blakiebinside Posted July 7, 2014 ID:849852 Share Posted July 7, 2014 Hello, I am chasing a several BSOD's on a PC that has recently had a fresh Win7 install. After running mbam I found several malware programs that I am wondering might be relating to my BOSD's. I was hoping someone might have some ideas? Here is a list of what I have done. Memtest - PassedSeatools - PassedUpdated Mobo DriversUpdated Chipset DriversScanned w/ mbamScanned w/ adwcleaner Any help is greatly appreciated! Thanks, Blake Link to post Share on other sites More sharing options...
Psychotic Posted July 7, 2014 ID:849911 Share Posted July 7, 2014 Hi there,my name is Marius and I will assist you with your malware related problems.Before we move on, please read the following points carefully.First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding. Perform everything in the correct order. Sometimes one step requires the previous one. If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem. Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me. Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts. If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed. Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean. My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding. HijackThis is not the preferred initial scanning tool in this forum. With today's malware, a more comprehensive set of logs is required to determine the presence of malware. Scan with FRST in normal modePlease download Farbar's Recovery Scan Tool to your desktop: FRST 32bit or FRST 64bit (If not sure: Start --> Computer (right click) --> properties) Run FRST. Don´t change one of the checkboxes and hit Scan. Logfiles are created on your desktop. Poste the FRST.txt and (after the first scan only!) the Addition.txt. Scan with aswMBRPlease download aswMBR ( 4.5MB ) to your desktop.Double click the aswMBR.exe icon, and click Run. There will be a short delay before the next dialog box comes up. Please just wait a minute or two. When asked if you'd like to "download the latest Avast! virus definitions", click Yes. Typically this is about a 100MB download so depending on your connection speed it can take a short while to download and become ready. Click the Scan button to start the scan once the update has finished downloading On completion of the scan, click the save log button, save it to your desktop, then copy and paste it in your next reply.Note: There will also be a file on your desktop named MBR.dat do not delete this for now. It is an actual backup of the MBR (master boot record). Link to post Share on other sites More sharing options...
blakiebinside Posted July 8, 2014 Author ID:850167 Share Posted July 8, 2014 Hello Marius, Thank you for taking the time to take a look at my problem. Please see below for my logs. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-07-2014 01Ran by Stacy (administrator) on STACY-PC on 07-07-2014 19:03:40Running from C:\Users\Stacy\DownloadsPlatform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)Internet Explorer Version 11Boot Mode: NormalThe only official download link for FRST:Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/Download link from any site other than Bleeping Computer is unpermitted or outdated.See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/==================== Processes (Whitelisted) =================(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe(ASUSTeK Computer Inc.) C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_w32.exe(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\tv_x64.exe(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe==================== Registry (Whitelisted) ==================HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7833120 2009-05-23] (Realtek Semiconductor)HKLM\...\Run: [skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-05-23] (Realtek Semiconductor Corp.)HKLM\...\Run: [Nvtmru] => "C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe"HKLM\...\Run: [shadowPlay] => C:\Windows\system32\nvspcap64.dll [1279480 2014-05-29] (NVIDIA Corporation)HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2352072 2014-05-29] (NVIDIA Corporation)HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)HKLM-x32\...\Run: [AVG_UI] => C:\Program Files (x86)\AVG\AVG2014\avgui.exe [5179408 2014-06-17] (AVG Technologies CZ, s.r.o.)HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)HKU\S-1-5-21-4084548156-1875462298-2095991957-1000\...\MountPoints2: {62b96a40-5796-11e3-a930-806e6f6e6963} - E:\BlueBirds.exe==================== Internet (Whitelisted) ====================HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://search.coupons.com/SearchScopes: HKLM-x32 - DefaultScope value is missing.SearchScopes: HKLM-x32 - {5a1d0d31-749c-4186-a295-4106e6e7b26a} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^AFA^man000^YYA^&ptb=4EFA4D21-0C01-42B8-97B9-AF670D59E487&ind=2014040110&n=780bd02e&psa=&st=sb&searchfor={searchTerms}SearchScopes: HKCU - DefaultScope {5a1d0d31-749c-4186-a295-4106e6e7b26a} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^AFA^man000^YYA^&ptb=4EFA4D21-0C01-42B8-97B9-AF670D59E487&ind=2014040110&n=780bd02e&psa=&st=sb&searchfor={searchTerms}SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =SearchScopes: HKCU - {5a1d0d31-749c-4186-a295-4106e6e7b26a} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^AFA^man000^YYA^&ptb=4EFA4D21-0C01-42B8-97B9-AF670D59E487&ind=2014040110&n=780bd02e&psa=&st=sb&searchfor={searchTerms}SearchScopes: HKCU - {E412E48D-E496-4279-8F36-AAB22CFB2755} URL = http://mysearch.avg.com/search?cid={DF8B7F56-7A7C-46EE-9759-639D612A077C}&mid=d56d3c0856fa47d3936fd16dca7b2b2c-d9e4e754e4c04a251b8d61ca952a66e3f6cf5212〈=en&ds=AVG&coid=avgtbavg&cmpid=&pr=pr&d=2013-12-09 09:43:16&v=17.2.0.38&pid=safeguard&sg=0&sap=dsp&q={searchTerms} BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)Tcpip\Parameters: [DhcpNameServer] 192.168.1.254FireFox:========FF ProfilePath: C:\Users\Stacy\AppData\Roaming\Mozilla\Firefox\Profiles\7dilgz3x.defaultFF Homepage: https://www.google.comFF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()FF Plugin: @microsoft.com/GENUINE - disabled No FileFF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()FF Plugin-x32: @java.com/DTPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)FF Plugin-x32: @java.com/JavaPlugin,version=10.60.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)FF Plugin-x32: @microsoft.com/GENUINE - disabled No FileFF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)==================== Services (Whitelisted) =================R2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.02\AsSysCtrlService.exe [96896 2009-12-28] (ASUSTeK Computer Inc.)R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3241488 2014-06-27] (AVG Technologies CZ, s.r.o.)R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [289328 2014-06-17] (AVG Technologies CZ, s.r.o.)R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)R2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1631008 2014-05-29] (NVIDIA Corporation)R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [21055432 2014-05-29] (NVIDIA Corporation)S3 Futuremark SystemInfo Service; "C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe" [X]==================== Drivers (Whitelisted) ====================R1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2009-08-04] ()R1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [13368 2009-07-06] ()R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [242968 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [235800 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [328984 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123672 2014-06-17] (AVG Technologies CZ, s.r.o.)R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [269080 2014-06-17] (AVG Technologies CZ, s.r.o.)R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50464 2014-04-27] (AVG Technologies)R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-07] (Malwarebytes Corporation)R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)R3 MTsensor; C:\Windows\System32\DRIVERS\ASACPI.sys [15416 2009-07-16] ()R3 NvStreamKms; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [20256 2014-05-29] (NVIDIA Corporation)R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [40392 2014-03-31] (NVIDIA Corporation)==================== NetSvcs (Whitelisted) ======================================= One Month Created Files and Folders ========2014-07-07 19:03 - 2014-07-07 19:03 - 00011384 _____ () C:\Users\Stacy\Downloads\FRST.txt2014-07-07 19:02 - 2014-07-07 19:03 - 00000000 ____D () C:\FRST2014-07-07 19:01 - 2014-07-07 19:01 - 02084352 _____ (Farbar) C:\Users\Stacy\Downloads\FRST64.exe2014-07-07 06:27 - 2014-07-07 06:27 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk2014-07-07 06:27 - 2014-07-07 06:27 - 00001166 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk2014-07-07 06:26 - 2014-07-07 06:26 - 06226040 _____ (TeamViewer GmbH) C:\Users\Stacy\Downloads\TeamViewer_Setup_en.exe2014-07-07 06:26 - 2014-07-07 06:26 - 00000000 ____D () C:\Program Files (x86)\TeamViewer2014-07-06 21:01 - 2014-07-06 21:01 - 00007608 _____ () C:\Users\Stacy\AppData\Local\Resmon.ResmonCfg2014-07-06 20:51 - 2014-07-06 20:51 - 00000000 ____D () C:\Users\Stacy\AppData\Local\Adobe2014-07-06 20:50 - 2014-07-06 20:50 - 00098532 _____ () C:\Users\Stacy\Downloads\P6T_SE-DDR3_QVL_list_20091019.zip2014-07-06 20:35 - 2014-07-06 20:35 - 04568305 _____ () C:\Users\Stacy\Documents\Windows7_Vista_jcgriff2.rar2014-07-06 20:27 - 2014-07-06 20:34 - 00000000 ____D () C:\Users\Stacy\Documents\Windows7_Vista_jcgriff22014-07-06 20:25 - 2014-07-06 20:25 - 00591040 _____ (Sysinternals - www.sysinternals.com) C:\Users\Stacy\Documents\autoruns.exe2014-07-06 20:25 - 2014-07-06 20:25 - 00055296 _____ () C:\Users\Stacy\Documents\BSOD_Windows7_Vista_v2.64_jcgriff2_.exe2014-07-06 20:10 - 2014-07-06 20:10 - 01324120 _____ () C:\Windows\Minidump\070614-34008-01.dmp2014-07-06 16:27 - 2014-07-06 16:27 - 01326832 _____ () C:\Windows\Minidump\070614-25303-01.dmp2014-07-06 15:47 - 2014-07-06 21:02 - 00001212 _____ () C:\Users\Stacy\Desktop\1.txt2014-07-06 15:46 - 2011-02-03 07:00 - 00374171 _____ () C:\Windows6.1-KB2459268-x64.msu2014-07-06 15:45 - 2014-07-06 15:45 - 00503112 _____ () C:\Users\Stacy\Downloads\427485_intl_x64_zip.exe2014-07-06 15:41 - 2014-07-06 15:41 - 01324920 _____ () C:\Windows\Minidump\070614-27534-01.dmp2014-07-06 07:38 - 2014-07-06 07:42 - 01007592 _____ () C:\Users\Stacy\Downloads\p64v2511.zip2014-07-06 07:36 - 2014-07-06 07:36 - 00000000 ____D () C:\Windows\Sun2014-07-06 07:36 - 2014-07-06 07:36 - 00000000 ____D () C:\Users\Stacy\AppData\Roaming\Oracle2014-07-06 07:29 - 2014-07-06 07:29 - 00000000 ____D () C:\Users\Stacy\AppData\Local\IsolatedStorage2014-07-06 07:29 - 2014-07-06 07:29 - 00000000 ____D () C:\Users\Stacy\AppData\Local\Futuremark2014-07-06 07:26 - 2014-07-06 07:26 - 00000196 _____ () C:\Windows\DirectX.log2014-07-06 07:26 - 2010-06-02 04:55 - 00527192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAudio2_7.dll2014-07-06 07:26 - 2010-06-02 04:55 - 00518488 _____ (Microsoft Corporation) C:\Windows\system32\XAudio2_7.dll2014-07-06 07:26 - 2010-06-02 04:55 - 00239960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\xactengine3_7.dll2014-07-06 07:26 - 2010-06-02 04:55 - 00176984 _____ (Microsoft Corporation) C:\Windows\system32\xactengine3_7.dll2014-07-06 07:26 - 2010-06-02 04:55 - 00077656 _____ (Microsoft Corporation) C:\Windows\system32\XAPOFX1_5.dll2014-07-06 07:26 - 2010-06-02 04:55 - 00074072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XAPOFX1_5.dll2014-07-06 07:26 - 2010-05-26 11:41 - 02526056 _____ (Microsoft Corporation) C:\Windows\system32\D3DCompiler_43.dll2014-07-06 07:26 - 2010-05-26 11:41 - 02106216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DCompiler_43.dll2014-07-06 07:26 - 2010-05-26 11:41 - 01907552 _____ (Microsoft Corporation) C:\Windows\system32\d3dcsx_43.dll2014-07-06 07:26 - 2010-05-26 11:41 - 01868128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dcsx_43.dll2014-07-06 07:26 - 2006-09-28 16:05 - 03977496 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_31.dll2014-07-06 07:26 - 2006-09-28 16:05 - 02414360 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx9_31.dll2014-07-05 22:09 - 2014-07-05 22:13 - 00000000 ____D () C:\AdwCleaner2014-07-05 22:09 - 2014-07-05 22:09 - 01346519 _____ () C:\Users\Stacy\Desktop\adwcleaner_3.214.exe2014-07-05 22:00 - 2014-07-06 12:28 - 00002688 _____ () C:\Users\Stacy\Desktop\bugs.txt2014-07-05 21:53 - 2014-07-07 18:54 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2014-07-05 21:53 - 2014-07-05 21:53 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2014-07-05 21:53 - 2014-07-05 21:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-07-05 21:53 - 2014-07-05 21:53 - 00000000 ____D () C:\ProgramData\Malwarebytes2014-07-05 21:53 - 2014-07-05 21:53 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-07-05 21:53 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys2014-07-05 21:53 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys2014-07-05 21:53 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys2014-07-05 21:52 - 2014-07-05 21:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Stacy\Downloads\mbam-setup-2.0.2.1012.exe2014-07-05 21:15 - 2014-07-05 21:15 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe2014-07-05 21:15 - 2014-07-05 21:15 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe2014-07-05 21:15 - 2014-07-05 21:15 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe2014-07-05 21:15 - 2014-07-05 21:15 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\Users\Stacy\AppData\Local\Macromedia2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\ProgramData\Sun2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\ProgramData\Oracle2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\Program Files (x86)\Java2014-07-05 21:14 - 2014-07-05 21:14 - 00918952 _____ (Oracle Corporation) C:\Users\Stacy\Downloads\jxpiinstall.exe2014-07-05 20:31 - 2014-07-05 20:31 - 01212992 _____ () C:\Windows\Minidump\070514-27674-01.dmp2014-07-05 18:07 - 2014-07-05 18:08 - 01299104 _____ () C:\Windows\Minidump\070514-28111-01.dmp2014-07-05 15:39 - 2014-07-05 15:39 - 03297294 _____ () C:\Users\Stacy\Downloads\memtest86-usb.zip2014-07-05 15:31 - 2014-07-05 15:31 - 01326768 _____ () C:\Windows\Minidump\070514-26613-01.dmp2014-07-05 15:20 - 2014-01-08 21:22 - 05694464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll2014-07-05 15:20 - 2014-01-03 17:44 - 06574592 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll2014-07-05 13:09 - 2013-10-01 20:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll2014-07-05 13:08 - 2013-10-01 21:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys2014-07-05 13:08 - 2013-10-01 21:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe2014-07-05 13:08 - 2013-10-01 21:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll2014-07-05 13:08 - 2013-10-01 20:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll2014-07-05 13:08 - 2013-10-01 20:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll2014-07-05 13:08 - 2013-10-01 20:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll2014-07-05 13:08 - 2013-10-01 19:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll2014-07-05 13:08 - 2013-10-01 19:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll2014-07-05 13:08 - 2013-10-01 19:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll2014-07-05 13:08 - 2013-10-01 19:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe2014-07-05 13:08 - 2013-10-01 19:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe2014-07-05 13:08 - 2013-10-01 18:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll2014-07-05 13:08 - 2013-10-01 18:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe2014-07-05 13:08 - 2013-10-01 18:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll2014-07-05 13:08 - 2013-10-01 17:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe2014-07-05 13:08 - 2013-09-24 21:23 - 01030144 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll2014-07-05 13:08 - 2013-09-24 20:57 - 00792576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll2014-07-05 12:48 - 2014-07-05 12:48 - 00000000 ___SD () C:\Windows\system32\CompatTel2014-07-05 12:46 - 2014-07-05 12:46 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies2014-07-05 12:45 - 2014-05-19 18:10 - 00601432 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvStreaming.exe2014-07-05 12:45 - 2014-05-14 18:49 - 03774821 _____ () C:\Windows\system32\nvcoproc.bin2014-07-05 12:44 - 2014-05-19 21:44 - 31387936 _____ (NVIDIA Corporation) C:\Windows\system32\nvoglv64.dll2014-07-05 12:44 - 2014-05-19 21:44 - 25256224 _____ (NVIDIA Corporation) C:\Windows\system32\nvcompiler.dll2014-07-05 12:44 - 2014-05-19 21:44 - 24025376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvoglv32.dll2014-07-05 12:44 - 2014-05-19 21:44 - 17561544 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcompiler.dll2014-07-05 12:44 - 2014-05-19 21:44 - 17480432 _____ (NVIDIA Corporation) C:\Windows\system32\nvd3dumx.dll2014-07-05 12:44 - 2014-05-19 21:44 - 16003912 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvwgf2um.dll2014-07-05 12:44 - 2014-05-19 21:44 - 12688328 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvlddmkm.sys2014-07-05 12:44 - 2014-05-19 21:44 - 11644928 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuda.dll2014-07-05 12:44 - 2014-05-19 21:44 - 11599072 _____ (NVIDIA Corporation) C:\Windows\system32\nvopencl.dll2014-07-05 12:44 - 2014-05-19 21:44 - 09735256 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuda.dll2014-07-05 12:44 - 2014-05-19 21:44 - 09697640 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvopencl.dll2014-07-05 12:44 - 2014-05-19 21:44 - 03141976 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvid.dll2014-07-05 12:44 - 2014-05-19 21:44 - 02953672 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvid.dll2014-07-05 12:44 - 2014-05-19 21:44 - 02785568 _____ (NVIDIA Corporation) C:\Windows\system32\nvcuvenc.dll2014-07-05 12:44 - 2014-05-19 21:44 - 02412376 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvcuvenc.dll2014-07-05 12:44 - 2014-05-19 21:44 - 01889112 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispco6433788.dll2014-07-05 12:44 - 2014-05-19 21:44 - 01541576 _____ (NVIDIA Corporation) C:\Windows\system32\nvdispgenco6433788.dll2014-07-05 12:44 - 2014-05-19 21:44 - 00895776 _____ (NVIDIA Corporation) C:\Windows\system32\NvIFR64.dll2014-07-05 12:44 - 2014-05-19 21:44 - 00892704 _____ (NVIDIA Corporation) C:\Windows\system32\NvFBC64.dll2014-07-05 12:44 - 2014-05-19 21:44 - 00867784 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvIFR.dll2014-07-05 12:44 - 2014-05-19 21:44 - 00861128 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\NvFBC.dll2014-07-05 12:41 - 2010-05-26 11:41 - 02401112 _____ (Microsoft Corporation) C:\Windows\system32\D3DX9_43.dll2014-07-05 12:41 - 2010-05-26 11:41 - 01998168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\D3DX9_43.dll2014-07-05 12:41 - 2010-05-26 11:41 - 00511328 _____ (Microsoft Corporation) C:\Windows\system32\d3dx10_43.dll2014-07-05 12:41 - 2010-05-26 11:41 - 00470880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx10_43.dll2014-07-05 12:41 - 2010-05-26 11:41 - 00276832 _____ (Microsoft Corporation) C:\Windows\system32\d3dx11_43.dll2014-07-05 12:41 - 2010-05-26 11:41 - 00248672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3dx11_43.dll2014-07-05 12:40 - 2014-05-29 18:07 - 01715176 _____ (NVIDIA Corporation) C:\Windows\system32\nvspbridge64.dll2014-07-05 12:40 - 2014-05-29 18:07 - 01291232 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvspbridge.dll2014-07-05 12:40 - 2014-03-31 11:42 - 00040392 _____ (NVIDIA Corporation) C:\Windows\system32\Drivers\nvvad64v.sys2014-07-05 12:40 - 2014-03-31 11:42 - 00034760 _____ (NVIDIA Corporation) C:\Windows\SysWOW64\nvaudcap32v.dll2014-07-05 09:34 - 2014-07-06 12:26 - 00000206 _____ () C:\Users\Stacy\Desktop\checklist.txt2014-07-05 09:24 - 2014-07-05 09:24 - 00000000 ____D () C:\ProgramData\Package Cache2014-07-05 09:24 - 2014-07-05 09:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate2014-07-05 09:24 - 2014-07-05 09:24 - 00000000 ____D () C:\Program Files (x86)\Seagate2014-07-05 09:23 - 2014-07-05 09:23 - 26771088 _____ () C:\Users\Stacy\Downloads\SeaToolsforWindowsSetup.exe2014-07-05 09:22 - 2014-07-05 09:22 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk2014-07-05 09:22 - 2014-07-05 09:22 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk2014-07-05 09:22 - 2014-07-05 09:22 - 00000000 ____D () C:\Users\Stacy\AppData\Roaming\Mozilla2014-07-05 09:22 - 2014-07-05 09:22 - 00000000 ____D () C:\Users\Stacy\AppData\Local\Mozilla2014-07-05 09:22 - 2014-07-05 09:22 - 00000000 ____D () C:\ProgramData\Mozilla2014-07-05 09:22 - 2014-07-05 09:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2014-07-05 09:22 - 2014-05-30 05:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll2014-07-05 09:22 - 2014-05-30 05:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb2014-07-05 09:22 - 2014-05-30 05:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll2014-07-05 09:22 - 2014-05-30 04:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll2014-07-05 09:22 - 2014-05-30 04:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll2014-07-05 09:22 - 2014-05-30 04:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll2014-07-05 09:22 - 2014-05-30 04:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll2014-07-05 09:22 - 2014-05-30 04:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll2014-07-05 09:22 - 2014-05-30 04:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll2014-07-05 09:22 - 2014-05-30 04:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll2014-07-05 09:22 - 2014-05-30 04:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe2014-07-05 09:22 - 2014-05-30 04:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe2014-07-05 09:22 - 2014-05-30 04:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll2014-07-05 09:22 - 2014-05-30 04:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll2014-07-05 09:22 - 2014-05-30 04:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe2014-07-05 09:22 - 2014-05-30 04:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll2014-07-05 09:22 - 2014-05-30 04:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll2014-07-05 09:22 - 2014-05-30 04:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb2014-07-05 09:22 - 2014-05-30 03:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll2014-07-05 09:22 - 2014-05-30 03:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll2014-07-05 09:22 - 2014-05-30 03:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll2014-07-05 09:22 - 2014-05-30 03:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll2014-07-05 09:22 - 2014-05-30 03:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll2014-07-05 09:22 - 2014-05-30 03:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll2014-07-05 09:22 - 2014-05-30 03:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll2014-07-05 09:22 - 2014-05-30 03:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll2014-07-05 09:22 - 2014-05-30 03:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe2014-07-05 09:22 - 2014-05-30 03:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll2014-07-05 09:22 - 2014-05-30 03:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll2014-07-05 09:22 - 2014-05-30 03:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll2014-07-05 09:22 - 2014-05-30 03:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll2014-07-05 09:22 - 2014-05-30 03:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe2014-07-05 09:22 - 2014-05-30 03:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll2014-07-05 09:22 - 2014-05-30 03:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll2014-07-05 09:22 - 2014-05-30 03:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl2014-07-05 09:22 - 2014-05-30 03:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll2014-07-05 09:22 - 2014-05-30 03:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll2014-07-05 09:22 - 2014-05-30 03:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll2014-07-05 09:22 - 2014-05-30 03:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll2014-07-05 09:22 - 2014-05-30 03:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll2014-07-05 09:22 - 2014-05-30 02:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll2014-07-05 09:22 - 2014-05-30 02:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll2014-07-05 09:22 - 2014-05-30 02:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll2014-07-05 09:22 - 2014-05-30 02:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll2014-07-05 09:22 - 2014-05-30 02:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl2014-07-05 09:22 - 2014-05-30 02:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll2014-07-05 09:22 - 2014-05-30 02:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll2014-07-05 09:22 - 2014-05-30 02:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll2014-07-05 09:22 - 2014-05-30 02:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll2014-07-05 09:22 - 2014-05-30 02:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll2014-07-05 09:22 - 2014-05-30 02:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll2014-07-05 09:22 - 2014-05-30 02:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll2014-07-05 09:22 - 2014-05-08 04:32 - 03178496 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll2014-07-05 09:22 - 2014-05-08 04:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll2014-07-05 09:22 - 2014-04-24 21:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll2014-07-05 09:22 - 2014-04-24 21:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll2014-07-05 09:22 - 2014-04-11 21:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys2014-07-05 09:22 - 2014-04-11 21:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys2014-07-05 09:22 - 2014-04-11 21:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll2014-07-05 09:22 - 2014-04-11 21:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll2014-07-05 09:22 - 2014-04-11 21:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe2014-07-05 09:22 - 2014-04-11 21:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll2014-07-05 09:22 - 2014-04-11 21:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll2014-07-05 09:22 - 2014-04-11 21:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll2014-07-05 09:22 - 2014-04-11 21:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll2014-07-05 09:22 - 2014-04-04 21:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys2014-07-05 09:22 - 2014-04-04 21:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS2014-07-05 09:22 - 2014-03-26 09:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll2014-07-05 09:22 - 2014-03-26 09:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll2014-07-05 09:22 - 2014-03-26 09:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll2014-07-05 09:22 - 2014-03-26 09:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll2014-07-05 09:22 - 2014-03-26 09:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll2014-07-05 09:22 - 2014-03-26 09:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll2014-07-05 09:22 - 2014-03-26 09:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll2014-07-05 09:22 - 2014-03-26 09:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll2014-07-05 09:22 - 2014-03-24 21:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll2014-07-05 09:22 - 2014-03-24 21:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll2014-07-05 09:22 - 2014-03-04 04:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe2014-07-05 09:22 - 2014-03-04 04:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll2014-07-05 09:22 - 2014-03-04 04:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll2014-07-05 09:22 - 2014-03-04 04:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll2014-07-05 09:22 - 2014-03-04 04:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll2014-07-05 09:22 - 2014-03-04 04:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll2014-07-05 09:22 - 2014-03-04 04:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll2014-07-05 09:22 - 2014-03-04 04:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll2014-07-05 09:22 - 2014-03-04 04:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll2014-07-05 09:22 - 2014-03-04 04:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe2014-07-05 09:22 - 2014-03-04 04:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll2014-07-05 09:22 - 2014-03-04 04:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll2014-07-05 09:22 - 2014-03-04 04:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll2014-07-05 09:22 - 2014-03-04 04:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll2014-07-05 09:22 - 2014-03-04 04:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll2014-07-05 09:22 - 2014-03-04 04:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll2014-07-05 09:22 - 2014-03-04 04:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe2014-07-05 09:22 - 2014-03-04 04:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe2014-07-05 09:22 - 2014-03-04 04:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll2014-07-05 09:22 - 2014-03-04 04:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll2014-07-05 09:22 - 2014-03-04 04:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll2014-07-05 09:21 - 2014-07-05 09:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-07-05 09:19 - 2014-06-08 04:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2014-07-05 09:19 - 2014-06-08 04:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll2014-07-05 09:16 - 2014-07-05 09:16 - 00000000 __SHD () C:\Users\Stacy\AppData\Local\EmieUserList2014-07-05 09:16 - 2014-07-05 09:16 - 00000000 __SHD () C:\Users\Stacy\AppData\Local\EmieSiteList2014-06-17 16:21 - 2014-06-17 16:21 - 00235800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys2014-06-17 16:07 - 2014-06-17 16:07 - 00328984 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00269080 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00242968 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00190744 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00153368 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00123672 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00031512 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys==================== One Month Modified Files and Folders =======2014-07-07 19:03 - 2014-07-07 19:03 - 00011384 _____ () C:\Users\Stacy\Downloads\FRST.txt2014-07-07 19:03 - 2014-07-07 19:02 - 00000000 ____D () C:\FRST2014-07-07 19:01 - 2014-07-07 19:01 - 02084352 _____ (Farbar) C:\Users\Stacy\Downloads\FRST64.exe2014-07-07 18:59 - 2013-12-09 10:35 - 00000000 ____D () C:\ProgramData\MFAData2014-07-07 18:54 - 2014-07-05 21:53 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys2014-07-07 18:54 - 2013-11-27 16:30 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job2014-07-07 18:54 - 2013-11-27 12:11 - 01483278 _____ () C:\Windows\WindowsUpdate.log2014-07-07 06:27 - 2014-07-07 06:27 - 00001178 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 9.lnk2014-07-07 06:27 - 2014-07-07 06:27 - 00001166 _____ () C:\Users\Public\Desktop\TeamViewer 9.lnk2014-07-07 06:26 - 2014-07-07 06:26 - 06226040 _____ (TeamViewer GmbH) C:\Users\Stacy\Downloads\TeamViewer_Setup_en.exe2014-07-07 06:26 - 2014-07-07 06:26 - 00000000 ____D () C:\Program Files (x86)\TeamViewer2014-07-07 06:26 - 2009-07-14 00:13 - 00781298 _____ () C:\Windows\system32\PerfStringBackup.INI2014-07-07 06:26 - 2009-07-13 23:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A02014-07-07 06:26 - 2009-07-13 23:45 - 00022096 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A02014-07-07 06:19 - 2013-11-27 15:20 - 00000000 ____D () C:\ProgramData\NVIDIA2014-07-07 06:19 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT2014-07-07 06:19 - 2009-07-13 23:51 - 00038939 _____ () C:\Windows\setupact.log2014-07-06 22:04 - 2013-11-27 12:22 - 00000000 ____D () C:\Program Files (x86)\Intel2014-07-06 22:04 - 2010-11-20 22:47 - 00140854 _____ () C:\Windows\PFRO.log2014-07-06 21:56 - 2013-11-27 12:28 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information2014-07-06 21:56 - 2013-11-27 12:28 - 00000000 ____D () C:\Program Files (x86)\ASUS2014-07-06 21:55 - 2013-11-27 12:29 - 00000000 ____D () C:\Windows\System32\Tasks\ASUS2014-07-06 21:02 - 2014-07-06 15:47 - 00001212 _____ () C:\Users\Stacy\Desktop\1.txt2014-07-06 21:01 - 2014-07-06 21:01 - 00007608 _____ () C:\Users\Stacy\AppData\Local\Resmon.ResmonCfg2014-07-06 20:51 - 2014-07-06 20:51 - 00000000 ____D () C:\Users\Stacy\AppData\Local\Adobe2014-07-06 20:50 - 2014-07-06 20:50 - 00098532 _____ () C:\Users\Stacy\Downloads\P6T_SE-DDR3_QVL_list_20091019.zip2014-07-06 20:35 - 2014-07-06 20:35 - 04568305 _____ () C:\Users\Stacy\Documents\Windows7_Vista_jcgriff2.rar2014-07-06 20:34 - 2014-07-06 20:27 - 00000000 ____D () C:\Users\Stacy\Documents\Windows7_Vista_jcgriff22014-07-06 20:25 - 2014-07-06 20:25 - 00591040 _____ (Sysinternals - www.sysinternals.com) C:\Users\Stacy\Documents\autoruns.exe2014-07-06 20:25 - 2014-07-06 20:25 - 00055296 _____ () C:\Users\Stacy\Documents\BSOD_Windows7_Vista_v2.64_jcgriff2_.exe2014-07-06 20:10 - 2014-07-06 20:10 - 01324120 _____ () C:\Windows\Minidump\070614-34008-01.dmp2014-07-06 20:10 - 2013-11-27 16:18 - 521007170 _____ () C:\Windows\MEMORY.DMP2014-07-06 20:10 - 2013-11-27 16:18 - 00000000 ____D () C:\Windows\Minidump2014-07-06 16:27 - 2014-07-06 16:27 - 01326832 _____ () C:\Windows\Minidump\070614-25303-01.dmp2014-07-06 15:45 - 2014-07-06 15:45 - 00503112 _____ () C:\Users\Stacy\Downloads\427485_intl_x64_zip.exe2014-07-06 15:41 - 2014-07-06 15:41 - 01324920 _____ () C:\Windows\Minidump\070614-27534-01.dmp2014-07-06 12:28 - 2014-07-05 22:00 - 00002688 _____ () C:\Users\Stacy\Desktop\bugs.txt2014-07-06 12:28 - 2013-11-27 12:11 - 00000000 ____D () C:\Users\Stacy2014-07-06 12:26 - 2014-07-05 09:34 - 00000206 _____ () C:\Users\Stacy\Desktop\checklist.txt2014-07-06 08:51 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\rescache2014-07-06 07:42 - 2014-07-06 07:38 - 01007592 _____ () C:\Users\Stacy\Downloads\p64v2511.zip2014-07-06 07:36 - 2014-07-06 07:36 - 00000000 ____D () C:\Windows\Sun2014-07-06 07:36 - 2014-07-06 07:36 - 00000000 ____D () C:\Users\Stacy\AppData\Roaming\Oracle2014-07-06 07:29 - 2014-07-06 07:29 - 00000000 ____D () C:\Users\Stacy\AppData\Local\IsolatedStorage2014-07-06 07:29 - 2014-07-06 07:29 - 00000000 ____D () C:\Users\Stacy\AppData\Local\Futuremark2014-07-06 07:26 - 2014-07-06 07:26 - 00000196 _____ () C:\Windows\DirectX.log2014-07-05 22:13 - 2014-07-05 22:09 - 00000000 ____D () C:\AdwCleaner2014-07-05 22:09 - 2014-07-05 22:09 - 01346519 _____ () C:\Users\Stacy\Desktop\adwcleaner_3.214.exe2014-07-05 22:03 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\SchCache2014-07-05 21:53 - 2014-07-05 21:53 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk2014-07-05 21:53 - 2014-07-05 21:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware2014-07-05 21:53 - 2014-07-05 21:53 - 00000000 ____D () C:\ProgramData\Malwarebytes2014-07-05 21:53 - 2014-07-05 21:53 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware2014-07-05 21:53 - 2014-07-05 21:52 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Stacy\Downloads\mbam-setup-2.0.2.1012.exe2014-07-05 21:36 - 2014-04-01 09:16 - 00000000 ____D () C:\Program Files (x86)\Coupons2014-07-05 21:15 - 2014-07-05 21:15 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe2014-07-05 21:15 - 2014-07-05 21:15 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe2014-07-05 21:15 - 2014-07-05 21:15 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe2014-07-05 21:15 - 2014-07-05 21:15 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\Users\Stacy\AppData\Local\Macromedia2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\ProgramData\Sun2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\ProgramData\Oracle2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java2014-07-05 21:15 - 2014-07-05 21:15 - 00000000 ____D () C:\Program Files (x86)\Java2014-07-05 21:14 - 2014-07-05 21:14 - 00918952 _____ (Oracle Corporation) C:\Users\Stacy\Downloads\jxpiinstall.exe2014-07-05 21:13 - 2013-11-27 16:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe2014-07-05 21:13 - 2013-11-27 16:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl2014-07-05 21:13 - 2013-11-27 16:30 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater2014-07-05 20:31 - 2014-07-05 20:31 - 01212992 _____ () C:\Windows\Minidump\070514-27674-01.dmp2014-07-05 18:08 - 2014-07-05 18:07 - 01299104 _____ () C:\Windows\Minidump\070514-28111-01.dmp2014-07-05 15:39 - 2014-07-05 15:39 - 03297294 _____ () C:\Users\Stacy\Downloads\memtest86-usb.zip2014-07-05 15:32 - 2009-07-14 00:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD2014-07-05 15:31 - 2014-07-05 15:31 - 01326768 _____ () C:\Windows\Minidump\070514-26613-01.dmp2014-07-05 15:24 - 2009-07-13 23:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk2014-07-05 13:01 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions2014-07-05 12:52 - 2013-11-27 13:07 - 00000000 ____D () C:\Windows\system32\MRT2014-07-05 12:51 - 2013-12-09 10:26 - 00000000 ____D () C:\ProgramData\Microsoft Help2014-07-05 12:48 - 2014-07-05 12:48 - 00000000 ___SD () C:\Windows\system32\CompatTel2014-07-05 12:46 - 2014-07-05 12:46 - 00000000 ____D () C:\Program Files (x86)\AGEIA Technologies2014-07-05 12:46 - 2013-11-27 15:19 - 00000000 ____D () C:\Program Files (x86)\NVIDIA Corporation2014-07-05 12:45 - 2013-12-09 10:21 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation2014-07-05 12:40 - 2013-12-09 11:12 - 00000000 ____D () C:\Users\Stacy\AppData\Local\NVIDIA Corporation2014-07-05 12:40 - 2013-11-27 15:19 - 00000000 ____D () C:\ProgramData\NVIDIA Corporation2014-07-05 12:40 - 2013-11-27 15:18 - 00000000 ____D () C:\Program Files\NVIDIA Corporation2014-07-05 09:24 - 2014-07-05 09:24 - 00000000 ____D () C:\ProgramData\Package Cache2014-07-05 09:24 - 2014-07-05 09:24 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Seagate2014-07-05 09:24 - 2014-07-05 09:24 - 00000000 ____D () C:\Program Files (x86)\Seagate2014-07-05 09:23 - 2014-07-05 09:23 - 26771088 _____ () C:\Users\Stacy\Downloads\SeaToolsforWindowsSetup.exe2014-07-05 09:22 - 2014-07-05 09:22 - 00001163 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk2014-07-05 09:22 - 2014-07-05 09:22 - 00001151 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk2014-07-05 09:22 - 2014-07-05 09:22 - 00000000 ____D () C:\Users\Stacy\AppData\Roaming\Mozilla2014-07-05 09:22 - 2014-07-05 09:22 - 00000000 ____D () C:\Users\Stacy\AppData\Local\Mozilla2014-07-05 09:22 - 2014-07-05 09:22 - 00000000 ____D () C:\ProgramData\Mozilla2014-07-05 09:22 - 2014-07-05 09:22 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service2014-07-05 09:22 - 2014-07-05 09:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox2014-07-05 09:19 - 2013-12-09 11:15 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk2014-07-05 09:16 - 2014-07-05 09:16 - 00000000 __SHD () C:\Users\Stacy\AppData\Local\EmieUserList2014-07-05 09:16 - 2014-07-05 09:16 - 00000000 __SHD () C:\Users\Stacy\AppData\Local\EmieSiteList2014-06-17 16:21 - 2014-06-17 16:21 - 00235800 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgldx64.sys2014-06-17 16:07 - 2014-06-17 16:07 - 00328984 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgloga.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00269080 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgtdia.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00242968 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsdrivera.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00190744 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgidsha.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00153368 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgdiska.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00123672 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgmfx64.sys2014-06-17 16:06 - 2014-06-17 16:06 - 00031512 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\system32\Drivers\avgrkx64.sys2014-06-08 04:13 - 2014-07-05 09:19 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll2014-06-08 04:08 - 2014-07-05 09:19 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dllSome content of TEMP:====================C:\Users\Stacy\AppData\Local\Temp\Couponscom.exeC:\Users\Stacy\AppData\Local\Temp\DefaultPack.exeC:\Users\Stacy\AppData\Local\Temp\install_reader11_en_gtbd_chrd_dn_aaa_aih.exeC:\Users\Stacy\AppData\Local\Temp\MouseKeyboardCenterx64_1033.exeC:\Users\Stacy\AppData\Local\Temp\nvSCPAPI.dllC:\Users\Stacy\AppData\Local\Temp\nvStInst.exeC:\Users\Stacy\AppData\Local\Temp\oi_{53F0692E-D4FB-4913-BEF1-D35049E98018}.exeC:\Users\Stacy\AppData\Local\Temp\ose00000.exe==================== Bamital & volsnap Check =================C:\Windows\System32\winlogon.exe => File is digitally signedC:\Windows\System32\wininit.exe => File is digitally signedC:\Windows\SysWOW64\wininit.exe => File is digitally signedC:\Windows\explorer.exe => File is digitally signedC:\Windows\SysWOW64\explorer.exe => File is digitally signedC:\Windows\System32\svchost.exe => File is digitally signedC:\Windows\SysWOW64\svchost.exe => File is digitally signedC:\Windows\System32\services.exe => File is digitally signedC:\Windows\System32\User32.dll => File is digitally signedC:\Windows\SysWOW64\User32.dll => File is digitally signedC:\Windows\System32\userinit.exe => File is digitally signedC:\Windows\SysWOW64\userinit.exe => File is digitally signedC:\Windows\System32\rpcss.dll => File is digitally signedC:\Windows\System32\Drivers\volsnap.sys => File is digitally signedLastRegBack: 2014-07-05 13:48==================== End Of Log ============================ Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-07-2014 01Ran by Stacy at 2014-07-07 19:04:00Running from C:\Users\Stacy\DownloadsBoot Mode: Normal============================================================================== Security Center ========================AV: AVG AntiVirus 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}AS: AVG AntiVirus 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}==================== Installed Programs ======================Adobe Flash Player 13 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 13.0.0.214 - Adobe Systems Incorporated)Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)Adobe Reader XI (11.0.07) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4716 - AVG Technologies)AVG 2014 (Version: 14.0.3986 - AVG Technologies) HiddenAVG 2014 (Version: 14.0.4716 - AVG Technologies) HiddenCPUID CPU-Z 1.66 (HKLM\...\CPUID CPU-Z_is1) (Version: - )Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{CA75CBF9-B078-47CB-ABA3-74EFD4FC9A43}) (Version: - Microsoft)Futuremark SystemInfo (HKLM-x32\...\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}) (Version: 4.17.0 - Futuremark Corporation)Java 7 Update 60 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217060FF}) (Version: 7.0.600 - Oracle)Java Auto Updater (x32 Version: 2.1.60.19 - Oracle, Inc.) HiddenMalwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) HiddenMicrosoft Office Access MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Excel MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Home and Student 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Proof (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Proofing (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Office Word MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) HiddenMicrosoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) HiddenMicrosoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) HiddenMozilla Firefox 30.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 en-US)) (Version: 30.0 - Mozilla)Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)NVIDIA 3D Vision Controller Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 337.88 - NVIDIA Corporation)NVIDIA 3D Vision Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 337.88 - NVIDIA Corporation)NVIDIA Control Panel 337.88 (Version: 337.88 - NVIDIA Corporation) HiddenNVIDIA GeForce Experience 2.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.1 - NVIDIA Corporation)NVIDIA Graphics Driver 337.88 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 337.88 - NVIDIA Corporation)NVIDIA Install Application (Version: 2.1002.157.1165 - NVIDIA Corporation) HiddenNVIDIA LED Visualizer 1.0 (Version: 1.0 - NVIDIA Corporation) HiddenNVIDIA Network Service (Version: 1.0 - NVIDIA Corporation) HiddenNVIDIA PhysX (x32 Version: 9.13.1220 - NVIDIA Corporation) HiddenNVIDIA PhysX System Software 9.13.1220 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.1220 - NVIDIA Corporation)NVIDIA ShadowPlay 14.6.22 (Version: 14.6.22 - NVIDIA Corporation) HiddenNVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.12.6514 - NVIDIA Corporation) HiddenNVIDIA Update 14.6.22 (Version: 14.6.22 - NVIDIA Corporation) HiddenNVIDIA Update Core (Version: 14.6.22 - NVIDIA Corporation) HiddenNVIDIA Virtual Audio 1.2.23 (Version: 1.2.23 - NVIDIA Corporation) HiddenRealtek 8136 8168 8169 Ethernet Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0005 - Realtek)Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5859 - Realtek Semiconductor Corp.)SeaTools for Windows (HKLM-x32\...\SeaTools for Windows) (Version: - Seagate Technology)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) HiddenSHIELD Streaming (Version: 2.1.214 - NVIDIA Corporation) HiddenTeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.29947 - TeamViewer)Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.SingleImage_{5E8EB600-8B94-429E-873E-98369C6DC1BC}) (Version: - Microsoft)Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0409-0000-0000000FF1CE}_Office14.SingleImage_{DCE104A1-1875-4469-A83D-A5BFA6C4640F}) (Version: - Microsoft)Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0409-0000-0000000FF1CE}_Office14.SingleImage_{334AA0A1-2BB1-4D74-B66A-2B2C4D9C2C87}) (Version: - Microsoft)Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.SingleImage_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)WinRAR 5.00 (64-bit) (HKLM\...\WinRAR archiver) (Version: 5.00.0 - win.rar GmbH)==================== Restore Points =========================05-07-2014 17:47:39 Windows Update05-07-2014 18:08:22 Windows Update05-07-2014 18:18:18 Windows Update06-07-2014 01:55:25 Windows Update06-07-2014 02:14:38 Installed Java 7 Update 6006-07-2014 12:25:38 Installed 3DMark06-07-2014 14:58:02 Removed 3DMark06-07-2014 20:46:25 Windows Update07-07-2014 01:53:42 restore 1 techsupportforum07-07-2014 02:14:33 Removed ASUS Ai Charger07-07-2014 02:16:22 Removed ASUSUpdate07-07-2014 02:17:36 Removed PC Probe II07-07-2014 02:55:08 Removed AI Suite07-07-2014 02:55:34 Removed EPU-6 Engine07-07-2014 02:56:12 Removed TurboV==================== Hosts content: ==========================2009-07-13 21:34 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts==================== Scheduled Tasks (whitelisted) =============Task: {14B09382-5656-4795-B09A-74E15BEF0F51} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-05] (Adobe Systems Incorporated)Task: {DCD7CB95-A588-4BD0-A1FD-5B4CBC1C6736} - System32\Tasks\ASUS\ASUS RegRun Loader => C:\Program Files (x86)\ASUS\AASP\1.01.02\AsLoader.exe [2009-12-28] (ASUSTeK Computer Inc.)Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe==================== Loaded Modules (whitelisted) =============2013-11-27 15:19 - 2014-05-19 20:25 - 00116568 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll2006-12-04 02:26 - 2006-12-04 02:26 - 00022016 _____ () C:\Windows\System32\sugs2l6.dll2014-07-05 09:21 - 2014-06-05 23:38 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll==================== Alternate Data Streams (whitelisted) ============================= Safe Mode (whitelisted) ======================================= EXE Association (whitelisted) ================================= MSCONFIG/TASK MANAGER disabled items ============================= Faulty Device Manager Devices ================================= Event log errors: =========================Application errors:==================Error: (07/07/2014 06:20:50 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 10:06:28 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 09:46:09 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 09:34:04 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 09:05:00 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 08:12:02 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 04:28:39 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 03:53:34 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 03:50:28 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 03:42:43 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003System errors:=============Error: (07/06/2014 08:10:39 PM) (Source: BugCheck) (EventID: 1001) (User: )Description: 0x0000009f (0x0000000000000003, 0xfffffa800941f060, 0xfffff80000b9c518, 0xfffffa800733f8e0)C:\Windows\MEMORY.DMP070614-34008-01Error: (07/06/2014 08:10:36 PM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 8:07:54 PM on 7/6/2014 was unexpected.Error: (07/06/2014 04:27:15 PM) (Source: BugCheck) (EventID: 1001) (User: )Description: 0x0000009f (0x0000000000000003, 0xfffffa8009471060, 0xfffff80004301518, 0xfffffa8007705c10)C:\Windows\MEMORY.DMP070614-25303-01Error: (07/06/2014 04:27:05 PM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 4:25:17 PM on 7/6/2014 was unexpected.Error: (07/06/2014 03:47:10 PM) (Source: DCOM) (EventID: 10010) (User: )Description: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}Error: (07/06/2014 03:41:26 PM) (Source: BugCheck) (EventID: 1001) (User: )Description: 0x0000009f (0x0000000000000003, 0xfffffa80094f8060, 0xfffff80000b9c518, 0xfffffa800ab07c10)C:\Windows\MEMORY.DMP070614-27534-01Error: (07/06/2014 03:41:11 PM) (Source: EventLog) (EventID: 6008) (User: )Description: The previous system shutdown at 12:46:10 PM on 7/6/2014 was unexpected.Microsoft Office Sessions:=========================Error: (07/07/2014 06:20:50 AM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 10:06:28 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 09:46:09 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 09:34:04 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 09:05:00 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 08:12:02 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 04:28:39 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 03:53:34 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 03:50:28 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003Error: (07/06/2014 03:42:43 PM) (Source: WinMgmt) (EventID: 10) (User: )Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003==================== Memory info ===========================Percentage of memory in use: 19%Total physical RAM: 8183.12 MBAvailable physical RAM: 6563.11 MBTotal Pagefile: 16364.41 MBAvailable Pagefile: 14243.32 MBTotal Virtual: 8192 MBAvailable Virtual: 8191.83 MB==================== Drives ================================Drive c: () (Fixed) (Total:931.41 GB) (Free:880.42 GB) NTFS==================== MBR & Partition Table ==========================================================================Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 707B5CEE)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)========================================================Disk: 1 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 707B5CEE)Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)==================== End Of Log ============================ aswMBR version 1.0.1.2041 Copyright© 2014 AVAST SoftwareRun date: 2014-07-07 19:08:14-----------------------------19:08:14.840 OS Version: Windows x64 6.1.7601 Service Pack 119:08:14.840 Number of processors: 8 586 0x1A0519:08:14.840 ComputerName: STACY-PC UserName: Stacy19:08:17.017 Initialize success19:08:17.110 VM: initialized successfully19:08:17.113 VM: Intel CPU supported19:08:29.998 VM: supported disk I/O ataport.SYS19:09:39.328 AVAST engine defs: 1407070119:12:58.051 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-219:12:58.067 Disk 0 Vendor: ST31000528AS CC34 Size: 953869MB BusType: 319:12:58.067 Disk 1 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP3T0L0-319:12:58.067 Disk 1 Vendor: ST31000528AS CC34 Size: 953869MB BusType: 319:12:58.145 Disk 0 MBR read successfully19:12:58.145 Disk 0 MBR scan19:12:58.160 Disk 0 Windows 7 default MBR code19:12:58.160 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 204819:12:58.160 Disk 0 default boot code19:12:58.176 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 953765 MB offset 20684819:12:58.207 Disk 0 scanning C:\Windows\system32\drivers19:13:05.399 Service scanning19:13:18.861 Modules scanning19:13:18.861 Disk 0 trace - called modules:19:13:18.877 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys19:13:18.877 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007d82790]19:13:18.893 3 CLASSPNP.SYS[fffff88001bc543f] -> nt!IofCallDriver -> [0xfffffa8007b17670]19:13:18.893 5 ACPI.sys[fffff88000f6d7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-2[0xfffffa8007b50060]19:13:22.715 AVAST engine scan C:\Windows19:13:24.587 AVAST engine scan C:\Windows\system3219:15:54.207 AVAST engine scan C:\Windows\system32\drivers19:16:03.270 AVAST engine scan C:\Users\Stacy19:18:13.357 AVAST engine scan C:\ProgramData19:18:27.011 Scan finished successfully19:18:40.490 Disk 0 MBR has been saved successfully to "C:\Users\Stacy\Desktop\MBR.dat"19:18:40.490 The log file has been saved successfully to "C:\Users\Stacy\Desktop\aswMBR.txt" Please let me know if I missed somthing. Link to post Share on other sites More sharing options...
Psychotic Posted July 8, 2014 ID:850284 Share Posted July 8, 2014 That doesnt´look malware related. Let´s check something else: Use the Windows Error Checking utility (Check Disk), with the options to fix file system errors and scan the disk surface for errors, attempt recovery of data and repair the disk: Click the "Windows Orb" Start button, then click Computer. Right-click on the drive that you wish to check > Properties > Tools tab In the "Error checking" section, click on Check now. Place a checkmark in both boxes > Start. If the disk you have chosen is the Windows system disk: A message will notify you that a restart is necessary ask "Do you want to check for hard disk errors the next time you start your computer?". Click Schedule disk check > OK and close all windows. Re-start the computer. The disk will be checked when the system boots. This will take some time to run and at times may appear stalled but just let it run. When the disk check is complete, the system will re-start automatically and load Windows.A log of the disk check is recorded only if the scheduled re-start is used, and only for drives on the same HDD as the Operating System.To open Event Viewer and view the log: Click the "Windows Orb" Start button -> type "eventvwr" without the quotes -> press the key. The Event Viewer window will open. In the left pane, expand "Windows Logs" and then click on Application. In the right pane, at the top, click on the column heading Source to sort the list alphabetically. Look in the Source column for "Wininit", with an entry corresponding to the date and time of the disk check. Click on that Wininit entry to select it. On the top main menu, click Action > Copy > Copy Details as Text. Paste the contents into your next reply. System File CheckFor Windows XP: Press the Windows- and the R-key simultanously. Within the text box that jus opened, write cmd and hit Enter.For Windows Vista/7: Press the Windows key to open the start menu. Don´t highlight anything, just write cmd. The start menu will offer you an entry named cmd. Right click it and select "run as administrator"Within the opening window, write the following:sfc /scannow(See the blank within). Hit enter. Your system will be checked for damaged system files. Tell me the result of that scan in here (as the tool produces no log). Link to post Share on other sites More sharing options...
blakiebinside Posted July 8, 2014 Author ID:850294 Share Posted July 8, 2014 Marius, I have run both of these programs and it looks like I am good to go. Since removing the malware using malwarebytes and uninstalling the ASUS utilities I have not seen a crash yet. Thank you for taking the time to review my logs, I appreciate your help. -Blake Link to post Share on other sites More sharing options...
Psychotic Posted July 8, 2014 ID:850299 Share Posted July 8, 2014 You´re welcome! Uninstall our tools using delfixPlease follow these steps in order: In the case we used Defogger to turn off your CD emulation software. You can start it again and use the Enable button. In the case we used Combofix. Deactivate your antivirus software once more, then rename the combofix.exe to uninstall.exe and run it one last time. You shall be noted that Combofix has been removed. In any case please download delfix to your desktop. Close all other programms and start delfix. Please check all the boxes and run the tool. delfix will now delete all found traces of our removal process [*] If there is still something left please delete it manualy.Delete System Restore PointsTo ensure your System Restore Points are free of malware, we will delete all of them but the most recent or create a new one.On Windows Vista: Please follow these instructions to delete all but the most common System Protection Restore Points.On Windows 7/8: Please follow these instructions to delete all but the most common System Protection Restore Points.On Windows XP: Please follow these instructions to delete all but the most common System Protection Restore Points. Recommendations: How to protect yourselfSystem UpdatesPlease ensure to have automatic updates activated in your control panel.For further information and a tutorial, see this Microsoft Support article. ProtectionWhat you need is one (not more) virus scanner with background protection. Additionally I recommend a special malware scanner to run on demand weekly.Personally I am using avast! Antivirus Free Edition and Malwarebytes Anti-Malware. They offer good protection for free.To keep your browser free of advertising, you may install the Adblock Plus browser extension.It will filter unwanted advertising out of the website´s content. To protect yourself from accidentally visiting malicious web sites, install the Web of Trust (WOT) browser extension.It will display a green (safe), yellow (unknown) or red (potentially dangerous) icon for a visited website within your browser.In addition, before accessing a dangerous classified web site, a warning screen is displayed. [*]Up to date SoftwareKeep your Windows and your third party software up to date. The easiest way to get infected is an outdated windows, followed by: browser(s) (including add-ons and plug-ins), Adobe Flash Player and Adobe Reader, Java Runtime Environment, your antivirus program and so on. These links may help you to check:Secunia Personal Software Inspector - checks if your software has updates available. SecurityCheck (by screen317) - scans your computer for most vulnerable outdated software. Mozilla: Check your plugins - The webpage will tell you if you have outdated plugins running in your Firefox browser. [*]BackupHardware issues, malware, fire, lightning strike: There is a long list of different ways to loose all your data. Back up your files regularly. Use the windows internal backup function or a third party tool and save your data onto an external hard drive, cloud storage, optical media like CDs or DVDs or (if available) a professional network backup system. [*]BehaviourThe commonest error when using a computer is "error 80" - what means that the error is located about 80cm in front of the monitor. This is a common joke between IT support technicians but it shows that all the safety mechanisms won´t help if you aren´t careful enough.While surfing the internet, don´t click on anything you don´t know. In the worst case, it infects your system with malware. Watch your step in social networks! Many cyber criminals use them to spread malware, mine personal pata (to be sold to advertising companies, for example) or simply do damage to other users. Even if a received hyperlink within a message seems to be coming from one of your friends, have a closer look. In addition, don´t click everything. When installing software, have a look to each of the setup windows and uncheck any additional toolbars or free programs that may be offered additionally. Most of today´s setup procedures contain potentially unwanted programs so keep them off your system. Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 16, 2014 Root Admin ID:853420 Share Posted July 16, 2014 Glad we could help. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread. Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts