Jump to content

melissac72

Honorary Members
  • Posts

    28
  • Joined

  • Last visited

Reputation

0 Neutral
  1. I completed all steps. I did get a message when I ran Delfix "application failed to starte wbemcomn.dll not found. The only way out of it was to close program. It appears though that it cleaned up all the programs downloaded during our progress. I am not sure if that is important or not. Thanks again, Melissa
  2. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-08-2014 Ran by Melissa (administrator) on MELISSA-PC on 02-08-2014 13:01:32 Running from C:\Users\Melissa\Desktop Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States) Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (Agere Systems) C:\Program Files\LSI SoftModem\agr64svc.exe (Coupons.com Inc.) C:\Program Files (x86)\Coupons\CouponPrinterService.exe (Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe (Microsoft Corporation) C:\Windows\ehome\ehsched.exe () C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe () C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe (Seagate Technology LLC) C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE () C:\Windows\mHotkey.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe (PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (Seagate Technology LLC) C:\Program Files (x86)\Seagate\SeagateManager\Sync\MaxSync.exe (Seagate LLC) C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\1275861383\ee\aolsoftware.exe (Creative) C:\Windows\CNYHKey.exe (Chicony) C:\Windows\ChiFuncExt.exe (Chicony) C:\Windows\ModLEDKey.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\waol.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\shellmon.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\UIFramework\uiWinMgr.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [229824 2013-10-09] (Trend Micro Inc.) HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.) HKLM\...\Run: [iAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-09-12] (Intel Corporation) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM-x32\...\Run: [Monitor] => C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe [295304 2012-07-05] (LeapFrog Enterprises, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [LTCM Client] => C:\Program Files (x86)\LTCM Client\ltcmClient.exe [1596096 2009-08-05] (Leader Technologies Inc.) HKLM-x32\...\Run: [sSDMonitor] => C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [112600 2010-11-15] (PC Tools) HKLM-x32\...\Run: [MaxMenuMgr] => C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe [185640 2009-05-01] (Seagate LLC) HKLM-x32\...\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1275861383\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.) HKLM-x32\...\Run: [LedKey] => C:\Windows\CNYHKey.exe [339968 2008-04-23] (Creative) HKLM-x32\...\Run: [LchDrvKey] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] () Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-770997747-1975351657-1911745460-1000\...\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL Desktop 9.7b\AOL.EXE [72296 2014-06-05] (AOL Inc.) HKU\S-1-5-21-770997747-1975351657-1911745460-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1 ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1C520D3D7F3DCB01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0610&m=sx2800 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe64.dll (Trend Micro Inc.) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg32.dll (Trend Micro Inc.) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: AOL Toolbar Loader -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File BHO-x32: EWPBrowseObject Class -> {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} -> C:\Program Files (x86)\Canon\Easy-WebPrint\EWPBrowseLoader.dll () BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe32.dll (Trend Micro Inc.) BHO-x32: Price Check by AOL -> {D25B97E9-62B2-40CE-BECF-E43A7B879072} -> C:\Program Files (x86)\Price Check by AOL\aolpricecheck.dll (AOL Inc.) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe64.dll (Trend Micro Inc.) Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.) Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - No File Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe32.dll (Trend Micro Inc.) Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg32.dll (Trend Micro Inc.) Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/MycameraPlugin -> C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 -> C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @viewpoint.com/VMP -> C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll () FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Melissa\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll (Amazon.com, Inc.) FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension [2014-04-24] FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-06-06] FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-10-09] FF HKLM-x32\...\Firefox\Extensions: [{38783831-6098-4faa-A9C9-1EE1E343F4D2}] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1104\7.1.1104\firefoxextension FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF HKLM-x32\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-04-24] Chrome: ======= CHR HomePage: CHR StartupUrls: "hxxp://www.google.com/" CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-02] CHR Extension: (RealDownloader) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-07-07] CHR Extension: (Google Wallet) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-02] CHR HKLM-x32\...\Chrome\Extension: [bmiabdepfhhiieiipmeecdmeljggmfee] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1135\8.0.1135\chrome_tmbep.crx [2014-08-02] CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agr64svc.exe [16896 2008-08-26] (Agere Systems) R2 CouponPrinterService; C:\Program Files (x86)\Coupons\CouponPrinterService.exe [176624 2014-02-13] (Coupons.com Inc.) R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed] R2 FlipShare Service; C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe [460144 2011-05-06] () R2 FlipShareServer; C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [1085440 2011-05-06] () [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [632792 2010-04-08] (PC Tools) R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] () R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X] S3 TweakingRunAsSystemService; "C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\tweaking_ras.exe" cmd.exe []/c start /HIGH cmd.exe /c C:\Users\Melissa\AppData\Local\Temp\temp761.bat & exit ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation) S1 Beep; No ImagePath R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) S3 NeroCd2k; C:\Windows\SysWOW64\drivers\NeroCd2k.sys [44227 2001-04-16] (ahead software gmbh im stoeckmaedle 6 76307 karlsbad, germany Fax: ++49-7248-911-888 e-mail: info@nero.com) [File not signed] S3 rt70x64; C:\Windows\System32\DRIVERS\WUSB54Gv4x64.sys [308224 2007-03-11] (Ralink Technology Inc.) R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [117312 2013-12-03] (Trend Micro Inc.) R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [283160 2013-12-03] (Trend Micro Inc.) R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [50976 2013-07-01] (Trend Micro Inc.) R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [100640 2013-06-13] (Trend Micro Inc.) R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [85936 2013-12-03] (Trend Micro Inc.) R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [303392 2013-05-15] (Trend Micro Inc.) R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105744 2011-08-22] (Trend Micro Inc.) R3 XG762_VS; C:\Windows\System32\DRIVERS\WlanGZG.sys [1041920 2008-10-28] (Atheros Communications, Inc.) S3 ZDCNDIS6a64; C:\Windows\system32\ZDCNDIS6a64.sys [41280 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) S3 ZDCNDIS6a64; C:\Windows\SysWOW64\ZDCNDIS6a64.sys [41280 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) S3 BCMH43XX; system32\DRIVERS\bcmwlhigh664.sys [X] S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] U2 TMAgent; ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-02 13:01 - 2014-08-02 13:01 - 00022005 _____ () C:\Users\Melissa\Desktop\FRST.txt 2014-08-02 12:54 - 2014-08-02 12:54 - 02094080 _____ (Farbar) C:\Users\Melissa\Desktop\FRST64.exe 2014-08-02 11:12 - 2014-08-02 11:12 - 00448512 _____ (OldTimer Tools) C:\Users\Melissa\Desktop\TFC.exe 2014-08-01 17:40 - 2014-08-01 17:40 - 00000384 _____ () C:\Windows\DCEBOOT.RST 2014-08-01 17:40 - 2014-08-01 17:40 - 00000000 _____ () C:\Windows\DCEBOOT.LOG 2014-08-01 17:38 - 2014-08-01 17:38 - 00231960 _____ () C:\Windows\RegBootClean64.exe 2014-08-01 17:38 - 2014-08-01 17:38 - 00021528 _____ () C:\Windows\DCEBoot64.exe 2014-08-01 12:39 - 2014-08-02 12:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-01 11:44 - 2014-08-02 12:56 - 00003370 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-01 11:44 - 2014-08-02 12:56 - 00003240 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-07-31 06:14 - 2014-07-31 06:14 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MELISSA-PC-Microsoft®-Windows-Vista™-Home-Premium-(64-bit).dat 2014-07-31 06:14 - 2014-07-31 06:14 - 00000000 ____D () C:\RegBackup 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-07-30 20:24 - 2014-07-30 20:24 - 00001956 _____ () C:\Users\Melissa\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-30 20:23 - 2014-07-30 20:23 - 09522240 _____ () C:\Users\Melissa\Desktop\tweaking.com_windows_repair_aio_setup.exe 2014-07-30 20:23 - 2014-07-30 20:23 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-29 13:39 - 2014-07-29 13:40 - 02347384 _____ (ESET) C:\Users\Melissa\Desktop\esetsmartinstaller_enu.exe 2014-07-29 09:27 - 2014-07-29 09:27 - 00016582 _____ () C:\ComboFix.txt 2014-07-28 23:54 - 2014-07-29 09:27 - 00000000 ____D () C:\Qoobox 2014-07-28 23:54 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-07-28 23:54 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-07-28 23:54 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe 2014-07-28 23:53 - 2014-07-29 09:23 - 00000000 ____D () C:\Windows\erdnt 2014-07-28 23:50 - 2014-07-28 23:50 - 05563277 ____R (Swearware) C:\Users\Melissa\Desktop\ComboFix.exe 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\ProgramData\Viewpoint 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\Program Files (x86)\Viewpoint 2014-07-28 23:19 - 2014-08-02 11:46 - 00001688 _____ () C:\Windows\PFRO.log 2014-07-28 23:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-07-28 23:13 - 2014-07-28 23:43 - 00000000 ____D () C:\AdwCleaner 2014-07-28 23:12 - 2014-07-28 23:12 - 01365551 _____ () C:\Users\Melissa\Desktop\AdwCleaner.exe 2014-07-28 22:38 - 2014-07-28 22:38 - 00001301 _____ () C:\Users\Melissa\Desktop\Documents\quarantine list.txt 2014-07-28 11:17 - 2014-07-28 11:17 - 00072624 _____ () C:\Users\Brooke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-28 10:17 - 2014-08-02 13:01 - 00000000 ____D () C:\FRST 2014-07-28 10:01 - 2014-07-28 10:02 - 00206246 _____ () C:\Users\Melissa\Desktop\Documents\cc_20140728_100144.reg 2014-07-28 01:31 - 2014-07-28 01:31 - 00001149 _____ () C:\Users\Brooke\Desktop\Trend Micro Titanium Internet Security.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000951 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000941 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000936 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Real 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Leader Technologies 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Epson 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Apple Computer 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Google 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Fisher-Price 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\AOL 2014-07-28 01:30 - 2014-07-28 09:46 - 00000000 ____D () C:\Users\Brooke\AppData\Local\VirtualStore 2014-07-28 01:30 - 2014-07-28 01:31 - 00000917 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-07-28 01:30 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke 2014-07-28 01:30 - 2014-07-28 01:30 - 00000020 ___SH () C:\Users\Brooke\ntuser.ini 2014-07-28 01:30 - 2010-06-06 19:48 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Microsoft Help 2014-07-28 01:30 - 2010-06-06 18:37 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Macromedia 2014-07-28 01:30 - 2010-06-05 18:36 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Power2Go 2014-07-28 01:30 - 2008-01-20 23:20 - 00000000 ___RD () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-07-28 01:30 - 2008-01-20 23:20 - 00000000 ___RD () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-07-28 01:02 - 2014-07-28 01:02 - 110331640 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\msert.exe 2014-07-28 00:36 - 2014-07-28 00:36 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{74ED30BA-00C4-413B-83E1-1A8B2B958A60} 2014-07-28 00:27 - 2014-07-28 00:27 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{4B03C2EF-9478-4C62-94BE-0012C9EDDE0D} 2014-07-27 23:29 - 2014-07-27 23:29 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{06C6F07A-6C0C-4519-9CBD-02CDE2F27824} 2014-07-27 23:24 - 2014-07-27 23:24 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{F8A53BEA-5E66-48D8-9A0F-ACBA323096A7} 2014-07-27 23:11 - 2014-07-27 23:11 - 00347816 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\MicrosoftFixit.WinFileFolder.RNP.236329947861191425.1.1.Run.exe 2014-07-27 22:49 - 2014-07-27 22:49 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{D27ED732-5CF7-414B-AC59-C3FE34F5F748} 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\Resume_files 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\PTO.Supplies.Flyer 2014-07-26 09:39 - 2014-08-01 12:25 - 00000000 ____D () C:\Users\Melissa\Desktop\to be ordered 2014-07-24 20:16 - 2014-08-01 12:52 - 00000000 ____D () C:\Users\Melissa\Desktop\Alaina pics 2014-07-22 11:59 - 2014-07-25 16:19 - 00000000 ____D () C:\Users\Melissa\Desktop\Tim Missy Pics 2014-07-21 13:55 - 2014-07-21 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 13:55 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-21 13:55 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-21 13:55 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-21 13:55 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-21 13:54 - 2014-07-21 13:55 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-09 20:37 - 2014-06-07 00:02 - 17854464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-07-09 20:37 - 2014-06-06 23:13 - 10890752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-07-09 20:37 - 2014-06-06 22:59 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-07-09 20:37 - 2014-06-06 22:52 - 01348608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-07-09 20:37 - 2014-06-06 22:51 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-07-09 20:37 - 2014-06-06 22:51 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-07-09 20:37 - 2014-06-06 22:50 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-07-09 20:37 - 2014-06-06 22:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-07-09 20:37 - 2014-06-06 22:42 - 02148352 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-07-09 20:37 - 2014-06-06 22:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-07-09 20:37 - 2014-06-06 22:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-07-09 20:37 - 2014-06-06 22:35 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-07-09 20:37 - 2014-06-06 20:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-07-09 20:37 - 2014-06-06 19:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-07-09 20:37 - 2014-06-06 19:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-07-09 20:37 - 2014-06-06 19:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-07-09 20:37 - 2014-06-06 19:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-07-09 20:37 - 2014-06-06 19:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-07-09 20:37 - 2014-06-06 19:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-07-09 20:37 - 2014-06-06 18:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-07-09 20:37 - 2014-06-06 18:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-07-09 20:37 - 2014-06-06 18:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-07-09 20:37 - 2014-06-06 18:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-07-09 20:37 - 2014-06-06 18:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-07-09 20:37 - 2014-06-06 18:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-07-09 20:37 - 2014-06-06 18:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-07-09 20:36 - 2014-06-06 20:33 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-07-09 20:36 - 2014-06-06 04:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-07-09 20:36 - 2014-06-06 03:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-07-09 20:36 - 2014-05-30 03:10 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-02 13:02 - 2014-08-02 13:01 - 00022005 _____ () C:\Users\Melissa\Desktop\FRST.txt 2014-08-02 13:01 - 2014-07-28 10:17 - 00000000 ____D () C:\FRST 2014-08-02 12:59 - 2010-06-05 21:23 - 01696254 _____ () C:\Windows\WindowsUpdate.log 2014-08-02 12:57 - 2012-04-20 08:53 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-02 12:56 - 2014-08-01 11:44 - 00003370 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-02 12:56 - 2014-08-01 11:44 - 00003240 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-02 12:56 - 2010-07-01 15:37 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-02 12:56 - 2006-11-02 11:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-02 12:56 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-02 12:56 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-02 12:56 - 2006-11-02 11:07 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-08-02 12:55 - 2006-11-02 11:42 - 00032648 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-08-02 12:54 - 2014-08-02 12:54 - 02094080 _____ (Farbar) C:\Users\Melissa\Desktop\FRST64.exe 2014-08-02 12:54 - 2013-04-15 23:17 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Catalina – Print Savings 2014-08-02 12:40 - 2014-08-01 12:39 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-02 12:11 - 2010-07-01 15:37 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-02 11:46 - 2014-07-28 23:19 - 00001688 _____ () C:\Windows\PFRO.log 2014-08-02 11:12 - 2014-08-02 11:12 - 00448512 _____ (OldTimer Tools) C:\Users\Melissa\Desktop\TFC.exe 2014-08-01 17:40 - 2014-08-01 17:40 - 00000384 _____ () C:\Windows\DCEBOOT.RST 2014-08-01 17:40 - 2014-08-01 17:40 - 00000000 _____ () C:\Windows\DCEBOOT.LOG 2014-08-01 17:38 - 2014-08-01 17:38 - 00231960 _____ () C:\Windows\RegBootClean64.exe 2014-08-01 17:38 - 2014-08-01 17:38 - 00021528 _____ () C:\Windows\DCEBoot64.exe 2014-08-01 17:38 - 2010-06-06 11:20 - 00000000 ____D () C:\ProgramData\Trend Micro 2014-08-01 12:53 - 2014-03-15 21:20 - 00000000 ____D () C:\Users\Melissa\Desktop\photos to order 2014-08-01 12:52 - 2014-07-24 20:16 - 00000000 ____D () C:\Users\Melissa\Desktop\Alaina pics 2014-08-01 12:25 - 2014-07-26 09:39 - 00000000 ____D () C:\Users\Melissa\Desktop\to be ordered 2014-08-01 11:01 - 2010-06-05 18:43 - 00131072 _____ () C:\Users\Melissa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-08-01 11:00 - 2014-05-30 16:24 - 00000000 ____D () C:\Users\Melissa\Desktop\craigslist 2014-08-01 10:51 - 2014-06-19 21:28 - 00000000 ____D () C:\Users\Melissa\Desktop\avary pics 2014-08-01 10:47 - 2014-03-18 18:48 - 00000000 ____D () C:\Users\Melissa\Desktop\pics to order 2014-07-31 06:25 - 2006-11-02 08:46 - 00775178 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-07-31 06:25 - 2006-11-02 08:34 - 00000286 _____ () C:\Windows\win.ini 2014-07-31 06:18 - 2014-02-25 22:17 - 00775178 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-07-31 06:14 - 2014-07-31 06:14 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MELISSA-PC-Microsoft®-Windows-Vista™-Home-Premium-(64-bit).dat 2014-07-31 06:14 - 2014-07-31 06:14 - 00000000 ____D () C:\RegBackup 2014-07-30 22:07 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-04-28 20:17 - 00000910 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00001956 _____ () C:\Users\Melissa\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-30 20:23 - 2014-07-30 20:23 - 09522240 _____ () C:\Users\Melissa\Desktop\tweaking.com_windows_repair_aio_setup.exe 2014-07-30 20:23 - 2014-07-30 20:23 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-29 13:40 - 2014-07-29 13:39 - 02347384 _____ (ESET) C:\Users\Melissa\Desktop\esetsmartinstaller_enu.exe 2014-07-29 09:27 - 2014-07-29 09:27 - 00016582 _____ () C:\ComboFix.txt 2014-07-29 09:27 - 2014-07-28 23:54 - 00000000 ____D () C:\Qoobox 2014-07-29 09:27 - 2006-11-02 09:33 - 00000000 __RHD () C:\Users\Default 2014-07-29 09:23 - 2014-07-28 23:53 - 00000000 ____D () C:\Windows\erdnt 2014-07-29 09:21 - 2006-11-02 08:34 - 00000215 ____N () C:\Windows\system.ini 2014-07-29 02:31 - 2006-11-02 08:33 - 76808192 _____ () C:\Windows\system32\config\SOFTWARE.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 63438848 _____ () C:\Windows\system32\config\COMPONENTS.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 21495808 _____ () C:\Windows\system32\config\SYSTEM.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00524288 _____ () C:\Windows\system32\config\DEFAULT.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00262144 _____ () C:\Windows\system32\config\SAM.bak 2014-07-28 23:50 - 2014-07-28 23:50 - 05563277 ____R (Swearware) C:\Users\Melissa\Desktop\ComboFix.exe 2014-07-28 23:43 - 2014-07-28 23:13 - 00000000 ____D () C:\AdwCleaner 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\ProgramData\Viewpoint 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\Program Files (x86)\Viewpoint 2014-07-28 23:12 - 2014-07-28 23:12 - 01365551 _____ () C:\Users\Melissa\Desktop\AdwCleaner.exe 2014-07-28 22:38 - 2014-07-28 22:38 - 00001301 _____ () C:\Users\Melissa\Desktop\Documents\quarantine list.txt 2014-07-28 22:34 - 2010-06-05 18:34 - 00000000 ____D () C:\ProgramData\Temp 2014-07-28 11:41 - 2013-06-17 09:41 - 00000000 ____D () C:\Users\Melissa\Desktop\Ebay 2014-07-28 11:17 - 2014-07-28 11:17 - 00072624 _____ () C:\Users\Brooke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-28 10:02 - 2014-07-28 10:01 - 00206246 _____ () C:\Users\Melissa\Desktop\Documents\cc_20140728_100144.reg 2014-07-28 09:59 - 2013-07-11 16:50 - 00000000 ____D () C:\Windows\Minidump 2014-07-28 09:59 - 2010-08-02 21:07 - 00000000 ____D () C:\Users\Melissa\Tracing 2014-07-28 09:54 - 2012-06-11 09:27 - 00000000 ____D () C:\Windows\pss 2014-07-28 09:46 - 2014-07-28 01:30 - 00000000 ____D () C:\Users\Brooke\AppData\Local\VirtualStore 2014-07-28 01:31 - 2014-07-28 01:31 - 00001149 _____ () C:\Users\Brooke\Desktop\Trend Micro Titanium Internet Security.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000951 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000941 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000936 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Real 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Leader Technologies 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Epson 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Apple Computer 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Google 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Fisher-Price 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\AOL 2014-07-28 01:31 - 2014-07-28 01:30 - 00000917 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-07-28 01:31 - 2014-07-28 01:30 - 00000000 ____D () C:\Users\Brooke 2014-07-28 01:30 - 2014-07-28 01:30 - 00000020 ___SH () C:\Users\Brooke\ntuser.ini 2014-07-28 01:02 - 2014-07-28 01:02 - 110331640 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\msert.exe 2014-07-28 00:36 - 2014-07-28 00:36 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{74ED30BA-00C4-413B-83E1-1A8B2B958A60} 2014-07-28 00:27 - 2014-07-28 00:27 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{4B03C2EF-9478-4C62-94BE-0012C9EDDE0D} 2014-07-27 23:29 - 2014-07-27 23:29 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{06C6F07A-6C0C-4519-9CBD-02CDE2F27824} 2014-07-27 23:24 - 2014-07-27 23:24 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{F8A53BEA-5E66-48D8-9A0F-ACBA323096A7} 2014-07-27 23:11 - 2014-07-27 23:11 - 00347816 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\MicrosoftFixit.WinFileFolder.RNP.236329947861191425.1.1.Run.exe 2014-07-27 22:49 - 2014-07-27 22:49 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{D27ED732-5CF7-414B-AC59-C3FE34F5F748} 2014-07-27 00:32 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\system 2014-07-26 12:57 - 2014-04-28 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-07-26 12:57 - 2014-04-28 20:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\Resume_files 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\PTO.Supplies.Flyer 2014-07-26 11:36 - 2014-06-20 21:43 - 00000000 ____D () C:\Users\Melissa\Desktop\New Folder (2) 2014-07-25 17:37 - 2012-12-24 18:27 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents 2 2014-07-25 17:35 - 2011-04-04 23:23 - 00000000 ____D () C:\Users\Melissa\Desktop\For DVD 2014-07-25 16:24 - 2013-04-16 21:08 - 00000000 ____D () C:\Users\Melissa\Desktop\Family Photos Scanned 2014-07-25 16:20 - 2014-06-11 20:37 - 00000000 ____D () C:\Users\Melissa\Desktop\New Folder 2014-07-25 16:19 - 2014-07-22 11:59 - 00000000 ____D () C:\Users\Melissa\Desktop\Tim Missy Pics 2014-07-25 16:12 - 2013-01-22 14:14 - 00000000 ____D () C:\Users\Melissa\Desktop\Avary Video 2014-07-24 19:51 - 2010-08-02 21:15 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-07-23 20:15 - 2010-09-15 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-07-23 10:52 - 2010-06-05 18:37 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-07-21 13:55 - 2014-07-21 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 13:55 - 2014-07-21 13:54 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-21 13:55 - 2009-04-02 04:30 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-11 03:02 - 2014-07-21 13:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-21 13:55 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-21 13:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-21 13:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-10 17:10 - 2006-11-02 11:21 - 00310808 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-07-10 17:08 - 2006-11-02 11:07 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-09 21:07 - 2013-07-18 00:31 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-09 21:04 - 2006-11-02 08:35 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-07-08 20:57 - 2012-04-20 08:53 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-08 20:57 - 2012-04-20 08:53 - 00003682 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-08 20:57 - 2011-05-19 09:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-06 20:32 - 2014-06-29 20:44 - 00000000 ____D () C:\Users\Melissa\AppData\Local\Adobe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-02 13:02 ==================== End Of Log ============================
  3. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-08-2014 Ran by Melissa at 2014-08-02 12:54:51 Run:1 Running from C:\Users\Melissa\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - No File URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File URLSearchHook: HKCU - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - No File URLSearchHook: HKCU - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File SearchScopes: HKLM-x32 - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask...r={searchTerms} SearchScopes: HKCU - DefaultScope {B5EB76EB-459D-4DC0-B6EC-8A9D204407F1} URL = http://search.condui...&ctid=CT3196716 SearchScopes: HKCU - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask...r={searchTerms} SearchScopes: HKCU - {B5EB76EB-459D-4DC0-B6EC-8A9D204407F1} URL = https://search.yahoo...p={searchTerms} Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File Toolbar: HKCU - AOL Toolbar - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} - No File FF Plugin HKCU: CouponNetwork.com/CMDUniversalCouponPrintActivator - C:\Users\Melissa\AppData\Roaming\CATALI~2\NPBCSK~1.DLL (Catalina Marketing Corporation) cmd: type C:\Users\Melissa\AppData\Local\Temp\temp761.bat C:\ProgramData\unins000.dat C:\ProgramData\unins000.exe Reboot: ***************** HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks\\{f0e98552-8e47-4c6c-9b3a-11ab0549f94d} => value deleted successfully. "HKCR\CLSID\{f0e98552-8e47-4c6c-9b3a-11ab0549f94d}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{f0e98552-8e47-4c6c-9b3a-11ab0549f94d}" => Key deleted successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\URLSearchHooks\\{f0e98552-8e47-4c6c-9b3a-11ab0549f94d} => Value not found. HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{f0e98552-8e47-4c6c-9b3a-11ab0549f94d} => value deleted successfully. HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\\{f0e98552-8e47-4c6c-9b3a-11ab0549f94d} => Value not found. "HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}" => Key deleted successfully. "HKCR\Wow6432Node\CLSID\{b0441a0e-a49a-4e16-afc1-74ecced1921f}" => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{1EB6F07C-4A8F-4EAD-9125-9BFAECDC2888}" => Key deleted successfully. "HKCR\CLSID\{1EB6F07C-4A8F-4EAD-9125-9BFAECDC2888}" => Key not found. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{b0441a0e-a49a-4e16-afc1-74ecced1921f}" => Key deleted successfully. "HKCR\CLSID\{b0441a0e-a49a-4e16-afc1-74ecced1921f}" => Key not found. "HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B5EB76EB-459D-4DC0-B6EC-8A9D204407F1}" => Key deleted successfully. "HKCR\CLSID\{B5EB76EB-459D-4DC0-B6EC-8A9D204407F1}" => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{ba00b7b1-0351-477a-b948-23e3ee5a73d4} => value deleted successfully. "HKCR\Wow6432Node\CLSID\{ba00b7b1-0351-477a-b948-23e3ee5a73d4}" => Key deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BA00B7B1-0351-477A-B948-23E3EE5A73D4} => value deleted successfully. "HKCR\CLSID\{BA00B7B1-0351-477A-B948-23E3EE5A73D4}" => Key not found. "HKCU\Software\MozillaPlugins\CouponNetwork.com/CMDUniversalCouponPrintActivator" => Key deleted successfully. C:\Users\Melissa\AppData\Roaming\CATALI~2\NPBCSK~1.DLL => Moved successfully. ========= type C:\Users\Melissa\AppData\Local\Temp\temp761.bat ========= The system cannot find the file specified. ========= End of CMD: ========= C:\ProgramData\unins000.dat => Moved successfully. C:\ProgramData\unins000.exe => Moved successfully. The system needed a reboot. ==== End of Fixlog ====
  4. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 02 Ran by Melissa (administrator) on MELISSA-PC on 02-08-2014 11:51:25 Running from C:\Users\Melissa\Desktop Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States) Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (Agere Systems) C:\Program Files\LSI SoftModem\agr64svc.exe (Coupons.com Inc.) C:\Program Files (x86)\Coupons\CouponPrinterService.exe (Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe (Microsoft Corporation) C:\Windows\ehome\ehsched.exe () C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe () C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe (Seagate Technology LLC) C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Seagate Technology LLC) C:\Program Files (x86)\Seagate\SeagateManager\Sync\MaxSync.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe () C:\Windows\mHotkey.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\Titanium\plugin\TMDC\TMDC.exe (Chicony) C:\Windows\ChiFuncExt.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\waol.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe (PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (Seagate LLC) C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\1275861383\ee\aolsoftware.exe (Creative) C:\Windows\CNYHKey.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Chicony) C:\Windows\ModLEDKey.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [229824 2013-10-09] (Trend Micro Inc.) HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.) HKLM\...\Run: [iAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-09-12] (Intel Corporation) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM-x32\...\Run: [Monitor] => C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe [295304 2012-07-05] (LeapFrog Enterprises, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [LTCM Client] => C:\Program Files (x86)\LTCM Client\ltcmClient.exe [1596096 2009-08-05] (Leader Technologies Inc.) HKLM-x32\...\Run: [sSDMonitor] => C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [112600 2010-11-15] (PC Tools) HKLM-x32\...\Run: [MaxMenuMgr] => C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe [185640 2009-05-01] (Seagate LLC) HKLM-x32\...\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1275861383\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.) HKLM-x32\...\Run: [LedKey] => C:\Windows\CNYHKey.exe [339968 2008-04-23] (Creative) HKLM-x32\...\Run: [LchDrvKey] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] () Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-770997747-1975351657-1911745460-1000\...\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL Desktop 9.7b\AOL.EXE [72296 2014-06-05] (AOL Inc.) HKU\S-1-5-21-770997747-1975351657-1911745460-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1 ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1C520D3D7F3DCB01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0610&m=sx2800 URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - No File URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File URLSearchHook: HKCU - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - No File URLSearchHook: HKCU - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW SearchScopes: HKLM-x32 - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm423^S09999^us&si=245051_US-B-GDD1&ptb=D9CD2D74-D48E-42BB-9892-22D245D108B8&ind=2014062008&n=780c25b8&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - DefaultScope {B5EB76EB-459D-4DC0-B6EC-8A9D204407F1} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} SearchScopes: HKCU - {1EB6F07C-4A8F-4EAD-9125-9BFAECDC2888} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3196716 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW SearchScopes: HKCU - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm423^S09999^us&si=245051_US-B-GDD1&ptb=D9CD2D74-D48E-42BB-9892-22D245D108B8&ind=2014062008&n=780c25b8&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - {B5EB76EB-459D-4DC0-B6EC-8A9D204407F1} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe64.dll (Trend Micro Inc.) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg32.dll (Trend Micro Inc.) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: AOL Toolbar Loader -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File BHO-x32: EWPBrowseObject Class -> {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} -> C:\Program Files (x86)\Canon\Easy-WebPrint\EWPBrowseLoader.dll () BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe32.dll (Trend Micro Inc.) BHO-x32: Price Check by AOL -> {D25B97E9-62B2-40CE-BECF-E43A7B879072} -> C:\Program Files (x86)\Price Check by AOL\aolpricecheck.dll (AOL Inc.) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File Toolbar: HKCU - AOL Toolbar - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} - No File DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe64.dll (Trend Micro Inc.) Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.) Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - No File Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe32.dll (Trend Micro Inc.) Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg32.dll (Trend Micro Inc.) Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @viewpoint.com/VMP - C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll () FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Melissa\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll (Amazon.com, Inc.) FF Plugin HKCU: CouponNetwork.com/CMDUniversalCouponPrintActivator - C:\Users\Melissa\AppData\Roaming\CATALI~2\NPBCSK~1.DLL (Catalina Marketing Corporation) FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension [2014-04-24] FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-06-06] FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-10-09] FF HKLM-x32\...\Firefox\Extensions: [{38783831-6098-4faa-A9C9-1EE1E343F4D2}] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1104\7.1.1104\firefoxextension FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF HKLM-x32\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-04-24] Chrome: ======= CHR HomePage: CHR StartupUrls: "hxxp://www.google.com/" CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-02] CHR Extension: (RealDownloader) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-07-07] CHR Extension: (Google Wallet) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-08-02] CHR HKLM-x32\...\Chrome\Extension: [bmiabdepfhhiieiipmeecdmeljggmfee] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1135\8.0.1135\chrome_tmbep.crx [2014-08-02] CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agr64svc.exe [16896 2008-08-26] (Agere Systems) R2 CouponPrinterService; C:\Program Files (x86)\Coupons\CouponPrinterService.exe [176624 2014-02-13] (Coupons.com Inc.) R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed] R2 FlipShare Service; C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe [460144 2011-05-06] () R2 FlipShareServer; C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [1085440 2011-05-06] () [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [632792 2010-04-08] (PC Tools) R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] () R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X] S3 TweakingRunAsSystemService; "C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\tweaking_ras.exe" cmd.exe []/c start /HIGH cmd.exe /c C:\Users\Melissa\AppData\Local\Temp\temp761.bat & exit ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation) S1 Beep; No ImagePath R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) S3 NeroCd2k; C:\Windows\SysWOW64\drivers\NeroCd2k.sys [44227 2001-04-16] (ahead software gmbh im stoeckmaedle 6 76307 karlsbad, germany Fax: ++49-7248-911-888 e-mail: info@nero.com) [File not signed] S3 rt70x64; C:\Windows\System32\DRIVERS\WUSB54Gv4x64.sys [308224 2007-03-11] (Ralink Technology Inc.) R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [117312 2013-12-03] (Trend Micro Inc.) R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [283160 2013-12-03] (Trend Micro Inc.) R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [50976 2013-07-01] (Trend Micro Inc.) R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [100640 2013-06-13] (Trend Micro Inc.) R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [85936 2013-12-03] (Trend Micro Inc.) R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [303392 2013-05-15] (Trend Micro Inc.) R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105744 2011-08-22] (Trend Micro Inc.) R3 XG762_VS; C:\Windows\System32\DRIVERS\WlanGZG.sys [1041920 2008-10-28] (Atheros Communications, Inc.) S3 ZDCNDIS6a64; C:\Windows\system32\ZDCNDIS6a64.sys [41280 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) S3 ZDCNDIS6a64; C:\Windows\SysWOW64\ZDCNDIS6a64.sys [41280 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) S3 BCMH43XX; system32\DRIVERS\bcmwlhigh664.sys [X] S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] U2 TMAgent; ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-02 11:51 - 2014-08-02 11:51 - 00023679 _____ () C:\Users\Melissa\Desktop\FRST.txt 2014-08-02 11:12 - 2014-08-02 11:12 - 00448512 _____ (OldTimer Tools) C:\Users\Melissa\Desktop\TFC.exe 2014-08-01 18:19 - 2014-08-01 18:19 - 02094080 _____ (Farbar) C:\Users\Melissa\Desktop\FRST64.exe 2014-08-01 17:40 - 2014-08-01 17:40 - 00000384 _____ () C:\Windows\DCEBOOT.RST 2014-08-01 17:40 - 2014-08-01 17:40 - 00000000 _____ () C:\Windows\DCEBOOT.LOG 2014-08-01 17:38 - 2014-08-01 17:38 - 00231960 _____ () C:\Windows\RegBootClean64.exe 2014-08-01 17:38 - 2014-08-01 17:38 - 00021528 _____ () C:\Windows\DCEBoot64.exe 2014-08-01 12:39 - 2014-08-02 11:40 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-01 11:44 - 2014-08-02 11:50 - 00003370 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-01 11:44 - 2014-08-02 11:50 - 00003240 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-07-31 06:14 - 2014-07-31 06:14 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MELISSA-PC-Microsoft®-Windows-Vista™-Home-Premium-(64-bit).dat 2014-07-31 06:14 - 2014-07-31 06:14 - 00000000 ____D () C:\RegBackup 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-07-30 20:24 - 2014-07-30 20:24 - 00001956 _____ () C:\Users\Melissa\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-30 20:23 - 2014-07-30 20:23 - 09522240 _____ () C:\Users\Melissa\Desktop\tweaking.com_windows_repair_aio_setup.exe 2014-07-30 20:23 - 2014-07-30 20:23 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-29 13:39 - 2014-07-29 13:40 - 02347384 _____ (ESET) C:\Users\Melissa\Desktop\esetsmartinstaller_enu.exe 2014-07-29 09:27 - 2014-07-29 09:27 - 00016582 _____ () C:\ComboFix.txt 2014-07-28 23:54 - 2014-07-29 09:27 - 00000000 ____D () C:\Qoobox 2014-07-28 23:54 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-07-28 23:54 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-07-28 23:54 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe 2014-07-28 23:53 - 2014-07-29 09:23 - 00000000 ____D () C:\Windows\erdnt 2014-07-28 23:50 - 2014-07-28 23:50 - 05563277 ____R (Swearware) C:\Users\Melissa\Desktop\ComboFix.exe 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\ProgramData\Viewpoint 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\Program Files (x86)\Viewpoint 2014-07-28 23:19 - 2014-08-02 11:46 - 00001688 _____ () C:\Windows\PFRO.log 2014-07-28 23:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-07-28 23:13 - 2014-07-28 23:43 - 00000000 ____D () C:\AdwCleaner 2014-07-28 23:12 - 2014-07-28 23:12 - 01365551 _____ () C:\Users\Melissa\Desktop\AdwCleaner.exe 2014-07-28 22:38 - 2014-07-28 22:38 - 00001301 _____ () C:\Users\Melissa\Desktop\Documents\quarantine list.txt 2014-07-28 11:17 - 2014-07-28 11:17 - 00072624 _____ () C:\Users\Brooke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-28 10:17 - 2014-08-02 11:51 - 00000000 ____D () C:\FRST 2014-07-28 10:01 - 2014-07-28 10:02 - 00206246 _____ () C:\Users\Melissa\Desktop\Documents\cc_20140728_100144.reg 2014-07-28 01:31 - 2014-07-28 01:31 - 00001149 _____ () C:\Users\Brooke\Desktop\Trend Micro Titanium Internet Security.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000951 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000941 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000936 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Real 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Leader Technologies 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Epson 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Apple Computer 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Google 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Fisher-Price 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\AOL 2014-07-28 01:30 - 2014-07-28 09:46 - 00000000 ____D () C:\Users\Brooke\AppData\Local\VirtualStore 2014-07-28 01:30 - 2014-07-28 01:31 - 00000917 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-07-28 01:30 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke 2014-07-28 01:30 - 2014-07-28 01:30 - 00000020 ___SH () C:\Users\Brooke\ntuser.ini 2014-07-28 01:30 - 2010-06-06 19:48 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Microsoft Help 2014-07-28 01:30 - 2010-06-06 18:37 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Macromedia 2014-07-28 01:30 - 2010-06-05 18:36 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Power2Go 2014-07-28 01:30 - 2008-01-20 23:20 - 00000000 ___RD () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-07-28 01:30 - 2008-01-20 23:20 - 00000000 ___RD () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-07-28 01:02 - 2014-07-28 01:02 - 110331640 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\msert.exe 2014-07-28 00:36 - 2014-07-28 00:36 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{74ED30BA-00C4-413B-83E1-1A8B2B958A60} 2014-07-28 00:27 - 2014-07-28 00:27 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{4B03C2EF-9478-4C62-94BE-0012C9EDDE0D} 2014-07-27 23:29 - 2014-07-27 23:29 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{06C6F07A-6C0C-4519-9CBD-02CDE2F27824} 2014-07-27 23:24 - 2014-07-27 23:24 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{F8A53BEA-5E66-48D8-9A0F-ACBA323096A7} 2014-07-27 23:11 - 2014-07-27 23:11 - 00347816 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\MicrosoftFixit.WinFileFolder.RNP.236329947861191425.1.1.Run.exe 2014-07-27 22:49 - 2014-07-27 22:49 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{D27ED732-5CF7-414B-AC59-C3FE34F5F748} 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\Resume_files 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\PTO.Supplies.Flyer 2014-07-26 09:39 - 2014-08-01 12:25 - 00000000 ____D () C:\Users\Melissa\Desktop\to be ordered 2014-07-24 20:16 - 2014-08-01 12:52 - 00000000 ____D () C:\Users\Melissa\Desktop\Alaina pics 2014-07-22 11:59 - 2014-07-25 16:19 - 00000000 ____D () C:\Users\Melissa\Desktop\Tim Missy Pics 2014-07-21 13:55 - 2014-07-21 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 13:55 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-21 13:55 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-21 13:55 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-21 13:55 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-21 13:54 - 2014-07-21 13:55 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-09 20:37 - 2014-06-07 00:02 - 17854464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-07-09 20:37 - 2014-06-06 23:13 - 10890752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-07-09 20:37 - 2014-06-06 22:59 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-07-09 20:37 - 2014-06-06 22:52 - 01348608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-07-09 20:37 - 2014-06-06 22:51 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-07-09 20:37 - 2014-06-06 22:51 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-07-09 20:37 - 2014-06-06 22:50 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-07-09 20:37 - 2014-06-06 22:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-07-09 20:37 - 2014-06-06 22:42 - 02148352 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-07-09 20:37 - 2014-06-06 22:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-07-09 20:37 - 2014-06-06 22:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-07-09 20:37 - 2014-06-06 22:35 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-07-09 20:37 - 2014-06-06 20:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-07-09 20:37 - 2014-06-06 19:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-07-09 20:37 - 2014-06-06 19:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-07-09 20:37 - 2014-06-06 19:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-07-09 20:37 - 2014-06-06 19:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-07-09 20:37 - 2014-06-06 19:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-07-09 20:37 - 2014-06-06 19:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-07-09 20:37 - 2014-06-06 18:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-07-09 20:37 - 2014-06-06 18:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-07-09 20:37 - 2014-06-06 18:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-07-09 20:37 - 2014-06-06 18:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-07-09 20:37 - 2014-06-06 18:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-07-09 20:37 - 2014-06-06 18:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-07-09 20:37 - 2014-06-06 18:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-07-09 20:36 - 2014-06-06 20:33 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-07-09 20:36 - 2014-06-06 04:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-07-09 20:36 - 2014-06-06 03:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-07-09 20:36 - 2014-05-30 03:10 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-02 11:53 - 2014-08-02 11:51 - 00023679 _____ () C:\Users\Melissa\Desktop\FRST.txt 2014-08-02 11:51 - 2014-07-28 10:17 - 00000000 ____D () C:\FRST 2014-08-02 11:50 - 2014-08-01 11:44 - 00003370 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-02 11:50 - 2014-08-01 11:44 - 00003240 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-02 11:49 - 2010-07-01 15:37 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-02 11:46 - 2014-07-28 23:19 - 00001688 _____ () C:\Windows\PFRO.log 2014-08-02 11:46 - 2006-11-02 11:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-02 11:46 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-02 11:46 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-02 11:46 - 2006-11-02 11:07 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-08-02 11:45 - 2010-06-05 21:23 - 01692680 _____ () C:\Windows\WindowsUpdate.log 2014-08-02 11:45 - 2006-11-02 11:42 - 00032648 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-08-02 11:40 - 2014-08-01 12:39 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-02 11:12 - 2014-08-02 11:12 - 00448512 _____ (OldTimer Tools) C:\Users\Melissa\Desktop\TFC.exe 2014-08-02 11:11 - 2010-07-01 15:37 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-02 10:57 - 2012-04-20 08:53 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-01 18:19 - 2014-08-01 18:19 - 02094080 _____ (Farbar) C:\Users\Melissa\Desktop\FRST64.exe 2014-08-01 17:40 - 2014-08-01 17:40 - 00000384 _____ () C:\Windows\DCEBOOT.RST 2014-08-01 17:40 - 2014-08-01 17:40 - 00000000 _____ () C:\Windows\DCEBOOT.LOG 2014-08-01 17:38 - 2014-08-01 17:38 - 00231960 _____ () C:\Windows\RegBootClean64.exe 2014-08-01 17:38 - 2014-08-01 17:38 - 00021528 _____ () C:\Windows\DCEBoot64.exe 2014-08-01 17:38 - 2010-06-06 11:20 - 00000000 ____D () C:\ProgramData\Trend Micro 2014-08-01 12:53 - 2014-03-15 21:20 - 00000000 ____D () C:\Users\Melissa\Desktop\photos to order 2014-08-01 12:52 - 2014-07-24 20:16 - 00000000 ____D () C:\Users\Melissa\Desktop\Alaina pics 2014-08-01 12:25 - 2014-07-26 09:39 - 00000000 ____D () C:\Users\Melissa\Desktop\to be ordered 2014-08-01 11:01 - 2010-06-05 18:43 - 00131072 _____ () C:\Users\Melissa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-08-01 11:00 - 2014-05-30 16:24 - 00000000 ____D () C:\Users\Melissa\Desktop\craigslist 2014-08-01 10:51 - 2014-06-19 21:28 - 00000000 ____D () C:\Users\Melissa\Desktop\avary pics 2014-08-01 10:47 - 2014-03-18 18:48 - 00000000 ____D () C:\Users\Melissa\Desktop\pics to order 2014-07-31 06:25 - 2006-11-02 08:46 - 00775178 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-07-31 06:25 - 2006-11-02 08:34 - 00000286 _____ () C:\Windows\win.ini 2014-07-31 06:18 - 2014-02-25 22:17 - 00775178 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-07-31 06:14 - 2014-07-31 06:14 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MELISSA-PC-Microsoft®-Windows-Vista™-Home-Premium-(64-bit).dat 2014-07-31 06:14 - 2014-07-31 06:14 - 00000000 ____D () C:\RegBackup 2014-07-30 22:07 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-04-28 20:17 - 00000910 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00001956 _____ () C:\Users\Melissa\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-30 20:23 - 2014-07-30 20:23 - 09522240 _____ () C:\Users\Melissa\Desktop\tweaking.com_windows_repair_aio_setup.exe 2014-07-30 20:23 - 2014-07-30 20:23 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-29 13:40 - 2014-07-29 13:39 - 02347384 _____ (ESET) C:\Users\Melissa\Desktop\esetsmartinstaller_enu.exe 2014-07-29 09:27 - 2014-07-29 09:27 - 00016582 _____ () C:\ComboFix.txt 2014-07-29 09:27 - 2014-07-28 23:54 - 00000000 ____D () C:\Qoobox 2014-07-29 09:27 - 2006-11-02 09:33 - 00000000 __RHD () C:\Users\Default 2014-07-29 09:23 - 2014-07-28 23:53 - 00000000 ____D () C:\Windows\erdnt 2014-07-29 09:21 - 2006-11-02 08:34 - 00000215 ____N () C:\Windows\system.ini 2014-07-29 02:31 - 2006-11-02 08:33 - 76808192 _____ () C:\Windows\system32\config\SOFTWARE.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 63438848 _____ () C:\Windows\system32\config\COMPONENTS.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 21495808 _____ () C:\Windows\system32\config\SYSTEM.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00524288 _____ () C:\Windows\system32\config\DEFAULT.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00262144 _____ () C:\Windows\system32\config\SAM.bak 2014-07-28 23:50 - 2014-07-28 23:50 - 05563277 ____R (Swearware) C:\Users\Melissa\Desktop\ComboFix.exe 2014-07-28 23:43 - 2014-07-28 23:13 - 00000000 ____D () C:\AdwCleaner 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\ProgramData\Viewpoint 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\Program Files (x86)\Viewpoint 2014-07-28 23:12 - 2014-07-28 23:12 - 01365551 _____ () C:\Users\Melissa\Desktop\AdwCleaner.exe 2014-07-28 22:38 - 2014-07-28 22:38 - 00001301 _____ () C:\Users\Melissa\Desktop\Documents\quarantine list.txt 2014-07-28 22:34 - 2010-06-05 18:34 - 00000000 ____D () C:\ProgramData\Temp 2014-07-28 11:41 - 2013-06-17 09:41 - 00000000 ____D () C:\Users\Melissa\Desktop\Ebay 2014-07-28 11:17 - 2014-07-28 11:17 - 00072624 _____ () C:\Users\Brooke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-28 10:02 - 2014-07-28 10:01 - 00206246 _____ () C:\Users\Melissa\Desktop\Documents\cc_20140728_100144.reg 2014-07-28 09:59 - 2013-07-11 16:50 - 00000000 ____D () C:\Windows\Minidump 2014-07-28 09:59 - 2010-08-02 21:07 - 00000000 ____D () C:\Users\Melissa\Tracing 2014-07-28 09:54 - 2012-06-11 09:27 - 00000000 ____D () C:\Windows\pss 2014-07-28 09:46 - 2014-07-28 01:30 - 00000000 ____D () C:\Users\Brooke\AppData\Local\VirtualStore 2014-07-28 01:31 - 2014-07-28 01:31 - 00001149 _____ () C:\Users\Brooke\Desktop\Trend Micro Titanium Internet Security.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000951 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000941 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000936 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Real 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Leader Technologies 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Epson 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Apple Computer 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Google 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Fisher-Price 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\AOL 2014-07-28 01:31 - 2014-07-28 01:30 - 00000917 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-07-28 01:31 - 2014-07-28 01:30 - 00000000 ____D () C:\Users\Brooke 2014-07-28 01:30 - 2014-07-28 01:30 - 00000020 ___SH () C:\Users\Brooke\ntuser.ini 2014-07-28 01:02 - 2014-07-28 01:02 - 110331640 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\msert.exe 2014-07-28 00:36 - 2014-07-28 00:36 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{74ED30BA-00C4-413B-83E1-1A8B2B958A60} 2014-07-28 00:27 - 2014-07-28 00:27 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{4B03C2EF-9478-4C62-94BE-0012C9EDDE0D} 2014-07-27 23:29 - 2014-07-27 23:29 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{06C6F07A-6C0C-4519-9CBD-02CDE2F27824} 2014-07-27 23:24 - 2014-07-27 23:24 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{F8A53BEA-5E66-48D8-9A0F-ACBA323096A7} 2014-07-27 23:11 - 2014-07-27 23:11 - 00347816 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\MicrosoftFixit.WinFileFolder.RNP.236329947861191425.1.1.Run.exe 2014-07-27 22:49 - 2014-07-27 22:49 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{D27ED732-5CF7-414B-AC59-C3FE34F5F748} 2014-07-27 00:32 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\system 2014-07-26 12:57 - 2014-04-28 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-07-26 12:57 - 2014-04-28 20:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\Resume_files 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\PTO.Supplies.Flyer 2014-07-26 11:36 - 2014-06-20 21:43 - 00000000 ____D () C:\Users\Melissa\Desktop\New Folder (2) 2014-07-25 17:37 - 2012-12-24 18:27 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents 2 2014-07-25 17:35 - 2011-04-04 23:23 - 00000000 ____D () C:\Users\Melissa\Desktop\For DVD 2014-07-25 16:24 - 2013-04-16 21:08 - 00000000 ____D () C:\Users\Melissa\Desktop\Family Photos Scanned 2014-07-25 16:20 - 2014-06-11 20:37 - 00000000 ____D () C:\Users\Melissa\Desktop\New Folder 2014-07-25 16:19 - 2014-07-22 11:59 - 00000000 ____D () C:\Users\Melissa\Desktop\Tim Missy Pics 2014-07-25 16:12 - 2013-01-22 14:14 - 00000000 ____D () C:\Users\Melissa\Desktop\Avary Video 2014-07-24 19:51 - 2010-08-02 21:15 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-07-23 20:15 - 2010-09-15 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-07-23 10:52 - 2010-06-05 18:37 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-07-21 13:55 - 2014-07-21 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 13:55 - 2014-07-21 13:54 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-21 13:55 - 2009-04-02 04:30 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-11 03:02 - 2014-07-21 13:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-21 13:55 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-21 13:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-21 13:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-10 17:10 - 2006-11-02 11:21 - 00310808 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-07-10 17:08 - 2006-11-02 11:07 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-09 21:07 - 2013-07-18 00:31 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-09 21:04 - 2006-11-02 08:35 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-07-08 20:57 - 2012-04-20 08:53 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-08 20:57 - 2012-04-20 08:53 - 00003682 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-08 20:57 - 2011-05-19 09:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-06 20:32 - 2014-06-29 20:44 - 00000000 ____D () C:\Users\Melissa\AppData\Local\Adobe Files to move or delete: ==================== C:\ProgramData\unins000.dat C:\ProgramData\unins000.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-02 09:33 ==================== End Of Log ============================
  5. Ok,, I went to on Startup,, edit pages, and deleted yahoo. It is not showing up anymore when I open Chrome. I think that is what you wanted . I will continue with your instructions.
  6. I open the Chrome and a Yahoo search tab comes up with this in it http://search.yahoo.com/?type=937811&fr=spigot-yhp-ch. There is also a Google tab next to it. I am not sure how to delete that search . It keeps coming back. I am not sure exactly what you want me to do. Thanks Melissa
  7. Ok Sorry,, I never use it . I found the icon in the toolbar at bottom of my screen. I went to settings, --did you want me to paste that in search settings box at the top of the page. I did that and it said no matches found.
  8. I don't have a Chrome browser,, Do you want me to download and install the Chrome browser and continue with your directions? Thanks
  9. Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2014 02 Ran by Melissa at 2014-08-01 18:20:35 Running from C:\Users\Melissa\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Trend Micro Titanium Internet Security (Disabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Trend Micro Titanium Internet Security (Disabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft) 3ivx MPEG-4 5.0.3 (remove only) (HKLM-x32\...\3ivx MPEG-4 5.0.3) (Version: 5.0.3 - 3ivx Technologies, Pty. Ltd.) Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated) Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.0.19530 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 2.7.0.19530 - Adobe Systems Incorporated) Hidden Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated) Adobe Photoshop Elements 8.0 (x32 Version: 8.0 - Adobe Systems Incorporated) Hidden Adobe Reader X (10.1.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated) Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.) Agere Systems PCI-SV92EX Soft Modem (HKLM\...\Agere Systems Soft Modem) (Version: - LSI Corporation) Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC) Amazon MP3 Uploader (HKLM-x32\...\com.amazon.music.uploader) (Version: 1.0.5 - Amazon Services LLC) Amazon MP3 Uploader (x32 Version: 1.0.5 - Amazon Services LLC) Hidden Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.0.5.567 - Amazon Services LLC) AOL Toolbar (HKLM-x32\...\AOL Toolbar) (Version: - ) AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\...\AOL Uninstaller) (Version: - AOL Inc.) Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ArcSoft PhotoStudio 6 (HKLM-x32\...\{ED8EF3C2-FA5B-4A1E-950D-5A0227161F97}) (Version: 6.0.1.148 - ArcSoft) Canon Auto Update Service (HKLM-x32\...\Auto Update Service) (Version: 1.1.0.13 - Canon Inc.) Canon CanoScan 9000F User Registration (HKLM-x32\...\Canon CanoScan 9000F User Registration) (Version: - ) Canon DIGITAL CAMERA Solution Disk Software Guide (HKLM-x32\...\Software Guide) (Version: 1.6.0.1 - Canon Inc.) CANON iMAGE GATEWAY MyCamera Download Plugin (HKLM-x32\...\MyCamera Download Plugin) (Version: 3.1.1.2 - Canon Inc.) CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM-x32\...\CANON iMAGE GATEWAY Task) (Version: 1.9.0.9 - Canon Inc.) Canon MOV Decoder (HKLM-x32\...\Canon MOV Decoder) (Version: 1.9.0.8 - Canon Inc.) Canon MOV Encoder (HKLM-x32\...\Canon MOV Encoder) (Version: 1.8.0.1 - Canon Inc.) Canon MovieEdit Task for ZoomBrowser EX (HKLM-x32\...\MovieEditTask) (Version: 3.9.0.6 - Canon Inc.) Canon MP Navigator EX 3.1 (HKLM-x32\...\MP Navigator EX 3.1) (Version: - ) Canon PowerShot ELPH 310 HS_IXUS 230 HS Camera User Guide (HKLM-x32\...\CameraUserGuide-PSELPH310HS_IXUS230HS) (Version: 1.0.0.1 - Canon Inc.) Canon Utilities CameraWindow DC 8 (HKLM-x32\...\CameraWindowDC8) (Version: 8.6.0.11 - Canon Inc.) Canon Utilities CameraWindow Launcher (HKLM-x32\...\CameraWindowLauncher) (Version: 7.6.0.1 - Canon Inc.) Canon Utilities Movie Uploader for YouTube (HKLM-x32\...\MovieUploaderForYouTube) (Version: 1.3.0.3 - Canon Inc.) Canon Utilities MyCamera (HKLM-x32\...\MyCamera) (Version: 7.5.0.1 - Canon Inc.) Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.) Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - ) Canon Utilities ZoomBrowser EX (HKLM-x32\...\ZoomBrowser EX) (Version: 6.8.0.10 - Canon Inc.) Canon ZoomBrowser EX Memory Card Utility (HKLM-x32\...\ZoomBrowser EX Memory Card Utility) (Version: 1.6.0.15 - Canon Inc.) CanoScan 9000F Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ9602) (Version: - ) Catalina Savings Printer (HKLM-x32\...\{4956ACE3-F537-4418-BB45-FD52395275A7}) (Version: 1.0.0 - Catalina Marketing Corp) <==== ATTENTION CCleaner (HKLM\...\CCleaner) (Version: 3.11 - Piriform) Click-N-Ship for Business® (HKLM-x32\...\{15C77FC3-8137-4A5E-8F81-F559045DD6B0}) (Version: 4.1.450.0 - United States Postal Service) Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Coupon Printer for Windows (HKLM-x32\...\Coupon Printer for Windows5.0.0.7) (Version: 5.0.0.7 - Coupons.com Incorporated) CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2325a - CyberLink Corp.) CyberLink Power2Go (x32 Version: 6.0.2325a - CyberLink Corp.) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Disketch CD Label Software (HKLM-x32\...\Disketch) (Version: - NCH Software) Easy-WebPrint (HKLM-x32\...\Easy-WebPrint) (Version: - ) EPSON Artisan 720 Series Printer Uninstall (HKLM\...\EPSON Artisan 720 Series) (Version: - SEIKO EPSON Corporation) Epson CreativeZone (HKLM-x32\...\{E6C82F8F-2031-4825-8CC3-98C5960875C1}) (Version: - ) Epson Event Manager (HKLM-x32\...\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION) Epson Print CD (HKLM-x32\...\{D16A31F9-276D-4968-A753-FFEAC56995D0}) (Version: 2.00.00 - SEIKO EPSON CORPORATION) EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation) EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4i - SEIKO EPSON CORPORATION) EpsonNet Setup 3.2 (HKLM-x32\...\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.2a - SEIKO EPSON CORPORATION) Fisher-Price Music Player (HKLM-x32\...\InstallShield_{DE6DBCE8-05B1-49BF-BB0F-D1C8C49FB1EA}) (Version: 1.0.0.33 - Fisher-Price) Fisher-Price Music Player (x32 Version: 1.0.0.33 - Fisher-Price) Hidden FlipShare (HKLM-x32\...\{97C658D2-61FB-027F-0D76-E9CDC84AFEC7}) (Version: 5.12.3.0 - Flip Video) Gateway Photo Frame 4.2.2.7 (HKLM-x32\...\Gateway Photo Frame) (Version: 4.2.2.7 - I/O Interconnect) Gateway Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.00.3006 - Acer Incorporated) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.) Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden In Context Solutions 3D Virtual Store (HKLM-x32\...\{24450378-B34B-4F83-AFFE-FEC645A10551}_is1) (Version: 1.1 - In Context Solutions, LLC) Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation) Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation) Internet Transporter - NCP Link (HKLM-x32\...\{92BF38A8-5616-4209-87A3-D910B45A1D98}) (Version: 3.2.1 - National Consumer Panel) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.27 - Irfan Skiljan) Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.650 - Oracle) Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden KB0817 Keyboard Driver (HKLM-x32\...\{ED5DCA6F-5FEA-47CB-83DB-210A468C298B}) (Version: 1.30.0000 - Gateway) LeapFrog Connect (HKLM-x32\...\UPCShell) (Version: 4.0.33.15045 - LeapFrog) LeapFrog Connect (x32 Version: 4.0.33.15045 - LeapFrog) Hidden LeapFrog LeapPad Explorer Plugin (x32 Version: 4.1.7.15314 - LeapFrog) Hidden Lexia Reading (HKLM-x32\...\Lexia Reading 9.0.0) (Version: 9.0.0 - Lexia Learning Systems, Inc.) LTCM Client (HKLM-x32\...\LTCM Client) (Version: - Leader Technologies Inc.) Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation) Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.) Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation) Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Money Essentials (HKLM-x32\...\Money2007b) (Version: 16 - Microsoft) Microsoft Money Shared Libraries (x32 Version: 16.0.0.705 - Microsoft Corporation) Hidden Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation) Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft VC9 runtime libraries (x32 Version: 1.0.0 - AOL Inc.) Hidden Microsoft VC9 runtime libraries (x32 Version: 1.0.0 - AOL LLC) Hidden Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Works (HKLM-x32\...\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB927978) (HKLM-x32\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) NCP Internet Transporter (HKLM-x32\...\{7CEB5AC4-B6F8-414C-845D-4295C125D17B}) (Version: 3.2.1 - National Consumer Panel) Nero - Burning Rom (HKLM-x32\...\{A4D7B764-4140-11D4-88EB-0050DA3579C0}) (Version: 5.5.3.0 - ahead software gmbh) OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.) P@H-Protocol (HKLM-x32\...\{CF594DB8-CFB0-45B4-86DA-8BB4AC0941F8}) (Version: 3.0.7.0 - Valassis) PlayReady PC runtime (HKLM\...\{704ABF63-B0B1-446B-9D92-C5D06AFCE7B6}) (Version: 1 - Microsoft Corporation) Presto! PageManager 7.15.11 (HKLM-x32\...\{EA52A1AC-D35D-4D25-8686-9466FE2C5CE5}) (Version: - ) Price Check by AOL (HKLM-x32\...\Price Check by AOL) (Version: 1.11.1.2 - AOL Inc.) QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.) RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks) Registry Mechanic 10.0 (HKLM-x32\...\Registry Mechanic_is1) (Version: 10.0 - PC Tools) Seagate Manager Installer (HKLM-x32\...\InstallShield_{E6F019F1-DFB6-4853-A87D-6E31624755A9}) (Version: 2.02.0109 - Seagate) Seagate Manager Installer (x32 Version: 2.02.0109 - Seagate) Hidden Segoe UI (x32 Version: 15.4.2271.0615 - Microsoft Corp) Hidden Shopping InContext (HKCU\...\{4E002314-9999-4402-9823-1CB9E6098849}_is1) (Version: 3.5 - InContext Solutions, Inc) Slingo Deluxe (HKLM-x32\...\Slingo Deluxe) (Version: 1.0.12 - funkitron) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Symphony Mathematics version 6.02 (HKLM-x32\...\Symphony Mathematics_is1) (Version: - Symphony Learning, Inc.) Trend Micro Titanium (Version: 7.0 - Trend Micro Inc.) Hidden Trend Micro Titanium Internet Security (HKLM\...\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}) (Version: 7.0 - Trend Micro Inc.) Tweaking.com - Windows Repair (All in One) (HKLM-x32\...\Tweaking.com - Windows Repair (All in One)) (Version: 2.8.4 - Tweaking.com) Uninstall AOL Emergency Connect Utility 1.0 (HKLM-x32\...\AOL Emergency Connect Utility 1.0) (Version: - ) Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation) Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version: - Microsoft) Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version: - Microsoft) Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version: - Microsoft) Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft) Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version: - Microsoft) Use the entry named LeapFrog Connect to uninstall (LeapFrog LeapPad Explorer Plugin) (HKLM-x32\...\LeapPadExplorerPlugin) (Version: - LeapFrog) Viewpoint Media Player (HKLM-x32\...\ViewpointMediaPlayer) (Version: - ) ViewSonic Monitor Drivers (HKLM-x32\...\{B4FEA924-630D-11D4-B78E-005004566E4D}) (Version: - ) Vz In-Home Agent (HKLM-x32\...\VzInHomeAgent) (Version: 9.0.55.0 - Verizon) Windows Driver Package - FTDI CDM Driver Package (02/17/2009 2.04.16) (HKLM\...\2DC0AA065FA83047D7ECD51C7000C1620D79A4C5) (Version: 02/17/2009 2.04.16 - FTDI) Windows Driver Package - FTDI CDM Driver Package (02/17/2009 2.04.16) (HKLM\...\51A4D522DD31538335EF5736F0E7F588C70BCB12) (Version: 02/17/2009 2.04.16 - FTDI) Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012) (HKLM\...\8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D) (Version: 09/10/2009 02.03.05.012 - Leapfrog) Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation) Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden YTD Video Downloader 4.6 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.6 - GreenTree Applications SRL) ZyXEL G-220v3 Wireless USB Adapter Utility (HKLM-x32\...\{29DFAB41-7D73-4E92-9329-FB1ECBD2EF83}) (Version: 1.00.0000 - ZyXEL) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-770997747-1975351657-1911745460-1000_Classes\CLSID\{9000834c-c6c7-43ac-b8ee-dc9668f39a81}\localserver32 -> C:\Users\Melissa\AppData\Local\Temp\{91814ec0-b5f0-11d2-80b9-00104b1f6cea}\IDriver.NonElevated.exe N (the data entry has 6 more characters). ==================== Restore Points ========================= 11-07-2014 15:23:50 Scheduled Checkpoint 12-07-2014 04:00:04 Scheduled Checkpoint 12-07-2014 23:03:47 Scheduled Checkpoint 13-07-2014 23:30:05 Scheduled Checkpoint 14-07-2014 14:26:18 Scheduled Checkpoint 15-07-2014 18:35:46 Scheduled Checkpoint 16-07-2014 23:11:57 Scheduled Checkpoint 18-07-2014 00:25:57 Scheduled Checkpoint 19-07-2014 04:00:03 Scheduled Checkpoint 21-07-2014 15:09:07 Scheduled Checkpoint 21-07-2014 17:53:59 Installed Java 7 Update 65 22-07-2014 16:38:25 Scheduled Checkpoint 23-07-2014 22:49:08 Scheduled Checkpoint 24-07-2014 00:14:04 Windows Update 25-07-2014 01:06:40 Scheduled Checkpoint 26-07-2014 04:18:14 Scheduled Checkpoint 26-07-2014 16:22:16 Scheduled Checkpoint 28-07-2014 00:32:25 Scheduled Checkpoint 28-07-2014 17:39:40 Scheduled Checkpoint 29-07-2014 02:52:14 Removed Ask Toolbar. 29-07-2014 02:53:40 Removed Catalina Savings Printer. 29-07-2014 02:57:32 Removed Catalina Savings Printer. 29-07-2014 02:58:41 Removed YTD Toolbar v9.3. 29-07-2014 03:03:50 Removed Catalina Savings Printer. 29-07-2014 20:53:46 Scheduled Checkpoint 30-07-2014 22:40:01 Scheduled Checkpoint 31-07-2014 10:15:20 Tweaking.com - Windows Repair ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 08:34 - 2014-07-31 06:26 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM Task: {0B04AFCA-8D54-4447-92AE-9599EBC22358} - System32\Tasks\Leader Technologies\LTCM Client\New Message Check - Melissa => C:\Program Files (x86)\LTCM Client\ltcmClient.exe [2009-08-05] (Leader Technologies Inc.) Task: {0D3F70F9-6434-4402-B73C-8B528596AFD9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-01] (Google Inc.) Task: {17FD7FCA-7CF1-4924-B381-607A167E4986} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation) Task: {409E7277-5D35-4BE8-B35B-BD8D5C4988C5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-01] (Google Inc.) Task: {458C5283-C971-41F6-B57E-F4080A3A1CAA} - System32\Tasks\Acer\Burn Notification => C:\Program Files\Gateway\Gateway Recovery Management\NotificationCenter\Notification.exe [2009-02-25] (Acer) Task: {4E4FEE25-2950-491B-8E33-12303701E2A9} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.) Task: {60D7968F-3138-484C-B83B-B9EFDA5FC1E0} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe Task: {61587307-5B52-401F-A0B6-F751FA101C10} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {662F757B-13CD-436A-AA37-4C1B976FF848} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe Task: {67414571-08EB-4C47-A73C-1F712B9FAB6E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.) Task: {718C06AD-2F17-44A9-9444-4C14F6CE4F80} - System32\Tasks\NCH Software\disketchShakeIcon => C:\Program Files (x86)\NCH Software\Disketch\Disketch.exe Task: {74C59BD0-3557-480A-9B23-05F0B4BC65EB} - System32\Tasks\Titanium BTC => C:\Program Files\Trend Micro\Titanium\plugin\TMDC\TMDC.exe [2014-05-09] (Trend Micro Inc.) Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI Task: {8A99596F-E655-4AA4-9E78-03E61B9AB575} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation) Task: {8EEBE1A3-27C1-4593-B2C4-3C2465B09932} - System32\Tasks\RMSmartUpdate => C:\Program Files (x86)\Registry Mechanic\update.exe Task: {D8631574-4537-4772-B7B8-409B8E3B1C91} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {E6CA3B30-BC97-4663-91F3-F3BDCC70D84D} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.) Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] () Task: {F50A156A-49FB-4AE5-96C4-F85466FDD35C} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-20] (Microsoft Corporation) Task: {FD1177C0-7F46-4D90-929A-E29FCEC70787} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe Task: {FE729E00-D28E-4133-BFB4-9E6F73061300} - System32\Tasks\MHotkey => C:\Windows\MHotKey.exe [2008-05-30] () Task: {FFA654E0-F932-45C6-BA6C-4F94FFE3CB8F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-04-07 20:04 - 2013-01-15 22:19 - 00048128 _____ () C:\Program Files\Trend Micro\AMSP\boost_date_time-vc110-mt-1_49.dll 2014-04-07 20:04 - 2013-04-02 00:25 - 00675840 _____ () C:\Program Files\Trend Micro\AMSP\sqlite3.dll 2014-04-07 20:04 - 2013-01-15 22:23 - 00058368 _____ () C:\Program Files\Trend Micro\AMSP\boost_thread-vc110-mt-1_49.dll 2014-04-07 20:04 - 2012-12-18 16:06 - 01300480 _____ () C:\Program Files\Trend Micro\AMSP\libprotobuf.dll 2014-04-07 20:04 - 2013-01-15 22:19 - 00018944 _____ () C:\Program Files\Trend Micro\AMSP\boost_system-vc110-mt-1_49.dll 2014-04-07 19:33 - 2013-07-23 11:28 - 00247352 _____ () C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll 2011-05-06 13:07 - 2011-05-06 13:07 - 00460144 _____ () C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe 2011-05-06 12:58 - 2011-05-06 12:58 - 01085440 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe 2013-08-14 15:19 - 2013-08-14 15:19 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe 2009-04-02 04:22 - 2008-05-30 13:50 - 00581120 _____ () C:\Windows\MHotKey.exe 2010-10-26 00:06 - 2010-10-26 00:06 - 02248704 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtCore4.dll 2011-05-06 13:07 - 2011-05-06 13:07 - 04317184 _____ () C:\Program Files (x86)\Flip Video\FlipShare\Core.dll 2011-05-06 13:02 - 2011-05-06 13:02 - 00737280 _____ () C:\Program Files (x86)\Flip Video\FlipShare\qca2.dll 2010-10-26 00:23 - 2010-10-26 00:23 - 08351744 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtGui4.dll 2010-10-26 00:08 - 2010-10-26 00:08 - 00983040 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtNetwork4.dll 2010-10-26 00:23 - 2010-10-26 00:23 - 00204800 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtSql4.dll 2010-10-26 00:06 - 2010-10-26 00:06 - 00364544 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtXml4.dll 2010-10-26 08:34 - 2010-10-26 08:34 - 11853824 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtWebKit4.dll 2010-10-26 00:37 - 2010-10-26 00:37 - 00258048 _____ () C:\Program Files (x86)\Flip Video\FlipShare\phonon4.dll 2010-05-20 13:49 - 2010-05-20 13:49 - 00258048 _____ () C:\Program Files (x86)\Flip Video\FlipShare\boost_serialization-vc80-mt-1_43.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 01199104 _____ () C:\Program Files (x86)\Flip Video\FlipShare\PocoFoundation.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00642048 _____ () C:\Program Files (x86)\Flip Video\FlipShare\PocoNet.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00511488 _____ () C:\Program Files (x86)\Flip Video\FlipShare\PocoXML.dll 2010-10-26 00:06 - 2010-10-26 00:06 - 02248704 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\QtCore4.dll 2010-10-26 00:08 - 2010-10-26 00:08 - 00983040 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\QtNetwork4.dll 2010-10-26 00:23 - 2010-10-26 00:23 - 00204800 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\QtSql4.dll 2010-05-20 13:49 - 2010-05-20 13:49 - 00258048 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\boost_serialization-vc80-mt-1_43.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 01199104 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoFoundation.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00642048 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoNet.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00175616 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoNetSSL.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00291840 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoUtil.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00511488 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoXML.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00110592 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoCrypto.dll 2009-05-01 14:35 - 2009-05-01 14:35 - 00066856 _____ () C:\Program Files (x86)\Seagate\SeagateManager\Sync\ExtensionFilter.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00048640 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\zlib.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 21151744 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libcef.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00648704 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libglesv2.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00122880 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libegl.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00094208 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\Components\Tier2Svc.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00060928 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\Components\DataSvcs.dll 2014-07-08 20:57 - 2014-07-08 20:57 - 17029808 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1 AlternateDataStreams: C:\Users\Melissa\Desktop\Documents\2010-03-31 19 58 12.AVI:TOC.WMV ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ZyXEL G-220v3 Wireless USB Adapter Utility.lnk => C:\Windows\pss\ZyXEL G-220v3 Wireless USB Adapter Utility.lnk.CommonStartup MSCONFIG\startupreg: Amazon Music => "C:\Users\Melissa\AppData\Local\Amazon Music\Amazon Music Helper.exe" MSCONFIG\startupreg: Artisan 720(Network) => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGYA.EXE /FU "C:\Windows\TEMP\E_SEBA5.tmp" /EF "HKCU" MSCONFIG\startupreg: EEventManager => "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" MSCONFIG\startupreg: EPSON Artisan 720 Series => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGYA.EXE /FU "C:\Windows\TEMP\E_S33EB.tmp" /EF "HKCU" MSCONFIG\startupreg: EPSON8D005F (Artisan 720) => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGYA.EXE /FU "C:\Windows\TEMP\E_S2A4A.tmp" /EF "HKCU" MSCONFIG\startupreg: Launch Kid-Touch Music Player Middleware => "C:\Program Files (x86)\Fisher-Price\Music Player\MP_Middleware.exe" MSCONFIG\startupreg: MegaPanel => "C:\Program Files (x86)\National Consumer Panel\NCP Internet Transporter\HSTrans.exe" MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background MSCONFIG\startupreg: NeroCheck => C:\Windows\SysWOW64\NeroCheck.exe MSCONFIG\startupreg: OpwareSE2 => "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime MSCONFIG\startupreg: Slick Savings => "C:\Users\Melissa\AppData\Roaming\Slick Savings\CouponsHelper.exe" MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\real\realplayer\update\realsched.exe" -osboot ==================== Faulty Device Manager Devices ============= Name: Intel® 82567V-2 Gigabit Network Connection Description: Intel® 82567V-2 Gigabit Network Connection Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Intel Service: e1yexpress Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: E:\ Description: Compact Flash Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a} Manufacturer: Generic- Service: WUDFRd Problem: : Windows cannot initialize the device driver for this hardware. (Code 37) Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver. Name: F:\ Description: Flash Reader Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a} Manufacturer: Multiple Service: WUDFRd Problem: : Windows cannot initialize the device driver for this hardware. (Code 37) Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver. ==================== Event log errors: ========================= Application errors: ================== Error: (08/01/2014 05:40:38 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/01/2014 01:42:04 PM) (Source: System Restore) (EventID: 8210) (User: ) Description: The scheduled restore point could not be created. Additional information: (0x8000ffff). Error: (08/01/2014 01:42:04 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: Failed to create restore point on volume (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Descripton = Scheduled Checkpoint; Hr = 0x8000ffff). Error: (08/01/2014 01:42:04 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070057. Operation: Abort Backup Context: Execution Context: Requestor Current State: SnapshotSetCreated Error: (08/01/2014 01:42:04 PM) (Source: VSS) (EventID: 13) (User: ) Description: Volume Shadow Copy Service information: The COM Server with CLSID {faf53cc4-bd73-4e36-83f1-2b23f46e513e} and name VSSEvent cannot be started. [0x80070057] Operation: Abort Backup Context: Execution Context: Requestor Current State: SnapshotSetCreated Error: (08/01/2014 01:42:04 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040154. Operation: Gathering Writer Data Executing Asynchronous Operation Context: Execution Context: Requestor Current State: GatherWriterMetadata Error: (08/01/2014 01:42:04 PM) (Source: VSS) (EventID: 34) (User: ) Description: Volume Shadow Copy Service error: The VSS event class is not registered. This will prevent any VSS writers from receiving events. This may be caused due to a setup failure or as a result of an application's installer or uninstaller. Operation: Gathering Writer Data Executing Asynchronous Operation Context: Execution Context: Requestor Current State: GatherWriterMetadata Error: (08/01/2014 00:27:53 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/01/2014 00:00:52 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/01/2014 11:41:32 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (08/01/2014 05:40:40 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 00:27:57 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 00:00:52 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 11:41:45 AM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 11:41:32 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: MBAMScheduler%%1053 Error: (08/01/2014 11:41:32 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: 30000MBAMScheduler Error: (08/01/2014 11:23:58 AM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 11:23:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: FlipShare Service%%1053 Error: (08/01/2014 11:23:54 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: 30000FlipShare Service Error: (08/01/2014 10:59:10 AM) (Source: Ntfs) (EventID: 137) (User: ) Description: The default transaction resource manager on volume G: encountered a non-retryable error and could not start. The data contains the error code. Microsoft Office Sessions: ========================= Error: (01/08/2012 10:42:25 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 128 seconds with 120 seconds of active time. This session ended with a crash. Error: (12/08/2011 09:20:29 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2014-08-01 18:20:09.895 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:20:09.654 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:20:09.395 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:20:09.112 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:19:53.334 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:19:53.097 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:19:52.817 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:19:52.593 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:17:19.015 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 18:17:18.796 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 56% Total physical RAM: 4060.26 MB Available physical RAM: 1777.57 MB Total Pagefile: 8329.81 MB Available Pagefile: 5594.16 MB Total Virtual: 8192 MB Available Virtual: 8191.87 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:583.17 GB) (Free:351.4 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive g: (FreeAgent Drive) (Fixed) (Total:298.09 GB) (Free:78.92 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596 GB) (Disk ID: CD6556B4) Partition 1: (Not Active) - (Size=13 GB) - (Type=27) Partition 2: (Active) - (Size=583 GB) - (Type=07 NTFS) ======================================================== Disk: 3 (Size: 298 GB) (Disk ID: A4B57300) Partition 1: (Not Active) - (Size=298 GB) - (Type=07 NTFS) ==================== End Of Log ============================
  10. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 02 Ran by Melissa (administrator) on MELISSA-PC on 01-08-2014 18:20:03 Running from C:\Users\Melissa\Desktop Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States) Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (Agere Systems) C:\Program Files\LSI SoftModem\agr64svc.exe (Coupons.com Inc.) C:\Program Files (x86)\Coupons\CouponPrinterService.exe (Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe (Microsoft Corporation) C:\Windows\ehome\ehsched.exe () C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe () C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe (Seagate Technology LLC) C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE () C:\Windows\mHotkey.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (Chicony) C:\Windows\ChiFuncExt.exe (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe (PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (Seagate LLC) C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\1275861383\ee\aolsoftware.exe (Creative) C:\Windows\CNYHKey.exe (Seagate Technology LLC) C:\Program Files (x86)\Seagate\SeagateManager\Sync\MaxSync.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Chicony) C:\Windows\ModLEDKey.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\waol.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\shellmon.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\aolbrowser.exe (Microsoft Corporation) C:\Windows\splwow64.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [229824 2013-10-09] (Trend Micro Inc.) HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.) HKLM\...\Run: [iAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-09-12] (Intel Corporation) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM-x32\...\Run: [Monitor] => C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe [295304 2012-07-05] (LeapFrog Enterprises, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [LTCM Client] => C:\Program Files (x86)\LTCM Client\ltcmClient.exe [1596096 2009-08-05] (Leader Technologies Inc.) HKLM-x32\...\Run: [sSDMonitor] => C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [112600 2010-11-15] (PC Tools) HKLM-x32\...\Run: [MaxMenuMgr] => C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe [185640 2009-05-01] (Seagate LLC) HKLM-x32\...\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1275861383\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.) HKLM-x32\...\Run: [LedKey] => C:\Windows\CNYHKey.exe [339968 2008-04-23] (Creative) HKLM-x32\...\Run: [LchDrvKey] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] () Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-770997747-1975351657-1911745460-1000\...\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL Desktop 9.7b\AOL.EXE [72296 2014-06-05] (AOL Inc.) HKU\S-1-5-21-770997747-1975351657-1911745460-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1 HKU\S-1-5-21-770997747-1975351657-1911745460-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL Desktop 9.7b\AOL.EXE [72296 2014-06-05] (AOL Inc.) HKU\S-1-5-21-770997747-1975351657-1911745460-1000-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoDesktopCleanupWizard] 1 HKU\S-1-5-21-770997747-1975351657-1911745460-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [NoDesktopCleanupWizard] 1 ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1C520D3D7F3DCB01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0610&m=sx2800 URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - No File URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File URLSearchHook: HKCU - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - No File URLSearchHook: HKCU - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW SearchScopes: HKLM-x32 - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm423^S09999^us&si=245051_US-B-GDD1&ptb=D9CD2D74-D48E-42BB-9892-22D245D108B8&ind=2014062008&n=780c25b8&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - DefaultScope {B5EB76EB-459D-4DC0-B6EC-8A9D204407F1} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} SearchScopes: HKCU - {1EB6F07C-4A8F-4EAD-9125-9BFAECDC2888} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3196716 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW SearchScopes: HKCU - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm423^S09999^us&si=245051_US-B-GDD1&ptb=D9CD2D74-D48E-42BB-9892-22D245D108B8&ind=2014062008&n=780c25b8&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - {B5EB76EB-459D-4DC0-B6EC-8A9D204407F1} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe64.dll (Trend Micro Inc.) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg32.dll (Trend Micro Inc.) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: AOL Toolbar Loader -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File BHO-x32: EWPBrowseObject Class -> {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} -> C:\Program Files (x86)\Canon\Easy-WebPrint\EWPBrowseLoader.dll () BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe32.dll (Trend Micro Inc.) BHO-x32: Price Check by AOL -> {D25B97E9-62B2-40CE-BECF-E43A7B879072} -> C:\Program Files (x86)\Price Check by AOL\aolpricecheck.dll (AOL Inc.) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File Toolbar: HKCU - AOL Toolbar - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} - No File DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe64.dll (Trend Micro Inc.) Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.) Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - No File Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe32.dll (Trend Micro Inc.) Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg32.dll (Trend Micro Inc.) Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @viewpoint.com/VMP - C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll () FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Melissa\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll (Amazon.com, Inc.) FF Plugin HKCU: CouponNetwork.com/CMDUniversalCouponPrintActivator - C:\Users\Melissa\AppData\Roaming\CATALI~2\NPBCSK~1.DLL (Catalina Marketing Corporation) FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension [2014-04-24] FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-06-06] FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-10-09] FF HKLM-x32\...\Firefox\Extensions: [{38783831-6098-4faa-A9C9-1EE1E343F4D2}] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1104\7.1.1104\firefoxextension FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF HKLM-x32\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-04-24] Chrome: ======= CHR HomePage: CHR RestoreOnStartup: "hxxp://search.yahoo.com?type=937811&fr=spigot-yhp-ch", "hxxp://www.google.com/" CHR DefaultSearchKeyword: slirsredirect.search.aol.com CHR DefaultSearchProvider: AOL Search CHR DefaultSearchURL: http://slirsredirect.search.aol.com/redirector/sredir?sredir=843&query={searchTerms}&invocationType=tb50-ie-aolTB50CL-chromesbox-en-us CHR Extension: (Weatherbug Toolbar) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaodccgghcfficmpomnifhhlmlbfef [2013-07-07] CHR Extension: (TrendMicro BEP Extension) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmiabdepfhhiieiipmeecdmeljggmfee [2013-07-07] CHR Extension: (RealDownloader) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-07-07] CHR HKLM-x32\...\Chrome\Extension: [bmiabdepfhhiieiipmeecdmeljggmfee] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1135\8.0.1135\chrome_tmbep.crx [2013-07-07] CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agr64svc.exe [16896 2008-08-26] (Agere Systems) R2 CouponPrinterService; C:\Program Files (x86)\Coupons\CouponPrinterService.exe [176624 2014-02-13] (Coupons.com Inc.) R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed] R2 FlipShare Service; C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe [460144 2011-05-06] () R2 FlipShareServer; C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [1085440 2011-05-06] () [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [632792 2010-04-08] (PC Tools) R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] () R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X] S3 TweakingRunAsSystemService; "C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\tweaking_ras.exe" cmd.exe []/c start /HIGH cmd.exe /c C:\Users\Melissa\AppData\Local\Temp\temp761.bat & exit ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation) S1 Beep; No ImagePath R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-08-01] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) S3 NeroCd2k; C:\Windows\SysWOW64\drivers\NeroCd2k.sys [44227 2001-04-16] (ahead software gmbh im stoeckmaedle 6 76307 karlsbad, germany Fax: ++49-7248-911-888 e-mail: info@nero.com) [File not signed] S3 rt70x64; C:\Windows\System32\DRIVERS\WUSB54Gv4x64.sys [308224 2007-03-11] (Ralink Technology Inc.) R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [117312 2013-12-03] (Trend Micro Inc.) R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [283160 2013-12-03] (Trend Micro Inc.) R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [50976 2013-07-01] (Trend Micro Inc.) R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [100640 2013-06-13] (Trend Micro Inc.) R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [85936 2013-12-03] (Trend Micro Inc.) R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [303392 2013-05-15] (Trend Micro Inc.) R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105744 2011-08-22] (Trend Micro Inc.) R3 XG762_VS; C:\Windows\System32\DRIVERS\WlanGZG.sys [1041920 2008-10-28] (Atheros Communications, Inc.) S3 ZDCNDIS6a64; C:\Windows\system32\ZDCNDIS6a64.sys [41280 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) S3 ZDCNDIS6a64; C:\Windows\SysWOW64\ZDCNDIS6a64.sys [41280 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) S3 BCMH43XX; system32\DRIVERS\bcmwlhigh664.sys [X] S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] U2 TMAgent; ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-01 18:20 - 2014-08-01 18:20 - 00024967 _____ () C:\Users\Melissa\Desktop\FRST.txt 2014-08-01 18:19 - 2014-08-01 18:19 - 02094080 _____ (Farbar) C:\Users\Melissa\Desktop\FRST64.exe 2014-08-01 17:40 - 2014-08-01 17:40 - 00000384 _____ () C:\Windows\DCEBOOT.RST 2014-08-01 17:40 - 2014-08-01 17:40 - 00000000 _____ () C:\Windows\DCEBOOT.LOG 2014-08-01 17:38 - 2014-08-01 17:38 - 00231960 _____ () C:\Windows\RegBootClean64.exe 2014-08-01 17:38 - 2014-08-01 17:38 - 00021528 _____ () C:\Windows\DCEBoot64.exe 2014-08-01 12:39 - 2014-08-01 18:19 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-01 11:44 - 2014-08-01 17:40 - 00003370 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-01 11:44 - 2014-08-01 17:40 - 00003240 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-07-31 06:14 - 2014-07-31 06:14 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MELISSA-PC-Microsoft®-Windows-Vista™-Home-Premium-(64-bit).dat 2014-07-31 06:14 - 2014-07-31 06:14 - 00000000 ____D () C:\RegBackup 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-07-30 20:24 - 2014-07-30 20:24 - 00001956 _____ () C:\Users\Melissa\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-30 20:23 - 2014-07-30 20:23 - 09522240 _____ () C:\Users\Melissa\Desktop\tweaking.com_windows_repair_aio_setup.exe 2014-07-30 20:23 - 2014-07-30 20:23 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-29 13:39 - 2014-07-29 13:40 - 02347384 _____ (ESET) C:\Users\Melissa\Desktop\esetsmartinstaller_enu.exe 2014-07-29 09:27 - 2014-07-29 09:27 - 00016582 _____ () C:\ComboFix.txt 2014-07-28 23:54 - 2014-07-29 09:27 - 00000000 ____D () C:\Qoobox 2014-07-28 23:54 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-07-28 23:54 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-07-28 23:54 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe 2014-07-28 23:53 - 2014-07-29 09:23 - 00000000 ____D () C:\Windows\erdnt 2014-07-28 23:50 - 2014-07-28 23:50 - 05563277 ____R (Swearware) C:\Users\Melissa\Desktop\ComboFix.exe 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\ProgramData\Viewpoint 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\Program Files (x86)\Viewpoint 2014-07-28 23:19 - 2014-07-31 06:31 - 00001204 _____ () C:\Windows\PFRO.log 2014-07-28 23:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-07-28 23:13 - 2014-07-28 23:43 - 00000000 ____D () C:\AdwCleaner 2014-07-28 23:12 - 2014-07-28 23:12 - 01365551 _____ () C:\Users\Melissa\Desktop\AdwCleaner.exe 2014-07-28 22:38 - 2014-07-28 22:38 - 00001301 _____ () C:\Users\Melissa\Desktop\Documents\quarantine list.txt 2014-07-28 11:17 - 2014-07-28 11:17 - 00072624 _____ () C:\Users\Brooke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-28 10:17 - 2014-08-01 18:20 - 00000000 ____D () C:\FRST 2014-07-28 10:01 - 2014-07-28 10:02 - 00206246 _____ () C:\Users\Melissa\Desktop\Documents\cc_20140728_100144.reg 2014-07-28 01:31 - 2014-07-28 01:31 - 00001149 _____ () C:\Users\Brooke\Desktop\Trend Micro Titanium Internet Security.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000951 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000941 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000936 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Real 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Leader Technologies 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Epson 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Apple Computer 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Google 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Fisher-Price 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\AOL 2014-07-28 01:30 - 2014-07-28 09:46 - 00000000 ____D () C:\Users\Brooke\AppData\Local\VirtualStore 2014-07-28 01:30 - 2014-07-28 01:31 - 00000917 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-07-28 01:30 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke 2014-07-28 01:30 - 2014-07-28 01:30 - 00000020 ___SH () C:\Users\Brooke\ntuser.ini 2014-07-28 01:30 - 2010-06-06 19:48 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Microsoft Help 2014-07-28 01:30 - 2010-06-06 18:37 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Macromedia 2014-07-28 01:30 - 2010-06-05 18:36 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Power2Go 2014-07-28 01:30 - 2008-01-20 23:20 - 00000000 ___RD () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-07-28 01:30 - 2008-01-20 23:20 - 00000000 ___RD () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-07-28 01:02 - 2014-07-28 01:02 - 110331640 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\msert.exe 2014-07-28 00:36 - 2014-07-28 00:36 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{74ED30BA-00C4-413B-83E1-1A8B2B958A60} 2014-07-28 00:27 - 2014-07-28 00:27 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{4B03C2EF-9478-4C62-94BE-0012C9EDDE0D} 2014-07-27 23:29 - 2014-07-27 23:29 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{06C6F07A-6C0C-4519-9CBD-02CDE2F27824} 2014-07-27 23:24 - 2014-07-27 23:24 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{F8A53BEA-5E66-48D8-9A0F-ACBA323096A7} 2014-07-27 23:11 - 2014-07-27 23:11 - 00347816 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\MicrosoftFixit.WinFileFolder.RNP.236329947861191425.1.1.Run.exe 2014-07-27 22:49 - 2014-07-27 22:49 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{D27ED732-5CF7-414B-AC59-C3FE34F5F748} 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\Resume_files 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\PTO.Supplies.Flyer 2014-07-26 09:39 - 2014-08-01 12:25 - 00000000 ____D () C:\Users\Melissa\Desktop\to be ordered 2014-07-24 20:16 - 2014-08-01 12:52 - 00000000 ____D () C:\Users\Melissa\Desktop\Alaina pics 2014-07-22 11:59 - 2014-07-25 16:19 - 00000000 ____D () C:\Users\Melissa\Desktop\Tim Missy Pics 2014-07-21 13:55 - 2014-07-21 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 13:55 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-21 13:55 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-21 13:55 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-21 13:55 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-21 13:54 - 2014-07-21 13:55 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-09 20:37 - 2014-06-07 00:02 - 17854464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-07-09 20:37 - 2014-06-06 23:13 - 10890752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-07-09 20:37 - 2014-06-06 22:59 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-07-09 20:37 - 2014-06-06 22:52 - 01348608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-07-09 20:37 - 2014-06-06 22:51 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-07-09 20:37 - 2014-06-06 22:51 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-07-09 20:37 - 2014-06-06 22:50 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-07-09 20:37 - 2014-06-06 22:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-07-09 20:37 - 2014-06-06 22:42 - 02148352 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-07-09 20:37 - 2014-06-06 22:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-07-09 20:37 - 2014-06-06 22:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-07-09 20:37 - 2014-06-06 22:35 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-07-09 20:37 - 2014-06-06 20:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-07-09 20:37 - 2014-06-06 19:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-07-09 20:37 - 2014-06-06 19:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-07-09 20:37 - 2014-06-06 19:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-07-09 20:37 - 2014-06-06 19:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-07-09 20:37 - 2014-06-06 19:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-07-09 20:37 - 2014-06-06 19:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-07-09 20:37 - 2014-06-06 18:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-07-09 20:37 - 2014-06-06 18:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-07-09 20:37 - 2014-06-06 18:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-07-09 20:37 - 2014-06-06 18:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-07-09 20:37 - 2014-06-06 18:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-07-09 20:37 - 2014-06-06 18:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-07-09 20:37 - 2014-06-06 18:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-07-09 20:36 - 2014-06-06 20:33 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-07-09 20:36 - 2014-06-06 04:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-07-09 20:36 - 2014-06-06 03:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-07-09 20:36 - 2014-05-30 03:10 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-01 18:20 - 2014-08-01 18:20 - 00024967 _____ () C:\Users\Melissa\Desktop\FRST.txt 2014-08-01 18:20 - 2014-07-28 10:17 - 00000000 ____D () C:\FRST 2014-08-01 18:19 - 2014-08-01 18:19 - 02094080 _____ (Farbar) C:\Users\Melissa\Desktop\FRST64.exe 2014-08-01 18:19 - 2014-08-01 12:39 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-01 18:11 - 2010-07-01 15:37 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-01 17:57 - 2012-04-20 08:53 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-01 17:43 - 2010-06-05 21:23 - 01668926 _____ () C:\Windows\WindowsUpdate.log 2014-08-01 17:40 - 2014-08-01 17:40 - 00000384 _____ () C:\Windows\DCEBOOT.RST 2014-08-01 17:40 - 2014-08-01 17:40 - 00000000 _____ () C:\Windows\DCEBOOT.LOG 2014-08-01 17:40 - 2014-08-01 11:44 - 00003370 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-01 17:40 - 2014-08-01 11:44 - 00003240 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-01 17:40 - 2010-07-01 15:37 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-01 17:40 - 2006-11-02 11:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-01 17:40 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-01 17:40 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-01 17:40 - 2006-11-02 11:07 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-08-01 17:39 - 2006-11-02 11:42 - 00032648 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-08-01 17:38 - 2014-08-01 17:38 - 00231960 _____ () C:\Windows\RegBootClean64.exe 2014-08-01 17:38 - 2014-08-01 17:38 - 00021528 _____ () C:\Windows\DCEBoot64.exe 2014-08-01 17:38 - 2010-06-06 11:20 - 00000000 ____D () C:\ProgramData\Trend Micro 2014-08-01 12:53 - 2014-03-15 21:20 - 00000000 ____D () C:\Users\Melissa\Desktop\photos to order 2014-08-01 12:52 - 2014-07-24 20:16 - 00000000 ____D () C:\Users\Melissa\Desktop\Alaina pics 2014-08-01 12:25 - 2014-07-26 09:39 - 00000000 ____D () C:\Users\Melissa\Desktop\to be ordered 2014-08-01 11:01 - 2010-06-05 18:43 - 00131072 _____ () C:\Users\Melissa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-08-01 11:00 - 2014-05-30 16:24 - 00000000 ____D () C:\Users\Melissa\Desktop\craigslist 2014-08-01 10:51 - 2014-06-19 21:28 - 00000000 ____D () C:\Users\Melissa\Desktop\avary pics 2014-08-01 10:47 - 2014-03-18 18:48 - 00000000 ____D () C:\Users\Melissa\Desktop\pics to order 2014-07-31 06:31 - 2014-07-28 23:19 - 00001204 _____ () C:\Windows\PFRO.log 2014-07-31 06:25 - 2006-11-02 08:46 - 00775178 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-07-31 06:25 - 2006-11-02 08:34 - 00000286 _____ () C:\Windows\win.ini 2014-07-31 06:18 - 2014-02-25 22:17 - 00775178 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-07-31 06:14 - 2014-07-31 06:14 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MELISSA-PC-Microsoft®-Windows-Vista™-Home-Premium-(64-bit).dat 2014-07-31 06:14 - 2014-07-31 06:14 - 00000000 ____D () C:\RegBackup 2014-07-30 22:07 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-04-28 20:17 - 00000910 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00001956 _____ () C:\Users\Melissa\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-30 20:23 - 2014-07-30 20:23 - 09522240 _____ () C:\Users\Melissa\Desktop\tweaking.com_windows_repair_aio_setup.exe 2014-07-30 20:23 - 2014-07-30 20:23 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-29 13:40 - 2014-07-29 13:39 - 02347384 _____ (ESET) C:\Users\Melissa\Desktop\esetsmartinstaller_enu.exe 2014-07-29 09:27 - 2014-07-29 09:27 - 00016582 _____ () C:\ComboFix.txt 2014-07-29 09:27 - 2014-07-28 23:54 - 00000000 ____D () C:\Qoobox 2014-07-29 09:27 - 2006-11-02 09:33 - 00000000 __RHD () C:\Users\Default 2014-07-29 09:23 - 2014-07-28 23:53 - 00000000 ____D () C:\Windows\erdnt 2014-07-29 09:21 - 2006-11-02 08:34 - 00000215 _____ () C:\Windows\system.ini 2014-07-29 02:31 - 2006-11-02 08:33 - 76808192 _____ () C:\Windows\system32\config\SOFTWARE.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 63438848 _____ () C:\Windows\system32\config\COMPONENTS.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 21495808 _____ () C:\Windows\system32\config\SYSTEM.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00524288 _____ () C:\Windows\system32\config\DEFAULT.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00262144 _____ () C:\Windows\system32\config\SAM.bak 2014-07-28 23:50 - 2014-07-28 23:50 - 05563277 ____R (Swearware) C:\Users\Melissa\Desktop\ComboFix.exe 2014-07-28 23:43 - 2014-07-28 23:13 - 00000000 ____D () C:\AdwCleaner 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\ProgramData\Viewpoint 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\Program Files (x86)\Viewpoint 2014-07-28 23:12 - 2014-07-28 23:12 - 01365551 _____ () C:\Users\Melissa\Desktop\AdwCleaner.exe 2014-07-28 22:38 - 2014-07-28 22:38 - 00001301 _____ () C:\Users\Melissa\Desktop\Documents\quarantine list.txt 2014-07-28 22:34 - 2010-06-05 18:34 - 00000000 ____D () C:\ProgramData\Temp 2014-07-28 11:41 - 2013-06-17 09:41 - 00000000 ____D () C:\Users\Melissa\Desktop\Ebay 2014-07-28 11:17 - 2014-07-28 11:17 - 00072624 _____ () C:\Users\Brooke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-28 10:02 - 2014-07-28 10:01 - 00206246 _____ () C:\Users\Melissa\Desktop\Documents\cc_20140728_100144.reg 2014-07-28 09:59 - 2013-07-11 16:50 - 00000000 ____D () C:\Windows\Minidump 2014-07-28 09:59 - 2010-08-02 21:07 - 00000000 ____D () C:\Users\Melissa\Tracing 2014-07-28 09:54 - 2012-06-11 09:27 - 00000000 ____D () C:\Windows\pss 2014-07-28 09:46 - 2014-07-28 01:30 - 00000000 ____D () C:\Users\Brooke\AppData\Local\VirtualStore 2014-07-28 01:31 - 2014-07-28 01:31 - 00001149 _____ () C:\Users\Brooke\Desktop\Trend Micro Titanium Internet Security.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000951 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000941 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000936 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Real 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Leader Technologies 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Epson 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Apple Computer 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Google 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Fisher-Price 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\AOL 2014-07-28 01:31 - 2014-07-28 01:30 - 00000917 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-07-28 01:31 - 2014-07-28 01:30 - 00000000 ____D () C:\Users\Brooke 2014-07-28 01:30 - 2014-07-28 01:30 - 00000020 ___SH () C:\Users\Brooke\ntuser.ini 2014-07-28 01:02 - 2014-07-28 01:02 - 110331640 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\msert.exe 2014-07-28 00:36 - 2014-07-28 00:36 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{74ED30BA-00C4-413B-83E1-1A8B2B958A60} 2014-07-28 00:27 - 2014-07-28 00:27 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{4B03C2EF-9478-4C62-94BE-0012C9EDDE0D} 2014-07-27 23:29 - 2014-07-27 23:29 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{06C6F07A-6C0C-4519-9CBD-02CDE2F27824} 2014-07-27 23:24 - 2014-07-27 23:24 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{F8A53BEA-5E66-48D8-9A0F-ACBA323096A7} 2014-07-27 23:11 - 2014-07-27 23:11 - 00347816 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\MicrosoftFixit.WinFileFolder.RNP.236329947861191425.1.1.Run.exe 2014-07-27 22:49 - 2014-07-27 22:49 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{D27ED732-5CF7-414B-AC59-C3FE34F5F748} 2014-07-27 00:32 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\system 2014-07-26 12:57 - 2014-04-28 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-07-26 12:57 - 2014-04-28 20:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\Resume_files 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\PTO.Supplies.Flyer 2014-07-26 11:36 - 2014-06-20 21:43 - 00000000 ____D () C:\Users\Melissa\Desktop\New Folder (2) 2014-07-25 17:37 - 2012-12-24 18:27 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents 2 2014-07-25 17:35 - 2011-04-04 23:23 - 00000000 ____D () C:\Users\Melissa\Desktop\For DVD 2014-07-25 16:24 - 2013-04-16 21:08 - 00000000 ____D () C:\Users\Melissa\Desktop\Family Photos Scanned 2014-07-25 16:20 - 2014-06-11 20:37 - 00000000 ____D () C:\Users\Melissa\Desktop\New Folder 2014-07-25 16:19 - 2014-07-22 11:59 - 00000000 ____D () C:\Users\Melissa\Desktop\Tim Missy Pics 2014-07-25 16:12 - 2013-01-22 14:14 - 00000000 ____D () C:\Users\Melissa\Desktop\Avary Video 2014-07-24 19:51 - 2010-08-02 21:15 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-07-23 20:15 - 2010-09-15 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-07-23 10:52 - 2010-06-05 18:37 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-07-21 13:55 - 2014-07-21 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 13:55 - 2014-07-21 13:54 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-21 13:55 - 2009-04-02 04:30 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-11 03:02 - 2014-07-21 13:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-21 13:55 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-21 13:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-21 13:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-10 17:10 - 2006-11-02 11:21 - 00310808 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-07-10 17:08 - 2006-11-02 11:07 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-09 21:07 - 2013-07-18 00:31 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-09 21:04 - 2006-11-02 08:35 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-07-08 20:57 - 2012-04-20 08:53 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-08 20:57 - 2012-04-20 08:53 - 00003682 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-08 20:57 - 2011-05-19 09:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-06 20:32 - 2014-06-29 20:44 - 00000000 ____D () C:\Users\Melissa\AppData\Local\Adobe Files to move or delete: ==================== C:\ProgramData\unins000.dat C:\ProgramData\unins000.exe Some content of TEMP: ==================== C:\Users\Melissa\AppData\Local\Temp\mbam-setup.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-01 17:46 ==================== End Of Log ============================
  11. I went into the external harddrive and removed all the history files which freed up a bit of space. I was able to sync and backup the external harddrive correctly and that fixed the problem. I am now able to delete all the icons and they don't come back anymore. Finally!! Does everything else seem to look ok? Thanks again, Melissa
  12. Additional scan result of Farbar Recovery Scan Tool (x64) Version: 31-07-2014 02 Ran by Melissa at 2014-08-01 17:49:50 Running from C:\Users\Melissa\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== (If an entry is included in the fixlist, it will be removed.) AV: Trend Micro Titanium Internet Security (Disabled - Up to date) {5D349EF8-873B-C657-917F-F1D93E101A7C} AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} AS: Trend Micro Titanium Internet Security (Disabled - Up to date) {E6557F1C-A101-C9D9-ABCF-CAAB459750C1} ==================== Installed Programs ====================== (Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.) Update for Microsoft Office 2007 (KB2508958) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0C5823AA-7B6F-44E1-8D5B-8FD1FF0E6438}) (Version: - Microsoft) 3ivx MPEG-4 5.0.3 (remove only) (HKLM-x32\...\3ivx MPEG-4 5.0.3) (Version: 5.0.3 - 3ivx Technologies, Pty. Ltd.) Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated) Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.7.0.19530 - Adobe Systems Incorporated) Adobe AIR (x32 Version: 2.7.0.19530 - Adobe Systems Incorporated) Hidden Adobe Flash Player 14 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated) Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated) Adobe Photoshop Elements 8.0 (x32 Version: 8.0 - Adobe Systems Incorporated) Hidden Adobe Reader X (10.1.10) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.10 - Adobe Systems Incorporated) Adobe Shockwave Player 11.6 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.6.5.635 - Adobe Systems, Inc.) Agere Systems PCI-SV92EX Soft Modem (HKLM\...\Agere Systems Soft Modem) (Version: - LSI Corporation) Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC) Amazon MP3 Uploader (HKLM-x32\...\com.amazon.music.uploader) (Version: 1.0.5 - Amazon Services LLC) Amazon MP3 Uploader (x32 Version: 1.0.5 - Amazon Services LLC) Hidden Amazon Music (HKCU\...\Amazon Amazon Music) (Version: 3.0.5.567 - Amazon Services LLC) AOL Toolbar (HKLM-x32\...\AOL Toolbar) (Version: - ) AOL Uninstaller (Choose which Products to Remove) (HKLM-x32\...\AOL Uninstaller) (Version: - AOL Inc.) Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.) Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.) ArcSoft PhotoStudio 6 (HKLM-x32\...\{ED8EF3C2-FA5B-4A1E-950D-5A0227161F97}) (Version: 6.0.1.148 - ArcSoft) Canon Auto Update Service (HKLM-x32\...\Auto Update Service) (Version: 1.1.0.13 - Canon Inc.) Canon CanoScan 9000F User Registration (HKLM-x32\...\Canon CanoScan 9000F User Registration) (Version: - ) Canon DIGITAL CAMERA Solution Disk Software Guide (HKLM-x32\...\Software Guide) (Version: 1.6.0.1 - Canon Inc.) CANON iMAGE GATEWAY MyCamera Download Plugin (HKLM-x32\...\MyCamera Download Plugin) (Version: 3.1.1.2 - Canon Inc.) CANON iMAGE GATEWAY Task for ZoomBrowser EX (HKLM-x32\...\CANON iMAGE GATEWAY Task) (Version: 1.9.0.9 - Canon Inc.) Canon MOV Decoder (HKLM-x32\...\Canon MOV Decoder) (Version: 1.9.0.8 - Canon Inc.) Canon MOV Encoder (HKLM-x32\...\Canon MOV Encoder) (Version: 1.8.0.1 - Canon Inc.) Canon MovieEdit Task for ZoomBrowser EX (HKLM-x32\...\MovieEditTask) (Version: 3.9.0.6 - Canon Inc.) Canon MP Navigator EX 3.1 (HKLM-x32\...\MP Navigator EX 3.1) (Version: - ) Canon PowerShot ELPH 310 HS_IXUS 230 HS Camera User Guide (HKLM-x32\...\CameraUserGuide-PSELPH310HS_IXUS230HS) (Version: 1.0.0.1 - Canon Inc.) Canon Utilities CameraWindow DC 8 (HKLM-x32\...\CameraWindowDC8) (Version: 8.6.0.11 - Canon Inc.) Canon Utilities CameraWindow Launcher (HKLM-x32\...\CameraWindowLauncher) (Version: 7.6.0.1 - Canon Inc.) Canon Utilities Movie Uploader for YouTube (HKLM-x32\...\MovieUploaderForYouTube) (Version: 1.3.0.3 - Canon Inc.) Canon Utilities MyCamera (HKLM-x32\...\MyCamera) (Version: 7.5.0.1 - Canon Inc.) Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.22.46 - Canon Inc.) Canon Utilities Solution Menu (HKLM-x32\...\CanonSolutionMenu) (Version: - ) Canon Utilities ZoomBrowser EX (HKLM-x32\...\ZoomBrowser EX) (Version: 6.8.0.10 - Canon Inc.) Canon ZoomBrowser EX Memory Card Utility (HKLM-x32\...\ZoomBrowser EX Memory Card Utility) (Version: 1.6.0.15 - Canon Inc.) CanoScan 9000F Scanner Driver (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_CNQ9602) (Version: - ) Catalina Savings Printer (HKLM-x32\...\{4956ACE3-F537-4418-BB45-FD52395275A7}) (Version: 1.0.0 - Catalina Marketing Corp) <==== ATTENTION CCleaner (HKLM\...\CCleaner) (Version: 3.11 - Piriform) Click-N-Ship for Business® (HKLM-x32\...\{15C77FC3-8137-4A5E-8F81-F559045DD6B0}) (Version: 4.1.450.0 - United States Postal Service) Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Coupon Printer for Windows (HKLM-x32\...\Coupon Printer for Windows5.0.0.7) (Version: 5.0.0.7 - Coupons.com Incorporated) CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2325a - CyberLink Corp.) CyberLink Power2Go (x32 Version: 6.0.2325a - CyberLink Corp.) Hidden D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden Disketch CD Label Software (HKLM-x32\...\Disketch) (Version: - NCH Software) Easy-WebPrint (HKLM-x32\...\Easy-WebPrint) (Version: - ) EPSON Artisan 720 Series Printer Uninstall (HKLM\...\EPSON Artisan 720 Series) (Version: - SEIKO EPSON Corporation) Epson CreativeZone (HKLM-x32\...\{E6C82F8F-2031-4825-8CC3-98C5960875C1}) (Version: - ) Epson Event Manager (HKLM-x32\...\{03B8AA32-F23C-4178-B8E6-09ECD07EAA47}) (Version: 2.40.0001 - SEIKO EPSON CORPORATION) Epson Print CD (HKLM-x32\...\{D16A31F9-276D-4968-A753-FFEAC56995D0}) (Version: 2.00.00 - SEIKO EPSON CORPORATION) EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version: - Seiko Epson Corporation) EpsonNet Print (HKLM-x32\...\{3E31400D-274E-4647-916C-2CACC3741799}) (Version: 2.4i - SEIKO EPSON CORPORATION) EpsonNet Setup 3.2 (HKLM-x32\...\{C9D8A041-2963-4B31-8FFC-1500F3DB9293}) (Version: 3.2a - SEIKO EPSON CORPORATION) Fisher-Price Music Player (HKLM-x32\...\InstallShield_{DE6DBCE8-05B1-49BF-BB0F-D1C8C49FB1EA}) (Version: 1.0.0.33 - Fisher-Price) Fisher-Price Music Player (x32 Version: 1.0.0.33 - Fisher-Price) Hidden FlipShare (HKLM-x32\...\{97C658D2-61FB-027F-0D76-E9CDC84AFEC7}) (Version: 5.12.3.0 - Flip Video) Gateway Photo Frame 4.2.2.7 (HKLM-x32\...\Gateway Photo Frame) (Version: 4.2.2.7 - I/O Interconnect) Gateway Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.00.3006 - Acer Incorporated) Google Chrome (HKLM-x32\...\Google Chrome) (Version: 36.0.1985.125 - Google Inc.) Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google) Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.) Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden In Context Solutions 3D Virtual Store (HKLM-x32\...\{24450378-B34B-4F83-AFFE-FEC645A10551}_is1) (Version: 1.1 - In Context Solutions, LLC) Intel® Graphics Media Accelerator Driver (HKLM\...\HDMI) (Version: - Intel Corporation) Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation) Internet Transporter - NCP Link (HKLM-x32\...\{92BF38A8-5616-4209-87A3-D910B45A1D98}) (Version: 3.2.1 - National Consumer Panel) IrfanView (remove only) (HKLM-x32\...\IrfanView) (Version: 4.27 - Irfan Skiljan) Java 7 Update 65 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.650 - Oracle) Java Auto Updater (x32 Version: 2.1.65.20 - Oracle, Inc.) Hidden Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden KB0817 Keyboard Driver (HKLM-x32\...\{ED5DCA6F-5FEA-47CB-83DB-210A468C298B}) (Version: 1.30.0000 - Gateway) LeapFrog Connect (HKLM-x32\...\UPCShell) (Version: 4.0.33.15045 - LeapFrog) LeapFrog Connect (x32 Version: 4.0.33.15045 - LeapFrog) Hidden LeapFrog LeapPad Explorer Plugin (x32 Version: 4.1.7.15314 - LeapFrog) Hidden Lexia Reading (HKLM-x32\...\Lexia Reading 9.0.0) (Version: 9.0.0 - Lexia Learning Systems, Inc.) LTCM Client (HKLM-x32\...\LTCM Client) (Version: - Leader Technologies Inc.) Malwarebytes Anti-Malware version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation) Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation) McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.) Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation) Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation) Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden Microsoft Money Essentials (HKLM-x32\...\Money2007b) (Version: 16 - Microsoft) Microsoft Money Shared Libraries (x32 Version: 16.0.0.705 - Microsoft Corporation) Hidden Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft) Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation) Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office PowerPoint Viewer 2007 (English) (HKLM-x32\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Office Suite Activation Assistant (HKLM-x32\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation) Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation) Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation) Microsoft VC9 runtime libraries (x32 Version: 1.0.0 - AOL Inc.) Hidden Microsoft VC9 runtime libraries (x32 Version: 1.0.0 - AOL LLC) Hidden Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}) (Version: 8.0.59192 - Microsoft Corporation) Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation) Microsoft Works (HKLM-x32\...\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation) MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden MSXML 4.0 SP2 (KB927978) (HKLM-x32\...\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}) (Version: 4.20.9841.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation) MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation) NCP Internet Transporter (HKLM-x32\...\{7CEB5AC4-B6F8-414C-845D-4295C125D17B}) (Version: 3.2.1 - National Consumer Panel) Nero - Burning Rom (HKLM-x32\...\{A4D7B764-4140-11D4-88EB-0050DA3579C0}) (Version: 5.5.3.0 - ahead software gmbh) OmniPage SE 2.0 (HKLM-x32\...\{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}) (Version: 2.00.0004 - ScanSoft, Inc.) P@H-Protocol (HKLM-x32\...\{CF594DB8-CFB0-45B4-86DA-8BB4AC0941F8}) (Version: 3.0.7.0 - Valassis) PlayReady PC runtime (HKLM\...\{704ABF63-B0B1-446B-9D92-C5D06AFCE7B6}) (Version: 1 - Microsoft Corporation) Presto! PageManager 7.15.11 (HKLM-x32\...\{EA52A1AC-D35D-4D25-8686-9466FE2C5CE5}) (Version: - ) Price Check by AOL (HKLM-x32\...\Price Check by AOL) (Version: 1.11.1.2 - AOL Inc.) QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.) RealDownloader (x32 Version: 1.3.3 - RealNetworks, Inc.) Hidden RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.3 - RealNetworks) Registry Mechanic 10.0 (HKLM-x32\...\Registry Mechanic_is1) (Version: 10.0 - PC Tools) Seagate Manager Installer (HKLM-x32\...\InstallShield_{E6F019F1-DFB6-4853-A87D-6E31624755A9}) (Version: 2.02.0109 - Seagate) Seagate Manager Installer (x32 Version: 2.02.0109 - Seagate) Hidden Segoe UI (x32 Version: 15.4.2271.0615 - Microsoft Corp) Hidden Shopping InContext (HKCU\...\{4E002314-9999-4402-9823-1CB9E6098849}_is1) (Version: 3.5 - InContext Solutions, Inc) Slingo Deluxe (HKLM-x32\...\Slingo Deluxe) (Version: 1.0.12 - funkitron) swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden Symphony Mathematics version 6.02 (HKLM-x32\...\Symphony Mathematics_is1) (Version: - Symphony Learning, Inc.) Trend Micro Titanium (Version: 7.0 - Trend Micro Inc.) Hidden Trend Micro Titanium Internet Security (HKLM\...\{ABBD4BA8-6703-40D2-AB1E-5BB1F7DB49A4}) (Version: 7.0 - Trend Micro Inc.) Tweaking.com - Windows Repair (All in One) (HKLM-x32\...\Tweaking.com - Windows Repair (All in One)) (Version: 2.8.4 - Tweaking.com) Uninstall AOL Emergency Connect Utility 1.0 (HKLM-x32\...\AOL Emergency Connect Utility 1.0) (Version: - ) Unity Web Player (HKCU\...\UnityWebPlayer) (Version: - Unity Technologies ApS) Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft) Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation) Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft) Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version: - Microsoft) Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version: - Microsoft) Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version: - Microsoft) Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft) Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version: - Microsoft) Use the entry named LeapFrog Connect to uninstall (LeapFrog LeapPad Explorer Plugin) (HKLM-x32\...\LeapPadExplorerPlugin) (Version: - LeapFrog) Viewpoint Media Player (HKLM-x32\...\ViewpointMediaPlayer) (Version: - ) ViewSonic Monitor Drivers (HKLM-x32\...\{B4FEA924-630D-11D4-B78E-005004566E4D}) (Version: - ) Vz In-Home Agent (HKLM-x32\...\VzInHomeAgent) (Version: 9.0.55.0 - Verizon) Windows Driver Package - FTDI CDM Driver Package (02/17/2009 2.04.16) (HKLM\...\2DC0AA065FA83047D7ECD51C7000C1620D79A4C5) (Version: 02/17/2009 2.04.16 - FTDI) Windows Driver Package - FTDI CDM Driver Package (02/17/2009 2.04.16) (HKLM\...\51A4D522DD31538335EF5736F0E7F588C70BCB12) (Version: 02/17/2009 2.04.16 - FTDI) Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012) (HKLM\...\8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D) (Version: 09/10/2009 02.03.05.012 - Leapfrog) Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation) Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Language Selector (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live PIMT Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Sync (HKLM-x32\...\{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}) (Version: 14.0.8089.726 - Microsoft Corporation) Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live UX Platform Language Pack (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden YTD Video Downloader 4.6 (HKLM-x32\...\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}) (Version: 4.6 - GreenTree Applications SRL) ZyXEL G-220v3 Wireless USB Adapter Utility (HKLM-x32\...\{29DFAB41-7D73-4E92-9329-FB1ECBD2EF83}) (Version: 1.00.0000 - ZyXEL) ==================== Custom CLSID (selected items): ========================== (If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.) CustomCLSID: HKU\S-1-5-21-770997747-1975351657-1911745460-1000_Classes\CLSID\{9000834c-c6c7-43ac-b8ee-dc9668f39a81}\localserver32 -> C:\Users\Melissa\AppData\Local\Temp\{91814ec0-b5f0-11d2-80b9-00104b1f6cea}\IDriver.NonElevated.exe N (the data entry has 6 more characters). ==================== Restore Points ========================= 11-07-2014 15:23:50 Scheduled Checkpoint 12-07-2014 04:00:04 Scheduled Checkpoint 12-07-2014 23:03:47 Scheduled Checkpoint 13-07-2014 23:30:05 Scheduled Checkpoint 14-07-2014 14:26:18 Scheduled Checkpoint 15-07-2014 18:35:46 Scheduled Checkpoint 16-07-2014 23:11:57 Scheduled Checkpoint 18-07-2014 00:25:57 Scheduled Checkpoint 19-07-2014 04:00:03 Scheduled Checkpoint 21-07-2014 15:09:07 Scheduled Checkpoint 21-07-2014 17:53:59 Installed Java 7 Update 65 22-07-2014 16:38:25 Scheduled Checkpoint 23-07-2014 22:49:08 Scheduled Checkpoint 24-07-2014 00:14:04 Windows Update 25-07-2014 01:06:40 Scheduled Checkpoint 26-07-2014 04:18:14 Scheduled Checkpoint 26-07-2014 16:22:16 Scheduled Checkpoint 28-07-2014 00:32:25 Scheduled Checkpoint 28-07-2014 17:39:40 Scheduled Checkpoint 29-07-2014 02:52:14 Removed Ask Toolbar. 29-07-2014 02:53:40 Removed Catalina Savings Printer. 29-07-2014 02:57:32 Removed Catalina Savings Printer. 29-07-2014 02:58:41 Removed YTD Toolbar v9.3. 29-07-2014 03:03:50 Removed Catalina Savings Printer. 29-07-2014 20:53:46 Scheduled Checkpoint 30-07-2014 22:40:01 Scheduled Checkpoint 31-07-2014 10:15:20 Tweaking.com - Windows Repair ==================== Hosts content: ========================== (If needed Hosts: directive could be included in the fixlist to reset Hosts.) 2006-11-02 08:34 - 2014-07-31 06:26 - 00000855 ____A C:\Windows\system32\Drivers\etc\hosts 127.0.0.1 localhost ==================== Scheduled Tasks (whitelisted) ============= (If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.) Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM Task: {0B04AFCA-8D54-4447-92AE-9599EBC22358} - System32\Tasks\Leader Technologies\LTCM Client\New Message Check - Melissa => C:\Program Files (x86)\LTCM Client\ltcmClient.exe [2009-08-05] (Leader Technologies Inc.) Task: {0D3F70F9-6434-4402-B73C-8B528596AFD9} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-01] (Google Inc.) Task: {17FD7FCA-7CF1-4924-B381-607A167E4986} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation) Task: {409E7277-5D35-4BE8-B35B-BD8D5C4988C5} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-07-01] (Google Inc.) Task: {458C5283-C971-41F6-B57E-F4080A3A1CAA} - System32\Tasks\Acer\Burn Notification => C:\Program Files\Gateway\Gateway Recovery Management\NotificationCenter\Notification.exe [2009-02-25] (Acer) Task: {4E4FEE25-2950-491B-8E33-12303701E2A9} - System32\Tasks\RealDownloaderDownloaderScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\recordingmanager.exe [2013-08-14] (RealNetworks, Inc.) Task: {60D7968F-3138-484C-B83B-B9EFDA5FC1E0} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe Task: {61587307-5B52-401F-A0B6-F751FA101C10} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {662F757B-13CD-436A-AA37-4C1B976FF848} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe Task: {67414571-08EB-4C47-A73C-1F712B9FAB6E} - System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.) Task: {718C06AD-2F17-44A9-9444-4C14F6CE4F80} - System32\Tasks\NCH Software\disketchShakeIcon => C:\Program Files (x86)\NCH Software\Disketch\Disketch.exe Task: {74C59BD0-3557-480A-9B23-05F0B4BC65EB} - System32\Tasks\Titanium BTC => C:\Program Files\Trend Micro\Titanium\plugin\TMDC\TMDC.exe [2014-05-09] (Trend Micro Inc.) Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI Task: {8A99596F-E655-4AA4-9E78-03E61B9AB575} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation) Task: {8EEBE1A3-27C1-4593-B2C4-3C2465B09932} - System32\Tasks\RMSmartUpdate => C:\Program Files (x86)\Registry Mechanic\update.exe Task: {D8631574-4537-4772-B7B8-409B8E3B1C91} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup Task: {E6CA3B30-BC97-4663-91F3-F3BDCC70D84D} - System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\RealNetworks\RealDownloader\realupgrade.exe [2013-08-14] (RealNetworks, Inc.) Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] () Task: {F50A156A-49FB-4AE5-96C4-F85466FDD35C} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-20] (Microsoft Corporation) Task: {FD1177C0-7F46-4D90-929A-E29FCEC70787} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe Task: {FE729E00-D28E-4133-BFB4-9E6F73061300} - System32\Tasks\MHotkey => C:\Windows\MHotKey.exe [2008-05-30] () Task: {FFA654E0-F932-45C6-BA6C-4F94FFE3CB8F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe ==================== Loaded Modules (whitelisted) ============= 2014-04-07 20:04 - 2013-01-15 22:19 - 00048128 _____ () C:\Program Files\Trend Micro\AMSP\boost_date_time-vc110-mt-1_49.dll 2014-04-07 20:04 - 2013-04-02 00:25 - 00675840 _____ () C:\Program Files\Trend Micro\AMSP\sqlite3.dll 2014-04-07 20:04 - 2013-01-15 22:23 - 00058368 _____ () C:\Program Files\Trend Micro\AMSP\boost_thread-vc110-mt-1_49.dll 2014-04-07 20:04 - 2012-12-18 16:06 - 01300480 _____ () C:\Program Files\Trend Micro\AMSP\libprotobuf.dll 2014-04-07 20:04 - 2013-01-15 22:19 - 00018944 _____ () C:\Program Files\Trend Micro\AMSP\boost_system-vc110-mt-1_49.dll 2014-04-07 19:33 - 2013-07-23 11:28 - 00247352 _____ () C:\Program Files\Trend Micro\UniClient\plugins\LUADLL.dll 2011-05-06 13:07 - 2011-05-06 13:07 - 00460144 _____ () C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe 2011-05-06 12:58 - 2011-05-06 12:58 - 01085440 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe 2013-08-14 15:19 - 2013-08-14 15:19 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe 2009-04-02 04:22 - 2008-05-30 13:50 - 00581120 _____ () C:\Windows\MHotKey.exe 2010-10-26 00:06 - 2010-10-26 00:06 - 02248704 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtCore4.dll 2011-05-06 13:07 - 2011-05-06 13:07 - 04317184 _____ () C:\Program Files (x86)\Flip Video\FlipShare\Core.dll 2011-05-06 13:02 - 2011-05-06 13:02 - 00737280 _____ () C:\Program Files (x86)\Flip Video\FlipShare\qca2.dll 2010-10-26 00:23 - 2010-10-26 00:23 - 08351744 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtGui4.dll 2010-10-26 00:08 - 2010-10-26 00:08 - 00983040 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtNetwork4.dll 2010-10-26 00:23 - 2010-10-26 00:23 - 00204800 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtSql4.dll 2010-10-26 00:06 - 2010-10-26 00:06 - 00364544 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtXml4.dll 2010-10-26 08:34 - 2010-10-26 08:34 - 11853824 _____ () C:\Program Files (x86)\Flip Video\FlipShare\QtWebKit4.dll 2010-10-26 00:37 - 2010-10-26 00:37 - 00258048 _____ () C:\Program Files (x86)\Flip Video\FlipShare\phonon4.dll 2010-05-20 13:49 - 2010-05-20 13:49 - 00258048 _____ () C:\Program Files (x86)\Flip Video\FlipShare\boost_serialization-vc80-mt-1_43.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 01199104 _____ () C:\Program Files (x86)\Flip Video\FlipShare\PocoFoundation.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00642048 _____ () C:\Program Files (x86)\Flip Video\FlipShare\PocoNet.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00511488 _____ () C:\Program Files (x86)\Flip Video\FlipShare\PocoXML.dll 2010-10-26 00:06 - 2010-10-26 00:06 - 02248704 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\QtCore4.dll 2010-10-26 00:08 - 2010-10-26 00:08 - 00983040 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\QtNetwork4.dll 2010-10-26 00:23 - 2010-10-26 00:23 - 00204800 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\QtSql4.dll 2010-05-20 13:49 - 2010-05-20 13:49 - 00258048 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\boost_serialization-vc80-mt-1_43.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 01199104 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoFoundation.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00642048 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoNet.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00175616 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoNetSSL.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00291840 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoUtil.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00511488 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoXML.dll 2010-05-17 09:47 - 2010-05-17 09:47 - 00110592 _____ () C:\Program Files (x86)\Flip Video\FlipShareServer\PocoCrypto.dll 2009-05-01 14:35 - 2009-05-01 14:35 - 00066856 _____ () C:\Program Files (x86)\Seagate\SeagateManager\Sync\ExtensionFilter.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00048640 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\zlib.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 21151744 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libcef.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00648704 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libglesv2.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00122880 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\libegl.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00094208 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\Components\Tier2Svc.dll 2014-06-05 17:31 - 2014-06-05 17:31 - 00060928 _____ () C:\Program Files (x86)\AOL Desktop 9.7b\Components\DataSvcs.dll 2014-07-08 20:57 - 2014-07-08 20:57 - 17029808 _____ () C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll ==================== Alternate Data Streams (whitelisted) ========= (If an entry is included in the fixlist, only the Alternate Data Streams will be removed.) AlternateDataStreams: C:\ProgramData\Temp:D1B5B4F1 AlternateDataStreams: C:\Users\Melissa\Desktop\Documents\2010-03-31 19 58 12.AVI:TOC.WMV ==================== Safe Mode (whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.) ==================== EXE Association (whitelisted) ============= (If an entry is included in the fixlist, the default will be restored. None default entries will be removed.) ==================== MSCONFIG/TASK MANAGER disabled items ========= (Currently there is no automatic fix for this section.) MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk => C:\Windows\pss\McAfee Security Scan Plus.lnk.CommonStartup MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^ZyXEL G-220v3 Wireless USB Adapter Utility.lnk => C:\Windows\pss\ZyXEL G-220v3 Wireless USB Adapter Utility.lnk.CommonStartup MSCONFIG\startupreg: Amazon Music => "C:\Users\Melissa\AppData\Local\Amazon Music\Amazon Music Helper.exe" MSCONFIG\startupreg: Artisan 720(Network) => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGYA.EXE /FU "C:\Windows\TEMP\E_SEBA5.tmp" /EF "HKCU" MSCONFIG\startupreg: EEventManager => "C:\Program Files (x86)\Epson Software\Event Manager\EEventManager.exe" MSCONFIG\startupreg: EPSON Artisan 720 Series => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGYA.EXE /FU "C:\Windows\TEMP\E_S33EB.tmp" /EF "HKCU" MSCONFIG\startupreg: EPSON8D005F (Artisan 720) => C:\Windows\system32\spool\DRIVERS\x64\3\E_IATIGYA.EXE /FU "C:\Windows\TEMP\E_S2A4A.tmp" /EF "HKCU" MSCONFIG\startupreg: Launch Kid-Touch Music Player Middleware => "C:\Program Files (x86)\Fisher-Price\Music Player\MP_Middleware.exe" MSCONFIG\startupreg: MegaPanel => "C:\Program Files (x86)\National Consumer Panel\NCP Internet Transporter\HSTrans.exe" MSCONFIG\startupreg: msnmsgr => "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background MSCONFIG\startupreg: NeroCheck => C:\Windows\SysWOW64\NeroCheck.exe MSCONFIG\startupreg: OpwareSE2 => "C:\Program Files (x86)\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime MSCONFIG\startupreg: Slick Savings => "C:\Users\Melissa\AppData\Roaming\Slick Savings\CouponsHelper.exe" MSCONFIG\startupreg: TkBellExe => "C:\Program Files (x86)\real\realplayer\update\realsched.exe" -osboot ==================== Faulty Device Manager Devices ============= Name: Intel® 82567V-2 Gigabit Network Connection Description: Intel® 82567V-2 Gigabit Network Connection Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: Intel Service: e1yexpress Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. Name: E:\ Description: Compact Flash Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a} Manufacturer: Generic- Service: WUDFRd Problem: : Windows cannot initialize the device driver for this hardware. (Code 37) Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver. Name: F:\ Description: Flash Reader Class Guid: {eec5ad98-8080-425f-922a-dabf3de3f69a} Manufacturer: Multiple Service: WUDFRd Problem: : Windows cannot initialize the device driver for this hardware. (Code 37) Resolution: The driver returned failure from its DriverEntry routine. Uninstall the driver, and then click "Scan for hardware changes" to reinstall or upgrade the driver. ==================== Event log errors: ========================= Application errors: ================== Error: (08/01/2014 05:40:38 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/01/2014 01:42:04 PM) (Source: System Restore) (EventID: 8210) (User: ) Description: The scheduled restore point could not be created. Additional information: (0x8000ffff). Error: (08/01/2014 01:42:04 PM) (Source: System Restore) (EventID: 8193) (User: ) Description: Failed to create restore point on volume (Process = C:\Windows\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation; Descripton = Scheduled Checkpoint; Hr = 0x8000ffff). Error: (08/01/2014 01:42:04 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80070057. Operation: Abort Backup Context: Execution Context: Requestor Current State: SnapshotSetCreated Error: (08/01/2014 01:42:04 PM) (Source: VSS) (EventID: 13) (User: ) Description: Volume Shadow Copy Service information: The COM Server with CLSID {faf53cc4-bd73-4e36-83f1-2b23f46e513e} and name VSSEvent cannot be started. [0x80070057] Operation: Abort Backup Context: Execution Context: Requestor Current State: SnapshotSetCreated Error: (08/01/2014 01:42:04 PM) (Source: VSS) (EventID: 8193) (User: ) Description: Volume Shadow Copy Service error: Unexpected error calling routine CoCreateInstance. hr = 0x80040154. Operation: Gathering Writer Data Executing Asynchronous Operation Context: Execution Context: Requestor Current State: GatherWriterMetadata Error: (08/01/2014 01:42:04 PM) (Source: VSS) (EventID: 34) (User: ) Description: Volume Shadow Copy Service error: The VSS event class is not registered. This will prevent any VSS writers from receiving events. This may be caused due to a setup failure or as a result of an application's installer or uninstaller. Operation: Gathering Writer Data Executing Asynchronous Operation Context: Execution Context: Requestor Current State: GatherWriterMetadata Error: (08/01/2014 00:27:53 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/01/2014 00:00:52 PM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (08/01/2014 11:41:32 AM) (Source: WinMgmt) (EventID: 10) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Error: (08/01/2014 05:40:40 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 00:27:57 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 00:00:52 PM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 11:41:45 AM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 11:41:32 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: MBAMScheduler%%1053 Error: (08/01/2014 11:41:32 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: 30000MBAMScheduler Error: (08/01/2014 11:23:58 AM) (Source: Service Control Manager) (EventID: 7026) (User: ) Description: Beep i8042prt Error: (08/01/2014 11:23:54 AM) (Source: Service Control Manager) (EventID: 7000) (User: ) Description: FlipShare Service%%1053 Error: (08/01/2014 11:23:54 AM) (Source: Service Control Manager) (EventID: 7009) (User: ) Description: 30000FlipShare Service Error: (08/01/2014 10:59:10 AM) (Source: Ntfs) (EventID: 137) (User: ) Description: The default transaction resource manager on volume G: encountered a non-retryable error and could not start. The data contains the error code. Microsoft Office Sessions: ========================= Error: (01/08/2012 10:42:25 AM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6600.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 128 seconds with 120 seconds of active time. This session ended with a crash. Error: (12/08/2011 09:20:29 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2014-08-01 17:49:26.511 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 17:49:26.293 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 17:49:26.075 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 17:49:25.856 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 17:48:34.382 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 17:48:34.116 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 17:48:33.898 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-08-01 17:48:33.664 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-07-31 19:37:20.206 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. Date: 2014-07-31 19:37:19.956 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mwac.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 46% Total physical RAM: 4060.26 MB Available physical RAM: 2186.23 MB Total Pagefile: 8329.81 MB Available Pagefile: 6104.84 MB Total Virtual: 8192 MB Available Virtual: 8191.87 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:583.17 GB) (Free:351.43 GB) NTFS ==>[Drive with boot components (obtained from BCD)] Drive g: (FreeAgent Drive) (Fixed) (Total:298.09 GB) (Free:78.92 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596 GB) (Disk ID: CD6556B4) Partition 1: (Not Active) - (Size=13 GB) - (Type=27) Partition 2: (Active) - (Size=583 GB) - (Type=07 NTFS) ======================================================== Disk: 3 (Size: 298 GB) (Disk ID: A4B57300) Partition 1: (Not Active) - (Size=298 GB) - (Type=07 NTFS) ==================== End Of Log ============================
  13. Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 31-07-2014 02 Ran by Melissa (administrator) on MELISSA-PC on 01-08-2014 17:49:21 Running from C:\Users\Melissa\Desktop Platform: Windows Vista Home Premium Service Pack 2 (X64) OS Language: English (United States) Internet Explorer Version 9 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (Microsoft Corporation) C:\Windows\System32\SLsvc.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiWatchDog.exe (SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\AMSP\coreFrameworkHost.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe (Agere Systems) C:\Program Files\LSI SoftModem\agr64svc.exe (Coupons.com Inc.) C:\Program Files (x86)\Coupons\CouponPrinterService.exe (Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe (Microsoft Corporation) C:\Windows\ehome\ehsched.exe () C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe () C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe (Seagate Technology LLC) C:\Program Files (x86)\Seagate\SeagateManager\Sync\FreeAgentService.exe (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE () C:\Windows\mHotkey.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (ArcSoft Inc.) C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe (Chicony) C:\Windows\ChiFuncExt.exe (LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe (PC Tools) C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe (Seagate LLC) C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\stxmenumgr.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\1275861383\ee\aolsoftware.exe (Creative) C:\Windows\CNYHKey.exe (Seagate Technology LLC) C:\Program Files (x86)\Seagate\SeagateManager\Sync\MaxSync.exe (Trend Micro Inc.) C:\Program Files\Trend Micro\UniClient\UiFrmwrk\uiSeAgnt.exe (Chicony) C:\Windows\ModLEDKey.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\waol.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\acs\AOLacsd.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\shellmon.exe (AOL Inc.) C:\Program Files (x86)\Common Files\aol\TopSpeed\3.0\aoltpsd3.exe (AOL Inc.) C:\Program Files (x86)\AOL Desktop 9.7b\aolbrowser.exe (Microsoft Corporation) C:\Windows\System32\dllhost.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [Trend Micro Client Framework] => C:\Program Files\Trend Micro\UniClient\UiFrmWrk\UIWatchDog.exe [229824 2013-10-09] (Trend Micro Inc.) HKLM\...\Run: [CanonSolutionMenu] => C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe [767312 2009-09-03] (CANON INC.) HKLM\...\Run: [iAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-09-12] (Intel Corporation) HKLM-x32\...\Run: [sunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-11] (Oracle Corporation) HKLM-x32\...\Run: [ArcSoft Connection Service] => C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-09-13] (Apple Inc.) HKLM-x32\...\Run: [Monitor] => C:\Program Files (x86)\LeapFrog\LeapFrog Connect\Monitor.exe [295304 2012-07-05] (LeapFrog Enterprises, Inc.) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [LTCM Client] => C:\Program Files (x86)\LTCM Client\ltcmClient.exe [1596096 2009-08-05] (Leader Technologies Inc.) HKLM-x32\...\Run: [sSDMonitor] => C:\Program Files (x86)\Common Files\PC Tools\sMonitor\SSDMonitor.exe [112600 2010-11-15] (PC Tools) HKLM-x32\...\Run: [MaxMenuMgr] => C:\Program Files (x86)\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe [185640 2009-05-01] (Seagate LLC) HKLM-x32\...\Run: [HostManager] => C:\Program Files (x86)\Common Files\AOL\1275861383\ee\AOLSoftware.exe [41800 2010-03-08] (AOL Inc.) HKLM-x32\...\Run: [LedKey] => C:\Windows\CNYHKey.exe [339968 2008-04-23] (Creative) HKLM-x32\...\Run: [LchDrvKey] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] () Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-770997747-1975351657-1911745460-1000\...\Run: [AOL Fast Start] => C:\Program Files (x86)\AOL Desktop 9.7b\AOL.EXE [72296 2014-06-05] (AOL Inc.) HKU\S-1-5-21-770997747-1975351657-1911745460-1000\...\Policies\Explorer: [NoDesktopCleanupWizard] 1 ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x1C520D3D7F3DCB01 HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = about:blank HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=0610&m=sx2800 URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - No File URLSearchHook: HKLM-x32 - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File URLSearchHook: HKCU - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - No File URLSearchHook: HKCU - AOL Toolbar Search Class - {f0e98552-8e47-4c6c-9b3a-11ab0549f94d} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW SearchScopes: HKLM-x32 - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm423^S09999^us&si=245051_US-B-GDD1&ptb=D9CD2D74-D48E-42BB-9892-22D245D108B8&ind=2014062008&n=780c25b8&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - DefaultScope {B5EB76EB-459D-4DC0-B6EC-8A9D204407F1} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} SearchScopes: HKCU - {1EB6F07C-4A8F-4EAD-9125-9BFAECDC2888} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3196716 SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW SearchScopes: HKCU - {b0441a0e-a49a-4e16-afc1-74ecced1921f} URL = http://search.tb.ask.com/search/GGmain.jhtml?p2=^UX^xdm423^S09999^us&si=245051_US-B-GDD1&ptb=D9CD2D74-D48E-42BB-9892-22D245D108B8&ind=2014062008&n=780c25b8&psa=&st=sb&searchfor={searchTerms} SearchScopes: HKCU - {B5EB76EB-459D-4DC0-B6EC-8A9D204407F1} URL = https://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=937811&p={searchTerms} BHO: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.) BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe64.dll (Trend Micro Inc.) BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: TmIEPlugInBHO Class -> {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -> C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg32.dll (Trend Micro Inc.) BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader) BHO-x32: AOL Toolbar Loader -> {3ef64538-8b54-4573-b48f-4d34b0238ab2} -> C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File BHO-x32: EWPBrowseObject Class -> {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} -> C:\Program Files (x86)\Canon\Easy-WebPrint\EWPBrowseLoader.dll () BHO-x32: Java Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: TmBpIeBHO Class -> {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} -> C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe32.dll (Trend Micro Inc.) BHO-x32: Price Check by AOL -> {D25B97E9-62B2-40CE-BECF-E43A7B879072} -> C:\Program Files (x86)\Price Check by AOL\aolpricecheck.dll (AOL Inc.) BHO-x32: Java Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM-x32 - AOL Toolbar - {ba00b7b1-0351-477a-b948-23e3ee5a73d4} - C:\Program Files (x86)\AOL Toolbar\aoltb.dll No File Toolbar: HKCU - AOL Toolbar - {BA00B7B1-0351-477A-B948-23E3EE5A73D4} - No File DPF: HKLM-x32 {BEA7310D-06C4-4339-A784-DC3804819809} http://www.cvsphoto.com/upload/activex/v3_0_0_7/PhotoCenter_ActiveX_Control.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe64.dll (Trend Micro Inc.) Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg.dll (Trend Micro Inc.) Handler: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - No File Handler-x32: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\TmBpIe32.dll (Trend Micro Inc.) Handler-x32: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - C:\Program Files\Trend Micro\AMSP\module\20004\3.0.1313\6.8.1120\TmIEPlg32.dll (Trend Micro Inc.) Handler-x32: tmtbim - {0B37915C-8B98-4B9E-80D4-464D2C830D10} - C:\Program Files\Trend Micro\Titanium\UIFramework\ProToolbarIMRatingActiveX.dll (Trend Micro Inc.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_145.dll () FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_145.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.65.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll (Microsoft Corp.) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF Plugin-x32: @real.com/nppl3260;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.3 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpchromebrowserrecordext;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprphtml5videoshim;version=15.0.4.53 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF Plugin-x32: @real.com/nprpplugin;version=16.0.3.51 - c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer) FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @viewpoint.com/VMP - C:\Program Files (x86)\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll () FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Melissa\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin1017325.dll (Amazon.com, Inc.) FF Plugin HKCU: CouponNetwork.com/CMDUniversalCouponPrintActivator - C:\Users\Melissa\AppData\Roaming\CATALI~2\NPBCSK~1.DLL (Catalina Marketing Corporation) FF HKLM\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension FF Extension: Trend Micro BEP Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension [2014-04-24] FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2010-06-06] FF HKLM-x32\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-10-09] FF HKLM-x32\...\Firefox\Extensions: [{38783831-6098-4faa-A9C9-1EE1E343F4D2}] - C:\Program Files\Trend Micro\AMSP\Module\20002\7.1.1104\7.1.1104\firefoxextension FF HKLM-x32\...\Firefox\Extensions: [{DF153AFF-6948-45d7-AC98-4FC4AF8A08E2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext FF HKLM-x32\...\Firefox\Extensions: [tmbepff@trendmicro.com] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1170\8.0.1170\firefoxextension FF HKLM-x32\...\Firefox\Extensions: [{22C7F6C6-8D67-4534-92B5-529A0EC09405}] - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension FF Extension: Trend Micro NSC Firefox Extension - C:\Program Files\Trend Micro\AMSP\module\20004\FxExt\firefoxextension [2014-04-24] Chrome: ======= CHR HomePage: CHR RestoreOnStartup: "hxxp://search.yahoo.com?type=937811&fr=spigot-yhp-ch", "hxxp://www.google.com/" CHR DefaultSearchKeyword: slirsredirect.search.aol.com CHR DefaultSearchProvider: AOL Search CHR DefaultSearchURL: http://slirsredirect.search.aol.com/redirector/sredir?sredir=843&query={searchTerms}&invocationType=tb50-ie-aolTB50CL-chromesbox-en-us CHR Extension: (Weatherbug Toolbar) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\aaaaodccgghcfficmpomnifhhlmlbfef [2013-07-07] CHR Extension: (TrendMicro BEP Extension) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\bmiabdepfhhiieiipmeecdmeljggmfee [2013-07-07] CHR Extension: (RealDownloader) - C:\Users\Melissa\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2013-07-07] CHR HKLM-x32\...\Chrome\Extension: [bmiabdepfhhiieiipmeecdmeljggmfee] - C:\Program Files\Trend Micro\AMSP\module\20002\8.0.1135\8.0.1135\chrome_tmbep.crx [2013-07-07] CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-08-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.) R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agr64svc.exe [16896 2008-08-26] (Agere Systems) R2 CouponPrinterService; C:\Program Files (x86)\Coupons\CouponPrinterService.exe [176624 2014-02-13] (Coupons.com Inc.) R2 EpsonBidirectionalService; C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSVC.exe [94208 2006-12-19] (SEIKO EPSON CORPORATION) [File not signed] R2 FlipShare Service; C:\Program Files (x86)\Flip Video\FlipShare\FlipShareService.exe [460144 2011-05-06] () R2 FlipShareServer; C:\Program Files (x86)\Flip Video\FlipShareServer\FlipShareServer.exe [1085440 2011-05-06] () [File not signed] R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation) S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.) R2 PCToolsSSDMonitorSvc; C:\Program Files (x86)\Common Files\PC Tools\sMonitor\StartManSvc.exe [632792 2010-04-08] (PC Tools) R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-08-14] () R2 Amsp; "C:\Program Files\Trend Micro\AMSP\coreServiceShell.exe" coreFrameworkHost.exe -m=rb -dt=60000 -ad -bt=0 [X] S3 TweakingRunAsSystemService; "C:\Program Files (x86)\Tweaking.com\Windows Repair (All in One)\files\tweaking_ras.exe" cmd.exe []/c start /HIGH cmd.exe /c C:\Users\Melissa\AppData\Local\Temp\temp761.bat & exit ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) U5 AppMgmt; C:\Windows\system32\svchost.exe [27648 2008-01-20] (Microsoft Corporation) S1 Beep; No ImagePath R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation) S3 NeroCd2k; C:\Windows\SysWOW64\drivers\NeroCd2k.sys [44227 2001-04-16] (ahead software gmbh im stoeckmaedle 6 76307 karlsbad, germany Fax: ++49-7248-911-888 e-mail: info@nero.com) [File not signed] S3 rt70x64; C:\Windows\System32\DRIVERS\WUSB54Gv4x64.sys [308224 2007-03-11] (Ralink Technology Inc.) R1 tmactmon; C:\Windows\System32\DRIVERS\tmactmon.sys [117312 2013-12-03] (Trend Micro Inc.) R1 tmcomm; C:\Windows\System32\DRIVERS\tmcomm.sys [283160 2013-12-03] (Trend Micro Inc.) R0 TMEBC; C:\Windows\System32\DRIVERS\TMEBC64.sys [50976 2013-07-01] (Trend Micro Inc.) R3 tmeevw; C:\Windows\System32\DRIVERS\tmeevw.sys [100640 2013-06-13] (Trend Micro Inc.) R1 tmevtmgr; C:\Windows\System32\DRIVERS\tmevtmgr.sys [85936 2013-12-03] (Trend Micro Inc.) R3 tmnciesc; C:\Windows\System32\DRIVERS\tmnciesc.sys [303392 2013-05-15] (Trend Micro Inc.) R1 tmtdi; C:\Windows\System32\DRIVERS\tmtdi.sys [105744 2011-08-22] (Trend Micro Inc.) R3 XG762_VS; C:\Windows\System32\DRIVERS\WlanGZG.sys [1041920 2008-10-28] (Atheros Communications, Inc.) S3 ZDCNDIS6a64; C:\Windows\system32\ZDCNDIS6a64.sys [41280 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) S3 ZDCNDIS6a64; C:\Windows\SysWOW64\ZDCNDIS6a64.sys [41280 2008-10-28] (Printing Communications Assoc., Inc. (PCAUSA)) S3 BCMH43XX; system32\DRIVERS\bcmwlhigh664.sys [X] S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 IpInIp; system32\DRIVERS\ipinip.sys [X] S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X] S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X] U2 TMAgent; ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-01 17:48 - 2014-08-01 17:49 - 00024180 _____ () C:\Users\Melissa\Desktop\FRST.txt 2014-08-01 17:48 - 2014-08-01 17:48 - 02094080 _____ (Farbar) C:\Users\Melissa\Desktop\FRST64.exe 2014-08-01 17:40 - 2014-08-01 17:40 - 00000384 _____ () C:\Windows\DCEBOOT.RST 2014-08-01 17:40 - 2014-08-01 17:40 - 00000000 _____ () C:\Windows\DCEBOOT.LOG 2014-08-01 17:38 - 2014-08-01 17:38 - 00231960 _____ () C:\Windows\RegBootClean64.exe 2014-08-01 17:38 - 2014-08-01 17:38 - 00021528 _____ () C:\Windows\DCEBoot64.exe 2014-08-01 12:39 - 2014-08-01 15:23 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-01 11:44 - 2014-08-01 17:40 - 00003370 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-01 11:44 - 2014-08-01 17:40 - 00003240 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-07-31 06:14 - 2014-07-31 06:14 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MELISSA-PC-Microsoft®-Windows-Vista™-Home-Premium-(64-bit).dat 2014-07-31 06:14 - 2014-07-31 06:14 - 00000000 ____D () C:\RegBackup 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-07-30 20:24 - 2014-07-30 20:24 - 00001956 _____ () C:\Users\Melissa\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-30 20:23 - 2014-07-30 20:23 - 09522240 _____ () C:\Users\Melissa\Desktop\tweaking.com_windows_repair_aio_setup.exe 2014-07-30 20:23 - 2014-07-30 20:23 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-29 13:39 - 2014-07-29 13:40 - 02347384 _____ (ESET) C:\Users\Melissa\Desktop\esetsmartinstaller_enu.exe 2014-07-29 09:27 - 2014-07-29 09:27 - 00016582 _____ () C:\ComboFix.txt 2014-07-28 23:54 - 2014-07-29 09:27 - 00000000 ____D () C:\Qoobox 2014-07-28 23:54 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-07-28 23:54 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-07-28 23:54 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe 2014-07-28 23:54 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe 2014-07-28 23:53 - 2014-07-29 09:23 - 00000000 ____D () C:\Windows\erdnt 2014-07-28 23:50 - 2014-07-28 23:50 - 05563277 ____R (Swearware) C:\Users\Melissa\Desktop\ComboFix.exe 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\ProgramData\Viewpoint 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\Program Files (x86)\Viewpoint 2014-07-28 23:19 - 2014-07-31 06:31 - 00001204 _____ () C:\Windows\PFRO.log 2014-07-28 23:15 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll 2014-07-28 23:13 - 2014-07-28 23:43 - 00000000 ____D () C:\AdwCleaner 2014-07-28 23:12 - 2014-07-28 23:12 - 01365551 _____ () C:\Users\Melissa\Desktop\AdwCleaner.exe 2014-07-28 22:38 - 2014-07-28 22:38 - 00001301 _____ () C:\Users\Melissa\Desktop\Documents\quarantine list.txt 2014-07-28 11:17 - 2014-07-28 11:17 - 00072624 _____ () C:\Users\Brooke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-28 10:17 - 2014-08-01 17:49 - 00000000 ____D () C:\FRST 2014-07-28 10:01 - 2014-07-28 10:02 - 00206246 _____ () C:\Users\Melissa\Desktop\Documents\cc_20140728_100144.reg 2014-07-28 01:31 - 2014-07-28 01:31 - 00001149 _____ () C:\Users\Brooke\Desktop\Trend Micro Titanium Internet Security.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000951 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000941 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000936 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Real 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Leader Technologies 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Epson 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Apple Computer 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Google 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Fisher-Price 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\AOL 2014-07-28 01:30 - 2014-07-28 09:46 - 00000000 ____D () C:\Users\Brooke\AppData\Local\VirtualStore 2014-07-28 01:30 - 2014-07-28 01:31 - 00000917 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-07-28 01:30 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke 2014-07-28 01:30 - 2014-07-28 01:30 - 00000020 ___SH () C:\Users\Brooke\ntuser.ini 2014-07-28 01:30 - 2010-06-06 19:48 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Microsoft Help 2014-07-28 01:30 - 2010-06-06 18:37 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Macromedia 2014-07-28 01:30 - 2010-06-05 18:36 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink Power2Go 2014-07-28 01:30 - 2008-01-20 23:20 - 00000000 ___RD () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance 2014-07-28 01:30 - 2008-01-20 23:20 - 00000000 ___RD () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories 2014-07-28 01:02 - 2014-07-28 01:02 - 110331640 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\msert.exe 2014-07-28 00:36 - 2014-07-28 00:36 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{74ED30BA-00C4-413B-83E1-1A8B2B958A60} 2014-07-28 00:27 - 2014-07-28 00:27 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{4B03C2EF-9478-4C62-94BE-0012C9EDDE0D} 2014-07-27 23:29 - 2014-07-27 23:29 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{06C6F07A-6C0C-4519-9CBD-02CDE2F27824} 2014-07-27 23:24 - 2014-07-27 23:24 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{F8A53BEA-5E66-48D8-9A0F-ACBA323096A7} 2014-07-27 23:11 - 2014-07-27 23:11 - 00347816 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\MicrosoftFixit.WinFileFolder.RNP.236329947861191425.1.1.Run.exe 2014-07-27 22:49 - 2014-07-27 22:49 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{D27ED732-5CF7-414B-AC59-C3FE34F5F748} 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\Resume_files 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\PTO.Supplies.Flyer 2014-07-26 09:39 - 2014-08-01 12:25 - 00000000 ____D () C:\Users\Melissa\Desktop\to be ordered 2014-07-24 20:16 - 2014-08-01 12:52 - 00000000 ____D () C:\Users\Melissa\Desktop\Alaina pics 2014-07-22 11:59 - 2014-07-25 16:19 - 00000000 ____D () C:\Users\Melissa\Desktop\Tim Missy Pics 2014-07-21 13:55 - 2014-07-21 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 13:55 - 2014-07-11 03:02 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-21 13:55 - 2014-07-11 02:56 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-21 13:55 - 2014-07-11 02:56 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-21 13:55 - 2014-07-11 02:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-21 13:54 - 2014-07-21 13:55 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-09 20:37 - 2014-06-07 00:02 - 17854464 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-07-09 20:37 - 2014-06-06 23:13 - 10890752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-07-09 20:37 - 2014-06-06 22:59 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-07-09 20:37 - 2014-06-06 22:52 - 01348608 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-07-09 20:37 - 2014-06-06 22:51 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-07-09 20:37 - 2014-06-06 22:51 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-07-09 20:37 - 2014-06-06 22:50 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-07-09 20:37 - 2014-06-06 22:47 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-07-09 20:37 - 2014-06-06 22:45 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-07-09 20:37 - 2014-06-06 22:42 - 02148352 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-07-09 20:37 - 2014-06-06 22:42 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-07-09 20:37 - 2014-06-06 22:41 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-07-09 20:37 - 2014-06-06 22:40 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-07-09 20:37 - 2014-06-06 22:39 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-07-09 20:37 - 2014-06-06 22:35 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-07-09 20:37 - 2014-06-06 20:05 - 12353024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-07-09 20:37 - 2014-06-06 19:25 - 09711616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-07-09 20:37 - 2014-06-06 19:12 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-07-09 20:37 - 2014-06-06 19:04 - 01106432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-07-09 20:37 - 2014-06-06 19:03 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-07-09 20:37 - 2014-06-06 19:02 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-07-09 20:37 - 2014-06-06 19:00 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-07-09 20:37 - 2014-06-06 18:58 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-07-09 20:37 - 2014-06-06 18:57 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-07-09 20:37 - 2014-06-06 18:56 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-07-09 20:37 - 2014-06-06 18:56 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-07-09 20:37 - 2014-06-06 18:54 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 00073728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-07-09 20:37 - 2014-06-06 18:53 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-07-09 20:37 - 2014-06-06 18:52 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-07-09 20:37 - 2014-06-06 18:51 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-07-09 20:37 - 2014-06-06 18:47 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-07-09 20:36 - 2014-06-06 20:33 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-07-09 20:36 - 2014-06-06 04:59 - 00506880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-07-09 20:36 - 2014-06-06 03:13 - 00620032 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-07-09 20:36 - 2014-05-30 03:10 - 00404992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-08-01 17:49 - 2014-08-01 17:48 - 00024180 _____ () C:\Users\Melissa\Desktop\FRST.txt 2014-08-01 17:49 - 2014-07-28 10:17 - 00000000 ____D () C:\FRST 2014-08-01 17:48 - 2014-08-01 17:48 - 02094080 _____ (Farbar) C:\Users\Melissa\Desktop\FRST64.exe 2014-08-01 17:43 - 2010-06-05 21:23 - 01668926 _____ () C:\Windows\WindowsUpdate.log 2014-08-01 17:40 - 2014-08-01 17:40 - 00000384 _____ () C:\Windows\DCEBOOT.RST 2014-08-01 17:40 - 2014-08-01 17:40 - 00000000 _____ () C:\Windows\DCEBOOT.LOG 2014-08-01 17:40 - 2014-08-01 11:44 - 00003370 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-01 17:40 - 2014-08-01 11:44 - 00003240 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-770997747-1975351657-1911745460-1000 2014-08-01 17:40 - 2010-07-01 15:37 - 00000896 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-08-01 17:40 - 2006-11-02 11:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-08-01 17:40 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2014-08-01 17:40 - 2006-11-02 11:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2014-08-01 17:40 - 2006-11-02 11:07 - 00000000 ___RD () C:\Users\Public\Recorded TV 2014-08-01 17:39 - 2006-11-02 11:42 - 00032648 _____ () C:\Windows\Tasks\SCHEDLGU.TXT 2014-08-01 17:38 - 2014-08-01 17:38 - 00231960 _____ () C:\Windows\RegBootClean64.exe 2014-08-01 17:38 - 2014-08-01 17:38 - 00021528 _____ () C:\Windows\DCEBoot64.exe 2014-08-01 17:38 - 2010-06-06 11:20 - 00000000 ____D () C:\ProgramData\Trend Micro 2014-08-01 17:11 - 2010-07-01 15:37 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-08-01 16:57 - 2012-04-20 08:53 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-08-01 15:23 - 2014-08-01 12:39 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-08-01 12:53 - 2014-03-15 21:20 - 00000000 ____D () C:\Users\Melissa\Desktop\photos to order 2014-08-01 12:52 - 2014-07-24 20:16 - 00000000 ____D () C:\Users\Melissa\Desktop\Alaina pics 2014-08-01 12:25 - 2014-07-26 09:39 - 00000000 ____D () C:\Users\Melissa\Desktop\to be ordered 2014-08-01 11:01 - 2010-06-05 18:43 - 00131072 _____ () C:\Users\Melissa\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini 2014-08-01 11:00 - 2014-05-30 16:24 - 00000000 ____D () C:\Users\Melissa\Desktop\craigslist 2014-08-01 10:51 - 2014-06-19 21:28 - 00000000 ____D () C:\Users\Melissa\Desktop\avary pics 2014-08-01 10:47 - 2014-03-18 18:48 - 00000000 ____D () C:\Users\Melissa\Desktop\pics to order 2014-07-31 06:31 - 2014-07-28 23:19 - 00001204 _____ () C:\Windows\PFRO.log 2014-07-31 06:25 - 2006-11-02 08:46 - 00775178 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-07-31 06:25 - 2006-11-02 08:34 - 00000286 _____ () C:\Windows\win.ini 2014-07-31 06:18 - 2014-02-25 22:17 - 00775178 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-07-31 06:14 - 2014-07-31 06:14 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-MELISSA-PC-Microsoft®-Windows-Vista™-Home-Premium-(64-bit).dat 2014-07-31 06:14 - 2014-07-31 06:14 - 00000000 ____D () C:\RegBackup 2014-07-30 22:07 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-07-30 21:08 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-07-30 21:08 - 2014-04-28 20:17 - 00000910 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00001956 _____ () C:\Users\Melissa\Desktop\Tweaking.com - Windows Repair (All in One).lnk 2014-07-30 20:24 - 2014-07-30 20:24 - 00000000 ____D () C:\Users\Melissa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com 2014-07-30 20:23 - 2014-07-30 20:23 - 09522240 _____ () C:\Users\Melissa\Desktop\tweaking.com_windows_repair_aio_setup.exe 2014-07-30 20:23 - 2014-07-30 20:23 - 00000000 ____D () C:\Program Files (x86)\Tweaking.com 2014-07-29 13:40 - 2014-07-29 13:39 - 02347384 _____ (ESET) C:\Users\Melissa\Desktop\esetsmartinstaller_enu.exe 2014-07-29 09:27 - 2014-07-29 09:27 - 00016582 _____ () C:\ComboFix.txt 2014-07-29 09:27 - 2014-07-28 23:54 - 00000000 ____D () C:\Qoobox 2014-07-29 09:27 - 2006-11-02 09:33 - 00000000 __RHD () C:\Users\Default 2014-07-29 09:23 - 2014-07-28 23:53 - 00000000 ____D () C:\Windows\erdnt 2014-07-29 09:21 - 2006-11-02 08:34 - 00000215 _____ () C:\Windows\system.ini 2014-07-29 02:31 - 2006-11-02 08:33 - 76808192 _____ () C:\Windows\system32\config\SOFTWARE.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 63438848 _____ () C:\Windows\system32\config\COMPONENTS.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 21495808 _____ () C:\Windows\system32\config\SYSTEM.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00524288 _____ () C:\Windows\system32\config\DEFAULT.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak 2014-07-29 02:31 - 2006-11-02 08:33 - 00262144 _____ () C:\Windows\system32\config\SAM.bak 2014-07-28 23:50 - 2014-07-28 23:50 - 05563277 ____R (Swearware) C:\Users\Melissa\Desktop\ComboFix.exe 2014-07-28 23:43 - 2014-07-28 23:13 - 00000000 ____D () C:\AdwCleaner 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\ProgramData\Viewpoint 2014-07-28 23:26 - 2014-07-28 23:26 - 00000000 ____D () C:\Program Files (x86)\Viewpoint 2014-07-28 23:12 - 2014-07-28 23:12 - 01365551 _____ () C:\Users\Melissa\Desktop\AdwCleaner.exe 2014-07-28 22:38 - 2014-07-28 22:38 - 00001301 _____ () C:\Users\Melissa\Desktop\Documents\quarantine list.txt 2014-07-28 22:34 - 2010-06-05 18:34 - 00000000 ____D () C:\ProgramData\Temp 2014-07-28 11:41 - 2013-06-17 09:41 - 00000000 ____D () C:\Users\Melissa\Desktop\Ebay 2014-07-28 11:17 - 2014-07-28 11:17 - 00072624 _____ () C:\Users\Brooke\AppData\Local\GDIPFONTCACHEV1.DAT 2014-07-28 10:02 - 2014-07-28 10:01 - 00206246 _____ () C:\Users\Melissa\Desktop\Documents\cc_20140728_100144.reg 2014-07-28 09:59 - 2013-07-11 16:50 - 00000000 ____D () C:\Windows\Minidump 2014-07-28 09:59 - 2010-08-02 21:07 - 00000000 ____D () C:\Users\Melissa\Tracing 2014-07-28 09:54 - 2012-06-11 09:27 - 00000000 ____D () C:\Windows\pss 2014-07-28 09:46 - 2014-07-28 01:30 - 00000000 ____D () C:\Users\Brooke\AppData\Local\VirtualStore 2014-07-28 01:31 - 2014-07-28 01:31 - 00001149 _____ () C:\Users\Brooke\Desktop\Trend Micro Titanium Internet Security.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000951 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000941 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000936 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Real 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Trend Micro Titanium Internet Security 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Leader Technologies 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Epson 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Roaming\Apple Computer 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Google 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\Fisher-Price 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\ArcSoft 2014-07-28 01:31 - 2014-07-28 01:31 - 00000000 ____D () C:\Users\Brooke\AppData\Local\AOL 2014-07-28 01:31 - 2014-07-28 01:30 - 00000917 _____ () C:\Users\Brooke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Mail.lnk 2014-07-28 01:31 - 2014-07-28 01:30 - 00000000 ____D () C:\Users\Brooke 2014-07-28 01:30 - 2014-07-28 01:30 - 00000020 ___SH () C:\Users\Brooke\ntuser.ini 2014-07-28 01:02 - 2014-07-28 01:02 - 110331640 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\msert.exe 2014-07-28 00:36 - 2014-07-28 00:36 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{74ED30BA-00C4-413B-83E1-1A8B2B958A60} 2014-07-28 00:27 - 2014-07-28 00:27 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{4B03C2EF-9478-4C62-94BE-0012C9EDDE0D} 2014-07-27 23:29 - 2014-07-27 23:29 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{06C6F07A-6C0C-4519-9CBD-02CDE2F27824} 2014-07-27 23:24 - 2014-07-27 23:24 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{F8A53BEA-5E66-48D8-9A0F-ACBA323096A7} 2014-07-27 23:11 - 2014-07-27 23:11 - 00347816 _____ (Microsoft Corporation) C:\Users\Melissa\Desktop\Documents\MicrosoftFixit.WinFileFolder.RNP.236329947861191425.1.1.Run.exe 2014-07-27 22:49 - 2014-07-27 22:49 - 00000000 ____D () C:\Users\Melissa\AppData\Local\{D27ED732-5CF7-414B-AC59-C3FE34F5F748} 2014-07-27 00:32 - 2006-11-02 09:33 - 00000000 ____D () C:\Windows\system 2014-07-26 12:57 - 2014-04-28 20:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-07-26 12:57 - 2014-04-28 20:17 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\Resume_files 2014-07-26 11:47 - 2014-07-26 11:47 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents\PTO.Supplies.Flyer 2014-07-26 11:36 - 2014-06-20 21:43 - 00000000 ____D () C:\Users\Melissa\Desktop\New Folder (2) 2014-07-25 17:37 - 2012-12-24 18:27 - 00000000 ____D () C:\Users\Melissa\Desktop\Documents 2 2014-07-25 17:35 - 2011-04-04 23:23 - 00000000 ____D () C:\Users\Melissa\Desktop\For DVD 2014-07-25 16:24 - 2013-04-16 21:08 - 00000000 ____D () C:\Users\Melissa\Desktop\Family Photos Scanned 2014-07-25 16:20 - 2014-06-11 20:37 - 00000000 ____D () C:\Users\Melissa\Desktop\New Folder 2014-07-25 16:19 - 2014-07-22 11:59 - 00000000 ____D () C:\Users\Melissa\Desktop\Tim Missy Pics 2014-07-25 16:12 - 2013-01-22 14:14 - 00000000 ____D () C:\Users\Melissa\Desktop\Avary Video 2014-07-24 19:51 - 2010-08-02 21:15 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-07-23 20:15 - 2010-09-15 00:18 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight 2014-07-23 10:52 - 2010-06-05 18:37 - 00270496 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe 2014-07-21 13:55 - 2014-07-21 13:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java 2014-07-21 13:55 - 2014-07-21 13:54 - 00004489 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_65-b20.log 2014-07-21 13:55 - 2009-04-02 04:30 - 00000000 ____D () C:\Program Files (x86)\Java 2014-07-11 03:02 - 2014-07-21 13:55 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2014-07-11 02:56 - 2014-07-21 13:55 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2014-07-11 02:56 - 2014-07-21 13:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2014-07-11 02:55 - 2014-07-21 13:55 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2014-07-10 17:10 - 2006-11-02 11:21 - 00310808 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-07-10 17:08 - 2006-11-02 11:07 - 00000000 ____D () C:\Program Files\Windows Journal 2014-07-09 21:07 - 2013-07-18 00:31 - 00000000 ____D () C:\Windows\system32\MRT 2014-07-09 21:04 - 2006-11-02 08:35 - 96441528 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe 2014-07-08 20:57 - 2012-04-20 08:53 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-07-08 20:57 - 2012-04-20 08:53 - 00003682 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-07-08 20:57 - 2011-05-19 09:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-07-06 20:32 - 2014-06-29 20:44 - 00000000 ____D () C:\Users\Melissa\AppData\Local\Adobe Files to move or delete: ==================== C:\ProgramData\unins000.dat C:\ProgramData\unins000.exe Some content of TEMP: ==================== C:\Users\Melissa\AppData\Local\Temp\mbam-setup.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-08-01 17:46 ==================== End Of Log ============================
  14. Ok,, here is my next question. I have an external Seagate harddrive. Before we started all these repairs I kept getting messages that it is full and last backup had failed. Can that be affected by malware too? I can't believe it is actually full. But.... I took it out of the stand on my computer so it wouldn't come on with the reboot,, deleted one or two known reappearing files from the desktop and when I did a restart THEN they did not appear? I want to be able to keep my hard drive plugged in not sure where to go from here. I also didn't plug it back in yet to see if the files will come back again once it is back. I figured I would wait for your response as you know more about this stuff then me. Thanks again.
  15. Hi, I ran the windows repair and it is complete. Still can't delete items on desktop as they keep coming back? Everything else still is fine. ??? Thanks again Melissa
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.