Jump to content

blantonr

Honorary Members
  • Posts

    34
  • Joined

  • Last visited

Reputation

0 Neutral

Contact Methods

  • Website URL
    http://
  • ICQ
    0

Profile Information

  • Location
    Atlanta
  • Interests
    Writing, Photography, Canoeing, Computers
  1. Seems smooth and operational, thanks for the help.
  2. Status: Deleted (events: 1) 11/12/2014 11:22:15 AM Deleted Trojan program HEUR:Exploit.Script.Generic E:\Users\Dad\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\2T7VCOT0\cmuesal7[1].htm High
  3. This application has been running 9 hours and is eight percent done, I do not have the ability to let it finish as I need my pc to perform my work and the resources it takes while running this make that impossible, is there another application I can use that will perform normally within a reasonable amount of time?
  4. ComboFix 14-10-29.01 - Dad's 11/02/2014 15:10:54.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.6109.4420 [GMT -5:00] Running from: c:\users\Dad's\Desktop\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859} SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} * Created a new restore point . ADS - Windows: deleted 0 bytes in 1 streams. . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . c:\users\Dad's\AppData\Local\Adobe\downloader.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\_ctypes.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\_elementtree.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\_hashlib.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\_multiprocessing.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\_socket.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\_ssl.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\hashobjs_ext.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\pyexpat.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\pysqlite2._sqlite.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\python27.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\pythoncom27.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\PyWinTypes27.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\select.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\unicodedata.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32api.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32com.shell.shell.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32crypt.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32event.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32file.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32gui.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32inet.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32pdh.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32pipe.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32process.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32profile.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32security.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\win32ts.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\windows._lib_cacheinvalidation.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wx._animate.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wx._controls_.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wx._core_.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wx._gdi_.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wx._html2.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wx._misc_.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wx._windows_.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wx._wizard.pyd c:\users\Dad's\AppData\Local\Temp\_MEI55602\wxbase294u_net_vc90.