-3215525461-1865147296-1000\...\Run: [Medialink Utilty] => C:\Program Files (x86)\Medialink\MWN-USB150N\UI.exe [2281488 2009-08-21] ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Logitech SetPoint.lnk
ShortcutTarget: Logitech SetPoint.lnk -> C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\NETGEAR WG311T Smart Wizard.lnk
ShortcutTarget: NETGEAR WG311T Smart Wizard.lnk -> C:\Program Files (x86)\NETGEAR\WG311T\wlancfg5.exe ()
Startup: C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0609&m=dx4300
URLSearchHook: HKCU - (No Name) - {472734EA-242A-422b-ADF8-83D1E48CC825} - No File
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW
SearchScopes: HKCU - DefaultScope {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW_enUS342
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW_enUS342
SearchScopes: HKCU - {88FB16D2-04EA-4ffe-8079-CFF68F1B9CE6} URL = http://www.search-results.com/web?q={searchTerms}&o=15868&l=dis&prt=BDIE&chn=retail&geo=US&ver=3.0.0.1
SearchScopes: HKCU - {9FECCCE0-B67A-4589-9425-CE9E3D884DD6} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=crm&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=9AD45D53-4373-427B-BA50-30FE178C2C6A&apn_sauid=553B8402-7ECC-433D-B725-2B6AA9638D1D&
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: VIPRE Search Guard Helper -> {963C8283-AE7F-4AA6-9B3B-847A8FC62C5E} -> C:\Program Files (x86)\VIPRE\VSG.dll ()
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - VIPRE Search Guard Toolbar - {A924C17A-5E94-4E02-BED5-49720BA6F7FA} - C:\Program Files (x86)\VIPRE\VSG.dll ()
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {472734EA-242A-422B-ADF8-83D1E48CC825} -  No File
Handler: vipresg - {47BE2E5B-703B-444F-ABD3-05717D2191C6} -  No File
Handler-x32: vipresg - {47BE2E5B-703B-444F-ABD3-05717D2191C6} - C:\Program Files (x86)\VIPRE\VSG.dll ()
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF Plugin-x32: @java.com/DTPlugin,version=1.6.0_35 -> C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin -> C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @zylom.com/ZylomGamesPlayer -> C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-08-26]
FF HKLM-x32\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010-07-04]
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [71680 2010-08-06] (Hewlett-Packard) [File not signed]
R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1720792 2014-08-08] (NVIDIA Corporation)
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [89600 2010-08-06] (Hewlett-Packard) [File not signed]
U2 SBAMSvc; C:\Program Files (x86)\VIPRE\SBAMSvc.exe [3937472 2013-09-05] (ThreatTrack Security, Inc.)
R2 SBPIMSvc; C:\Program Files (x86)\VIPRE\SBPIMSvc.exe [176016 2013-09-05] (ThreatTrack Security, Inc.)
R2 yksvc; C:\Windows\System32\ykx64mpcoinst.dll [382464 2009-01-08] (Marvell)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)
S1 Beep; No ImagePath
S3 gfiutil; C:\Windows\System32\drivers\gfiutil.sys [31264 2013-09-04] (ThreatTrack Security)
S3 GKUPRO2D; C:\Windows\System32\Drivers\GKUPRO2D.sys [120704 2005-02-18] (Gemplus)
S3 LGSHidFilt; C:\Windows\System32\DRIVERS\LGSHidFilt.Sys [64280 2013-05-30] (Logitech Inc.)
S3 LGSUsbFilt; C:\Windows\System32\DRIVERS\LGSUsbFilt.Sys [41752 2013-05-30] (Logitech Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-29] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\SysWOW64\drivers\MBAMSwissArmy.sys [38224 2009-12-30] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R2 sbapifs; C:\Windows\System32\DRIVERS\sbapifs.sys [88928 2013-06-18] (ThreatTrack Security, Inc.)
S3 USBCCID; C:\Windows\System32\DRIVERS\usbccid.sys [38400 2008-01-20] (Microsoft Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S1 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-29 17:49 - 2014-08-29 17:50 - 00015834 _____ () C:\Users\Molly\Desktop\FRST.txt
2014-08-29 17:49 - 2014-08-29 17:50 - 00000000 ____D () C:\FRST
2014-08-29 17:49 - 2014-08-29 17:49 - 02103808 _____ (Farbar) C:\Users\Molly\Desktop\FRST64.exe
2014-08-29 17:40 - 2014-08-29 17:44 - 00000000 ____D () C:\AdwCleaner
2014-08-29 17:29 - 2014-08-29 17:40 - 00001074 _____ () C:\Users\Molly\Desktop\MalwareBytesResults.txt
2014-08-29 17:26 - 2014-08-29 17:26 - 00016342 _____ () C:\ComboFix.txt
2014-08-29 16:41 - 2011-06-26 01:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-08-29 16:41 - 2010-11-07 12:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-08-29 16:41 - 2009-04-19 23:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-08-29 16:41 - 2000-08-30 19:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-08-29 16:41 - 2000-08-30 19:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-08-29 16:41 - 2000-08-30 19:00 - 00098816 _____ () C:\Windows\sed.exe
2014-08-29 16:41 - 2000-08-30 19:00 - 00080412 _____ () C:\Windows\grep.exe
2014-08-29 16:41 - 2000-08-30 19:00 - 00068096 _____ () C:\Windows\zip.exe
2014-08-29 16:24 - 2014-08-29 16:30 - 00001684 _____ () C:\Users\Molly\Desktop\Rkill.txt
2014-08-29 16:24 - 2014-08-29 16:24 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\Molly\Desktop\rkill64.exe
2014-08-29 16:23 - 2014-08-29 16:23 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Molly\Desktop\rkill.exe
2014-08-29 16:20 - 2014-08-29 16:20 - 01364531 _____ () C:\Users\Molly\Desktop\adwcleaner_3.308.exe
2014-08-29 16:14 - 2014-08-29 16:14 - 00000000 _____ () C:\Users\Molly\Desktop\RogueKillerX64_exe.05nas1h.partial
2014-08-29 15:48 - 2014-08-29 15:48 - 00001190 _____ () C:\Windows\SysWOW64\ServiceConfig.xml
2014-08-29 08:35 - 2014-08-29 08:36 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Ventrilo
2014-08-29 08:35 - 2014-08-29 08:35 - 00000754 _____ () C:\Users\Test\Desktop\Ventrilo.lnk
2014-08-29 08:35 - 2014-08-29 08:35 - 00000262 _____ () C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
2014-08-29 08:35 - 2014-08-29 08:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ventrilo
2014-08-29 08:35 - 2014-08-29 08:35 - 00000000 ____D () C:\Program Files\Ventrilo
2014-08-29 08:33 - 2014-08-29 08:34 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Curse Advertising
2014-08-29 08:32 - 2014-08-29 15:11 - 00000000 ____D () C:\Users\Test\AppData\Local\Deployment
2014-08-29 08:32 - 2014-08-29 08:32 - 00000318 _____ () C:\Users\Test\Desktop\Curse Client.appref-ms
2014-08-29 08:32 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse
2014-08-29 08:32 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Local\Apps\2.0
2014-08-29 06:50 - 2014-08-29 06:50 - 00001846 _____ () C:\Users\Public\Desktop\Canon IJ Network Tool.lnk
2014-08-29 06:50 - 2014-08-29 06:50 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-08-29 06:50 - 2014-08-29 06:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon IJ Network Utilities
2014-08-29 06:49 - 2014-08-29 06:49 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-08-29 06:49 - 2014-08-29 06:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP970 series
2014-08-29 06:48 - 2014-08-29 06:48 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-08-29 06:48 - 2007-07-11 08:55 - 00261120 _____ (CANON INC.) C:\Windows\system32\CNC970L.DLL
2014-08-29 06:48 - 2007-05-22 05:00 - 00258560 _____ (CANON INC.) C:\Windows\system32\CNMLM91.DLL
2014-08-29 06:48 - 2007-04-17 09:10 - 01440256 _____ (CANON INC.) C:\Windows\system32\CNC970C.DLL
2014-08-29 06:48 - 2007-04-17 09:09 - 00092672 _____ (CANON INC.) C:\Windows\system32\CNC970I.DLL
2014-08-29 06:48 - 2007-03-15 14:13 - 00229888 _____ (Canon Inc.) C:\Windows\system32\CNC970O.DLL
2014-08-29 06:47 - 2014-08-29 06:50 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-08-29 06:47 - 2012-08-30 11:18 - 00252416 _____ (CANON INC.) C:\Windows\system32\CNMN6PPM.DLL
2014-08-29 06:47 - 2012-08-30 11:18 - 00152064 _____ (CANON INC.) C:\Windows\system32\CNMN6UI.DLL
2014-08-29 06:47 - 2012-08-30 11:15 - 00366080 _____ (CANON INC.) C:\Windows\SysWOW64\CNMNPPM.DLL
2014-08-29 06:47 - 2007-03-20 00:14 - 00117850 _____ () C:\Windows\system32\Cnmnput.chm
2014-08-28 22:46 - 2014-08-28 22:46 - 00001077 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2014-08-28 22:46 - 2014-08-28 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-08-28 22:44 - 2014-08-29 15:28 - 00000000 ____D () C:\Users\Test\AppData\Local\Battle.net
2014-08-28 22:44 - 2014-08-28 22:45 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Battle.net
2014-08-28 22:44 - 2014-08-28 22:44 - 00000985 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Roaming\NVIDIA
2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Local\Blizzard Entertainment
2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-28 22:38 - 2014-08-28 22:38 - 02942368 _____ (Blizzard Entertainment) C:\Users\Test\Downloads\World-of-Warcraft-Setup-enUS.exe
2014-08-28 22:35 - 2014-08-29 06:45 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Google
2014-08-28 22:35 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Adobe
2014-08-28 22:35 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Local\Google
2014-08-28 22:34 - 2014-08-28 22:34 - 00000000 ____D () C:\Users\Test\AppData\Roaming\deb27c1a-00e6-4263-94b2-8b78ea4d32ae
2014-08-28 22:31 - 2014-08-28 22:31 - 00071928 _____ () C:\Users\Test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Logitech
2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\Logitech
2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\IOI
2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\Apple Computer
2014-08-28 22:30 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\Documents\Gaming Mouse Perdition
2014-08-28 22:30 - 2014-08-28 22:30 - 00000981 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-28 22:30 - 2014-08-28 22:30 - 00000976 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-08-28 22:30 - 2014-08-28 22:30 - 00000951 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2014-08-28 22:30 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Macromedia
2014-08-28 22:30 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\AppData\Local\NVIDIA
2014-08-28 22:29 - 2014-08-29 06:49 - 00000000 ____D () C:\Users\Test
2014-08-28 22:29 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Roaming\VIPRE
2014-08-28 22:29 - 2014-08-28 22:30 - 00000917 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-08-28 22:29 - 2014-08-28 22:29 - 00000020 ___SH () C:\Users\Test\ntuser.ini
2014-08-28 22:29 - 2009-09-09 03:02 - 00000000 ____D () C:\Users\Test\AppData\Local\Microsoft Help
2014-08-28 22:29 - 2009-06-13 13:54 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Power2Go
2014-08-28 22:29 - 2008-01-20 22:20 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
2014-08-28 22:29 - 2008-01-20 22:20 - 00000000 ___RD () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
2014-08-28 21:05 - 2014-08-29 17:26 - 00000000 ____D () C:\Qoobox
2014-08-28 21:05 - 2014-08-29 17:25 - 00000000 ____D () C:\Windows\erdnt
2014-08-28 20:35 - 2014-08-29 16:40 - 05576760 ____R (Swearware) C:\Users\Molly\Desktop\ComboFix.exe
2014-08-28 20:32 - 2014-08-28 20:32 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Molly\Desktop\tdsskiller.exe
2014-08-28 15:42 - 2014-08-29 17:46 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-28 15:40 - 2014-08-28 15:40 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-28 15:40 - 2014-08-28 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-28 15:40 - 2014-08-28 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-28 15:40 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-28 15:40 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-28 15:38 - 2014-08-28 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Molly\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-28 15:29 - 2014-08-28 15:29 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-28 15:29 - 2014-08-28 15:29 - 00000000 _____ () C:\Windows\setupact.log
2014-08-28 12:36 - 2014-08-28 12:36 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-28 12:30 - 2014-07-02 05:14 - 03826628 _____ () C:\Windows\system32\nvcoproc.bin
2014-08-28 12:16 - 2014-08-11 15:31 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-28 12:16 - 2014-08-11 15:31 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 31512520 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 24196896 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 22994208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 18626304 _____ (NVIDIA Corporation) C:\Windows\system32\nvwgf2umx.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 16122344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 15294296 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 13922752 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 13835208 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 12866008 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys
2014-08-28 12:16 - 2014-07-02 15:48 - 11283344 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 11222048 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 04247000 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 03989960 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 02814656 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvapi.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 01890080 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6434052.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 01539928 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6434052.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 00391640 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFROpenGL.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 00348120 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFROpenGL.dll
2014-08-28 12:16 - 2014-07-02 15:48 - 00026353 _____ () C:\Windows\system32\nvinfo.pb
2014-08-28 10:49 - 2014-08-28 12:06 - 00000000 ____D () C:\Users\Molly\AppData\Local\NVIDIA
2014-08-28 08:44 - 2014-08-22 20:05 - 00304128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-28 08:44 - 2014-08-22 19:42 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-28 08:44 - 2014-08-22 18:38 - 02782208 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-23 23:07 - 2014-08-23 23:07 - 00000027 _____ () C:\Users\Molly\Documents\wow email.txt
2014-08-23 09:26 - 2014-08-23 09:27 - 49274981 _____ () C:\Users\Molly\Downloads\simc-548-8-win64.zip
2014-08-19 11:19 - 2014-08-19 12:07 - 00000000 ____D () C:\Users\Molly\Documents\StarCraft II
2014-08-16 03:04 - 2014-06-26 17:17 - 01389200 _____ (Microsoft Corporation) C:\Windows\system32\icardagt.exe
2014-08-16 03:04 - 2014-06-26 17:17 - 00619664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardagt.exe
2014-08-16 03:04 - 2014-06-26 17:17 - 00171152 _____ (Microsoft Corporation) C:\Windows\system32\infocardapi.dll
2014-08-16 03:04 - 2014-06-26 17:17 - 00099480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\infocardapi.dll
2014-08-16 03:04 - 2014-06-26 17:17 - 00008856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardres.dll
2014-08-16 03:04 - 2014-06-26 17:17 - 00008848 _____ (Microsoft Corporation) C:\Windows\system32\icardres.dll
2014-08-16 03:03 - 2014-06-05 23:29 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-16 03:03 - 2014-06-05 23:28 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-15 06:49 - 2014-06-13 19:56 - 00901568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-15 06:49 - 2014-06-13 19:51 - 00047104 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-15 06:48 - 2014-07-24 14:28 - 17861120 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-15 06:48 - 2014-07-24 14:12 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-15 06:48 - 2014-07-24 14:10 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-15 06:48 - 2014-07-24 14:07 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-15 06:48 - 2014-07-24 14:06 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-15 06:48 - 2014-07-24 14:05 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-15 06:48 - 2014-07-24 14:05 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-08-15 06:48 - 2014-07-24 14:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-15 06:48 - 2014-07-24 14:04 - 02155520 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-15 06:48 - 2014-07-24 14:04 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-15 06:48 - 2014-07-24 14:04 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-15 06:48 - 2014-07-24 14:04 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-08-15 06:48 - 2014-07-24 14:04 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-15 06:48 - 2014-07-24 14:04 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-08-15 06:48 - 2014-07-24 14:03 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-15 06:48 - 2014-07-24 14:03 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-15 06:48 - 2014-07-24 14:03 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-15 06:48 - 2014-07-24 14:03 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-08-15 06:48 - 2014-07-24 14:03 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-08-15 06:48 - 2014-07-24 14:03 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-08-15 06:48 - 2014-07-24 14:02 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-08-15 06:48 - 2014-07-24 13:07 - 12356608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-15 06:48 - 2014-07-24 12:58 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-15 06:48 - 2014-07-24 12:57 - 09739264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-15 06:48 - 2014-07-24 12:52 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-15 06:48 - 2014-07-24 12:51 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-15 06:48 - 2014-07-24 12:51 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-15 06:48 - 2014-07-24 12:50 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-08-15 06:48 - 2014-07-24 12:50 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-15 06:48 - 2014-07-24 12:49 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-15 06:48 - 2014-07-24 12:49 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-15 06:48 - 2014-07-24 12:49 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-15 06:48 - 2014-07-24 12:49 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-08-15 06:48 - 2014-07-24 12:49 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-08-15 06:48 - 2014-07-24 12:48 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-15 06:48 - 2014-07-24 12:48 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-15 06:48 - 2014-07-24 12:48 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-15 06:48 - 2014-07-24 12:48 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-15 06:48 - 2014-07-24 12:48 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-08-15 06:48 - 2014-07-24 12:48 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-08-15 06:48 - 2014-07-24 12:48 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-08-15 06:48 - 2014-07-24 12:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-08-15 06:47 - 2014-07-07 20:12 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-08-15 06:47 - 2014-07-07 19:46 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-08-15 06:47 - 2014-06-02 16:30 - 03137536 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-15 06:47 - 2014-06-02 16:30 - 00503296 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-15 06:47 - 2014-06-02 16:29 - 02280448 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-15 06:47 - 2014-06-02 16:29 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-08-15 06:47 - 2014-06-02 15:29 - 00087552 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-15 06:47 - 2014-06-02 05:31 - 02263552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-15 06:47 - 2014-06-02 05:31 - 00332800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-15 06:47 - 2014-06-02 05:30 - 01993728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-05 13:21 - 2014-08-05 13:22 - 00000000 ____D () C:\Users\Molly\Documents\Gaming Mouse Perdition
2014-08-05 13:20 - 2014-08-05 13:20 - 00000920 _____ () C:\Users\Public\Desktop\REDRAGON GAMING MOUSE.lnk
2014-08-05 13:20 - 2014-08-05 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REDRAGON GAMING MOUSE
2014-08-05 13:20 - 2014-08-05 13:20 - 00000000 ____D () C:\Program Files (x86)\REDRAGON GAMING MOUSE
2014-08-01 18:37 - 2014-08-01 18:37 - 00003962 _____ () C:\Windows\System32\Tasks\{EDAF20EA-6C7C-C72C-65D7-A44828B615BB}
2014-08-01 18:37 - 2014-08-01 18:37 - 00000000 _____ () C:\Windows\system32\oxwvet.dll
2014-07-31 08:18 - 2014-07-31 08:18 - 00000373 _____ () C:\Users\Molly\Documents - Shortcut.lnk

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-29 17:50 - 2014-08-29 17:49 - 00015834 _____ () C:\Users\Molly\Desktop\FRST.txt
2014-08-29 17:50 - 2014-08-29 17:49 - 00000000 ____D () C:\FRST
2014-08-29 17:49 - 2014-08-29 17:49 - 02103808 _____ (Farbar) C:\Users\Molly\Desktop\FRST64.exe
2014-08-29 17:46 - 2014-08-28 15:42 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-29 17:46 - 2010-02-04 22:00 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-08-29 17:46 - 2008-01-20 22:26 - 01155928 _____ () C:\Windows\PFRO.log
2014-08-29 17:46 - 2006-11-02 10:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-08-29 17:46 - 2006-11-02 10:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-08-29 17:46 - 2006-11-02 10:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-08-29 17:44 - 2014-08-29 17:40 - 00000000 ____D () C:\AdwCleaner
2014-08-29 17:44 - 2011-10-08 23:04 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-08-29 17:44 - 2009-06-13 13:37 - 01939062 _____ () C:\Windows\WindowsUpdate.log
2014-08-29 17:44 - 2006-11-02 10:42 - 00032574 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-08-29 17:40 - 2014-08-29 17:29 - 00001074 _____ () C:\Users\Molly\Desktop\MalwareBytesResults.txt
2014-08-29 17:27 - 2010-02-04 22:00 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-08-29 17:26 - 2014-08-29 17:26 - 00016342 _____ () C:\ComboFix.txt
2014-08-29 17:26 - 2014-08-28 21:05 - 00000000 ____D () C:\Qoobox
2014-08-29 17:26 - 2006-11-02 08:33 - 00000000 __RHD () C:\Users\Default
2014-08-29 17:25 - 2014-08-28 21:05 - 00000000 ____D () C:\Windows\erdnt
2014-08-29 17:24 - 2006-11-02 07:34 - 00000215 _____ () C:\Windows\system.ini
2014-08-29 16:40 - 2014-08-28 20:35 - 05576760 ____R (Swearware) C:\Users\Molly\Desktop\ComboFix.exe
2014-08-29 16:30 - 2014-08-29 16:24 - 00001684 _____ () C:\Users\Molly\Desktop\Rkill.txt
2014-08-29 16:24 - 2014-08-29 16:24 - 01063160 _____ (Bleeping Computer, LLC) C:\Users\Molly\Desktop\rkill64.exe
2014-08-29 16:23 - 2014-08-29 16:23 - 01944824 _____ (Bleeping Computer, LLC) C:\Users\Molly\Desktop\rkill.exe
2014-08-29 16:20 - 2014-08-29 16:20 - 01364531 _____ () C:\Users\Molly\Desktop\adwcleaner_3.308.exe
2014-08-29 16:14 - 2014-08-29 16:14 - 00000000 _____ () C:\Users\Molly\Desktop\RogueKillerX64_exe.05nas1h.partial
2014-08-29 15:48 - 2014-08-29 15:48 - 00001190 _____ () C:\Windows\SysWOW64\ServiceConfig.xml
2014-08-29 15:28 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Local\Battle.net
2014-08-29 15:11 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Local\Deployment
2014-08-29 09:53 - 2009-08-24 19:43 - 00000000 ____D () C:\Program Files (x86)\World of Warcraft
2014-08-29 08:36 - 2014-08-29 08:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Ventrilo
2014-08-29 08:35 - 2014-08-29 08:35 - 00000754 _____ () C:\Users\Test\Desktop\Ventrilo.lnk
2014-08-29 08:35 - 2014-08-29 08:35 - 00000262 _____ () C:\Windows\{EEB3F6BB-318D-4CE5-989F-8191FCBFB578}_WiseFW.ini
2014-08-29 08:35 - 2014-08-29 08:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Ventrilo
2014-08-29 08:35 - 2014-08-29 08:35 - 00000000 ____D () C:\Program Files\Ventrilo
2014-08-29 08:34 - 2014-08-29 08:33 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Curse Advertising
2014-08-29 08:32 - 2014-08-29 08:32 - 00000318 _____ () C:\Users\Test\Desktop\Curse Client.appref-ms
2014-08-29 08:32 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Curse
2014-08-29 08:32 - 2014-08-29 08:32 - 00000000 ____D () C:\Users\Test\AppData\Local\Apps\2.0
2014-08-29 06:50 - 2014-08-29 06:50 - 00001846 _____ () C:\Users\Public\Desktop\Canon IJ Network Tool.lnk
2014-08-29 06:50 - 2014-08-29 06:50 - 00000000 ___HD () C:\ProgramData\CanonBJ
2014-08-29 06:50 - 2014-08-29 06:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon IJ Network Utilities
2014-08-29 06:50 - 2014-08-29 06:47 - 00000000 ____D () C:\Program Files (x86)\Canon
2014-08-29 06:50 - 2006-11-02 08:33 - 00000000 __RSD () C:\Windows\Media
2014-08-29 06:49 - 2014-08-29 06:49 - 00000000 ___HD () C:\Windows\system32\CanonIJ Uninstaller Information
2014-08-29 06:49 - 2014-08-29 06:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Canon MP970 series
2014-08-29 06:49 - 2014-08-28 22:29 - 00000000 ____D () C:\Users\Test
2014-08-29 06:48 - 2014-08-29 06:48 - 00000000 ___HD () C:\Program Files\CanonBJ
2014-08-29 06:45 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Google
2014-08-28 22:46 - 2014-08-28 22:46 - 00001077 _____ () C:\Users\Public\Desktop\World of Warcraft.lnk
2014-08-28 22:46 - 2014-08-28 22:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Warcraft
2014-08-28 22:45 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Battle.net
2014-08-28 22:44 - 2014-08-28 22:44 - 00000985 _____ () C:\Users\Public\Desktop\Battle.net.lnk
2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Roaming\NVIDIA
2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Users\Test\AppData\Local\Blizzard Entertainment
2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Battle.net
2014-08-28 22:44 - 2014-08-28 22:44 - 00000000 ____D () C:\Program Files (x86)\Battle.net
2014-08-28 22:38 - 2014-08-28 22:38 - 02942368 _____ (Blizzard Entertainment) C:\Users\Test\Downloads\World-of-Warcraft-Setup-enUS.exe
2014-08-28 22:35 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Adobe
2014-08-28 22:35 - 2014-08-28 22:35 - 00000000 ____D () C:\Users\Test\AppData\Local\Google
2014-08-28 22:34 - 2014-08-28 22:34 - 00000000 ____D () C:\Users\Test\AppData\Roaming\deb27c1a-00e6-4263-94b2-8b78ea4d32ae
2014-08-28 22:34 - 2014-06-18 20:48 - 00000000 ____D () C:\ProgramData\VIPRE
2014-08-28 22:31 - 2014-08-28 22:31 - 00071928 _____ () C:\Users\Test\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Logitech
2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\Logitech
2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\IOI
2014-08-28 22:31 - 2014-08-28 22:31 - 00000000 ____D () C:\Users\Test\AppData\Local\Apple Computer
2014-08-28 22:31 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\Documents\Gaming Mouse Perdition
2014-08-28 22:31 - 2014-08-28 22:29 - 00000000 ____D () C:\Users\Test\AppData\Roaming\VIPRE
2014-08-28 22:31 - 2010-08-01 18:23 - 00000000 ____D () C:\OEMSettings
2014-08-28 22:30 - 2014-08-28 22:30 - 00000981 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-08-28 22:30 - 2014-08-28 22:30 - 00000976 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2014-08-28 22:30 - 2014-08-28 22:30 - 00000951 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
2014-08-28 22:30 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\AppData\Roaming\Macromedia
2014-08-28 22:30 - 2014-08-28 22:30 - 00000000 ____D () C:\Users\Test\AppData\Local\NVIDIA
2014-08-28 22:30 - 2014-08-28 22:29 - 00000917 _____ () C:\Users\Test\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk
2014-08-28 22:29 - 2014-08-28 22:29 - 00000020 ___SH () C:\Users\Test\ntuser.ini
2014-08-28 22:24 - 2006-11-02 08:33 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-08-28 21:44 - 2006-11-02 10:21 - 00306064 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-28 21:24 - 2014-05-04 18:17 - 00000000 ____D () C:\Windows\pss
2014-08-28 20:32 - 2014-08-28 20:32 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Molly\Desktop\tdsskiller.exe
2014-08-28 18:45 - 2012-10-05 07:35 - 00000000 ____D () C:\Users\Molly\AppData\Local\Deployment
2014-08-28 17:54 - 2009-08-24 19:38 - 00000000 ____D () C:\Users\Molly\AppData\Local\Google
2014-08-28 17:54 - 2009-08-24 19:24 - 00000000 ____D () C:\Program Files (x86)\Google
2014-08-28 15:40 - 2014-08-28 15:40 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-28 15:40 - 2014-08-28 15:40 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-28 15:40 - 2014-08-28 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-28 15:40 - 2010-01-01 09:24 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-28 15:39 - 2014-08-28 15:38 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Molly\Downloads\mbam-setup-2.0.2.1012.exe
2014-08-28 15:29 - 2014-08-28 15:29 - 00000000 _____ () C:\Windows\setuperr.log
2014-08-28 15:29 - 2014-08-28 15:29 - 00000000 _____ () C:\Windows\setupact.log
2014-08-28 14:29 - 2014-07-09 08:45 - 00000000 ____D () C:\Users\Molly\AppData\Local\Battle.net
2014-08-28 13:36 - 2012-12-06 08:16 - 00000000 ____D () C:\Windows\Minidump
2014-08-28 12:36 - 2014-08-28 12:36 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies
2014-08-28 12:36 - 2014-05-17 17:56 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation
2014-08-28 12:35 - 2009-08-24 19:24 - 00000000 ____D () C:\Users\Molly
2014-08-28 12:31 - 2014-05-17 17:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-08-28 12:31 - 2011-03-26 19:16 - 00000000 ____D () C:\Temp
2014-08-28 12:26 - 2014-05-17 17:51 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2014-08-28 12:06 - 2014-08-28 10:49 - 00000000 ____D () C:\Users\Molly\AppData\Local\NVIDIA
2014-08-28 12:04 - 2014-05-17 17:54 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation
2014-08-28 10:00 - 2012-12-06 01:57 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-08-28 08:55 - 2010-05-12 20:40 - 00000000 ____D () C:\Users\Molly\AppData\Local\Yahoo
2014-08-28 08:55 - 2010-05-12 20:39 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-08-28 08:55 - 2010-05-12 20:37 - 00000000 ____D () C:\Program Files (x86)\Yahoo!
2014-08-28 08:53 - 2012-09-24 19:56 - 00000000 ____D () C:\ProgramData\Origin
2014-08-26 09:00 - 2010-07-04 21:58 - 00000000 ____D () C:\Users\Molly\AppData\Roaming\HpUpdate
2014-08-23 23:07 - 2014-08-23 23:07 - 00000027 _____ () C:\Users\Molly\Documents\wow email.txt
2014-08-23 09:27 - 2014-08-23 09:26 - 49274981 _____ () C:\Users\Molly\Downloads\simc-548-8-win64.zip
2014-08-22 20:05 - 2014-08-28 08:44 - 00304128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-22 19:42 - 2014-08-28 08:44 - 00390144 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-22 18:38 - 2014-08-28 08:44 - 02782208 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-19 12:07 - 2014-08-19 11:19 - 00000000 ____D () C:\Users\Molly\Documents\StarCraft II
2014-08-19 11:22 - 2009-08-25 06:58 - 00000000 ____D () C:\ProgramData\Blizzard Entertainment
2014-08-16 04:31 - 2006-11-02 08:33 - 00000000 ____D () C:\Windows\rescache
2014-08-16 04:19 - 2006-11-02 07:46 - 00759582 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-16 03:51 - 2009-04-10 00:34 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-08-16 03:49 - 2013-08-15 03:04 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-16 03:16 - 2006-11-02 07:35 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2014-08-11 15:31 - 2014-08-28 12:16 - 00197408 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvhda64v.sys
2014-08-11 15:31 - 2014-08-28 12:16 - 00031520 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdap64.dll
2014-08-11 15:31 - 2014-05-17 17:55 - 01515296 _____ (NVIDIA Corporation) C:\Windows\system32\nvhdagenco6420103.dll
2014-08-09 18:58 - 2010-05-31 18:38 - 00001356 _____ () C:\Users\Molly\AppData\Local\d3d9caps.dat
2014-08-05 13:22 - 2014-08-05 13:21 - 00000000 ____D () C:\Users\Molly\Documents\Gaming Mouse Perdition
2014-08-05 13:20 - 2014-08-05 13:20 - 00000920 _____ () C:\Users\Public\Desktop\REDRAGON GAMING MOUSE.lnk
2014-08-05 13:20 - 2014-08-05 13:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\REDRAGON GAMING MOUSE
2014-08-05 13:20 - 2014-08-05 13:20 - 00000000 ____D () C:\Program Files (x86)\REDRAGON GAMING MOUSE
2014-08-01 18:37 - 2014-08-01 18:37 - 00003962 _____ () C:\Windows\System32\Tasks\{EDAF20EA-6C7C-C72C-65D7-A44828B615BB}
2014-08-01 18:37 - 2014-08-01 18:37 - 00000000 _____ () C:\Windows\system32\oxwvet.dll
2014-07-31 08:18 - 2014-07-31 08:18 - 00000373 _____ () C:\Users\Molly\Documents - Shortcut.lnk

Some content of TEMP:
====================
C:\Users\Molly\AppData\Local\temp\Quarantine.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-08-29 17:53

==================== End Of Log ============================

Link to post
Share on other sites

Hi and I'm very sorry for the delay. I had a short-circuit accident which deeply fried my home PC's hard drive. As you may know, it's quite hard to run a PC without it :)

After some time, I'd like to see a fresh report.


FRST.gif Scan with Farbar Recovery Scan Tool

Please re-run Farbar Recovery Scan Tool.

  • Right-click on FRST.gif icon and select RunAsAdmin.jpg Run as Administrator to start the tool.
    > XP users click run after receipt of Windows Security Warning - Open File.
    > 8 users will be prompted about Windows SmartScreen protection - click More information and Run.
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.

Please include their content in your next reply.

Link to post
Share on other sites

  • Root Admin

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    No registered users viewing this page.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.