TerryH Posted October 19, 2014 ID:892623 Share Posted October 19, 2014 I'm infected as of yesterday. Malwarebytes Pro is stopping outgoing dllhost.exe to 95.215.1.57 and 31.184.192.90. Here are the files usually requested first. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-10-2014Ran by Terry (administrator) on TERRY-PC on 19-10-2014 14:51:07Running from C:\Users\Terry\DesktopLoaded Profile: Terry (Available profiles: Terry & Mcx1)Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States)Internet Explorer Version 9Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(AMD) C:\Windows\System32\atiesrxx.exe(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe(Microsoft Corporation) C:\Windows\System32\SLsvc.exe(AMD) C:\Windows\System32\atieclxx.exe(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe() C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe(Microsoft Corporation) C:\Windows\ehome\ehtray.exe(Dropbox, Inc.) C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exe(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(InterVideo Inc.) C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamservice.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamgui.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\System32\mobsync.exe(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [6975520 2009-02-24] (Realtek Semiconductor)HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-20] (Microsoft Corporation)HKLM-x32\...\Run: [OpwareSE2] => C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)HKLM-x32\...\Run: [uVS11 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [341232 2007-07-23] (InterVideo Digital Technology Corporation)HKLM-x32\...\Run: [brStsWnd] => C:\Program Files (x86)\Brownie\BrstsW64.exe [3695416 2009-06-11] (brother)HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [190808 2011-03-01] (Logitech Inc.)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)HKLM-x32\...\Run: [AmazonGSDownloaderTray] => C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe [326144 2009-10-23] (Amazon.com)HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-08-25] (AVG Technologies CZ, s.r.o.)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)HKLM-x32\...\Run: [sDTray] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [4101576 2014-06-24] (Safer-Networking Ltd.)Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenterHKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenterHKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [iSUSPM] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [213936 2006-03-20] (Macrovision Corporation)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [Amazon Music] => C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [6281536 2014-09-05] ()HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [spybot-S&D Cleaning] => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDCleaner.exe [4566952 2014-06-24] (Safer-Networking Ltd.)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exeHKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\MountPoints2: {290a2515-45f4-11e1-a962-0024e807d92f} - L:\LaunchU3.exe -aHKU\S-1-5-21-227674338-2978312964-2044416110-1000\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 239 more characters). <==== Poweliks!AppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~2\AMAZON~2.DLL => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE64.dll [119616 2014-05-23] (Amazon Inc.)AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~2\AMAZON~3.DLL => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE.dll [106304 2014-05-23] (Amazon Inc.)Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Mcx1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnkShortcutTarget: Dropbox.lnk -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)BootExecute: autocheck autochk * sdnclean64.exe==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)ProxyServer: localhost:21320HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/?m=1HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeSearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =BHO: Advertising Cookie Opt-out -> {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} -> C:\Program Files\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc)BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Advertising Cookie Opt-out -> {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} -> C:\Program Files (x86)\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc)BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO-x32: No Name -> {A3BC75A2-1F87-4686-AA43-5347D756017C} -> No FileBHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileDPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabHandler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No FileHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txtTcpip\Parameters: [DhcpNameServer] 192.168.1.1FireFox:========FF ProfilePath: C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.defaultFF Homepage: hxxp://my.yahoo.com/FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No FileFF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No FileFF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> F:\Google\Picasa3\npPicasa3.dll No FileFF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF Plugin-x32: @movenetworks.com/Quantum Media Player -> C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll (Move Networks)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKCU: @movenetworks.com/Quantum Media Player -> C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll (Move Networks)FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\Terry\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10171.dll (Amazon.com, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Invenda Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll (Coupons, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll (Coupons, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Users\Terry\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)FF Extension: Microsoft .NET Framework Assistant - C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-07-08]FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-09-25]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-09-25]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-09-25]FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-09-25]FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtensionFF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-02]FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-05-15]FF HKCU\...\Firefox\Extensions: [moveplayer@movenetworks.com] - C:\Users\Terry\AppData\Roaming\Move NetworksFF Extension: Move Media Player - C:\Users\Terry\AppData\Roaming\Move Networks [2010-03-08]Chrome:=======CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06]==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 Amazon Download Agent; C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [401920 2009-10-23] (Amazon.com) [File not signed]R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3242000 2014-08-25] (AVG Technologies CZ, s.r.o.)R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-08-25] (AVG Technologies CZ, s.r.o.)R2 Capture Device Service; C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe [198168 2007-03-06] (InterVideo Inc.)R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-12-18] (Stardock Corporation) [File not signed]S2 gupdate1c9ee9e3e003430; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [133104 2009-06-16] (Google Inc.)S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]S3 License Management Service ESD; C:\Program Files (x86)\Common Files\element5 Shared\Service\Licence Manager ESD.exe [69120 2010-01-08] (element5) [File not signed]R2 MBAMScheduler; C:\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation) [File not signed]R2 MBAMService; C:\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation) [File not signed]S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738168 2014-06-24] (Safer-Networking Ltd.)R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2088408 2014-06-27] (Safer-Networking Ltd.)R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]S2 SBSDWSCService; F:\Spybot - Search & Destroy\SDWinSec.exe [X]==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.)R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-06-17] (AVG Technologies CZ, s.r.o.)S3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) [File not signed]S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS64_100507.sys [28984 2010-05-10] (Your Corporation)S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios64_100507.sys [33592 2010-05-10] (Your Corporation)S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS64_100507.sys [14960 2010-05-10] () [File not signed]R3 msvad_simple; C:\Windows\System32\drivers\povrtdev.sys [28528 2010-02-24] (MediaMall Technologies, Inc.)S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2009-07-23] () [File not signed]S3 UDXTTM6000; C:\Windows\System32\Drivers\UDXTTM6000.sys [366336 2008-03-02] ()S3 UDXTTM6000HID; C:\Windows\System32\drivers\UDXTTM6000HID.sys [17920 2006-06-28] (DTV-DVB)S3 IpInIp; system32\DRIVERS\ipinip.sys [X]S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2014-10-19 14:49 - 2014-10-19 14:51 - 00022799 _____ () C:\Users\Terry\Desktop\FRST.txt2014-10-19 14:49 - 2014-10-19 14:51 - 00000000 ____D () C:\FRST2014-10-19 14:45 - 2014-10-19 14:46 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Terry\Desktop\tdsskiller.exe2014-10-19 14:44 - 2014-10-19 14:45 - 02112512 _____ (Farbar) C:\Users\Terry\Desktop\FRST64.exe2014-10-19 13:52 - 2014-10-19 14:01 - 00000632 _____ () C:\Windows\PFRO.log2014-10-19 13:38 - 2014-10-19 13:59 - 00000000 ____D () C:\AdwCleaner2014-10-19 13:37 - 2014-10-19 13:37 - 01976320 _____ () C:\Users\Terry\Downloads\adwcleaner_4.000.exe2014-10-19 11:12 - 2014-10-19 11:25 - 00000000 ____D () C:\NPE2014-10-19 11:09 - 2014-10-19 11:50 - 00000000 ____D () C:\Users\Terry\AppData\Local\NPE2014-10-19 11:09 - 2014-10-19 11:09 - 00000000 ____D () C:\ProgramData\Norton2014-10-19 11:06 - 2014-10-19 11:06 - 03060320 ____N (Symantec Corporation) C:\Users\Terry\Downloads\NPE.exe2014-10-19 10:33 - 2014-10-19 10:33 - 00000732 _____ () C:\Users\Terry\AppData\Local\d3d9caps64.dat2014-10-19 02:19 - 2014-10-19 02:19 - 00000000 ____D () C:\Users\Terry\Documents\ProcAlyzer Dumps2014-10-19 02:05 - 2014-10-19 10:37 - 00000628 _____ () C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job2014-10-19 02:05 - 2014-10-19 10:37 - 00000458 _____ () C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job2014-10-19 02:05 - 2014-10-19 02:05 - 00003794 _____ () C:\Windows\System32\Tasks\Scan the system (Spybot - Search & Destroy)2014-10-19 02:05 - 2014-10-19 02:05 - 00003440 _____ () C:\Windows\System32\Tasks\Refresh immunization (Spybot - Search & Destroy)2014-10-19 02:04 - 2014-10-19 14:05 - 00000656 _____ () C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job2014-10-19 02:04 - 2014-10-19 02:04 - 00003022 _____ () C:\Windows\System32\Tasks\Check for updates (Spybot - Search & Destroy)2014-10-19 02:03 - 2014-10-19 02:08 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 22014-10-19 02:03 - 2014-10-19 02:03 - 00001232 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot-S&D Start Center.lnk2014-10-19 02:03 - 2014-10-19 02:03 - 00001220 _____ () C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk2014-10-19 02:03 - 2014-10-19 02:03 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy 22014-10-19 02:03 - 2013-09-20 10:49 - 00021040 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe2014-10-19 01:50 - 2014-10-19 01:50 - 00000258 __RSH () C:\ProgramData\ntuser.pol2014-10-16 03:18 - 2014-09-27 16:41 - 02782208 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-10-16 03:18 - 2014-09-16 23:57 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll2014-10-16 03:18 - 2014-09-16 09:56 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll2014-10-16 03:14 - 2014-06-15 15:18 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll2014-10-16 03:14 - 2014-06-15 15:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll2014-10-16 03:14 - 2014-06-13 11:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll2014-10-16 03:14 - 2014-06-13 11:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll2014-10-16 03:14 - 2014-06-13 10:36 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll2014-10-16 03:14 - 2014-06-13 10:36 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll2014-10-16 03:13 - 2014-09-04 16:38 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys2014-10-15 22:55 - 2014-09-19 17:09 - 17867776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-10-15 22:55 - 2014-09-19 16:55 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-10-15 22:55 - 2014-09-19 16:54 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-10-15 22:55 - 2014-09-19 16:50 - 01385472 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-10-15 22:55 - 2014-09-19 16:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-10-15 22:55 - 2014-09-19 16:48 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-10-15 22:55 - 2014-09-19 16:48 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll2014-10-15 22:55 - 2014-09-19 16:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-10-15 22:55 - 2014-09-19 16:47 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-10-15 22:55 - 2014-09-19 16:46 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-10-15 22:55 - 2014-09-19 16:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe2014-10-15 22:55 - 2014-09-19 16:45 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-10-15 22:55 - 2014-09-19 16:45 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe2014-10-15 22:55 - 2014-09-19 15:53 - 12364288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-10-15 22:55 - 2014-09-19 15:44 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-10-15 22:55 - 2014-09-19 15:41 - 09739776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-10-15 22:55 - 2014-09-19 15:39 - 01138688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-10-15 22:55 - 2014-09-19 15:38 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-10-15 22:55 - 2014-09-19 15:37 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-10-15 22:55 - 2014-09-19 15:36 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2014-10-15 22:55 - 2014-09-19 15:36 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-10-15 22:55 - 2014-09-19 15:36 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-10-15 22:55 - 2014-09-19 15:35 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2014-10-15 22:55 - 2014-09-19 15:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-10-15 22:55 - 2014-09-19 15:34 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe2014-10-15 22:55 - 2014-09-19 15:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe2014-10-15 22:55 - 2014-09-19 15:33 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-09-25 09:28 - 2014-09-25 09:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-09-24 00:18 - 2014-09-08 23:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2014-09-24 00:18 - 2014-09-08 23:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2014-10-19 14:45 - 2009-06-30 01:21 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-10-19 14:16 - 2014-09-01 23:43 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\KeePass2014-10-19 14:16 - 2011-10-29 12:03 - 00000000 ____D () C:\ProgramData\MFAData2014-10-19 14:15 - 2012-04-05 09:05 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-10-19 14:07 - 2009-05-21 13:51 - 01620489 _____ () C:\Windows\WindowsUpdate.log2014-10-19 14:05 - 2014-09-01 22:02 - 00000000 ___RD () C:\Users\Terry\Dropbox2014-10-19 14:05 - 2014-09-01 22:00 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Dropbox2014-10-19 14:02 - 2013-01-24 13:52 - 00000354 _____ () C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job2014-10-19 14:02 - 2009-06-30 01:21 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-10-19 14:02 - 2006-11-02 08:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-10-19 14:02 - 2006-11-02 08:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A02014-10-19 14:02 - 2006-11-02 08:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A02014-10-19 14:02 - 2006-11-02 08:21 - 00404736 _____ () C:\Windows\system32\FNTCACHE.DAT2014-10-19 14:01 - 2009-12-16 17:30 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs2014-10-19 12:38 - 2006-11-02 08:42 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-10-19 09:42 - 2009-12-11 10:25 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy2014-10-17 23:28 - 2006-11-02 05:46 - 00759582 _____ () C:\Windows\system32\PerfStringBackup.INI2014-10-16 03:13 - 2013-08-15 03:03 - 00000000 ____D () C:\Windows\system32\MRT2014-10-16 03:00 - 2006-11-02 05:35 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe2014-10-14 11:41 - 2011-01-08 00:00 - 00000858 _____ () C:\Users\Public\Desktop\CCleaner.lnk2014-10-14 11:41 - 2010-04-08 17:28 - 00000000 ____D () C:\Program Files (x86)\CCleaner2014-10-11 00:54 - 2009-06-22 23:21 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Skype2014-10-10 09:45 - 2014-04-15 09:56 - 00002413 _____ () C:\Users\Public\Desktop\Skype.lnk2014-10-04 09:58 - 2014-06-12 00:00 - 00001582 _____ () C:\Windows\System32\Tasks\Amazon Music Helper2014-10-04 09:58 - 2014-06-12 00:00 - 00000927 _____ () C:\Users\Terry\Desktop\Amazon Music.lnk2014-10-01 09:19 - 2010-02-09 16:48 - 00000426 _____ () C:\Windows\BRWMARK.INI2014-09-26 09:50 - 2006-11-02 06:33 - 00000000 ____D () C:\Windows\rescache2014-09-26 09:31 - 2012-05-11 08:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2014-09-24 10:15 - 2012-04-05 09:05 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-09-24 10:15 - 2012-04-05 09:05 - 00003682 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2014-09-24 10:15 - 2011-05-19 22:10 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-09-24 00:21 - 2009-06-23 11:23 - 00002275 _____ () C:\Users\Public\Desktop\Jasc Paint Shop Pro 9.lnk2014-09-24 00:21 - 2009-06-23 11:17 - 00000000 ____D () C:\Users\Terry\Documents\My PSP Files2014-09-22 08:57 - 2009-07-16 21:17 - 00000000 ____D () C:\Windows\Minidump2014-09-21 16:13 - 2014-09-01 22:02 - 00000921 _____ () C:\Users\Terry\Desktop\Dropbox.lnk2014-09-21 16:13 - 2014-09-01 22:01 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DropboxSome content of TEMP:====================C:\Users\Terry\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpm2u3zr.dllC:\Users\Terry\AppData\Local\Temp\Quarantine.exeC:\Users\Terry\AppData\Local\Temp\sqlite3.dll==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-10-19 14:16==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-10-2014Ran by Terry at 2014-10-19 14:51:30Running from C:\Users\Terry\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: Spybot - Search and Destroy (Disabled - Up to date) {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)001 Joiner and Splitter Pro (HKLM-x32\...\001 Joiner and Splitter Pro2.0) (Version: 2.0 - Welltek Software)7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version: - )Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)Adobe AIR (x32 Version: 3.0.0.4080 - Adobe Systems Incorporated) HiddenAdobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5 - Adobe Systems, Inc.)Amazon 1Button App (HKLM-x32\...\{4D875057-4353-4B8F-93E5-8C3DC7F34EA9}) (Version: 1.0.8 - Amazon)Amazon Games & Software Downloader (HKLM-x32\...\Amazon Games & Software Downloader_is1) (Version: 2.0.2.0 - Amazon)Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version: - Amazon)Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.4.0.628 - Amazon Services LLC)AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) HiddenAMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)ArcSoft PhotoBase 4.5 (HKLM-x32\...\{C0BBE46D-5318-485A-8564-D8FA5576ECD4}) (Version: - ArcSoft)ArcSoft PhotoBase 4.5 (Shared Components) (HKLM-x32\...\Uninstaller_B27C5000_ArcSoft PhotoBase 4.5) (Version: 2.60.30 - element5)ArcSoft PhotoStudio 5.5 (HKLM-x32\...\{D2261C4B-4D9B-4149-8472-31B7A2FEAB91}) (Version: - ArcSoft)Astronomy 2005 Screensaver (HKLM-x32\...\Astronomy 2005 Screensaver) (Version: - )ATI AVIVO64 Codecs (Version: 10.10.0.40914 - ATI Technologies Inc.) HiddenAVG 2014 (HKLM\...\AVG) (Version: 2014.0.4765 - AVG Technologies)AVG 2014 (Version: 14.0.4040 - AVG Technologies) HiddenAVG 2014 (Version: 14.0.4765 - AVG Technologies) HiddenBonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Brother HL-2170W (HKLM-x32\...\{689BA753-2D23-470F-8014-B1EC8D61EE95}) (Version: 1.00 - Brother)CameraHelperMsi (x32 Version: 13.25.1010.0 - Logitech) HiddenCanon ScanGear Starter (HKLM-x32\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version: - )CanoScan Toolbox Ver4.9 (HKLM-x32\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )CarbonPoker (HKCU\...\CarbonPoker) (Version: 5.0 - )Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center Graphics Previews Common (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center InstallProxy (x32 Version: 2008.0828.2144.37162 - ATI Technologies, Inc.) HiddenCatalyst Control Center InstallProxy (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center Localization All (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Chinese Standard (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Chinese Traditional (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Czech (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Danish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Dutch (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help English (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Finnish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help French (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help German (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Greek (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Hungarian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Italian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Japanese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Korean (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Norwegian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Polish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Portuguese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Russian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Spanish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Swedish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Thai (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Turkish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hiddenccc-utility64 (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) HiddenCompatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Corel AfterShot Pro (HKLM-x32\...\AfterShot Pro) (Version: 1.2.0.7 - Corel Corporation)Darksiders (HKLM-x32\...\Steam App 50620) (Version: - Vigil Games)DarksidersInstaller (HKLM-x32\...\{B93EEE50-9C8F-45DF-95E4-3D85A6E242F3}) (Version: 1.00.1000 - THQ)Dell Dock (HKLM\...\{F6CB42B9-F033-4152-8813-FF11DA8E6A78}) (Version: 1.0.0 - Dell)Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)DigitalTV (HKLM-x32\...\{C19DBE5E-712E-4F02-8380-ECEDD951B374}) (Version: 2.64 - )DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.41 - DivX, LLC)Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) HiddenGoogle Advertising Cookie Opt-out (HKLM\...\{A2E00B38-848D-4898-9109-BFA37C074DDC}) (Version: 1.0.1.0 - Google Inc)Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) HiddenH&R Block California 2010 (HKLM-x32\...\{9FBDF580-E37F-4DEE-8F2E-75A8E8716AAD}) (Version: 1.10.4801 - HRB Technology, LLC.)H&R Block California 2011 (HKLM-x32\...\{10894714-E82E-4371-9CF7-F58E352C76EA}) (Version: 1.11.5001 - HRB Technology, LLC.)H&R Block California 2012 (HKLM-x32\...\{E040F1EC-82A9-4950-AAFE-55762AB59590}) (Version: 1.12.7501 - HRB Technology, LLC.)H&R Block California 2013 (HKLM-x32\...\{FA9B4B45-B7F0-47A4-894B-19BBF8829FE2}) (Version: 1.13.6701 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2010 (HKLM-x32\...\{10964A8F-21C1-45EA-BC2D-F84B505C3848}) (Version: 10.04.6402 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2011 (HKLM-x32\...\{C6006AED-E5A7-4F77-BAD5-95AC43DE04F3}) (Version: 11.05.6901 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2012 (HKLM-x32\...\{89D20029-0578-4D8D-979A-695C8D868868}) (Version: 12.05.7801 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2013 (HKLM-x32\...\{EDE796DE-0A72-464D-9D21-F04BC41A092B}) (Version: 13.05.6502 - HRB Technology, LLC.)Hoyle Card Games 2003 (HKLM-x32\...\InstallShield_{9ABA26E1-843A-4A72-95AF-C72474E191F6}) (Version: 1.0.0.0 - Sierra)Hoyle Card Games 2003 (x32 Version: 1.0.0.0 - Sierra) HiddeniCloud (HKLM\...\{CE97E4D3-9F91-4D72-8A29-ED9EA90E5A15}) (Version: 2.1.3.25 - Apple Inc.)Intel® Network Connections 13.1.33.0 (HKLM\...\PROSetDX) (Version: 13.1.33.0 - Intel)Intel® Network Connections 13.1.33.0 (Version: 13.1.33.0 - Intel) HiddenInterVideo DeviceService (HKLM-x32\...\{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}) (Version: 1.0.0 - InterVideo)InterVideo WinDVD 8 (HKLM-x32\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0-B6.109 - InterVideo Inc.)InterVideo WinDVD 8 (x32 Version: 8.0-B6.109 - InterVideo Inc.) HiddenJasc Animation Shop 3 (HKLM-x32\...\{7C4196CA-CA41-4F34-9C08-7724E7705D52}) (Version: 3.11 - Jasc Software Inc)Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.01.0000 - Jasc Software Inc)Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) HiddenKeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7248) - Logitech Inc..)Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)Logitech Webcam Software Driver Package (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)LWS Facebook (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Gallery (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Help_main (x32 Version: 13.25.1016.0 - Logitech) HiddenLWS Launcher (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Motion Detection (x32 Version: 13.20.1176.0 - Logitech) HiddenLWS Pictures And Video (x32 Version: 13.25.1010.0 - Logitech) HiddenLWS Twitter (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Video Mask Maker (x32 Version: 13.10.1216.0 - Logitech) HiddenLWS VideoEffects (Version: 13.25.1005.0 - Logitech) HiddenLWS Webcam Software (x32 Version: 13.20.1168.0 - Logitech) HiddenLWS WLM Plugin (x32 Version: 1.20.1166.0 - Logitech) HiddenLWS YouTube Plugin (x32 Version: 13.20.1166.0 - Logitech) HiddenMalwarebytes Anti-Malware version 1.70.0.1100 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.70.0.1100 - Malwarebytes Corporation)Manual CanoScan LiDE 500F (HKLM-x32\...\{B9C54C44-BB5A-4B03-8907-C01A9790195A}) (Version: - )Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Office 2000 Disc 2 (HKLM-x32\...\{00040409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)Microsoft Office 2000 Small Business (HKLM-x32\...\{00030409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)Move Media Player (HKCU\...\Move Media Player) (Version: - Move Networks)Mozilla Firefox 32.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 en-US)) (Version: 32.0.3 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.0 - Nikon)Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.8.0 - Nikon)Octoshape add-in for Adobe Flash Player (HKCU\...\Octoshape add-in for Adobe Flash Player) (Version: - )Octoshape Streaming Services (HKCU\...\Octoshape Streaming Services) (Version: - )OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)Opanda IExif 2.3 (HKLM-x32\...\Opanda IExif_is1) (Version: 2.3 - Opanda Studio)Opanda PowerExif 1.2 Professional Trial (HKLM-x32\...\Opanda PowerExif Professional Trial_is1) (Version: 1.2 - Opanda Studio)PC Connectivity Solution (HKLM-x32\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)Picture Control Utility (HKLM-x32\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.2 - Nikon)Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.15 - Nikon)QuickBooks Pro (HKLM-x32\...\QuickBooks Pro) (Version: - )QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5783 - Realtek Semiconductor Corp.)Roxio Creator Audio (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Copy (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Data (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator DE (HKLM-x32\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.1 - Roxio)Roxio Creator DE (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Tools (x32 Version: 3.7.0 - Roxio) HiddenRoxio Express Labeler 3 (x32 Version: 3.2.1 - Roxio) HiddenRoxio Update Manager (x32 Version: 6.0.0 - Roxio) HiddenSD Viewer for DSC (HKLM-x32\...\{5A8D3524-79DB-11D5-99D1-00010256D40E}) (Version: - )Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.13.13771 - Skype Technologies S.A.)Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)SmartSound Quicktracks Plugin (HKLM-x32\...\InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}) (Version: 3.0.5.0 - SmartSound Software Inc)SmartSound Quicktracks Plugin (x32 Version: 3.0.5.0 - SmartSound Software Inc) HiddenSpotify (HKLM-x32\...\Spotify) (Version: 0.5.2 - )Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A99D31DE7}_is1) (Version: 2.4.40 - Safer-Networking Ltd.)Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)Stellarium 0.11.4 (HKLM\...\Stellarium_is1) (Version: 0.11.4 - Stellarium team)System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version: - )ubi.com (HKLM-x32\...\{AEDDF5A3-29CE-11D5-A8C2-000102246AAE}) (Version: - )Ulead VideoStudio 11 (HKLM-x32\...\InstallShield_{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}) (Version: 11.0.0.0000 - InterVideo Digital Technology Corporation)VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) HiddenVideoStudio (x32 Version: 11.0.0.0000 - InterVideo Digital Technology Corporation) HiddenViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.8.2 - Nikon)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}) (Version: 8.0.0.35 - GRISOFT, s.r.o.)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - )Windows 7 Upgrade Advisor (HKLM-x32\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\BC15EA930074932BB2C4B4493C9FD4EA95087D1A) (Version: 10/12/2007 6.85.4.0 - Nokia)Windows Live Sign-in Assistant (HKLM-x32\...\{9422C8EA-B0C6-4197-B8FC-DC797658CA00}) (Version: 5.000.818.6 - Microsoft Corporation)Windows Live Sync (HKLM-x32\...\{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}) (Version: 14.0.8050.1202 - Microsoft Corporation)Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )Windows Media Encoder 9 Series (x32 Version: 9.00.3374 - Microsoft Corporation) Hidden==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{8E590317-1329-11D1-B70B-00805F29CD16}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks Pro\qbw32.exe (Intuit, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf>ktds (the data entry has 247 more characters). <==== Poweliks?CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\FileSyncApi64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)==================== Restore Points =========================24-09-2014 07:00:01 Scheduled Checkpoint24-09-2014 07:17:46 Windows Update25-09-2014 08:22:50 Scheduled Checkpoint26-09-2014 07:12:28 Scheduled Checkpoint27-09-2014 07:12:26 Scheduled Checkpoint28-09-2014 07:40:17 Scheduled Checkpoint29-09-2014 07:23:32 Scheduled Checkpoint30-09-2014 07:30:45 Scheduled Checkpoint01-10-2014 07:46:28 Scheduled Checkpoint02-10-2014 07:42:00 Scheduled Checkpoint03-10-2014 06:52:06 Scheduled Checkpoint04-10-2014 07:31:36 Scheduled Checkpoint05-10-2014 07:00:00 Scheduled Checkpoint06-10-2014 07:17:43 Scheduled Checkpoint09-10-2014 19:11:35 Scheduled Checkpoint10-10-2014 07:54:05 Scheduled Checkpoint11-10-2014 08:20:32 Scheduled Checkpoint12-10-2014 07:32:45 Scheduled Checkpoint13-10-2014 03:49:42 Scheduled Checkpoint14-10-2014 07:00:01 Scheduled Checkpoint15-10-2014 07:54:27 Scheduled Checkpoint16-10-2014 07:00:02 Scheduled Checkpoint16-10-2014 10:00:16 Windows Update17-10-2014 07:55:10 Scheduled Checkpoint17-10-2014 21:13:30 Scheduled Checkpoint19-10-2014 18:39:30 Norton_Power_Eraser_20141019113930010==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2006-11-02 05:34 - 2011-12-29 13:56 - 00439947 ____R C:\Windows\system32\Drivers\etc\hosts127.0.0.1 localhost127.0.0.1 www.007guard.com127.0.0.1 007guard.com127.0.0.1 008i.com127.0.0.1 www.008k.com127.0.0.1 008k.com127.0.0.1 www.00hq.com127.0.0.1 00hq.com127.0.0.1 010402.com127.0.0.1 www.032439.com127.0.0.1 032439.com127.0.0.1 www.0scan.com127.0.0.1 0scan.com127.0.0.1 1000gratisproben.com127.0.0.1 www.1000gratisproben.com127.0.0.1 1001namen.com127.0.0.1 www.1001namen.com127.0.0.1 100888290cs.com127.0.0.1 www.100888290cs.com127.0.0.1 www.100sexlinks.com127.0.0.1 100sexlinks.com127.0.0.1 10sek.com127.0.0.1 www.10sek.com127.0.0.1 www.1-2005-search.com127.0.0.1 1-2005-search.com127.0.0.1 123fporn.info127.0.0.1 www.123fporn.info127.0.0.1 123haustiereundmehr.com127.0.0.1 www.123haustiereundmehr.comThere are 1000 more lines.==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {059095CE-546D-42FA-BFB7-E33EEA86785D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {0949C240-3D38-4303-8DC3-70A020A2F70A} - System32\Tasks\Refresh immunization (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exeTask: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMMTask: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPagesTask: {1FA0A7B4-ED60-4DD0-A86B-5B580DC734EE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16] (Google Inc.)Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)Task: {25F37DCF-758A-4D40-8AD5-541C7606A708} - System32\Tasks\{3B5C56C1-C525-4A88-BC88-61EE6267BF86} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {320A623B-2FC3-43AB-B63B-7525B0C1D192} - System32\Tasks\Check for updates (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeTask: {33E3A743-D36C-4DF9-ADF2-C23F213D301D} - System32\Tasks\{AE5D3469-07BF-4E7B-928B-3BF5CB113809} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {4221026F-393B-4E5D-A8EC-D65747B252B5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)Task: {4A15123C-E76F-4D82-B937-7D5243C98D4F} - System32\Tasks\{FE0E2BBA-4C80-4767-89A4-E9ACD7EC1BD1} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {6663F415-D2F8-44BB-895F-3767650B3BA3} - System32\Tasks\{3D2BD65F-DB2E-44BF-B7D4-B095FB17512A} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {73BE57F4-69BB-4A26-8063-8C62FDCE9650} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16] (Google Inc.)Task: {74E73ABB-3C2E-4E70-81BE-A96408803B53} - System32\Tasks\{601D9548-9905-4246-9B31-F26759BF3791} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {7A74FA86-3C66-4D14-9015-F48ED6785C2E} - System32\Tasks\{6842AD54-94B6-4A61-9BE5-784DA11F3505} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UITask: {7D7FBBF4-4AD3-4CAC-AE0E-2A537530C66F} - System32\Tasks\{D196BA7A-04DD-48D5-9D85-E077ABA37980} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {8A678B8E-11EB-4BD0-B154-4AC383C77F85} - System32\Tasks\{4E509FBC-8D20-48B3-BC84-70CD1F5B8430} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {8DF75516-4B1E-4AAE-9DD9-82CA55732D7F} - System32\Tasks\Amazon Music Helper => C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [2014-09-05] ()Task: {8EB90811-87C9-4200-8C35-53900E0C3761} - System32\Tasks\ROC_JAN2013_TB_rmv => C:\Program Files (x86)\AVG Secure Search\PostInstall\ROC.exeTask: {91FF7E33-391D-4CD3-93EF-C90A2141CF12} - System32\Tasks\{794A5A98-576A-4AC6-B2F6-7A6AEBBE1CFB} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {936FDF1A-F2F1-4178-B434-D50A40DDA843} - System32\Tasks\{6E98BF58-8743-49B2-B308-4DE4611C776C} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {9653A31E-2291-49B3-9186-F09F96011527} - System32\Tasks\Scan the system (Spybot - Search & Destroy) => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exeTask: {996EB13C-36C5-4711-911C-BA20B30DF07A} - System32\Tasks\{59E7C911-55A9-4C3E-B8D2-17DF1B71CBD7} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {9C62F2EB-3709-4238-9408-83463879928F} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)Task: {9C639299-8693-461C-9CB2-45D1A0FF2D8A} - System32\Tasks\{E503D6A6-1A96-49AB-A045-19E3A4F5DC74} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {C4CF95F9-568A-4311-81F4-7DF6A379CA76} - System32\Tasks\{DB0D0ADC-9968-4EAE-986D-62664CE01A59} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {CA62A84B-F5D8-494B-9526-C9C18D45A06A} - System32\Tasks\{945D3406-F7FA-4D61-96AA-8B434EE19EAD} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-02-10] (Skype Technologies S.A.)Task: {DE5F040D-02BF-482C-936F-ADD968366CF5} - System32\Tasks\{DF5DE0A7-5C1B-4991-B5D0-CC2F00C6A55C} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {E09DB6C2-0533-4D35-8229-FBAC11C2A77D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)Task: {E6780EE5-268A-4BD0-997D-0875F071CDE4} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Terry => C:\Program Files\Windows Calendar\wincal.exe [2008-01-20] (Microsoft Corporation)Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()Task: {EE12B1A3-7823-4EC6-9089-AA4CC209033D} - System32\Tasks\{05E3AA6F-390E-4F95-B09F-B23A7A691C38} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {F6E17BA7-1D87-482D-B956-B9A9E9F2366C} - System32\Tasks\{23020DA5-E10F-49C1-9AE8-B4E2F5F23E7F} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {F83E7E02-FA8B-4B8D-9506-4010AD28F308} - System32\Tasks\{BEB37EE1-93B4-4734-8BA9-884601E030FD} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\Check for updates (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDImmunize.exeTask: C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job => C:\Program Files (x86)\AVG Secure Search\PostInstall\ROC.exeTask: C:\Windows\Tasks\Scan the system (Spybot - Search & Destroy).job => C:\Program Files (x86)\Spybot - Search & Destroy 2\SDScan.exe==================== Loaded Modules (whitelisted) =============2013-10-31 14:47 - 2013-10-31 14:47 - 00954696 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll2011-04-20 01:21 - 2013-03-28 18:07 - 00045056 _____ () C:\Windows\system32\atitmp64.dll2014-06-11 23:59 - 2014-09-05 17:54 - 06281536 _____ () C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe2014-10-19 14:04 - 2014-10-19 14:04 - 00043008 _____ () c:\users\terry\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpm2u3zr.dll2013-08-23 12:01 - 2013-08-23 12:01 - 25100288 _____ () C:\Users\Terry\AppData\Roaming\Dropbox\bin\libcef.dll2010-05-07 19:35 - 2010-05-07 19:35 - 02143576 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll2010-05-07 19:35 - 2010-05-07 19:35 - 07954776 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll2010-05-07 19:36 - 2010-05-07 19:36 - 00340824 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll2010-05-07 19:37 - 2010-05-07 19:37 - 00027480 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll2010-05-07 19:37 - 2010-05-07 19:37 - 00126808 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll2014-10-19 02:03 - 2014-05-13 12:04 - 00109400 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlThirdParty150.bpl2014-10-19 02:03 - 2014-05-13 12:04 - 00416600 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\DEC150.bpl2014-10-19 02:03 - 2014-05-13 12:04 - 00167768 _____ () C:\Program Files (x86)\Spybot - Search & Destroy 2\snlFileFormats150.bpl2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2007-02-05 17:34 - 2007-02-05 17:34 - 00116248 _____ () C:\Program Files (x86)\Common Files\InterVideo\Common\Bin\MpgTsRdr.ax2014-09-25 09:28 - 2014-09-25 09:29 - 03715184 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll2014-09-09 20:15 - 2014-09-09 20:15 - 16825520 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) =============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Classes\.exe: => <===== ATTENTION! ==================== MSCONFIG/TASK MANAGER disabled items =========(Currently there is no automatic fix for this section.)MSCONFIG\startupreg: DivXMediaServer => "C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe"MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW========================= Accounts: ==========================Administrator (S-1-5-21-227674338-2978312964-2044416110-500 - Administrator - Disabled)Guest (S-1-5-21-227674338-2978312964-2044416110-501 - Limited - Disabled)Mcx1 (S-1-5-21-227674338-2978312964-2044416110-1006 - Administrator - Enabled) => C:\Users\Mcx1Terry (S-1-5-21-227674338-2978312964-2044416110-1000 - Administrator - Enabled) => C:\Users\Terry==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (10/19/2014 02:50:25 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program FRST64.exe version 19.10.2014.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.Process ID: 1668Start Time: 01cfebe6891f3118Termination Time: 2Error: (10/19/2014 02:06:30 PM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.Error: (10/19/2014 02:04:50 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 01:54:17 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 01:53:44 PM) (Source: EventSystem) (EventID: 4609) (User: )Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043cError: (10/19/2014 01:36:19 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program iexplore.exe version 9.0.8112.16584 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.Process ID: 1814Start Time: 01cfebdc29f5fe42Termination Time: 92Error: (10/19/2014 00:44:59 PM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.Error: (10/19/2014 00:43:34 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 00:37:25 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program iexplore.exe version 9.0.8112.16584 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.Process ID: 15a4Start Time: 01cfebd1b23599a4Termination Time: 0Error: (10/19/2014 00:26:33 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.PSET> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)System errors:=============Error: (10/19/2014 02:31:23 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}Error: (10/19/2014 02:05:38 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: Spybot-S&D 2 Scanner Service%%1053Error: (10/19/2014 02:05:38 PM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: 30000Spybot-S&D 2 Scanner ServiceError: (10/19/2014 02:05:19 PM) (Source: Service Control Manager) (EventID: 7026) (User: )Description: StarOpenError: (10/19/2014 02:05:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: SBSD Security Center Service%%3Error: (10/19/2014 02:05:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: Windows Search%%1053Error: (10/19/2014 02:05:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: 30000Windows SearchError: (10/19/2014 02:05:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: Spybot-S&D 2 Scanner Service%%1053Error: (10/19/2014 02:05:19 PM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: 30000Spybot-S&D 2 Scanner ServiceError: (10/19/2014 02:05:14 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Microsoft Office Sessions:=========================Error: (10/19/2014 02:50:25 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: FRST64.exe19.10.2014.0166801cfebe6891f31182Error: (10/19/2014 02:06:30 PM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.(NULL)(NULL)(NULL)(NULL)Error: (10/19/2014 02:04:50 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 01:54:17 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 01:53:44 PM) (Source: EventSystem) (EventID: 4609) (User: )Description: d:\longhorn\com\complus\src\events\tier1\eventsystemobj.cpp458007043cError: (10/19/2014 01:36:19 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: iexplore.exe9.0.8112.16584181401cfebdc29f5fe4292Error: (10/19/2014 00:44:59 PM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.(NULL)(NULL)(NULL)(NULL)Error: (10/19/2014 00:43:34 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 00:37:25 PM) (Source: Application Hang) (EventID: 1002) (User: )Description: iexplore.exe9.0.8112.1658415a401cfebd1b23599a40Error: (10/19/2014 00:26:33 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.PSETCodeIntegrity Errors:=================================== Date: 2014-10-19 14:51:10.779 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 14:51:10.545 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 14:51:10.309 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 14:51:10.019 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 14:49:55.472 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 14:49:55.225 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 14:49:54.980 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 14:49:54.727 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 11:37:23.118 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-19 00:40:19.023 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\Backup\amd64_microsoft-windows-tcpip-binaries_31bf3856ad364e35_6.0.6001.18000_none_0f3cadd61ec3b22c_tcpip.sys_3339bd51 because the set of per-page image hashes could not be found on the system.==================== Memory info ===========================Processor: Intel® Core i7 CPU 920 @ 2.67GHzPercentage of memory in use: 25%Total physical RAM: 12278.26 MBAvailable physical RAM: 9123.37 MBTotal Pagefile: 24731.55 MBAvailable Pagefile: 21342.04 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.81 MB==================== Drives ================================Drive c: (OS) (Fixed) (Total:581.1 GB) (Free:374.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]Drive d: (RECOVERY) (Fixed) (Total:15 GB) (Free:8.53 GB) NTFSDrive k: (Seagate Expansion Drive) (Fixed) (Total:1863.01 GB) (Free:1792.02 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596.2 GB) (Disk ID: B8000000)Partition 1: (Not Active) - (Size=71 MB) - (Type=DE)Partition 2: (Not Active) - (Size=15 GB) - (Type=07 NTFS)Partition 3: (Active) - (Size=581.1 GB) - (Type=07 NTFS)Attempted reading MBR returned 0 bytes. Could not read MBR for disk 5.==================== End Of Log ============================TDSSKiller.3.0.0.40_19.10.2014_15.01.35_log.txt Link to post Share on other sites More sharing options...
Naathim Posted October 20, 2014 ID:892720 Share Posted October 20, 2014 My name's Naathim and I'm a GeekU Minion! Now that we are mates and will be working together to clean your machine out of any junkware, feel free to call me Naat Before we start please note the following:Analysis and research take some time, also sometimes real life gets in the way, please be patient.Limit your internet access to posting here, some infections just wait to steal typed-in passwords.Don't run any scripts or tools on your own, unsupervised usage may cause more harm than good.Paste the logs in your posts, attachments make my work harder and more complicated.Stay with me to the end, the absence of symtoms doesn't mean that your machine is fully operational.Note that we may live in totally different time zones, what may cause some delays between answers.I can't foresee everything, so if anything unexpected happens, please stop and inform me!There are no silly questions. Never be afraid to ask if in doubt!Let's start and enjoy the fight! Rules and policiesWe won't support any piracy. That being told, if any evidence of illegal OS, software, cracks/keygens or any other will be revealed, any further assistance will be suspended. If you are aware that there is this kind of stuff on your machine, remove it before proceeding!The same applies to any use of P2P software: uTorrent, BitTorrent, Vuze, Kazaa, Ares... We don't provide any help for P2P, except for their removal. All P2P software has to be uninstalled or at least fully disabled before proceeding!Failure to follow these guidelines will result with closing your topic and withdrawning any assistance. Backdoor warning!Unfortunately your machine seems to be heavy compromised by a Backdoor Trojan. This type of infection allows hackers to remotely control your computer, steal critical system information and download and execute files. My advice for this moment:Disconnect this machine from the internet.Change your online passwords from a well-known clean computer (not this one!).It would be also wise to inform financial institutions about your situation - see here.Many experts believe that the best action should be reformat and reinstall, but I think that we can still be able to clean this one and return it to its normal funcionality (with no security guarantee afterwards, as this is a very severe type of infection).If you plan to rather reinstall your system, let me know if I could provide any help during that procedure.If you wish to omit the reinstallation, just please proceed with the next steps directed.I believe that we can kill this nasty bad guy SpyBot S&D WarningMVPS.org is no longer recommending SpyBot S&D due to very poor testing results (scroll down and read under Freeware Antispyware Products).My advice is to get rid of this program. To do so:Press the + R on your keyboard at the same time. Type appwiz.cpl and click OK.Search for SpyBot, right-click the entry and click Uninstall.This is optional, but please consider it. At least until we are clean, cause SpyBot is able to hinder the removal process. Scan with ComboFixThis is a very powerful tool that should be used only if advised by Malware Analyst.Do not run ComboFix on your own!Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.If you are a user of CD emulation software (like Daemon Tools or Alcohol) also disable it for the cleaning process - instructions here.Right-click on icon and select Run as Administrator to start the tool.Accept the disclaimer and agree if prompted to install Recovery Console.Do not take any actions while ComboFix goes through your System - it may cause it to stall!This scan may take some time!When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).Include that log in your next reply. If you'll encounter any issues with internet connection after running ComboFix, please visit this link. If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine. Don't forget to re-enable your previously switched-off protection software! Link to post Share on other sites More sharing options...
TerryH Posted October 20, 2014 Author ID:892822 Share Posted October 20, 2014 Spybot uninstalled. No sign since running Combofix of dllhost.com being stopped from outgoing. Hmmmm, checking with Task Manager shows no dllhost.com file now exists in processes. Combofix.txt results ComboFix 14-10-20.01 - Terry 10/20/2014 0:32.1.8 - x64Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.12278.9296 [GMT -7:00]Running from: c:\users\Terry\Desktop\ComboFix.exeAV: AVG AntiVirus 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}SP: AVG AntiVirus 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\users\Terry\GoToAssistDownloadHelper.exec:\windows\SysWow64\regobj.dllc:\windows\SysWow64\systemc:\windows\wininit.iniK:\Autorun.infK:\Setup.exe..CLSID={AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} - infected with Poweliks and removed.You should verify if current CLSID data is correct:.HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} (Default) REG_SZ Thumbnail Cache Class Factory for Out of Proc Server AppID REG_SZ {AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}.HKEY_CLASSES_ROOT\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\InprocServer32 (Default) REG_SZ c:\windows\system32\thumbcache.dll ThreadingModel REG_SZ Apartment..((((((((((((((((((((((((( Files Created from 2014-09-20 to 2014-10-20 )))))))))))))))))))))))))))))))..2014-10-20 08:21 . 2014-10-20 08:21 -------- d-----w- c:\users\Mcx1\AppData\Local\temp2014-10-20 08:21 . 2014-10-20 08:21 -------- d-----w- c:\users\Default\AppData\Local\temp2014-10-19 21:49 . 2014-10-19 23:18 -------- d-----w- C:\FRST2014-10-19 20:38 . 2014-10-19 20:59 -------- d-----w- C:\AdwCleaner2014-10-19 18:12 . 2014-10-19 18:25 -------- d-----w- C:\NPE2014-10-19 18:09 . 2014-10-19 18:50 -------- d-----w- c:\users\Terry\AppData\Local\NPE2014-10-19 18:09 . 2014-10-19 18:09 -------- d-----w- c:\programdata\Norton2014-10-19 09:03 . 2014-10-20 07:04 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 22014-10-16 10:18 . 2014-09-17 06:57 76800 ----a-w- c:\windows\system32\packager.dll2014-10-16 10:18 . 2014-09-16 16:56 66560 ----a-w- c:\windows\SysWow64\packager.dll2014-10-16 10:18 . 2014-09-27 23:41 2782208 ----a-w- c:\windows\system32\win32k.sys2014-10-16 10:14 . 2014-06-15 22:18 1131664 ----a-w- c:\windows\SysWow64\dfshim.dll2014-10-16 10:14 . 2014-06-15 22:18 1943696 ----a-w- c:\windows\system32\dfshim.dll2014-10-16 10:14 . 2014-06-13 18:22 81560 ----a-w- c:\windows\SysWow64\mscories.dll2014-10-16 10:14 . 2014-06-13 18:22 156824 ----a-w- c:\windows\SysWow64\mscorier.dll2014-10-16 10:14 . 2014-06-13 17:36 73880 ----a-w- c:\windows\system32\mscories.dll2014-10-16 10:14 . 2014-06-13 17:36 156312 ----a-w- c:\windows\system32\mscorier.dll2014-10-16 10:13 . 2014-09-04 23:38 198656 ----a-w- c:\windows\system32\drivers\fastfat.sys2014-09-24 07:18 . 2014-09-09 06:40 2048 ----a-w- c:\windows\system32\tzres.dll2014-09-24 07:18 . 2014-09-09 06:24 2048 ----a-w- c:\windows\SysWow64\tzres.dll...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2014-10-16 10:00 . 2006-11-02 12:35 103265616 ----a-w- c:\windows\system32\mrt.exe2014-09-24 17:15 . 2012-04-05 16:05 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2014-09-24 17:15 . 2011-05-20 05:10 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2014-08-23 01:05 . 2014-08-28 10:00 304128 ----a-w- c:\windows\SysWow64\gdi32.dll2014-08-23 00:42 . 2014-08-28 10:00 390144 ----a-w- c:\windows\system32\gdi32.dll2014-08-10 17:37 . 2014-08-10 17:38 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll2014-08-06 17:50 . 2014-08-06 17:50 123672 ----a-w- c:\windows\system32\drivers\avgmfx64.sys2014-07-25 09:35 . 2014-07-25 09:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll2014-07-25 06:47 . 2014-07-25 06:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ISUSPM"="c:\program files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-21 213936]"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]"Amazon Music"="c:\users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe" [2014-09-06 6281536].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"OpwareSE2"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]"UVS11 Preload"="c:\program files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-07-23 341232]"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-06-11 3695416]"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-03-02 190808]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-13 43848]"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2011-10-30 571392]"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-29 642656]"AVG_UI"="c:\program files (x86)\AVG\AVG2014\avgui.exe" [2014-08-25 5188112]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2014-07-06 2117632].c:\users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-12 36414624].c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-2-6 1312096].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"LoadAppInit_DLLs"=1 (0x1)"AppInit_DLLs"=c:\progra~2\Amazon\AMAZON~2\AmazonExtIE.dll.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]@="Service".S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]..HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcsThemes.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{981b174d-7733-4e7f-b89d-6545a7c21838}]2014-05-23 21:45 189952 ----a-w- c:\program files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonTaskbarApp.exe.Contents of the 'Scheduled Tasks' folder.2014-10-20 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 17:15].2014-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16 16:19].2014-10-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16 16:19]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-02-24 6975520].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLs"=c:\progra~2\Amazon\AMAZON~2\AmazonExtIE64.dll.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmuStart Page = hxxp://my.yahoo.com/?m=1mLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.localuInternet Settings,ProxyServer = localhost:8080IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: Locate Spot on Map by GPS - c:\program files (x86)\Opanda\IExif 2.3\IExifMap.htmIE: View Exif/GPS/IPTC with IExif - c:\program files (x86)\Opanda\IExif 2.3\IExifCom.htmTrusted Zone: assethealth.com\wwwTrusted Zone: com\www.msiTrusted Zone: com.tw\asia.msiTrusted Zone: com.tw\global.msiTrusted Zone: ikmnet.comTrusted Zone: usps.comTCP: DhcpNameServer = 192.168.1.1FF - ProfilePath - c:\users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.default\FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/FF - ExtSQL: !HIDDEN! 2009-06-25 03:10; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension.- - - - ORPHANS REMOVED - - - -.BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)SafeBoot-WudfPfSafeBoot-WudfRdAddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exeAddRemove-AfterShot Pro - f:\corel\Corel AfterShot Pro\uninstall.exeAddRemove-Astronomy 2005 Screensaver - c:\program files (x86)\Edible EntertainmentAddRemove-Picasa 3 - f:\google\Picasa3\Uninstall.exeAddRemove-{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 - f:\spybot - search & destroy\unins000.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]@Denied: (A 2) (Everyone)@="IFlashBroker6".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.15".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]@Denied: (A 2) (Everyone)@="IFlashBroker6".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]@Denied: (A 2) (Everyone).[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]@="Shockwave Flash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]@Denied: (A 2) (Everyone)@="".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]@="FlashBroker".[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\.Completion time: 2014-10-20 01:23:49ComboFix-quarantined-files.txt 2014-10-20 08:23.Pre-Run: 402,215,440,384 bytes freePost-Run: 406,994,173,952 bytes free.- - End Of File - - 469EA62CB10F231DB22D9B32E94D8B2C5C616939100B85E558DA92B899A0FC36 Link to post Share on other sites More sharing options...
Naathim Posted October 20, 2014 ID:892871 Share Posted October 20, 2014 Hi Good, now let's confirm that the main bad guy is killed. Scan with Farbar Recovery Scan ToolPlease re-run Farbar Recovery Scan Tool.Right-click on icon and select Run as Administrator to start the tool.> XP users click run after receipt of Windows Security Warning - Open File.> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please include their content in your next reply. Link to post Share on other sites More sharing options...
TerryH Posted October 20, 2014 Author ID:893014 Share Posted October 20, 2014 Thanks Naat! Appreciate your time. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-10-2014Ran by Terry (administrator) on TERRY-PC on 20-10-2014 09:42:11Running from C:\Users\Terry\DesktopLoaded Profile: Terry (Available profiles: Terry & Mcx1)Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States)Internet Explorer Version 9Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(AMD) C:\Windows\System32\atiesrxx.exe(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe(Microsoft Corporation) C:\Windows\System32\SLsvc.exe(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe(AMD) C:\Windows\System32\atieclxx.exe() C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe(Microsoft Corporation) C:\Windows\ehome\ehtray.exe(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe(Dropbox, Inc.) C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exe(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(InterVideo Inc.) C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamservice.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamgui.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe(Microsoft Corporation) C:\Windows\System32\mobsync.exe(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [6975520 2009-02-24] (Realtek Semiconductor)HKLM-x32\...\Run: [OpwareSE2] => C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)HKLM-x32\...\Run: [uVS11 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [341232 2007-07-23] (InterVideo Digital Technology Corporation)HKLM-x32\...\Run: [brStsWnd] => C:\Program Files (x86)\Brownie\BrstsW64.exe [3695416 2009-06-11] (brother)HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [190808 2011-03-01] (Logitech Inc.)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)HKLM-x32\...\Run: [AmazonGSDownloaderTray] => C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe [326144 2009-10-23] (Amazon.com)HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-08-25] (AVG Technologies CZ, s.r.o.)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [iSUSPM] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [213936 2006-03-20] (Macrovision Corporation)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [Amazon Music] => C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [6281536 2014-09-05] ()HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exeAppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~2\AmazonExtIE64.dll => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE64.dll [119616 2014-05-23] (Amazon Inc.)AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~2\AmazonExtIE.dll => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE.dll [106304 2014-05-23] (Amazon Inc.)Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Mcx1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnkShortcutTarget: Dropbox.lnk -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)BootExecute: autocheck autochk * sdnclean64.exe==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)ProxyServer: localhost:8080HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearchHKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/?m=1StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeSearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =BHO: Advertising Cookie Opt-out -> {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} -> C:\Program Files\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc)BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Advertising Cookie Opt-out -> {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} -> C:\Program Files (x86)\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc)BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO-x32: No Name -> {A3BC75A2-1F87-4686-AA43-5347D756017C} -> No FileBHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileDPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabHandler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No FileHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)Tcpip\Parameters: [DhcpNameServer] 192.168.1.1FireFox:========FF ProfilePath: C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.defaultFF Homepage: hxxp://my.yahoo.com/FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No FileFF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No FileFF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> F:\Google\Picasa3\npPicasa3.dll No FileFF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF Plugin-x32: @movenetworks.com/Quantum Media Player -> C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll (Move Networks)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKCU: @movenetworks.com/Quantum Media Player -> C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll (Move Networks)FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\Terry\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10171.dll (Amazon.com, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Invenda Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll (Coupons, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll (Coupons, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Users\Terry\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)FF Extension: Microsoft .NET Framework Assistant - C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-07-08]FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-09-25]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-09-25]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-09-25]FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-09-25]FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtensionFF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-02]FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-05-15]FF HKCU\...\Firefox\Extensions: [moveplayer@movenetworks.com] - C:\Users\Terry\AppData\Roaming\Move NetworksFF Extension: Move Media Player - C:\Users\Terry\AppData\Roaming\Move Networks [2010-03-08]Chrome:=======CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06]==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 Amazon Download Agent; C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [401920 2009-10-23] (Amazon.com) [File not signed]R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3242000 2014-08-25] (AVG Technologies CZ, s.r.o.)R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-08-25] (AVG Technologies CZ, s.r.o.)R2 Capture Device Service; C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe [198168 2007-03-06] (InterVideo Inc.)R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-12-18] (Stardock Corporation) [File not signed]S2 gupdate1c9ee9e3e003430; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [133104 2009-06-16] (Google Inc.)S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]S3 License Management Service ESD; C:\Program Files (x86)\Common Files\element5 Shared\Service\Licence Manager ESD.exe [69120 2010-01-08] (element5) [File not signed]R2 MBAMScheduler; C:\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation) [File not signed]R2 MBAMService; C:\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation) [File not signed]S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]S2 SBSDWSCService; F:\Spybot - Search & Destroy\SDWinSec.exe [X]==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.)R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-06-17] (AVG Technologies CZ, s.r.o.)S1 Beep; No ImagePathS3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) [File not signed]S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS64_100507.sys [28984 2010-05-10] (Your Corporation)S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios64_100507.sys [33592 2010-05-10] (Your Corporation)S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS64_100507.sys [14960 2010-05-10] () [File not signed]R3 msvad_simple; C:\Windows\System32\drivers\povrtdev.sys [28528 2010-02-24] (MediaMall Technologies, Inc.)S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2009-07-23] () [File not signed]S3 UDXTTM6000; C:\Windows\System32\Drivers\UDXTTM6000.sys [366336 2008-03-02] ()S3 UDXTTM6000HID; C:\Windows\System32\drivers\UDXTTM6000HID.sys [17920 2006-06-28] (DTV-DVB)S3 catchme; \??\C:\ComboFix\catchme.sys [X]S3 IpInIp; system32\DRIVERS\ipinip.sys [X]S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2014-10-20 09:42 - 2014-10-20 09:42 - 00020997 _____ () C:\Users\Terry\Desktop\FRST.txt2014-10-20 09:42 - 2014-10-20 09:42 - 00000000 ____D () C:\Users\Terry\Desktop\FRST-OlderVersion2014-10-20 01:23 - 2014-10-20 01:23 - 00022885 _____ () C:\ComboFix.txt2014-10-20 00:28 - 2011-06-25 23:45 - 00256000 _____ () C:\Windows\PEV.exe2014-10-20 00:28 - 2010-11-07 10:20 - 00208896 _____ () C:\Windows\MBR.exe2014-10-20 00:28 - 2009-04-19 21:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00098816 _____ () C:\Windows\sed.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00080412 _____ () C:\Windows\grep.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00068096 _____ () C:\Windows\zip.exe2014-10-20 00:27 - 2014-10-20 01:23 - 00000000 ____D () C:\Qoobox2014-10-20 00:27 - 2014-10-20 01:22 - 00000000 ____D () C:\Windows\erdnt2014-10-20 00:24 - 2014-10-20 00:24 - 05583433 ____R (Swearware) C:\Users\Terry\Desktop\ComboFix.exe2014-10-20 00:04 - 2014-10-20 09:21 - 00003648 _____ () C:\Windows\PFRO.log2014-10-19 14:49 - 2014-10-20 09:42 - 00000000 ____D () C:\FRST2014-10-19 14:45 - 2014-10-19 14:46 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Terry\Desktop\tdsskiller.exe2014-10-19 14:44 - 2014-10-20 09:42 - 02111488 _____ (Farbar) C:\Users\Terry\Desktop\FRST64.exe2014-10-19 13:38 - 2014-10-19 13:59 - 00000000 ____D () C:\AdwCleaner2014-10-19 13:37 - 2014-10-19 13:37 - 01976320 _____ () C:\Users\Terry\Downloads\adwcleaner_4.000.exe2014-10-19 11:12 - 2014-10-19 11:25 - 00000000 ____D () C:\NPE2014-10-19 11:09 - 2014-10-19 11:50 - 00000000 ____D () C:\Users\Terry\AppData\Local\NPE2014-10-19 11:09 - 2014-10-19 11:09 - 00000000 ____D () C:\ProgramData\Norton2014-10-19 11:06 - 2014-10-19 11:06 - 03060320 ____N (Symantec Corporation) C:\Users\Terry\Downloads\NPE.exe2014-10-19 10:33 - 2014-10-19 10:33 - 00000732 _____ () C:\Users\Terry\AppData\Local\d3d9caps64.dat2014-10-19 02:19 - 2014-10-19 02:19 - 00000000 ____D () C:\Users\Terry\Documents\ProcAlyzer Dumps2014-10-19 02:03 - 2014-10-20 00:04 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 22014-10-19 01:50 - 2014-10-19 01:50 - 00000258 __RSH () C:\ProgramData\ntuser.pol2014-10-16 03:18 - 2014-09-27 16:41 - 02782208 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-10-16 03:18 - 2014-09-16 23:57 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll2014-10-16 03:18 - 2014-09-16 09:56 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll2014-10-16 03:14 - 2014-06-15 15:18 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll2014-10-16 03:14 - 2014-06-15 15:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll2014-10-16 03:14 - 2014-06-13 11:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll2014-10-16 03:14 - 2014-06-13 11:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll2014-10-16 03:14 - 2014-06-13 10:36 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll2014-10-16 03:14 - 2014-06-13 10:36 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll2014-10-16 03:13 - 2014-09-04 16:38 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys2014-10-15 22:55 - 2014-09-19 17:09 - 17867776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-10-15 22:55 - 2014-09-19 16:55 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-10-15 22:55 - 2014-09-19 16:54 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-10-15 22:55 - 2014-09-19 16:50 - 01385472 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-10-15 22:55 - 2014-09-19 16:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-10-15 22:55 - 2014-09-19 16:48 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-10-15 22:55 - 2014-09-19 16:48 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll2014-10-15 22:55 - 2014-09-19 16:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-10-15 22:55 - 2014-09-19 16:47 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-10-15 22:55 - 2014-09-19 16:46 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-10-15 22:55 - 2014-09-19 16:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe2014-10-15 22:55 - 2014-09-19 16:45 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-10-15 22:55 - 2014-09-19 16:45 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe2014-10-15 22:55 - 2014-09-19 15:53 - 12364288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-10-15 22:55 - 2014-09-19 15:44 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-10-15 22:55 - 2014-09-19 15:41 - 09739776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-10-15 22:55 - 2014-09-19 15:39 - 01138688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-10-15 22:55 - 2014-09-19 15:38 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-10-15 22:55 - 2014-09-19 15:37 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-10-15 22:55 - 2014-09-19 15:36 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2014-10-15 22:55 - 2014-09-19 15:36 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-10-15 22:55 - 2014-09-19 15:36 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-10-15 22:55 - 2014-09-19 15:35 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2014-10-15 22:55 - 2014-09-19 15:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-10-15 22:55 - 2014-09-19 15:34 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe2014-10-15 22:55 - 2014-09-19 15:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe2014-10-15 22:55 - 2014-09-19 15:33 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-09-25 09:28 - 2014-09-25 09:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-09-24 00:18 - 2014-09-08 23:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2014-09-24 00:18 - 2014-09-08 23:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2014-10-20 09:39 - 2009-05-21 13:51 - 01648195 _____ () C:\Windows\WindowsUpdate.log2014-10-20 09:27 - 2011-10-29 12:03 - 00000000 ____D () C:\ProgramData\MFAData2014-10-20 09:24 - 2014-09-01 22:02 - 00000000 ___RD () C:\Users\Terry\Dropbox2014-10-20 09:24 - 2014-09-01 22:00 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Dropbox2014-10-20 09:21 - 2009-12-16 17:30 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs2014-10-20 09:21 - 2009-06-30 01:21 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-10-20 09:21 - 2006-11-02 08:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-10-20 09:21 - 2006-11-02 08:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A02014-10-20 09:21 - 2006-11-02 08:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A02014-10-20 01:48 - 2006-11-02 08:42 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-10-20 01:45 - 2009-06-30 01:21 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-10-20 01:23 - 2006-11-02 06:33 - 00000000 __RHD () C:\Users\Default2014-10-20 01:21 - 2006-11-02 05:34 - 00000215 _____ () C:\Windows\system.ini2014-10-20 01:20 - 2009-06-02 17:22 - 00000000 ____D () C:\Users\Terry2014-10-20 01:15 - 2012-04-05 09:05 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-10-20 00:01 - 2009-12-11 10:25 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy2014-10-19 19:42 - 2009-07-16 21:17 - 00000000 ____D () C:\Windows\Minidump2014-10-19 19:11 - 2009-06-23 11:17 - 00000000 ____D () C:\Users\Terry\Documents\My PSP Files2014-10-19 14:16 - 2014-09-01 23:43 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\KeePass2014-10-19 14:02 - 2006-11-02 08:21 - 00404736 _____ () C:\Windows\system32\FNTCACHE.DAT2014-10-17 23:28 - 2006-11-02 05:46 - 00759582 _____ () C:\Windows\system32\PerfStringBackup.INI2014-10-16 03:13 - 2013-08-15 03:03 - 00000000 ____D () C:\Windows\system32\MRT2014-10-16 03:00 - 2006-11-02 05:35 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe2014-10-14 11:41 - 2011-01-08 00:00 - 00000858 _____ () C:\Users\Public\Desktop\CCleaner.lnk2014-10-14 11:41 - 2010-04-08 17:28 - 00000000 ____D () C:\Program Files (x86)\CCleaner2014-10-11 00:54 - 2009-06-22 23:21 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Skype2014-10-10 09:45 - 2014-04-15 09:56 - 00002413 _____ () C:\Users\Public\Desktop\Skype.lnk2014-10-04 09:58 - 2014-06-12 00:00 - 00001582 _____ () C:\Windows\System32\Tasks\Amazon Music Helper2014-10-04 09:58 - 2014-06-12 00:00 - 00000927 _____ () C:\Users\Terry\Desktop\Amazon Music.lnk2014-10-01 09:19 - 2010-02-09 16:48 - 00000426 _____ () C:\Windows\BRWMARK.INI2014-09-26 09:50 - 2006-11-02 06:33 - 00000000 ____D () C:\Windows\rescache2014-09-26 09:31 - 2012-05-11 08:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2014-09-24 10:15 - 2012-04-05 09:05 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-09-24 10:15 - 2012-04-05 09:05 - 00003682 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2014-09-24 10:15 - 2011-05-19 22:10 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-09-24 00:21 - 2009-06-23 11:23 - 00002275 _____ () C:\Users\Public\Desktop\Jasc Paint Shop Pro 9.lnk2014-09-21 16:13 - 2014-09-01 22:02 - 00000921 _____ () C:\Users\Terry\Desktop\Dropbox.lnk2014-09-21 16:13 - 2014-09-01 22:01 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DropboxSome content of TEMP:====================C:\Users\Terry\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyxkqvj.dll==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-10-20 09:35==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-10-2014Ran by Terry at 2014-10-20 09:43:08Running from C:\Users\Terry\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)001 Joiner and Splitter Pro (HKLM-x32\...\001 Joiner and Splitter Pro2.0) (Version: 2.0 - Welltek Software)7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version: - )Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)Adobe AIR (x32 Version: 3.0.0.4080 - Adobe Systems Incorporated) HiddenAdobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5 - Adobe Systems, Inc.)Amazon 1Button App (HKLM-x32\...\{4D875057-4353-4B8F-93E5-8C3DC7F34EA9}) (Version: 1.0.8 - Amazon)Amazon Games & Software Downloader (HKLM-x32\...\Amazon Games & Software Downloader_is1) (Version: 2.0.2.0 - Amazon)Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version: - Amazon)Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.4.0.628 - Amazon Services LLC)AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) HiddenAMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)ArcSoft PhotoBase 4.5 (HKLM-x32\...\{C0BBE46D-5318-485A-8564-D8FA5576ECD4}) (Version: - ArcSoft)ArcSoft PhotoBase 4.5 (Shared Components) (HKLM-x32\...\Uninstaller_B27C5000_ArcSoft PhotoBase 4.5) (Version: 2.60.30 - element5)ArcSoft PhotoStudio 5.5 (HKLM-x32\...\{D2261C4B-4D9B-4149-8472-31B7A2FEAB91}) (Version: - ArcSoft)Astronomy 2005 Screensaver (HKLM-x32\...\Astronomy 2005 Screensaver) (Version: - )ATI AVIVO64 Codecs (Version: 10.10.0.40914 - ATI Technologies Inc.) HiddenAVG 2014 (HKLM\...\AVG) (Version: 2014.0.4765 - AVG Technologies)AVG 2014 (Version: 14.0.4040 - AVG Technologies) HiddenAVG 2014 (Version: 14.0.4765 - AVG Technologies) HiddenBonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Brother HL-2170W (HKLM-x32\...\{689BA753-2D23-470F-8014-B1EC8D61EE95}) (Version: 1.00 - Brother)CameraHelperMsi (x32 Version: 13.25.1010.0 - Logitech) HiddenCanon ScanGear Starter (HKLM-x32\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version: - )CanoScan Toolbox Ver4.9 (HKLM-x32\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )CarbonPoker (HKCU\...\CarbonPoker) (Version: 5.0 - )Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center Graphics Previews Common (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center InstallProxy (x32 Version: 2008.0828.2144.37162 - ATI Technologies, Inc.) HiddenCatalyst Control Center InstallProxy (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center Localization All (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Chinese Standard (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Chinese Traditional (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Czech (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Danish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Dutch (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help English (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Finnish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help French (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help German (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Greek (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Hungarian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Italian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Japanese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Korean (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Norwegian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Polish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Portuguese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Russian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Spanish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Swedish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Thai (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Turkish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hiddenccc-utility64 (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) HiddenCompatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Corel AfterShot Pro (HKLM-x32\...\AfterShot Pro) (Version: 1.2.0.7 - Corel Corporation)Darksiders (HKLM-x32\...\Steam App 50620) (Version: - Vigil Games)DarksidersInstaller (HKLM-x32\...\{B93EEE50-9C8F-45DF-95E4-3D85A6E242F3}) (Version: 1.00.1000 - THQ)Dell Dock (HKLM\...\{F6CB42B9-F033-4152-8813-FF11DA8E6A78}) (Version: 1.0.0 - Dell)Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)DigitalTV (HKLM-x32\...\{C19DBE5E-712E-4F02-8380-ECEDD951B374}) (Version: 2.64 - )DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.41 - DivX, LLC)Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) HiddenGoogle Advertising Cookie Opt-out (HKLM\...\{A2E00B38-848D-4898-9109-BFA37C074DDC}) (Version: 1.0.1.0 - Google Inc)Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) HiddenH&R Block California 2010 (HKLM-x32\...\{9FBDF580-E37F-4DEE-8F2E-75A8E8716AAD}) (Version: 1.10.4801 - HRB Technology, LLC.)H&R Block California 2011 (HKLM-x32\...\{10894714-E82E-4371-9CF7-F58E352C76EA}) (Version: 1.11.5001 - HRB Technology, LLC.)H&R Block California 2012 (HKLM-x32\...\{E040F1EC-82A9-4950-AAFE-55762AB59590}) (Version: 1.12.7501 - HRB Technology, LLC.)H&R Block California 2013 (HKLM-x32\...\{FA9B4B45-B7F0-47A4-894B-19BBF8829FE2}) (Version: 1.13.6701 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2010 (HKLM-x32\...\{10964A8F-21C1-45EA-BC2D-F84B505C3848}) (Version: 10.04.6402 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2011 (HKLM-x32\...\{C6006AED-E5A7-4F77-BAD5-95AC43DE04F3}) (Version: 11.05.6901 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2012 (HKLM-x32\...\{89D20029-0578-4D8D-979A-695C8D868868}) (Version: 12.05.7801 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2013 (HKLM-x32\...\{EDE796DE-0A72-464D-9D21-F04BC41A092B}) (Version: 13.05.6502 - HRB Technology, LLC.)Hoyle Card Games 2003 (HKLM-x32\...\InstallShield_{9ABA26E1-843A-4A72-95AF-C72474E191F6}) (Version: 1.0.0.0 - Sierra)Hoyle Card Games 2003 (x32 Version: 1.0.0.0 - Sierra) HiddeniCloud (HKLM\...\{CE97E4D3-9F91-4D72-8A29-ED9EA90E5A15}) (Version: 2.1.3.25 - Apple Inc.)Intel® Network Connections 13.1.33.0 (HKLM\...\PROSetDX) (Version: 13.1.33.0 - Intel)Intel® Network Connections 13.1.33.0 (Version: 13.1.33.0 - Intel) HiddenInterVideo DeviceService (HKLM-x32\...\{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}) (Version: 1.0.0 - InterVideo)InterVideo WinDVD 8 (HKLM-x32\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0-B6.109 - InterVideo Inc.)InterVideo WinDVD 8 (x32 Version: 8.0-B6.109 - InterVideo Inc.) HiddenJasc Animation Shop 3 (HKLM-x32\...\{7C4196CA-CA41-4F34-9C08-7724E7705D52}) (Version: 3.11 - Jasc Software Inc)Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.01.0000 - Jasc Software Inc)Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) HiddenKeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7248) - Logitech Inc..)Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)Logitech Webcam Software Driver Package (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)LWS Facebook (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Gallery (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Help_main (x32 Version: 13.25.1016.0 - Logitech) HiddenLWS Launcher (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Motion Detection (x32 Version: 13.20.1176.0 - Logitech) HiddenLWS Pictures And Video (x32 Version: 13.25.1010.0 - Logitech) HiddenLWS Twitter (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Video Mask Maker (x32 Version: 13.10.1216.0 - Logitech) HiddenLWS VideoEffects (Version: 13.25.1005.0 - Logitech) HiddenLWS Webcam Software (x32 Version: 13.20.1168.0 - Logitech) HiddenLWS WLM Plugin (x32 Version: 1.20.1166.0 - Logitech) HiddenLWS YouTube Plugin (x32 Version: 13.20.1166.0 - Logitech) HiddenMalwarebytes Anti-Malware version 1.70.0.1100 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.70.0.1100 - Malwarebytes Corporation)Manual CanoScan LiDE 500F (HKLM-x32\...\{B9C54C44-BB5A-4B03-8907-C01A9790195A}) (Version: - )Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Office 2000 Disc 2 (HKLM-x32\...\{00040409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)Microsoft Office 2000 Small Business (HKLM-x32\...\{00030409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)Move Media Player (HKCU\...\Move Media Player) (Version: - Move Networks)Mozilla Firefox 32.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 en-US)) (Version: 32.0.3 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.0 - Nikon)Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.8.0 - Nikon)Octoshape add-in for Adobe Flash Player (HKCU\...\Octoshape add-in for Adobe Flash Player) (Version: - )Octoshape Streaming Services (HKCU\...\Octoshape Streaming Services) (Version: - )OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)Opanda IExif 2.3 (HKLM-x32\...\Opanda IExif_is1) (Version: 2.3 - Opanda Studio)Opanda PowerExif 1.2 Professional Trial (HKLM-x32\...\Opanda PowerExif Professional Trial_is1) (Version: 1.2 - Opanda Studio)PC Connectivity Solution (HKLM-x32\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)Picture Control Utility (HKLM-x32\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.2 - Nikon)Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.15 - Nikon)QuickBooks Pro (HKLM-x32\...\QuickBooks Pro) (Version: - )QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5783 - Realtek Semiconductor Corp.)Roxio Creator Audio (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Copy (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Data (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator DE (HKLM-x32\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.1 - Roxio)Roxio Creator DE (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Tools (x32 Version: 3.7.0 - Roxio) HiddenRoxio Express Labeler 3 (x32 Version: 3.2.1 - Roxio) HiddenRoxio Update Manager (x32 Version: 6.0.0 - Roxio) HiddenSD Viewer for DSC (HKLM-x32\...\{5A8D3524-79DB-11D5-99D1-00010256D40E}) (Version: - )Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.13.13771 - Skype Technologies S.A.)Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)SmartSound Quicktracks Plugin (HKLM-x32\...\InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}) (Version: 3.0.5.0 - SmartSound Software Inc)SmartSound Quicktracks Plugin (x32 Version: 3.0.5.0 - SmartSound Software Inc) HiddenSpotify (HKLM-x32\...\Spotify) (Version: 0.5.2 - )Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)Stellarium 0.11.4 (HKLM\...\Stellarium_is1) (Version: 0.11.4 - Stellarium team)System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version: - )ubi.com (HKLM-x32\...\{AEDDF5A3-29CE-11D5-A8C2-000102246AAE}) (Version: - )Ulead VideoStudio 11 (HKLM-x32\...\InstallShield_{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}) (Version: 11.0.0.0000 - InterVideo Digital Technology Corporation)VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) HiddenVideoStudio (x32 Version: 11.0.0.0000 - InterVideo Digital Technology Corporation) HiddenViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.8.2 - Nikon)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}) (Version: 8.0.0.35 - GRISOFT, s.r.o.)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - )Windows 7 Upgrade Advisor (HKLM-x32\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\BC15EA930074932BB2C4B4493C9FD4EA95087D1A) (Version: 10/12/2007 6.85.4.0 - Nokia)Windows Live Sign-in Assistant (HKLM-x32\...\{9422C8EA-B0C6-4197-B8FC-DC797658CA00}) (Version: 5.000.818.6 - Microsoft Corporation)Windows Live Sync (HKLM-x32\...\{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}) (Version: 14.0.8050.1202 - Microsoft Corporation)Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )Windows Media Encoder 9 Series (x32 Version: 9.00.3374 - Microsoft Corporation) Hidden==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{8E590317-1329-11D1-B70B-00805F29CD16}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks Pro\qbw32.exe (Intuit, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\FileSyncApi64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)==================== Restore Points =========================24-09-2014 07:00:01 Scheduled Checkpoint24-09-2014 07:17:46 Windows Update25-09-2014 08:22:50 Scheduled Checkpoint26-09-2014 07:12:28 Scheduled Checkpoint27-09-2014 07:12:26 Scheduled Checkpoint28-09-2014 07:40:17 Scheduled Checkpoint29-09-2014 07:23:32 Scheduled Checkpoint30-09-2014 07:30:45 Scheduled Checkpoint01-10-2014 07:46:28 Scheduled Checkpoint02-10-2014 07:42:00 Scheduled Checkpoint03-10-2014 06:52:06 Scheduled Checkpoint04-10-2014 07:31:36 Scheduled Checkpoint05-10-2014 07:00:00 Scheduled Checkpoint06-10-2014 07:17:43 Scheduled Checkpoint09-10-2014 19:11:35 Scheduled Checkpoint10-10-2014 07:54:05 Scheduled Checkpoint11-10-2014 08:20:32 Scheduled Checkpoint12-10-2014 07:32:45 Scheduled Checkpoint13-10-2014 03:49:42 Scheduled Checkpoint14-10-2014 07:00:01 Scheduled Checkpoint15-10-2014 07:54:27 Scheduled Checkpoint16-10-2014 07:00:02 Scheduled Checkpoint16-10-2014 10:00:16 Windows Update17-10-2014 07:55:10 Scheduled Checkpoint17-10-2014 21:13:30 Scheduled Checkpoint19-10-2014 18:39:30 Norton_Power_Eraser_20141019113930010==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2006-11-02 05:34 - 2014-10-20 01:21 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts127.0.0.1 localhost==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {059095CE-546D-42FA-BFB7-E33EEA86785D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMMTask: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPagesTask: {1FA0A7B4-ED60-4DD0-A86B-5B580DC734EE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16] (Google Inc.)Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)Task: {25F37DCF-758A-4D40-8AD5-541C7606A708} - System32\Tasks\{3B5C56C1-C525-4A88-BC88-61EE6267BF86} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {33E3A743-D36C-4DF9-ADF2-C23F213D301D} - System32\Tasks\{AE5D3469-07BF-4E7B-928B-3BF5CB113809} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {4221026F-393B-4E5D-A8EC-D65747B252B5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)Task: {4A15123C-E76F-4D82-B937-7D5243C98D4F} - System32\Tasks\{FE0E2BBA-4C80-4767-89A4-E9ACD7EC1BD1} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {6663F415-D2F8-44BB-895F-3767650B3BA3} - System32\Tasks\{3D2BD65F-DB2E-44BF-B7D4-B095FB17512A} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {73BE57F4-69BB-4A26-8063-8C62FDCE9650} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16] (Google Inc.)Task: {74E73ABB-3C2E-4E70-81BE-A96408803B53} - System32\Tasks\{601D9548-9905-4246-9B31-F26759BF3791} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {7A74FA86-3C66-4D14-9015-F48ED6785C2E} - System32\Tasks\{6842AD54-94B6-4A61-9BE5-784DA11F3505} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UITask: {7D7FBBF4-4AD3-4CAC-AE0E-2A537530C66F} - System32\Tasks\{D196BA7A-04DD-48D5-9D85-E077ABA37980} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {8A678B8E-11EB-4BD0-B154-4AC383C77F85} - System32\Tasks\{4E509FBC-8D20-48B3-BC84-70CD1F5B8430} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {8DF75516-4B1E-4AAE-9DD9-82CA55732D7F} - System32\Tasks\Amazon Music Helper => C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [2014-09-05] ()Task: {91FF7E33-391D-4CD3-93EF-C90A2141CF12} - System32\Tasks\{794A5A98-576A-4AC6-B2F6-7A6AEBBE1CFB} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {936FDF1A-F2F1-4178-B434-D50A40DDA843} - System32\Tasks\{6E98BF58-8743-49B2-B308-4DE4611C776C} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {996EB13C-36C5-4711-911C-BA20B30DF07A} - System32\Tasks\{59E7C911-55A9-4C3E-B8D2-17DF1B71CBD7} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {9C62F2EB-3709-4238-9408-83463879928F} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)Task: {9C639299-8693-461C-9CB2-45D1A0FF2D8A} - System32\Tasks\{E503D6A6-1A96-49AB-A045-19E3A4F5DC74} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {C4CF95F9-568A-4311-81F4-7DF6A379CA76} - System32\Tasks\{DB0D0ADC-9968-4EAE-986D-62664CE01A59} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {CA62A84B-F5D8-494B-9526-C9C18D45A06A} - System32\Tasks\{945D3406-F7FA-4D61-96AA-8B434EE19EAD} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-02-10] (Skype Technologies S.A.)Task: {DE5F040D-02BF-482C-936F-ADD968366CF5} - System32\Tasks\{DF5DE0A7-5C1B-4991-B5D0-CC2F00C6A55C} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {E09DB6C2-0533-4D35-8229-FBAC11C2A77D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)Task: {E6780EE5-268A-4BD0-997D-0875F071CDE4} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Terry => C:\Program Files\Windows Calendar\wincal.exe [2008-01-20] (Microsoft Corporation)Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()Task: {EE12B1A3-7823-4EC6-9089-AA4CC209033D} - System32\Tasks\{05E3AA6F-390E-4F95-B09F-B23A7A691C38} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {F6E17BA7-1D87-482D-B956-B9A9E9F2366C} - System32\Tasks\{23020DA5-E10F-49C1-9AE8-B4E2F5F23E7F} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {F83E7E02-FA8B-4B8D-9506-4010AD28F308} - System32\Tasks\{BEB37EE1-93B4-4734-8BA9-884601E030FD} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) =============2011-04-20 01:21 - 2013-03-28 18:07 - 00045056 _____ () C:\Windows\system32\atitmp64.dll2013-10-31 14:47 - 2013-10-31 14:47 - 00954696 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll2014-06-11 23:59 - 2014-09-05 17:54 - 06281536 _____ () C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe2014-10-20 09:23 - 2014-10-20 09:23 - 00043008 _____ () c:\users\terry\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpyxkqvj.dll2013-08-23 12:01 - 2013-08-23 12:01 - 25100288 _____ () C:\Users\Terry\AppData\Roaming\Dropbox\bin\libcef.dll2010-05-07 19:35 - 2010-05-07 19:35 - 02143576 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll2010-05-07 19:35 - 2010-05-07 19:35 - 07954776 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll2010-05-07 19:36 - 2010-05-07 19:36 - 00340824 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll2010-05-07 19:37 - 2010-05-07 19:37 - 00027480 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll2010-05-07 19:37 - 2010-05-07 19:37 - 00126808 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2007-02-05 17:34 - 2007-02-05 17:34 - 00116248 _____ () C:\Program Files (x86)\Common Files\InterVideo\Common\Bin\MpgTsRdr.ax==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) =============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== MSCONFIG/TASK MANAGER disabled items =========(Currently there is no automatic fix for this section.)MSCONFIG\startupreg: DivXMediaServer => "C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe"MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW========================= Accounts: ==========================Administrator (S-1-5-21-227674338-2978312964-2044416110-500 - Administrator - Disabled)Guest (S-1-5-21-227674338-2978312964-2044416110-501 - Limited - Disabled)Mcx1 (S-1-5-21-227674338-2978312964-2044416110-1006 - Administrator - Enabled) => C:\Users\Mcx1Terry (S-1-5-21-227674338-2978312964-2044416110-1000 - Administrator - Enabled) => C:\Users\Terry==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (10/20/2014 09:41:22 AM) (Source: Application Hang) (EventID: 1002) (User: )Description: The program FRST64.exe version 19.10.2014.0 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Problem Reports and Solutions control panel.Process ID: 16a4Start Time: 01cfec84a38f1664Termination Time: 2Error: (10/20/2014 09:24:52 AM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.Error: (10/20/2014 09:23:07 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/20/2014 00:09:46 AM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.Error: (10/20/2014 00:06:47 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 07:02:34 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 06:58:09 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 04:06:47 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-PHISH-SHAVAR.CACHE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/19/2014 04:06:47 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-PHISH-SHAVAR.CACHE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/19/2014 04:06:47 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.SBSTORE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)System errors:=============Error: (10/20/2014 09:24:06 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: Windows Media Player Network Sharing Service%%1053Error: (10/20/2014 09:24:06 AM) (Source: Service Control Manager) (EventID: 7009) (User: )Description: 30000Windows Media Player Network Sharing ServiceError: (10/20/2014 09:23:15 AM) (Source: Service Control Manager) (EventID: 7026) (User: )Description: BeepStarOpenError: (10/20/2014 09:23:10 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: SBSD Security Center Service%%3Error: (10/20/2014 09:20:47 AM) (Source: Application Popup) (EventID: 1060) (User: )Description: \SystemRoot\SysWow64\Drivers\StarOpen.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.Error: (10/20/2014 01:21:34 AM) (Source: Service Control Manager) (EventID: 7030) (User: )Description: PEVSystemStartError: (10/20/2014 01:20:45 AM) (Source: Application Popup) (EventID: 1060) (User: )Description: \??\C:\ComboFix\catchme.sys has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.Error: (10/20/2014 01:06:20 AM) (Source: Service Control Manager) (EventID: 7030) (User: )Description: PEVSystemStartError: (10/20/2014 00:11:39 AM) (Source: Service Control Manager) (EventID: 7022) (User: )Description: Windows UpdateError: (10/20/2014 00:09:18 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: Windows Media Player Network Sharing Service%%1053Microsoft Office Sessions:=========================Error: (10/20/2014 09:41:22 AM) (Source: Application Hang) (EventID: 1002) (User: )Description: FRST64.exe19.10.2014.016a401cfec84a38f16642Error: (10/20/2014 09:24:52 AM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.(NULL)(NULL)(NULL)(NULL)Error: (10/20/2014 09:23:07 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/20/2014 00:09:46 AM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.(NULL)(NULL)(NULL)(NULL)Error: (10/20/2014 00:06:47 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 07:02:34 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 06:58:09 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/19/2014 04:06:47 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-PHISH-SHAVAR.CACHEError: (10/19/2014 04:06:47 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-PHISH-SHAVAR.CACHEError: (10/19/2014 04:06:47 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.SBSTORECodeIntegrity Errors:=================================== Date: 2014-10-20 09:42:33.147 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-20 09:42:32.940 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-20 09:42:32.661 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-20 09:42:32.430 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-20 01:20:45.711 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-10-20 01:20:45.477 Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume3\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source. Date: 2014-10-20 00:34:02.188 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-20 00:34:01.969 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-20 00:34:01.735 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-20 00:34:01.486 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system.==================== Memory info ===========================Processor: Intel® Core i7 CPU 920 @ 2.67GHzPercentage of memory in use: 23%Total physical RAM: 12278.26 MBAvailable physical RAM: 9396.41 MBTotal Pagefile: 24481.55 MBAvailable Pagefile: 21839.8 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.81 MB==================== Drives ================================Drive c: (OS) (Fixed) (Total:581.1 GB) (Free:379.11 GB) NTFS ==>[Drive with boot components (obtained from BCD)]Drive d: (RECOVERY) (Fixed) (Total:15 GB) (Free:8.53 GB) NTFSDrive k: (Seagate Expansion Drive) (Fixed) (Total:1863.01 GB) (Free:1792.64 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596.2 GB) (Disk ID: B8000000)Partition 1: (Not Active) - (Size=71 MB) - (Type=DE)Partition 2: (Not Active) - (Size=15 GB) - (Type=07 NTFS)Partition 3: (Active) - (Size=581.1 GB) - (Type=07 NTFS)Attempted reading MBR returned 0 bytes. Could not read MBR for disk 1.==================== End Of Log ============================ Link to post Share on other sites More sharing options...
Naathim Posted October 20, 2014 ID:893059 Share Posted October 20, 2014 Hi Scan with TDSSKiller Please download TDSSKiller by Kaspersky and save it to your desktop.Right-click on icon and select Run as Administrator to start the tool.Click on Change parameters and put a checkmark beside Loaded modules. A reboot will be needed to apply the changes, allow it to do so.Your machine may appear very slow and unusable after that - it's normal.TDSSKiller will run automaticaly. Click on Change parameters and click OK.Make sure that Verify driver digital signatures & Detect TDLFS File System are marked and click OK.Click the Start Scan button and wait patiently.If anything will be found follow this guidelines:If a suspicious object is detected, the default action will be Skip, click on Continue.If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options. > Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process. > If Cure is not available, please choose Skip instead.Do not choose Delete unless instructed!A report will be created in your root directory, (usually C:\ drive) in the form of TDSSKiller.[Version]_[Date]_[Time]_log.txt. Please include the contents of that file in your next post. Link to post Share on other sites More sharing options...
TerryH Posted October 20, 2014 Author ID:893083 Share Posted October 20, 2014 attachment included.TDSSKiller.3.0.0.40_20.10.2014_11.36.49_log.txt Link to post Share on other sites More sharing options...
TerryH Posted October 20, 2014 Author ID:893218 Share Posted October 20, 2014 Is there anything in the future that I can do to protect against trojans of this kind? I didnt open email and have up to date av and malware software running all the time This other trojan seemed to show up when I had AVG AV disabled last night to run one of the malware programs. Machine is running fine other than IE, but it never ran great on Vista anyway. I'm using Firefox mostly now. Link to post Share on other sites More sharing options...
Naathim Posted October 21, 2014 ID:893441 Share Posted October 21, 2014 Hi Is there anything in the future that I can do to protect against trojans of this kind? I didnt open email and have up to date av and malware software running all the time This is a fairly new infection, spreaded probably with exploits. Malwarebytes' Anti-Exploit may be helpful, but as you see in the forums, there is a huge infestation of it currently. The main issue is that Poweliks lives only in the registry value, so before it's bad and dllhost.exe is skyrocketing, it's difficult for an average user to even know that something's going on. This other trojan seemed to show up when I had AVG AV disabled last night to run one of the malware programs. Machine is running fine other than IE, but it never ran great on Vista anyway. I'm using Firefox mostly now. This one should be killed. Please do the following: Fix with Farbar Recovery Scan Tool This fix was created for this user for use on that particular machine. Running it on another one may cause damage and render the system unstable. Press the + R on your keyboard at the same time. Type Notepad and click OK.Copy the entire content of the codebox below and paste into the Notepad document:startC:\users\terry\appdata\local\temp\nsd9d0b.tmpendClick File, Save As and type fixlist.txt as the File Name.Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!Right-click on icon and select Run as Administrator to start the tool.> XP users click run after receipt of Windows Security Warning - Open File.> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.Press the Fix button just once and wait.If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.When finished FRST will generate a log on the Desktop, called Fixlog.txt.Please include it in your reply. Scan with Farbar Recovery Scan ToolPlease re-run Farbar Recovery Scan Tool.Right-click on icon and select Run as Administrator to start the tool.> XP users click run after receipt of Windows Security Warning - Open File.> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please include their content in your next reply. Link to post Share on other sites More sharing options...
TerryH Posted October 21, 2014 Author ID:893603 Share Posted October 21, 2014 Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 21-10-2014Ran by Terry at 2014-10-21 08:48:19 Run:1Running from C:\Users\Terry\DesktopLoaded Profile: Terry (Available profiles: Terry & Mcx1)Boot Mode: Normal==============================================Content of fixlist:*****************startC:\users\terry\appdata\local\temp\nsd9d0b.tmpend*****************"C:\users\terry\appdata\local\temp\nsd9d0b.tmp" => File/Directory not found.==== End of Fixlog ==== Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-10-2014Ran by Terry (administrator) on TERRY-PC on 21-10-2014 08:51:29Running from C:\Users\Terry\DesktopLoaded Profile: Terry (Available profiles: Terry & Mcx1)Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States)Internet Explorer Version 9Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(AMD) C:\Windows\System32\atiesrxx.exe(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe(Microsoft Corporation) C:\Windows\System32\SLsvc.exe(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe(AMD) C:\Windows\System32\atieclxx.exe() C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe(Microsoft Corporation) C:\Windows\ehome\ehtray.exe(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe(Dropbox, Inc.) C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exe(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(InterVideo Inc.) C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamservice.exe(Malwarebytes Corporation) C:\Malwarebytes' Anti-Malware\mbamgui.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe(Microsoft Corporation) C:\Windows\System32\mobsync.exe(Microsoft Corporation) C:\Windows\splwow64.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [6975520 2009-02-24] (Realtek Semiconductor)HKLM-x32\...\Run: [OpwareSE2] => C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)HKLM-x32\...\Run: [uVS11 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [341232 2007-07-23] (InterVideo Digital Technology Corporation)HKLM-x32\...\Run: [brStsWnd] => C:\Program Files (x86)\Brownie\BrstsW64.exe [3695416 2009-06-11] (brother)HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [190808 2011-03-01] (Logitech Inc.)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)HKLM-x32\...\Run: [AmazonGSDownloaderTray] => C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe [326144 2009-10-23] (Amazon.com)HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-08-25] (AVG Technologies CZ, s.r.o.)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [iSUSPM] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [213936 2006-03-20] (Macrovision Corporation)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [Amazon Music] => C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [6281536 2014-09-05] ()HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exeAppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~2\AmazonExtIE64.dll => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE64.dll [119616 2014-05-23] (Amazon Inc.)AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~2\AmazonExtIE.dll => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE.dll [106304 2014-05-23] (Amazon Inc.)Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Mcx1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnkShortcutTarget: Dropbox.lnk -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)BootExecute: autocheck autochk * sdnclean64.exe==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)ProxyServer: localhost:8080HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearchHKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.yahoo.com/?m=1StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeSearchScopes: HKCU - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =BHO: Advertising Cookie Opt-out -> {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} -> C:\Program Files\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc)BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Advertising Cookie Opt-out -> {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} -> C:\Program Files (x86)\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc)BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO-x32: No Name -> {A3BC75A2-1F87-4686-AA43-5347D756017C} -> No FileBHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileDPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabHandler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No FileHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)Tcpip\Parameters: [DhcpNameServer] 192.168.1.1FireFox:========FF ProfilePath: C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.defaultFF Homepage: hxxp://my.yahoo.com/FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No FileFF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No FileFF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> F:\Google\Picasa3\npPicasa3.dll No FileFF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF Plugin-x32: @movenetworks.com/Quantum Media Player -> C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll (Move Networks)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKCU: @movenetworks.com/Quantum Media Player -> C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll (Move Networks)FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\Terry\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10171.dll (Amazon.com, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Invenda Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npCouponPrinter.dll (Coupons, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMozCouponPrinter.dll (Coupons, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Users\Terry\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)FF Extension: Microsoft .NET Framework Assistant - C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-07-08]FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-09-25]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-09-25]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-09-25]FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-09-25]FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtensionFF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-02]FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-05-15]FF HKCU\...\Firefox\Extensions: [moveplayer@movenetworks.com] - C:\Users\Terry\AppData\Roaming\Move NetworksFF Extension: Move Media Player - C:\Users\Terry\AppData\Roaming\Move Networks [2010-03-08]Chrome:=======CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06]==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 Amazon Download Agent; C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [401920 2009-10-23] (Amazon.com) [File not signed]R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3242000 2014-08-25] (AVG Technologies CZ, s.r.o.)R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-08-25] (AVG Technologies CZ, s.r.o.)R2 Capture Device Service; C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe [198168 2007-03-06] (InterVideo Inc.)R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-12-18] (Stardock Corporation) [File not signed]S2 gupdate1c9ee9e3e003430; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107912 2014-10-21] (Google Inc.)S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]S3 License Management Service ESD; C:\Program Files (x86)\Common Files\element5 Shared\Service\Licence Manager ESD.exe [69120 2010-01-08] (element5) [File not signed]R2 MBAMScheduler; C:\Malwarebytes' Anti-Malware\mbamscheduler.exe [398184 2012-12-14] (Malwarebytes Corporation) [File not signed]R2 MBAMService; C:\Malwarebytes' Anti-Malware\mbamservice.exe [682344 2012-12-14] (Malwarebytes Corporation) [File not signed]S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]S2 SBSDWSCService; F:\Spybot - Search & Destroy\SDWinSec.exe [X]==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.)R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-06-17] (AVG Technologies CZ, s.r.o.)S1 Beep; No ImagePathS3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) [File not signed]S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS64_100507.sys [28984 2010-05-10] (Your Corporation)S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios64_100507.sys [33592 2010-05-10] (Your Corporation)S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS64_100507.sys [14960 2010-05-10] () [File not signed]R3 msvad_simple; C:\Windows\System32\drivers\povrtdev.sys [28528 2010-02-24] (MediaMall Technologies, Inc.)S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2009-07-23] () [File not signed]S3 UDXTTM6000; C:\Windows\System32\Drivers\UDXTTM6000.sys [366336 2008-03-02] ()S3 UDXTTM6000HID; C:\Windows\System32\drivers\UDXTTM6000HID.sys [17920 2006-06-28] (DTV-DVB)S3 catchme; \??\C:\ComboFix\catchme.sys [X]S3 IpInIp; system32\DRIVERS\ipinip.sys [X]S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2014-10-21 08:51 - 2014-10-21 08:51 - 00021140 _____ () C:\Users\Terry\Desktop\FRST.txt2014-10-20 01:23 - 2014-10-20 01:23 - 00022885 _____ () C:\ComboFix.txt2014-10-20 00:28 - 2011-06-25 23:45 - 00256000 _____ () C:\Windows\PEV.exe2014-10-20 00:28 - 2010-11-07 10:20 - 00208896 _____ () C:\Windows\MBR.exe2014-10-20 00:28 - 2009-04-19 21:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00098816 _____ () C:\Windows\sed.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00080412 _____ () C:\Windows\grep.exe2014-10-20 00:28 - 2000-08-30 17:00 - 00068096 _____ () C:\Windows\zip.exe2014-10-20 00:27 - 2014-10-20 01:23 - 00000000 ____D () C:\Qoobox2014-10-20 00:27 - 2014-10-20 01:22 - 00000000 ____D () C:\Windows\erdnt2014-10-20 00:24 - 2014-10-20 00:24 - 05583433 ____R (Swearware) C:\Users\Terry\Desktop\ComboFix.exe2014-10-20 00:04 - 2014-10-20 09:21 - 00003648 _____ () C:\Windows\PFRO.log2014-10-19 14:49 - 2014-10-21 08:51 - 00000000 ____D () C:\FRST2014-10-19 14:45 - 2014-10-19 14:46 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Terry\Desktop\tdsskiller.exe2014-10-19 14:44 - 2014-10-21 08:48 - 02110976 _____ (Farbar) C:\Users\Terry\Desktop\FRST64.exe2014-10-19 13:38 - 2014-10-19 13:59 - 00000000 ____D () C:\AdwCleaner2014-10-19 13:37 - 2014-10-19 13:37 - 01976320 _____ () C:\Users\Terry\Downloads\adwcleaner_4.000.exe2014-10-19 11:12 - 2014-10-19 11:25 - 00000000 ____D () C:\NPE2014-10-19 11:09 - 2014-10-19 11:50 - 00000000 ____D () C:\Users\Terry\AppData\Local\NPE2014-10-19 11:09 - 2014-10-19 11:09 - 00000000 ____D () C:\ProgramData\Norton2014-10-19 11:06 - 2014-10-19 11:06 - 03060320 ____N (Symantec Corporation) C:\Users\Terry\Downloads\NPE.exe2014-10-19 10:33 - 2014-10-19 10:33 - 00000732 _____ () C:\Users\Terry\AppData\Local\d3d9caps64.dat2014-10-19 02:19 - 2014-10-19 02:19 - 00000000 ____D () C:\Users\Terry\Documents\ProcAlyzer Dumps2014-10-19 02:03 - 2014-10-20 00:04 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 22014-10-19 01:50 - 2014-10-19 01:50 - 00000258 __RSH () C:\ProgramData\ntuser.pol2014-10-16 03:18 - 2014-09-27 16:41 - 02782208 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-10-16 03:18 - 2014-09-16 23:57 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll2014-10-16 03:18 - 2014-09-16 09:56 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll2014-10-16 03:14 - 2014-06-15 15:18 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll2014-10-16 03:14 - 2014-06-15 15:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll2014-10-16 03:14 - 2014-06-13 11:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll2014-10-16 03:14 - 2014-06-13 11:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll2014-10-16 03:14 - 2014-06-13 10:36 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll2014-10-16 03:14 - 2014-06-13 10:36 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll2014-10-16 03:13 - 2014-09-04 16:38 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys2014-10-15 22:55 - 2014-09-19 17:09 - 17867776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-10-15 22:55 - 2014-09-19 16:55 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-10-15 22:55 - 2014-09-19 16:54 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-10-15 22:55 - 2014-09-19 16:50 - 01385472 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-10-15 22:55 - 2014-09-19 16:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-10-15 22:55 - 2014-09-19 16:48 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-10-15 22:55 - 2014-09-19 16:48 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll2014-10-15 22:55 - 2014-09-19 16:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-10-15 22:55 - 2014-09-19 16:47 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-10-15 22:55 - 2014-09-19 16:46 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-10-15 22:55 - 2014-09-19 16:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe2014-10-15 22:55 - 2014-09-19 16:45 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-10-15 22:55 - 2014-09-19 16:45 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe2014-10-15 22:55 - 2014-09-19 15:53 - 12364288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-10-15 22:55 - 2014-09-19 15:44 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-10-15 22:55 - 2014-09-19 15:41 - 09739776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-10-15 22:55 - 2014-09-19 15:39 - 01138688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-10-15 22:55 - 2014-09-19 15:38 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-10-15 22:55 - 2014-09-19 15:37 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-10-15 22:55 - 2014-09-19 15:36 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2014-10-15 22:55 - 2014-09-19 15:36 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-10-15 22:55 - 2014-09-19 15:36 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-10-15 22:55 - 2014-09-19 15:35 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2014-10-15 22:55 - 2014-09-19 15:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-10-15 22:55 - 2014-09-19 15:34 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe2014-10-15 22:55 - 2014-09-19 15:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe2014-10-15 22:55 - 2014-09-19 15:33 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-09-25 09:28 - 2014-09-25 09:29 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-09-24 00:18 - 2014-09-08 23:40 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2014-09-24 00:18 - 2014-09-08 23:24 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2014-10-21 08:51 - 2009-06-30 01:21 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-10-21 08:42 - 2006-11-02 08:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A02014-10-21 08:42 - 2006-11-02 08:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A02014-10-21 08:40 - 2009-05-21 13:51 - 01670625 _____ () C:\Windows\WindowsUpdate.log2014-10-21 08:16 - 2011-10-29 12:03 - 00000000 ____D () C:\ProgramData\MFAData2014-10-21 08:15 - 2012-04-05 09:05 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-10-21 00:51 - 2009-06-30 01:21 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-10-21 00:46 - 2009-06-30 01:21 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA2014-10-21 00:46 - 2009-06-30 01:21 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore2014-10-20 15:48 - 2010-02-09 16:48 - 00000426 _____ () C:\Windows\BRWMARK.INI2014-10-20 15:04 - 2006-11-02 05:46 - 00759582 _____ () C:\Windows\system32\PerfStringBackup.INI2014-10-20 14:45 - 2014-09-01 22:02 - 00000000 ___RD () C:\Users\Terry\Dropbox2014-10-20 14:45 - 2014-09-01 22:00 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Dropbox2014-10-20 14:42 - 2009-12-16 17:30 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs2014-10-20 14:42 - 2006-11-02 08:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-10-20 14:40 - 2006-11-02 08:42 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-10-20 11:08 - 2014-09-01 23:43 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\KeePass2014-10-20 01:23 - 2006-11-02 06:33 - 00000000 __RHD () C:\Users\Default2014-10-20 01:21 - 2006-11-02 05:34 - 00000215 _____ () C:\Windows\system.ini2014-10-20 01:20 - 2009-06-02 17:22 - 00000000 ____D () C:\Users\Terry2014-10-20 00:01 - 2009-12-11 10:25 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy2014-10-19 19:42 - 2009-07-16 21:17 - 00000000 ____D () C:\Windows\Minidump2014-10-19 19:11 - 2009-06-23 11:17 - 00000000 ____D () C:\Users\Terry\Documents\My PSP Files2014-10-19 14:02 - 2006-11-02 08:21 - 00404736 _____ () C:\Windows\system32\FNTCACHE.DAT2014-10-16 03:13 - 2013-08-15 03:03 - 00000000 ____D () C:\Windows\system32\MRT2014-10-16 03:00 - 2006-11-02 05:35 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe2014-10-14 11:41 - 2011-01-08 00:00 - 00000858 _____ () C:\Users\Public\Desktop\CCleaner.lnk2014-10-14 11:41 - 2010-04-08 17:28 - 00000000 ____D () C:\Program Files (x86)\CCleaner2014-10-11 00:54 - 2009-06-22 23:21 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Skype2014-10-10 09:45 - 2014-04-15 09:56 - 00002413 _____ () C:\Users\Public\Desktop\Skype.lnk2014-10-04 09:58 - 2014-06-12 00:00 - 00001582 _____ () C:\Windows\System32\Tasks\Amazon Music Helper2014-10-04 09:58 - 2014-06-12 00:00 - 00000927 _____ () C:\Users\Terry\Desktop\Amazon Music.lnk2014-09-26 09:50 - 2006-11-02 06:33 - 00000000 ____D () C:\Windows\rescache2014-09-26 09:31 - 2012-05-11 08:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2014-09-24 10:15 - 2012-04-05 09:05 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-09-24 10:15 - 2012-04-05 09:05 - 00003682 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2014-09-24 10:15 - 2011-05-19 22:10 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-09-24 00:21 - 2009-06-23 11:23 - 00002275 _____ () C:\Users\Public\Desktop\Jasc Paint Shop Pro 9.lnk2014-09-21 16:13 - 2014-09-01 22:02 - 00000921 _____ () C:\Users\Terry\Desktop\Dropbox.lnk2014-09-21 16:13 - 2014-09-01 22:01 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DropboxSome content of TEMP:====================C:\Users\Terry\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpdjzn2q.dll==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-10-21 02:58==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-10-2014Ran by Terry at 2014-10-21 08:52:05Running from C:\Users\Terry\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)001 Joiner and Splitter Pro (HKLM-x32\...\001 Joiner and Splitter Pro2.0) (Version: 2.0 - Welltek Software)7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version: - )Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)Adobe AIR (x32 Version: 3.0.0.4080 - Adobe Systems Incorporated) HiddenAdobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5 - Adobe Systems, Inc.)Amazon 1Button App (HKLM-x32\...\{4D875057-4353-4B8F-93E5-8C3DC7F34EA9}) (Version: 1.0.8 - Amazon)Amazon Games & Software Downloader (HKLM-x32\...\Amazon Games & Software Downloader_is1) (Version: 2.0.2.0 - Amazon)Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version: - Amazon)Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.4.0.628 - Amazon Services LLC)AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) HiddenAMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)ArcSoft PhotoBase 4.5 (HKLM-x32\...\{C0BBE46D-5318-485A-8564-D8FA5576ECD4}) (Version: - ArcSoft)ArcSoft PhotoBase 4.5 (Shared Components) (HKLM-x32\...\Uninstaller_B27C5000_ArcSoft PhotoBase 4.5) (Version: 2.60.30 - element5)ArcSoft PhotoStudio 5.5 (HKLM-x32\...\{D2261C4B-4D9B-4149-8472-31B7A2FEAB91}) (Version: - ArcSoft)Astronomy 2005 Screensaver (HKLM-x32\...\Astronomy 2005 Screensaver) (Version: - )ATI AVIVO64 Codecs (Version: 10.10.0.40914 - ATI Technologies Inc.) HiddenAVG 2014 (HKLM\...\AVG) (Version: 2014.0.4765 - AVG Technologies)AVG 2014 (Version: 14.0.4040 - AVG Technologies) HiddenAVG 2014 (Version: 14.0.4765 - AVG Technologies) HiddenBonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Brother HL-2170W (HKLM-x32\...\{689BA753-2D23-470F-8014-B1EC8D61EE95}) (Version: 1.00 - Brother)CameraHelperMsi (x32 Version: 13.25.1010.0 - Logitech) HiddenCanon ScanGear Starter (HKLM-x32\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version: - )CanoScan Toolbox Ver4.9 (HKLM-x32\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )CarbonPoker (HKCU\...\CarbonPoker) (Version: 5.0 - )Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center Graphics Previews Common (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center InstallProxy (x32 Version: 2008.0828.2144.37162 - ATI Technologies, Inc.) HiddenCatalyst Control Center InstallProxy (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCatalyst Control Center Localization All (x32 Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Chinese Standard (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Chinese Traditional (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Czech (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Danish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Dutch (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help English (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Finnish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help French (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help German (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Greek (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Hungarian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Italian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Japanese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Korean (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Norwegian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Polish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Portuguese (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Russian (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Spanish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Swedish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Thai (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) HiddenCCC Help Turkish (x32 Version: 2013.0328.2217.38225 - Advanced Micro Devices, Inc.) Hiddenccc-utility64 (Version: 2013.0328.2218.38225 - Advanced Micro Devices, Inc.) HiddenCCleaner (HKLM\...\CCleaner) (Version: 4.18 - Piriform)Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) HiddenCompatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Corel AfterShot Pro (HKLM-x32\...\AfterShot Pro) (Version: 1.2.0.7 - Corel Corporation)Darksiders (HKLM-x32\...\Steam App 50620) (Version: - Vigil Games)DarksidersInstaller (HKLM-x32\...\{B93EEE50-9C8F-45DF-95E4-3D85A6E242F3}) (Version: 1.00.1000 - THQ)Dell Dock (HKLM\...\{F6CB42B9-F033-4152-8813-FF11DA8E6A78}) (Version: 1.0.0 - Dell)Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)DigitalTV (HKLM-x32\...\{C19DBE5E-712E-4F02-8380-ECEDD951B374}) (Version: 2.64 - )DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.41 - DivX, LLC)Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) HiddenGoogle Advertising Cookie Opt-out (HKLM\...\{A2E00B38-848D-4898-9109-BFA37C074DDC}) (Version: 1.0.1.0 - Google Inc)Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) HiddenH&R Block California 2010 (HKLM-x32\...\{9FBDF580-E37F-4DEE-8F2E-75A8E8716AAD}) (Version: 1.10.4801 - HRB Technology, LLC.)H&R Block California 2011 (HKLM-x32\...\{10894714-E82E-4371-9CF7-F58E352C76EA}) (Version: 1.11.5001 - HRB Technology, LLC.)H&R Block California 2012 (HKLM-x32\...\{E040F1EC-82A9-4950-AAFE-55762AB59590}) (Version: 1.12.7501 - HRB Technology, LLC.)H&R Block California 2013 (HKLM-x32\...\{FA9B4B45-B7F0-47A4-894B-19BBF8829FE2}) (Version: 1.13.6701 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2010 (HKLM-x32\...\{10964A8F-21C1-45EA-BC2D-F84B505C3848}) (Version: 10.04.6402 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2011 (HKLM-x32\...\{C6006AED-E5A7-4F77-BAD5-95AC43DE04F3}) (Version: 11.05.6901 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2012 (HKLM-x32\...\{89D20029-0578-4D8D-979A-695C8D868868}) (Version: 12.05.7801 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2013 (HKLM-x32\...\{EDE796DE-0A72-464D-9D21-F04BC41A092B}) (Version: 13.05.6502 - HRB Technology, LLC.)Hoyle Card Games 2003 (HKLM-x32\...\InstallShield_{9ABA26E1-843A-4A72-95AF-C72474E191F6}) (Version: 1.0.0.0 - Sierra)Hoyle Card Games 2003 (x32 Version: 1.0.0.0 - Sierra) HiddeniCloud (HKLM\...\{CE97E4D3-9F91-4D72-8A29-ED9EA90E5A15}) (Version: 2.1.3.25 - Apple Inc.)Intel® Network Connections 13.1.33.0 (HKLM\...\PROSetDX) (Version: 13.1.33.0 - Intel)Intel® Network Connections 13.1.33.0 (Version: 13.1.33.0 - Intel) HiddenInterVideo DeviceService (HKLM-x32\...\{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}) (Version: 1.0.0 - InterVideo)InterVideo WinDVD 8 (HKLM-x32\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0-B6.109 - InterVideo Inc.)InterVideo WinDVD 8 (x32 Version: 8.0-B6.109 - InterVideo Inc.) HiddenJasc Animation Shop 3 (HKLM-x32\...\{7C4196CA-CA41-4F34-9C08-7724E7705D52}) (Version: 3.11 - Jasc Software Inc)Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.01.0000 - Jasc Software Inc)Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) HiddenKeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7248) - Logitech Inc..)Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)Logitech Webcam Software Driver Package (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)LWS Facebook (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Gallery (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Help_main (x32 Version: 13.25.1016.0 - Logitech) HiddenLWS Launcher (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Motion Detection (x32 Version: 13.20.1176.0 - Logitech) HiddenLWS Pictures And Video (x32 Version: 13.25.1010.0 - Logitech) HiddenLWS Twitter (x32 Version: 13.20.1166.0 - Logitech) HiddenLWS Video Mask Maker (x32 Version: 13.10.1216.0 - Logitech) HiddenLWS VideoEffects (Version: 13.25.1005.0 - Logitech) HiddenLWS Webcam Software (x32 Version: 13.20.1168.0 - Logitech) HiddenLWS WLM Plugin (x32 Version: 1.20.1166.0 - Logitech) HiddenLWS YouTube Plugin (x32 Version: 13.20.1166.0 - Logitech) HiddenMalwarebytes Anti-Malware version 1.70.0.1100 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.70.0.1100 - Malwarebytes Corporation)Manual CanoScan LiDE 500F (HKLM-x32\...\{B9C54C44-BB5A-4B03-8907-C01A9790195A}) (Version: - )Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Office 2000 Disc 2 (HKLM-x32\...\{00040409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)Microsoft Office 2000 Small Business (HKLM-x32\...\{00030409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)Move Media Player (HKCU\...\Move Media Player) (Version: - Move Networks)Mozilla Firefox 32.0.3 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 en-US)) (Version: 32.0.3 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.0 - Nikon)Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.8.0 - Nikon)Octoshape add-in for Adobe Flash Player (HKCU\...\Octoshape add-in for Adobe Flash Player) (Version: - )Octoshape Streaming Services (HKCU\...\Octoshape Streaming Services) (Version: - )OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)Opanda IExif 2.3 (HKLM-x32\...\Opanda IExif_is1) (Version: 2.3 - Opanda Studio)Opanda PowerExif 1.2 Professional Trial (HKLM-x32\...\Opanda PowerExif Professional Trial_is1) (Version: 1.2 - Opanda Studio)PC Connectivity Solution (HKLM-x32\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)Picture Control Utility (HKLM-x32\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.2 - Nikon)Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.15 - Nikon)QuickBooks Pro (HKLM-x32\...\QuickBooks Pro) (Version: - )QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5783 - Realtek Semiconductor Corp.)Roxio Creator Audio (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Copy (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Data (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator DE (HKLM-x32\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.1 - Roxio)Roxio Creator DE (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Tools (x32 Version: 3.7.0 - Roxio) HiddenRoxio Express Labeler 3 (x32 Version: 3.2.1 - Roxio) HiddenRoxio Update Manager (x32 Version: 6.0.0 - Roxio) HiddenSD Viewer for DSC (HKLM-x32\...\{5A8D3524-79DB-11D5-99D1-00010256D40E}) (Version: - )Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.13.13771 - Skype Technologies S.A.)Skype™ 6.14 (HKLM-x32\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)SmartSound Quicktracks Plugin (HKLM-x32\...\InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}) (Version: 3.0.5.0 - SmartSound Software Inc)SmartSound Quicktracks Plugin (x32 Version: 3.0.5.0 - SmartSound Software Inc) HiddenSpotify (HKLM-x32\...\Spotify) (Version: 0.5.2 - )Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)Stellarium 0.11.4 (HKLM\...\Stellarium_is1) (Version: 0.11.4 - Stellarium team)System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version: - )ubi.com (HKLM-x32\...\{AEDDF5A3-29CE-11D5-A8C2-000102246AAE}) (Version: - )Ulead VideoStudio 11 (HKLM-x32\...\InstallShield_{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}) (Version: 11.0.0.0000 - InterVideo Digital Technology Corporation)VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) HiddenVideoStudio (x32 Version: 11.0.0.0000 - InterVideo Digital Technology Corporation) HiddenViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.8.2 - Nikon)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}) (Version: 8.0.0.35 - GRISOFT, s.r.o.)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - )Windows 7 Upgrade Advisor (HKLM-x32\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\BC15EA930074932BB2C4B4493C9FD4EA95087D1A) (Version: 10/12/2007 6.85.4.0 - Nokia)Windows Live Sign-in Assistant (HKLM-x32\...\{9422C8EA-B0C6-4197-B8FC-DC797658CA00}) (Version: 5.000.818.6 - Microsoft Corporation)Windows Live Sync (HKLM-x32\...\{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}) (Version: 14.0.8050.1202 - Microsoft Corporation)Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )Windows Media Encoder 9 Series (x32 Version: 9.00.3374 - Microsoft Corporation) Hidden==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{8E590317-1329-11D1-B70B-00805F29CD16}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks Pro\qbw32.exe (Intuit, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\FileSyncApi64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)==================== Restore Points =========================25-09-2014 08:22:50 Scheduled Checkpoint26-09-2014 07:12:28 Scheduled Checkpoint27-09-2014 07:12:26 Scheduled Checkpoint28-09-2014 07:40:17 Scheduled Checkpoint29-09-2014 07:23:32 Scheduled Checkpoint30-09-2014 07:30:45 Scheduled Checkpoint01-10-2014 07:46:28 Scheduled Checkpoint02-10-2014 07:42:00 Scheduled Checkpoint03-10-2014 06:52:06 Scheduled Checkpoint04-10-2014 07:31:36 Scheduled Checkpoint05-10-2014 07:00:00 Scheduled Checkpoint06-10-2014 07:17:43 Scheduled Checkpoint09-10-2014 19:11:35 Scheduled Checkpoint10-10-2014 07:54:05 Scheduled Checkpoint11-10-2014 08:20:32 Scheduled Checkpoint12-10-2014 07:32:45 Scheduled Checkpoint13-10-2014 03:49:42 Scheduled Checkpoint14-10-2014 07:00:01 Scheduled Checkpoint15-10-2014 07:54:27 Scheduled Checkpoint16-10-2014 07:00:02 Scheduled Checkpoint16-10-2014 10:00:16 Windows Update17-10-2014 07:55:10 Scheduled Checkpoint17-10-2014 21:13:30 Scheduled Checkpoint19-10-2014 18:39:30 Norton_Power_Eraser_2014101911393001021-10-2014 03:49:19 Scheduled Checkpoint==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2006-11-02 05:34 - 2014-10-20 01:21 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts127.0.0.1 localhost==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {059095CE-546D-42FA-BFB7-E33EEA86785D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMMTask: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPagesTask: {1FA0A7B4-ED60-4DD0-A86B-5B580DC734EE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)Task: {25F37DCF-758A-4D40-8AD5-541C7606A708} - System32\Tasks\{3B5C56C1-C525-4A88-BC88-61EE6267BF86} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {33E3A743-D36C-4DF9-ADF2-C23F213D301D} - System32\Tasks\{AE5D3469-07BF-4E7B-928B-3BF5CB113809} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {4221026F-393B-4E5D-A8EC-D65747B252B5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2014-09-26] (Piriform Ltd)Task: {4A15123C-E76F-4D82-B937-7D5243C98D4F} - System32\Tasks\{FE0E2BBA-4C80-4767-89A4-E9ACD7EC1BD1} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {6663F415-D2F8-44BB-895F-3767650B3BA3} - System32\Tasks\{3D2BD65F-DB2E-44BF-B7D4-B095FB17512A} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {73BE57F4-69BB-4A26-8063-8C62FDCE9650} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)Task: {74E73ABB-3C2E-4E70-81BE-A96408803B53} - System32\Tasks\{601D9548-9905-4246-9B31-F26759BF3791} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {7A74FA86-3C66-4D14-9015-F48ED6785C2E} - System32\Tasks\{6842AD54-94B6-4A61-9BE5-784DA11F3505} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UITask: {7D7FBBF4-4AD3-4CAC-AE0E-2A537530C66F} - System32\Tasks\{D196BA7A-04DD-48D5-9D85-E077ABA37980} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {8A678B8E-11EB-4BD0-B154-4AC383C77F85} - System32\Tasks\{4E509FBC-8D20-48B3-BC84-70CD1F5B8430} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {8DF75516-4B1E-4AAE-9DD9-82CA55732D7F} - System32\Tasks\Amazon Music Helper => C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [2014-09-05] ()Task: {91FF7E33-391D-4CD3-93EF-C90A2141CF12} - System32\Tasks\{794A5A98-576A-4AC6-B2F6-7A6AEBBE1CFB} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {936FDF1A-F2F1-4178-B434-D50A40DDA843} - System32\Tasks\{6E98BF58-8743-49B2-B308-4DE4611C776C} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {996EB13C-36C5-4711-911C-BA20B30DF07A} - System32\Tasks\{59E7C911-55A9-4C3E-B8D2-17DF1B71CBD7} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {9C62F2EB-3709-4238-9408-83463879928F} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)Task: {9C639299-8693-461C-9CB2-45D1A0FF2D8A} - System32\Tasks\{E503D6A6-1A96-49AB-A045-19E3A4F5DC74} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {C4CF95F9-568A-4311-81F4-7DF6A379CA76} - System32\Tasks\{DB0D0ADC-9968-4EAE-986D-62664CE01A59} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {CA62A84B-F5D8-494B-9526-C9C18D45A06A} - System32\Tasks\{945D3406-F7FA-4D61-96AA-8B434EE19EAD} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-02-10] (Skype Technologies S.A.)Task: {DE5F040D-02BF-482C-936F-ADD968366CF5} - System32\Tasks\{DF5DE0A7-5C1B-4991-B5D0-CC2F00C6A55C} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {E09DB6C2-0533-4D35-8229-FBAC11C2A77D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)Task: {E6780EE5-268A-4BD0-997D-0875F071CDE4} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Terry => C:\Program Files\Windows Calendar\wincal.exe [2008-01-20] (Microsoft Corporation)Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()Task: {EE12B1A3-7823-4EC6-9089-AA4CC209033D} - System32\Tasks\{05E3AA6F-390E-4F95-B09F-B23A7A691C38} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {F6E17BA7-1D87-482D-B956-B9A9E9F2366C} - System32\Tasks\{23020DA5-E10F-49C1-9AE8-B4E2F5F23E7F} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {F83E7E02-FA8B-4B8D-9506-4010AD28F308} - System32\Tasks\{BEB37EE1-93B4-4734-8BA9-884601E030FD} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) =============2013-10-31 14:47 - 2013-10-31 14:47 - 00021320 _____ () C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreamsPS64.dll2013-10-31 14:47 - 2013-10-31 14:47 - 00954696 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll2011-04-20 01:21 - 2013-03-28 18:07 - 00045056 _____ () C:\Windows\system32\atitmp64.dll2014-06-11 23:59 - 2014-09-05 17:54 - 06281536 _____ () C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe2014-10-20 14:44 - 2014-10-20 14:44 - 00043008 _____ () c:\users\terry\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpdjzn2q.dll2013-08-23 12:01 - 2013-08-23 12:01 - 25100288 _____ () C:\Users\Terry\AppData\Roaming\Dropbox\bin\libcef.dll2010-05-07 19:35 - 2010-05-07 19:35 - 02143576 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll2010-05-07 19:35 - 2010-05-07 19:35 - 07954776 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll2010-05-07 19:36 - 2010-05-07 19:36 - 00340824 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll2010-05-07 19:37 - 2010-05-07 19:37 - 00027480 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll2010-05-07 19:37 - 2010-05-07 19:37 - 00126808 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2007-02-05 17:34 - 2007-02-05 17:34 - 00116248 _____ () C:\Program Files (x86)\Common Files\InterVideo\Common\Bin\MpgTsRdr.ax2013-09-14 02:51 - 2013-09-14 02:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll2013-09-14 02:50 - 2013-09-14 02:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\81159880.sys => ""="Driver"HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\81159880.sys => ""="Driver"==================== EXE Association (whitelisted) =============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== MSCONFIG/TASK MANAGER disabled items =========(Currently there is no automatic fix for this section.)MSCONFIG\startupreg: DivXMediaServer => "C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe"MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW========================= Accounts: ==========================Administrator (S-1-5-21-227674338-2978312964-2044416110-500 - Administrator - Disabled)Guest (S-1-5-21-227674338-2978312964-2044416110-501 - Limited - Disabled)Mcx1 (S-1-5-21-227674338-2978312964-2044416110-1006 - Administrator - Enabled) => C:\Users\Mcx1Terry (S-1-5-21-227674338-2978312964-2044416110-1000 - Administrator - Enabled) => C:\Users\Terry==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (10/21/2014 00:41:59 AM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\2FC6FE1971F899D4DCBB8BE8ADBC6774E1347B26> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/21/2014 00:41:59 AM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\2FC6FE1971F899D4DCBB8BE8ADBC6774E1347B26> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-PHISH-SHAVAR.CACHE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-PHISH-SHAVAR.CACHE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.SBSTORE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.SBSTORE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.PSET> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.PSET> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.CACHE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.CACHE> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)System errors:=============Error: (10/20/2014 03:44:56 PM) (Source: BROWSER) (EventID: 8032) (User: )Description: The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{D3EAAE56-DB7C-4125-9B9A-4083AB142C90}.The backup browser is stopping.Error: (10/20/2014 02:46:47 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}Error: (10/20/2014 02:44:23 PM) (Source: Service Control Manager) (EventID: 7026) (User: )Description: BeepStarOpenError: (10/20/2014 02:44:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: SBSD Security Center Service%%3Error: (10/20/2014 02:41:55 PM) (Source: Application Popup) (EventID: 1060) (User: )Description: \SystemRoot\SysWow64\Drivers\StarOpen.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.Error: (10/20/2014 00:25:04 PM) (Source: BROWSER) (EventID: 8032) (User: )Description: The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{D3EAAE56-DB7C-4125-9B9A-4083AB142C90}.The backup browser is stopping.Error: (10/20/2014 11:55:53 AM) (Source: DCOM) (EventID: 10010) (User: )Description: {B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}Error: (10/20/2014 11:35:35 AM) (Source: Service Control Manager) (EventID: 7026) (User: )Description: BeepStarOpenError: (10/20/2014 11:35:34 AM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: SBSD Security Center Service%%3Error: (10/20/2014 11:33:21 AM) (Source: Application Popup) (EventID: 1060) (User: )Description: \SystemRoot\SysWow64\Drivers\StarOpen.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.Microsoft Office Sessions:=========================Error: (10/21/2014 00:41:59 AM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\2FC6FE1971F899D4DCBB8BE8ADBC6774E1347B26Error: (10/21/2014 00:41:59 AM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\2FC6FE1971F899D4DCBB8BE8ADBC6774E1347B26Error: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-PHISH-SHAVAR.CACHEError: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-PHISH-SHAVAR.CACHEError: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.SBSTOREError: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.SBSTOREError: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.PSETError: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.PSETError: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.CACHEError: (10/20/2014 03:35:38 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\SAFEBROWSING\GOOG-MALWARE-SHAVAR.CACHECodeIntegrity Errors:=================================== Date: 2014-10-21 08:51:34.811 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 08:51:34.520 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 08:51:34.251 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 08:51:33.931 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 08:51:33.598 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdrivera.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 08:51:33.348 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdrivera.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 08:51:33.101 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdrivera.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 08:51:32.857 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdrivera.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 00:31:59.654 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdrivera.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-21 00:31:59.341 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdrivera.sys because the set of per-page image hashes could not be found on the system.==================== Memory info ===========================Processor: Intel® Core i7 CPU 920 @ 2.67GHzPercentage of memory in use: 29%Total physical RAM: 12278.26 MBAvailable physical RAM: 8696.53 MBTotal Pagefile: 24717.55 MBAvailable Pagefile: 21701.35 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.8 MB==================== Drives ================================Drive c: (OS) (Fixed) (Total:581.1 GB) (Free:378.08 GB) NTFS ==>[Drive with boot components (obtained from BCD)]Drive d: (RECOVERY) (Fixed) (Total:15 GB) (Free:8.53 GB) NTFSDrive k: (Seagate Expansion Drive) (Fixed) (Total:1863.01 GB) (Free:1792.53 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596.2 GB) (Disk ID: B8000000)Partition 1: (Not Active) - (Size=71 MB) - (Type=DE)Partition 2: (Not Active) - (Size=15 GB) - (Type=07 NTFS)Partition 3: (Active) - (Size=581.1 GB) - (Type=07 NTFS)Attempted reading MBR returned 0 bytes. Could not read MBR for disk 1.==================== End Of Log ============================ Link to post Share on other sites More sharing options...
Naathim Posted October 22, 2014 ID:894104 Share Posted October 22, 2014 OK, now let's take a look at your services. One of them looks like broken. Scan with Farbar Service ScannerDownload Farbar Service Scanner by Farbar and save it to your desktop.Right-click on icon and select Run as Administrator to start the tool.Make sure all of the options are checked!Press Scan.It will create a log (FSS.txt) in the same directory the tool is run.Please include that log in your next reply. Link to post Share on other sites More sharing options...
TerryH Posted October 22, 2014 Author ID:894350 Share Posted October 22, 2014 Farbar Service Scanner Version: 21-07-2014Ran by Terry (administrator) on 22-10-2014 at 09:14:36Running from "C:\Users\Terry\Desktop"Microsoft® Windows Vista™ Home Premium Service Pack 2 (X64)Boot Mode: Normal****************************************************************Internet Services:============Connection Status:==============Localhost is accessible.LAN connected.Google IP is accessible.Google.com is accessible.Yahoo.com is accessible.Windows Firewall:=============Firewall Disabled Policy:==================System Restore:============System Restore Disabled Policy:========================Security Center:============Windows Update:============Windows Autoupdate Disabled Policy:============================Windows Defender:==============WinDefend Service is not running. Checking service configuration:The start type of WinDefend service is set to Demand. The default start type is Auto.The ImagePath of WinDefend service is OK.The ServiceDll of WinDefend service is OK.Windows Defender Disabled Policy:==========================[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]"DisableAntiSpyware"=DWORD:1Other Services:==============File Check:========C:\Windows\System32\nsisvc.dll => File is digitally signedC:\Windows\System32\drivers\nsiproxy.sys => File is digitally signedC:\Windows\System32\dhcpcsvc.dll => File is digitally signedC:\Windows\System32\drivers\afd.sys => File is digitally signedC:\Windows\System32\drivers\tdx.sys => File is digitally signedC:\Windows\System32\Drivers\tcpip.sys => File is digitally signedC:\Windows\System32\dnsrslvr.dll => File is digitally signedC:\Windows\System32\mpssvc.dll => File is digitally signedC:\Windows\System32\bfe.dll => File is digitally signedC:\Windows\System32\drivers\mpsdrv.sys => File is digitally signedC:\Windows\System32\SDRSVC.dll => File is digitally signedC:\Windows\System32\vssvc.exe => File is digitally signedC:\Windows\System32\wscsvc.dll => File is digitally signedC:\Windows\System32\wbem\WMIsvc.dll => File is digitally signedC:\Windows\System32\wuaueng.dll => File is digitally signedC:\Windows\System32\qmgr.dll => File is digitally signedC:\Windows\System32\es.dll => File is digitally signedC:\Windows\System32\cryptsvc.dll => File is digitally signedC:\Program Files\Windows Defender\MpSvc.dll => File is digitally signedC:\Windows\System32\ipnathlp.dll => File is digitally signedC:\Windows\System32\iphlpsvc.dll => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signed**** End of log **** Link to post Share on other sites More sharing options...
TerryH Posted October 22, 2014 Author ID:894361 Share Posted October 22, 2014 I purchased Malwarebytes a while back, but the disk says 2011. Would I be better off installing a new version of freeware to get a newer base model? Would my old product key work if I downloaded the new premium version? My version says "Pro". Thanks. Link to post Share on other sites More sharing options...
Naathim Posted October 22, 2014 ID:894389 Share Posted October 22, 2014 This broken beep service is worrying me. Scan with GmerThis type of scan often produces false positives. At any point do not take any action for any suspicious entries you may see there. Instead post the log to be analyzed.Please download GMER by Gmer and save the file to your desktop.It will come as a randomly named file (like a6ge38b4.exe) - that's absolutely normal.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.If you are a user of CD emulation software (like Daemon Tools or Alcohol) also disable it for the cleaning process - instructions here.Right-click on randomly named icon and select Run as Administrator to start the tool.It is very important that you do not use your computer while Gmer is running!Gmer will open to the Rootkit/Malware tab and perform an automatic quick scan.If you receive a warning about rootkit activity and are asked to fully scan your system click NO!When the pre-scan is completed, please do the following:Please check in the Quick scan box.Please uncheck the IAT/EAT and Show All.Click Scan.If you see a rootkit warning window click OK.When the scan is finished, Save the results to your desktop as gmer.log.Please include the content of this file in your next reply.Don't forget to re-enable previously switched-off protection software! If you encounter any problems, try running GMER in Safe Mode. If GMER crashes or keeps resulting in a Blue Screen of Death, uncheck Devices on the right side before scanning. Link to post Share on other sites More sharing options...
TerryH Posted October 22, 2014 Author ID:894462 Share Posted October 22, 2014 gmer.log attachedgmer.log Link to post Share on other sites More sharing options...
Naathim Posted October 22, 2014 ID:894473 Share Posted October 22, 2014 OK, update me what issues remain please. Link to post Share on other sites More sharing options...
TerryH Posted October 22, 2014 Author ID:894484 Share Posted October 22, 2014 Everything appears okay. Vista64 has been on here for a few years and likely could use reformat or replacement soon. Can you address my previous posted question regarding Malwarebytes? My current version is Pro and it has a tab called "more tools" which contains Rootkit and other tools. Should continue with this version? I want to make sure my machine is protected as possible. Thanks! Link to post Share on other sites More sharing options...
Naathim Posted October 22, 2014 ID:894487 Share Posted October 22, 2014 We will address them later, when we'll be done. I'd like some more general scans to leave you as secure as possible Scan with Malwarebytes' Anti-MalwarePlease re-run Malwarebytes' Anti-Malware.First of all, select update.Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.Click the Scan tab, choose Threat Scan is checked and click Scan Now.If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.Upon completion of the scan (or after the reboot), click the History tab.Click Application Logs and double-click the newest Scan Log.At the bottom click Export and choose Text file.Save the file to your desktop and include its content in your next reply. Scan with ESET Online ScannerThis step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Please visit ESET Online Scanner website.Click there Run ESET Online Scanner.If using Internet Explorer:Accept the Terms of Use and click Start.Allow the running of add-on.If using Mozilla Firefox or Google Chrome:Download esetsmartinstaller_enu.exe that you'll be given link to.Double click esetsmartinstaller_enu.exe.Allow the Terms of Use and click Start.To perform the scan:Make sure that Enable detecion of potentially unwanted applications is checked.In the Advanced Settings dropdown menu:Make sure that Remove found threats is unchecked.Scan archives is checked.Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.Use custom proxy settings is unchecked.Click StartThe program will begin to download it's virus database. The speed may vary depending on your Internet connection.When completed, the program will begin to scan. This may take several hours. Please, be patient.Do not do anything on your machine as it may interrupt the scan.When the scan is done, click Finish.A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad.Please include this logfile in your next reply.Don't forget to re-enable previously switched-off protection software! Scan with Security CheckPlease download Security Check by Screen317 and save it to your desktop.Right-click on icon and select Run as Administrator to start the tool.Follow onscreen instructions inside the black box. This scan won't take long.Soon a notepad document called checkup.txt will open automaticaly.Please include the content of that document. Link to post Share on other sites More sharing options...
TerryH Posted October 22, 2014 Author ID:894491 Share Posted October 22, 2014 Here is my version of Malwarebytes. Link to post Share on other sites More sharing options...
TerryH Posted October 22, 2014 Author ID:894497 Share Posted October 22, 2014 Again, my version of Malwarebytes does not have rootkit, only a tab for anti-rootkit beta option. Your reference to Malwarebytes does not contain a link for me to download the proper version. I will run the other two programs and wait for further instruction on MBytes. Link to post Share on other sites More sharing options...
Naathim Posted October 22, 2014 ID:894517 Share Posted October 22, 2014 You are using a very outdated one. We need to upgrade it prior to scan, that version doesn;t have up-to-date functionalities. Uninstall outdated Malwarebytes' Anti-MalwarePlease download MBAM-clean and save it to your desktop.Right-click on mbam-clean.exe icon and select Run as Administrator to start the tool.It will ask you to reboot the machine - please do so.After that follow my next instructions to download & install the newset MBAM version. Scan with Malwarebytes' Anti-MalwarePlease download Malwarebytes Anti-Malware and save it to your desktop.Install the progam and select update.Once updated, click the Settings tab, in the left panel choose Detctions & protection and tick Scan for rootkits.Click the Scan tab, choose Threat Scan is checked and click Scan Now.If threats are detected, click the Apply Actions button. You will now be prompted to reboot. Click Yes.Upon completion of the scan (or after the reboot), click the History tab.Click Application Logs and double-click the Scan Log.At the bottom click Export and choose Text file.Save the file to your desktop and include its content in your next reply. Link to post Share on other sites More sharing options...
TerryH Posted October 23, 2014 Author ID:894618 Share Posted October 23, 2014 Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 10/22/2014Scan Time: 4:30:25 PMLogfile: mbam.txtAdministrator: YesVersion: 2.00.3.1025Malware Database: v2014.10.22.10Rootkit Database: v2014.10.22.01License: FreeMalware Protection: DisabledMalicious Website Protection: DisabledSelf-protection: DisabledOS: Windows Vista Service Pack 2CPU: x64File System: NTFSUser: TerryScan Type: Threat ScanResult: CompletedObjects Scanned: 380084Time Elapsed: 14 min, 38 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 1PUP.Optional.MindSpark.A, HKU\S-1-5-21-227674338-2978312964-2044416110-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\TelevisionFanatic, Quarantined, [6b56a96e90eca98dd66ec7740102f709],Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end) # product=EOS# version=8# iexplore.exe=9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)# OnlineScanner.ocx=1.0.0.7623# api_version=3.0.2# EOSSerial=e09681999229824cb7608a9a6ddb672f# engine=20732# end=finished# remove_checked=false# archives_checked=true# unwanted_checked=true# unsafe_checked=true# antistealth_checked=true# utc_time=2014-10-22 11:08:30# local_time=2014-10-22 04:08:30 (-0800, Pacific Daylight Time)# country="United States"# lang=1033# osver=6.0.6002 NT Service Pack 2# compatibility_mode_1='AVG AntiVirus 2014'# compatibility_mode=1050 16777213 100 100 0 100199294 0 0# compatibility_mode_1=''# compatibility_mode=5892 16776574 100 100 51240169 250618016 0 0# scanned=362090# found=9# cleaned=0# scan_time=6495sh=E5A133CB1754CC1CC37A32F1EF56049D947D0BE5 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\23\4aacb0d7-74721ed7"sh=5044E3F303F275C5055A5311AA4CAAB6B377B8D7 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\5603dea2-18eafba8"sh=B0298BA71B954F01DD98BA45385773D6106CC897 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\34\74af1862-23bb9a65"sh=068B0ED9A0638878D68AC5436285C16EF02F4882 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\35\6ef6f7a3-32b8e0d1"sh=CE94DEDE4002B941CA65287961B94C9EE4C1450F ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\49\4cdf7bb1-2310b3e9"sh=32B7D9D1CC1FF521589DDE9B0C8A61C5C514F086 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\50\34970ab2-5d1c5b1f"sh=C436004740B19EFA4D53CC132AC66BBD085D8A1E ft=0 fh=0000000000000000 vn="Java/Exploit.CVE-2012-4681.CR trojan" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\56\431e3538-719b3a60"sh=9C830FD5175CEDC24117F3F78B3BE3C6577DFD8C ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.NNO trojan" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\58\11d6713a-1ad6503c"sh=AACB58B9A374800013DDB56C7BD87BCEE3E5E914 ft=0 fh=0000000000000000 vn="a variant of Java/Exploit.Agent.QZQ trojan" ac=I fn="C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\59\78d73ffb-4800cb97" Results of screen317's Security Check version 0.99.89 Windows Vista Service Pack 2 x64 (UAC is disabled!) Internet Explorer 9 Internet Explorer 8 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! AVG AntiVirus 2014 Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Spybot - Search & Destroy Java 7 Update 67 Adobe Flash Player 15.0.0.152 Adobe Reader 10.1.12 Adobe Reader out of Date! Mozilla Firefox 32.0.3 Firefox out of Date! ````````Process Check: objlist.exe by Laurent```````` AVG avgwdsvc.exe`````````````````System Health check````````````````` Total Fragmentation on Drive C: 1 %````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
TerryH Posted October 23, 2014 Author ID:894623 Share Posted October 23, 2014 I uninstalled Spybot, but there must be fragments left. Looks like Java is infected. I recently turned off UAC because of all the nuisance prompts. Link to post Share on other sites More sharing options...
Naathim Posted October 23, 2014 ID:894822 Share Posted October 23, 2014 Fix with ComboFixLet's prepare a Script for ComboFix to mark some things for being deleted.Press the + R on your keyboard at the same time.A Run window should appear in the lower left corner. Type in notepad.exe and press Enter.In the shown window paste in the following script:ClearJavaCache::Go to File menu and select Save as.Make sure that the Save as type option is set to Text files (*.txt) and the place to save will be your desktop.Name the file CFScript and select Save.Your CFScript.txt file should appear on your desktop.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Now drag your CFScript file and drop it onto the icon:This will start ComboFix. Let it run uninterrupted!A reboot may be needed during this run. Allow it.When finished, it shall produce a log for you at C:\ComboFix.txt and display it.Please include that log in your next reply. If you'll encounter any issues with internet connection after running ComboFix, please visit this link. If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine. Do not forget to turn on your previously switched-off protection software! Link to post Share on other sites More sharing options...
TerryH Posted October 23, 2014 Author ID:894989 Share Posted October 23, 2014 At stage 50 combofix stalled and I restarted. So if you expect something that's not there, that might be the reason. ComboFix 14-10-21.01 - Terry 10/23/2014 8:55.3.8 - x64Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.12278.9892 [GMT -7:00]Running from: c:\users\Terry\Desktop\ComboFix.exeCommand switches used :: c:\users\Terry\Desktop\CFScript.txtAV: AVG AntiVirus 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}SP: AVG AntiVirus 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((( Files Created from 2014-09-23 to 2014-10-23 )))))))))))))))))))))))))))))))..2014-10-23 16:06 . 2014-10-23 16:06 -------- d-----w- c:\users\Terry\AppData\Local\temp2014-10-23 16:06 . 2014-10-23 16:06 -------- d-----w- c:\users\Mcx1\AppData\Local\temp2014-10-23 16:06 . 2014-10-23 16:06 -------- d-----w- c:\users\Default\AppData\Local\temp2014-10-22 23:28 . 2014-10-22 23:30 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys2014-10-22 23:28 . 2014-10-22 23:28 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware2014-10-22 23:28 . 2014-10-22 23:28 -------- d-----w- c:\programdata\Malwarebytes2014-10-22 23:28 . 2014-10-01 18:11 64216 ----a-w- c:\windows\system32\drivers\mwac.sys2014-10-22 23:28 . 2014-10-01 18:11 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys2014-10-22 23:28 . 2014-10-01 18:11 25816 ----a-w- c:\windows\system32\drivers\mbam.sys2014-10-22 23:17 . 2014-10-22 23:52 -------- d-----w- c:\users\Terry\AppData\Local\CrashDumps2014-10-22 21:18 . 2014-10-22 21:18 -------- d-----w- c:\program files (x86)\ESET2014-10-19 21:49 . 2014-10-21 15:52 -------- d-----w- C:\FRST2014-10-19 20:38 . 2014-10-19 20:59 -------- d-----w- C:\AdwCleaner2014-10-19 18:12 . 2014-10-19 18:25 -------- d-----w- C:\NPE2014-10-19 18:09 . 2014-10-19 18:50 -------- d-----w- c:\users\Terry\AppData\Local\NPE2014-10-19 18:09 . 2014-10-19 18:09 -------- d-----w- c:\programdata\Norton2014-10-19 09:03 . 2014-10-20 07:04 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 22014-10-16 10:18 . 2014-09-17 06:57 76800 ----a-w- c:\windows\system32\packager.dll2014-10-16 10:18 . 2014-09-16 16:56 66560 ----a-w- c:\windows\SysWow64\packager.dll2014-10-16 10:18 . 2014-09-27 23:41 2782208 ----a-w- c:\windows\system32\win32k.sys2014-10-16 10:14 . 2014-06-15 22:18 1131664 ----a-w- c:\windows\SysWow64\dfshim.dll2014-10-16 10:14 . 2014-06-15 22:18 1943696 ----a-w- c:\windows\system32\dfshim.dll2014-10-16 10:14 . 2014-06-13 18:22 81560 ----a-w- c:\windows\SysWow64\mscories.dll2014-10-16 10:14 . 2014-06-13 18:22 156824 ----a-w- c:\windows\SysWow64\mscorier.dll2014-10-16 10:14 . 2014-06-13 17:36 73880 ----a-w- c:\windows\system32\mscories.dll2014-10-16 10:14 . 2014-06-13 17:36 156312 ----a-w- c:\windows\system32\mscorier.dll2014-10-16 10:13 . 2014-09-04 23:38 198656 ----a-w- c:\windows\system32\drivers\fastfat.sys2014-09-24 07:18 . 2014-09-09 06:40 2048 ----a-w- c:\windows\system32\tzres.dll2014-09-24 07:18 . 2014-09-09 06:24 2048 ----a-w- c:\windows\SysWow64\tzres.dll...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2014-10-16 10:00 . 2006-11-02 12:35 103265616 ----a-w- c:\windows\system32\mrt.exe2014-09-24 17:15 . 2012-04-05 16:05 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2014-09-24 17:15 . 2011-05-20 05:10 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2014-08-23 01:05 . 2014-08-28 10:00 304128 ----a-w- c:\windows\SysWow64\gdi32.dll2014-08-23 00:42 . 2014-08-28 10:00 390144 ----a-w- c:\windows\system32\gdi32.dll2014-08-10 17:37 . 2014-08-10 17:38 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll2014-08-06 17:50 . 2014-08-06 17:50 123672 ----a-w- c:\windows\system32\drivers\avgmfx64.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ISUSPM"="c:\program files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-21 213936]"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]"Amazon Music"="c:\users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe" [2014-09-06 6281536].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"OpwareSE2"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]"UVS11 Preload"="c:\program files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-07-23 341232]"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-06-11 3695416]"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-03-02 190808]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-13 43848]"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2011-10-30 571392]"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-29 642656]"AVG_UI"="c:\program files (x86)\AVG\AVG2014\avgui.exe" [2014-08-25 5188112]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2014-07-06 2117632].c:\users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-12 36414624].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-6-3 113664].c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-2-6 1312096].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"LoadAppInit_DLLs"=1 (0x1)"AppInit_DLLs"=c:\progra~2\Amazon\AMAZON~2\AmazonExtIE.dll.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]@="Service".S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]..HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcsThemes.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{981b174d-7733-4e7f-b89d-6545a7c21838}]2014-05-23 21:45 189952 ----a-w- c:\program files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonTaskbarApp.exe.Contents of the 'Scheduled Tasks' folder.2014-10-23 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 17:15].2014-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16 07:46].2014-10-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16 07:46]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-02-24 6975520].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLs"=c:\progra~2\Amazon\AMAZON~2\AmazonExtIE64.dll.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmuStart Page = hxxp://my.yahoo.com/?m=1mLocal Page = c:\windows\SysWOW64\blank.htmuInternet Settings,ProxyOverride = *.localuInternet Settings,ProxyServer = localhost:8080IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: Locate Spot on Map by GPS - c:\program files (x86)\Opanda\IExif 2.3\IExifMap.htmIE: View Exif/GPS/IPTC with IExif - c:\program files (x86)\Opanda\IExif 2.3\IExifCom.htmTrusted Zone: assethealth.com\wwwTrusted Zone: com\www.msiTrusted Zone: com.tw\asia.msiTrusted Zone: com.tw\global.msiTrusted Zone: ikmnet.comTrusted Zone: usps.comTCP: DhcpNameServer = 192.168.1.1FF - ProfilePath - c:\users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.default\FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/FF - ExtSQL: !HIDDEN! 2009-06-25 03:10; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension.- - - - ORPHANS REMOVED - - - -.BHO-{A3BC75A2-1F87-4686-AA43-5347D756017C} - (no file)Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exeSafeBoot-81159880.sysAddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exeAddRemove-AfterShot Pro - f:\corel\Corel AfterShot Pro\uninstall.exeAddRemove-Astronomy 2005 Screensaver - c:\program files (x86)\Edible EntertainmentAddRemove-Picasa 3 - f:\google\Picasa3\Uninstall.exeAddRemove-{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 - f:\spybot - search & destroy\unins000.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]@Denied: (A 2) (Everyone)@="IFlashBroker6".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.15".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]@Denied: (A 2) (Everyone)@="IFlashBroker6".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]@Denied: (A 2) (Everyone).[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]@="Shockwave Flash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]@Denied: (A 2) (Everyone)@="".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]@="FlashBroker".[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\.Completion time: 2014-10-23 09:08:16ComboFix-quarantined-files.txt 2014-10-23 16:08ComboFix2.txt 2014-10-20 08:23.Pre-Run: 406,448,730,112 bytes freePost-Run: 406,382,170,112 bytes free.- - End Of File - - 7968CF0A86B383A9CE70FBFD92B180455C616939100B85E558DA92B899A0FC36 Link to post Share on other sites More sharing options...
Recommended Posts