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\wxbase294u_vc90.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\wxmsw294u_adv_vc90.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\wxmsw294u_core_vc90.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\wxmsw294u_html_vc90.dll c:\users\Dad's\AppData\Local\Temp\_MEI55602\wxmsw294u_webview_vc90.dll c:\users\Dad's\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll . . ((((((((((((((((((((((((( Files Created from 2014-10-02 to 2014-11-02 ))))))))))))))))))))))))))))))) . . 2014-11-02 20:38 . 2014-11-02 20:38 -------- d-----w- c:\users\Public\AppData\Local\temp 2014-11-02 20:38 . 2014-11-02 20:38 -------- d-----w- c:\users\DefaultAppPool\AppData\Local\temp 2014-11-02 20:38 . 2014-11-02 20:38 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-11-02 20:38 . 2014-11-02 20:38 -------- d-----w- c:\users\Kathy\AppData\Local\temp 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin5.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin4.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin3.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin2.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll 2014-10-28 18:16 . 2014-10-28 18:16 159744 ----a-w- c:\program files (x86)\Mozilla Firefox\plugins\npqtplugin.dll 2014-10-28 18:14 . 2014-10-28 18:14 -------- d-----w- c:\program files\iPod 2014-10-28 18:14 . 2014-10-28 18:15 -------- d-----w- c:\programdata\E1864A66-75E3-486a-BD95-D1B7D99A84A7 2014-10-28 18:14 . 2014-10-28 18:15 -------- d-----w- c:\program files\iTunes 2014-10-28 18:14 . 2014-10-28 18:15 -------- d-----w- c:\program files (x86)\iTunes 2014-10-27 05:35 . 2014-10-29 05:35 -------- d-----w- C:\Big Bang Theory 2014-10-27 01:56 . 2014-10-27 01:56 -------- d-----w- C:\FRST 2014-10-26 08:09 . 2014-10-26 09:48 -------- d-----w- c:\users\Dad's\AppData\Roaming\vlc 2014-10-26 08:09 . 2014-10-26 08:09 -------- d-----w- C:\VLC 2014-10-24 03:18 . 2014-10-24 03:19 -------- d-----w- C:\b8160190bcf8797cdf 2014-10-23 03:59 . 2014-10-16 12:27 614544 ----a-w- c:\windows\SysWow64\nvStreaming.exe 2014-10-21 19:34 . 2014-10-21 19:34 -------- d-----w- c:\program files (x86)\Common Files\Java 2014-10-21 19:33 . 2014-10-21 19:33 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll 2014-10-21 19:33 . 2014-10-21 19:33 -------- d-----w- c:\program files (x86)\Java 2014-10-19 23:33 . 2014-10-19 23:37 -------- d-----w- C:\Jimbo Cross Hair . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-11-02 20:49 . 2014-04-18 01:20 129752 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys 2014-10-24 03:19 . 2012-08-17 01:43 103265616 ----a-w- c:\windows\system32\MRT.exe 2014-10-16 16:54 . 2014-09-20 18:50 14029400 ----a-w- c:\windows\system32\nvopencl.dll 2014-10-16 16:54 . 2014-09-20 18:50 20922696 ----a-w- c:\windows\system32\nvcompiler.dll 2014-10-16 16:54 . 2014-07-30 17:04 18499648 ----a-w- c:\windows\SysWow64\nvwgf2um.dll 2014-10-16 16:54 . 2014-05-27 16:48 31890064 ----a-w- c:\windows\system32\nvoglv64.dll 2014-10-16 16:54 . 2013-02-26 04:32 2849224 ----a-w- c:\windows\SysWow64\nvapi.dll 2014-10-16 16:54 . 2012-08-13 01:45 987008 ----a-w- c:\windows\system32\nvumdshimx.dll 2014-10-16 16:54 . 2010-08-09 05:05 3237528 ----a-w- c:\windows\system32\nvapi64.dll 2014-10-16 16:54 . 2010-08-09 05:05 20968040 ----a-w- c:\windows\system32\nvwgf2umx.dll 2014-10-16 16:54 . 2010-08-09 05:05 16886168 ----a-w- c:\windows\SysWow64\nvd3dum.dll 2014-10-16 14:11 . 2010-08-09 03:12 6883136 ----a-w- c:\windows\system32\nvcpl.dll 2014-10-16 14:11 . 2010-08-09 03:12 3533632 ----a-w- c:\windows\system32\nvsvc64.dll 2014-10-16 14:11 . 2010-08-09 03:12 933064 ----a-w- c:\windows\system32\nvvsvc.exe 2014-10-16 14:11 . 2010-08-09 03:12 61640 ----a-w- c:\windows\system32\nvshext.dll 2014-10-16 14:11 . 2010-08-09 03:12 384200 ----a-w- c:\windows\system32\nvmctray.dll 2014-10-16 14:11 . 2010-08-09 03:12 2559808 ----a-w- c:\windows\system32\nvsvcr.dll 2014-10-15 00:48 . 2012-08-13 01:45 4047877 ----a-w- c:\windows\system32\nvcoproc.bin 2014-10-09 11:08 . 2013-10-14 13:37 43064 ----a-w- c:\windows\system32\drivers\avnetflt.sys 2014-10-09 11:08 . 2013-10-14 13:37 131608 ----a-w- c:\windows\system32\drivers\avipbb.sys 2014-10-09 11:08 . 2013-10-14 13:37 119272 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2014-10-02 18:23 . 2014-10-02 18:23 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx 2014-10-02 18:23 . 2014-10-02 18:23 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts 2014-10-01 15:11 . 2014-04-18 01:19 63704 ----a-w- c:\windows\system32\drivers\mwac.sys 2014-10-01 15:11 . 2014-04-09 07:56 93400 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys 2014-10-01 15:11 . 2012-09-06 02:08 25816 ----a-w- c:\windows\system32\drivers\mbam.sys 2014-09-25 02:08 . 2014-09-30 20:45 371712 ----a-w- c:\windows\system32\qdvd.dll 2014-09-25 01:40 . 2014-09-30 20:45 519680 ----a-w- c:\windows\SysWow64\qdvd.dll 2014-09-24 03:28 . 2012-08-15 15:17 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-09-24 03:28 . 2012-05-13 03:22 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2014-09-23 23:41 . 2010-06-24 18:33 23256 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll 2014-09-17 04:51 . 2014-09-20 18:50 31520 ----a-w- c:\windows\system32\nvhdap64.dll 2014-09-17 04:51 . 2014-09-20 18:50 197408 ----a-w- c:\windows\system32\drivers\nvhda64v.sys 2014-09-17 04:51 . 2014-02-19 15:06 1538880 ----a-w- c:\windows\system32\nvhdagenco6420103.dll 2014-09-17 02:13 . 2014-07-30 16:59 1291280 ----a-w- c:\windows\SysWow64\nvspbridge.dll 2014-09-17 02:13 . 2013-10-29 02:40 2193560 ----a-w- c:\windows\SysWow64\nvspcap.dll 2014-09-17 02:12 . 2013-10-29 02:40 2799784 ----a-w- c:\windows\system32\nvspcap64.dll 2014-09-17 02:12 . 2014-07-30 16:59 1715224 ----a-w- c:\windows\system32\nvspbridge64.dll 2014-09-13 23:48 . 2014-09-20 18:50 1876296 ----a-w- c:\windows\system32\nvdispco6434411.dll 2014-09-13 23:48 . 2014-09-20 18:50 1539272 ----a-w- c:\windows\system32\nvdispgenco6434411.dll 2014-09-09 22:11 . 2014-09-24 03:10 2048 ----a-w- c:\windows\system32\tzres.dll 2014-09-09 21:47 . 2014-09-24 03:10 2048 ----a-w- c:\windows\SysWow64\tzres.dll 2014-09-04 19:14 . 2014-09-20 18:44 38048 ----a-w- c:\windows\system32\drivers\nvvad64v.sys 2014-09-04 19:14 . 2014-09-20 18:44 32416 ----a-w- c:\windows\SysWow64\nvaudcap32v.dll 2014-09-04 19:14 . 2013-08-04 07:38 34976 ----a-w- c:\windows\system32\nvaudcap64v.dll 2014-08-23 02:07 . 2014-08-27 22:54 404480 ----a-w- c:\windows\system32\gdi32.dll 2014-08-23 01:45 . 2014-08-27 22:54 311808 ----a-w- c:\windows\SysWow64\gdi32.dll 2014-08-23 00:59 . 2014-08-27 22:54 3163648 ----a-w- c:\windows\system32\win32k.sys 2014-08-19 18:05 . 2014-09-22 10:37 374968 ----a-w- c:\windows\system32\iedkcs32.dll 2014-08-18 23:01 . 2014-09-22 10:37 23591424 ----a-w- c:\windows\system32\mshtml.dll 2014-08-18 22:29 . 2014-09-22 10:37 2724864 ----a-w- c:\windows\system32\mshtml.tlb 2014-08-18 22:29 . 2014-09-22 10:37 4096 ----a-w- c:\windows\system32\ieetwcollectorres.dll 2014-08-18 22:20 . 2014-09-22 10:37 2793984 ----a-w- c:\windows\system32\iertutil.dll 2014-08-18 22:19 . 2014-09-22 10:37 5833728 ----a-w- c:\windows\system32\jscript9.dll 2014-08-18 22:15 . 2014-09-22 10:37 547328 ----a-w- c:\windows\system32\vbscript.dll 2014-08-18 22:15 . 2014-09-22 10:37 66048 ----a-w- c:\windows\system32\iesetup.dll 2014-08-18 22:14 . 2014-09-22 10:37 48640 ----a-w- c:\windows\system32\ieetwproxystub.dll 2014-08-18 22:14 . 2014-09-22 10:37 83968 ----a-w- c:\windows\system32\MshtmlDac.dll 2014-08-18 22:08 . 2014-09-22 10:37 51200 ----a-w- c:\windows\system32\jsproxy.dll 2014-08-18 22:08 . 2014-09-22 10:37 4232704 ----a-w- c:\windows\SysWow64\jscript9.dll 2014-08-18 22:08 . 2014-09-22 10:37 33792 ----a-w- c:\windows\system32\iernonce.dll 2014-08-18 22:05 . 2014-09-22 10:37 596480 ----a-w- c:\windows\system32\ieui.dll 2014-08-18 22:03 . 2014-09-22 10:37 139264 ----a-w- c:\windows\system32\ieUnatt.exe 2014-08-18 22:03 . 2014-09-22 10:37 111616 ----a-w- c:\windows\system32\ieetwcollector.exe 2014-08-18 22:03 . 2014-09-22 10:37 758272 ----a-w- c:\windows\system32\jscript9diag.dll 2014-08-18 21:57 . 2014-09-22 10:37 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb 2014-08-18 21:56 . 2014-09-22 10:37 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe 2014-08-18 21:51 . 2014-09-22 10:37 446464 ----a-w- c:\windows\system32\dxtmsft.dll 2014-08-18 21:46 . 2014-09-22 10:37 454656 ----a-w- c:\windows\SysWow64\vbscript.dll 2014-08-18 21:45 . 2014-09-22 10:37 61952 ----a-w- c:\windows\SysWow64\iesetup.dll 2014-08-18 21:45 . 2014-09-22 10:37 72704 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll 2014-08-18 21:44 . 2014-09-22 10:37 51200 ----a-w- c:\windows\SysWow64\ieetwproxystub.dll 2014-08-18 21:44 . 2014-09-22 10:37 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll 2014-08-18 21:40 . 2014-09-22 10:37 195584 ----a-w- c:\windows\system32\msrating.dll 2014-08-18 21:39 . 2014-09-22 10:37 85504 ----a-w- c:\windows\system32\mshtmled.dll 2014-08-18 21:38 . 2014-09-22 10:37 289280 ----a-w- c:\windows\system32\dxtrans.dll 2014-08-18 21:36 . 2014-09-22 10:37 112128 ----a-w- c:\windows\SysWow64\ieUnatt.exe 2014-08-18 21:35 . 2014-09-22 10:37 597504 ----a-w- c:\windows\SysWow64\jscript9diag.dll 2014-08-18 21:25 . 2014-09-22 10:37 727040 ----a-w- c:\windows\system32\msfeeds.dll 2014-08-18 21:25 . 2014-09-22 10:37 707072 ----a-w- c:\windows\system32\ie4uinit.exe 2014-08-18 21:23 . 2014-09-22 10:37 2104832 ----a-w- c:\windows\system32\inetcpl.cpl 2014-08-18 21:23 . 2014-09-22 10:37 1249280 ----a-w- c:\windows\system32\mshtmlmedia.dll 2014-08-18 21:22 . 2014-09-22 10:37 60416 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll 2014-08-18 21:16 . 2014-09-22 10:37 13588480 ----a-w- c:\windows\system32\ieframe.dll 2014-08-18 21:15 . 2014-09-22 10:37 2310656 ----a-w- c:\windows\system32\wininet.dll 2014-08-18 21:08 . 2014-09-22 10:37 2014208 ----a-w- c:\windows\SysWow64\inetcpl.cpl 2014-08-18 21:07 . 2014-09-22 10:37 1068032 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll 2014-08-18 20:55 . 2014-09-22 10:37 1447424 ----a-w- c:\windows\system32\urlmon.dll 2014-08-18 20:46 . 2014-09-22 10:37 1812992 ----a-w- c:\windows\SysWow64\wininet.dll 2014-08-18 20:38 . 2014-09-22 10:37 775168 ----a-w- c:\windows\system32\ieapfltr.dll . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GoogleDriveSync"="c:\program files (x86)\Google\Drive\googledrivesync.exe" [2014-08-08 22734160] "Sticky-Notes"="c:\program files (x86)\Sticky-Notes\stickynotes.exe" [2012-03-09 621568] "cdloader"="c:\users\Dad's\AppData\Roaming\mjusbsp\cdloader2.exe" [2014-07-04 51592] "Spotify Web Helper"="c:\users\Dad's\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2014-08-20 1245752] "HP Deskjet 3050 J610 series (NET)"="c:\program files\HP\HP Deskjet 3050 J610 series\Bin\ScanToPCActivationApp.exe" [2012-10-17 2573416] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2011-05-20 284440] "RUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe" [2011-09-20 115048] "jmekey"="c:\windows\jmesoft\hotkey.exe" [2011-06-08 