TerryH Posted October 27, 2014 Author ID:897396 Share Posted October 27, 2014 Mostly Facebook... wife was on Youtube briefly. Nothing else much. Zoek.exe v5.0.0.0 Updated 26-10-2014Tool run by Terry on Mon 10/27/2014 at 14:57:04.74.Microsoft® Windows Vista™ Home Premium 6.0.6002 Service Pack 2 x64Running in: Normal Mode Internet Access DetectedLaunched: C:\Users\Terry\Desktop\zoek.exe [scan all users] [script inserted]==== System Restore Info ======================10/27/2014 2:59:26 PM Zoek.exe System Restore Point Created Succesfully.==== Deleting CLSID Registry Keys ========================== Deleting CLSID Registry Values ========================== Installed Programs ======================001 Joiner and Splitter Pro 7-Zip 4.65 Acrobat.com Adobe AIR Adobe Flash Player 15 ActiveX Adobe Flash Player 15 Plugin Adobe Photoshop 7.0 Adobe Reader X (10.1.12) Adobe Shockwave Player 11.5 Amazon 1Button App Amazon Games & Software Downloader Amazon Kindle Amazon MP3 Downloader 1.0.17 Amazon Music AMD APP SDK Runtime AMD Catalyst Install Manager Apple Application Support Apple Mobile Device Support Apple Software Update ArcSoft PhotoBase 4.5 ArcSoft PhotoBase 4.5 (Shared Components) ArcSoft PhotoStudio 5.5 Astronomy 2005 Screensaver ATI AVIVO64 Codecs AVG 2014 Bonjour Brother HL-2170W CameraHelperMsi Canon ScanGear Starter CanoScan Toolbox Ver4.9 CarbonPoker Catalyst Control Center - Branding Catalyst Control Center Catalyst Control Center Graphics Previews Common Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-utility64 CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish CCleaner Choice Guard Compatibility Pack for the 2007 Office system Corel AfterShot Pro Darksiders DarksidersInstaller Dell Dock Dell Edoc Viewer DigitalTV DivX Setup Dropbox erLT Google Advertising Cookie Opt-out Google Earth Google Update Helper H&R Block California 2010 H&R Block California 2011 H&R Block California 2012 H&R Block California 2013 H&R Block Deluxe + Efile + State 2010 H&R Block Deluxe + Efile + State 2011 H&R Block Deluxe + Efile + State 2012 H&R Block Deluxe + Efile + State 2013 Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595) Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484) Hoyle Card Games 2003 iCloud Intel® Network Connections 13.1.33.0 InterVideo DeviceService InterVideo WinDVD 8 Jasc Animation Shop 3 Jasc Paint Shop Pro 9 KeePass Password Safe 2.27 Logitech Vid HD Logitech Webcam Software Logitech Webcam Software Driver Package LWS Facebook LWS Gallery LWS Help_main LWS Launcher LWS Motion Detection LWS Pictures And Video LWS Twitter LWS Video Mask Maker LWS VideoEffects LWS Webcam Software LWS WLM Plugin LWS YouTube Plugin Malwarebytes Anti-Malware version 2.0.3.1025 Manual CanoScan LiDE 500F Microsoft .NET Framework 3.5 SP1 Microsoft .NET Framework 4.5.1 Microsoft Office 2000 Disc 2 Microsoft Office 2000 Small Business Microsoft Office PowerPoint Viewer 2007 (English) Microsoft OneDrive Microsoft Silverlight Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 Microsoft Visual C++ 2005 Redistributable (x64) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 Microsoft Works Move Media Player Mozilla Firefox 33.0 (x86 en-US) Mozilla Maintenance Service MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) Nikon Message Center 2 Nikon Movie Editor Octoshape add-in for Adobe Flash Player Octoshape Streaming Services Opanda IExif 2.3 Opanda PowerExif 1.2 Professional Trial PC Connectivity Solution Picasa 3 Picture Control Utility Picture Control Utility x64 QuickBooks Pro QuickTime 7 Realtek High Definition Audio Driver Roxio Creator Audio Roxio Creator Copy Roxio Creator Data Roxio Creator DE Roxio Creator Tools Roxio Express Labeler 3 Roxio Update Manager SD Viewer for DSC Security Update for CAPICOM (KB931906) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2840629) Security Update for Microsoft .NET Framework 3.5 SP1 (KB2861697) Security Update for Microsoft .NET Framework 4.5.1 (KB2894854v2) Security Update for Microsoft .NET Framework 4.5.1 (KB2898869) Security Update for Microsoft .NET Framework 4.5.1 (KB2901126) Security Update for Microsoft .NET Framework 4.5.1 (KB2931368) Security Update for Microsoft .NET Framework 4.5.1 (KB2972107) Security Update for Microsoft .NET Framework 4.5.1 (KB2972216) Security Update for Microsoft .NET Framework 4.5.1 (KB2979578v2) Security Update for Windows Media Encoder (KB2447961) Security Update for Windows Media Encoder (KB954156) Security Update for Windows Media Encoder (KB979332) Shockwave Director 10.2 Skype Click to Call SkypeT 6.21 SmartSound Quicktracks Plugin Spotify Spybot - Search & Destroy Steam Stellarium 0.11.4 System Requirements Lab ubi.com Ulead VideoStudio 11 Update for Microsoft .NET Framework 3.5 SP1 (KB963707) VC80CRTRedist - 8.0.50727.6195 VideoStudio ViewNX 2 Visual C++ 8.0 Runtime Setup Package (x64) Visual Studio 2008 x64 Redistributables Visual Studio 2010 x64 Redistributables Visual Studio 2012 x64 Redistributables Visual Studio 2012 x86 Redistributables WinDirStat 1.1.2 Windows 7 Upgrade Advisor Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0) Windows Live Sign-in Assistant Windows Live Sync Windows Live Upload Tool Windows Media Encoder 9 Series ==== Running Processes ======================C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exeC:\Program Files\Dell\DellDock\DockLogin.exeC:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exeC:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exeC:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exeC:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exeC:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exeC:\Program Files (x86)\AVG\AVG2014\avgui.exeC:\Windows\SysWOW64\ctfmon.exeC:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exeC:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files (x86)\AVG\AVG2014\avgidsagent.exeC:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exeC:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exeC:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exeC:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exeC:\Windows\SysWow64\svchost.exeC:\Windows\SysWOW64\ctfmon.exeC:\Users\Terry\Desktop\zoek.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe==== Services (whitelist) ======================Powered by E DevR2 - [AdobeARMservice] - Adobe Acrobat Update Service - "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"R2 - [AERTFilters] - Andrea RT Filters Service - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exeR2 - [AMD External Events Utility] - AMD External Events Utility - C:\Windows\system32\atiesrxx.exeR2 - [Apple Mobile Device] - Apple Mobile Device - "C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe"R2 - [AVGIDSAgent] - AVGIDSAgent - "C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe"R2 - [avgwd] - AVG WatchDog - "C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe"R2 - [bonjour Service] - Bonjour Service - "C:\Program Files\Bonjour\mDNSResponder.exe"R2 - [Capture Device Service] - Capture Device Service - "C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe"R2 - [DockLoginService] - Dock Login Service - C:\Program Files\Dell\DellDock\DockLogin.exeR2 - [iviRegMgr] - IviRegMgr - C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exeR2 - [MBAMService] - MBAMService - "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe"R2 - [slsvc] - Software Licensing - C:\Windows\system32\SLsvc.exeR2 - [uMVPFSrv] - UMVPFSrv - C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exeR2 - [WMPNetworkSvc] - Windows Media Player Network Sharing Service - "C:\Program Files\Windows Media Player\wmpnetwk.exe"R2 - [WSearch] - Windows Search - C:\Windows\system32\SearchIndexer.exe /EmbeddingR3 - [WPFFontCache_v0400] - Windows Presentation Foundation Font Cache 4.0.0.0 - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exeR4 - [MBAMScheduler] - MBAMScheduler - "C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe"S2 - [clr_optimization_v4.0.30319_32] - Microsoft .NET Framework NGEN v4.0.30319_X86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeS2 - [clr_optimization_v4.0.30319_64] - Microsoft .NET Framework NGEN v4.0.30319_X64 - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeS2 - [gupdate1c9ee9e3e003430] - Google Update Service (gupdate1c9ee9e3e003430) - "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /svcS2 - [sBSDWSCService] - SBSD Security Center Service - F:\Spybot - Search & Destroy\SDWinSec.exeS2 - [skype C2C Service] - Skype C2C Service - "C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe"S3 - [AdobeFlashPlayerUpdateSvc] - Adobe Flash Player Update Service - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeS3 - [ALG] - Application Layer Gateway Service - C:\Windows\System32\alg.exeS3 - [Amazon Download Agent] - Amazon Download Agent - C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exeS3 - [COMSysApp] - COM+ System Application - C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}S3 - [DFSR] - DFS Replication - C:\Windows\system32\DFSR.exeS3 - [ehRecvr] - Windows Media Center Receiver Service - C:\Windows\ehome\ehRecvr.exeS3 - [ehSched] - Windows Media Center Scheduler Service - C:\Windows\ehome\ehsched.exeS3 - [FontCache3.0.0.0] - Windows Presentation Foundation Font Cache 3.0.0.0 - C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exeS3 - [gupdatem] - Google Update Service (gupdatem) - "C:\Program Files (x86)\Google\Update\GoogleUpdate.exe" /medsvcS3 - [gusvc] - Google Software Updater - "C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe"S3 - [iDriverT] - InstallDriver Table Manager - "C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe"S3 - [License Management Service ESD] - License Management Service ESD - "C:\Program Files (x86)\Common Files\element5 Shared\Service\Licence Manager ESD.exe"S3 - [MozillaMaintenance] - Mozilla Maintenance Service - "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"S3 - [MSDTC] - Distributed Transaction Coordinator - C:\Windows\System32\msdtc.exeS3 - [msiserver] - Windows Installer - C:\Windows\system32\msiexec.exe /VS3 - [PerfHost] - Performance Counter DLL Host - C:\Windows\SysWow64\perfhost.exeS3 - [RpcLocator] - Remote Procedure Call (RPC) Locator - C:\Windows\system32\locator.exeS3 - [sNMPTRAP] - SNMP Trap - C:\Windows\System32\snmptrap.exeS3 - [steam Client Service] - Steam Client Service - C:\Program Files (x86)\Common Files\Steam\SteamService.exe /RunAsServiceS3 - [stllssvr] - stllssvr - "C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe"S3 - [TrustedInstaller] - Windows Modules Installer - C:\Windows\servicing\TrustedInstaller.exeS3 - [vds] - Virtual Disk - C:\Windows\System32\vds.exeS3 - [VSS] - Volume Shadow Copy - C:\Windows\system32\vssvc.exeS3 - [wmiApSrv] - WMI Performance Adapter - C:\Windows\system32\wbem\WmiApSrv.exeS4 - [aspnet_state] - ASP.NET State Service - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeS4 - [clr_optimization_v2.0.50727_32] - Microsoft .NET Framework NGEN v2.0.50727_X86 - C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeS4 - [clr_optimization_v2.0.50727_64] - Microsoft .NET Framework NGEN v2.0.50727_X64 - C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe==== Deleting Services ========================== Deleting Files \ Folders ======================C:\Windows\syswow64\appdata deletedC:\PROGRA~2\Yahoo! deletedC:\Users\Terry\AppData\Roaming\Yahoo! deletedC:\Users\Terry\AppData\Local\Microsoft_Research deletedC:\Users\Terry\AppData\Local\cache deletedC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Coupons deletedC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy deletedC:\Users\Terry\AppData\LocalLow\boost_interprocess deletedC:\Windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG Secure Search deletedC:\windows\SysNative\GroupPolicy\Machine deletedC:\windows\SysNative\GroupPolicy\User deletedC:\windows\SysNative\GroupPolicy\gpt.ini deleted"C:\ProgramData\Rock Kit" deleted"C:\ProgramData\Sample Delay" deleted"C:\ProgramData\Sampler Instruments" deleted"C:\ProgramData\Sci-Fi" deleted"C:\ProgramData\Screen Saver" deleted"C:\ProgramData\Spacious" deleted"C:\ProgramData\Speech Enhancer" deleted"C:\ProgramData\Standard" deleted"C:\Users\Terry\AppData\Roaming\Samsung" deleted"C:\PROGRA~2\Windows Portable Devices" deleted==== System Specs ======================Windows: Windows Vista Home Premium Edition (64-bit) Service Pack 2 (Build 6002)Memory (RAM): 12279 MBCPU Info: Intel® Core i7 CPU 920 @ 2.67GHzCPU Speed: 2656.9 MHzSound Card: Speakers (Realtek High Definiti |Realtek Digital Output(Optical) |Realtek Digital Output (Realtek |Speakers (PlayOn Virtual Audio |Display Adapters: ATI Radeon HD 5700 Series | ATI Radeon HD 5700 Series | ATI Radeon HD 5700 Series | RDPDD Chained DD | RDP Encoder Mirror DriverMonitors: 1x; Generic PnP Monitor |Screen Resolution: 1920 X 1080 - 32 bitNetwork: Network PresentNetwork Adapters: Intel® 82567LF-2 Gigabit Network ConnectionCD / DVD Drives: 1x (E: | ) E: HL-DT-STDVD+-RW GH30NPorts: COM Ports NOT Present. LPT Port NOT Present.Mouse: 5 Button Wheel Mouse PresentHard Disks: C: 581.1GB | D: 15.0GB | K: 1863.0GBHard Disks - Free: C: 383.3GB | D: 8.5GB | K: 1792.5GBManufacturer *: Dell Inc.BIOS Info: AT/AT COMPATIBLE | 12/21/09 | DELL - 20091221Time Zone: Pacific Standard TimeMotherboard *: Dell Inc. 0R849JCountry: United StatesLanguage: ENU==== System Specs (Software) ======================Anti-Virus: AVG AntiVirus 2014 On-access scanning disabled (Outdated)Anti-Spyware: Windows Defender disabled (Outdated)Anti-Spyware: AVG AntiVirus 2014 disabled (Outdated)Internet Explorer Version: 9.0.8112.16421Mozilla Firefox version: 33.0 (x86 en-US)Adobe Reader version: 10.1.12.15Flash Player version: 15.0.0.152Shockwave Player version: 11.5r600==== Files Recently Created / Modified ============================ C:\Windows ========== C:\Users\Terry\AppData\Local\Temp ====2014-10-27 20:22:42 4E566FEA83FCEEAF2873702806B55006 43008 ----a-w- C:\Users\Terry\AppData\Local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp0wncd_.dll2014-10-27 20:06:02 E0DC8C6BBC787B972A9A468648DBFD85 1008128 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\libiconv2.dll2014-10-27 20:06:02 D202BAA425176287017FFE1FB5D1B77C 103424 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\libintl3.dll2014-10-27 20:06:02 57CAC848FA14AE38F14F9441F8933282 140288 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\pcre3.dll2014-10-27 20:06:02 547C43567AB8C08EB30F6C6BACB479A3 79360 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\regex2.dll2014-10-27 20:06:02 2E0323A94915FAAB10A25F3BABF82584 157696 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\erunt\ERUNT.EXE2014-10-19 20:58:16 5C73E64374D9BA37AC5569D1F7DE5C9B 665682 ----a-w- C:\Users\Terry\AppData\Local\temp\sqlite3.dll====== Java Cache =====2014-10-24 18:08:12 30810F09A3FCC03EC583120B033700BC 282329 ----a-w- C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\45\7e60542d-7794b0512014-10-24 18:08:12 67911F367EC150BDC8F2CB46397F0925 845 ----a-w- C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\11dd5f3d-7a83e7672014-10-24 18:08:12 67911F367EC150BDC8F2CB46397F0925 845 ----a-w- C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\2bbaaf87-491a90112014-10-24 18:08:12 62F5E0DEE3CD9B3C2FB029CE5E6619DB 437 ----a-w- C:\Users\Terry\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\7\2bbaaf87-e2e4c8970372d2fb4193a7ef29d16f6c3f08527947fcb9208b3a0e48820369fd-6.0.lap====== C:\Windows\SysWOW64 =====2014-10-26 02:55:28 E61075854E3D77F8AA9A3F92EB5B5154 28 ----a-w- C:\Windows\SysWOW64\u2014-10-16 10:18:38 1EB8CA23B805D3F8DBDAC8CAE7979B8B 66560 ----a-w- C:\Windows\SysWOW64\packager.dll2014-10-16 10:14:38 8580484193CE0A0788830FBAB97CF13B 1131664 ----a-w- C:\Windows\SysWOW64\dfshim.dll2014-10-16 10:14:38 842DE20A6487D830A458DDB5E0363F13 156824 ----a-w- C:\Windows\SysWOW64\mscorier.dll2014-10-16 10:14:38 653DFC2662680AB61232E1531147558A 81560 ----a-w- C:\Windows\SysWOW64\mscories.dll2014-10-16 05:55:40 3252D4791357FEE6C2BAF0619C041317 1129472 ----a-w- C:\Windows\SysWOW64\wininet.dll2014-10-16 05:55:40 1DDFA163F4FA305DE1F81CD80DE53F87 1810432 ----a-w- C:\Windows\SysWOW64\jscript9.dll2014-10-16 05:55:39 EE05498252DED63A6998C2629FFEFB89 223232 ----a-w- C:\Windows\SysWOW64\dxtrans.dll2014-10-16 05:55:39 E5C50FC8B9EDF1530EF230A687A5EB0B 421376 ----a-w- C:\Windows\SysWOW64\vbscript.dll2014-10-16 05:55:39 9B2FD5A84AA985B0393E0BF33391F4EF 73216 ----a-w- C:\Windows\SysWOW64\mshtmled.dll2014-10-16 05:55:39 89FACA9614F1C949106106BEB23D1EC0 353792 ----a-w- C:\Windows\SysWOW64\dxtmsft.dll2014-10-16 05:55:39 7F2188097B1D46554A7D1A31C787C978 717824 ----a-w- C:\Windows\SysWOW64\jscript.dll2014-10-16 05:55:39 5B170AD076338C48CDC77ABA487DD6FC 176640 ----a-w- C:\Windows\SysWOW64\ieui.dll2014-10-16 05:55:39 10B238C056068548211288D5DCC109DD 2382848 ----a-w- C:\Windows\SysWOW64\mshtml.tlb2014-10-16 05:55:38 3E7834CD2A543D58443BBE38FD74E8EB 12364288 ----a-w- C:\Windows\SysWOW64\mshtml.dll2014-10-16 05:55:35 09192845BF15D30A86E8AD012F232AEC 11776 ----a-w- C:\Windows\SysWOW64\mshta.exe2014-10-16 05:55:34 E8B3EE6038623D549264AE37BD3E0209 41472 ----a-w- C:\Windows\SysWOW64\msfeedsbs.dll2014-10-16 05:55:34 D93F3F1134C9CBC81D6F7D470A29E557 607744 ----a-w- C:\Windows\SysWOW64\msfeeds.dll2014-10-16 05:55:34 A6F7BBEFFD204C45BD732A261A52EED4 231936 ----a-w- C:\Windows\SysWOW64\url.dll2014-10-16 05:55:34 4037D4729F978F9677B4BD8E2D855BD7 1427968 ----a-w- C:\Windows\SysWOW64\inetcpl.cpl2014-10-16 05:55:34 29B990A63A3448A2AAC5FB9A441C8AF0 65536 ----a-w- C:\Windows\SysWOW64\jsproxy.dll2014-10-16 05:55:34 1524E24AC57E375F3C42481A9ACEE038 1138688 ----a-w- C:\Windows\SysWOW64\urlmon.dll2014-10-16 05:55:34 12486BDE40B31322A239D150C595BAF4 142848 ----a-w- C:\Windows\SysWOW64\ieUnatt.exe2014-10-16 05:55:33 8163D88337C067C8B75BA80BEBC0B0CD 9739776 ----a-w- C:\Windows\SysWOW64\ieframe.dll2014-10-16 05:55:33 77742DDD19DB7503EEBF0A4A5A0AD6B1 1802752 ----a-w- C:\Windows\SysWOW64\iertutil.dll2014-10-16 05:55:32 90634CE0C5601BF19E93076052D2A3D6 10752 ----a-w- C:\Windows\SysWOW64\msfeedssync.exe====== C:\Windows\SysWOW64\drivers =========== C:\Windows\Sysnative =====2014-10-26 02:51:09 !HASH: COULD NOT OPEN FILE !!!!! 0 ----a-w- C:\Windows\Sysnative\jqtqvi.dll2014-10-26 02:51:07 008A0A048330F1F747E409B0B45F662F 70656 ----a-w- C:\Windows\Sysnative\yxqjk.dll2014-10-16 10:18:38 B09134E16155654EAFE1E0858FC3D2ED 76800 ----a-w- C:\Windows\Sysnative\packager.dll2014-10-16 10:18:19 DB74B249035729EECD26DE3614D79631 2782208 ----a-w- C:\Windows\Sysnative\win32k.sys2014-10-16 10:14:38 5083CC5456FE8A5D21ECF9E32ACC779F 1943696 ----a-w- C:\Windows\Sysnative\dfshim.dll2014-10-16 10:14:38 3A652CB60DF77E5FFE0FDAE5D5657678 73880 ----a-w- C:\Windows\Sysnative\mscories.dll2014-10-16 10:14:38 32FC4A0FB7855FC7EFCCB927DD264E8A 156312 ----a-w- C:\Windows\Sysnative\mscorier.dll2014-10-16 05:55:40 FCADC331234849A634FDD675EC53E614 2339328 ----a-w- C:\Windows\Sysnative\jscript9.dll2014-10-16 05:55:40 5BDB4A8E43DD489593D89C74396303A7 2382848 ----a-w- C:\Windows\Sysnative\mshtml.tlb2014-10-16 05:55:39 A2E24197853DF27F5799BDA2F6D5A904 1392128 ----a-w- C:\Windows\Sysnative\wininet.dll2014-10-16 05:55:39 7F131B38896C262E7F017A8728C865C6 282112 ----a-w- C:\Windows\Sysnative\dxtrans.dll2014-10-16 05:55:39 50ACB4D3CDA1D52A7754EF1A032637B5 86016 ----a-w- C:\Windows\Sysnative\jsproxy.dll2014-10-16 05:55:39 41CFDBD396E9C59A9E3A7AE9A3F031E4 248320 ----a-w- C:\Windows\Sysnative\ieui.dll2014-10-16 05:55:39 418294856D06AB3B614C2DC68E347D16 453120 ----a-w- C:\Windows\Sysnative\dxtmsft.dll2014-10-16 05:55:38 1E6A8641DD71576FC599358E89C1671D 96768 ----a-w- C:\Windows\Sysnative\mshtmled.dll2014-10-16 05:55:37 EEB1D09E04E1ECDEE3D5C09F834093BD 17867776 ----a-w- C:\Windows\Sysnative\mshtml.dll2014-10-16 05:55:37 405CDBA0F8228BB2621E483B2CCF6954 599040 ----a-w- C:\Windows\Sysnative\vbscript.dll2014-10-16 05:55:35 841BF62B1BE13F0627835F0D422A0E1E 12800 ----a-w- C:\Windows\Sysnative\mshta.exe2014-10-16 05:55:35 25BD1E4C1FC35AB587B7DFF6CA1CB5E3 816640 ----a-w- C:\Windows\Sysnative\jscript.dll2014-10-16 05:55:34 F0373E1FB095F8D862EBC88B578E5591 729088 ----a-w- C:\Windows\Sysnative\msfeeds.dll2014-10-16 05:55:34 C5B9C2E2C3C5D2ECD36ED2B741D38634 173056 ----a-w- C:\Windows\Sysnative\ieUnatt.exe2014-10-16 05:55:34 98D647ECA1FDFC39D183900FB49AE5B7 1385472 ----a-w- C:\Windows\Sysnative\urlmon.dll2014-10-16 05:55:34 618E42727445536E883EC33F9D1D718F 2157056 ----a-w- C:\Windows\Sysnative\iertutil.dll2014-10-16 05:55:34 2904684E5A4AC12241B52D9E03EB6AFC 55296 ----a-w- C:\Windows\Sysnative\msfeedsbs.dll2014-10-16 05:55:34 1347A50EBE04FD2F311B2B74F43DEEE7 1494016 ----a-w- C:\Windows\Sysnative\inetcpl.cpl2014-10-16 05:55:33 CA281A77593AF5B620482F60AB45119C 237056 ----a-w- C:\Windows\Sysnative\url.dll2014-10-16 05:55:33 419DC76DA915F8E4B5B418B707BF67D7 10920960 ----a-w- C:\Windows\Sysnative\ieframe.dll2014-10-16 05:55:32 8EF083BB82EAE20FF074B11727F7999C 11264 ----a-w- C:\Windows\Sysnative\msfeedssync.exe====== C:\Windows\Sysnative\drivers =====2014-10-22 23:28:27 26C43960C99EE861A5D0EDC4DCF3B1C3 129752 ----a-w- C:\Windows\Sysnative\drivers\MBAMSwissArmy.sys2014-10-22 23:28:06 D3311B31C470E7681B14D9B014CBF9ED 93400 ----a-w- C:\Windows\Sysnative\drivers\mbamchameleon.sys2014-10-22 23:28:06 852C80EA88A9D8844EF1485143E79E48 64216 ----a-w- C:\Windows\Sysnative\drivers\mwac.sys2014-10-22 23:28:06 5C3669B71657F22E67A1D4BD49D2CBE7 25816 ----a-w- C:\Windows\Sysnative\drivers\mbam.sys2014-10-16 10:13:54 1E34B436811CCA4A2783C0BC7A0BEB2E 198656 ----a-w- C:\Windows\Sysnative\drivers\fastfat.sys====== C:\Windows\Tasks ======2014-10-26 02:51:07 799E5E75A388F615F54573EA2EF80D78 3856 ----a-w- C:\Windows\Sysnative\Tasks\{3C2470AF-5CE7-3D2D-2C5B-9A6E35516A1A}====== C:\Windows\Temp ============= C:\Program Files ============ C:\PROGRA~2 =====2014-10-24 22:46:18 -------- d-----w- C:\PROGRA~2\QuickTime2014-10-23 19:12:08 -------- d-----w- C:\PROGRA~2\COMMON~1\Skype2014-10-22 21:18:20 -------- d-----w- C:\PROGRA~2\ESET======= C: =====2014-10-24 07:46:37 CC756596FDA152D025DB3E4F975E830A 990 ----a-w- C:\DelFix.txt====== C:\Users\Terry\AppData\Roaming ======2014-10-24 06:59:58 -------- d-----w- C:\Users\Terry\AppData\Local\temp2014-10-24 06:59:58 -------- d-----w- C:\Users\Public\AppData\Local\temp2014-10-24 06:59:58 -------- d-----w- C:\Users\Mcx1\AppData\Local\temp2014-10-24 06:59:58 -------- d-----w- C:\Users\Default\AppData\Local\temp2014-10-24 06:59:58 -------- d-----w- C:\Users\Default User\AppData\Local\temp2014-10-22 23:17:46 -------- d-----w- C:\Users\Terry\AppData\Local\CrashDumps2014-10-22 20:21:01 -------- d-----w- C:\Windows\sysWoW64\config\systemprofile\AppData\Local\CrashDumps2014-10-20 07:02:45 A10AE7DA4D820B8C914F36914360988B 394272 ----a-w- C:\Windows\serviceprofiles\Localservice\AppData\Local\WPFFontCache_v0400-S-1-5-21-227674338-2978312964-2044416110-1000-8192.dat2014-10-19 18:09:08 -------- d-----w- C:\Users\Terry\AppData\Local\NPE2014-10-19 17:33:18 DA6DE4E13513A5292020CD5B158CE49E 732 ----a-w- C:\Users\Terry\AppData\Local\d3d9caps64.dat====== C:\Users\Terry ======2014-10-27 20:00:47 FF33D8CDF04B1D15F3808D49406BEA43 1998336 ----a-w- C:\Users\Terry\Desktop\AdwCleaner.exe2014-10-27 20:00:07 27A4F18F1BB9F05D71128BADD4DCD5C3 1706144 ----a-w- C:\Users\Terry\Desktop\JRT.exe2014-10-27 19:23:17 943C708E6C85202BB41BAAED958F2D07 2113024 ----a-w- C:\Users\Terry\Desktop\FRST64.exe2014-10-24 22:46:24 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime2014-10-23 19:12:08 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype2014-10-20 08:23:51 -------- d-----w- C:\Users\Public\AppData2014-10-19 08:50:09 075B0DA82E23780FA2DD7F2EA0464FD4 258 --sha-r- C:\ProgramData\ntuser.pol====== C: exe-files ==2014-10-27 20:06:02 2E0323A94915FAAB10A25F3BABF82584 157696 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\erunt\ERUNT.EXE2014-10-27 20:00:47 FF33D8CDF04B1D15F3808D49406BEA43 1998336 ----a-w- C:\Users\Terry\Desktop\AdwCleaner.exe2014-10-27 20:00:07 27A4F18F1BB9F05D71128BADD4DCD5C3 1706144 ----a-w- C:\Users\Terry\Desktop\JRT.exe2014-10-27 19:23:17 943C708E6C85202BB41BAAED958F2D07 2113024 ----a-w- C:\Users\Terry\Desktop\FRST64.exe2014-10-24 08:45:55 E5F0D261C81B766E82BCBEBCF418C1CD 46048 ----a-w- C:\Users\Terry\Desktop\Tweaking.com - Repair Internet Explorer\files\tweaking_rati.exe2014-10-24 08:45:55 5CD85F8CCE8E593C4AF5E6DF23D5A34A 46048 ----a-w- C:\Users\Terry\Desktop\Tweaking.com - Repair Internet Explorer\files\tweaking_ras.exe2014-10-24 08:45:55 451AE03D3C92777F09840CA56F08AB62 454056 ----a-w- C:\Users\Terry\Desktop\Tweaking.com - Repair Internet Explorer\files\SetACL_32.exe2014-10-24 08:45:55 3E350EB5DF15C06DEC400A39DD1C6F29 559528 ----a-w- C:\Users\Terry\Desktop\Tweaking.com - Repair Internet Explorer\files\SetACL_64.exe2014-10-24 08:45:55 27EC7614F489A47B6B6BB310ABF54DE4 66528 ----a-w- C:\Users\Terry\Desktop\Tweaking.com - Repair Internet Explorer\files\Tweaking_CleanMem.exe2014-10-24 08:45:54 7605F8F3F4AC98E56A368E67AAEDAB59 1000416 ----a-w- C:\Users\Terry\Desktop\Tweaking.com - Repair Internet Explorer\repair.exe2014-10-22 21:18:20 E273331224005C5A8A504164373DE1DC 535304 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe2014-10-22 21:18:20 9E47522861242EE002D7F385C35D1322 2887824 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exe2014-10-22 21:18:20 5B3DE7968D23B476AFB256D8014B25B9 333424 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScannerA.exe2014-10-22 21:18:20 47B06E473B78A792DF07D226E0537D63 119184 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerUninstaller.exe2014-10-22 21:18:20 3C3F35C91F230493B088B334E39D1F7A 358144 ----a-w- C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe2014-10-21 18:47:36 0104342D751C324107D8ACD6923710BF 15900672 ----a-w- C:\Program Files (x86)\Adobe\Photoshop 7.0\Photoshop.exe2014-10-21 07:46:51 821E577AB0B119278BD1940FEF224DDA 51080 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleUpdateBroker.exe2014-10-21 07:46:51 4067DC9EA0640485F1CF395427FD5E9B 51080 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleUpdateOnDemand.exe2014-10-21 07:46:49 27DC334376EE08A0962E6367E23D3CBA 880272 ----a-w- C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleUpdateSetup.exe2014-10-21 07:46:41 26E37D5EAC3F1CF66587183AB348168C 114568 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleUpdateComRegisterShell64.exe2014-10-21 07:46:40 976D5F35A058340DA2C160CEC4063C4B 230792 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe2014-10-21 07:46:40 047556104954A72A2222FFF169166EEE 285064 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe2014-10-21 07:46:38 51508F0C2476177E50C31B0BBFBF1BDB 107912 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleUpdate.exe2014-10-21 07:46:37 27DC334376EE08A0962E6367E23D3CBA 880272 ----a-w- C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.25.5\GoogleUpdateSetup.exe=== C: other files ==2014-10-27 20:06:01 F56A319979F631C141F5FF02DF87FDB1 43563 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\prelim.bat2014-10-27 20:06:01 DD1E4D974B1672ABD09EFFB225791C4A 1230 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\TDL4.bat2014-10-27 20:06:01 AD2F52DC72B10AF331692E4A4DD80DFC 18670 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\medfos.bat2014-10-27 20:06:01 AA0C656F898523BEDF2DA6923197BB80 1264 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\surfvox.bat2014-10-27 20:06:01 8E6020C14F982CF11B3FE7DBB0CB8EDE 24738 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\searchlnk.bat2014-10-27 20:06:01 86707BCE5CBB65D9B1C41E249B4423BA 152733 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\firefox.bat2014-10-27 20:06:01 83F691D8398F0E37E71E9355BF730DB9 719 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\ev_clear.bat2014-10-27 20:06:01 7F7A362CC9FBF3AD1D1E7C37DD825C0F 14957 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\get.bat2014-10-27 20:06:01 730313487A4CF7DCAA4039643F72A1BE 184027 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\misc.bat2014-10-27 20:06:01 4D80C7010E2CE44AB25FA25B013649E4 8085 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\mws.bat2014-10-27 20:06:01 38A0BDF322ACCC968B0A824C38D50157 29635 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\ask.bat2014-10-27 20:06:01 335DFF8F23E5EC02B5426362F0F8509B 31401 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\iexplore.bat2014-10-27 20:06:01 323C58D6693BEC9A6A37566F37D81B22 9469 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\runvalues.bat2014-10-27 20:06:01 0C4649A62845AB5D5DBCC4998477FF6D 1813 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\delfolders.bat2014-10-27 20:06:01 048407135C9B1FB6A355E256BD96160D 14192 ----a-w- C:\Users\Terry\AppData\Local\temp\jrt\chrome.bat2014-10-22 23:28:27 26C43960C99EE861A5D0EDC4DCF3B1C3 129752 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys2014-10-22 23:28:06 D3311B31C470E7681B14D9B014CBF9ED 93400 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys2014-10-22 23:28:06 852C80EA88A9D8844EF1485143E79E48 64216 ----a-w- C:\Windows\System32\drivers\mwac.sys2014-10-22 23:28:06 5C3669B71657F22E67A1D4BD49D2CBE7 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys==== Startup Registry Enabled ======================[HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Run]"ISUSPM"="C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe -scheduler""ehTray.exe"="C:\Windows\ehome\ehTray.exe""Amazon Music"="C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"OpwareSE2"="C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe""UVS11 Preload"="C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe""BrStsWnd"="C:\Program Files (x86)\Brownie\BrstsW64.exe Autorun""LWS"="C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe -hide""Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe""APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe""AmazonGSDownloaderTray"="C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe""Nikon Message Center 2"="C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe -s""StartCCC"="C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun""AVG_UI"="C:\Program Files (x86)\AVG\AVG2014\avgui.exe /TRAYONLY""KeePass 2 PreLoad"="C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe --preload""QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe -atboottime"[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]"ISUSPM"="C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe -scheduler""ehTray.exe"="C:\Windows\ehome\ehTray.exe""Amazon Music"="C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLs"="C:\\PROGRA~2\\Amazon\\AMAZON~2\\AmazonExtIE.dll"==== Startup Registry Enabled x64 ======================[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe"[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLs"="C:\\PROGRA~2\\Amazon\\AMAZON~2\\AmazonExtIE64.dll"==== Startup Registry Disabled x64 ======================[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DivXMediaServer]"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run""item"="DivXMediaServer""hkey"="HKLM""command"="\"C:\\Program Files (x86)\\DivX\\DivX Media Server\\DivXMediaServer.exe\""[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\DivXUpdate]"key"="SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run""item"="DivXUpdate""hkey"="HKLM""command"="\"C:\\Program Files (x86)\\DivX\\DivX Update\\DivXUpdate.exe\" /CHECKNOW"==== Startup Folders ======================2009-05-22 02:21:29 1835 ----a-w- C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk2009-05-22 02:21:29 1835 ----a-w- C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk2012-08-23 05:43:58 1835 ----a-w- C:\Users\Mcx1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk2014-09-02 05:01:56 953 ----a-w- C:\Users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk2014-10-21 18:49:11 1194 ----a-w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk==== Task Scheduler Jobs ======================C:\Windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [10/21/2014 12:46 AM]C:\Windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [10/21/2014 12:46 AM]==== Other Scheduled Tasks ======================"C:\Windows\SysNative\tasks\Adobe Flash Player Updater" [C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]"C:\Windows\SysNative\tasks\Amazon Music Helper" [C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe]"C:\Windows\SysNative\tasks\CCleanerSkipUAC" ["C:\Program Files (x86)\CCleaner\CCleaner.exe"]"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]"C:\Windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]"C:\Windows\SysNative\tasks\{05E3AA6F-390E-4F95-B09F-B23A7A691C38}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{23020DA5-E10F-49C1-9AE8-B4E2F5F23E7F}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{3B5C56C1-C525-4A88-BC88-61EE6267BF86}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{3C2470AF-5CE7-3D2D-2C5B-9A6E35516A1A}" [C:\Windows\system32\regsvr32.exe]"C:\Windows\SysNative\tasks\{3D2BD65F-DB2E-44BF-B7D4-B095FB17512A}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{4E509FBC-8D20-48B3-BC84-70CD1F5B8430}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{59E7C911-55A9-4C3E-B8D2-17DF1B71CBD7}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{601D9548-9905-4246-9B31-F26759BF3791}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{6842AD54-94B6-4A61-9BE5-784DA11F3505}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{6E98BF58-8743-49B2-B308-4DE4611C776C}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{794A5A98-576A-4AC6-B2F6-7A6AEBBE1CFB}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{945D3406-F7FA-4D61-96AA-8B434EE19EAD}" [C:\Program Files (x86)\Skype\Phone\Skype.exe]"C:\Windows\SysNative\tasks\{AE5D3469-07BF-4E7B-928B-3BF5CB113809}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{BEB37EE1-93B4-4734-8BA9-884601E030FD}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{D196BA7A-04DD-48D5-9D85-E077ABA37980}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{DB0D0ADC-9968-4EAE-986D-62664CE01A59}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{DF5DE0A7-5C1B-4991-B5D0-CC2F00C6A55C}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{E503D6A6-1A96-49AB-A045-19E3A4F5DC74}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\{FE0E2BBA-4C80-4767-89A4-E9ACD7EC1BD1}" ["c:\program files (x86)\internet explorer\iexplore.exe" http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBar]"C:\Windows\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe]==== Firefox Extensions Registry ======================[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"="C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5" [05/15/2013 12:22 AM][HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]"moveplayer@movenetworks.com"="C:\Users\Terry\AppData\Roaming\Move Networks" [04/03/2010 09:51 AM]==== Firefox Extensions ======================ProfilePath: C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.default- Move Media Player - C:\Users\Terry\AppData\Roaming\Move Networks- DivX Plus Web Player HTML5 lt;videogt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5- Undetermined - moveplayer@movenetworks.com- Undetermined - {23fcfd51-4958-4f00-80a3-ae97e717ed8b}- Microsoft .NET Framework Assistant - %ProfilePath%\extensions\{20a82645-c095-46ed-80e3-08825760534b}AppDir: C:\Program Files (x86)\Mozilla Firefox- Skype Click to Call - %AppDir%\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}- Java Console - %AppDir%\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}- Skype Click to Call - %AppDir%\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}==== Firefox Plugins ======================Profilepath: C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.defaultDFC9460CC37E5C414DC4680B10C19E7A - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll - Shockwave Flash8DE1B0441B8445508A917594BC847976 - C:\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10171.dll - AmazonMP3DownloaderPluginEC401349BFA64BD6232C746046AEC0B5 - C:\Users\Terry\AppData\Roaming\Mozilla\plugins\npoctoshape.dll - Octoshape Streaming ServicesE66E9C5D42AA085891A4F67E7B2CA4DF - C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll - Move Streaming Media PlayerEA85C911C213873A975A5988ED19A66B - C:\Windows\SysWoW64\Adobe\Director\np32dsw.dll - Shockwave for Director / Shockwave for DirectorAB87EEFFD18F2BAAFC274E7075EA6C67 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll - Windows Presentation Foundation / Windows Presentation Foundation==== Chromium Look ======================HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensionsnneajnkjbffgblleaoojgaacokifdkhm - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx[05/06/2013 01:12 AM]==== Set IE to Default ======================Old Values:[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"="http://my.yahoo.com/?m=1"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]"Tabs"="http://www.google.com"[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]"Tabs"="http://www.google.com"[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]No DefaultScope Set For HKCUNew Values:[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]"Start Page"="http://www.google.com"[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs]"Tabs"="res://ieframe.dll/tabswelcome.htm"[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\AboutURLs]"Tabs"="res://ieframe.dll/tabswelcome.htm"[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes]"DefaultScope"="{012E1000-F331-11DB-8314-0800200C9A66}"==== All HKCU SearchScopes ======================HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"{6A1806CD-94D4-4689-BA73-E35EA1EA9990} Unknown Url="Not_Found"==== Deleting CLSID Registry Keys ======================HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990} deleted successfully==== Deleting CLSID Registry Values ========================== Empty IE Cache ======================C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfullyC:\Users\Terry\AppData\Local\temp\acro_rd_dir\Temporary Internet Files\Content.IE5 emptied successfullyC:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Windows\serviceprofiles\networkservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Windows\serviceprofiles\Localservice\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfullyC:\Windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfullyC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01NGXY1J will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0DL6MGO1 will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23L9IXM0 will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BZRBFVVY will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H3I38SC0 will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H5KRYLE1 will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IPO390FY will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQ3HIBH0 will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NGI0428Q will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NWVJY3C6 will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OD81V6EM will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PL209ZU2 will be deleted at rebootC:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat will be deleted at reboot==== Empty FireFox Cache ======================C:\Users\Terry\AppData\Local\Mozilla\Firefox\Profiles\hzi3cjgp.default\cache2 emptied successfully==== Empty Chrome Cache ======================No Chrome User Data found==== Empty All Flash Cache ======================Flash Cache Emptied Successfully==== Empty All Java Cache ======================Java Cache cleared successfully==== C:\zoek_backup content ======================C:\zoek_backup (files=103 folders=23 2920782 bytes)==== Empty Temp Folders ======================C:\Users\Default\AppData\Local\temp emptied successfullyC:\Users\Default User\AppData\Local\temp emptied successfullyC:\Users\Mcx1\AppData\Local\temp emptied successfullyC:\Users\Public\AppData\Local\temp emptied successfullyC:\Users\Terry\AppData\Local\temp will be emptied at rebootC:\Windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfullyC:\Windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfullyC:\Windows\Temp will be emptied at reboot==== After Reboot ========================== Empty Temp Folders ======================C:\Windows\Temp successfully emptiedC:\Users\Terry\AppData\Local\Temp successfully emptied==== Empty Recycle Bin ======================C:\$RECYCLE.BIN successfully emptied==== Deleting Files / Folders ======================"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" not deleted"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\01NGXY1J" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0DL6MGO1" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\23L9IXM0" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BZRBFVVY" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H3I38SC0" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\H5KRYLE1" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IPO390FY" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQ3HIBH0" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NGI0428Q" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NWVJY3C6" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OD81V6EM" not found"C:\Users\Terry\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PL209ZU2" not found==== EOF on Mon 10/27/2014 at 15:43:39.98 ====================== Link to post Share on other sites More sharing options...
TerryH Posted October 28, 2014 Author ID:897443 Share Posted October 28, 2014 This just showed up for the first time...... xmlka.com mbam protection log Malwarebytes Anti-Malwarewww.malwarebytes.orgUpdate, 10/27/2014 12:08:49 AM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.26.8, 2014.10.27.1,Protection, 10/27/2014 12:08:49 AM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 12:08:49 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 12:08:49 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 12:08:56 AM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 12:08:56 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 12:08:57 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 12:08:58 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 5.45.67.219, 63606, Outbound, C:\Windows\SysWOW64\svchost.exe,Detection, 10/27/2014 12:09:04 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 88.214.193.54, 63607, Outbound, C:\Windows\SysWOW64\svchost.exe,Scan, 10/27/2014 2:24:58 AM, SYSTEM, TERRY-PC, Manual, Start:10/27/2014 2:16:05 AM, Duration:8 min 52 sec, Threat Scan, Completed, 0 Malware Detections, 0 Non-Malware Detections,Detection, 10/27/2014 2:25:17 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 88.214.193.54, 49195, Outbound, C:\Windows\SysWOW64\svchost.exe,Update, 10/27/2014 4:23:49 AM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.27.1, 2014.10.27.2,Protection, 10/27/2014 4:23:49 AM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 4:23:49 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 4:23:49 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 4:23:54 AM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 4:23:54 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 4:23:54 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 4:25:36 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 88.214.193.54, 50570, Outbound, C:\Windows\SysWOW64\svchost.exe,Update, 10/27/2014 7:13:49 AM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.27.2, 2014.10.27.3,Protection, 10/27/2014 7:13:50 AM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 7:13:50 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 7:13:50 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 7:13:54 AM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 7:13:55 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 7:13:55 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 7:14:06 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 88.214.193.54, 52542, Outbound, C:\Windows\SysWOW64\svchost.exe,Update, 10/27/2014 10:08:50 AM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.27.3, 2014.10.27.4,Protection, 10/27/2014 10:08:50 AM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 10:08:50 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 10:08:50 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 10:08:56 AM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 10:08:56 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 10:08:56 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 10:09:54 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 88.214.193.54, 56333, Outbound, C:\Windows\SysWOW64\svchost.exe,Update, 10/27/2014 10:38:49 AM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.27.4, 2014.10.27.5,Protection, 10/27/2014 10:38:49 AM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 10:38:49 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 10:38:49 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 10:38:55 AM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 10:38:55 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 10:38:55 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 10:39:29 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 5.149.250.194, 54115, Outbound, C:\Windows\SysWOW64\svchost.exe,Detection, 10/27/2014 11:42:33 AM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 5.104.111.43, miljamarketing.com, 0, Outbound,Update, 10/27/2014 12:53:49 PM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.27.5, 2014.10.27.6,Protection, 10/27/2014 12:53:49 PM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 12:53:49 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 12:53:49 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 12:53:56 PM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 12:53:56 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 12:53:56 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 12:59:15 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 5.149.250.194, 61021, Outbound, C:\Windows\SysWOW64\svchost.exe,Protection, 10/27/2014 1:03:18 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Stopping,Protection, 10/27/2014 1:03:18 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Stopped,Protection, 10/27/2014 1:03:19 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 1:03:19 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 1:04:50 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Starting,Protection, 10/27/2014 1:04:50 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Started,Protection, 10/27/2014 1:04:51 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 1:04:51 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Protection, 10/27/2014 1:04:58 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Stopping,Protection, 10/27/2014 1:04:58 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Stopped,Protection, 10/27/2014 1:05:03 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 1:05:03 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 1:25:06 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Starting,Protection, 10/27/2014 1:25:07 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Started,Protection, 10/27/2014 1:25:07 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 1:25:26 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Update, 10/27/2014 1:48:51 PM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.27.6, 2014.10.27.7,Protection, 10/27/2014 1:48:51 PM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 1:48:51 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 1:48:51 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 1:48:58 PM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 1:48:58 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 1:48:58 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 1:53:27 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 5.104.111.43, miljamarketing.com, 0, Outbound,Detection, 10/27/2014 2:46:47 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 5.149.250.194, 50273, Outbound, C:\Windows\SysWOW64\svchost.exe,Protection, 10/27/2014 2:56:29 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Stopping,Protection, 10/27/2014 2:56:29 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Stopped,Protection, 10/27/2014 2:56:32 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 2:56:32 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Update, 10/27/2014 3:03:49 PM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.27.7, 2014.10.27.8,Protection, 10/27/2014 3:03:49 PM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 3:03:55 PM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 4:01:51 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Starting,Protection, 10/27/2014 4:01:51 PM, SYSTEM, TERRY-PC, Protection, Malware Protection, Started,Protection, 10/27/2014 4:01:51 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 4:01:52 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 4:15:55 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 5.149.250.194, 63979, Outbound, C:\Windows\SysWOW64\svchost.exe,Update, 10/27/2014 4:18:50 PM, SYSTEM, TERRY-PC, Scheduler, Malware Database, 2014.10.27.8, 2014.10.27.9,Protection, 10/27/2014 4:18:50 PM, SYSTEM, TERRY-PC, Protection, Refresh, Starting,Protection, 10/27/2014 4:18:50 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopping,Protection, 10/27/2014 4:18:51 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Stopped,Protection, 10/27/2014 4:18:56 PM, SYSTEM, TERRY-PC, Protection, Refresh, Success,Protection, 10/27/2014 4:18:56 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Starting,Protection, 10/27/2014 4:18:56 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, Started,Detection, 10/27/2014 4:19:19 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 5.149.250.194, 64498, Outbound, C:\Windows\SysWOW64\svchost.exe,Scan, 10/27/2014 4:21:20 PM, SYSTEM, TERRY-PC, Manual, Start:10/27/2014 4:07:17 PM, Duration:14 min 2 sec, Threat Scan, Completed, 0 Malware Detections, 0 Non-Malware Detections,Detection, 10/27/2014 5:01:49 PM, SYSTEM, TERRY-PC, Protection, Malicious Website Protection, IP, 88.214.241.212, xmlka.com, 0, Outbound,(end) Link to post Share on other sites More sharing options...
Naathim Posted October 28, 2014 ID:897695 Share Posted October 28, 2014 OK, let's see how does it look after those fixes. Scan with Farbar Recovery Scan ToolPlease re-run Farbar Recovery Scan Tool.Right-click on icon and select Run as Administrator to start the tool.> XP users click run after receipt of Windows Security Warning - Open File.> 8 users will be prompted about Windows SmartScreen protection - click More information and Run.Make sure that Addition option is checked.Press Scan button and wait.The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.Please include their content in your next reply. Link to post Share on other sites More sharing options...
TerryH Posted October 28, 2014 Author ID:897904 Share Posted October 28, 2014 Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 27-10-2014 01Ran by Terry (administrator) on TERRY-PC on 28-10-2014 13:02:36Running from C:\Users\Terry\DesktopLoaded Profile: Terry (Available profiles: Terry & Mcx1)Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States)Internet Explorer Version 9Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(AMD) C:\Windows\System32\atiesrxx.exe(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\UMVPFSrv.exe(Microsoft Corporation) C:\Windows\System32\SLsvc.exe(Stardock Corporation) C:\Program Files\Dell\DellDock\DockLogin.exe(AMD) C:\Windows\System32\atieclxx.exe() C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Macrovision Corporation) C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe(Microsoft Corporation) C:\Windows\ehome\ehtray.exe(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe(ScanSoft, Inc.) C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\opwareSE2.exe(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(Logitech Inc.) C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe(Dropbox, Inc.) C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(InterVideo Inc.) C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe(InterVideo) C:\Program Files (x86)\Common Files\InterVideo\RegMgr\iviRegMgr.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe(Microsoft Corporation) C:\Windows\System32\msiexec.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [6975520 2009-02-24] (Realtek Semiconductor)HKLM-x32\...\Run: [OpwareSE2] => C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe [49152 2003-05-08] (ScanSoft, Inc.)HKLM-x32\...\Run: [uVS11 Preload] => C:\Program Files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [341232 2007-07-23] (InterVideo Digital Technology Corporation)HKLM-x32\...\Run: [brStsWnd] => C:\Program Files (x86)\Brownie\BrstsW64.exe [3695416 2009-06-11] (brother)HKLM-x32\...\Run: [LWS] => C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe [190808 2011-03-01] (Logitech Inc.)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-02-12] (Apple Inc.)HKLM-x32\...\Run: [AmazonGSDownloaderTray] => C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe [326144 2009-10-23] (Amazon.com)HKLM-x32\...\Run: [Nikon Message Center 2] => C:\Program Files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe [571392 2011-10-30] (Nikon Corporation)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-03-28] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5188112 2014-08-25] (AVG Technologies CZ, s.r.o.)HKLM-x32\...\Run: [KeePass 2 PreLoad] => C:\Program Files (x86)\KeePass Password Safe 2\KeePass.exe [2117632 2014-07-06] (Dominik Reichl)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [iSUSPM] => C:\Program Files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe [213936 2006-03-20] (Macrovision Corporation)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [138240 2008-01-20] (Microsoft Corporation)HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [Amazon Music] => C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [6281536 2014-09-05] ()HKU\S-1-5-21-227674338-2978312964-2044416110-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exeAppInit_DLLs: C:\PROGRA~2\Amazon\AMAZON~2\AmazonExtIE64.dll => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE64.dll [119616 2014-05-23] (Amazon Inc.)AppInit_DLLs-x32: C:\PROGRA~2\Amazon\AMAZON~2\AmazonExtIE.dll => C:\Program Files (x86)\Amazon\Amazon1ButtonApp\AmazonExtIE.dll [106304 2014-05-23] (Amazon Inc.)Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnkShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Mcx1\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnkShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)Startup: C:\Users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnkShortcutTarget: Dropbox.lnk -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)BootExecute: autocheck autochk * sdnclean64.exe==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearchStartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exeSearchScopes: HKCU - {012E1000-F331-11DB-8314-0800200C9A66} URL = http://www.google.com/search?q={searchTerms}BHO: Advertising Cookie Opt-out -> {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} -> C:\Program Files\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc)BHO: Skype add-on for Internet Explorer -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)BHO-x32: Advertising Cookie Opt-out -> {8E425EB4-ADBD-4816-B1E8-49BB9DECF034} -> C:\Program Files (x86)\Google\Advertising Cookie Opt-out\opt_out.dll (Google Inc)BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)BHO-x32: Skype Browser Helper -> {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} -> C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileDPF: HKLM-x32 {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cabDPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cabHandler: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - No FileHandler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: http\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: https\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: ipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)Tcpip\Parameters: [DhcpNameServer] 192.168.1.1FireFox:========FF ProfilePath: C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.defaultFF Homepage: hxxp://my.yahoo.com/FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin: @java.com/DTPlugin,version=10.21.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw.dll No FileFF Plugin-x32: @divx.com/DivX Player Plugin,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll No FileFF Plugin-x32: @divx.com/DivX Plus Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)FF Plugin-x32: @google.com/npPicasa3,version=3.0.0 -> F:\Google\Picasa3\npPicasa3.dll No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF Plugin-x32: @movenetworks.com/Quantum Media Player -> C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll (Move Networks)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKCU: @movenetworks.com/Quantum Media Player -> C:\Users\Terry\AppData\Roaming\Move Networks\plugins\npqmp071505000011.dll (Move Networks)FF Plugin HKCU: @octoshape.com/Octoshape Streaming Services,version=1.0 -> C:\Users\Terry\AppData\Roaming\Octoshape\Octoshape Streaming Services\sua-1101262-0-npoctoshape.dll (Octoshape ApS)FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin -> C:\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10171.dll (Amazon.com, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Invenda Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Users\Terry\AppData\Roaming\mozilla\plugins\npoctoshape.dll (Octoshape ApS)FF Extension: Microsoft .NET Framework Assistant - C:\Users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-07-08]FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-10-23]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-10-23]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-10-23]FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-10-23]FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtensionFF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-06-02]FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5FF Extension: DivX Plus Web Player HTML5 <video> - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2013-05-15]FF HKCU\...\Firefox\Extensions: [moveplayer@movenetworks.com] - C:\Users\Terry\AppData\Roaming\Move NetworksFF Extension: Move Media Player - C:\Users\Terry\AppData\Roaming\Move Networks [2010-03-08]FF Extension: No Name - moveplayer@movenetworks.com [Not Found]FF Extension: No Name - {23fcfd51-4958-4f00-80a3-ae97e717ed8b} [Not Found]Chrome:=======CHR HKLM-x32\...\Chrome\Extension: [nneajnkjbffgblleaoojgaacokifdkhm] - C:\Program Files (x86)\DivX\DivX Plus Web Player\chrome\DivXHTML5\DivXHTML5.crx [2013-05-06]==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 Amazon Download Agent; C:\Program Files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderService.exe [401920 2009-10-23] (Amazon.com) [File not signed]R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3242000 2014-08-25] (AVG Technologies CZ, s.r.o.)R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-08-25] (AVG Technologies CZ, s.r.o.)R2 Capture Device Service; C:\Program Files (x86)\Common Files\InterVideo\DeviceService\DevSvc.exe [198168 2007-03-06] (InterVideo Inc.)R2 DockLoginService; C:\Program Files\Dell\DellDock\DockLogin.exe [155648 2008-12-18] (Stardock Corporation) [File not signed]S2 gupdate1c9ee9e3e003430; C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [107912 2014-10-21] (Google Inc.)S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]S3 License Management Service ESD; C:\Program Files (x86)\Common Files\element5 Shared\Service\Licence Manager ESD.exe [69120 2010-01-08] (element5) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)S3 ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [430592 2008-04-07] (Nokia.) [File not signed]S2 SBSDWSCService; F:\Spybot - Search & Destroy\SDWinSec.exe [X]==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation)R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [152344 2014-06-30] (AVG Technologies CZ, s.r.o.)R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [244504 2014-07-21] (AVG Technologies CZ, s.r.o.)R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-08-06] (AVG Technologies CZ, s.r.o.)R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-06-17] (AVG Technologies CZ, s.r.o.)S1 Beep; No ImagePathS3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30304 2010-05-07] ()R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-10-01] (Malwarebytes Corporation)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-10-28] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-10-01] (Malwarebytes Corporation)S3 MSI_DVD_010507; C:\Program Files\MSI\MSIWDev\DVDSYS64_100507.sys [28984 2010-05-10] (Your Corporation)S3 MSI_MSIBIOS_010507; C:\Program Files\MSI\MSIWDev\msibios64_100507.sys [33592 2010-05-10] (Your Corporation)S3 MSI_VGASYS_010507; C:\Program Files\MSI\MSIWDev\VGASYS64_100507.sys [14960 2010-05-10] () [File not signed]R3 msvad_simple; C:\Windows\System32\drivers\povrtdev.sys [28528 2010-02-24] (MediaMall Technologies, Inc.)S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2009-07-23] () [File not signed]S3 UDXTTM6000; C:\Windows\System32\Drivers\UDXTTM6000.sys [366336 2008-03-02] ()S3 UDXTTM6000HID; C:\Windows\System32\drivers\UDXTTM6000HID.sys [17920 2006-06-28] (DTV-DVB)S3 catchme; \??\C:\ComboFix\catchme.sys [X]S3 IpInIp; system32\DRIVERS\ipinip.sys [X]S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2014-10-27 16:31 - 2014-10-27 16:31 - 00001060 _____ () C:\Users\Terry\Desktop\mbam.txt2014-10-27 15:47 - 2014-10-27 15:47 - 00000000 __SHD () C:\Windows\SysWOW64\%APPDATA%2014-10-27 15:19 - 2014-10-27 14:56 - 00024064 _____ () C:\Windows\zoek-delete.exe2014-10-27 14:58 - 2014-10-27 15:43 - 00050330 _____ () C:\zoek-results.log2014-10-27 14:57 - 2014-10-27 15:11 - 00000000 ____D () C:\zoek_backup2014-10-27 14:55 - 2014-10-27 14:55 - 01290752 _____ () C:\Users\Terry\Desktop\zoek.exe2014-10-27 13:21 - 2014-10-27 15:43 - 00000656 _____ () C:\Windows\PFRO.log2014-10-27 13:11 - 2014-10-27 13:11 - 00001697 _____ () C:\Users\Terry\Desktop\JRT.txt2014-10-27 13:06 - 2014-10-27 13:06 - 00000000 ____D () C:\Windows\ERUNT2014-10-27 13:00 - 2014-10-27 13:00 - 01998336 _____ () C:\Users\Terry\Desktop\AdwCleaner.exe2014-10-27 13:00 - 2014-10-27 13:00 - 01706144 _____ (Thisisu) C:\Users\Terry\Desktop\JRT.exe2014-10-27 12:24 - 2014-10-27 12:27 - 00045521 _____ () C:\Users\Terry\Desktop\Addition.txt2014-10-27 12:23 - 2014-10-28 13:02 - 00020815 _____ () C:\Users\Terry\Desktop\FRST.txt2014-10-27 12:23 - 2014-10-27 12:23 - 02113024 _____ (Farbar) C:\Users\Terry\Desktop\FRST64.exe2014-10-25 19:55 - 2014-10-25 19:55 - 00000028 _____ () C:\Windows\SysWOW64\u2014-10-25 19:51 - 2014-10-25 19:51 - 00003856 _____ () C:\Windows\System32\Tasks\{3C2470AF-5CE7-3D2D-2C5B-9A6E35516A1A}2014-10-25 19:51 - 2014-10-25 19:51 - 00000000 _____ () C:\Windows\system32\jqtqvi.dll2014-10-24 15:46 - 2014-10-24 15:46 - 00001758 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk2014-10-24 15:46 - 2014-10-24 15:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime2014-10-24 15:46 - 2014-10-24 15:46 - 00000000 ____D () C:\Program Files (x86)\QuickTime2014-10-24 00:46 - 2014-10-24 00:47 - 00000990 _____ () C:\DelFix.txt2014-10-24 00:43 - 2014-10-24 00:43 - 00000000 ___SD () C:\ComboFix2014-10-23 16:18 - 2014-10-23 16:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-10-23 12:12 - 2014-10-23 12:12 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype2014-10-22 16:28 - 2014-10-28 12:57 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2014-10-22 16:28 - 2014-10-22 16:28 - 00000943 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2014-10-22 16:28 - 2014-10-22 16:28 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-10-22 16:28 - 2014-10-22 16:28 - 00000000 ____D () C:\ProgramData\Malwarebytes2014-10-22 16:28 - 2014-10-22 16:28 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-10-22 16:28 - 2014-10-01 11:11 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2014-10-22 16:28 - 2014-10-01 11:11 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys2014-10-22 16:28 - 2014-10-01 11:11 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys2014-10-22 16:17 - 2014-10-28 12:56 - 00000000 ____D () C:\Users\Terry\AppData\Local\CrashDumps2014-10-22 14:18 - 2014-10-22 14:18 - 00000000 ____D () C:\Program Files (x86)\ESET2014-10-21 11:49 - 2014-10-21 11:49 - 00001009 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ImageReady 7.0.lnk2014-10-21 11:49 - 2014-10-21 11:49 - 00001004 _____ () C:\Users\Terry\Desktop\Adobe Photoshop 7.0.lnk2014-10-20 00:27 - 2014-10-20 01:22 - 00000000 ____D () C:\Windows\erdnt2014-10-19 14:49 - 2014-10-28 13:02 - 00000000 ____D () C:\FRST2014-10-19 13:38 - 2014-10-27 13:19 - 00000000 ____D () C:\AdwCleaner2014-10-19 11:12 - 2014-10-19 11:25 - 00000000 ____D () C:\NPE2014-10-19 11:09 - 2014-10-19 11:50 - 00000000 ____D () C:\Users\Terry\AppData\Local\NPE2014-10-19 11:09 - 2014-10-19 11:09 - 00000000 ____D () C:\ProgramData\Norton2014-10-19 10:33 - 2014-10-19 10:33 - 00000732 _____ () C:\Users\Terry\AppData\Local\d3d9caps64.dat2014-10-19 02:19 - 2014-10-19 02:19 - 00000000 ____D () C:\Users\Terry\Documents\ProcAlyzer Dumps2014-10-19 02:03 - 2014-10-20 00:04 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy 22014-10-19 01:50 - 2014-10-27 15:44 - 00000008 __RSH () C:\ProgramData\ntuser.pol2014-10-16 03:18 - 2014-09-27 16:41 - 02782208 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2014-10-16 03:18 - 2014-09-16 23:57 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll2014-10-16 03:18 - 2014-09-16 09:56 - 00066560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll2014-10-16 03:14 - 2014-06-15 15:18 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll2014-10-16 03:14 - 2014-06-15 15:18 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll2014-10-16 03:14 - 2014-06-13 11:22 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll2014-10-16 03:14 - 2014-06-13 11:22 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll2014-10-16 03:14 - 2014-06-13 10:36 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll2014-10-16 03:14 - 2014-06-13 10:36 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll2014-10-16 03:13 - 2014-09-04 16:38 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fastfat.sys2014-10-15 22:55 - 2014-09-19 17:09 - 17867776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-10-15 22:55 - 2014-09-19 16:55 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-10-15 22:55 - 2014-09-19 16:54 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-10-15 22:55 - 2014-09-19 16:50 - 01385472 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-10-15 22:55 - 2014-09-19 16:49 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-10-15 22:55 - 2014-09-19 16:48 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-10-15 22:55 - 2014-09-19 16:48 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll2014-10-15 22:55 - 2014-09-19 16:48 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-10-15 22:55 - 2014-09-19 16:47 - 02157056 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-10-15 22:55 - 2014-09-19 16:47 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-10-15 22:55 - 2014-09-19 16:46 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-10-15 22:55 - 2014-09-19 16:46 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll2014-10-15 22:55 - 2014-09-19 16:46 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe2014-10-15 22:55 - 2014-09-19 16:45 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-10-15 22:55 - 2014-09-19 16:45 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe2014-10-15 22:55 - 2014-09-19 15:53 - 12364288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-10-15 22:55 - 2014-09-19 15:44 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-10-15 22:55 - 2014-09-19 15:41 - 09739776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-10-15 22:55 - 2014-09-19 15:39 - 01138688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-10-15 22:55 - 2014-09-19 15:38 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-10-15 22:55 - 2014-09-19 15:37 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-10-15 22:55 - 2014-09-19 15:36 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll2014-10-15 22:55 - 2014-09-19 15:36 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-10-15 22:55 - 2014-09-19 15:36 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-10-15 22:55 - 2014-09-19 15:35 - 01802752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-10-15 22:55 - 2014-09-19 15:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll2014-10-15 22:55 - 2014-09-19 15:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-10-15 22:55 - 2014-09-19 15:34 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-10-15 22:55 - 2014-09-19 15:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe2014-10-15 22:55 - 2014-09-19 15:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe2014-10-15 22:55 - 2014-09-19 15:33 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-10-02 14:23 - 2014-10-02 14:23 - 00094208 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTimeVR.qtx2014-10-02 14:23 - 2014-10-02 14:23 - 00069632 _____ (Apple Inc.) C:\Windows\SysWOW64\QuickTime.qts==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2014-10-28 12:59 - 2009-05-21 13:51 - 01888328 _____ () C:\Windows\WindowsUpdate.log2014-10-28 12:57 - 2014-09-01 22:02 - 00000000 ___RD () C:\Users\Terry\Dropbox2014-10-28 12:57 - 2014-09-01 22:00 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Dropbox2014-10-28 12:54 - 2009-06-30 01:21 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-10-28 12:54 - 2006-11-02 08:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-10-28 12:54 - 2006-11-02 08:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A02014-10-28 12:54 - 2006-11-02 08:22 - 00003744 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A02014-10-28 12:53 - 2009-12-16 17:30 - 00000000 _____ () C:\Windows\system32\Drivers\lvuvc.hs2014-10-28 12:52 - 2006-11-02 08:42 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-10-28 12:51 - 2009-06-30 01:21 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-10-28 12:16 - 2011-10-29 12:03 - 00000000 ____D () C:\ProgramData\MFAData2014-10-28 12:15 - 2012-04-05 09:05 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-10-27 19:54 - 2014-09-01 23:43 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\KeePass2014-10-27 15:11 - 2006-11-02 06:34 - 00000000 ___HD () C:\Windows\system32\GroupPolicy2014-10-27 12:45 - 2009-05-21 19:04 - 00000000 ____D () C:\Program Files (x86)\Java2014-10-27 09:53 - 2009-06-22 23:21 - 00000000 ____D () C:\Users\Terry\AppData\Roaming\Skype2014-10-27 09:16 - 2014-04-15 09:56 - 00002413 _____ () C:\Users\Public\Desktop\Skype.lnk2014-10-25 17:54 - 2014-08-23 00:13 - 00000000 ____D () C:\Users\Terry\AppData\Local\Adobe2014-10-24 17:23 - 2009-07-16 21:17 - 00000000 ____D () C:\Windows\Minidump2014-10-24 17:22 - 2011-01-08 00:00 - 00000858 _____ () C:\Users\Public\Desktop\CCleaner.lnk2014-10-24 17:22 - 2010-04-08 17:28 - 00000000 ____D () C:\Program Files (x86)\CCleaner2014-10-24 15:46 - 2009-06-03 12:16 - 00000000 ____D () C:\ProgramData\Apple Computer2014-10-24 01:48 - 2006-11-02 05:34 - 00000180 _____ () C:\Windows\win.ini2014-10-24 00:52 - 2012-05-11 08:48 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2014-10-23 23:58 - 2006-11-02 05:34 - 00000215 _____ () C:\Windows\system.ini2014-10-23 12:12 - 2009-06-22 23:21 - 00000000 ___RD () C:\Program Files (x86)\Skype2014-10-23 12:12 - 2009-06-22 23:21 - 00000000 ____D () C:\ProgramData\Skype2014-10-22 14:01 - 2009-09-16 16:21 - 00000000 ____D () C:\TEMP2014-10-22 14:00 - 2009-06-23 11:23 - 00002275 _____ () C:\Users\Public\Desktop\Jasc Paint Shop Pro 9.lnk2014-10-22 14:00 - 2009-06-23 11:17 - 00000000 ____D () C:\Users\Terry\Documents\My PSP Files2014-10-22 13:36 - 2006-11-02 08:21 - 00404736 _____ () C:\Windows\system32\FNTCACHE.DAT2014-10-21 16:11 - 2009-06-04 12:23 - 00001688 _____ () C:\Users\Public\Desktop\Hoyle Card Games 2003.lnk2014-10-21 00:46 - 2009-06-30 01:21 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA2014-10-21 00:46 - 2009-06-30 01:21 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore2014-10-20 15:48 - 2010-02-09 16:48 - 00000426 _____ () C:\Windows\BRWMARK.INI2014-10-20 15:04 - 2006-11-02 05:46 - 00759582 _____ () C:\Windows\system32\PerfStringBackup.INI2014-10-20 01:23 - 2006-11-02 06:33 - 00000000 __RHD () C:\Users\Default2014-10-20 01:20 - 2009-06-02 17:22 - 00000000 ____D () C:\Users\Terry2014-10-20 00:01 - 2009-12-11 10:25 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy2014-10-16 03:13 - 2013-08-15 03:03 - 00000000 ____D () C:\Windows\system32\MRT2014-10-16 03:00 - 2006-11-02 05:35 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe2014-10-04 09:58 - 2014-06-12 00:00 - 00001582 _____ () C:\Windows\System32\Tasks\Amazon Music Helper2014-10-04 09:58 - 2014-06-12 00:00 - 00000927 _____ () C:\Users\Terry\Desktop\Amazon Music.lnk2014-10-02 15:53 - 2009-10-02 14:07 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exeSome content of TEMP:====================C:\Users\Terry\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphyla6n.dll==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-10-28 13:01==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 27-10-2014 01Ran by Terry at 2014-10-28 13:03:20Running from C:\Users\Terry\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)001 Joiner and Splitter Pro (HKLM-x32\...\001 Joiner and Splitter Pro2.0) (Version: 2.0 - Welltek Software)7-Zip 4.65 (HKLM-x32\...\7-Zip) (Version: - )Acrobat.com (HKLM-x32\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.0.0.4080 - Adobe Systems Incorporated)Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)Adobe Reader X (10.1.12) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.12 - Adobe Systems Incorporated)Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5 - Adobe Systems, Inc.)Amazon 1Button App (HKLM-x32\...\{4D875057-4353-4B8F-93E5-8C3DC7F34EA9}) (Version: 1.0.8 - Amazon)Amazon Games & Software Downloader (HKLM-x32\...\Amazon Games & Software Downloader_is1) (Version: 2.0.2.0 - Amazon)Amazon Kindle (HKLM-x32\...\Amazon Kindle) (Version: - Amazon)Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.4.0.628 - Amazon Services LLC)AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) HiddenAMD Catalyst Install Manager (HKLM\...\{9AB0D5B6-4779-8C4F-CA91-A1FEDB56D7EC}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)Apple Application Support (HKLM-x32\...\{AAC5D43E-816D-4C2D-8E51-55FFF35BE301}) (Version: 3.0.1 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)ArcSoft PhotoBase 4.5 (HKLM-x32\...\{C0BBE46D-5318-485A-8564-D8FA5576ECD4}) (Version: - ArcSoft)ArcSoft PhotoBase 4.5 (Shared Components) (HKLM-x32\...\Uninstaller_B27C5000_ArcSoft PhotoBase 4.5) (Version: 2.60.30 - element5)ArcSoft PhotoStudio 5.5 (HKLM-x32\...\{D2261C4B-4D9B-4149-8472-31B7A2FEAB91}) (Version: - ArcSoft)Astronomy 2005 Screensaver (HKLM-x32\...\Astronomy 2005 Screensaver) (Version: - )ATI AVIVO64 Codecs (Version: 10.10.0.40914 - ATI Technologies Inc.) HiddenAVG 2014 (HKLM\...\AVG) (Version: 2014.0.4765 - AVG Technologies)AVG 2014 (Version: 14.0.4040 - AVG Technologies) HiddenAVG 2014 (Version: 14.0.4765 - AVG Technologies) HiddenBonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Brother HL-2170W (HKLM-x32\...\{689BA753-2D23-470F-8014-B1EC8D61EE95}) (Version: 1.00 - Brother)CameraHelperMsi (x32 Version: 13.25.1010.0 - Logitech) HiddenCanon ScanGear Starter (HKLM-x32\...\{18A5DFF2-8A95-49F3-873F-743CB5549F3D}) (Version: - )CanoScan Toolbox Ver4.9 (HKLM-x32\...\{CA9BCD4D-B782-4637-8F1F-F9A328D3C244}) (Version: - )CarbonPoker (HKCU\...\CarbonPoker) (Version: 5.0 - )CCleaner (HKLM\...\CCleaner) (Version: 4.19 - Piriform)Choice Guard (x32 Version: 1.2.87.0 - Microsoft Corporation) HiddenCompatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Corel AfterShot Pro (HKLM-x32\...\AfterShot Pro) (Version: 1.2.0.7 - Corel Corporation)Darksiders (HKLM-x32\...\Steam App 50620) (Version: - Vigil Games)DarksidersInstaller (HKLM-x32\...\{B93EEE50-9C8F-45DF-95E4-3D85A6E242F3}) (Version: 1.00.1000 - THQ)Dell Dock (HKLM\...\{F6CB42B9-F033-4152-8813-FF11DA8E6A78}) (Version: 1.0.0 - Dell)Dell Edoc Viewer (HKLM\...\{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}) (Version: 1.0.0 - Dell Inc)DigitalTV (HKLM-x32\...\{C19DBE5E-712E-4F02-8380-ECEDD951B374}) (Version: 2.64 - )DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.41 - DivX, LLC)Dropbox (HKCU\...\Dropbox) (Version: 2.10.30 - Dropbox, Inc.)erLT (x32 Version: 1.20.138.34 - Logitech, Inc.) HiddenESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )Google Advertising Cookie Opt-out (HKLM\...\{A2E00B38-848D-4898-9109-BFA37C074DDC}) (Version: 1.0.1.0 - Google Inc)Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) HiddenH&R Block California 2010 (HKLM-x32\...\{9FBDF580-E37F-4DEE-8F2E-75A8E8716AAD}) (Version: 1.10.4801 - HRB Technology, LLC.)H&R Block California 2011 (HKLM-x32\...\{10894714-E82E-4371-9CF7-F58E352C76EA}) (Version: 1.11.5001 - HRB Technology, LLC.)H&R Block California 2012 (HKLM-x32\...\{E040F1EC-82A9-4950-AAFE-55762AB59590}) (Version: 1.12.7501 - HRB Technology, LLC.)H&R Block California 2013 (HKLM-x32\...\{FA9B4B45-B7F0-47A4-894B-19BBF8829FE2}) (Version: 1.13.6701 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2010 (HKLM-x32\...\{10964A8F-21C1-45EA-BC2D-F84B505C3848}) (Version: 10.04.6402 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2011 (HKLM-x32\...\{C6006AED-E5A7-4F77-BAD5-95AC43DE04F3}) (Version: 11.05.6901 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2012 (HKLM-x32\...\{89D20029-0578-4D8D-979A-695C8D868868}) (Version: 12.05.7801 - HRB Technology, LLC.)H&R Block Deluxe + Efile + State 2013 (HKLM-x32\...\{EDE796DE-0A72-464D-9D21-F04BC41A092B}) (Version: 13.05.6502 - HRB Technology, LLC.)Hoyle Card Games 2003 (HKLM-x32\...\InstallShield_{9ABA26E1-843A-4A72-95AF-C72474E191F6}) (Version: 1.0.0.0 - Sierra)Hoyle Card Games 2003 (x32 Version: 1.0.0.0 - Sierra) HiddeniCloud (HKLM\...\{CE97E4D3-9F91-4D72-8A29-ED9EA90E5A15}) (Version: 2.1.3.25 - Apple Inc.)Intel® Network Connections 13.1.33.0 (HKLM\...\PROSetDX) (Version: 13.1.33.0 - Intel)Intel® Network Connections 13.1.33.0 (Version: 13.1.33.0 - Intel) HiddenInterVideo DeviceService (HKLM-x32\...\{521AAD14-5030-44BB-8B0E-5CE65FCE57E0}) (Version: 1.0.0 - InterVideo)InterVideo WinDVD 8 (HKLM-x32\...\InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}) (Version: 8.0-B6.109 - InterVideo Inc.)InterVideo WinDVD 8 (x32 Version: 8.0-B6.109 - InterVideo Inc.) HiddenJasc Animation Shop 3 (HKLM-x32\...\{7C4196CA-CA41-4F34-9C08-7724E7705D52}) (Version: 3.11 - Jasc Software Inc)Jasc Paint Shop Pro 9 (HKLM-x32\...\{F843C6A3-224D-4615-94F8-3C461BD9AEA0}) (Version: 9.01.0000 - Jasc Software Inc)KeePass Password Safe 2.27 (HKLM-x32\...\KeePassPasswordSafe2_is1) (Version: 2.27 - Dominik Reichl)Logitech Vid HD (HKLM-x32\...\Logitech Vid) (Version: 7.2 (7248) - Logitech Inc..)Logitech Webcam Software (HKLM-x32\...\{D40EB009-0499-459c-A8AF-C9C110766215}) (Version: 2.0 - Logitech Inc.)Logitech Webcam Software Driver Package (HKLM\...\lvdrivers_12.10) (Version: 12.10.1110 - Logitech Inc.)LWS VideoEffects (Version: 13.25.1005.0 - Logitech) HiddenMalwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)Manual CanoScan LiDE 500F (HKLM-x32\...\{B9C54C44-BB5A-4B03-8907-C01A9790195A}) (Version: - )Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Office 2000 Disc 2 (HKLM-x32\...\{00040409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)Microsoft Office 2000 Small Business (HKLM-x32\...\{00030409-78E1-11D2-B60F-006097C998E7}) (Version: 9.00.2720 - Microsoft Corporation)Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1171.0714 - Microsoft Corporation)Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175 (HKLM\...\{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}) (Version: 8.0.51011 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Works (HKLM-x32\...\{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}) (Version: 9.7.0621 - Microsoft Corporation)Move Media Player (HKCU\...\Move Media Player) (Version: - Move Networks)Mozilla Firefox 33.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 33.0 (x86 en-US)) (Version: 33.0 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)Nikon Message Center 2 (HKLM-x32\...\{B014EE44-9197-4513-9613-71E6EB1B514E}) (Version: 2.1.0 - Nikon)Nikon Movie Editor (HKLM-x32\...\{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}) (Version: 2.8.0 - Nikon)Octoshape add-in for Adobe Flash Player (HKCU\...\Octoshape add-in for Adobe Flash Player) (Version: - )Octoshape Streaming Services (HKCU\...\Octoshape Streaming Services) (Version: - )OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.)Opanda IExif 2.3 (HKLM-x32\...\Opanda IExif_is1) (Version: 2.3 - Opanda Studio)Opanda PowerExif 1.2 Professional Trial (HKLM-x32\...\Opanda PowerExif Professional Trial_is1) (Version: 1.2 - Opanda Studio)PC Connectivity Solution (HKLM-x32\...\{AC599724-5755-48C1-ABE7-ABB857652930}) (Version: 8.15.0.0 - Nokia)Picasa 3 (HKLM-x32\...\Picasa 3) (Version: 3.8 - Google, Inc.)Picture Control Utility (HKLM-x32\...\{87441A59-5E64-4096-A170-14EFE67200C3}) (Version: 1.2.2 - Nikon)Picture Control Utility x64 (HKLM\...\{11953C65-BB4E-4CA4-B0F0-2600A4B20040}) (Version: 1.4.15 - Nikon)QuickBooks Pro (HKLM-x32\...\QuickBooks Pro) (Version: - )QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5783 - Realtek Semiconductor Corp.)Roxio Creator Audio (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Copy (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Data (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator DE (HKLM-x32\...\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}) (Version: 10.1 - Roxio)Roxio Creator DE (x32 Version: 3.7.0 - Roxio) HiddenRoxio Creator Tools (x32 Version: 3.7.0 - Roxio) HiddenRoxio Express Labeler 3 (x32 Version: 3.2.1 - Roxio) HiddenRoxio Update Manager (x32 Version: 6.0.0 - Roxio) HiddenSD Viewer for DSC (HKLM-x32\...\{5A8D3524-79DB-11D5-99D1-00010256D40E}) (Version: - )Skype Click to Call (HKLM-x32\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.13.13771 - Skype Technologies S.A.)Skype™ 6.21 (HKLM-x32\...\{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}) (Version: 6.21.104 - Skype Technologies S.A.)SmartSound Quicktracks Plugin (HKLM-x32\...\InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}) (Version: 3.0.5.0 - SmartSound Software Inc)SmartSound Quicktracks Plugin (x32 Version: 3.0.5.0 - SmartSound Software Inc) HiddenSpotify (HKLM-x32\...\Spotify) (Version: 0.5.2 - )Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)Stellarium 0.11.4 (HKLM\...\Stellarium_is1) (Version: 0.11.4 - Stellarium team)System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version: - )ubi.com (HKLM-x32\...\{AEDDF5A3-29CE-11D5-A8C2-000102246AAE}) (Version: - )Ulead VideoStudio 11 (HKLM-x32\...\InstallShield_{F99F9E24-EE2F-47FD-AEB0-FDB82859B5C9}) (Version: 11.0.0.0000 - InterVideo Digital Technology Corporation)VC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) HiddenVideoStudio (x32 Version: 11.0.0.0000 - InterVideo Digital Technology Corporation) HiddenViewNX 2 (HKLM\...\{635BE602-BB9C-4C59-8CC5-93F9366E8A21}) (Version: 2.8.2 - Nikon)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{021C4C4F-C93C-4425-BFFD-C2D16776BFAE}) (Version: 8.0.0.35 - GRISOFT, s.r.o.)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)Visual Studio 2008 x64 Redistributables (HKLM-x32\...\{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}) (Version: 10.0.0.2 - AVG Technologies)Visual Studio 2010 x64 Redistributables (HKLM\...\{21B133D6-5979-47F0-BE1C-F6A6B304693F}) (Version: 13.0.0.1 - AVG Technologies)Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)WinDirStat 1.1.2 (HKCU\...\WinDirStat) (Version: - )Windows 7 Upgrade Advisor (HKLM-x32\...\{AB05F2C8-F608-403b-95E1-FD8ADFACD31E}) (Version: 2.0.5000.0 - Microsoft Corporation)Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0) (HKLM\...\BC15EA930074932BB2C4B4493C9FD4EA95087D1A) (Version: 10/12/2007 6.85.4.0 - Nokia)Windows Live Sign-in Assistant (HKLM-x32\...\{9422C8EA-B0C6-4197-B8FC-DC797658CA00}) (Version: 5.000.818.6 - Microsoft Corporation)Windows Live Sync (HKLM-x32\...\{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}) (Version: 14.0.8050.1202 - Microsoft Corporation)Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version: - )Windows Media Encoder 9 Series (x32 Version: 9.00.3374 - Microsoft Corporation) Hidden==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{7B37E4E2-C62F-4914-9620-8FB5062718CC}\localserver32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{8E590317-1329-11D1-B70B-00805F29CD16}\localserver32 -> C:\Program Files (x86)\Intuit\QuickBooks Pro\qbw32.exe (Intuit, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\localserver32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\FileSyncApi64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-227674338-2978312964-2044416110-1000_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)==================== Restore Points =========================02-10-2014 07:42:00 Scheduled Checkpoint03-10-2014 06:52:06 Scheduled Checkpoint04-10-2014 07:31:36 Scheduled Checkpoint05-10-2014 07:00:00 Scheduled Checkpoint06-10-2014 07:17:43 Scheduled Checkpoint09-10-2014 19:11:35 Scheduled Checkpoint10-10-2014 07:54:05 Scheduled Checkpoint11-10-2014 08:20:32 Scheduled Checkpoint12-10-2014 07:32:45 Scheduled Checkpoint13-10-2014 03:49:42 Scheduled Checkpoint14-10-2014 07:00:01 Scheduled Checkpoint15-10-2014 07:54:27 Scheduled Checkpoint16-10-2014 07:00:02 Scheduled Checkpoint16-10-2014 10:00:16 Windows Update17-10-2014 07:55:10 Scheduled Checkpoint17-10-2014 21:13:30 Scheduled Checkpoint19-10-2014 18:39:30 Norton_Power_Eraser_2014101911393001021-10-2014 03:49:19 Scheduled Checkpoint21-10-2014 22:20:51 Scheduled Checkpoint23-10-2014 02:08:51 Scheduled Checkpoint23-10-2014 17:59:24 Scheduled Checkpoint24-10-2014 08:26:19 Windows Update24-10-2014 18:13:35 Installed Java 7 Update 7125-10-2014 07:00:01 Scheduled Checkpoint26-10-2014 07:00:02 Scheduled Checkpoint27-10-2014 07:55:17 Scheduled Checkpoint27-10-2014 19:44:45 Removed Java 7 Update 7127-10-2014 21:58:57 zoek.exe restore point28-10-2014 07:47:26 Windows Update==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2006-11-02 05:34 - 2014-10-20 01:21 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts127.0.0.1 localhost==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {04BAE03B-AD15-4A16-A8C6-56B6C0616671} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Terry => C:\Program Files\Windows Calendar\wincal.exe [2008-01-20] (Microsoft Corporation)Task: {059095CE-546D-42FA-BFB7-E33EEA86785D} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMMTask: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPagesTask: {1FA0A7B4-ED60-4DD0-A86B-5B580DC734EE} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)Task: {25F37DCF-758A-4D40-8AD5-541C7606A708} - System32\Tasks\{3B5C56C1-C525-4A88-BC88-61EE6267BF86} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {33E3A743-D36C-4DF9-ADF2-C23F213D301D} - System32\Tasks\{AE5D3469-07BF-4E7B-928B-3BF5CB113809} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {4221026F-393B-4E5D-A8EC-D65747B252B5} - System32\Tasks\CCleanerSkipUAC => C:\Program Files (x86)\CCleaner\CCleaner.exe [2014-10-23] (Piriform Ltd)Task: {4A15123C-E76F-4D82-B937-7D5243C98D4F} - System32\Tasks\{FE0E2BBA-4C80-4767-89A4-E9ACD7EC1BD1} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {6663F415-D2F8-44BB-895F-3767650B3BA3} - System32\Tasks\{3D2BD65F-DB2E-44BF-B7D4-B095FB17512A} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {73BE57F4-69BB-4A26-8063-8C62FDCE9650} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-21] (Google Inc.)Task: {74E73ABB-3C2E-4E70-81BE-A96408803B53} - System32\Tasks\{601D9548-9905-4246-9B31-F26759BF3791} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {7A74FA86-3C66-4D14-9015-F48ED6785C2E} - System32\Tasks\{6842AD54-94B6-4A61-9BE5-784DA11F3505} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UITask: {7D7FBBF4-4AD3-4CAC-AE0E-2A537530C66F} - System32\Tasks\{D196BA7A-04DD-48D5-9D85-E077ABA37980} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {804C1006-05E5-424D-880B-938CDC97893F} - System32\Tasks\{3C2470AF-5CE7-3D2D-2C5B-9A6E35516A1A} => C:\Windows\system32\yxqjk.dll/s "C:\Windows\system32\yxqjk.dll"Task: {8A678B8E-11EB-4BD0-B154-4AC383C77F85} - System32\Tasks\{4E509FBC-8D20-48B3-BC84-70CD1F5B8430} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {8DF75516-4B1E-4AAE-9DD9-82CA55732D7F} - System32\Tasks\Amazon Music Helper => C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [2014-09-05] ()Task: {91FF7E33-391D-4CD3-93EF-C90A2141CF12} - System32\Tasks\{794A5A98-576A-4AC6-B2F6-7A6AEBBE1CFB} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {936FDF1A-F2F1-4178-B434-D50A40DDA843} - System32\Tasks\{6E98BF58-8743-49B2-B308-4DE4611C776C} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {996EB13C-36C5-4711-911C-BA20B30DF07A} - System32\Tasks\{59E7C911-55A9-4C3E-B8D2-17DF1B71CBD7} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {9C62F2EB-3709-4238-9408-83463879928F} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)Task: {9C639299-8693-461C-9CB2-45D1A0FF2D8A} - System32\Tasks\{E503D6A6-1A96-49AB-A045-19E3A4F5DC74} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {C4CF95F9-568A-4311-81F4-7DF6A379CA76} - System32\Tasks\{DB0D0ADC-9968-4EAE-986D-62664CE01A59} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {CA62A84B-F5D8-494B-9526-C9C18D45A06A} - System32\Tasks\{945D3406-F7FA-4D61-96AA-8B434EE19EAD} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2014-10-01] (Skype Technologies S.A.)Task: {DE5F040D-02BF-482C-936F-ADD968366CF5} - System32\Tasks\{DF5DE0A7-5C1B-4991-B5D0-CC2F00C6A55C} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {E09DB6C2-0533-4D35-8229-FBAC11C2A77D} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-24] (Adobe Systems Incorporated)Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()Task: {EE12B1A3-7823-4EC6-9089-AA4CC209033D} - System32\Tasks\{05E3AA6F-390E-4F95-B09F-B23A7A691C38} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {F6E17BA7-1D87-482D-B956-B9A9E9F2366C} - System32\Tasks\{23020DA5-E10F-49C1-9AE8-B4E2F5F23E7F} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: {F83E7E02-FA8B-4B8D-9506-4010AD28F308} - System32\Tasks\{BEB37EE1-93B4-4734-8BA9-884601E030FD} => Iexplore.exe http://ui.skype.com/ui/0/6.14.0.104/en/abandoninstall?page=tsProgressBarTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) =============2013-10-31 14:47 - 2013-10-31 14:47 - 00954696 _____ () C:\Program Files\Common Files\Apple\Internet Services\ShellStreams64.dll2011-04-20 01:21 - 2013-03-28 18:07 - 00045056 _____ () C:\Windows\system32\atitmp64.dll2014-06-11 23:59 - 2014-09-05 17:54 - 06281536 _____ () C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe2014-02-12 20:58 - 2014-02-12 20:58 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-02-12 20:58 - 2014-02-12 20:58 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2010-05-07 19:35 - 2010-05-07 19:35 - 02143576 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtCore4.dll2010-05-07 19:35 - 2010-05-07 19:35 - 07954776 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtGui4.dll2010-05-07 19:36 - 2010-05-07 19:36 - 00340824 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\QtXml4.dll2010-05-07 19:37 - 2010-05-07 19:37 - 00027480 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QGif4.dll2010-05-07 19:37 - 2010-05-07 19:37 - 00126808 _____ () C:\Program Files (x86)\Logitech\LWS\Webcam Software\imageformats\QJpeg4.dll2014-10-28 12:56 - 2014-10-28 12:56 - 00043008 _____ () c:\users\terry\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmphyla6n.dll2013-08-23 12:01 - 2013-08-23 12:01 - 25100288 _____ () C:\Users\Terry\AppData\Roaming\Dropbox\bin\libcef.dll2007-02-05 17:34 - 2007-02-05 17:34 - 00116248 _____ () C:\Program Files (x86)\Common Files\InterVideo\Common\Bin\MpgTsRdr.ax==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) =============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== MSCONFIG/TASK MANAGER disabled items =========(Currently there is no automatic fix for this section.)MSCONFIG\startupreg: DivXMediaServer => "C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe"MSCONFIG\startupreg: DivXUpdate => "C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW========================= Accounts: ==========================Administrator (S-1-5-21-227674338-2978312964-2044416110-500 - Administrator - Disabled)Guest (S-1-5-21-227674338-2978312964-2044416110-501 - Limited - Disabled)Mcx1 (S-1-5-21-227674338-2978312964-2044416110-1006 - Administrator - Enabled) => C:\Users\Mcx1Terry (S-1-5-21-227674338-2978312964-2044416110-1000 - Administrator - Enabled) => C:\Users\Terry==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (10/28/2014 00:58:43 PM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.Error: (10/28/2014 00:56:11 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/28/2014 00:55:41 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application mbam.exe, version 1.0.1.711, time stamp 0x542b53ec, faulting module kernel32.dll, version 6.0.6002.18881, time stamp 0x51da3e00, exception code 0xc0000142, fault offset 0x0006f52f,process id 0xe4c, application start time 0xmbam.exe0.Error: (10/28/2014 00:47:40 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application mbam.exe, version 1.0.1.711, time stamp 0x542b53ec, faulting module gdiplus.dll_unloaded, version 0.0.0.0, time stamp 0x535bd814, exception code 0xc0000005, fault offset 0x72b374b2,process id 0x4828, application start time 0xmbam.exe0.Error: (10/27/2014 07:53:32 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\48929E005E4E21C666CDF7CB9517DCBB1B7C1DF0> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/27/2014 07:53:32 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\48929E005E4E21C666CDF7CB9517DCBB1B7C1DF0> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/27/2014 06:11:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\A4F72B91A46697E2A2B407CE3867E27A461C74F1> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/27/2014 06:11:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\A4F72B91A46697E2A2B407CE3867E27A461C74F1> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/27/2014 06:11:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\A4F72B91A46697E2A2B407CE3867E27A461C74F1> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)Error: (10/27/2014 06:11:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: The entry <C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\A4F72B91A46697E2A2B407CE3867E27A461C74F1> in the hash map cannot be updated.Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)System errors:=============Error: (10/28/2014 00:59:50 PM) (Source: Service Control Manager) (EventID: 7031) (User: )Description: Windows Modules Installer11200001Restart the serviceError: (10/28/2014 00:57:16 PM) (Source: Service Control Manager) (EventID: 7026) (User: )Description: BeepStarOpenError: (10/28/2014 00:57:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: SBSD Security Center Service%%3Error: (10/28/2014 00:54:08 PM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)Description: The print spooler failed to share printer Brother HL-2170W series with shared resource name Brother HL-2170W series. Error 2114. The printer cannot be used by others on the network.Error: (10/28/2014 00:54:08 PM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)Description: The print spooler failed to share printer Canon Inkjet PIXMA iP5000 with shared resource name Canon Inkjet PIXMA iP5000. Error 2114. The printer cannot be used by others on the network.Error: (10/28/2014 00:53:11 PM) (Source: Application Popup) (EventID: 1060) (User: )Description: \SystemRoot\SysWow64\Drivers\StarOpen.SYS has been blocked from loading due to incompatibility with this system. Please contact your software vendor for a compatible version of the driver.Error: (10/27/2014 03:44:51 PM) (Source: Service Control Manager) (EventID: 7026) (User: )Description: BeepStarOpenError: (10/27/2014 03:44:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )Description: SBSD Security Center Service%%3Error: (10/27/2014 03:43:23 PM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)Description: The print spooler failed to share printer Brother HL-2170W series with shared resource name Brother HL-2170W series. Error 2114. The printer cannot be used by others on the network.Error: (10/27/2014 03:43:23 PM) (Source: Print) (EventID: 19) (User: NT AUTHORITY)Description: The print spooler failed to share printer Canon Inkjet PIXMA iP5000 with shared resource name Canon Inkjet PIXMA iP5000. Error 2114. The printer cannot be used by others on the network.Microsoft Office Sessions:=========================Error: (10/28/2014 00:58:43 PM) (Source: MsiInstaller) (EventID: 1013) (User: NT AUTHORITY)Description: Product: Skype Click to Call -- Installation cannot proceed on this operating system.(NULL)(NULL)(NULL)(NULL)Error: (10/28/2014 00:56:11 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (10/28/2014 00:55:41 PM) (Source: Application Error) (EventID: 1000) (User: )Description: mbam.exe1.0.1.711542b53eckernel32.dll6.0.6002.1888151da3e00c00001420006f52fe4c01cff2e91ace4b9dError: (10/28/2014 00:47:40 AM) (Source: Application Error) (EventID: 1000) (User: )Description: mbam.exe1.0.1.711542b53ecgdiplus.dll_unloaded0.0.0.0535bd814c000000572b374b2482801cff243c58a935aError: (10/27/2014 07:53:32 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\48929E005E4E21C666CDF7CB9517DCBB1B7C1DF0Error: (10/27/2014 07:53:32 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\48929E005E4E21C666CDF7CB9517DCBB1B7C1DF0Error: (10/27/2014 06:11:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\A4F72B91A46697E2A2B407CE3867E27A461C74F1Error: (10/27/2014 06:11:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\A4F72B91A46697E2A2B407CE3867E27A461C74F1Error: (10/27/2014 06:11:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\A4F72B91A46697E2A2B407CE3867E27A461C74F1Error: (10/27/2014 06:11:46 PM) (Source: Windows Search Service) (EventID: 3013) (User: )Description: Context: Application, SystemIndex CatalogDetails: A device attached to the system is not functioning. (0x8007001f)C:\USERS\TERRY\APPDATA\LOCAL\MOZILLA\FIREFOX\PROFILES\HZI3CJGP.DEFAULT\CACHE2\ENTRIES\A4F72B91A46697E2A2B407CE3867E27A461C74F1CodeIntegrity Errors:=================================== Date: 2014-10-28 13:02:43.130 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 13:02:42.897 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 13:02:42.688 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 13:02:42.499 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsha.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 12:57:10.380 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 10:43:06.721 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 10:43:06.512 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 10:43:06.311 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 10:43:06.103 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system. Date: 2014-10-28 10:43:00.165 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Windows\System32\drivers\avgidsdrivera.sys because the set of per-page image hashes could not be found on the system.==================== Memory info ===========================Processor: Intel® Core i7 CPU 920 @ 2.67GHzPercentage of memory in use: 22%Total physical RAM: 12278.26 MBAvailable physical RAM: 9476.96 MBTotal Pagefile: 24481.55 MBAvailable Pagefile: 21886.16 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.83 MB==================== Drives ================================Drive c: (OS) (Fixed) (Total:581.1 GB) (Free:378.82 GB) NTFS ==>[Drive with boot components (obtained from BCD)]Drive d: (RECOVERY) (Fixed) (Total:15 GB) (Free:8.53 GB) NTFSDrive k: (Seagate Expansion Drive) (Fixed) (Total:1863.01 GB) (Free:1792.53 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596.2 GB) (Disk ID: B8000000)Partition 1: (Not Active) - (Size=71 MB) - (Type=DE)Partition 2: (Not Active) - (Size=15 GB) - (Type=07 NTFS)Partition 3: (Active) - (Size=581.1 GB) - (Type=07 NTFS)Attempted reading MBR returned 0 bytes. Could not read MBR for disk 1.==================== End Of Log ============================AVG snagged this just before I ran Farbar. Malwarebytes is unstable too and closes. I got stuff embedded. No obvious reasons to be infected. Link to post Share on other sites More sharing options...
Naathim Posted October 29, 2014 ID:898243 Share Posted October 29, 2014 Something is totally not right here. I am cleaning and new threads are arriving. I need to grab some deeper scans. Scan with GmerThis type of scan often produces false positives. At any point do not take any action for any suspicious entries you may see there. Instead post the log to be analyzed.Please download GMER by Gmer and save the file to your desktop.It will come as a randomly named file (like a6ge38b4.exe) - that's absolutely normal.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.If you are a user of CD emulation software (like Daemon Tools or Alcohol) also disable it for the cleaning process - instructions here.Right-click on randomly named icon and select Run as Administrator to start the tool.It is very important that you do not use your computer while Gmer is running!Gmer will open to the Rootkit/Malware tab and perform an automatic quick scan.If you receive a warning about rootkit activity and are asked to fully scan your system click NO!When the pre-scan is completed, please do the following:Please check in the Quick scan box.Please uncheck the IAT/EAT and Show All.Click Scan.If you see a rootkit warning window click OK.When the scan is finished, Save the results to your desktop as gmer.log.Please include the content of this file in your next reply.Don't forget to re-enable previously switched-off protection software! If you encounter any problems, try running GMER in Safe Mode. If GMER crashes or keeps resulting in a Blue Screen of Death, uncheck Devices on the right side before scanning. Scan with RogueKillerPlease download RogueKiller and save the file to your desktop.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Right-click on icon and select Run as Administrator to start the tool.Wait patiently until the pre-scan will be done. It shouldn't take more than 2-3 minutes.Accept the Terms of use.When the Scan button becomes available, please click it. RogueKiller will start a full scan.Let this process run uninterrupted!.When finished, a Report button will become available. Click it. You will be presented with a logfile.Please include the content of this logfile in your next reply. Link to post Share on other sites More sharing options...
TerryH Posted October 29, 2014 Author ID:898784 Share Posted October 29, 2014 Malwarebytes has not seen any outgoing since AVG deleted those trojan files. It's been almost 24 hours. GMER 2.1.19357 - http://www.gmer.netRootkit scan 2014-10-29 11:17:20Windows 6.0.6002 Service Pack 2 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD6400AAKS-75A7B2 rev.01.03B01 596.17GBRunning: oh1uy8jt.exe; Driver: C:\Users\Terry\AppData\Local\Temp\kgloipob.sys---- Kernel code sections - GMER 2.1 ----INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modificationINITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modificationINITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modificationINITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification---- Threads - GMER 2.1 ----Thread C:\Windows\system32\SearchIndexer.exe [3416:4688] 000007fef1cb39f0---- Processes - GMER 2.1 ----Library C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2228] (Microsoft OneDrive Shell Extension/Microsoft Corporation)(2014-09-01 16:44:15) 000007fefa1b0000Library C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\MSVCP110.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2228] (Microsoft® C Runtime Library/Microsoft Corporation)(2014-09-01 16:44:18) 000007fef9970000Library C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\MSVCR110.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2228] (Microsoft® C Runtime Library/Microsoft Corporation)(2014-09-01 16:44:15) 000007fef98a0000Library C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2228] (Dropbox Shell Extension/Dropbox, Inc.)(2014-06-24 21:08:00) 000007fef9870000Process C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe (*** suspicious ***) @ C:\Users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe [2796](2014-06-12 06:59:55) 00000000010b0000Process C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe (*** suspicious ***) @ C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe [3012] (Dropbox/Dropbox, Inc.)(2014-09-13 00:52:04) 0000000000400000Library C:\Users\Terry\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll (*** suspicious ***) @ C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe [3012](2014-09-13 00:20:58) 00000000041f0000Library c:\users\terry\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpjdcrgs.dll (*** suspicious ***) @ C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe [3012](2014-10-29 17:00:56) 00000000040e0000Library C:\Users\Terry\AppData\Roaming\Dropbox\bin\libcef.dll (*** suspicious ***) @ C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe [3012](2013-08-23 19:01:44) 000000006b1b0000Library C:\Users\Terry\AppData\Roaming\Dropbox\bin\icudt.dll (*** suspicious ***) @ C:\Users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe [3012] (ICU Data DLL/The ICU Project)(2013-08-23 19:01:42) 0000000067510000Library C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll (*** suspicious ***) @ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [5720] (Microsoft OneDrive Shell Extension/Microsoft Corporation)(2014-09-01 16:44:16) 00000000737c0000Library C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\MSVCP110.dll (*** suspicious ***) @ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [5720] (Microsoft® C Runtime Library/Microsoft Corporation)(2014-09-01 16:44:15) 0000000072940000Library C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\MSVCR110.dll (*** suspicious ***) @ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [5720] (Microsoft® C Runtime Library/Microsoft Corporation)(2014-09-01 16:44:15) 000000006ecb0000Library C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\Telemetry.dll (*** suspicious ***) @ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [5720] (Telemetry Library/Microsoft Corporation)(2014-09-01 16:44:15) 000000006f620000Library C:\Users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\logging.dll (*** suspicious ***) @ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [5720] (Logging Library/Microsoft Corporation)(2014-09-01 16:44:15) 0000000074cc0000Library C:\Users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll (*** suspicious ***) @ C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe [5720] (Dropbox Shell Extension/Dropbox, Inc.)(2014-06-24 21:08:00) 0000000072910000---- EOF - GMER 2.1 ---- RogueKiller V10.0.4.0 (x64) [Oct 29 2014] by Adlice Softwaremail : http://www.adlice.com/contact/Feedback : http://forum.adlice.comWebsite : http://www.adlice.com/softwares/roguekiller/Blog : http://www.adlice.comOperating System : Windows Vista (6.0.6002 Service Pack 2) 64 bits versionStarted in : Normal modeUser : Terry [Administrator]Mode : Scan -- Date : 10/29/2014 14:22:59¤¤¤ Processes : 0 ¤¤¤¤¤¤ Registry : 33 ¤¤¤[Hj.RegVal] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_A442\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell : cmd.exe /k start cmd.exe -> Found[Hj.RegVal] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_A442\Microsoft\Windows NT\CurrentVersion\Winlogon | Shell : cmd.exe /k start cmd.exe -> Found[Hidden.From.SCM] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\AFD (\SystemRoot\system32\drivers\afd.sys) -> Found[PUM.HomePage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Found [PUM.HomePage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Found [PUM.HomePage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Found [PUM.HomePage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Start Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome -> Found [PUM.SearchPage] (X64) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] (X86) HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] (X64) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.SearchPage] (X86) HKEY_USERS\S-1-5-18\Software\Microsoft\Internet Explorer\Main | Search Page : http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch -> Found [PUM.StartMenu] (X64) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> Found[PUM.StartMenu] (X86) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced | Start_ShowRecentDocs : 0 -> Found[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {645FF040-5081-101B-9F08-00AA002F954E} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {645FF040-5081-101B-9F08-00AA002F954E} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_A442\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\RK_Software_ON_D_A442\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_A442\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\RK_Software_ON_D_A442\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {645FF040-5081-101B-9F08-00AA002F954E} : 1 -> Found[PUM.DesktopIcons] (X64) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {645FF040-5081-101B-9F08-00AA002F954E} : 1 -> Found[PUM.DesktopIcons] (X86) HKEY_USERS\S-1-5-21-227674338-2978312964-2044416110-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031A47-3F72-44A7-89C5-5595FE6B30EE} : 1 -> Found¤¤¤ Tasks : 0 ¤¤¤¤¤¤ Files : 0 ¤¤¤¤¤¤ Hosts File : 1 ¤¤¤[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost¤¤¤ Antirootkit : 1 (Driver: Loaded) ¤¤¤[Filter(Kernel.Filter)] \Driver\atapi @ Unknown : \Driver\cdrom @ \Device\CdRom0 (\SystemRoot\system32\DRIVERS\1394BUS.SYS)¤¤¤ Web browsers : 1 ¤¤¤[PUM.HomePage][FIREFX:Config] hzi3cjgp.default : user_pref("browser.startup.homepage", "http://my.yahoo.com/"); -> Found ¤¤¤ MBR Check : ¤¤¤+++++ PhysicalDrive0: WDC WD6400AAKS-75A7B2 ATA Device +++++--- User ---[MBR] 62f6257a2c405e3bf5d5eba7b156ba49[bSP] 8abefccd33de0d42deccd99166f8f0d0 : HP MBR CodePartition table:0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 70 MB1 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 145408 | Size: 15360 MB2 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 31602688 | Size: 595048 MBUser = LL1 ... OKUser = LL2 ... OK+++++ PhysicalDrive1: Seagate Expansion Desk USB Device +++++Error reading User MBR! ([57] The parameter is incorrect. )Error reading LL1 MBR! ([79] The semaphore timeout period has expired. )Error reading LL2 MBR! ([32] The request is not supported. )+++++ PhysicalDrive2: TEAC USB HS-CF Card USB Device +++++Error reading User MBR! ([15] The device is not ready. )Error reading LL1 MBR! NOT VALID!Error reading LL2 MBR! ([32] The request is not supported. )+++++ PhysicalDrive3: TEAC USB HS-xD/SM USB Device +++++Error reading User MBR! ([15] The device is not ready. )Error reading LL1 MBR! NOT VALID!Error reading LL2 MBR! ([32] The request is not supported. )+++++ PhysicalDrive4: TEAC USB HS-MS Card USB Device +++++Error reading User MBR! ([15] The device is not ready. )Error reading LL1 MBR! NOT VALID!Error reading LL2 MBR! ([32] The request is not supported. )+++++ PhysicalDrive5: TEAC USB HS-SD Card USB Device +++++Error reading User MBR! ([15] The device is not ready. )Error reading LL1 MBR! NOT VALID!Error reading LL2 MBR! ([32] The request is not supported. ) Link to post Share on other sites More sharing options...
Naathim Posted October 30, 2014 ID:899098 Share Posted October 30, 2014 Hi Scan with ComboFixThis is a very powerful tool that should be used only if advised by Malware Analyst.Do not run ComboFix on your own!Referring to this instruction, please download ComboFix by sUBs and save it to your desktop.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.If you are a user of CD emulation software (like Daemon Tools or Alcohol) also disable it for the cleaning process - instructions here.Right-click on icon and select Run as Administrator to start the tool.Accept the disclaimer and agree if prompted to install Recovery Console.Do not take any actions while ComboFix goes through your System - it may cause it to stall!This scan may take some time!When finished - it will display a logfile (located also on your main drive, usually C:\ComboFix.txt).Include that log in your next reply. If you'll encounter any issues with internet connection after running ComboFix, please visit this link. If an error about operation on the key marked for deletion will appear after running the tool, please reboot your machine. Don't forget to re-enable your previously switched-off protection software! Link to post Share on other sites More sharing options...
TerryH Posted October 30, 2014 Author ID:899561 Share Posted October 30, 2014 ComboFix 14-10-29.01 - Terry 10/30/2014 12:09:47.1.8 - x64Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.12278.8689 [GMT -7:00]Running from: c:\users\Terry\Desktop\ComboFix.exeAV: AVG AntiVirus 2014 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}SP: AVG AntiVirus 2014 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\windows\msdownld.tmp..((((((((((((((((((((((((( Files Created from 2014-09-28 to 2014-10-30 )))))))))))))))))))))))))))))))..2014-10-30 09:07 . 2014-10-30 09:07 75888 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A011F925-34A0-4F0A-9E94-4EC79B7684DB}\offreg.dll2014-10-30 00:17 . 2014-10-20 10:37 11627712 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A011F925-34A0-4F0A-9E94-4EC79B7684DB}\mpengine.dll2014-10-29 18:20 . 2014-10-29 21:18 37624 ----a-w- c:\windows\system32\drivers\TrueSight.sys2014-10-29 18:20 . 2014-10-29 18:20 -------- d-----w- c:\programdata\RogueKiller2014-10-27 22:47 . 2014-10-27 22:47 -------- d-sh--w- c:\windows\SysWow64\%APPDATA%2014-10-27 22:19 . 2014-10-27 21:56 24064 ----a-w- c:\windows\zoek-delete.exe2014-10-27 21:57 . 2014-10-27 22:11 -------- d-----w- C:\zoek_backup2014-10-27 20:06 . 2014-10-27 20:06 -------- d-----w- c:\windows\ERUNT2014-10-26 02:51 . 2014-10-26 02:51 0 ----a-w- c:\windows\system32\jqtqvi.dll2014-10-24 22:46 . 2014-10-24 22:46 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin5.dll2014-10-24 22:46 . 2014-10-24 22:46 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin4.dll2014-10-24 22:46 . 2014-10-24 22:46 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin3.dll2014-10-24 22:46 . 2014-10-24 22:46 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin2.dll2014-10-24 22:46 . 2014-10-24 22:46 159744 ----a-w- c:\program files (x86)\Internet Explorer\Plugins\npqtplugin.dll2014-10-24 22:46 . 2014-10-24 22:46 -------- d-----w- c:\program files (x86)\QuickTime2014-10-23 19:12 . 2014-10-23 19:12 -------- d-----w- c:\program files (x86)\Common Files\Skype2014-10-22 23:28 . 2014-10-30 16:38 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys2014-10-22 23:28 . 2014-10-22 23:28 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware2014-10-22 23:28 . 2014-10-22 23:28 -------- d-----w- c:\programdata\Malwarebytes2014-10-22 23:28 . 2014-10-01 18:11 64216 ----a-w- c:\windows\system32\drivers\mwac.sys2014-10-22 23:28 . 2014-10-01 18:11 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys2014-10-22 23:28 . 2014-10-01 18:11 25816 ----a-w- c:\windows\system32\drivers\mbam.sys2014-10-22 23:17 . 2014-10-29 21:28 -------- d-----w- c:\users\Terry\AppData\Local\CrashDumps2014-10-22 21:18 . 2014-10-22 21:18 -------- d-----w- c:\program files (x86)\ESET2014-10-19 21:49 . 2014-10-28 20:06 -------- d-----w- C:\FRST2014-10-19 20:38 . 2014-10-27 20:19 -------- d-----w- C:\AdwCleaner2014-10-19 18:12 . 2014-10-19 18:25 -------- d-----w- C:\NPE2014-10-19 18:09 . 2014-10-19 18:50 -------- d-----w- c:\users\Terry\AppData\Local\NPE2014-10-19 18:09 . 2014-10-19 18:09 -------- d-----w- c:\programdata\Norton2014-10-19 09:03 . 2014-10-20 07:04 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy 22014-10-16 10:18 . 2014-09-17 06:57 76800 ----a-w- c:\windows\system32\packager.dll2014-10-16 10:18 . 2014-09-16 16:56 66560 ----a-w- c:\windows\SysWow64\packager.dll2014-10-16 10:18 . 2014-09-27 23:41 2782208 ----a-w- c:\windows\system32\win32k.sys2014-10-16 10:14 . 2014-06-15 22:18 1131664 ----a-w- c:\windows\SysWow64\dfshim.dll2014-10-16 10:14 . 2014-06-15 22:18 1943696 ----a-w- c:\windows\system32\dfshim.dll2014-10-16 10:14 . 2014-06-13 18:22 81560 ----a-w- c:\windows\SysWow64\mscories.dll2014-10-16 10:14 . 2014-06-13 18:22 156824 ----a-w- c:\windows\SysWow64\mscorier.dll2014-10-16 10:14 . 2014-06-13 17:36 73880 ----a-w- c:\windows\system32\mscories.dll2014-10-16 10:14 . 2014-06-13 17:36 156312 ----a-w- c:\windows\system32\mscorier.dll2014-10-16 10:13 . 2014-09-04 23:38 198656 ----a-w- c:\windows\system32\drivers\fastfat.sys2014-10-02 21:23 . 2014-10-02 21:23 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx2014-10-02 21:23 . 2014-10-02 21:23 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2014-10-16 10:00 . 2006-11-02 12:35 103265616 ----a-w- c:\windows\system32\mrt.exe2014-10-02 22:53 . 2009-10-02 21:07 278152 ------w- c:\windows\system32\MpSigStub.exe2014-09-24 17:15 . 2012-04-05 16:05 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe2014-09-24 17:15 . 2011-05-20 05:10 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl2014-09-09 06:40 . 2014-09-24 07:18 2048 ----a-w- c:\windows\system32\tzres.dll2014-09-09 06:24 . 2014-09-24 07:18 2048 ----a-w- c:\windows\SysWow64\tzres.dll2014-08-23 01:05 . 2014-08-28 10:00 304128 ----a-w- c:\windows\SysWow64\gdi32.dll2014-08-23 00:42 . 2014-08-28 10:00 390144 ----a-w- c:\windows\system32\gdi32.dll2014-08-06 17:50 . 2014-08-06 17:50 123672 ----a-w- c:\windows\system32\drivers\avgmfx64.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shownREGEDIT4.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]2014-09-01 16:44 233128 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\SkyDriveShell.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 131480 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt.24.dll.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ISUSPM"="c:\program files (x86)\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-21 213936]"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]"Amazon Music"="c:\users\Terry\AppData\Local\Amazon Music\Amazon Music Helper.exe" [2014-09-06 6281536].[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]"OpwareSE2"="c:\program files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]"UVS11 Preload"="c:\program files (x86)\Ulead Systems\Ulead VideoStudio 11\uvPL.exe" [2007-07-23 341232]"BrStsWnd"="c:\program files (x86)\Brownie\BrstsW64.exe" [2009-06-11 3695416]"LWS"="c:\program files (x86)\Logitech\LWS\Webcam Software\LWS.exe" [2011-03-02 190808]"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2014-08-21 959176]"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-02-13 43848]"AmazonGSDownloaderTray"="c:\program files (x86)\Amazon\Amazon Games & Software Downloader\AmazonGSDownloaderTray.exe" [2009-10-23 326144]"Nikon Message Center 2"="c:\program files (x86)\Nikon\Nikon Message Center 2\NkMC2.exe" [2011-10-30 571392]"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-03-29 642656]"AVG_UI"="c:\program files (x86)\AVG\AVG2014\avgui.exe" [2014-08-25 5188112]"KeePass 2 PreLoad"="c:\program files (x86)\KeePass Password Safe 2\KeePass.exe" [2014-07-06 2117632]"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888].c:\users\Terry\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk - c:\users\Terry\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-12 36414624].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk - c:\program files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-6-3 113664].c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe /firstrun [2009-2-6 1312096].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"EnableLUA"= 0 (0x0)"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]"LoadAppInit_DLLs"=1 (0x1)"AppInit_DLLs"=c:\progra~2\Amazon\AMAZON~2\AmazonExtIE.dll.[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]@="Service".S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [x]..--- Other Services/Drivers In Memory ---.*NewlyCreated* - MBAMSWISSARMY*Deregistered* - TrueSight.HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcsThemes.[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{981b174d-7733-4e7f-b89d-6545a7c21838}]2014-05-23 21:45 189952 ----a-w- c:\program files (x86)\Amazon\Amazon1ButtonApp\Amazon1ButtonTaskbarApp.exe.Contents of the 'Scheduled Tasks' folder.2014-10-30 c:\windows\Tasks\Adobe Flash Player Updater.job- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-05 17:15].2014-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16 07:46].2014-10-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2009-06-16 07:46]..--------- X64 Entries -----------..[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]2014-09-01 16:44 260776 ----a-w- c:\users\Terry\AppData\Local\Microsoft\SkyDrive\17.3.1171.0714_3\amd64\SkyDriveShell64.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"]@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"]@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"]@="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"]@="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"]@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"]@="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"]@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"]@="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}"[HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}]2014-06-24 21:08 164760 ----a-w- c:\users\Terry\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll.[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-02-24 6975520].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]"AppInit_DLLs"=c:\progra~2\Amazon\AMAZON~2\AmazonExtIE64.dll.------- Supplementary Scan -------.uLocal Page = c:\windows\system32\blank.htmuStart Page = hxxp://www.google.commLocal Page = c:\windows\SysWOW64\blank.htmIE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200IE: Locate Spot on Map by GPS - c:\program files (x86)\Opanda\IExif 2.3\IExifMap.htmIE: View Exif/GPS/IPTC with IExif - c:\program files (x86)\Opanda\IExif 2.3\IExifCom.htmTCP: DhcpNameServer = 192.168.1.1FF - ProfilePath - c:\users\Terry\AppData\Roaming\Mozilla\Firefox\Profiles\hzi3cjgp.default\FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/FF - ExtSQL: !HIDDEN! 2009-06-25 03:10; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension.- - - - ORPHANS REMOVED - - - -.Wow6432Node-HKCU-Run-WMPNSCFG - c:\program files (x86)\Windows Media Player\WMPNSCFG.exeSafeBoot-WudfPfSafeBoot-WudfRdAddRemove-Adobe Shockwave Player - c:\windows\system32\Adobe\Shockwave 11\uninstaller.exeAddRemove-AfterShot Pro - f:\corel\Corel AfterShot Pro\uninstall.exeAddRemove-Astronomy 2005 Screensaver - c:\program files (x86)\Edible EntertainmentAddRemove-Picasa 3 - f:\google\Picasa3\Uninstall.exeAddRemove-{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1 - f:\spybot - search & destroy\unins000.exe...--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]@Denied: (A 2) (Everyone)@="IFlashBroker6".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation]"Enabled"=dword:00000001.[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Shockwave Flash Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]@="0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]@="ShockwaveFlash.ShockwaveFlash.15".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="ShockwaveFlash.ShockwaveFlash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]@Denied: (A 2) (Everyone)@="Macromedia Flash Factory Object".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx""ThreadingModel"="Apartment".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]@="FlashFactory.FlashFactory.1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]@="{D27CDB6B-AE6D-11cf-96B8-444553540000}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]@="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]@="FlashFactory.FlashFactory".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}]@Denied: (A 2) (Everyone)@="IFlashBroker6".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]@Denied: (A 2) (Everyone).[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]@="Shockwave Flash".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]@Denied: (A 2) (Everyone)@="".[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]@="FlashBroker".[HKEY_LOCAL_MACHINE\software\Wow6432Node\Classes]"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\.Completion time: 2014-10-30 12:26:52ComboFix-quarantined-files.txt 2014-10-30 19:26.Pre-Run: 405,912,723,456 bytes freePost-Run: 405,884,960,768 bytes free.- - End Of File - - 898A33BB0A4403EB9E74E8C057D3BB715C616939100B85E558DA92B899A0FC36 Link to post Share on other sites More sharing options...
Naathim Posted October 30, 2014 ID:899632 Share Posted October 30, 2014 Hi That is all fine. Is there still something strange happening? Link to post Share on other sites More sharing options...
TerryH Posted October 30, 2014 Author ID:899722 Share Posted October 30, 2014 It's been 2 days since Malwarebytes has detected any outgoing. Looks good..... right now. Link to post Share on other sites More sharing options...
Naathim Posted October 31, 2014 ID:899914 Share Posted October 31, 2014 OK, let's clean my mess. Clean with DelFixPlease download DelFix by Xplode and save it to your desktop.Right-click on icon and select Run as Administrator to start the tool.Ensure that Remove disinfection tools, Purge system restore and Reset system settings are checked.Push Run.When finished, it will display a notepad report.Include it for my review.Please also manually reboot your machine after posting your logfile. Link to post Share on other sites More sharing options...
TerryH Posted October 31, 2014 Author ID:900269 Share Posted October 31, 2014 # DelFix v10.8 - Logfile created 31/10/2014 at 13:14:35# Updated 29/07/2014 by Xplode# Username : Terry - TERRY-PC# Operating System : Windows Vista Home Premium Service Pack 2 (64 bits)~ Removing disinfection tools ...Deleted : C:\QooboxDeleted : C:\CombofixDeleted : C:\FRSTDeleted : C:\zoek_backupDeleted : C:\AdwCleanerDeleted : C:\ComboFix.txtDeleted : C:\zoek-results.logDeleted : C:\Users\Terry\Desktop\Addition.txtDeleted : C:\Users\Terry\Desktop\AdwCleaner.exeDeleted : C:\Users\Terry\Desktop\ComboFix.exeDeleted : C:\Users\Terry\Desktop\FRST.txtDeleted : C:\Users\Terry\Desktop\FRST64.exeDeleted : C:\Users\Terry\Desktop\JRT.exeDeleted : C:\Users\Terry\Desktop\JRT.txtDeleted : C:\Users\Terry\Desktop\RKreport_SCN_10292014_142259.logDeleted : C:\Users\Terry\Desktop\RogueKillerX64.exeDeleted : C:\Users\Terry\Desktop\zoek.exeDeleted : C:\Windows\grep.exeDeleted : C:\Windows\PEV.exeDeleted : C:\Windows\NIRCMD.exeDeleted : C:\Windows\MBR.exeDeleted : C:\Windows\SED.exeDeleted : C:\Windows\SWREG.exeDeleted : C:\Windows\SWSC.exeDeleted : C:\Windows\SWXCACLS.exeDeleted : C:\Windows\Zip.exeDeleted : HKLM\SOFTWARE\AdwCleanerDeleted : HKLM\SOFTWARE\SwearwareDeleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe~ Cleaning system restore ...New restore point created !~ Resetting system settings ... OK########## - EOF - ########## Link to post Share on other sites More sharing options...
Naathim Posted November 1, 2014 ID:900436 Share Posted November 1, 2014 You are ready to go Below you will find my thoughts about securing your machine. Go ahead through it, you will benefit from some useful advice about safe computing. Recommended reading: MUST READ - security tips: Computer Security - a short guide to staying safer online. MUST READ - general maintenance: What to do if your Computer is running slowly? Recommended additional software: TFC - to clean unneeded temporary files. Malwarebytes' Anti-Malware - to scan your system from time to time in search for malware. Malwarebytes' Anti-Exploit - to prevent plenty of mostly exploited vulnerabilities. McShield - to prevent infections spread by removable media. CryptoPrevent - to secure yourself from very severe CryptoLocker infection. Unchecky - to prevent from installing additional foistware, implemented in legitimate installations. My help is always free, but if you are happy with the help provided and wish to help my fight against malware, please consider making a donation. All donations are to refund a new HDD to replace the old one, which recently passed away! Now if you have any other questions, feel free to ask me. Otherwise simply acknowledge my recommendations and this topic will be closed. Stay safe, Naat Link to post Share on other sites More sharing options...
TerryH Posted November 1, 2014 Author ID:900545 Share Posted November 1, 2014 Thanks Naat...... again! Link to post Share on other sites More sharing options...
Naathim Posted November 1, 2014 ID:900569 Share Posted November 1, 2014 You are welcome! Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted November 1, 2014 Root Admin ID:900585 Share Posted November 1, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts