krome Posted February 17, 2015 ID:940494 Share Posted February 17, 2015 Hello,It seems one of our computers has either adware or malware. It would come through google chrome and an ad would pop up trying to sell something. When I tried to close it another pop up came and gave me an option to continue listening or another option that basically wasn't going to let me get away. I've seen that before in the past on one of my older computers so I unplugged it. I did run a scan so here are the logs:Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 15-02-2015Ran by Kidstuff (administrator) on KSPSCAD1 on 17-02-2015 14:29:40Running from C:\Users\Kidstuff\DesktopLoaded Profiles: Kidstuff & MSSQL$ESTOCKCARD3 (Available profiles: Kidstuff & MSSQL$ESTOCKCARD3)Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: FF)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(AMD) C:\Windows\System32\atiesrxx.exe(AMD) C:\Windows\System32\atieclxx.exe(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe(Lenovo) C:\Program Files\Lenovo\LBAI\LBAEvent.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\sqlservr.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe(Lenovo) C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(Akamai Technologies, Inc.) C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe(Akamai Technologies, Inc.) C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe(Microsoft Corporation) C:\Windows\System32\rundll32.exe(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\PowerMgr\SCHTASK.EXE(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12343400 2012-01-10] (Realtek Semiconductor)HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [289648 2012-05-24] (Lenovo Group Limited)HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-02-15] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)HKLM-x32\...\Run: [iMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2011-12-15] (Intel Corporation)HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)HKLM-x32\...\Run: [Power Manager Startup Utility] => C:\Program Files (x86)\Lenovo\PowerMgr\DPMHost.exe [23352 2012-02-22] ()HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1091376 2012-01-17] (Lenovo)HKLM-x32\...\Run: [bCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1104288 2014-12-03] (Adobe Systems Incorporated)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [TWC.Win7] => C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exeHKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Policies\Explorer: []HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\MountPoints2: {667ba9c6-a250-11e2-9fd4-806e6f6e6963} - Q:\LenovoQDrive.exeHKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\MountPoints2: {93ebc887-30ba-11e3-8a67-fc4dd4350121} - E:\MotorolaDeviceManagerSetup.exe -aHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\...\RunOnce: [] => [X]HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\...\RunOnce: [Lenovoautoqdrive] => C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutorunreg.exe [159744 2011-12-14] ()HKU\S-1-5-18\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)Startup: C:\Users\Kidstuff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vertabasetimer.lnkShortcutTarget: vertabasetimer.lnk -> C:\Program Files (x86)\vertabasetimer\vertabasetimer.exe (No File)ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENPHKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSEHKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com/welcome/thinkcentreHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENPHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSEHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkID=226786&Mkt=en-US&Src=MSE&Tid=000328B9&OHP=http%3A%2F%2Fwww.google.com%2Fig%2Fredirectdomain%3Fbrand%3DLENP%26bmod%3DLENP,http%3A%2F%2Fwww.lenovo.com&OSP=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Die7%26q%3D%7BsearchTerms%7D%26rls%3Dcom.microsoft%3A%7Blanguage%7D%3A%7Breferrer%3Asource%3F%7D%26ie%3D%7BinputEncoding%7D%26oe%3D%7BoutputEncoding%7D%26rlz%3D1I7LENPSearchScopes: HKLM -> DefaultScope {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSESearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKLM -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSESearchScopes: HKLM-x32 -> DefaultScope {FA69100B-E03B-460C-A249-4506665598EC} URL =SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\.DEFAULT -> {47AE1BA9-0BD1-44F4-88AE-45F8F7B605EF} URL = http://www.basicserve.com/?prt=BASICSERVE113&sp=&keywords={searchTerms}SearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> DefaultScope {FA69100B-E03B-460C-A249-4506665598EC} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3282812&CUI=UN35640567661467324&UM=2SearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =SearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www.searchgol.com/?q={searchTerms}&babsrc=SP_ss&mntrId=86F0FC4DD4350121&affID=119351&tt=160913_nocpn&tsp=5014SearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENPSearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSESearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL =SearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {E8755B69-07B2-4E9D-B719-75F19C6E812C} URL = http://search.conduit.com/Results.aspx?ctid=CT3300019&SearchSource=45&UM=2&q={searchTerms}SearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {FA69100B-E03B-460C-A249-4506665598EC} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3282812&CUI=UN35640567661467324&UM=2SearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> DefaultScope {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSESearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENPSearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSEBHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)BHO-x32: DefaultTab Browser Helper -> {7F6AFBF1-E065-4627-A2FD-810366367D01} -> C:\Users\Kidstuff\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll No FileBHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.0.1Tcpip\Parameters: [NameServer] 8.8.8.8,8.8.4.4Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer] 8.8.8.8,8.8.4.4Tcpip\..\Interfaces\{FE273F25-CD2A-4DF1-8451-46A330CC8582}: [NameServer] 8.8.8.8,8.8.4.4FireFox:========FF ProfilePath: C:\Users\Kidstuff\AppData\Roaming\Mozilla\Firefox\Profiles\zlryv1jz.defaultFF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No FileFF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF HKLM-x32\...\Firefox\Extensions: [VIP5X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access ClientFF HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Firefox\Extensions: [sp2@sp.com] - C:\Program Files (x86)\Social Privacy\FFChrome:=======CHR HomePage: Profile 1 -> hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=86F0FC4DD4350121&affID=119351&tt=160913_nocpn&tsp=5014CHR StartupUrls: Profile 1 -> "hxxp://www.google.com/"CHR Plugin: (Shockwave Flash) - C:\PROGRA~2\Google\Chrome\APPLIC~1\40.0.2214.111\PepperFlash\pepflashplayer.dll ()CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewerCHR Plugin: (Native Client) - C:\PROGRA~2\Google\Chrome\APPLIC~1\40.0.2214.111\ppGoogleNaClPluginChrome.dll No FileCHR Plugin: (Chrome PDF Viewer) - C:\PROGRA~2\Google\Chrome\APPLIC~1\40.0.2214.111\pdf.dll ()CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No FileCHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No FileCHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No FileCHR Profile: C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\DefaultCHR Profile: C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1CHR Extension: (Mp3Skull Toolbar) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\anaehjnjgheaikfecjlfokolkoalpnda [2013-08-26]CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-28]CHR Extension: (My Scrap Nook) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gnaghjfblmncnfgjddgelpkbhfdflicf [2013-11-04]CHR Extension: (Google Wallet) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-26]CHR HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Chrome\Extension: [edfllcfghbogdahicgpcmnmkgpcmdjeo] - C:\Users\Kidstuff\AppData\Local\CRE\edfllcfghbogdahicgpcmnmkgpcmdjeo.crx [Not Found]CHR HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Chrome\Extension: [klibnahbojhkanfgaglnlalfkgpcppfi] - C:\Users\Kidstuff\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx [Not Found]CHR HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Chrome\Extension: [nemfjadlboooiffmcelkafilagddogim] - C:\Users\Kidstuff\AppData\Local\CRE\nemfjadlboooiffmcelkafilagddogim.crx [2013-10-16]CHR HKLM-x32\...\Chrome\Extension: [edfllcfghbogdahicgpcmnmkgpcmdjeo] - C:\Users\Kidstuff\AppData\Local\CRE\edfllcfghbogdahicgpcmnmkgpcmdjeo.crx [Not Found]CHR HKLM-x32\...\Chrome\Extension: [klibnahbojhkanfgaglnlalfkgpcppfi] - C:\Users\Kidstuff\AppData\Local\CRE\klibnahbojhkanfgaglnlalfkgpcppfi.crx [Not Found]CHR HKLM-x32\...\Chrome\Extension: [nemfjadlboooiffmcelkafilagddogim] - C:\Users\Kidstuff\AppData\Local\CRE\nemfjadlboooiffmcelkafilagddogim.crx [2013-10-16]==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.) [File not signed]R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776 2012-01-17] (Lenovo)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2011-12-15] (Intel Corporation)R2 LBAEvent; C:\Program Files\Lenovo\LBAI\LBAEvent.exe [15520 2012-03-23] (Lenovo) [File not signed]R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)R2 MSSQL$ESTOCKCARD3; c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\sqlservr.exe [206424 2012-02-11] (Microsoft Corporation)R2 MSSQL$RIT; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)R2 Power Manager DBC Service; C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.EXE [70968 2012-02-22] (Lenovo)S3 PwmEWSvc; C:\Program Files (x86)\Lenovo\PowerMgr\PWMEWSVC.EXE [165176 2012-02-22] (Lenovo Group Limited)S4 SQLAgent$ESTOCKCARD3; c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\SQLAGENT.EXE [438360 2012-02-11] (Microsoft Corporation)R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440 2008-01-10] (Ulead Systems, Inc.) [File not signed]S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70416 2012-01-17] (Windows ® Win 7 DDK provider)R3 LBAI; C:\Windows\System32\Drivers\LBAI.sys [9600 2011-12-08] (Lenovo)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2015-02-17 14:29 - 2015-02-17 14:30 - 00021569 _____ () C:\Users\Kidstuff\Desktop\FRST.txt2015-02-17 14:29 - 2015-02-17 14:29 - 00000000 ____D () C:\FRST2015-02-17 14:28 - 2015-02-17 14:28 - 02085888 _____ (Farbar) C:\Users\Kidstuff\Desktop\FRST64.exe2015-02-17 14:27 - 2015-02-17 14:27 - 00001170 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk2015-02-17 14:27 - 2015-02-17 14:27 - 00001158 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\Mozilla2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\ProgramData\Mozilla2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2015-02-17 14:23 - 2015-02-17 14:23 - 00000000 __SHD () C:\Users\Kidstuff\AppData\Local\EmieBrowserModeList2015-02-17 13:30 - 2015-02-17 13:30 - 00620544 _____ () C:\Parts.xls2015-02-11 17:46 - 2015-01-22 22:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2015-02-11 17:46 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2015-02-11 17:46 - 2015-01-22 21:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2015-02-11 17:46 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll2015-02-10 20:45 - 2015-02-03 21:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2015-02-10 20:45 - 2015-01-27 17:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe2015-02-10 20:45 - 2015-01-13 23:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2015-02-10 20:45 - 2015-01-13 23:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2015-02-10 20:45 - 2015-01-12 21:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll2015-02-10 20:45 - 2015-01-12 20:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll2015-02-10 20:45 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2015-02-10 20:45 - 2015-01-11 21:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2015-02-10 20:45 - 2015-01-11 21:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2015-02-10 20:45 - 2015-01-11 20:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2015-02-10 20:45 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2015-02-10 20:45 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2015-02-10 20:45 - 2015-01-11 20:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2015-02-10 20:45 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2015-02-10 20:45 - 2015-01-11 20:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2015-02-10 20:45 - 2015-01-11 20:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2015-02-10 20:45 - 2015-01-11 20:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2015-02-10 20:45 - 2015-01-11 20:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2015-02-10 20:45 - 2015-01-11 20:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2015-02-10 20:45 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2015-02-10 20:45 - 2015-01-11 20:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2015-02-10 20:45 - 2015-01-11 20:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2015-02-10 20:45 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2015-02-10 20:45 - 2015-01-11 20:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2015-02-10 20:45 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2015-02-10 20:45 - 2015-01-11 20:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2015-02-10 20:45 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2015-02-10 20:45 - 2015-01-11 20:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2015-02-10 20:45 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2015-02-10 20:45 - 2015-01-11 20:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2015-02-10 20:45 - 2015-01-11 19:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2015-02-10 20:45 - 2015-01-11 19:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2015-02-10 20:45 - 2015-01-11 19:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2015-02-10 20:45 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2015-02-10 20:45 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2015-02-10 20:45 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2015-02-10 20:45 - 2015-01-11 19:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2015-02-10 20:45 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2015-02-10 20:45 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2015-02-10 20:45 - 2015-01-11 19:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2015-02-10 20:45 - 2015-01-11 19:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2015-02-10 20:45 - 2015-01-11 19:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2015-02-10 20:45 - 2015-01-11 19:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2015-02-10 20:45 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2015-02-10 20:45 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2015-02-10 20:45 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2015-02-10 20:45 - 2015-01-11 19:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2015-02-10 20:45 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2015-02-10 20:45 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2015-02-10 20:45 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2015-02-10 20:45 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2015-02-10 20:45 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2015-02-10 20:45 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll2015-02-10 20:44 - 2015-01-15 02:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys2015-02-10 20:44 - 2015-01-15 02:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys2015-02-10 20:44 - 2015-01-15 02:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe2015-02-10 20:44 - 2015-01-15 02:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll2015-02-10 20:44 - 2015-01-15 02:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe2015-02-10 20:44 - 2015-01-15 02:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll2015-02-10 20:44 - 2015-01-15 02:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll2015-02-10 20:44 - 2015-01-15 02:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll2015-02-10 20:44 - 2015-01-15 01:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe2015-02-10 20:44 - 2015-01-15 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2015-02-10 20:44 - 2015-01-15 01:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2015-02-10 20:44 - 2015-01-15 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll2015-02-10 20:44 - 2015-01-15 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll2015-02-10 20:44 - 2015-01-15 01:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll2015-02-10 20:44 - 2015-01-14 22:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys2015-02-10 20:44 - 2015-01-14 00:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe2015-02-10 20:44 - 2015-01-14 00:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll2015-02-10 20:44 - 2015-01-14 00:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll2015-02-10 20:44 - 2015-01-14 00:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe2015-02-10 20:44 - 2015-01-13 23:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2015-02-10 20:44 - 2015-01-13 23:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2015-02-10 20:44 - 2015-01-13 23:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll2015-02-10 20:44 - 2015-01-08 20:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2015-02-10 20:44 - 2014-12-11 23:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll2015-02-10 20:44 - 2014-12-11 23:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll2015-02-10 20:44 - 2014-12-07 21:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll2015-02-10 20:44 - 2014-12-07 20:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll2015-02-10 20:44 - 2014-11-25 21:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll2015-02-10 20:44 - 2014-11-25 21:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll2015-02-05 01:40 - 2015-02-05 01:40 - 04437680 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2015-02-03 09:42 - 2015-02-03 09:42 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task2015-01-26 15:35 - 2014-12-18 21:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll2015-01-26 15:35 - 2014-12-18 19:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys2015-01-26 15:35 - 2014-12-11 11:47 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe2015-01-26 15:35 - 2014-12-05 22:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll2015-01-26 15:35 - 2014-12-05 21:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll2015-01-26 15:35 - 2014-12-05 21:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2015-02-17 14:28 - 2013-09-23 08:28 - 00000304 _____ () C:\Windows\Tasks\DigitalSite.job2015-02-17 14:28 - 2013-04-30 12:03 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-02-17 14:27 - 2013-09-23 08:28 - 00000000 ____D () C:\Users\Kidstuff\AppData\Roaming\Mozilla2015-02-17 14:27 - 2013-09-23 08:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2015-02-17 14:23 - 2013-04-30 12:03 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-02-17 14:15 - 2009-07-13 22:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-02-17 14:15 - 2009-07-13 22:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-02-17 14:12 - 2009-07-13 23:13 - 00977804 _____ () C:\Windows\system32\PerfStringBackup.INI2015-02-17 14:11 - 2013-04-10 20:40 - 01133543 _____ () C:\Windows\WindowsUpdate.log2015-02-17 14:08 - 2013-06-06 11:54 - 00000000 ____D () C:\Users\MSSQL$ESTOCKCARD32015-02-17 14:08 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-02-17 14:08 - 2009-07-13 22:51 - 00064752 _____ () C:\Windows\setupact.log2015-02-17 14:03 - 2013-09-23 09:28 - 00000214 _____ () C:\Users\Kidstuff\AppData\Roaming\WB.CFG2015-02-17 13:45 - 2013-05-01 07:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office2015-02-17 13:45 - 2013-05-01 06:58 - 00000000 ____D () C:\ProgramData\Microsoft Help2015-02-17 13:40 - 2013-06-05 07:37 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2015-02-17 12:29 - 2013-05-15 08:32 - 00606500 _____ () C:\Windows\system32\webservice4.log2015-02-17 12:19 - 2013-05-15 08:32 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\cache2015-02-12 04:10 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache2015-02-12 03:03 - 2013-05-01 08:19 - 00969926 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI2015-02-11 03:23 - 2009-07-13 22:45 - 00537632 _____ () C:\Windows\system32\FNTCACHE.DAT2015-02-11 03:22 - 2010-11-20 21:47 - 00763836 _____ () C:\Windows\PFRO.log2015-02-11 03:21 - 2014-12-10 03:08 - 00000000 ____D () C:\Windows\system32\appraiser2015-02-11 03:21 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel2015-02-11 03:21 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2015-02-11 03:05 - 2009-07-13 20:34 - 00000478 _____ () C:\Windows\win.ini2015-02-11 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT2015-02-11 03:03 - 2013-04-24 13:48 - 00002128 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk2015-02-11 03:03 - 2013-04-24 13:48 - 00001945 _____ () C:\Windows\epplauncher.mif2015-02-11 03:03 - 2013-04-24 13:48 - 00000000 ____D () C:\Program Files\Microsoft Security Client2015-02-11 03:03 - 2013-04-24 13:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client2015-02-11 03:01 - 2013-04-24 13:19 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2015-02-05 23:29 - 2013-04-30 12:04 - 00002194 _____ () C:\Users\Public\Desktop\Google Chrome.lnk2015-02-05 01:40 - 2013-06-05 07:37 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2015-02-05 01:40 - 2013-06-05 07:37 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2015-02-05 01:40 - 2013-06-05 07:37 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2015-02-04 22:23 - 2013-04-30 12:03 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA2015-02-04 22:23 - 2013-04-30 12:03 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore2015-01-27 03:02 - 2013-04-30 10:49 - 00000000 ____D () C:\Users\Kidstuff2015-01-26 17:21 - 2013-06-05 07:37 - 00000000 ____D () C:\Windows\system32\Macromed2015-01-26 17:21 - 2013-05-15 08:15 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\Akamai2015-01-26 17:21 - 2013-04-30 12:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome2015-01-26 17:21 - 2013-04-24 13:45 - 00000000 ____D () C:\Program Files\Microsoft Silverlight2015-01-26 17:21 - 2013-04-24 13:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight2015-01-26 17:21 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration==================== Files in the root of some directories =======2013-07-25 13:48 - 2013-07-29 15:59 - 0000000 _____ () C:\Users\Kidstuff\AppData\Roaming\bibstats2013-09-20 12:44 - 2013-09-20 12:44 - 0037847 _____ () C:\Users\Kidstuff\AppData\Roaming\Comma Separated Values (DOS).ADR2013-07-16 09:54 - 2013-07-16 10:23 - 0038449 _____ () C:\Users\Kidstuff\AppData\Roaming\Comma Separated Values (Windows).ADR2013-09-23 09:28 - 2015-02-17 14:03 - 0000214 _____ () C:\Users\Kidstuff\AppData\Roaming\WB.CFG2013-09-23 09:28 - 2014-01-29 00:28 - 0000005 _____ () C:\Users\Kidstuff\AppData\Roaming\WBPU-TTL.DAT2013-06-21 12:38 - 2013-06-21 12:38 - 0003584 _____ () C:\Users\Kidstuff\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2013-10-17 07:32 - 2013-10-17 07:32 - 0000000 _____ () C:\ProgramData\233a23272c333d59_c2013-06-06 11:32 - 2013-06-17 11:44 - 0005012 _____ () C:\ProgramData\liupbmqt.mviSome content of TEMP:====================C:\Users\Kidstuff\AppData\Local\Temp\AcDeltree.exeC:\Users\Kidstuff\AppData\Local\Temp\airBD4F.exeC:\Users\Kidstuff\AppData\Local\Temp\airCC21.exeC:\Users\Kidstuff\AppData\Local\Temp\airCCFB.exeC:\Users\Kidstuff\AppData\Local\Temp\BackupSetup.exeC:\Users\Kidstuff\AppData\Local\Temp\basicserve_bscsrvgup.exeC:\Users\Kidstuff\AppData\Local\Temp\BD50_FPPSetup.exeC:\Users\Kidstuff\AppData\Local\Temp\bi_cleaner.exeC:\Users\Kidstuff\AppData\Local\Temp\dp.exeC:\Users\Kidstuff\AppData\Local\Temp\eisetup.exeC:\Users\Kidstuff\AppData\Local\Temp\FastFreeConverter_Somoto2.exeC:\Users\Kidstuff\AppData\Local\Temp\fsrvsetup.exeC:\Users\Kidstuff\AppData\Local\Temp\helper.exeC:\Users\Kidstuff\AppData\Local\Temp\mconduitinstaller.exeC:\Users\Kidstuff\AppData\Local\Temp\newsetup.exeC:\Users\Kidstuff\AppData\Local\Temp\nsc452D.exeC:\Users\Kidstuff\AppData\Local\Temp\nsc82F1.exeC:\Users\Kidstuff\AppData\Local\Temp\nsf69E8.exeC:\Users\Kidstuff\AppData\Local\Temp\nsfBDB2.exeC:\Users\Kidstuff\AppData\Local\Temp\nsh8841.exeC:\Users\Kidstuff\AppData\Local\Temp\nsm8C1B.exeC:\Users\Kidstuff\AppData\Local\Temp\nsn5DED.exeC:\Users\Kidstuff\AppData\Local\Temp\nsn5FC2.exeC:\Users\Kidstuff\AppData\Local\Temp\nsqCE87.exeC:\Users\Kidstuff\AppData\Local\Temp\nss62CE.exeC:\Users\Kidstuff\AppData\Local\Temp\nss9208.exeC:\Users\Kidstuff\AppData\Local\Temp\nstAD48.exeC:\Users\Kidstuff\AppData\Local\Temp\nsu7B0A.exeC:\Users\Kidstuff\AppData\Local\Temp\nsuC340.exeC:\Users\Kidstuff\AppData\Local\Temp\nsw1E45.exeC:\Users\Kidstuff\AppData\Local\Temp\nsw3CC0.exeC:\Users\Kidstuff\AppData\Local\Temp\nsw7FA2.exeC:\Users\Kidstuff\AppData\Local\Temp\nsx8364.exeC:\Users\Kidstuff\AppData\Local\Temp\nsy6E01.exeC:\Users\Kidstuff\AppData\Local\Temp\nsyAB92.exeC:\Users\Kidstuff\AppData\Local\Temp\OptimizerPro.exeC:\Users\Kidstuff\AppData\Local\Temp\ppadsetup.exeC:\Users\Kidstuff\AppData\Local\Temp\PreferencesJson.exeC:\Users\Kidstuff\AppData\Local\Temp\SetupToparcadehits.exeC:\Users\Kidstuff\AppData\Local\Temp\SPStub.exeC:\Users\Kidstuff\AppData\Local\Temp\Sqlite3.dllC:\Users\Kidstuff\AppData\Local\Temp\sqlite3.exeC:\Users\Kidstuff\AppData\Local\Temp\System.Data.SQLite.dllC:\Users\Kidstuff\AppData\Local\Temp\tbInte.dllC:\Users\Kidstuff\AppData\Local\Temp\tbSomo.dllC:\Users\Kidstuff\AppData\Local\Temp\tbWhit.dllC:\Users\Kidstuff\AppData\Local\Temp\The_Weather_Channel_Application.exeC:\Users\Kidstuff\AppData\Local\Temp\tmpA8FE.tmp.exeC:\Users\Kidstuff\AppData\Local\Temp\ToolbarHelper.exeC:\Users\Kidstuff\AppData\Local\Temp\uninst1.exeC:\Users\Kidstuff\AppData\Local\Temp\UpdateCheckerSetup.exeC:\Users\Kidstuff\AppData\Local\Temp\US_en_Avery_AW40.exeC:\Users\Kidstuff\AppData\Local\Temp\vlc-2.0.2-win32.exe==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2015-02-13 00:20==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 15-02-2015Ran by Kidstuff at 2015-02-17 14:30:15Running from C:\Users\Kidstuff\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)Akamai NetSession Interface (HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Akamai) (Version: - Akamai Technologies, Inc)AMD Catalyst Install Manager (HKLM\...\{2239633A-969C-39BF-B5C2-C172F44EC096}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)AutoCAD LT 2014 - English (Version: 19.1.18.0 - Autodesk) HiddenAutoCAD LT 2014 Language Pack - English (Version: 19.1.18.0 - Autodesk) HiddenAutodesk 360 (HKLM\...\{52B28CAD-F49D-47BA-9FFE-29C2E85F0D0B}) (Version: 4.0.27.1 - Autodesk)Autodesk AutoCAD LT 2014 - English (HKLM\...\AutoCAD LT 2014 - English) (Version: 19.1.18.0 - Autodesk)Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.1.3.0 - Autodesk)Autodesk Content Service (x32 Version: 3.1.3.0 - Autodesk) HiddenAutodesk Content Service Language Pack (x32 Version: 3.1.3.0 - Autodesk) HiddenAutodesk Material Library 2014 (HKLM-x32\...\{644F9B19-A462-499C-BF4D-300ABC2A28B1}) (Version: 4.0.19.0 - Autodesk)Autodesk Material Library Base Resolution Image Library 2014 (HKLM-x32\...\{51BF3210-B825-4092-8E0D-66D689916E02}) (Version: 4.0.19.0 - Autodesk)Avery Wizard 4.0 (HKLM-x32\...\{7196E6BD-4B65-43F9-9D30-73A8E58D0E84}) (Version: 4.0.103 - Avery)Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) HiddenCorel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) HiddenCorel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)Crystal Reports Basic Runtime for Visual Studio 2008 (x64) (Version: 10.5.0.0 - Business Objects) HiddenDirect DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) HiddenGoogle Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoogle Update Helper (x32 Version: 1.3.26.9 - Google Inc.) HiddenIntel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)Intel® Network Connections 16.8.46.0 (HKLM\...\PROSetDX) (Version: 16.8.46.0 - Intel)Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)LBAI (HKLM-x32\...\{C5C91B7B-38A6-40B7-84D6-E44885E44B13}) (Version: 1.0.0.6 - Lenovo)Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)Microsoft Office Access Runtime (English) 2007 (HKLM-x32\...\{90120000-001C-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)Microsoft SQL Server 2008 Setup Support Files (HKLM-x32\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation)Microsoft SQL Server 2012 (HKLM-x32\...\Microsoft SQL Server SQLServer2012) (Version: - Microsoft Corporation)Microsoft SQL Server 2012 Native Client (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server 2012 Setup (English) (HKLM-x32\...\{CEA86648-87FA-4775-8F3B-A57F720BAE85}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server 2012 Transact-SQL ScriptDom (HKLM\...\{0E8670B8-3965-4930-ADA6-570348B67153}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 8.0 Support DLLs (HKLM-x32\...\{342F5437-C87D-4BB5-89B9-B23E16C6A395}) (Version: 1.0.0 - McNeel & Associates)Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)Microsoft VSS Writer for SQL Server 2012 (HKLM\...\{3E0DD83F-BE4C-4478-86A0-AD0D79D1353E}) (Version: 11.0.2100.60 - Microsoft Corporation)Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 1.00.0802 - Lenovo)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6543 - Realtek Semiconductor Corp.)Rhinoceros 4.0 SR6 (HKLM-x32\...\{6B9DD988-5ECB-4623-BBFF-8A8F2DA3ED16}) (Version: 4.0.40709 - Robert McNeel & Associates)Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.02.00 - Samsung Electronics Co., Ltd.)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)SQL Server 2012 Common Files (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server 2012 Database Engine Services (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server 2012 Database Engine Shared (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server Browser for SQL Server 2012 (HKLM-x32\...\{4B9E6EB0-0EED-4E74-9479-F982C3254F71}) (Version: 11.0.2100.60 - Microsoft Corporation)Sql Server Customer Experience Improvement Program (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenTeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.30992 - TeamViewer)ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.0.30.0 - Lenovo)ThinkVantage Power Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 2.10.0007 - Lenovo Group Limited)Update for Image Editor (HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\DigitalSite) (Version: - ) <==== ATTENTIONView Management Utility (HKLM-x32\...\InstallShield_{C6254514-DD94-45E5-87C0-B9CB90A34C89}) (Version: 3.0.12.0329 - Lenovo)View Management Utility (Version: 3.0.12.0329 - Lenovo) HiddenWindows Driver Package - Advanced Micro Devices (AtiHDAudioService) MEDIA (10/18/2011 7.12.0.7704) (HKLM\...\7E26D65CA5110FF168A57B5C479134FA5450759B) (Version: 10/18/2011 7.12.0.7704 - Advanced Micro Devices)Windows Driver Package - Advanced Micro Devices, Inc. (amdkmdap) Display (02/14/2012 8.913.1.0000) (HKLM\...\4D7E325B73136CE735F86BC465965BFECB76C1AD) (Version: 02/14/2012 8.913.1.0000 - Advanced Micro Devices, Inc.)Windows Driver Package - Intel (e1cexpress) Net (01/11/2012 11.15.16.0) (HKLM\...\E6D02BAF356D0EEE96DE70D352026CE420321A16) (Version: 01/11/2012 11.15.16.0 - Intel)Windows Driver Package - Intel hdc (08/26/2011 9.3.0.1011) (HKLM\...\A7E82C89A6D6643325B95A4FEDAB3DB18640208F) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel System (01/11/2012 9.3.0.1020) (HKLM\...\09839A9B5EDA69DA2DCC34637B5140AAF8A53B44) (Version: 01/11/2012 9.3.0.1020 - Intel)Windows Driver Package - Intel System (08/26/2011 9.3.0.1011) (HKLM\...\9D7CD466F7FC8B18FF1B84943B7BB8648D17FCE8) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel System (08/26/2011 9.3.0.1011) (HKLM\...\D8EF6CACF49BD33CC1FACD124C8CC2B1A8E8AE35) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel USB (08/26/2011 9.3.0.1011) (HKLM\...\97EE1802A0385A37DE6323FA39EC76BEB2D73E41) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (01/03/2012 6.0.1.6543) (HKLM\...\5DE3700033F94FCFD8726BE46A6727E460254CD5) (Version: 01/03/2012 6.0.1.6543 - Realtek Semiconductor Corp.)==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Kidstuff\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No FileCustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2014\acadlt.exe (Autodesk, Inc.)CustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2014\en-US\acadltficn.dll (Autodesk, Inc.)==================== Restore Points =========================27-01-2015 03:00:11 Windows Update30-01-2015 03:15:58 Windows Update02-02-2015 11:31:27 Windows Update05-02-2015 11:31:59 Windows Update09-02-2015 11:31:39 Windows Update11-02-2015 03:00:20 Windows Update12-02-2015 03:00:11 Windows Update16-02-2015 03:32:18 Windows Update==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {1C668618-FB88-4AC5-8637-E6476802E16D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)Task: {23F8CD9E-39C7-42B8-A3E7-81ED66C61081} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-30] (Google Inc.)Task: {2E4AB855-1826-4657-841F-6F0E4A6FAB00} - System32\Tasks\PMTask => C:\Program Files (x86)\Lenovo\PowerMgr\PWMIDTSV.EXE [2012-02-22] (Lenovo Group Limited)Task: {4A26B1FA-8302-40A4-8EDD-ACB020023DDD} - System32\Tasks\DigitalSite => C:\Users\Kidstuff\AppData\Roaming\DigitalSite\UpdateProc\UpdateTask.exe [2013-04-12] () <==== ATTENTIONTask: {57F760AA-9985-4A87-9E74-352AAD7C6407} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-30] (Google Inc.)Task: {62EBFDF1-E687-44FB-BCBA-F42A76EFE5A9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)Task: {9162585C-AB42-4AEC-9508-1B8062A771EE} - System32\Tasks\{0331DB66-F86F-4943-A9C5-2B2100C28796} => pcalua.exe -a C:\ISRPSetup\ISRPSetup.exe -d C:\ISRPSetupTask: {99B725CD-4AE3-456C-8393-3E1E9169F36F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvcTask: {F10D5434-7EB9-4B9C-BAB2-784FC3679952} - System32\Tasks\{41059747-FEBB-4B30-9855-2A9A45A74D1D} => pcalua.exe -a C:\Users\Kidstuff\Desktop\DesignPro5_2_Limited.exe -d C:\Users\Kidstuff\DesktopTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\DigitalSite.job => C:\Users\Kidstuff\AppData\Roaming\DIGITA~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTIONTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) ==============2008-09-08 09:19 - 2008-09-08 09:19 - 00022016 _____ () C:\Windows\System32\cl31cl6.dll2013-04-30 10:46 - 2011-04-10 23:26 - 00034304 _____ () C:\Windows\System32\spe__l.dll2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00056352 _____ () C:\Program Files\Autodesk\Autodesk Sync\qoauth_Ad_1.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00937504 _____ () C:\Program Files\Autodesk\Autodesk Sync\qca_Ad_2.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00124448 _____ () C:\Program Files\Autodesk\Autodesk Sync\QJson.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00045088 _____ () C:\Program Files\Autodesk\Autodesk Sync\QtSolutions_MFCMigrationFramework_Ad_2.dll2013-04-10 20:48 - 2012-02-12 12:10 - 00029184 ____N () C:\Program Files (x86)\Lenovo\PowerMgr\US\PWMRT64V.DLL2011-11-09 10:55 - 2011-11-09 10:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll2012-02-14 23:35 - 2012-02-14 23:35 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll2013-04-10 20:52 - 2012-01-17 00:29 - 00030512 ____N () C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBServiceps.dll2014-10-15 02:21 - 2014-10-15 02:21 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\38485cf51c91ff758c145158360bbb97\IsdiInterop.ni.dll2013-04-10 20:41 - 2011-11-29 21:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll2013-04-10 20:44 - 2011-12-15 20:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll2015-02-17 14:27 - 2015-01-23 04:37 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)AlternateDataStreams: C:\Windows:nlsPreferences==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) ===============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Kidstuff\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgDNS Servers: 8.8.8.8 - 8.8.4.4==================== MSCONFIG/TASK MANAGER disabled items ==(Currently there is no automatic fix for this section.)==================== Accounts: =============================Administrator (S-1-5-21-1142913190-692752148-3269810916-500 - Administrator - Disabled)Guest (S-1-5-21-1142913190-692752148-3269810916-501 - Limited - Disabled)Kidstuff (S-1-5-21-1142913190-692752148-3269810916-1001 - Administrator - Enabled) => C:\Users\Kidstuff==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (02/17/2015 02:09:47 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/17/2015 00:31:19 PM) (Source: Application Error) (EventID: 1000) (User: )Description: Faulting application name: WSCommCntr4.exe, version: 4.0.3.0, time stamp: 0x50dcb523Faulting module name: WSCommCntr4.exe, version: 4.0.3.0, time stamp: 0x50dcb523Exception code: 0xc0000005Fault offset: 0x0000000000016490Faulting process id: 0x1614Faulting application start time: 0xWSCommCntr4.exe0Faulting application path: WSCommCntr4.exe1Faulting module path: WSCommCntr4.exe2Report Id: WSCommCntr4.exe3Error: (02/12/2015 03:23:07 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/11/2015 03:24:02 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/01/2015 11:22:08 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/01/2015 11:14:46 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (01/27/2015 03:07:14 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (01/26/2015 03:31:58 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (01/26/2015 03:16:02 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (01/16/2015 01:13:06 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003System errors:=============Error: (02/17/2015 02:08:07 PM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 2:06:43 PM on 2/17/2015 was unexpected.Error: (02/11/2015 03:33:17 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for FailureCommand with the following error:%%5Error: (02/11/2015 03:33:16 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Start with the following error:%%5Error: (02/11/2015 03:13:51 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for FailureCommand with the following error:%%5Error: (02/11/2015 03:13:50 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Start with the following error:%%5Error: (02/01/2015 11:20:25 AM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 11:18:51 AM on 2/1/2015 was unexpected.Error: (02/01/2015 11:13:02 AM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 11:11:45 AM on 2/1/2015 was unexpected.Error: (01/26/2015 03:30:15 PM) (Source: Microsoft Antimalware) (EventID: 2004) (User: )Description: %60 has encountered an error trying to load signatures and will attempt reverting back to a known-good set of signatures. Signatures Attempted: %24 Error Code: 0x80070002 Error description: The system cannot find the file specified. Signature version: 0.0.0.0;0.0.0.0 Engine version: %600Error: (01/26/2015 03:17:24 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )Description: %NT AUTHORITY60 has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.191.2518.0 Update Source: %NT AUTHORITY59 Update Stage: 4.6.0305.00 Source Path: 4.6.0305.01 Signature Type: %NT AUTHORITY602 Update Type: %NT AUTHORITY604 User: NT AUTHORITY\SYSTEM Current Engine Version: %NT AUTHORITY605 Previous Engine Version: %NT AUTHORITY606 Error code: %NT AUTHORITY607 Error description: %NT AUTHORITY608Error: (11/09/2014 01:44:42 PM) (Source: Microsoft Antimalware) (EventID: 2001) (User: )Description: %NT AUTHORITY60 has encountered an error trying to update signatures. New Signature Version: Previous Signature Version: 1.187.1668.0 Update Source: %NT AUTHORITY59 Update Stage: 4.6.0305.00 Source Path: 4.6.0305.01 Signature Type: %NT AUTHORITY602 Update Type: %NT AUTHORITY604 User: NT AUTHORITY\SYSTEM Current Engine Version: %NT AUTHORITY605 Previous Engine Version: %NT AUTHORITY606 Error code: %NT AUTHORITY607 Error description: %NT AUTHORITY608Microsoft Office Sessions:=========================Error: (02/17/2015 02:09:47 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/17/2015 00:31:19 PM) (Source: Application Error) (EventID: 1000) (User: )Description: WSCommCntr4.exe4.0.3.050dcb523WSCommCntr4.exe4.0.3.050dcb523c00000050000000000016490161401d04adfa70d48ebC:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exeC:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe29b90b39-b6d3-11e4-b256-fc4dd4350121Error: (02/12/2015 03:23:07 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/11/2015 03:24:02 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/01/2015 11:22:08 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/01/2015 11:14:46 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (01/27/2015 03:07:14 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (01/26/2015 03:31:58 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (01/26/2015 03:16:02 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (01/16/2015 01:13:06 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003==================== Memory info ===========================Processor: Intel® Core i7-3770 CPU @ 3.40GHzPercentage of memory in use: 25%Total physical RAM: 8114.96 MBAvailable physical RAM: 6080.88 MBTotal Pagefile: 16228.12 MBAvailable Pagefile: 13844.63 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.83 MB==================== Drives ================================Drive c: (Windows7_OS) (Fixed) (Total:916.37 GB) (Free:639.6 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive q: (Lenovo_Recovery) (Fixed) (Total:13.67 GB) (Free:3.48 GB) NTFSDrive x: () (Network) (Total:149.05 GB) (Free:74.68 GB) NTFSDrive z: () (Network) (Total:149.05 GB) (Free:74.68 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (Size: 931.5 GB) (Disk ID: 70B41803)Partition 1: (Active) - (Size=1.5 GB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=916.4 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=13.7 GB) - (Type=07 NTFS)==================== End Of Log ============================ Link to post Share on other sites More sharing options...
kevinf80 Posted February 17, 2015 ID:940509 Share Posted February 17, 2015 Hello and welome, P2P/Piracy Warning: If you're using Peer 2 Peer software such as uTorrent, BitTorrent or similar you must either fully uninstall them or completely disable them from running while being assisted here.Failure to remove or disable such software will result in your topic being closed and no further assistance being provided.If you have illegal/cracked software, cracks, keygens etc. on the system, please remove or uninstall them now and read the policy on Piracy. Next, Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Download Malwarebytes Anti-Malware to your desktop.Double-click mbam-setup and follow the prompts to install the program.At the end, be sure a checkmark is placed next to the following: Launch Malwarebytes Anti-MalwareA 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.Click Finish.On the Dashboard, click the 'Update Now >>' linkAfter the update completes Select > Settings > Detection and Protection > Enable Scan for rootkit and Under Non Malware Protection set both PUP and PUM to Treat detections as malware.Now select > Scan > Threat scan > Scan nowWhen the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.In most cases, a restart will be required.Wait for the prompt to restart the computer to appear, then click on Yes. When the scan is completed from the main GUI click on History > Application Logs. Find your scan log, the date when run will identify it. Checkmark "select" box > then hit the "view" button. The history log window will open. At the bottom of that window are two options, "Copy to clipboard" and "Export" Select > "Copy to clipboard" that copies the full log to the windows clipboard, so at your reply you right click into the text field and select "Paste" the log is pasted (copied) to your reply. Next, Download AdwCleaner by Xplode onto your Desktop. Double click on Adwcleaner.exe to run the tool. Click on Scan Once the scan is done, click on the Clean button. You will get a prompt asking to close all programs. Click OK. Click OK again to reboot your computer. A text file will open after the restart. Please post the content of that logfile in your reply. You can also find the logfile at C:\AdwCleaner[sn].txt. Where n in the scan reference number Next, Please download Junkware Removal Tool to your desktop.Shut down your protection software now to avoid potential conflicts. (re-enable when done)Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".The tool will open and start scanning your system.Please be patient as this can take a while to complete depending on your system's specifications.On completion, a log (JRT.txt) is saved to your desktop and will automatically open.Post the contents of JRT.txt into your next message. Next, Download Microsoft's " Malicious Software Removal Tool" and save direct to the desktopEnsure to get the correct version for your system.... 32 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en64 Bit version:https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en'>https://www.microsoft.com/downloads/en/confirmation.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en Right click on the Tool, select “Run as Administrator” the tool will expand to the options WindowIn the "Scan Type" window, select Quick ScanPerform a scan and Click Finish when the scan is done.Retrieve the MSRT log as follows, and post it in your next reply: 1) Select the Windows key and R key together to open the "Run" function2) Type or Copy/Paste the following command to the "Run Line" and Press Enter: notepad c:\windows\debug\mrt.log Let me see those logs, also give update on any remaining issues or concerns... Thanks, Kevin Fixlist.txt Link to post Share on other sites More sharing options...
krome Posted February 17, 2015 Author ID:940525 Share Posted February 17, 2015 Ok I will start the scan. It may be a day or 2 by the time I get back to you so I won't let too much time elapse until the next update. Link to post Share on other sites More sharing options...
kevinf80 Posted February 18, 2015 ID:940596 Share Posted February 18, 2015 Post back whenever you`re ready....... Link to post Share on other sites More sharing options...
krome Posted February 18, 2015 Author ID:940830 Share Posted February 18, 2015 Ok here are the logs: Malwarebytes Anti-Malwarewww.malwarebytes.orgScan Date: 2/18/2015Scan Time: 2:02:22 PMLogfile: mbamscan.txtAdministrator: YesVersion: 0.00.0.0000Malware Database: v2015.02.18.08Rootkit Database: v2015.02.03.01License: TrialMalware Protection: EnabledMalicious Website Protection: EnabledSelf-protection: DisabledOS: Windows 7 Service Pack 1CPU: x64File System: NTFSUser: KidstuffScan Type: Threat ScanResult: CompletedObjects Scanned: 399579Time Elapsed: 9 min, 56 secMemory: EnabledStartup: EnabledFilesystem: EnabledArchives: EnabledRootkits: EnabledHeuristics: EnabledPUP: EnabledPUM: EnabledProcesses: 0(No malicious items detected)Modules: 0(No malicious items detected)Registry Keys: 0(No malicious items detected)Registry Values: 0(No malicious items detected)Registry Data: 0(No malicious items detected)Folders: 0(No malicious items detected)Files: 0(No malicious items detected)Physical Sectors: 0(No malicious items detected)(end) # AdwCleaner v4.111 - Logfile created 18/02/2015 at 15:36:57# Updated 18/02/2015 by Xplode# Database : 2015-02-18.3 [server]# Operating system : Windows 7 Professional Service Pack 1 (x64)# Username : Kidstuff - KSPSCAD1# Running from : C:\Users\Kidstuff\Desktop\AdwCleaner.exe# Option : Cleaning***** [ Services ] ********** [ Files / Folders ] *****Folder Deleted : C:\ProgramData\BabylonFolder Deleted : C:\ProgramData\ConduitFolder Deleted : C:\ProgramData\PartnerFolder Deleted : C:\Program Files (x86)\ConduitFolder Deleted : C:\Program Files (x86)\MyPC BackupFolder Deleted : C:\Windows\UtilFolder Deleted : C:\Users\Kidstuff\AppData\Local\Temp\AirInstallerFolder Deleted : C:\Users\Kidstuff\AppData\Local\Bundled software uninstallerFolder Deleted : C:\Users\Kidstuff\AppData\Local\ConduitFolder Deleted : C:\Users\Kidstuff\AppData\Local\unitlayersFolder Deleted : C:\Users\Kidstuff\AppData\LocalLow\ConduitFolder Deleted : C:\Users\Kidstuff\AppData\Roaming\BabylonFolder Deleted : C:\Users\Kidstuff\AppData\Roaming\digitalsiteFile Deleted : C:\END***** [ Scheduled tasks ] *****Task Deleted : DigitalSite***** [ Shortcuts ] ********** [ Registry ] *****Key Deleted : HKLM\SOFTWARE\Classes\Prod.capKey Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3282812Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289663Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3289847Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7C3B01BC-53A5-48A0-A43B-0C67731134B9}Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0ABE0FED-50E7-4E42-A125-57C0A11DBCDE}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{1231839B-064E-4788-B865-465A1B5266FD}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{2DAC2231-CC35-482B-97C5-CED1D4185080}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F1CD84C-04A3-4EA0-9EA1-7D134FD66C82}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3F83A9CA-B5F0-44EC-9357-35BB3E84B07F}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{47E520EA-CAD2-4F51-8F30-613B3A1C33EB}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{57C91446-8D81-4156-A70E-624551442DE9}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{69D3F709-9DE2-479F-980F-532D46895703}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{70AFB7B2-9FB5-4A70-905B-0E9576142E1D}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{7AD65FD1-79E0-406D-B03C-DD7C14726D69}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{97DD820D-2E20-40AD-B01E-6730B2FCE630}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9EDC0C90-2B5B-4512-953E-35767BAD5C67}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B177446D-54A4-4869-BABC-8566110B4BE0}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B37B4BA6-334E-72C1-B57E-6AFE8F8A5AF3}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{CA1CE38C-F04C-471F-B9F3-083C58165C10}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D54C859C-6066-4F31-8FE0-2AAEDCAE67D7}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{D9D1DFC5-502D-43E4-B1BB-4D0B7841489A}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E0B07188-A528-4F9E-B2F7-C7FDE8680AE4}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{E773F2CF-5E6E-FF2B-81A1-AC581A26B2B2}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F05B12E1-ADE8-4485-B45B-898748B53C37}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F42C7B47-5234-4BF5-8882-DAAC0D64870D}Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{F7BEBBB1-7E6B-4561-9444-6F4866D60C7C}Key Deleted : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{E8755B69-07B2-4E9D-B719-75F19C6E812C}Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{FA69100B-E03B-460C-A249-4506665598EC}Key Deleted : HKCU\Software\BABSOLUTIONKey Deleted : HKCU\Software\BIKey Deleted : HKCU\Software\ConduitKey Deleted : HKCU\Software\DeltaKey Deleted : HKCU\Software\ilividKey Deleted : HKCU\Software\ImeshKey Deleted : HKCU\Software\InstalledThirdPartyProgramsKey Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKCU\Software\AppDataLow\Software\ConduitKey Deleted : HKLM\SOFTWARE\{1146AC44-2F03-4431-B4FD-889BC837521F}Key Deleted : HKLM\SOFTWARE\{6791A2F3-FC80-475C-A002-C014AF797E9C}Key Deleted : HKLM\SOFTWARE\ConduitKey Deleted : HKLM\SOFTWARE\DeltaKey Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\DigitalSiteKey Deleted : [x64] HKLM\SOFTWARE\InstalledThirdPartyProgramsData Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings [ProxyOverride] - <local>***** [ Web browsers ] *****-\\ Internet Explorer v11.0.9600.17631-\\ Mozilla Firefox v35.0.1 (x86 en-US)-\\ Google Chrome v40.0.2214.111*************************AdwCleaner[R0].txt - [5720 bytes] - [18/02/2015 15:17:19]AdwCleaner[s0].txt - [5150 bytes] - [18/02/2015 15:36:57]########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [5209 bytes] ########## ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Junkware Removal Tool (JRT) by ThisisuVersion: 6.4.2 (02.02.2015:1)OS: Windows 7 Professional x64Ran by Kidstuff on Wed 02/18/2015 at 15:52:45.38~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Services~~~ Registry Values~~~ Registry Keys~~~ Files~~~ FoldersSuccessfully deleted: [Folder] "C:\Users\Kidstuff\appdata\local\cre"~~~ Event Viewer Logs were cleared~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~Scan was completed on Wed 02/18/2015 at 15:54:43.73End of JRT log~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.19, April 2013Started On Wed Apr 24 14:19:19 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Apr 24 14:19:50 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.20, May 2013Started On Wed May 15 03:03:17 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed May 15 03:04:02 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.21, June 2013Started On Wed Jun 12 03:00:46 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jun 12 03:01:40 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v4.22, July 2013Started On Wed Jul 10 03:03:51 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jul 10 03:04:50 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.3, August 2013 (build 5.3.9301.0)Started On Thu Aug 15 03:01:02 2013Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Aug 15 03:02:10 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.4, September 2013 (build 5.4.9400.0)Started On Tue Sep 17 03:04:28 2013Engine: 1.1.9800.0Signatures: 1.157.932.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Tue Sep 17 03:05:42 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.5, October 2013 (build 5.5.9502.0)Started On Wed Oct 09 03:03:24 2013Engine: 1.1.9901.0Signatures: 1.159.530.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 09 03:04:14 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.6, November 2013 (build 5.6.9603.0)Started On Wed Nov 13 16:37:10 2013Engine: 1.1.10003.0Signatures: 1.161.1618.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 13 16:38:11 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.7, December 2013 (build 5.7.9701.0)Started On Sun Dec 15 03:00:24 2013Engine: 1.1.10100.0Signatures: 1.163.1013.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Sun Dec 15 03:01:25 2013Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.8, January 2014 (build 5.8.9803.0)Started On Thu Jan 16 03:00:25 2014Engine: 1.1.10201.0Signatures: 1.165.1273.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Jan 16 03:01:22 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.9, February 2014 (build 5.9.9902.0)Started On Thu Feb 20 03:00:18 2014Engine: 1.1.10201.0Signatures: 1.165.3163.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Feb 20 03:01:19 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.10, March 2014 (build 5.10.10001.0)Started On Wed Mar 19 14:04:49 2014Engine: 1.1.10302.0Signatures: 1.167.1001.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Mar 19 14:05:48 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.11, April 2014 (build 5.11.10100.0)Started On Thu Apr 10 03:00:58 2014Engine: 1.1.10401.0Signatures: 1.169.1258.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Apr 10 03:02:04 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.12, May 2014 (build 5.12.10200.0)Started On Thu May 15 03:01:30 2014Engine: 1.1.10502.0Signatures: 1.173.1305.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu May 15 03:02:30 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.13, June 2014 (build 5.13.10300.0)Started On Thu Jun 12 03:02:21 2014Engine: 1.1.10600.0Signatures: 1.175.1113.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Jun 12 03:03:15 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.14, July 2014 (build 5.14.10402.0)Started On Wed Jul 09 03:01:47 2014Engine: 1.1.10701.0Signatures: 1.177.949.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jul 09 03:02:43 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.15, August 2014 (build 5.15.10500.0)Started On Sat Aug 16 03:03:43 2014Engine: 1.1.10802.0Signatures: 1.179.1796.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Sat Aug 16 03:06:19 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.16, September 2014 (build 5.16.10602.0)Started On Thu Sep 11 03:01:12 2014Engine: 1.1.10904.0Signatures: 1.183.882.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Thu Sep 11 03:04:05 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.17, October 2014 (build 5.17.10700.0)Started On Wed Oct 15 03:00:41 2014Engine: 1.1.11005.0Signatures: 1.185.2035.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Oct 15 03:03:32 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.18, November 2014 (build 5.18.10802.0)Started On Wed Nov 12 03:00:59 2014Engine: 1.1.11104.0Signatures: 1.187.1116.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Nov 12 03:02:23 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.19, December 2014 (build 5.19.10902.0)Started On Wed Dec 10 03:03:29 2014Engine: 1.1.11202.0Signatures: 1.189.872.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Dec 10 03:04:51 2014Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.20, January 2015 (build 5.20.11000.0)Started On Wed Jan 14 03:00:20 2015Engine: 1.1.11302.0Signatures: 1.191.1276.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Jan 14 03:02:13 2015Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.20, January 2015 (build 5.20.11000.0)Started On Tue Jan 27 03:00:35 2015Engine: 1.1.11302.0Signatures: 1.191.1276.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Tue Jan 27 03:02:42 2015Return code: 0 (0x0)---------------------------------------------------------------------------------------Microsoft Windows Malicious Software Removal Tool v5.21, February 2015 (build 5.21.11102.0)Started On Wed Feb 11 03:01:29 2015Engine: 1.1.11302.0Signatures: 1.191.3593.0Results Summary:----------------No infection found.Microsoft Windows Malicious Software Removal Tool Finished On Wed Feb 11 03:03:30 2015Return code: 0 (0x0) Here's what MSE found before I contacted you guys: TrojanDropper:Win32/Robrow.M; BrowserModifier:Win32/Zwangi; BrowserModifier:Win32/DefaultTab.I haven't deleted them yet. Do you want me to do that now or wait? Link to post Share on other sites More sharing options...
kevinf80 Posted February 18, 2015 ID:940849 Share Posted February 18, 2015 Yes please, delete whatever was found... Run FRST again, ensure all boxes are checkmarked under "WhiteList" but only checkmark Addition.txt under "Optional scan" Select scan, post the two new logs when complete... Link to post Share on other sites More sharing options...
krome Posted February 19, 2015 Author ID:941037 Share Posted February 19, 2015 Ok here are the FRST logs: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 18-02-2015 01Ran by Kidstuff (administrator) on KSPSCAD1 on 19-02-2015 09:19:03Running from C:\Users\Kidstuff\DesktopLoaded Profiles: Kidstuff & MSSQL$ESTOCKCARD3 (Available profiles: Kidstuff & MSSQL$ESTOCKCARD3)Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: FF)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(AMD) C:\Windows\System32\atiesrxx.exe(AMD) C:\Windows\System32\atieclxx.exe(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe(Lenovo) C:\Program Files\Lenovo\LBAI\LBAEvent.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\sqlservr.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe(Lenovo) C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(Akamai Technologies, Inc.) C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe(Akamai Technologies, Inc.) C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\PowerMgr\SCHTASK.EXE(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12343400 2012-01-10] (Realtek Semiconductor)HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [289648 2012-05-24] (Lenovo Group Limited)HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-02-15] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)HKLM-x32\...\Run: [iMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2011-12-15] (Intel Corporation)HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)HKLM-x32\...\Run: [Power Manager Startup Utility] => C:\Program Files (x86)\Lenovo\PowerMgr\DPMHost.exe [23352 2012-02-22] ()HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1091376 2012-01-17] (Lenovo)HKLM-x32\...\Run: [bCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1104288 2014-12-03] (Adobe Systems Incorporated)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [TWC.Win7] => C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exeHKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Policies\Explorer: []HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\MountPoints2: {667ba9c6-a250-11e2-9fd4-806e6f6e6963} - Q:\LenovoQDrive.exeHKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\MountPoints2: {93ebc887-30ba-11e3-8a67-fc4dd4350121} - E:\MotorolaDeviceManagerSetup.exe -aHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\...\RunOnce: [] => [X]HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\...\RunOnce: [Lenovoautoqdrive] => C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutorunreg.exe [159744 2011-12-14] ()HKU\S-1-5-18\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)Startup: C:\Users\Kidstuff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vertabasetimer.lnkShortcutTarget: vertabasetimer.lnk -> C:\Program Files (x86)\vertabasetimer\vertabasetimer.exe (No File)ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENPHKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSEHKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com/welcome/thinkcentreHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENPHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSEHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkID=226786&Mkt=en-US&Src=MSE&Tid=000328B9&OHP=http%3A%2F%2Fwww.google.com%2Fig%2Fredirectdomain%3Fbrand%3DLENP%26bmod%3DLENP,http%3A%2F%2Fwww.lenovo.com&OSP=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Die7%26q%3D%7BsearchTerms%7D%26rls%3Dcom.microsoft%3A%7Blanguage%7D%3A%7Breferrer%3Asource%3F%7D%26ie%3D%7BinputEncoding%7D%26oe%3D%7BoutputEncoding%7D%26rlz%3D1I7LENPSearchScopes: HKLM -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSESearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENPSearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSESearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENPSearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSEBHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.0.1Tcpip\Parameters: [NameServer] 8.8.8.8,8.8.4.4Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer] 8.8.8.8,8.8.4.4Tcpip\..\Interfaces\{FE273F25-CD2A-4DF1-8451-46A330CC8582}: [NameServer] 8.8.8.8,8.8.4.4FireFox:========FF ProfilePath: C:\Users\Kidstuff\AppData\Roaming\Mozilla\Firefox\Profiles\zlryv1jz.defaultFF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No FileFF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF HKLM-x32\...\Firefox\Extensions: [VIP5X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access ClientChrome:=======CHR HomePage: Profile 1 -> hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=86F0FC4DD4350121&affID=119351&tt=160913_nocpn&tsp=5014CHR StartupUrls: Profile 1 -> "hxxp://www.google.com/"CHR Plugin: (Shockwave Flash) - C:\PROGRA~2\Google\Chrome\APPLIC~1\40.0.2214.111\PepperFlash\pepflashplayer.dll ()CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewerCHR Plugin: (Native Client) - C:\PROGRA~2\Google\Chrome\APPLIC~1\40.0.2214.111\ppGoogleNaClPluginChrome.dll No FileCHR Plugin: (Chrome PDF Viewer) - C:\PROGRA~2\Google\Chrome\APPLIC~1\40.0.2214.111\pdf.dll ()CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No FileCHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No FileCHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No FileCHR Profile: C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\DefaultCHR Profile: C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1CHR Extension: (Mp3Skull Toolbar) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\anaehjnjgheaikfecjlfokolkoalpnda [2013-08-26]CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-28]CHR Extension: (My Scrap Nook) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gnaghjfblmncnfgjddgelpkbhfdflicf [2013-11-04]CHR Extension: (Google Wallet) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-26]==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.) [File not signed]R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776 2012-01-17] (Lenovo)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2011-12-15] (Intel Corporation)R2 LBAEvent; C:\Program Files\Lenovo\LBAI\LBAEvent.exe [15520 2012-03-23] (Lenovo) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)R2 MSSQL$ESTOCKCARD3; c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\sqlservr.exe [206424 2012-02-11] (Microsoft Corporation)R2 MSSQL$RIT; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)R2 Power Manager DBC Service; C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.EXE [70968 2012-02-22] (Lenovo)S3 PwmEWSvc; C:\Program Files (x86)\Lenovo\PowerMgr\PWMEWSVC.EXE [165176 2012-02-22] (Lenovo Group Limited)S4 SQLAgent$ESTOCKCARD3; c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\SQLAGENT.EXE [438360 2012-02-11] (Microsoft Corporation)R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440 2008-01-10] (Ulead Systems, Inc.) [File not signed]S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70416 2012-01-17] (Windows ® Win 7 DDK provider)R3 LBAI; C:\Windows\System32\Drivers\LBAI.sys [9600 2011-12-08] (Lenovo)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-19] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2015-02-19 09:18 - 2015-02-19 09:18 - 00000000 ____D () C:\Users\Kidstuff\Desktop\FRST-OlderVersion2015-02-18 15:54 - 2015-02-18 15:54 - 00000708 _____ () C:\Users\Kidstuff\Desktop\JRT.txt2015-02-18 15:48 - 2015-02-18 15:48 - 01388274 _____ (Thisisu) C:\Users\Kidstuff\Desktop\JRT.exe2015-02-18 15:35 - 2015-02-18 15:35 - 00001063 _____ () C:\Users\Kidstuff\Desktop\mbamscan_1.txt2015-02-18 15:34 - 2015-02-18 15:34 - 00001061 _____ () C:\Users\Kidstuff\Desktop\mbamscan.txt2015-02-18 15:17 - 2015-02-18 15:36 - 00000000 ____D () C:\AdwCleaner2015-02-18 15:16 - 2015-02-18 15:16 - 02126848 _____ () C:\Users\Kidstuff\Desktop\AdwCleaner.exe2015-02-17 16:38 - 2015-02-19 05:47 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-02-17 16:38 - 2015-02-17 16:38 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2015-02-17 16:38 - 2015-02-17 16:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2015-02-17 16:38 - 2015-02-17 16:38 - 00000000 ____D () C:\ProgramData\Malwarebytes2015-02-17 16:38 - 2015-02-17 16:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2015-02-17 16:38 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2015-02-17 16:38 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys2015-02-17 16:38 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys2015-02-17 16:37 - 2015-02-17 16:37 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Kidstuff\Downloads\mbam-setup-2.0.4.1028.exe2015-02-17 14:30 - 2015-02-17 14:30 - 00029494 _____ () C:\Users\Kidstuff\Desktop\Addition.txt2015-02-17 14:29 - 2015-02-19 09:19 - 00019499 _____ () C:\Users\Kidstuff\Desktop\FRST.txt2015-02-17 14:29 - 2015-02-19 09:19 - 00000000 ____D () C:\FRST2015-02-17 14:28 - 2015-02-19 09:18 - 02086912 _____ (Farbar) C:\Users\Kidstuff\Desktop\FRST64.exe2015-02-17 14:27 - 2015-02-17 14:27 - 00001170 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk2015-02-17 14:27 - 2015-02-17 14:27 - 00001158 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\Mozilla2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\ProgramData\Mozilla2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2015-02-17 14:23 - 2015-02-17 14:23 - 00000000 __SHD () C:\Users\Kidstuff\AppData\Local\EmieBrowserModeList2015-02-17 13:30 - 2015-02-17 13:30 - 00620544 _____ () C:\Parts.xls2015-02-11 17:46 - 2015-01-22 22:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2015-02-11 17:46 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2015-02-11 17:46 - 2015-01-22 21:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2015-02-11 17:46 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll2015-02-10 20:45 - 2015-02-03 21:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2015-02-10 20:45 - 2015-01-27 17:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe2015-02-10 20:45 - 2015-01-13 23:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2015-02-10 20:45 - 2015-01-13 23:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2015-02-10 20:45 - 2015-01-12 21:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll2015-02-10 20:45 - 2015-01-12 20:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll2015-02-10 20:45 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2015-02-10 20:45 - 2015-01-11 21:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2015-02-10 20:45 - 2015-01-11 21:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2015-02-10 20:45 - 2015-01-11 20:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2015-02-10 20:45 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2015-02-10 20:45 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2015-02-10 20:45 - 2015-01-11 20:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2015-02-10 20:45 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2015-02-10 20:45 - 2015-01-11 20:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2015-02-10 20:45 - 2015-01-11 20:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2015-02-10 20:45 - 2015-01-11 20:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2015-02-10 20:45 - 2015-01-11 20:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2015-02-10 20:45 - 2015-01-11 20:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2015-02-10 20:45 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2015-02-10 20:45 - 2015-01-11 20:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2015-02-10 20:45 - 2015-01-11 20:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2015-02-10 20:45 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2015-02-10 20:45 - 2015-01-11 20:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2015-02-10 20:45 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2015-02-10 20:45 - 2015-01-11 20:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2015-02-10 20:45 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2015-02-10 20:45 - 2015-01-11 20:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2015-02-10 20:45 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2015-02-10 20:45 - 2015-01-11 20:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2015-02-10 20:45 - 2015-01-11 19:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2015-02-10 20:45 - 2015-01-11 19:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2015-02-10 20:45 - 2015-01-11 19:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2015-02-10 20:45 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2015-02-10 20:45 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2015-02-10 20:45 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2015-02-10 20:45 - 2015-01-11 19:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2015-02-10 20:45 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2015-02-10 20:45 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2015-02-10 20:45 - 2015-01-11 19:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2015-02-10 20:45 - 2015-01-11 19:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2015-02-10 20:45 - 2015-01-11 19:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2015-02-10 20:45 - 2015-01-11 19:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2015-02-10 20:45 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2015-02-10 20:45 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2015-02-10 20:45 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2015-02-10 20:45 - 2015-01-11 19:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2015-02-10 20:45 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2015-02-10 20:45 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2015-02-10 20:45 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2015-02-10 20:45 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2015-02-10 20:45 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2015-02-10 20:45 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll2015-02-10 20:44 - 2015-01-15 02:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys2015-02-10 20:44 - 2015-01-15 02:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys2015-02-10 20:44 - 2015-01-15 02:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe2015-02-10 20:44 - 2015-01-15 02:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll2015-02-10 20:44 - 2015-01-15 02:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe2015-02-10 20:44 - 2015-01-15 02:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll2015-02-10 20:44 - 2015-01-15 02:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll2015-02-10 20:44 - 2015-01-15 02:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll2015-02-10 20:44 - 2015-01-15 01:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe2015-02-10 20:44 - 2015-01-15 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2015-02-10 20:44 - 2015-01-15 01:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2015-02-10 20:44 - 2015-01-15 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll2015-02-10 20:44 - 2015-01-15 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll2015-02-10 20:44 - 2015-01-15 01:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll2015-02-10 20:44 - 2015-01-14 22:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys2015-02-10 20:44 - 2015-01-14 00:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe2015-02-10 20:44 - 2015-01-14 00:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll2015-02-10 20:44 - 2015-01-14 00:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll2015-02-10 20:44 - 2015-01-14 00:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe2015-02-10 20:44 - 2015-01-13 23:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2015-02-10 20:44 - 2015-01-13 23:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2015-02-10 20:44 - 2015-01-13 23:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll2015-02-10 20:44 - 2015-01-08 20:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2015-02-10 20:44 - 2014-12-11 23:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll2015-02-10 20:44 - 2014-12-11 23:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll2015-02-10 20:44 - 2014-12-07 21:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll2015-02-10 20:44 - 2014-12-07 20:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll2015-02-10 20:44 - 2014-11-25 21:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll2015-02-10 20:44 - 2014-11-25 21:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll2015-02-05 01:40 - 2015-02-05 01:40 - 04437680 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2015-02-03 09:42 - 2015-02-03 09:42 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task2015-01-26 15:35 - 2014-12-18 21:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll2015-01-26 15:35 - 2014-12-18 19:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys2015-01-26 15:35 - 2014-12-11 11:47 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe2015-01-26 15:35 - 2014-12-05 22:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll2015-01-26 15:35 - 2014-12-05 21:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll2015-01-26 15:35 - 2014-12-05 21:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2015-02-19 08:40 - 2013-06-05 07:37 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2015-02-19 08:28 - 2013-04-30 12:03 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-02-19 08:02 - 2013-04-10 20:40 - 01425469 _____ () C:\Windows\WindowsUpdate.log2015-02-18 22:28 - 2013-04-30 12:03 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-02-18 15:45 - 2009-07-13 22:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-02-18 15:45 - 2009-07-13 22:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-02-18 15:42 - 2009-07-13 23:13 - 00977804 _____ () C:\Windows\system32\PerfStringBackup.INI2015-02-18 15:37 - 2010-11-20 21:47 - 00785840 _____ () C:\Windows\PFRO.log2015-02-18 15:37 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-02-18 15:37 - 2009-07-13 22:51 - 00064864 _____ () C:\Windows\setupact.log2015-02-17 14:27 - 2013-09-23 08:28 - 00000000 ____D () C:\Users\Kidstuff\AppData\Roaming\Mozilla2015-02-17 14:27 - 2013-09-23 08:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2015-02-17 14:08 - 2013-06-06 11:54 - 00000000 ____D () C:\Users\MSSQL$ESTOCKCARD32015-02-17 14:03 - 2013-09-23 09:28 - 00000214 _____ () C:\Users\Kidstuff\AppData\Roaming\WB.CFG2015-02-17 13:45 - 2013-05-01 07:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office2015-02-17 13:45 - 2013-05-01 06:58 - 00000000 ____D () C:\ProgramData\Microsoft Help2015-02-17 12:29 - 2013-05-15 08:32 - 00606500 _____ () C:\Windows\system32\webservice4.log2015-02-17 12:19 - 2013-05-15 08:32 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\cache2015-02-12 04:10 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache2015-02-12 03:03 - 2013-05-01 08:19 - 00969926 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI2015-02-11 03:23 - 2009-07-13 22:45 - 00537632 _____ () C:\Windows\system32\FNTCACHE.DAT2015-02-11 03:21 - 2014-12-10 03:08 - 00000000 ____D () C:\Windows\system32\appraiser2015-02-11 03:21 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel2015-02-11 03:21 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2015-02-11 03:05 - 2009-07-13 20:34 - 00000478 _____ () C:\Windows\win.ini2015-02-11 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT2015-02-11 03:03 - 2013-04-24 13:48 - 00002128 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk2015-02-11 03:03 - 2013-04-24 13:48 - 00001945 _____ () C:\Windows\epplauncher.mif2015-02-11 03:03 - 2013-04-24 13:48 - 00000000 ____D () C:\Program Files\Microsoft Security Client2015-02-11 03:03 - 2013-04-24 13:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client2015-02-11 03:01 - 2013-04-24 13:19 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2015-02-05 23:29 - 2013-04-30 12:04 - 00002194 _____ () C:\Users\Public\Desktop\Google Chrome.lnk2015-02-05 01:40 - 2013-06-05 07:37 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2015-02-05 01:40 - 2013-06-05 07:37 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2015-02-05 01:40 - 2013-06-05 07:37 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2015-02-04 22:23 - 2013-04-30 12:03 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA2015-02-04 22:23 - 2013-04-30 12:03 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore2015-01-27 03:02 - 2013-04-30 10:49 - 00000000 ____D () C:\Users\Kidstuff2015-01-26 17:21 - 2013-06-05 07:37 - 00000000 ____D () C:\Windows\system32\Macromed2015-01-26 17:21 - 2013-05-15 08:15 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\Akamai2015-01-26 17:21 - 2013-04-30 12:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome2015-01-26 17:21 - 2013-04-24 13:45 - 00000000 ____D () C:\Program Files\Microsoft Silverlight2015-01-26 17:21 - 2013-04-24 13:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight2015-01-26 17:21 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration==================== Files in the root of some directories =======2013-07-25 13:48 - 2013-07-29 15:59 - 0000000 _____ () C:\Users\Kidstuff\AppData\Roaming\bibstats2013-09-20 12:44 - 2013-09-20 12:44 - 0037847 _____ () C:\Users\Kidstuff\AppData\Roaming\Comma Separated Values (DOS).ADR2013-07-16 09:54 - 2013-07-16 10:23 - 0038449 _____ () C:\Users\Kidstuff\AppData\Roaming\Comma Separated Values (Windows).ADR2013-09-23 09:28 - 2015-02-17 14:03 - 0000214 _____ () C:\Users\Kidstuff\AppData\Roaming\WB.CFG2013-09-23 09:28 - 2014-01-29 00:28 - 0000005 _____ () C:\Users\Kidstuff\AppData\Roaming\WBPU-TTL.DAT2013-06-21 12:38 - 2013-06-21 12:38 - 0003584 _____ () C:\Users\Kidstuff\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini2013-10-17 07:32 - 2013-10-17 07:32 - 0000000 _____ () C:\ProgramData\233a23272c333d59_c2013-06-06 11:32 - 2013-06-17 11:44 - 0005012 _____ () C:\ProgramData\liupbmqt.mviSome content of TEMP:====================C:\Users\Kidstuff\AppData\Local\Temp\AcDeltree.exeC:\Users\Kidstuff\AppData\Local\Temp\airCCFB.exeC:\Users\Kidstuff\AppData\Local\Temp\BD50_FPPSetup.exeC:\Users\Kidstuff\AppData\Local\Temp\bi_cleaner.exeC:\Users\Kidstuff\AppData\Local\Temp\eisetup.exeC:\Users\Kidstuff\AppData\Local\Temp\fsrvsetup.exeC:\Users\Kidstuff\AppData\Local\Temp\helper.exeC:\Users\Kidstuff\AppData\Local\Temp\ppadsetup.exeC:\Users\Kidstuff\AppData\Local\Temp\PreferencesJson.exeC:\Users\Kidstuff\AppData\Local\Temp\Quarantine.exeC:\Users\Kidstuff\AppData\Local\Temp\Sqlite3.dllC:\Users\Kidstuff\AppData\Local\Temp\sqlite3.exeC:\Users\Kidstuff\AppData\Local\Temp\System.Data.SQLite.dllC:\Users\Kidstuff\AppData\Local\Temp\tbInte.dllC:\Users\Kidstuff\AppData\Local\Temp\tbSomo.dllC:\Users\Kidstuff\AppData\Local\Temp\tbWhit.dllC:\Users\Kidstuff\AppData\Local\Temp\The_Weather_Channel_Application.exeC:\Users\Kidstuff\AppData\Local\Temp\uninst1.exeC:\Users\Kidstuff\AppData\Local\Temp\US_en_Avery_AW40.exeC:\Users\Kidstuff\AppData\Local\Temp\vlc-2.0.2-win32.exe==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2015-02-13 00:20==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 18-02-2015 01Ran by Kidstuff at 2015-02-19 09:19:17Running from C:\Users\Kidstuff\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)Akamai NetSession Interface (HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Akamai) (Version: - Akamai Technologies, Inc)AMD Catalyst Install Manager (HKLM\...\{2239633A-969C-39BF-B5C2-C172F44EC096}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)AutoCAD LT 2014 - English (Version: 19.1.18.0 - Autodesk) HiddenAutoCAD LT 2014 Language Pack - English (Version: 19.1.18.0 - Autodesk) HiddenAutodesk 360 (HKLM\...\{52B28CAD-F49D-47BA-9FFE-29C2E85F0D0B}) (Version: 4.0.27.1 - Autodesk)Autodesk AutoCAD LT 2014 - English (HKLM\...\AutoCAD LT 2014 - English) (Version: 19.1.18.0 - Autodesk)Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.1.3.0 - Autodesk)Autodesk Content Service (x32 Version: 3.1.3.0 - Autodesk) HiddenAutodesk Content Service Language Pack (x32 Version: 3.1.3.0 - Autodesk) HiddenAutodesk Material Library 2014 (HKLM-x32\...\{644F9B19-A462-499C-BF4D-300ABC2A28B1}) (Version: 4.0.19.0 - Autodesk)Autodesk Material Library Base Resolution Image Library 2014 (HKLM-x32\...\{51BF3210-B825-4092-8E0D-66D689916E02}) (Version: 4.0.19.0 - Autodesk)Avery Wizard 4.0 (HKLM-x32\...\{7196E6BD-4B65-43F9-9D30-73A8E58D0E84}) (Version: 4.0.103 - Avery)Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) HiddenCorel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) HiddenCorel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)Crystal Reports Basic Runtime for Visual Studio 2008 (x64) (Version: 10.5.0.0 - Business Objects) HiddenDirect DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) HiddenGoogle Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.111 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoogle Update Helper (x32 Version: 1.3.26.9 - Google Inc.) HiddenIntel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)Intel® Network Connections 16.8.46.0 (HKLM\...\PROSetDX) (Version: 16.8.46.0 - Intel)Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)LBAI (HKLM-x32\...\{C5C91B7B-38A6-40B7-84D6-E44885E44B13}) (Version: 1.0.0.6 - Lenovo)Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)Microsoft Office Access Runtime (English) 2007 (HKLM-x32\...\{90120000-001C-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)Microsoft SQL Server 2008 Setup Support Files (HKLM-x32\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation)Microsoft SQL Server 2012 (HKLM-x32\...\Microsoft SQL Server SQLServer2012) (Version: - Microsoft Corporation)Microsoft SQL Server 2012 Native Client (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server 2012 Setup (English) (HKLM-x32\...\{CEA86648-87FA-4775-8F3B-A57F720BAE85}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server 2012 Transact-SQL ScriptDom (HKLM\...\{0E8670B8-3965-4930-ADA6-570348B67153}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 8.0 Support DLLs (HKLM-x32\...\{342F5437-C87D-4BB5-89B9-B23E16C6A395}) (Version: 1.0.0 - McNeel & Associates)Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)Microsoft VSS Writer for SQL Server 2012 (HKLM\...\{3E0DD83F-BE4C-4478-86A0-AD0D79D1353E}) (Version: 11.0.2100.60 - Microsoft Corporation)Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 1.00.0802 - Lenovo)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6543 - Realtek Semiconductor Corp.)Rhinoceros 4.0 SR6 (HKLM-x32\...\{6B9DD988-5ECB-4623-BBFF-8A8F2DA3ED16}) (Version: 4.0.40709 - Robert McNeel & Associates)Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.02.00 - Samsung Electronics Co., Ltd.)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)SQL Server 2012 Common Files (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server 2012 Database Engine Services (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server 2012 Database Engine Shared (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server Browser for SQL Server 2012 (HKLM-x32\...\{4B9E6EB0-0EED-4E74-9479-F982C3254F71}) (Version: 11.0.2100.60 - Microsoft Corporation)Sql Server Customer Experience Improvement Program (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenTeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.30992 - TeamViewer)ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.0.30.0 - Lenovo)ThinkVantage Power Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 2.10.0007 - Lenovo Group Limited)View Management Utility (HKLM-x32\...\InstallShield_{C6254514-DD94-45E5-87C0-B9CB90A34C89}) (Version: 3.0.12.0329 - Lenovo)View Management Utility (Version: 3.0.12.0329 - Lenovo) HiddenWindows Driver Package - Advanced Micro Devices (AtiHDAudioService) MEDIA (10/18/2011 7.12.0.7704) (HKLM\...\7E26D65CA5110FF168A57B5C479134FA5450759B) (Version: 10/18/2011 7.12.0.7704 - Advanced Micro Devices)Windows Driver Package - Advanced Micro Devices, Inc. (amdkmdap) Display (02/14/2012 8.913.1.0000) (HKLM\...\4D7E325B73136CE735F86BC465965BFECB76C1AD) (Version: 02/14/2012 8.913.1.0000 - Advanced Micro Devices, Inc.)Windows Driver Package - Intel (e1cexpress) Net (01/11/2012 11.15.16.0) (HKLM\...\E6D02BAF356D0EEE96DE70D352026CE420321A16) (Version: 01/11/2012 11.15.16.0 - Intel)Windows Driver Package - Intel hdc (08/26/2011 9.3.0.1011) (HKLM\...\A7E82C89A6D6643325B95A4FEDAB3DB18640208F) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel System (01/11/2012 9.3.0.1020) (HKLM\...\09839A9B5EDA69DA2DCC34637B5140AAF8A53B44) (Version: 01/11/2012 9.3.0.1020 - Intel)Windows Driver Package - Intel System (08/26/2011 9.3.0.1011) (HKLM\...\9D7CD466F7FC8B18FF1B84943B7BB8648D17FCE8) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel System (08/26/2011 9.3.0.1011) (HKLM\...\D8EF6CACF49BD33CC1FACD124C8CC2B1A8E8AE35) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel USB (08/26/2011 9.3.0.1011) (HKLM\...\97EE1802A0385A37DE6323FA39EC76BEB2D73E41) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (01/03/2012 6.0.1.6543) (HKLM\...\5DE3700033F94FCFD8726BE46A6727E460254CD5) (Version: 01/03/2012 6.0.1.6543 - Realtek Semiconductor Corp.)==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Kidstuff\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No FileCustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2014\acadlt.exe (Autodesk, Inc.)CustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2014\en-US\acadltficn.dll (Autodesk, Inc.)==================== Restore Points =========================27-01-2015 03:00:11 Windows Update30-01-2015 03:15:58 Windows Update02-02-2015 11:31:27 Windows Update05-02-2015 11:31:59 Windows Update09-02-2015 11:31:39 Windows Update11-02-2015 03:00:20 Windows Update12-02-2015 03:00:11 Windows Update16-02-2015 03:32:18 Windows Update==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {1C668618-FB88-4AC5-8637-E6476802E16D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)Task: {23F8CD9E-39C7-42B8-A3E7-81ED66C61081} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-30] (Google Inc.)Task: {2E4AB855-1826-4657-841F-6F0E4A6FAB00} - System32\Tasks\PMTask => C:\Program Files (x86)\Lenovo\PowerMgr\PWMIDTSV.EXE [2012-02-22] (Lenovo Group Limited)Task: {57F760AA-9985-4A87-9E74-352AAD7C6407} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-30] (Google Inc.)Task: {62EBFDF1-E687-44FB-BCBA-F42A76EFE5A9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)Task: {9162585C-AB42-4AEC-9508-1B8062A771EE} - System32\Tasks\{0331DB66-F86F-4943-A9C5-2B2100C28796} => pcalua.exe -a C:\ISRPSetup\ISRPSetup.exe -d C:\ISRPSetupTask: {99B725CD-4AE3-456C-8393-3E1E9169F36F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvcTask: {F10D5434-7EB9-4B9C-BAB2-784FC3679952} - System32\Tasks\{41059747-FEBB-4B30-9855-2A9A45A74D1D} => pcalua.exe -a C:\Users\Kidstuff\Desktop\DesignPro5_2_Limited.exe -d C:\Users\Kidstuff\DesktopTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) ==============2008-09-08 09:19 - 2008-09-08 09:19 - 00022016 _____ () C:\Windows\System32\cl31cl6.dll2013-04-30 10:46 - 2011-04-10 23:26 - 00034304 _____ () C:\Windows\System32\spe__l.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00056352 _____ () C:\Program Files\Autodesk\Autodesk Sync\qoauth_Ad_1.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00937504 _____ () C:\Program Files\Autodesk\Autodesk Sync\qca_Ad_2.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00124448 _____ () C:\Program Files\Autodesk\Autodesk Sync\QJson.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00045088 _____ () C:\Program Files\Autodesk\Autodesk Sync\QtSolutions_MFCMigrationFramework_Ad_2.dll2011-11-09 10:55 - 2011-11-09 10:55 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll2012-02-14 23:35 - 2012-02-14 23:35 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll2013-04-10 20:52 - 2012-01-17 00:29 - 00030512 ____N () C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBServiceps.dll2014-10-15 02:21 - 2014-10-15 02:21 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\38485cf51c91ff758c145158360bbb97\IsdiInterop.ni.dll2013-04-10 20:41 - 2011-11-29 21:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll2013-04-10 20:44 - 2011-12-15 20:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll2015-02-17 14:27 - 2015-01-23 04:37 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)AlternateDataStreams: C:\Windows:nlsPreferences==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) ===============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Kidstuff\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgDNS Servers: 8.8.8.8 - 8.8.4.4==================== MSCONFIG/TASK MANAGER disabled items ==(Currently there is no automatic fix for this section.)==================== Accounts: =============================Administrator (S-1-5-21-1142913190-692752148-3269810916-500 - Administrator - Disabled)Guest (S-1-5-21-1142913190-692752148-3269810916-501 - Limited - Disabled)Kidstuff (S-1-5-21-1142913190-692752148-3269810916-1001 - Administrator - Enabled) => C:\Users\Kidstuff==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================System errors:=============Error: (02/18/2015 03:55:41 PM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Start with the following error:%%5Error: (02/18/2015 03:55:42 PM) (Source: Microsoft Antimalware) (EventID: 3002) (User: )Description: %%860 Real-Time Protection feature has encountered an error and failed. Feature: %%886 Error Code: 0x80070005 Error description: Access is denied. Reason: %%858Microsoft Office Sessions:============================================= Memory info ===========================Processor: Intel® Core i7-3770 CPU @ 3.40GHzPercentage of memory in use: 26%Total physical RAM: 8114.96 MBAvailable physical RAM: 5990.05 MBTotal Pagefile: 16228.12 MBAvailable Pagefile: 13542.61 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.84 MB==================== Drives ================================Drive c: (Windows7_OS) (Fixed) (Total:916.37 GB) (Free:639.02 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive q: (Lenovo_Recovery) (Fixed) (Total:13.67 GB) (Free:3.48 GB) NTFSDrive x: () (Network) (Total:149.05 GB) (Free:73.75 GB) NTFSDrive z: () (Network) (Total:149.05 GB) (Free:73.75 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (Size: 931.5 GB) (Disk ID: 70B41803)Partition 1: (Active) - (Size=1.5 GB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=916.4 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=13.7 GB) - (Type=07 NTFS)==================== End Of Log ============================ Link to post Share on other sites More sharing options...
kevinf80 Posted February 19, 2015 ID:941133 Share Posted February 19, 2015 Download attached fixlist.txt file (end of reply) and save it to the Desktop, or the folder you saved FRST into.NOTE. It's important that both FRST and fixlist.txt are in the same location or the fix will not work. Run FRST and press the Fix button just once and wait.The tool will make a log on the Desktop (Fixlog.txt) or the folder it was ran from. Please post it to your reply. Next, Scan with ESET Online Scanner This step can only be done using Internet Explorer, Google Chrome or Mozilla Firefox.Temporary disable your AntiVirus and AntiSpyware protection - instructions here.Please visit ESET Online Scanner website. Click there Run ESET Online Scanner. If using Internet Explorer: Accept the Terms of Use and click Start.Allow the running of add-on.If using Mozilla Firefox or Google Chrome:Download esetsmartinstaller_enu.exe that you'll be given link to.Double click esetsmartinstaller_enu.exe.Allow the Terms of Use and click Start.To perform the scan:Make sure that Remove found threats is unchecked.Scan archives is checked.In Advanced Settings: Scan for potentially unwanted applications, Scan for potentially unsafe applications and Enable Anti-Stealth technology are checked.Under “Enable Stealth Technology select “Change” select any extra drives in that window.Click StartThe program will begin to download it's virus database. The speed may vary depending on your Internet connection.When completed, the program will begin to scan. This may take several hours. Please, be patient.Do not do anything on your machine as it may interrupt the scan.When the scan is done, click Finish.A logfile will be created at C:\Program Files (x86)\ESET\ESET Online Scanner. Open it using Notepad.Please include this logfile in your next reply. Don't forget to re-enable protection software! Let me see those two logs, also give an update on any remaining issues or concerns.. Thanks, Kevin...Fixlist.txt Link to post Share on other sites More sharing options...
krome Posted February 20, 2015 Author ID:941619 Share Posted February 20, 2015 Ok here we go: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 18-02-2015 01Ran by Kidstuff at 2015-02-20 15:40:27 Run:1Running from C:\Users\Kidstuff\DesktopLoaded Profiles: Kidstuff & MSSQL$ESTOCKCARD3 (Available profiles: Kidstuff & MSSQL$ESTOCKCARD3)Boot Mode: Normal==============================================Content of fixlist:*****************startHKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Policies\Explorer: []HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\MountPoints2: {667ba9c6-a250-11e2-9fd4-806e6f6e6963} - Q:\LenovoQDrive.exeHKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\MountPoints2: {93ebc887-30ba-11e3-8a67-fc4dd4350121} - E:\MotorolaDeviceManagerSetup.exe -aCHR HomePage: Profile 1 -> hxxp://www.searchgol.com/?babsrc=HP_ss&mntrId=86F0FC4DD4350121&affID=119351&tt=160913_nocpn&tsp=50142013-10-17 07:32 - 2013-10-17 07:32 - 0000000 _____ () C:\ProgramData\233a23272c333d59_c2013-06-06 11:32 - 2013-06-17 11:44 - 0005012 _____ () C:\ProgramData\liupbmqt.mviC:\Users\Kidstuff\AppData\Local\Temp\AcDeltree.exeC:\Users\Kidstuff\AppData\Local\Temp\airCCFB.exeC:\Users\Kidstuff\AppData\Local\Temp\BD50_FPPSetup.exeC:\Users\Kidstuff\AppData\Local\Temp\bi_cleaner.exeC:\Users\Kidstuff\AppData\Local\Temp\eisetup.exeC:\Users\Kidstuff\AppData\Local\Temp\fsrvsetup.exeC:\Users\Kidstuff\AppData\Local\Temp\helper.exeC:\Users\Kidstuff\AppData\Local\Temp\ppadsetup.exeC:\Users\Kidstuff\AppData\Local\Temp\PreferencesJson.exeC:\Users\Kidstuff\AppData\Local\Temp\Quarantine.exeC:\Users\Kidstuff\AppData\Local\Temp\Sqlite3.dllC:\Users\Kidstuff\AppData\Local\Temp\sqlite3.exeC:\Users\Kidstuff\AppData\Local\Temp\System.Data.SQLite.dllC:\Users\Kidstuff\AppData\Local\Temp\tbInte.dllC:\Users\Kidstuff\AppData\Local\Temp\tbSomo.dllC:\Users\Kidstuff\AppData\Local\Temp\tbWhit.dllC:\Users\Kidstuff\AppData\Local\Temp\The_Weather_Channel_Application.exeC:\Users\Kidstuff\AppData\Local\Temp\uninst1.exeC:\Users\Kidstuff\AppData\Local\Temp\US_en_Avery_AW40.exeC:\Users\Kidstuff\AppData\Local\Temp\vlc-2.0.2-win32.exeEmptyTemp:end*****************HKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\\ => value deleted successfully."HKU\S-1-5-21-1142913190-692752148-3269810916-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{667ba9c6-a250-11e2-9fd4-806e6f6e6963}" => Key deleted successfully.HKCR\CLSID\{667ba9c6-a250-11e2-9fd4-806e6f6e6963} => Key not found."HKU\S-1-5-21-1142913190-692752148-3269810916-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{93ebc887-30ba-11e3-8a67-fc4dd4350121}" => Key deleted successfully.HKCR\CLSID\{93ebc887-30ba-11e3-8a67-fc4dd4350121} => Key not found.Chrome HomePage deleted successfully.C:\ProgramData\233a23272c333d59_c => Moved successfully.C:\ProgramData\liupbmqt.mvi => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\AcDeltree.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\airCCFB.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\BD50_FPPSetup.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\bi_cleaner.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\eisetup.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\fsrvsetup.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\helper.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\ppadsetup.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\PreferencesJson.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\Quarantine.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\Sqlite3.dll => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\sqlite3.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\System.Data.SQLite.dll => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\tbInte.dll => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\tbSomo.dll => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\tbWhit.dll => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\The_Weather_Channel_Application.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\uninst1.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\US_en_Avery_AW40.exe => Moved successfully.C:\Users\Kidstuff\AppData\Local\Temp\vlc-2.0.2-win32.exe => Moved successfully.EmptyTemp: => Removed 1.2 GB temporary data.The system needed a reboot.==== End of Fixlog 15:40:48 ==== ESETSmartInstaller@High as downloader log:all ok# product=EOS# version=8# OnlineScannerApp.exe=1.0.0.1# OnlineScanner.ocx=1.0.0.7623# api_version=3.0.2# EOSSerial=7e0a67a4cec8294f93391e3f90c73a79# engine=22575# end=finished# remove_checked=false# archives_checked=true# unwanted_checked=true# unsafe_checked=true# antistealth_checked=true# utc_time=2015-02-20 10:45:04# local_time=2015-02-20 04:45:04 (-0600, Central Standard Time)# country="United States"# lang=1033# osver=6.1.7601 NT Service Pack 1# compatibility_mode_1='Microsoft Security Essentials'# compatibility_mode=5895 16777213 100 100 0 65674020 0 0# scanned=194129# found=11# cleaned=0# scan_time=2984sh=97BCCD25561F44E9B13F05F6EEF083C9CE9BA529 ft=1 fh=641f1fb3d2e699c4 vn="Win32/Toolbar.Conduit.Y potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\Community Alerts\Alert.dll.vir"sh=DB5DEC21F203A3AE275461D03FF977C87C6C00F9 ft=1 fh=09feb8da0d515751 vn="Win32/Toolbar.Conduit.AC potentially unwanted application" ac=I fn="C:\AdwCleaner\Quarantine\C\Program Files (x86)\Conduit\CT3289663\plugins\TBVerifier.dll.vir"sh=B20C8F1B56E259BAD85BE78A99CB87B06872C527 ft=1 fh=31af058cd8c13232 vn="a variant of Win32/Toolbar.Conduit.H potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kidstuff\AppData\Local\Temp\eisetup.exe.xBAD"sh=14BD8568D91B241A7D0753975F3C37847087F144 ft=1 fh=af2b696d2a153a62 vn="a variant of Win32/Toolbar.Conduit.H potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kidstuff\AppData\Local\Temp\fsrvsetup.exe.xBAD"sh=F2FDA15DD7F37C18CE687E1B6B83D0358AAD678F ft=1 fh=ce42ffc2efb46278 vn="MSIL/FileTypeHelper.A potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kidstuff\AppData\Local\Temp\helper.exe.xBAD"sh=E8E5F5ABA9A9CA4A07156AFF974DE26B6D7960EB ft=1 fh=efac05b3b93fb2d8 vn="a variant of Win32/Bundled.Toolbar.Google.C potentially unsafe application" ac=I fn="C:\FRST\Quarantine\C\Users\Kidstuff\AppData\Local\Temp\ppadsetup.exe.xBAD"sh=6C02BC376864DF0440DE70DED3A65938D6295795 ft=1 fh=965e2f365cb21a83 vn="a variant of Win32/Toolbar.Conduit.X potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kidstuff\AppData\Local\Temp\tbInte.dll.xBAD"sh=31E93E104678E9814A5E5D43A73387819E6282E5 ft=1 fh=b31cd14a0801e57c vn="a variant of Win32/Toolbar.Conduit.X potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kidstuff\AppData\Local\Temp\tbSomo.dll.xBAD"sh=C3765EEA673C05499FE03A616DFD06AD9B5D2003 ft=1 fh=abb2e62a25934613 vn="a variant of Win32/Toolbar.Conduit.X potentially unwanted application" ac=I fn="C:\FRST\Quarantine\C\Users\Kidstuff\AppData\Local\Temp\tbWhit.dll.xBAD"sh=B307340E25D07B8A7D9E1E3F3467E6310352F0EC ft=0 fh=0000000000000000 vn="a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application" ac=I fn="C:\Users\Kidstuff\AppData\Local\Downloaded Installations\{BF3589D3-BF62-48FE-9405-C2FB81574783}\The Weather Channel App.msi"sh=050E7D4A29BFCC59B401D224B161EDB1D7D46EDB ft=1 fh=e745ef58d8bc0508 vn="a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application" ac=I fn="C:\Users\Kidstuff\Downloads\Avery Wizard 4.01 - US 20111209.exe" Link to post Share on other sites More sharing options...
kevinf80 Posted February 20, 2015 ID:941621 Share Posted February 20, 2015 Any remaining issues or concerns? Link to post Share on other sites More sharing options...
krome Posted February 23, 2015 Author ID:942277 Share Posted February 23, 2015 At first when I opened chrome the main start page was Ask.com, however, I just made chrome the main browser and it went away. Other than that no other problems I see at this time. Thank you for your help! Link to post Share on other sites More sharing options...
krome Posted February 23, 2015 Author ID:942278 Share Posted February 23, 2015 So I'm guessing we're on to the cleanup process or a final check-up? Link to post Share on other sites More sharing options...
kevinf80 Posted February 23, 2015 ID:942391 Share Posted February 23, 2015 Run FRST one more time, ensure all boxes are checkmarcked under "Whitelist" but only Addition.txt under "Optional scan" Select scan, post the two new logs... Thank you, Kevin... Link to post Share on other sites More sharing options...
krome Posted February 25, 2015 Author ID:943174 Share Posted February 25, 2015 Here you go: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 25-02-2015 01Ran by Kidstuff (administrator) on KSPSCAD1 on 25-02-2015 11:40:51Running from C:\Users\Kidstuff\DesktopLoaded Profiles: Kidstuff & MSSQL$ESTOCKCARD3 (Available profiles: Kidstuff & MSSQL$ESTOCKCARD3)Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11 (Default browser: FF)Boot Mode: NormalTutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe(AMD) C:\Windows\System32\atiesrxx.exe(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe(Lenovo) C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe(Intel® Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\Jhi_service.exe(Lenovo) C:\Program Files\Lenovo\LBAI\LBAEvent.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\sqlservr.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe(Lenovo) C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.exe(Microsoft Corporation) C:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe(AMD) C:\Windows\System32\atieclxx.exe(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler.exe(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.26.9\GoogleCrashHandler64.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe(Akamai Technologies, Inc.) C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe(Autodesk, Inc.) C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe(Akamai Technologies, Inc.) C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe(Intel Corporation) C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe(Microsoft Corporation) C:\Windows\System32\rundll32.exe(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\PowerMgr\SCHTASK.EXE==================== Registry (Whitelisted) ==================(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12343400 2012-01-10] (Realtek Semiconductor)HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [289648 2012-05-24] (Lenovo Group Limited)HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1332296 2015-01-30] (Microsoft Corporation)HKLM-x32\...\Run: [startCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2012-02-15] (Advanced Micro Devices, Inc.)HKLM-x32\...\Run: [iAStorIcon] => C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-11-29] (Intel Corporation)HKLM-x32\...\Run: [iMSS] => C:\Program Files (x86)\Intel\Intel® Management Engine Components\IMSS\PIconStartup.exe [133400 2011-12-15] (Intel Corporation)HKLM-x32\...\Run: [uSB3MON] => C:\Program Files (x86)\Intel\Intel® USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-01-26] (Intel Corporation)HKLM-x32\...\Run: [Power Manager Startup Utility] => C:\Program Files (x86)\Lenovo\PowerMgr\DPMHost.exe [23352 2012-02-22] ()HKLM-x32\...\Run: [Fastboot] => C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe [1091376 2012-01-17] (Lenovo)HKLM-x32\...\Run: [bCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Akamai NetSession Interface] => C:\Users\Kidstuff\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [Adobe Reader Synchronizer] => C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AdobeCollabSync.exe [1104288 2014-12-03] (Adobe Systems Incorporated)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Run: [TWC.Win7] => C:\Program Files (x86)\The Weather Channel\Desktop Weather\TWC.Win7.exeHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\...\RunOnce: [] => [X]HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\...\RunOnce: [Lenovoautoqdrive] => C:\Program Files (x86)\Common Files\Lenovo\LenovoDrive\LenovoAutorunreg.exe [159744 2011-12-14] ()HKU\S-1-5-18\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [1081224 2013-02-05] (Autodesk, Inc.)Startup: C:\Users\Kidstuff\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vertabasetimer.lnkShortcutTarget: vertabasetimer.lnk -> C:\Program Files (x86)\vertabasetimer\vertabasetimer.exe (No File)ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)==================== Internet (Whitelisted) ====================(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENPHKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSEHKU\S-1-5-21-1142913190-692752148-3269810916-1001\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.lenovo.com/welcome/thinkcentreHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENPHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?pc=MSSEHKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkID=226786&Mkt=en-US&Src=MSE&Tid=000328B9&OHP=http%3A%2F%2Fwww.google.com%2Fig%2Fredirectdomain%3Fbrand%3DLENP%26bmod%3DLENP,http%3A%2F%2Fwww.lenovo.com&OSP=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Die7%26q%3D%7BsearchTerms%7D%26rls%3Dcom.microsoft%3A%7Blanguage%7D%3A%7Breferrer%3Asource%3F%7D%26ie%3D%7BinputEncoding%7D%26oe%3D%7BoutputEncoding%7D%26rlz%3D1I7LENPSearchScopes: HKLM -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSESearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENPSearchScopes: HKU\S-1-5-21-1142913190-692752148-3269810916-1001 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSESearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7LENPSearchScopes: HKU\S-1-5-80-3085906733-1464581378-3076927952-3836574481-4147582144 -> {80c554b9-c7f8-4a21-9471-06d606da78a2} URL = http://www.bing.com/search?q={searchTerms}&form=MSSEDF&pc=MSSEBHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.0.1Tcpip\Parameters: [NameServer] 8.8.8.8,8.8.4.4Tcpip\..\Interfaces\{846ee342-7039-11de-9d20-806e6f6e6963}: [NameServer] 8.8.8.8,8.8.4.4Tcpip\..\Interfaces\{FE273F25-CD2A-4DF1-8451-46A330CC8582}: [NameServer] 8.8.8.8,8.8.4.4FireFox:========FF ProfilePath: C:\Users\Kidstuff\AppData\Roaming\Mozilla\Firefox\Profiles\zlryv1jz.defaultFF Plugin: @microsoft.com/GENUINE -> disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.52 -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)FF Plugin-x32: @microsoft.com/GENUINE -> disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll No FileFF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.26.9\npGoogleUpdate3.dll (Google Inc.)FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)FF HKLM-x32\...\Firefox\Extensions: [VIP5X@verisign.com] - C:\Program Files (x86)\Symantec\VIP Access ClientChrome:=======CHR StartupUrls: Profile 1 -> "hxxp://www.google.com/"CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\PepperFlash\pepflashplayer.dll ()CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewerCHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\ppGoogleNaClPluginChrome.dll No FileCHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\40.0.2214.115\pdf.dll ()CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll No FileCHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll No FileCHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)CHR Plugin: (Intel® Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel® Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll No FileCHR Profile: C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\DefaultCHR Profile: C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1CHR Extension: (Mp3Skull Toolbar) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\anaehjnjgheaikfecjlfokolkoalpnda [2013-08-26]CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-28]CHR Extension: (My Scrap Nook) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gnaghjfblmncnfgjddgelpkbhfdflicf [2013-11-04]CHR Extension: (Google Wallet) - C:\Users\Kidstuff\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-26]==================== Services (Whitelisted) =================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [12288 2012-12-13] (Autodesk, Inc.) [File not signed]R2 FastbootService; C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [169776 2012-01-17] (Lenovo)R2 jhi_service; C:\Program Files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [161560 2011-12-15] (Intel Corporation)R2 LBAEvent; C:\Program Files\Lenovo\LBAI\LBAEvent.exe [15520 2012-03-23] (Lenovo) [File not signed]R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2015-01-30] (Microsoft Corporation)R2 MSSQL$ESTOCKCARD3; c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\sqlservr.exe [206424 2012-02-11] (Microsoft Corporation)R2 MSSQL$RIT; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation)R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366512 2015-01-30] (Microsoft Corporation)R2 Power Manager DBC Service; C:\Program Files (x86)\Lenovo\PowerMgr\PWMDBSVC.EXE [70968 2012-02-22] (Lenovo)S3 PwmEWSvc; C:\Program Files (x86)\Lenovo\PowerMgr\PWMEWSVC.EXE [165176 2012-02-22] (Lenovo Group Limited)S4 SQLAgent$ESTOCKCARD3; c:\Program Files (x86)\Microsoft SQL Server\MSSQL11.ESTOCKCARD3\MSSQL\Binn\SQLAGENT.EXE [438360 2012-02-11] (Microsoft Corporation)R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440 2008-01-10] (Ulead Systems, Inc.) [File not signed]S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-26] (Microsoft Corporation)==================== Drivers (Whitelisted) ====================(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)S3 Fastboot; C:\Windows\System32\DRIVERS\Fastboot.sys [70416 2012-01-17] (Windows ® Win 7 DDK provider)R3 LBAI; C:\Windows\System32\Drivers\LBAI.sys [9600 2011-12-08] (Lenovo)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [129752 2015-02-25] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [274696 2014-11-15] (Microsoft Corporation)R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [124560 2014-11-15] (Microsoft Corporation)R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [40248 2011-05-29] (Lenovo Information Product(ShenZhen China) Inc.)==================== NetSvcs (Whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)==================== One Month Created Files and Folders ========(If an entry is included in the fixlist, the file\folder will be moved.)2015-02-25 03:00 - 2015-01-08 17:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls2015-02-25 03:00 - 2015-01-08 17:43 - 00419936 _____ () C:\Windows\system32\locale.nls2015-02-20 15:51 - 2015-02-20 15:51 - 00000000 ____D () C:\Program Files (x86)\ESET2015-02-20 15:50 - 2015-02-20 15:50 - 02347384 _____ (ESET) C:\Users\Kidstuff\Downloads\esetsmartinstaller_enu.exe2015-02-19 09:18 - 2015-02-25 11:40 - 00000000 ____D () C:\Users\Kidstuff\Desktop\FRST-OlderVersion2015-02-18 15:54 - 2015-02-18 15:54 - 00000708 _____ () C:\Users\Kidstuff\Desktop\JRT.txt2015-02-18 15:48 - 2015-02-18 15:48 - 01388274 _____ (Thisisu) C:\Users\Kidstuff\Desktop\JRT.exe2015-02-18 15:35 - 2015-02-18 15:35 - 00001063 _____ () C:\Users\Kidstuff\Desktop\mbamscan_1.txt2015-02-18 15:34 - 2015-02-18 15:34 - 00001061 _____ () C:\Users\Kidstuff\Desktop\mbamscan.txt2015-02-18 15:17 - 2015-02-18 15:36 - 00000000 ____D () C:\AdwCleaner2015-02-18 15:16 - 2015-02-18 15:16 - 02126848 _____ () C:\Users\Kidstuff\Desktop\AdwCleaner.exe2015-02-17 16:38 - 2015-02-25 11:39 - 00129752 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2015-02-17 16:38 - 2015-02-17 16:38 - 00001113 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2015-02-17 16:38 - 2015-02-17 16:38 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2015-02-17 16:38 - 2015-02-17 16:38 - 00000000 ____D () C:\ProgramData\Malwarebytes2015-02-17 16:38 - 2015-02-17 16:38 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2015-02-17 16:38 - 2014-11-21 06:14 - 00093400 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2015-02-17 16:38 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys2015-02-17 16:38 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys2015-02-17 16:37 - 2015-02-17 16:37 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Kidstuff\Downloads\mbam-setup-2.0.4.1028.exe2015-02-17 14:30 - 2015-02-19 09:19 - 00021272 _____ () C:\Users\Kidstuff\Desktop\Addition.txt2015-02-17 14:29 - 2015-02-25 11:41 - 00019099 _____ () C:\Users\Kidstuff\Desktop\FRST.txt2015-02-17 14:29 - 2015-02-25 11:40 - 00000000 ____D () C:\FRST2015-02-17 14:28 - 2015-02-25 11:40 - 02087936 _____ (Farbar) C:\Users\Kidstuff\Desktop\FRST64.exe2015-02-17 14:27 - 2015-02-17 14:27 - 00001170 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk2015-02-17 14:27 - 2015-02-17 14:27 - 00001158 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\Mozilla2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\ProgramData\Mozilla2015-02-17 14:27 - 2015-02-17 14:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2015-02-17 14:23 - 2015-02-17 14:23 - 00000000 __SHD () C:\Users\Kidstuff\AppData\Local\EmieBrowserModeList2015-02-17 13:30 - 2015-02-17 13:30 - 00620544 _____ () C:\Parts.xls2015-02-11 17:46 - 2015-01-22 22:42 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2015-02-11 17:46 - 2015-01-22 22:41 - 06041600 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2015-02-11 17:46 - 2015-01-22 21:43 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2015-02-11 17:46 - 2015-01-22 21:17 - 04300800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00894976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00762368 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00609280 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00414720 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2015-02-10 20:45 - 2015-02-03 21:16 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll2015-02-10 20:45 - 2015-02-03 21:13 - 01098752 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2015-02-10 20:45 - 2015-01-27 17:36 - 01239720 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe2015-02-10 20:45 - 2015-01-13 23:47 - 00389808 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll2015-02-10 20:45 - 2015-01-13 23:09 - 00342712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll2015-02-10 20:45 - 2015-01-12 21:10 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll2015-02-10 20:45 - 2015-01-12 20:49 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll2015-02-10 20:45 - 2015-01-11 21:09 - 25056256 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2015-02-10 20:45 - 2015-01-11 21:05 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2015-02-10 20:45 - 2015-01-11 21:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2015-02-10 20:45 - 2015-01-11 20:49 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2015-02-10 20:45 - 2015-01-11 20:48 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2015-02-10 20:45 - 2015-01-11 20:48 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2015-02-10 20:45 - 2015-01-11 20:48 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2015-02-10 20:45 - 2015-01-11 20:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll2015-02-10 20:45 - 2015-01-11 20:40 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2015-02-10 20:45 - 2015-01-11 20:39 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2015-02-10 20:45 - 2015-01-11 20:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2015-02-10 20:45 - 2015-01-11 20:34 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2015-02-10 20:45 - 2015-01-11 20:34 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2015-02-10 20:45 - 2015-01-11 20:25 - 19740160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2015-02-10 20:45 - 2015-01-11 20:25 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2015-02-10 20:45 - 2015-01-11 20:21 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2015-02-10 20:45 - 2015-01-11 20:21 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2015-02-10 20:45 - 2015-01-11 20:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2015-02-10 20:45 - 2015-01-11 20:08 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2015-02-10 20:45 - 2015-01-11 20:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2015-02-10 20:45 - 2015-01-11 20:07 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2015-02-10 20:45 - 2015-01-11 20:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll2015-02-10 20:45 - 2015-01-11 20:04 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2015-02-10 20:45 - 2015-01-11 20:02 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2015-02-10 20:45 - 2015-01-11 20:00 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2015-02-10 20:45 - 2015-01-11 19:59 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2015-02-10 20:45 - 2015-01-11 19:57 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2015-02-10 20:45 - 2015-01-11 19:55 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2015-02-10 20:45 - 2015-01-11 19:48 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2015-02-10 20:45 - 2015-01-11 19:48 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2015-02-10 20:45 - 2015-01-11 19:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2015-02-10 20:45 - 2015-01-11 19:46 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2015-02-10 20:45 - 2015-01-11 19:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2015-02-10 20:45 - 2015-01-11 19:43 - 14401024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2015-02-10 20:45 - 2015-01-11 19:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2015-02-10 20:45 - 2015-01-11 19:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2015-02-10 20:45 - 2015-01-11 19:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2015-02-10 20:45 - 2015-01-11 19:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2015-02-10 20:45 - 2015-01-11 19:27 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2015-02-10 20:45 - 2015-01-11 19:23 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2015-02-10 20:45 - 2015-01-11 19:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2015-02-10 20:45 - 2015-01-11 19:22 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2015-02-10 20:45 - 2015-01-11 19:14 - 12829184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2015-02-10 20:45 - 2015-01-11 19:14 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2015-02-10 20:45 - 2015-01-11 19:02 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2015-02-10 20:45 - 2015-01-11 19:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2015-02-10 20:45 - 2015-01-11 18:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2015-02-10 20:45 - 2015-01-11 18:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll2015-02-10 20:45 - 2015-01-10 00:48 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll2015-02-10 20:45 - 2015-01-10 00:27 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll2015-02-10 20:44 - 2015-01-15 02:14 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys2015-02-10 20:44 - 2015-01-15 02:14 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys2015-02-10 20:44 - 2015-01-15 02:09 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe2015-02-10 20:44 - 2015-01-15 02:09 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll2015-02-10 20:44 - 2015-01-15 02:09 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll2015-02-10 20:44 - 2015-01-15 02:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe2015-02-10 20:44 - 2015-01-15 02:06 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll2015-02-10 20:44 - 2015-01-15 02:06 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll2015-02-10 20:44 - 2015-01-15 02:04 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll2015-02-10 20:44 - 2015-01-15 01:42 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe2015-02-10 20:44 - 2015-01-15 01:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2015-02-10 20:44 - 2015-01-15 01:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2015-02-10 20:44 - 2015-01-15 01:39 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll2015-02-10 20:44 - 2015-01-15 01:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll2015-02-10 20:44 - 2015-01-15 01:37 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll2015-02-10 20:44 - 2015-01-14 22:22 - 00458824 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys2015-02-10 20:44 - 2015-01-14 00:09 - 05554112 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe2015-02-10 20:44 - 2015-01-14 00:05 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll2015-02-10 20:44 - 2015-01-14 00:05 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll2015-02-10 20:44 - 2015-01-14 00:04 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe2015-02-10 20:44 - 2015-01-13 23:44 - 03972544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2015-02-10 20:44 - 2015-01-13 23:44 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2015-02-10 20:44 - 2015-01-13 23:41 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll2015-02-10 20:44 - 2015-01-08 20:03 - 03201536 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys2015-02-10 20:44 - 2014-12-11 23:31 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll2015-02-10 20:44 - 2014-12-11 23:07 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll2015-02-10 20:44 - 2014-12-07 21:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll2015-02-10 20:44 - 2014-12-07 20:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll2015-02-10 20:44 - 2014-11-25 21:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll2015-02-10 20:44 - 2014-11-25 21:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll2015-02-05 01:40 - 2015-02-05 01:40 - 04437680 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe2015-02-03 09:42 - 2015-02-03 09:42 - 00003886 _____ () C:\Windows\System32\Tasks\Adobe Acrobat Update Task2015-01-26 15:35 - 2014-12-18 21:06 - 00210432 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll2015-01-26 15:35 - 2014-12-18 19:46 - 00141312 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys2015-01-26 15:35 - 2014-12-11 11:47 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe2015-01-26 15:35 - 2014-12-05 22:17 - 00303616 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll2015-01-26 15:35 - 2014-12-05 21:50 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll2015-01-26 15:35 - 2014-12-05 21:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll==================== One Month Modified Files and Folders =======(If an entry is included in the fixlist, the file\folder will be moved.)2015-02-25 11:40 - 2013-06-05 07:37 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2015-02-25 11:40 - 2013-04-10 20:40 - 01089165 _____ () C:\Windows\WindowsUpdate.log2015-02-25 11:39 - 2013-04-30 12:03 - 00000894 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job2015-02-25 11:28 - 2013-04-30 12:03 - 00000898 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job2015-02-25 03:23 - 2009-07-13 22:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02015-02-25 03:23 - 2009-07-13 22:45 - 00034432 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02015-02-25 03:20 - 2009-07-13 23:13 - 00977804 _____ () C:\Windows\system32\PerfStringBackup.INI2015-02-25 03:16 - 2009-07-13 23:08 - 00032582 _____ () C:\Windows\Tasks\SCHEDLGU.TXT2015-02-25 03:16 - 2009-07-13 23:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2015-02-25 03:16 - 2009-07-13 22:51 - 00064976 _____ () C:\Windows\setupact.log2015-02-20 15:42 - 2010-11-20 21:47 - 00786448 _____ () C:\Windows\PFRO.log2015-02-19 19:29 - 2013-04-30 12:04 - 00002194 _____ () C:\Users\Public\Desktop\Google Chrome.lnk2015-02-19 09:56 - 2013-05-01 07:01 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office2015-02-19 09:56 - 2013-05-01 06:58 - 00000000 ____D () C:\ProgramData\Microsoft Help2015-02-17 14:27 - 2013-09-23 08:28 - 00000000 ____D () C:\Users\Kidstuff\AppData\Roaming\Mozilla2015-02-17 14:27 - 2013-09-23 08:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2015-02-17 14:08 - 2013-06-06 11:54 - 00000000 ____D () C:\Users\MSSQL$ESTOCKCARD32015-02-17 14:03 - 2013-09-23 09:28 - 00000214 _____ () C:\Users\Kidstuff\AppData\Roaming\WB.CFG2015-02-17 12:29 - 2013-05-15 08:32 - 00606500 _____ () C:\Windows\system32\webservice4.log2015-02-17 12:19 - 2013-05-15 08:32 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\cache2015-02-12 04:10 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\rescache2015-02-12 03:03 - 2013-05-01 08:19 - 00969926 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI2015-02-11 03:23 - 2009-07-13 22:45 - 00537632 _____ () C:\Windows\system32\FNTCACHE.DAT2015-02-11 03:21 - 2014-12-10 03:08 - 00000000 ____D () C:\Windows\system32\appraiser2015-02-11 03:21 - 2014-05-07 02:00 - 00000000 ___SD () C:\Windows\system32\CompatTel2015-02-11 03:21 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2015-02-11 03:05 - 2009-07-13 20:34 - 00000478 _____ () C:\Windows\win.ini2015-02-11 03:03 - 2013-08-15 02:01 - 00000000 ____D () C:\Windows\system32\MRT2015-02-11 03:03 - 2013-04-24 13:48 - 00002128 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk2015-02-11 03:03 - 2013-04-24 13:48 - 00001945 _____ () C:\Windows\epplauncher.mif2015-02-11 03:03 - 2013-04-24 13:48 - 00000000 ____D () C:\Program Files\Microsoft Security Client2015-02-11 03:03 - 2013-04-24 13:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Security Client2015-02-11 03:01 - 2013-04-24 13:19 - 116773704 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe2015-02-05 01:40 - 2013-06-05 07:37 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2015-02-05 01:40 - 2013-06-05 07:37 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2015-02-05 01:40 - 2013-06-05 07:37 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2015-02-04 22:23 - 2013-04-30 12:03 - 00003894 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA2015-02-04 22:23 - 2013-04-30 12:03 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore2015-01-27 03:02 - 2013-04-30 10:49 - 00000000 ____D () C:\Users\Kidstuff2015-01-26 17:21 - 2013-06-05 07:37 - 00000000 ____D () C:\Windows\system32\Macromed2015-01-26 17:21 - 2013-05-15 08:15 - 00000000 ____D () C:\Users\Kidstuff\AppData\Local\Akamai2015-01-26 17:21 - 2013-04-30 12:04 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome2015-01-26 17:21 - 2013-04-24 13:45 - 00000000 ____D () C:\Program Files\Microsoft Silverlight2015-01-26 17:21 - 2013-04-24 13:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight2015-01-26 17:21 - 2009-07-13 21:20 - 00000000 ____D () C:\Windows\registration==================== Files in the root of some directories =======2013-07-25 13:48 - 2013-07-29 15:59 - 0000000 _____ () C:\Users\Kidstuff\AppData\Roaming\bibstats2013-09-20 12:44 - 2013-09-20 12:44 - 0037847 _____ () C:\Users\Kidstuff\AppData\Roaming\Comma Separated Values (DOS).ADR2013-07-16 09:54 - 2013-07-16 10:23 - 0038449 _____ () C:\Users\Kidstuff\AppData\Roaming\Comma Separated Values (Windows).ADR2013-09-23 09:28 - 2015-02-17 14:03 - 0000214 _____ () C:\Users\Kidstuff\AppData\Roaming\WB.CFG2013-09-23 09:28 - 2014-01-29 00:28 - 0000005 _____ () C:\Users\Kidstuff\AppData\Roaming\WBPU-TTL.DAT2013-06-21 12:38 - 2013-06-21 12:38 - 0003584 _____ () C:\Users\Kidstuff\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini==================== Bamital & volsnap Check =================(There is no automatic fix for files that do not pass verification.)C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2015-02-23 00:15==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-02-2015 01Ran by Kidstuff at 2015-02-25 11:41:26Running from C:\Users\Kidstuff\DesktopBoot Mode: Normal============================================================================== Security Center ========================(If an entry is included in the fixlist, it will be removed.)AV: Microsoft Security Essentials (Enabled - Up to date) {B7ECF8CD-0188-6703-DBA4-AA65C6ACFB0A}AS: Microsoft Security Essentials (Enabled - Up to date) {0C8D1929-27B2-688D-E114-9117BD2BB1B7}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}==================== Installed Programs ======================(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.1.0.4880 - Adobe Systems Incorporated)Adobe Flash Player 16 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)Adobe Reader X (10.1.13) MUI (HKLM-x32\...\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)Akamai NetSession Interface (HKU\S-1-5-21-1142913190-692752148-3269810916-1001\...\Akamai) (Version: - Akamai Technologies, Inc)AMD Catalyst Install Manager (HKLM\...\{2239633A-969C-39BF-B5C2-C172F44EC096}) (Version: 3.0.851.0 - Advanced Micro Devices, Inc.)AutoCAD LT 2014 - English (Version: 19.1.18.0 - Autodesk) HiddenAutoCAD LT 2014 Language Pack - English (Version: 19.1.18.0 - Autodesk) HiddenAutodesk 360 (HKLM\...\{52B28CAD-F49D-47BA-9FFE-29C2E85F0D0B}) (Version: 4.0.27.1 - Autodesk)Autodesk AutoCAD LT 2014 - English (HKLM\...\AutoCAD LT 2014 - English) (Version: 19.1.18.0 - Autodesk)Autodesk Content Service (HKLM-x32\...\Autodesk Content Service) (Version: 3.1.3.0 - Autodesk)Autodesk Content Service (x32 Version: 3.1.3.0 - Autodesk) HiddenAutodesk Content Service Language Pack (x32 Version: 3.1.3.0 - Autodesk) HiddenAutodesk Material Library 2014 (HKLM-x32\...\{644F9B19-A462-499C-BF4D-300ABC2A28B1}) (Version: 4.0.19.0 - Autodesk)Autodesk Material Library Base Resolution Image Library 2014 (HKLM-x32\...\{51BF3210-B825-4092-8E0D-66D689916E02}) (Version: 4.0.19.0 - Autodesk)Avery Wizard 4.0 (HKLM-x32\...\{7196E6BD-4B65-43F9-9D30-73A8E58D0E84}) (Version: 4.0.103 - Avery)Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) HiddenCorel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) HiddenCorel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)Crystal Reports Basic Runtime for Visual Studio 2008 (x64) (Version: 10.5.0.0 - Business Objects) HiddenDirect DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) HiddenESET Online Scanner v3 (HKLM-x32\...\ESET Online Scanner) (Version: - )Google Chrome (HKLM-x32\...\Google Chrome) (Version: 40.0.2214.115 - Google Inc.)Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) HiddenGoogle Update Helper (x32 Version: 1.3.26.9 - Google Inc.) HiddenIntel® Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)Intel® Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)Intel® Network Connections 16.8.46.0 (HKLM\...\PROSetDX) (Version: 16.8.46.0 - Intel)Intel® Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.0.0.1032 - Intel Corporation)Intel® USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.3.214 - Intel Corporation)Intel® Trusted Connect Service Client (HKLM\...\{6199B534-A1B6-46ED-873B-97B0ECF8F81E}) (Version: 1.23.216.0 - Intel Corporation)LBAI (HKLM-x32\...\{C5C91B7B-38A6-40B7-84D6-E44885E44B13}) (Version: 1.0.0.6 - Lenovo)Lenovo Patch Utility 64 bit (HKLM\...\{0369F866-2CE0-4EB9-B426-88FA122C6E82}) (Version: 1.3.0.9 - Lenovo Group Limited)Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)Microsoft Office Access Runtime (English) 2007 (HKLM-x32\...\{90120000-001C-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.7.205.0 - Microsoft Corporation)Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)Microsoft SQL Server 2005 (HKLM-x32\...\Microsoft SQL Server 2005) (Version: - Microsoft Corporation)Microsoft SQL Server 2008 Setup Support Files (HKLM-x32\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation)Microsoft SQL Server 2012 (HKLM-x32\...\Microsoft SQL Server SQLServer2012) (Version: - Microsoft Corporation)Microsoft SQL Server 2012 Native Client (HKLM\...\{49D665A2-4C2A-476E-9AB8-FCC425F526FC}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server 2012 Setup (English) (HKLM-x32\...\{CEA86648-87FA-4775-8F3B-A57F720BAE85}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server 2012 Transact-SQL ScriptDom (HKLM\...\{0E8670B8-3965-4930-ADA6-570348B67153}) (Version: 11.0.2100.60 - Microsoft Corporation)Microsoft SQL Server Setup Support Files (English) (HKLM-x32\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.5000.00 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation)Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)Microsoft Visual C++ 8.0 Support DLLs (HKLM-x32\...\{342F5437-C87D-4BB5-89B9-B23E16C6A395}) (Version: 1.0.0 - McNeel & Associates)Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)Microsoft VSS Writer for SQL Server 2012 (HKLM\...\{3E0DD83F-BE4C-4478-86A0-AD0D79D1353E}) (Version: 11.0.2100.60 - Microsoft Corporation)Mozilla Firefox 35.0.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 35.0.1 - Mozilla)RapidBoot HDD Accelerator (HKLM-x32\...\Fastboot) (Version: 1.00.0802 - Lenovo)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6543 - Realtek Semiconductor Corp.)Rhinoceros 4.0 SR6 (HKLM-x32\...\{6B9DD988-5ECB-4623-BBFF-8A8F2DA3ED16}) (Version: 4.0.40709 - Robert McNeel & Associates)Samsung Universal Print Driver 2 (HKLM-x32\...\Samsung Universal Print Driver 2) (Version: 2.50.02.00 - Samsung Electronics Co., Ltd.)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)SQL Server 2012 Common Files (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server 2012 Database Engine Services (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server 2012 Database Engine Shared (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenSQL Server Browser for SQL Server 2012 (HKLM-x32\...\{4B9E6EB0-0EED-4E74-9479-F982C3254F71}) (Version: 11.0.2100.60 - Microsoft Corporation)Sql Server Customer Experience Improvement Program (x32 Version: 11.0.2100.60 - Microsoft Corporation) HiddenTeamViewer 8 (HKLM-x32\...\TeamViewer 8) (Version: 8.0.30992 - TeamViewer)ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 3.0.30.0 - Lenovo)ThinkVantage Power Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 2.10.0007 - Lenovo Group Limited)View Management Utility (HKLM-x32\...\InstallShield_{C6254514-DD94-45E5-87C0-B9CB90A34C89}) (Version: 3.0.12.0329 - Lenovo)View Management Utility (Version: 3.0.12.0329 - Lenovo) HiddenWindows Driver Package - Advanced Micro Devices (AtiHDAudioService) MEDIA (10/18/2011 7.12.0.7704) (HKLM\...\7E26D65CA5110FF168A57B5C479134FA5450759B) (Version: 10/18/2011 7.12.0.7704 - Advanced Micro Devices)Windows Driver Package - Advanced Micro Devices, Inc. (amdkmdap) Display (02/14/2012 8.913.1.0000) (HKLM\...\4D7E325B73136CE735F86BC465965BFECB76C1AD) (Version: 02/14/2012 8.913.1.0000 - Advanced Micro Devices, Inc.)Windows Driver Package - Intel (e1cexpress) Net (01/11/2012 11.15.16.0) (HKLM\...\E6D02BAF356D0EEE96DE70D352026CE420321A16) (Version: 01/11/2012 11.15.16.0 - Intel)Windows Driver Package - Intel hdc (08/26/2011 9.3.0.1011) (HKLM\...\A7E82C89A6D6643325B95A4FEDAB3DB18640208F) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel System (01/11/2012 9.3.0.1020) (HKLM\...\09839A9B5EDA69DA2DCC34637B5140AAF8A53B44) (Version: 01/11/2012 9.3.0.1020 - Intel)Windows Driver Package - Intel System (08/26/2011 9.3.0.1011) (HKLM\...\9D7CD466F7FC8B18FF1B84943B7BB8648D17FCE8) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel System (08/26/2011 9.3.0.1011) (HKLM\...\D8EF6CACF49BD33CC1FACD124C8CC2B1A8E8AE35) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Intel USB (08/26/2011 9.3.0.1011) (HKLM\...\97EE1802A0385A37DE6323FA39EC76BEB2D73E41) (Version: 08/26/2011 9.3.0.1011 - Intel)Windows Driver Package - Realtek Semiconductor Corp. HD Audio Driver (01/03/2012 6.0.1.6543) (HKLM\...\5DE3700033F94FCFD8726BE46A6727E460254CD5) (Version: 01/03/2012 6.0.1.6543 - Realtek Semiconductor Corp.)==================== Custom CLSID (selected items): ==========================(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)CustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Kidstuff\AppData\Roaming\Dropbox\bin\Dropbox.exe /autoplay No FileCustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{6A221957-2D85-42A7-8E19-BE33950D1DEB}\localserver32 -> C:\Program Files\Autodesk\AutoCAD LT 2014\acadlt.exe (Autodesk, Inc.)CustomCLSID: HKU\S-1-5-21-1142913190-692752148-3269810916-1001_Classes\CLSID\{74F5CC00-49A9-11CF-A2F9-444553540000}\InprocServer32 -> C:\Program Files\Autodesk\AutoCAD LT 2014\en-US\acadltficn.dll (Autodesk, Inc.)==================== Restore Points =========================09-02-2015 11:31:39 Windows Update11-02-2015 03:00:20 Windows Update12-02-2015 03:00:11 Windows Update16-02-2015 03:32:18 Windows Update19-02-2015 15:49:18 Windows Update22-02-2015 15:53:17 Windows Update25-02-2015 03:00:11 Windows Update==================== Hosts content: ==========================(If needed Hosts: directive could be included in the fixlist to reset Hosts.)2009-07-13 20:34 - 2009-06-10 15:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)Task: {1C668618-FB88-4AC5-8637-E6476802E16D} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)Task: {23F8CD9E-39C7-42B8-A3E7-81ED66C61081} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-30] (Google Inc.)Task: {2E4AB855-1826-4657-841F-6F0E4A6FAB00} - System32\Tasks\PMTask => C:\Program Files (x86)\Lenovo\PowerMgr\PWMIDTSV.EXE [2012-02-22] (Lenovo Group Limited)Task: {57F760AA-9985-4A87-9E74-352AAD7C6407} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-04-30] (Google Inc.)Task: {62EBFDF1-E687-44FB-BCBA-F42A76EFE5A9} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-05] (Adobe Systems Incorporated)Task: {9162585C-AB42-4AEC-9508-1B8062A771EE} - System32\Tasks\{0331DB66-F86F-4943-A9C5-2B2100C28796} => pcalua.exe -a C:\ISRPSetup\ISRPSetup.exe -d C:\ISRPSetupTask: {99B725CD-4AE3-456C-8393-3E1E9169F36F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvcTask: {F10D5434-7EB9-4B9C-BAB2-784FC3679952} - System32\Tasks\{41059747-FEBB-4B30-9855-2A9A45A74D1D} => pcalua.exe -a C:\Users\Kidstuff\Desktop\DesignPro5_2_Limited.exe -d C:\Users\Kidstuff\DesktopTask: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exeTask: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe==================== Loaded Modules (whitelisted) ==============2008-09-08 09:19 - 2008-09-08 09:19 - 00022016 _____ () C:\Windows\System32\cl31cl6.dll2013-04-30 10:46 - 2011-04-10 23:26 - 00034304 _____ () C:\Windows\System32\spe__l.dll2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF2010-10-20 14:23 - 2010-10-20 14:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00056352 _____ () C:\Program Files\Autodesk\Autodesk Sync\qoauth_Ad_1.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00937504 _____ () C:\Program Files\Autodesk\Autodesk Sync\qca_Ad_2.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00124448 _____ () C:\Program Files\Autodesk\Autodesk Sync\QJson.dll2013-02-04 23:21 - 2013-02-04 23:21 - 00045088 _____ () C:\Program Files\Autodesk\Autodesk Sync\QtSolutions_MFCMigrationFramework_Ad_2.dll2013-04-10 20:48 - 2012-02-12 12:10 - 00029184 ____N () C:\Program Files (x86)\Lenovo\PowerMgr\US\PWMRT64V.DLL2013-04-10 20:52 - 2012-01-17 00:29 - 00030512 ____N () C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBServiceps.dll2014-10-15 02:21 - 2014-10-15 02:21 - 00172032 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\38485cf51c91ff758c145158360bbb97\IsdiInterop.ni.dll2013-04-10 20:41 - 2011-11-29 21:00 - 00059392 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll2013-04-10 20:44 - 2011-12-15 20:39 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\ACE.dll2013-09-05 00:14 - 2013-09-05 00:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF2010-10-20 14:45 - 2010-10-20 14:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll2015-02-17 14:27 - 2015-01-23 04:37 - 03925104 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll==================== Alternate Data Streams (whitelisted) =========(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)AlternateDataStreams: C:\Windows:nlsPreferences==================== Safe Mode (whitelisted) ===================(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)==================== EXE Association (whitelisted) ===============(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)==================== Other Areas ============================(Currently there is no automatic fix for this section.)HKU\S-1-5-21-1142913190-692752148-3269810916-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\Kidstuff\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpgDNS Servers: 8.8.8.8 - 8.8.4.4==================== MSCONFIG/TASK MANAGER disabled items ==(Currently there is no automatic fix for this section.)==================== Accounts: =============================Administrator (S-1-5-21-1142913190-692752148-3269810916-500 - Administrator - Disabled)Guest (S-1-5-21-1142913190-692752148-3269810916-501 - Limited - Disabled)Kidstuff (S-1-5-21-1142913190-692752148-3269810916-1001 - Administrator - Enabled) => C:\Users\Kidstuff==================== Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (02/25/2015 03:17:50 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/20/2015 05:06:37 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.Error: (02/20/2015 03:51:05 PM) (Source: SideBySide) (EventID: 80) (User: )Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.A component version required by the application conflicts with another component version already active.Conflicting components are:.Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.Error: (02/20/2015 03:43:27 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003System errors:=============Error: (02/25/2015 03:26:10 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for FailureCommand with the following error:%%5Error: (02/25/2015 03:26:09 AM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Start with the following error:%%5Error: (02/18/2015 03:55:41 PM) (Source: Service Control Manager) (EventID: 7006) (User: )Description: The ScRegSetValueExW call failed for Start with the following error:%%5Error: (02/18/2015 03:55:42 PM) (Source: Microsoft Antimalware) (EventID: 3002) (User: )Description: %%860 Real-Time Protection feature has encountered an error and failed. Feature: %%886 Error Code: 0x80070005 Error description: Access is denied. Reason: %%858Microsoft Office Sessions:=========================Error: (02/25/2015 03:17:50 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (02/20/2015 05:06:37 PM) (Source: SideBySide) (EventID: 80) (User: )Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Program Files (x86)\ESET\ESET Online Scanner\ESETSmartInstaller.exeError: (02/20/2015 03:51:05 PM) (Source: SideBySide) (EventID: 80) (User: )Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\Kidstuff\Downloads\esetsmartinstaller_enu.exeError: (02/20/2015 03:43:27 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003==================== Memory info ===========================Processor: Intel® Core i7-3770 CPU @ 3.40GHzPercentage of memory in use: 27%Total physical RAM: 8114.96 MBAvailable physical RAM: 5849.69 MBTotal Pagefile: 16228.12 MBAvailable Pagefile: 13576.51 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.85 MB==================== Drives ================================Drive c: (Windows7_OS) (Fixed) (Total:916.37 GB) (Free:640.33 GB) NTFS ==>[system with boot components (obtained from reading drive)]Drive q: (Lenovo_Recovery) (Fixed) (Total:13.67 GB) (Free:3.48 GB) NTFSDrive x: () (Network) (Total:149.05 GB) (Free:73.78 GB) NTFSDrive z: () (Network) (Total:149.05 GB) (Free:73.78 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (Size: 931.5 GB) (Disk ID: 70B41803)Partition 1: (Active) - (Size=1.5 GB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=916.4 GB) - (Type=07 NTFS)Partition 3: (Not Active) - (Size=13.7 GB) - (Type=07 NTFS)==================== End Of Log ============================ Link to post Share on other sites More sharing options...
kevinf80 Posted February 25, 2015 ID:943202 Share Posted February 25, 2015 Thanks for the logs, all looks good now. One update required: Adobe Reader is outdated...Visit http://get.adobe.com/uk/reader/otherversions/ and download the latest version of Acrobat Reader Step 1 - Select your Operating System.Step 2 - Select your Langauge.Step 3 - Select latest version. Untick the option for any security scanner or toolbar if offered. Download and install. Having the latest updates ensures there are no security vulnerabilities in your system. Next, Download "Delfix by Xplode" and save it to your desktop. Or use the following if first link is down: "Delfix link mirror" Double Click to start the program. If you are using Vista or higher, please right-click and choose run as administrator Make Sure the following items are checked: Remove disinfection tools Purge System Restore Reset system settings Now click on "Run" and wait patiently until the tool has completed. Next, Read the following link to fully understand PC security and best practices, you may find it useful.... http://www.bleepingcomputer.com/forums/t/407147/answers-to-common-security-questions-best-practices/#entry2316629 If there are no remaining issues or concerns are we ok to close out... Thanks, Kevin..... The tool will create a log when it has completed. We don't need you to post this. Any remnant files/logs from tools we have used can be deleted… Link to post Share on other sites More sharing options...
krome Posted February 27, 2015 Author ID:943772 Share Posted February 27, 2015 Hello, Looks like there are no remaining issues! Thanks a bunch! Link to post Share on other sites More sharing options...
kevinf80 Posted February 27, 2015 ID:943776 Share Posted February 27, 2015 Excellent, come back anytime.... Take care and surf safe, Kevin... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 10, 2015 Root Admin ID:946561 Share Posted March 10, 2015 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts