Jump to content

dllhost.exe *32 COM Surrogate repeated in task processes


Recommended Posts

Hello,

 

I am having issues with multiple "dllhost.exe *32" COM Surrogate process running and these processes keep coming back even after manually stop them. I followed the instruction of previous topic post by some other member & I ran Farbar Recovery Scan, Malwarebyte Threat Scan and now ESET Online Scanner is  scanning now & 18 infected files are detect yet, i will let you the complete details of scan once it completed .......I have a question, I download Fixlist file from previous topic and run the fix of Farbar Recovery Scan.....I dont know that i done correct or wrong 

 

I also completed the scan with MBAM and it detects some objects, i removed all detected object and resttart my computer but unfortunately i forgot to save MBAM log file. I remove MBAM after threat removal because my computer was working slow with MBAM so i removed it.......Sorry if i done wrong

 

Below is FRST,   Addition.txt,   Fixlist is use and Fixlog details

 

FRST Log

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 08-10-2014 01

Ran by Sharon (administrator) on SHARON-PC on 10-10-2014 17:58:55
Running from C:\Users\Sharon\Desktop
Loaded Profile: Sharon (Available profiles: Sharon)
Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States)
Internet Explorer Version 8
Boot Mode: Normal
 
==================== Processes (Whitelisted) =================
 
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
 
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
(Apple Inc.) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_service.exe
(Eastman Kodak Company) C:\Program Files (x86)\Kodak\AiO\Center\ekdiscovery.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_comm_customer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_system_customer.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_host_service.exe
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_user_customer.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Service.exe
(Intuit Inc.) C:\Program Files (x86)\Common Files\Intuit\Update Service\IntuitUpdateService.exe
(Citrix Online, LLC) C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_user_high_customer.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\System32\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
() C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe
(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe
(Microsoft Corporation) C:\Windows\System32\consent.exe
() C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe
() C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe
 
 
==================== Registry (Whitelisted) ==================
 
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
 
HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [iAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2008-12-04] (Intel Corporation)
HKLM\...\Run: [EKIJ5000StatusMonitor] => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe [2023936 2009-08-03] (Eastman Kodak Company)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Yquqedxenipu] => C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe [291069 2014-04-17] ()
HKLM Group Policy restriction on software: C:\Program Files\Windows Defender <====== ATTENTION
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_winlogonx64.dll (Citrix Online, LLC)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3122679508-3511620857-1760614917-1000\...\Run: [Yquqedxenipu] => C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe [291069 2014-04-17] ()
HKU\S-1-5-21-3122679508-3511620857-1760614917-1000\...409d6c4515e9\InprocServer32: [Default-shell32] C:\Users\Sharon\AppData\Local\Temp\soupoqr\stdipwr\wow.dll ATTENTION! ====> ZeroAccess?
HKU\S-1-5-21-3122679508-3511620857-1760614917-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!
Startup: C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Epson scanner Registration.lnk
ShortcutTarget: Epson scanner Registration.lnk -> E:\Common\EpsonReg\US\EpsonReg.exe (No File)
Startup: C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnk
ShortcutTarget: Monitor Ink Alerts - HP Deskjet 1000 J110 series.lnk -> C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
Startup: C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote Table Of Contents.onetoc2 ()
BootExecute: autocheck autochk * sdnclean64.exe
 
==================== Internet (Whitelisted) ====================
 
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
 
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndt
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndt
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndt
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=93&bd=Pavilion&pf=cndt
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {379648A4-9AD1-4C0C-823B-64FC70F7B141} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM - {CD11E25A-D6A3-4080-8230-9C3BC5878831} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDF
SearchScopes: HKLM-x32 - {379648A4-9AD1-4C0C-823B-64FC70F7B141} URL = http://www.ask.com/web?q={searchterms}&l=dis&o=ushpd
SearchScopes: HKLM-x32 - {CD11E25A-D6A3-4080-8230-9C3BC5878831} URL = http://search.live.com/results.aspx?q={searchTerms}&FORM=HPDTDF
SearchScopes: HKCU - {379648A4-9AD1-4C0C-823B-64FC70F7B141} URL = 
SearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = 
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Google Toolbar Notifier BHO -> {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} -> C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
BHO-x32: Google Dictionary Compression sdch -> {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} -> C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} -  No File
Toolbar: HKCU - No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} -  No File
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {F7E4B48A-9940-48D8-A732-246A2FDB7B40} -  No File
Toolbar: HKCU - No Name - {311B58DC-A4DC-4B04-B1B5-60299AD3D803} -  No File
Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} -  No File
DPF: HKLM-x32 {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} -  No File
Handler-x32: gopher - {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\syswow64\urlmon.dll (Microsoft Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62
 
FireFox:
========
FF ProfilePath: C:\Users\Sharon\AppData\Roaming\Mozilla\Firefox\Profiles\cvrmozf5.default
FF Plugin-x32: @java.com/DTPlugin,version=10.15.2 -> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.15.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @mcafee.com/McAfeeMssPlugin -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
FF Plugin-x32: @mcafee.com/MVT -> C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll (McAfee, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin -> C:\Users\Sharon\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np32dsw.dll (Macromedia, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPSWF32.dll (Macromedia, Inc.)
FF Extension: Playtopus  - C:\Users\Sharon\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}\links@playtopus.com [2013-06-26]
FF Extension: Video Downloader - C:\Users\Sharon\AppData\Roaming\Mozilla\Firefox\Profiles\cvrmozf5.default\Extensions\oqhnkpizab@oqhnkpizab.org.xpi [2013-07-24]
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-09-15]
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn
 
Chrome: 
=======
CHR HomePage: Default -> hxxp://rocket-find.com/?f=1&a=rckt_cmi_14_29_ie&cd=2XzuyEtN2Y1L1QzutDtDtByCtCzztCzyzzyDzz0AyEtAyDyDtN0D0Tzu0SzytBzztN1L2XzutBtFtBtCtFtCyEtFyEtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StB0BtCyDyDzztC0BtG0FtAyBtCtGtDtA0DyEtGyD0D0B0AtGyBtD0B0DtDzz0AzyzztB0FtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyCtDtBzztCtBtAyCtG0AyB0CzztG0C0C0FtBtG0AyDyE0CtGyD0A0CyCyDyEzyyE0A0CyEzz2Q&cr=516915441&ir=
CHR StartupUrls: Default -> "hxxp://www.yahoo.com/"
CHR DefaultSuggestURL: Default -> {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:inputType}{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}{google:searchVersion}{google:sessionToken}sugkey={google:suggestAPIKeyParameter}
CHR Profile: C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Docs) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-03-16]
CHR Extension: (Google Drive) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-03-16]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-07-13]
CHR Extension: (YouTube) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-03-16]
CHR Extension: (Google Search) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-03-16]
CHR Extension: (Google Wallet) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR Extension: (Gmail) - C:\Users\Sharon\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-03-16]
 
==================== Services (Whitelisted) =================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 EpsonScanSvc; C:\Windows\system32\EscSvc64.exe [135824 2011-12-12] (Seiko Epson Corporation)
R3 GoToAssist Remote Support Customer; C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\758\g2ax_service.exe [610888 2014-10-09] (Citrix Online, LLC)
R2 HP Health Check Service; c:\Program Files (x86)\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-12-04] (Hewlett-Packard) [File not signed]
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2009-03-17] (Hewlett-Packard Company) [File not signed]
S2 0109651412971787mcinstcleanup; C:\Users\Sharon\AppData\Local\Temp\010965~1.EXE -cleanup -nolog [X]
S2 mfevtp; "C:\Windows\system32\mfevtps.exe" [X]
 
==================== Drivers (Whitelisted) ====================
 
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
 
S2 mrtRate; C:\Windows\SysWow64\Drivers\mrtRate.sys [34916 1999-08-12] (Marimba, Inc.) [File not signed]
S3 SWDUMon; C:\Windows\System32\DRIVERS\SWDUMon.sys [16152 2014-10-09] ()
S0 mfeapfk; system32\drivers\mfeapfk.sys [X]
R0 mfehidk; system32\drivers\mfehidk.sys [X]
S0 mferkdet; system32\drivers\mferkdet.sys [X]
 
==================== NetSvcs (Whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
 
 
==================== One Month Created Files and Folders ========
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-10-10 21:02 - 2014-10-10 21:02 - 00003732 _____ () C:\Windows\System32\Tasks\Security Center Update - 1990788741
2014-10-10 21:02 - 2014-10-10 21:02 - 00000808 _____ () C:\Windows\Tasks\Security Center Update - 1990788741.job
2014-10-10 21:02 - 2014-10-10 21:02 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Edpopob
2014-10-10 17:58 - 2014-10-10 18:16 - 00017750 _____ () C:\Users\Sharon\Desktop\FRST.txt
2014-10-10 17:58 - 2014-10-10 18:01 - 00000000 ____D () C:\FRST
2014-10-10 17:56 - 2014-10-10 21:00 - 00000806 _____ () C:\Windows\Tasks\Security Center Update - 3010263955.job
2014-10-10 17:56 - 2014-10-10 17:56 - 00003730 _____ () C:\Windows\System32\Tasks\Security Center Update - 3010263955
2014-10-10 17:56 - 2014-10-10 17:56 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Qiqaaxu
2014-10-10 17:56 - 2014-10-10 17:54 - 02109952 _____ (Farbar) C:\Users\Sharon\Desktop\FRST64.exe
2014-10-10 17:55 - 2014-10-10 21:00 - 00000810 _____ () C:\Windows\Tasks\Security Center Update - 398391132.job
2014-10-10 17:55 - 2014-10-10 17:55 - 00003734 _____ () C:\Windows\System32\Tasks\Security Center Update - 398391132
2014-10-10 17:55 - 2014-10-10 17:55 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Uhniovgi
2014-10-10 17:51 - 2014-10-10 17:51 - 00081408 _____ () C:\Users\Sharon\AppData\Roaming\zvloglr.dll
2014-10-10 17:51 - 2014-10-10 17:51 - 00003964 _____ () C:\Windows\System32\Tasks\{9C36FFDA-02CA-D98A-C551-06CFEF40C5BC}
2014-10-10 17:51 - 2014-10-10 17:51 - 00000000 _____ () C:\Users\Sharon\AppData\Roaming\kdevr.dll
2014-10-10 16:13 - 2014-10-10 16:13 - 00000820 _____ () C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Temp File Cleaner.lnk
2014-10-10 16:13 - 2014-10-10 16:13 - 00000790 _____ () C:\Users\Sharon\Desktop\Temp File Cleaner.lnk
2014-10-10 16:13 - 2014-10-10 16:13 - 00000000 ____D () C:\Program Files\Temp File Cleaner
2014-10-10 16:09 - 2014-10-10 16:09 - 00000000 ____D () C:\Program Files\McAfee.com
2014-10-10 16:09 - 2014-10-10 16:09 - 00000000 ____D () C:\Program Files\McAfee
2014-10-10 16:02 - 2014-06-20 10:30 - 00189912 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe.0538.deleteme
2014-10-10 16:01 - 2014-10-10 16:09 - 00000000 ____D () C:\ProgramData\McAfee
2014-10-10 16:01 - 2014-10-10 16:09 - 00000000 ____D () C:\Program Files\Common Files\McAfee
2014-10-10 13:53 - 2014-10-10 13:50 - 01060352 _____ () C:\Users\Sharon\Desktop\MicrosoftFixit50472.msi
2014-10-10 03:51 - 2014-10-10 03:51 - 605410472 _____ (Microsoft Corporation) C:\Users\Sharon\Downloads\Windows6.0-KB948465-X64.exe
2014-10-10 03:44 - 2014-10-10 03:44 - 36138288 _____ (Microsoft Corporation) C:\Users\Sharon\Downloads\IE9-WindowsVista-x64-enu.exe
2014-10-10 03:37 - 2014-10-10 04:23 - 00000134 _____ () C:\Users\Sharon\Desktop\Internet Explorer Troubleshooting.url
2014-10-10 03:21 - 2014-10-10 16:03 - 00000000 ____D () C:\Program Files\stinger
2014-10-10 03:18 - 2014-10-10 03:18 - 05296056 _____ (McAfee, Inc.) C:\Users\Sharon\Downloads\Setup_serial_IjwK7YhRXe9iDRq_S7TeGQ2_key.exe
2014-10-10 03:02 - 2014-03-13 18:02 - 00450628 _____ () C:\Windows\system32\Drivers\etc\hosts.bak
2014-10-10 03:01 - 2014-10-10 16:09 - 00000000 ____D () C:\Program Files (x86)\McAfee
2014-10-10 03:01 - 2014-10-10 04:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\McAfee
2014-10-10 03:01 - 2014-10-10 03:01 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\McAfee
2014-10-10 02:56 - 2014-10-10 02:54 - 03480040 _____ (McAfee, Inc.) C:\Users\Sharon\Desktop\MCPR.exe
2014-10-10 02:31 - 2014-10-10 02:31 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-10-10 00:46 - 2014-10-10 00:46 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\addpcs
2014-10-09 22:47 - 2014-10-09 23:46 - 00000000 ____D () C:\AdwCleaner
2014-10-09 22:43 - 2014-10-07 14:11 - 04968160 _____ (TeamViewer) C:\Users\Sharon\Desktop\TeamViewerQS_en.exe
2014-10-09 22:34 - 2014-10-09 22:34 - 00000000 ____D () C:\Users\Sharon\AppData\Local\LogMeIn Rescue Applet
2014-10-09 18:50 - 2014-10-09 18:50 - 00000772 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-10-09 18:50 - 2014-10-09 18:50 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
2014-10-09 18:50 - 2014-10-09 18:50 - 00000000 ____D () C:\Program Files\CCleaner
2014-10-09 17:43 - 2014-10-09 23:48 - 00000000 ____D () C:\Program Files\PC Optimizer Pro
2014-10-09 17:17 - 2014-10-09 17:17 - 00001369 _____ () C:\Users\Sharon\Desktop\GoToAssist Customer.lnk
2014-10-09 17:17 - 2014-10-09 17:17 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Citrix
2014-10-09 17:17 - 2014-10-09 17:17 - 00000000 ____D () C:\Users\Sharon\AppData\Local\Citrix
2014-10-09 17:17 - 2014-10-09 17:17 - 00000000 ____D () C:\Program Files (x86)\Citrix
2014-10-09 17:15 - 2014-10-09 17:15 - 00000000 ____D () C:\Users\Sharon\AppData\Local\Apps\2.0
2014-10-09 17:14 - 2014-10-09 17:17 - 00000000 ____D () C:\Users\Sharon\AppData\Local\Deployment
2014-10-09 17:04 - 2014-10-10 03:06 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Otguise
2014-10-09 17:04 - 2014-10-10 02:45 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Ihuvar
2014-10-09 17:02 - 2014-10-09 17:02 - 00000344 _____ () C:\Windows\Tasks\{F559D6F4-03BC-FB8E-356A-00FC41EA67C0}.job
2014-10-09 17:02 - 2014-10-09 17:02 - 00000000 _____ () C:\Windows\system32\seetla.dll
2014-10-09 16:04 - 2014-10-09 16:05 - 00292408 _____ (Citrix Online) C:\Users\Sharon\Downloads\GoToAssist Launcher.exe
2014-10-09 15:39 - 2014-10-09 15:39 - 00000000 __SHD () C:\found.000
2014-10-06 13:32 - 2014-10-10 02:45 - 00000000 ____D () C:\ProgramData\j9tbgsdger04r
2014-10-05 15:30 - 2014-10-10 03:16 - 00000000 ____D () C:\Users\Sharon\Documents\PCSpeedClean
2014-10-03 04:04 - 2014-10-03 04:04 - 00000000 ____D () C:\Windows\Sun
2014-10-03 03:11 - 2014-10-03 03:11 - 00003370 _____ () C:\Windows\System32\Tasks\Performance Center@Logon
2014-10-03 03:11 - 2014-10-03 03:11 - 00003150 _____ () C:\Windows\System32\Tasks\Performance Center_Sharon-PC@Sharon
2014-10-02 18:15 - 2014-10-02 18:15 - 00000099 _____ () C:\Windows\Reimage.ini
2014-09-24 03:00 - 2014-09-09 02:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 03:00 - 2014-09-09 02:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-17 23:54 - 2014-09-17 23:54 - 00000000 ____D () C:\Users\Sharon\AppData\Local\downloadius
2014-09-12 04:03 - 2014-08-18 23:17 - 01491968 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 04:03 - 2014-08-18 23:17 - 01147904 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 04:03 - 2014-08-18 23:17 - 00108032 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 04:03 - 2014-08-18 23:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2014-09-12 04:03 - 2014-08-18 23:07 - 01068544 _____ (Microsoft Corporation) C:\Windows\system32\mstime.dll
2014-09-12 04:03 - 2014-08-18 23:03 - 09326592 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 04:03 - 2014-08-18 23:03 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 04:03 - 2014-08-18 23:02 - 00742912 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 04:03 - 2014-08-18 23:02 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 04:03 - 2014-08-18 22:58 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2014-09-12 04:03 - 2014-08-18 22:57 - 01538560 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 04:03 - 2014-08-18 22:57 - 00219136 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 04:03 - 2014-08-18 22:57 - 00132096 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-09-12 04:03 - 2014-08-18 22:57 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-12 04:03 - 2014-08-18 22:57 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 04:03 - 2014-08-18 22:56 - 12473344 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 04:03 - 2014-08-18 22:56 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 04:03 - 2014-08-18 22:56 - 00459776 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-12 04:03 - 2014-08-18 22:56 - 00252416 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2014-09-12 04:03 - 2014-08-18 22:56 - 00072192 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-12 04:03 - 2014-08-18 22:55 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\corpol.dll
2014-09-12 04:03 - 2014-08-18 21:46 - 01214976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 04:03 - 2014-08-18 21:46 - 00916992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 04:03 - 2014-08-18 21:46 - 00105984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-09-12 04:03 - 2014-08-18 21:44 - 00206848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-09-12 04:03 - 2014-08-18 21:41 - 06003200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 04:03 - 2014-08-18 21:41 - 00630784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstime.dll
2014-09-12 04:03 - 2014-08-18 21:41 - 00630272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 04:03 - 2014-08-18 21:41 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 04:03 - 2014-08-18 21:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-09-12 04:03 - 2014-08-18 21:40 - 01469440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 04:03 - 2014-08-18 21:40 - 00043520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-09-12 04:03 - 2014-08-18 21:40 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 04:03 - 2014-08-18 21:39 - 11082752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 04:03 - 2014-08-18 21:39 - 02005504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 04:03 - 2014-08-18 21:39 - 00387584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-12 04:03 - 2014-08-18 21:39 - 00184320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-09-12 04:03 - 2014-08-18 21:39 - 00164352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 04:03 - 2014-08-18 21:39 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-09-12 04:03 - 2014-08-18 21:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-12 04:03 - 2014-08-18 21:39 - 00055808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-12 04:03 - 2014-08-18 21:38 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\corpol.dll
2014-09-12 04:03 - 2014-08-18 21:36 - 00479232 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2014-09-12 04:03 - 2014-08-18 20:16 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 04:03 - 2014-08-18 20:15 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-12 04:03 - 2014-08-18 20:14 - 01638912 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 04:03 - 2014-08-18 20:14 - 00012288 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 04:03 - 2014-08-18 20:10 - 00385024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-09-12 04:03 - 2014-08-18 18:33 - 00174080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ie4uinit.exe
2014-09-12 04:03 - 2014-08-18 18:33 - 00133632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 04:03 - 2014-08-18 18:31 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-09-12 04:03 - 2014-08-18 18:30 - 01638912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
 
==================== One Month Modified Files and Folders =======
 
(If an entry is included in the fixlist, the file\folder will be moved.)
 
2014-10-10 21:14 - 2014-07-16 13:43 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-10 21:05 - 2013-09-07 21:17 - 00000000 ____D () C:\Users\Sharon\AppData\Local\CrashDumps
2014-10-10 20:57 - 2014-07-24 20:27 - 00000000 ____D () C:\ProgramData\Windows Genuine Advantage
2014-10-10 20:51 - 2010-01-10 12:42 - 00006000 _____ () C:\Users\Sharon\AppData\Local\d3d9caps.dat
2014-10-10 20:42 - 2014-07-16 13:42 - 00000296 _____ () C:\Windows\Tasks\Rocket Updater.job
2014-10-10 20:26 - 2012-03-14 12:56 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-10 17:56 - 2006-11-02 11:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-10 17:56 - 2006-11-02 11:22 - 00003616 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-10 16:00 - 2009-05-27 08:56 - 01148630 ____N () C:\Windows\WindowsUpdate.log
2014-10-10 15:57 - 2012-03-14 12:56 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-10 15:56 - 2010-05-11 17:14 - 00000000 ____D () C:\ProgramData\Kodak
2014-10-10 15:56 - 2006-11-02 11:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-10 15:55 - 2006-11-02 11:42 - 00032572 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-10 13:29 - 2013-08-03 21:32 - 00003986 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{ECEEEB37-047B-4EC4-968D-E55338B6D4D3}
2014-10-10 13:29 - 2013-08-03 21:32 - 00000436 ____H () C:\Windows\Tasks\User_Feed_Synchronization-{ECEEEB37-047B-4EC4-968D-E55338B6D4D3}.job
2014-10-10 03:17 - 2014-07-16 13:30 - 00000000 __SHD () C:\Windows\SysWOW64\AI_RecycleBin
2014-10-10 03:13 - 2009-09-02 13:50 - 00098160 _____ () C:\Users\Sharon\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-10 03:07 - 2006-11-02 11:21 - 00361608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-10 03:06 - 2006-11-02 09:34 - 00000000 ____D () C:\Windows\tracing
2014-10-10 03:02 - 2006-11-02 11:25 - 00000749 ___RH () C:\Windows\WindowsShell.Manifest
2014-10-10 02:45 - 2014-06-05 22:28 - 00000000 ____D () C:\ProgramData\OruroPfuve
2014-10-10 02:09 - 2009-05-13 08:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HP
2014-10-10 02:07 - 2009-05-13 08:16 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-10-10 02:02 - 2009-05-13 08:03 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PC Help & Tools
2014-10-10 01:57 - 2009-05-13 08:16 - 00000000 ____D () C:\Windows\Panther
2014-10-10 01:29 - 2013-07-08 19:39 - 00000000 ____D () C:\Windows\Minidump
2014-10-10 01:27 - 2009-05-13 08:22 - 00000000 ____D () C:\ProgramData\Temp
2014-10-09 23:52 - 2014-08-26 22:11 - 00003378 _____ () C:\Windows\System32\Tasks\PCSpeedClean_Popup
2014-10-09 23:48 - 2014-07-16 14:22 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-10-09 23:48 - 2014-03-13 17:49 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-10-09 23:45 - 2013-09-04 22:56 - 00000000 ____D () C:\Users\Sharon\AppData\Local\CRE
2014-10-09 19:56 - 2012-11-07 17:34 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-10-09 19:56 - 2012-11-07 17:34 - 00000000 ____D () C:\Program Files (x86)\Yahoo!
2014-10-09 19:55 - 2014-01-03 12:20 - 00016985 _____ () C:\Windows\wininit.ini
2014-10-09 19:54 - 2013-09-09 22:11 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-10-09 19:42 - 2009-05-13 08:01 - 00000000 ____D () C:\Program Files (x86)\Python
2014-10-09 19:30 - 2010-01-14 12:28 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Hoyle®
2014-10-09 19:30 - 2010-01-14 12:27 - 00000000 ____D () C:\Program Files (x86)\Encore
2014-10-09 19:21 - 2012-08-16 12:39 - 00000000 ____D () C:\ProgramData\FilesOpened
2014-10-09 19:20 - 2010-01-14 20:24 - 00000000 ____D () C:\Program Files (x86)\eGames
2014-10-09 19:03 - 2009-10-24 18:00 - 00000000 ____D () C:\Program Files (x86)\Intuit
2014-10-09 15:01 - 2012-11-10 00:03 - 00000290 _____ () C:\Windows\Tasks\FastAgain PC Booster_DEFAULT.job
2014-10-09 12:45 - 2014-07-16 14:24 - 00000432 _____ () C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Sharon).job
2014-10-09 09:23 - 2013-08-13 20:58 - 00000258 __RSH () C:\Users\Sharon\ntuser.pol
2014-10-09 09:23 - 2009-09-02 12:33 - 00000000 ____D () C:\Users\Sharon
2014-10-08 23:03 - 2012-11-10 00:03 - 00000298 _____ () C:\Windows\Tasks\FastAgain PC Booster_UPDATES.job
2014-10-08 21:15 - 2012-03-14 12:53 - 00002425 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader X.lnk
2014-10-07 18:49 - 2010-05-11 17:22 - 00000426 _____ () C:\Windows\Tasks\AiO Home Center Registration Remind Task.job
2014-10-07 18:49 - 2010-05-11 17:14 - 00245046 _____ () C:\Users\Sharon\AppData\Local\installer.log
2014-10-06 17:24 - 2009-12-14 18:54 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-09-25 17:02 - 2009-09-02 14:23 - 00002569 _____ () C:\Users\Sharon\Desktop\Microsoft Office Excel 2007.lnk
2014-09-25 17:01 - 2009-09-02 14:24 - 00002611 _____ () C:\Users\Sharon\Desktop\Microsoft Office Word 2007.lnk
2014-09-17 23:55 - 2014-03-13 18:14 - 00001975 _____ () C:\Users\Sharon\Desktop\Google Chrome.lnk
2014-09-15 09:06 - 2010-05-12 06:47 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-12 04:28 - 2014-08-09 11:55 - 00000000 ____D () C:\Users\Sharon\AppData\Roaming\Ancuym
2014-09-12 04:00 - 2014-02-26 04:07 - 00751766 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 04:00 - 2006-11-02 08:46 - 00751766 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-12 03:02 - 2013-08-15 03:08 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 03:02 - 2006-11-02 08:35 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
 
Files to move or delete:
====================
C:\Windows\Tasks\{F559D6F4-03BC-FB8E-356A-00FC41EA67C0}.job
 
 
==================== Bamital & volsnap Check =================
 
(There is no automatic fix for files that do not pass verification.)
 
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
 
 
LastRegBack: 2014-10-10 16:02
 
==================== End Of Log ============================
 
Addition.txt
 
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 08-10-2014 01
Ran by Sharon at 2014-10-10 21:39:23
Running from C:\Users\Sharon\Desktop
Boot Mode: Normal
==========================================================
 
 
==================== Security Center ========================
 
(If an entry is included in the fixlist, it will be removed.)
 
 
==================== Installed Programs ======================
 
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
 
 Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version:  - Microsoft)
ABBYY FineReader 6.0 Sprint (HKLM-x32\...\{ACF60000-22B9-4CE9-98D6-2CCF359BAC07}) (Version: 6.00.2146.41621 - ABBYY Software House)
ABBYY FineReader 9.0 Sprint (HKLM-x32\...\ABBYY FineReader 9.0 Sprint) (Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.7.186 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 1.7.186 - Adobe Systems Incorporated) Hidden
Activation Assistant for the 2007 Microsoft Office suites (x32 Version: 1.0.1 - Microsoft Corporation) Hidden
ActiveCheck component for HP Active Support Library (x32 Version: 3.0.0.2 - Hewlett-Packard) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.1.19610 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.7.1.19610 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX (HKLM-x32\...\{41042E28-CCA1-4147-869F-9E928B38F04C}) (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)
aiofw (x32 Version: 4.2.6.8 - Eastman Kodak Company) Hidden
aioprnt (Version: 4.2.7.4 - Eastman Kodak Company) Hidden
aioscnnr (x32 Version: 4.2.6.0 - Your Company Name) Hidden
Apple Application Support (HKLM-x32\...\{6A3F9D74-BB80-4451-8CA1-4B3A857F1359}) (Version: 2.0.1 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{DAE239CE-EB9D-4EB3-B0D4-528D6BAA48FD}) (Version: 1.0.106 - Apple Inc.)
Brother HL-2140 (HKLM-x32\...\{C8A34CF0-F679-49C6-B772-1D1B8356F698}) (Version: 1.00 - Brother)
CCleaner (HKLM\...\CCleaner) (Version: 4.17 - Piriform)
center (x32 Version: 4.2.6.8 - Eastman Kodak Company) Hidden
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
CyberLink DVD Suite Deluxe (HKLM-x32\...\InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}) (Version: 6.0.2602 - CyberLink Corp.)
CyberLink DVD Suite Deluxe (x32 Version: 6.0.2602 - CyberLink Corp.) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Epson Copy Utility 3.5 (HKLM-x32\...\{AA72FB28-73B4-49E5-B6B4-E78F44BBD0AD}) (Version: 3.5.0.0 - )
Epson Event Manager (HKLM-x32\...\{8F01524C-0676-4CC1-B4AE-64753C723391}) (Version: 3.01.0005 - Seiko Epson Corporation)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON Scan PDF EXtensions (HKLM-x32\...\{F9956472-6E16-4F83-BF9A-F887EF4A45B7}) (Version: 1.03.0000 - SEIKO EPSON Corp.)
EPSON WorkForce GT-1500 Scanner Driver Update version 3.0.2.0 (HKLM-x32\...\ScannerDriverUpdateEPSON WorkForce GT-1500_is1) (Version: 3.0.2.0 - Epson America Inc.)
FinePix Studio (HKLM-x32\...\{E3B3AB03-8ABC-46CF-8CA9-DB5581E1F368}) (Version:  - )
FinePixViewer Resource (HKLM-x32\...\{B44529FF-501E-47CD-A06D-223C161BE058}) (Version: 1.2 - FUJIFILM Corporation)
FinePixViewer Ver.5.5 (HKLM-x32\...\{24ED4D80-8294-11D5-96CD-0040266301AD}) (Version: 5.5 - FUJIFILM Corporation)
GEAR driver installer for x86 and x64 (x32 Version: 4.008.5 - GEAR Software) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.124 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version:  - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
GoToAssist Customer 2.2.0.758 (HKLM-x32\...\GoToAssist Express Customer) (Version: 2.2.0.758 - Citrix Online)
HP Active Support Library (HKLM-x32\...\{0295F89F-F698-4101-9A7D-49F407EC2D82}) (Version: 3.1.10.1 - Hewlett-Packard)
HP Advisor (HKLM-x32\...\{73A43E42-3658-4DD9-8551-FACDA3632538}) (Version: 3.1.1000.1002 - Hewlett-Packard)
HP Customer Experience Enhancements (HKLM-x32\...\{B84739A3-F943-47E4-95D8-96381EF5AC48}) (Version: 5.7.0.2945 - Hewlett-Packard)
HP Deskjet 1000 J110 series Basic Device Software (HKLM\...\{A3E89C5B-BB3A-433A-A878-D1310BB13EAD}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Deskjet 1000 J110 series Help (HKLM-x32\...\{DDDFCC77-7F9C-45E9-B38E-721BA599BA0C}) (Version: 140.0.65.65 - Hewlett Packard)
HP Deskjet 1000 J110 series Product Improvement Study (HKLM\...\{EEC82191-E879-4906-9D6B-D9665CF030CD}) (Version: 28.0.1313.0 - Hewlett-Packard Co.)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.0.66 - WildTangent)
HP MediaSmart Demo (HKLM-x32\...\{290CA856-3737-4874-864B-BA142F4823C8}_is1) (Version: 1.0.0.0 - Hewlett-Packard Company)
HP MediaSmart Music/Photo/Video (HKLM-x32\...\InstallShield_{B2EE25B9-5B00-4ACF-94F0-92433C28C39E}) (Version: 2.2.2809 - Hewlett-Packard)
HP MediaSmart Music/Photo/Video (x32 Version: 2.2.2809 - Hewlett-Packard) Hidden
HP MediaSmart SmartMenu (HKLM\...\{D2E8F543-D23A-4A38-AFFC-4BDEBFBA6FDA}) (Version: 2.1.12 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Photo Creations (HKLM-x32\...\HP Photo Creations) (Version: 1.0.0.7702 - HP)
HP Picasso Media Center Add-In (x32 Version: 1.0.0 - HP) Hidden
HP Product Detection (HKLM-x32\...\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}) (Version: 9.7.2 - Hewlett-Packard Company)
HP Recovery Manager RSS (x32 Version: 92.0.0.11 - Hewlet Packard Company) Hidden
HP Remote Software (HKLM\...\{5F240DB8-0D74-4F13-86C3-929760392A8D}) (Version: 1.0.5.0 - Hewlett-Packard)
HP Support Information (HKLM-x32\...\{1CC069FA-1A86-402E-9787-3F04E652C67A}) (Version: 10.1.0001 - Hewlett-Packard)
HPAsset component for HP Active Support Library (x32 Version: 3.0.2.2 - Hewlett-Packard) Hidden
Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version:  - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version:  - Intel Corporation)
ISIS Driver - EPSON GT-1500 v1.0 (HKLM-x32\...\{D41864EF-CC5D-4CF4-B0B9-CA3152164157}) (Version: 1.0 - EMC Captiva)
Java 7 Update 15 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217015FF}) (Version: 7.0.150 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
KODAK AiO Home Center (HKLM-x32\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 4.2.7.7 - Eastman Kodak Company)
ksDIP (x32 Version: 3.20.0000.0000 - Eastman Kodak Company) Hidden
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.1402 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.1402 - CyberLink Corp.) Hidden
LightScribe System Software (HKLM-x32\...\{7F10292C-A190-4176-A665-A1ED3478DF86}) (Version: 1.18.3.2 - LightScribe)
McAfee Virtual Technician (HKLM-x32\...\McAfee Virtual Technician) (Version: 7.5.0.3093 - McAfee, Inc.)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (HKLM\...\{EE936C7A-EA40-31D5-9B65-8E3E089C3828}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{4FFA2088-8317-3B14-93CD-4C699DB37843}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Web Publishing Wizard 1.52 (HKLM-x32\...\WebPost) (Version:  - )
Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 23.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 23.0.1 (x86 en-US)) (Version: 23.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 23.0.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
PictureMover (HKLM-x32\...\{1896E712-2B3D-45eb-BCE9-542742A51032}) (Version: 3.3.1.12 - Hewlett-Packard Company)
Playalot Games (HKLM-x32\...\{3A3532ED-A121-4297-AA4F-70B60E4BD631}) (Version: 1.0.0 - W3i, LLC)
Playtopus (HKCU\...\Playtopus) (Version:  - Playtopus)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2602 - CyberLink Corp.)
Power2Go (x32 Version: 6.0.2602 - CyberLink Corp.) Hidden
PowerDirector (HKLM-x32\...\InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}) (Version: 7.0.2611 - CyberLink Corp.)
PowerDirector (x32 Version: 7.0.2611 - CyberLink Corp.) Hidden
PreReq (x32 Version: 3.20.0000.0000 - Eastman Kodak Company) Hidden
Python 2.6.1 (HKLM-x32\...\{9CC89170-000B-457D-91F1-53691F85B223}) (Version: 2.6.1150 - Python Software Foundation)
Quicken 2010 (HKLM-x32\...\{CCF6F57B-F6B4-4508-BF45-63AAC9DE416A}) (Version: 19.1.3.19 - Intuit)
Quicken Basic 2000 (HKLM-x32\...\Quicken Basic 2000) (Version:  - )
QuickTime (HKLM-x32\...\{C9E14402-3631-4182-B377-6B0DFB1C0339}) (Version: 7.70.80.34 - Apple Inc.)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5789 - Realtek Semiconductor Corp.)
Shockwave (HKLM-x32\...\Shockwave) (Version:  - )
Solitaire Master 5 (HKLM-x32\...\Solitaire Master 5) (Version:  - )
Temp File Cleaner (HKLM\...\Temp File Cleaner) (Version: 4.3.0 - Addpcs, LLC)
TurboTax 2009 (HKLM-x32\...\TurboTax 2009) (Version:  - Intuit, Inc)
TurboTax 2009 wctiper (x32 Version: 009.000.0682 - Intuit Inc.) Hidden
TurboTax 2009 WinPerFedFormset (x32 Version: 009.000.1779 - Intuit Inc.) Hidden
TurboTax 2009 WinPerReleaseEngine (x32 Version: 009.000.0311 - Intuit Inc.) Hidden
TurboTax 2009 WinPerTaxSupport (x32 Version: 009.000.0227 - Intuit Inc.) Hidden
TurboTax 2009 wnyiper (x32 Version: 009.000.0695 - Intuit Inc.) Hidden
TurboTax 2009 wrapper (x32 Version: 009.000.0145 - Intuit Inc.) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version:  - Microsoft)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Yahoo! Detect (HKLM-x32\...\YTdetect) (Version:  - )
Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version:  - Yahoo! Inc.)
 
==================== Custom CLSID (selected items): ==========================
 
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
 
CustomCLSID: HKU\S-1-5-21-3122679508-3511620857-1760614917-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?
CustomCLSID: HKU\S-1-5-21-3122679508-3511620857-1760614917-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 -> C:\Users\Sharon\AppData\Local\Temp\soupoqr\stdipwr\wow.dll No File
 
==================== Restore Points  =========================
 
Could not list Restore Points. Check "winmgmt" service or repair WMI.
 
 
==================== Hosts content: ==========================
 
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
 
2006-11-02 08:34 - 2014-10-10 03:02 - 00450632 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
127.0.0.1 www.0scan.com
127.0.0.1 0scan.com
127.0.0.1 1000gratisproben.com
127.0.0.1 www.1000gratisproben.com
127.0.0.1 1001namen.com
127.0.0.1 www.1001namen.com
127.0.0.1 100888290cs.com
127.0.0.1 www.100888290cs.com
127.0.0.1 www.100sexlinks.com
127.0.0.1 100sexlinks.com
127.0.0.1 10sek.com
127.0.0.1 www.10sek.com
127.0.0.1 www.1-2005-search.com
127.0.0.1 1-2005-search.com
127.0.0.1 123fporn.info
127.0.0.1 www.123fporn.info
127.0.0.1 123haustiereundmehr.com
127.0.0.1 www.123haustiereundmehr.com
 
There are 1000 more lines.
 
 
==================== Scheduled Tasks (whitelisted) =============
 
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
 
Task: {02CE6A14-9918-43D2-B469-7588165AF243} - System32\Tasks\Scan the system (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe
Task: {03F02F2A-4205-4341-9EFF-28D21CA2869B} - System32\Tasks\Check for updates (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exe
Task: {0A42D78F-C665-4CA0-85AB-819BF30D12C1} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {0FAA1680-4D44-4AD0-918A-B9190109F08E} - System32\Tasks\Security Center Update - 3010263955 => C:\Users\Sharon\AppData\Roaming\Qiqaaxu\talee.exe [2013-07-31] () <==== ATTENTION
Task: {105442AD-E4DD-4ED0-B61E-A134643ECB8B} - System32\Tasks\PCSpeedClean_Popup => C:\Program Files (x86)\PC Speed Clean\Splash.exe
Task: {18DD8AB9-6084-435D-957D-3E39284E84B3} - System32\Tasks\Rocket Updater => C:\Users\Sharon\AppData\Roaming\ROCKET~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {1CFC9A8E-FAC8-4346-A91A-7E1CEDE17678} - System32\Tasks\DTReg => C:\Users\Sharon\AppData\Roaming\DefaultTab\DefaultTab\DTReg.exe <==== ATTENTION
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)
Task: {255718C8-317F-422C-AF8C-B1F3A09505E3} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-14] (Google Inc.)
Task: {2B6185EF-F140-4A61-9909-D26A4DCBB631} - System32\Tasks\Security Center Update - 398391132 => C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe [2014-04-17] () <==== ATTENTION
Task: {2BB45129-7013-450D-82D5-3BBD6D784400} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {2C2ECC56-F0E0-4E98-AD4D-F8D3AA311064} - System32\Tasks\FastAgain PC Booster => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exe
Task: {313668D2-6B9D-4765-85EE-CFE32497C141} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-16] (Adobe Systems Incorporated)
Task: {32975251-CAE8-41EB-943B-C81278159174} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-03-14] (Google Inc.)
Task: {32B4C94A-F0F3-42B7-A0F8-2D77BF02B22D} - System32\Tasks\Refresh immunization (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exe
Task: {374F3482-606C-448A-A440-DE0754F6987A} - System32\Tasks\Performance Center_Sharon-PC@Sharon => C:\Program Files (x86)\Ascentive\Performance Center\APCMain.exe
Task: {3A8728A2-0FA0-4B8F-BE97-DD4A5C19FF8D} - System32\Tasks\FastAgain PC Booster_UPDATES => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exe
Task: {4AE3D503-C641-4986-BF61-A10273BEEC63} - System32\Tasks\AiO Home Center Registration Remind Task => C:\ProgramData\Kodak\Installer\Registration.exe [2009-08-05] (KODAK)
Task: {4BA7005E-BEEC-4143-BA7A-60D6D7040E67} - \PC Performer No Task File <==== ATTENTION
Task: {51328E17-83ED-4D53-8C85-6C9D071CCED0} - System32\Tasks\Security Center Update - 1990788741 => C:\Users\Sharon\AppData\Roaming\Edpopob\ighoaz.exe [2013-08-31] () <==== ATTENTION
Task: {541B2805-D467-4B34-B6FC-DAE22CAB8009} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {54352893-4779-4C5E-9D9E-BA9ABBC48D87} - \Security Center Update - 697063983 No Task File <==== ATTENTION
Task: {54435C51-5DEC-4029-B594-7EF839CB1E8C} - System32\Tasks\{9C36FFDA-02CA-D98A-C551-06CFEF40C5BC} => C:\Users\Sharon\AppData\Roaming\zvloglr.dll [2014-10-10] ()
Task: {58948AA3-4DF3-4D3A-84E1-8959E860B16B} - \RegClean Pro No Task File <==== ATTENTION
Task: {69ABADD9-FD22-419B-99DE-B367350AD5AA} - System32\Tasks\HPCustParticipation HP Deskjet 1000 J110 series => C:\Program Files\HP\HP Deskjet 1000 J110 series\Bin\HPCustPartic.exe [2012-10-02] (Hewlett-Packard Co.)
Task: {735836CC-8231-418E-B028-CE5E9C32650C} - \Playtopus Updater No Task File <==== ATTENTION
Task: {7BC40770-4194-48B8-9928-D22E2262F376} - \PC Performer_DEFAULT No Task File <==== ATTENTION
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {7FC5C61E-B7D4-4776-A13F-C99CAE28ABB6} - \PC Performer_UPDATES No Task File <==== ATTENTION
Task: {9F1F0242-4DE4-449E-8C23-4F8716F92E9C} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {AE644FCA-D6E8-42AA-B3CC-46169528CDC7} - System32\Tasks\HP Health Check => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-12-04] (Hewlett-Packard)
Task: {AFD4CF3D-ED08-4EA0-A869-42F2AA6DC024} - System32\Tasks\SlimCleaner Plus (Scheduled Scan - Sharon) => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe
Task: {B01FC9A8-DCEC-4BB4-80EB-A7F3544A7242} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-20] (Microsoft Corporation)
Task: {BB0944B5-F633-4559-BD0B-F4D1516F2214} - System32\Tasks\PCSpeedClean_Start => C:\Program Files (x86)\PC Speed Clean\PCSpeedClean.exe
Task: {BF7E9A84-DBBC-45C4-B05F-41D3A1E4AB06} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe <==== ATTENTION
Task: {D02B20DD-252F-4905-AD46-47226B27C549} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {E010CE68-EDBA-49C5-92D5-1E9FEB7B6409} - \Security Center Update - 1913703763 No Task File <==== ATTENTION
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()
Task: {F2FBFBC8-815A-4A61-B923-D3A3B5CF9AEA} - \PastaQuotes No Task File <==== ATTENTION
Task: {F3B1433A-0EA0-4507-B0CD-35A624944C01} - System32\Tasks\Performance Center@Logon => C:\Program Files (x86)\Ascentive\Performance Center\APCMain.exe
Task: {F6742C4D-1CFD-42F4-9D87-3A2FCD2E5DC5} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {FDE15D5B-898A-4753-A69A-3E3B2DE04DF2} - System32\Tasks\FastAgain PC Booster_DEFAULT => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\AiO Home Center Registration Remind Task.job => C:\ProgramData\Kodak\Installer\Registration.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\FastAgain PC Booster_DEFAULT.job => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exe
Task: C:\Windows\Tasks\FastAgain PC Booster_UPDATES.job => C:\Program Files (x86)\FastAgain PC Booster\PCBooster.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Rocket Updater.job => C:\Users\Sharon\AppData\Roaming\ROCKET~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION
Task: C:\Windows\Tasks\Security Center Update - 1990788741.job => C:\Users\Sharon\AppData\Roaming\Edpopob\ighoaz.exe <==== ATTENTION
Task: C:\Windows\Tasks\Security Center Update - 3010263955.job => C:\Users\Sharon\AppData\Roaming\Qiqaaxu\talee.exe <==== ATTENTION
Task: C:\Windows\Tasks\Security Center Update - 398391132.job => C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe <==== ATTENTION
Task: C:\Windows\Tasks\SlimCleaner Plus (Scheduled Scan - Sharon).job => C:\Program Files\SlimCleaner Plus\SlimCleanerPlus.exe
Task: C:\Windows\Tasks\User_Feed_Synchronization-{ECEEEB37-047B-4EC4-968D-E55338B6D4D3}.job => C:\Windows\system32\msfeedssync.exe
Task: C:\Windows\Tasks\{F559D6F4-03BC-FB8E-356A-00FC41EA67C0}.job => C:\Windows\system32\regsvr32.exe
 
==================== Loaded Modules (whitelisted) =============
 
2014-04-17 15:08 - 2014-04-17 15:08 - 00291069 _____ () C:\Users\Sharon\AppData\Roaming\Uhniovgi\maxee.exe
2009-06-29 15:14 - 2009-06-29 15:14 - 00012288 _____ () C:\Program Files (x86)\Kodak\AiO\Center\Logger.dll
2010-01-14 11:06 - 2010-01-14 11:06 - 00854016 _____ () C:\Windows\assembly\GAC_32\System.Data.SQLite\1.0.61.0__db937bc2d44ff139\System.Data.SQLite.dll
2010-01-14 11:06 - 2010-01-14 11:06 - 00471040 _____ () C:\Windows\assembly\GAC_MSIL\Intuit.Spc.Map.Reporter\5.0.104.0__7ce6deabcb36a8ea\Intuit.Spc.Map.Reporter.dll
2013-12-08 20:18 - 2013-12-08 20:18 - 00498176 _____ () C:\Program Files (x86)\VideoLAN\VLC\axvlc.dll
2013-12-08 20:18 - 2013-12-08 20:18 - 00113664 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlc.dll
2013-12-08 20:19 - 2013-12-08 20:19 - 02342912 _____ () C:\Program Files (x86)\VideoLAN\VLC\libvlccore.dll
 
==================== Alternate Data Streams (whitelisted) =========
 
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
 
 
==================== Safe Mode (whitelisted) ===================
 
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
 
 
==================== EXE Association (whitelisted) =============
 
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
 
 
==================== MSCONFIG/TASK MANAGER disabled items =========
 
(Currently there is no automatic fix for this section.)
 
MSCONFIG\Services: BackupStack => 2
MSCONFIG\Services: CltMngSvc => 2
MSCONFIG\Services: DefaultTabUpdate => 2
MSCONFIG\Services: gupdate => 2
MSCONFIG\Services: gupdatem => 3
MSCONFIG\Services: gusvc => 3
MSCONFIG\Services: MozillaMaintenance => 3
MSCONFIG\Services: YahooAUService => 2
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Event Reminder.lnk => C:\Windows\pss\Event Reminder.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ExifLauncher2.lnk => C:\Windows\pss\ExifLauncher2.lnk.CommonStartup
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^PictureMover.lnk => C:\Windows\pss\PictureMover.lnk.CommonStartup
MSCONFIG\startupfolder: C:^Users^Sharon^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MyPC Backup.lnk => C:\Windows\pss\MyPC Backup.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Sharon^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
MSCONFIG\startupfolder: C:^Users^Sharon^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Socialbox.lnk => C:\Windows\pss\Socialbox.lnk.Startup
MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: ApnUpdater => "C:\Program Files (x86)\Ask.com\Updater\Updater.exe"
MSCONFIG\startupreg: BrStsWnd => "C:\Program Files (x86)\Brownie\BrstsW64.exe" Autorun
MSCONFIG\startupreg: CLMLServer for HP TouchSmart => "c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\Kernel\CLML\CLMLSvc.exe"
MSCONFIG\startupreg: Conime => %windir%\system32\conime.exe
MSCONFIG\startupreg: DW7 => "C:\Program Files (x86)\The Weather Channel\The Weather Channel App\TWCApp.exe"
MSCONFIG\startupreg: EEventManager => "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe"
MSCONFIG\startupreg: EKIJ5000StatusMonitor => C:\Windows\system32\spool\DRIVERS\x64\3\EKIJ5000MUI.exe
MSCONFIG\startupreg: HP Health Check Scheduler => c:\Program Files (x86)\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSCONFIG\startupreg: HP Remote Software => C:\Program Files\Hewlett-Packard\HP Remote\HP REMOTE V1.0.5.exe
MSCONFIG\startupreg: HP Software Update => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe
MSCONFIG\startupreg: hpsysdrv => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe
MSCONFIG\startupreg: Microsoft Default Manager => "c:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: SmartMenu => %ProgramFiles%\Hewlett-Packard\HP MediaSmart\SmartMenu.exe
MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
MSCONFIG\startupreg: TSMAgent => "c:\Program Files (x86)\Hewlett-Packard\TouchSmart\Media\TSMAgent.exe"
MSCONFIG\startupreg: UpdateLBPShortCut => "c:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
MSCONFIG\startupreg: UpdateP2GoShortCut => "c:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
MSCONFIG\startupreg: UpdatePDIRShortCut => "c:\Program Files (x86)\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\PowerDirector" UpdateWithCreateOnce "SOFTWARE\CyberLink\PowerDirector\7.0"
MSCONFIG\startupreg: UpdatePSTShortCut => "c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe\MUITransfer\MUIStartMenu.exe" "c:\Program Files (x86)\CyberLink\CyberLink DVD Suite Deluxe" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
 
========================= Accounts: ==========================
 
Administrator (S-1-5-21-3122679508-3511620857-1760614917-500 - Administrator - Disabled)
Guest (S-1-5-21-3122679508-3511620857-1760614917-501 - Limited - Disabled)
Sharon (S-1-5-21-3122679508-3511620857-1760614917-1000 - Administrator - Enabled) => C:\Users\Sharon
 
==================== Faulty Device Manager Devices =============
 
Could not list Devices. Check "winmgmt" service or repair WMI.
 
 
==================== Event log errors: =========================
 
Application errors:
==================
Error: (10/10/2014 08:57:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application msiexec.exe, version 5.0.0.0, time stamp 0x54344f7f, faulting module ntdll.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000005, fault offset 0x0002d5d5,
process id 0x20dc, application start time 0xmsiexec.exe0.
 
Error: (10/10/2014 08:57:38 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application msiexec.exe, version 5.0.0.0, time stamp 0x54252a2e, faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code 0xc00000fd, fault offset 0x75849ba4,
process id 0x34b0, application start time 0xmsiexec.exe0.
 
Error: (10/10/2014 05:57:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program Explorer.EXE version 6.0.6002.18005 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.
Process ID: c80
Start Time: 01cfe4c46b898d34
Termination Time: 282
 
Error: (10/10/2014 04:04:46 PM) (Source: SecurityCenter) (EventID: 3) (User: )
Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.
 
Error: (10/10/2014 03:58:36 PM) (Source: SecurityCenter) (EventID: 3) (User: )
Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.
 
Error: (10/10/2014 03:56:27 PM) (Source: WinMgmt) (EventID: 28) (User: )
Description: 0x8007007e
 
Error: (10/10/2014 03:04:15 PM) (Source: SecurityCenter) (EventID: 3) (User: )
Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.
 
Error: (10/10/2014 03:02:03 PM) (Source: WinMgmt) (EventID: 28) (User: )
Description: 0x8007007e
 
Error: (10/10/2014 01:53:51 PM) (Source: MsiInstaller) (EventID: 11720) (User: Sharon-PC)
Description: Product: Microsoft Fix it 50472 -- Error 1720. There is a problem with this Windows Installer package. A script required for this install to complete could not be run. Contact your support personnel or package vendor.  Custom action ProcessCheck script error -2147024770, :  Line 18, Column 1,
 
Error: (10/10/2014 01:29:29 PM) (Source: SecurityCenter) (EventID: 3) (User: )
Description: The Windows Security Center Service was unable to establish event queries with WMI to monitor third party AntiVirus, AntiSpyware and Firewall.
 
 
System errors:
=============
Error: (10/10/2014 04:11:32 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (10/10/2014 04:09:45 PM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
Error: (10/10/2014 03:56:26 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\Drivers\mrtRate.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (10/10/2014 03:02:01 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\Drivers\mrtRate.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (10/10/2014 01:39:59 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
 
Error: (10/10/2014 01:27:19 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\Drivers\mrtRate.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (10/10/2014 01:27:04 PM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)
Description: The print spooler failed to share printer HP Deskjet 1000 J110 series with shared resource name HP Deskjet 1000 J110 series. Error 2114. The printer cannot be used by others on the network.
 
Error: (10/10/2014 09:29:12 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \SystemRoot\SysWow64\Drivers\mrtRate.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.
 
Error: (10/10/2014 09:29:00 AM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)
Description: The print spooler failed to share printer HP Deskjet 1000 J110 series with shared resource name HP Deskjet 1000 J110 series. Error 2114. The printer cannot be used by others on the network.
 
Error: (10/10/2014 05:13:41 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
 
 
Microsoft Office Sessions:
=========================
 
CodeIntegrity Errors:
===================================
  Date: 2014-10-10 03:09:19.752
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-10-10 02:39:57.713
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-10-10 02:39:57.342
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-10-10 02:39:56.888
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-10-10 02:39:56.414
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-10-10 02:33:09.152
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-02-22 21:35:55.498
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Sharon\AppData\Local\Temp\TEMP.^^^\SYMEVENT64x86.SYS because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-02-22 21:35:55.201
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Sharon\AppData\Local\Temp\TEMP.^^^\SYMEVENT64x86.SYS because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-02-22 21:35:54.874
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Sharon\AppData\Local\Temp\TEMP.^^^\SYMEVENT64x86.SYS because the set of per-page image hashes could not be found on the system.
 
  Date: 2014-02-22 21:35:54.562
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Users\Sharon\AppData\Local\Temp\TEMP.^^^\SYMEVENT64x86.SYS because the set of per-page image hashes could not be found on the system.
 
 
==================== Memory info =========================== 
 
Processor: Pentium® Dual-Core CPU E6300 @ 2.80GHz
Percentage of memory in use: 76%
Total physical RAM: 8181.33 MB
Available physical RAM: 1902.52 MB
Total Pagefile: 16567.68 MB
Available Pagefile: 9893.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
 
==================== Drives ================================
 
Drive c: (HP) (Fixed) (Total:917.84 GB) (Free:714.85 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:13.67 GB) (Free:1.89 GB) NTFS ==>[system with boot components (obtained from reading drive)]
 
==================== MBR & Partition Table ==================
 
========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=917.8 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=13.7 GB) - (Type=07 NTFS)
 
==================== End Of Log ============================
 
And the Fixlist i use
 
Start
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess?
HKU\S-1-5-21-3287850538-662522702-2252149430-1000\...\MountPoints2: {9089bd59-fd7b-11e1-a068-f04da2fbeef7} - H:\setup.exe -a
HKU\S-1-5-21-3287850538-662522702-2252149430-1000\...\MountPoints2: {e8ddc4a6-8e70-11e3-9d38-f04da2fbeef7} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-3287850538-662522702-2252149430-1000\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\Haarstick Repair\AppData\Local\Temp\swqqwmy\sxxntfr\wow.dll ATTENTION! ====> ZeroAccess?
FF DefaultSearchEngine: Conduit Search
FF SelectedSearchEngine: Conduit Search
C:\Users\Haarstick Repair\AppData\Local\Temp\scmrbix\shtrtrq\wow.dll
C:\Users\Haarstick Repair\install_flashplayer12x32axau_gtbd_chrd_dn_aaa_aih.exe
C:\Users\Haarstick Repair\AppData\Local\Temp\InstallFlashPlayer.exe
End
 
 
And here is the Fixlog
 
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 08-10-2014 01
Ran by Sharon at 2014-10-10 22:51:13 Run:1
Running from C:\Users\Sharon\Desktop
Loaded Profile: Sharon (Available profiles: Sharon)
Boot Mode: Normal
==============================================
 
Content of fixlist:
*****************
Start
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess?
HKU\S-1-5-21-3287850538-662522702-2252149430-1000\...\MountPoints2: {9089bd59-fd7b-11e1-a068-f04da2fbeef7} - H:\setup.exe -a
HKU\S-1-5-21-3287850538-662522702-2252149430-1000\...\MountPoints2: {e8ddc4a6-8e70-11e3-9d38-f04da2fbeef7} - "G:\WD SmartWare.exe" autoplay=true
HKU\S-1-5-21-3287850538-662522702-2252149430-1000\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\Haarstick Repair\AppData\Local\Temp\swqqwmy\sxxntfr\wow.dll ATTENTION! ====> ZeroAccess?
FF DefaultSearchEngine: Conduit Search
FF SelectedSearchEngine: Conduit Search
C:\Users\Haarstick Repair\AppData\Local\Temp\scmrbix\shtrtrq\wow.dll
C:\Users\Haarstick Repair\install_flashplayer12x32axau_gtbd_chrd_dn_aaa_aih.exe
C:\Users\Haarstick Repair\AppData\Local\Temp\InstallFlashPlayer.exe
End
*****************
 
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
"HKU\S-1-5-21-3287850538-662522702-2252149430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9089bd59-fd7b-11e1-a068-f04da2fbeef7}" => Key not found.
"HKCR\CLSID\{9089bd59-fd7b-11e1-a068-f04da2fbeef7}" => Key not found.
"HKU\S-1-5-21-3287850538-662522702-2252149430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e8ddc4a6-8e70-11e3-9d38-f04da2fbeef7}" => Key not found.
"HKCR\CLSID\{e8ddc4a6-8e70-11e3-9d38-f04da2fbeef7}" => Key not found.
"HKU\S-1-5-21-3287850538-662522702-2252149430-1000\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}" => Key not found.
Firefox DefaultSearchEngine deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
"C:\Users\Haarstick Repair\AppData\Local\Temp\scmrbix\shtrtrq\wow.dll" => File/Directory not found.
"C:\Users\Haarstick Repair\install_flashplayer12x32axau_gtbd_chrd_dn_aaa_aih.exe" => File/Directory not found.
"C:\Users\Haarstick Repair\AppData\Local\Temp\InstallFlashPlayer.exe" => File/Directory not found.
 
==== End of Fixlog ====

 

Link to post
Share on other sites

Hello and :welcome: :

 

Your logs show that you are still infected.

We can't work on malware diagnostics and removal in this sub-section of the forum.

So, for expert assistance, I suggest that you please follow the advice in this pinned topic: Available Assistance For Possibly Infected Computers.
It explains the options for free, expert help >>AND<< the preliminary steps to expedite the process.

>>As you have already run FRST, you just need to start a NEW topic -- with these same logs -- in the malware removal area of the forum.
A malware analyst will guide you through the cleanup process.

Thanks,

Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.