118784] "jmesoft"="c:\windows\jmesoft\ServiceLoader.exe" [2011-03-16 28672] "UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe" [2011-12-07 214312] "LVT"="c:\program files\Lenovo\LVT\LJYZ.exe" [2011-11-24 886112] "CLMLServer"="c:\program files (x86)\Lenovo\Power2Go\CLMLSvc.exe" [2009-12-04 103720] "UpdateP2GoShortCut"="c:\program files (x86)\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe" [2011-12-07 214312] "Acrobat Assistant 8.0"="c:\program files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2011-08-30 624056] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-10-11 60712] "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184] "DivXMediaServer"="c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe" [2013-08-21 450560] "DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2013-08-29 1861968] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-10-09 703736] "Adobe Creative Cloud"="c:\program files (x86)\Adobe\Adobe Creative Cloud\ACC\Creative Cloud.exe" [2014-03-21 2691480] "HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2013-05-30 96056] "Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-09-23 165168] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-09-26 271744] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-10-15 157480] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-10-02 421888] . c:\users\Dad's\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ BUFFALO NAS Navigator2.lnk - c:\program files (x86)\BUFFALO\NASNAVI\NasNavi.exe /startup [2013-10-30 1945700] Dropbox.lnk - c:\users\Dad's\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-9-12 36414624] EvernoteClipper.lnk - c:\program files (x86)\Evernote\Evernote\EvernoteClipper.exe [2014-8-26 1110880] NAS Scheduler.lnk - c:\program files (x86)\BUFFALO\NASNAVI\nassche.exe [2009-5-15 206128] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 DokanMounter;DokanMounter;c:\program files (x86)\Dokan\DokanLibrary\mounter.exe;c:\program files (x86)\Dokan\DokanLibrary\mounter.exe [x] R2 JME Keyboard;JME Keyboard Driver;c:\windows\jmesoft\Service.exe;c:\windows\jmesoft\Service.exe [x] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x] R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x] R3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x] R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x] R3 SaiH053C;SaiH053C;c:\windows\system32\DRIVERS\SaiH053C.sys;c:\windows\SYSNATIVE\DRIVERS\SaiH053C.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] R3 wsvd;wsvd;c:\windows\system32\DRIVERS\wsvd.sys;c:\windows\SYSNATIVE\DRIVERS\wsvd.sys [x] R4 AntiVirWebService;Avira Web Protection;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe;c:\program files (x86)\Avira\AntiVir Desktop\avwebg7.exe [x] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x] S2 AntiVirSchedulerService;Avira Scheduler;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x] S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x] S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x] S2 Dokan;Dokan;c:\windows\system32\drivers\dokan.sys;c:\windows\SYSNATIVE\drivers\dokan.sys [x] S2 GfExperienceService;NVIDIA GeForce Experience Service;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe;c:\program files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [x] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [x] S2 Intel® Capability Licensing Service Interface;Intel® Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x] S2 jhi_service;Intel® Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\DAL\jhi_service.exe [x] S2 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x] S2 NasPmService;NAS PM Service;c:\program files (x86)\BUFFALO\NASNAVI\nassvc.exe;c:\program files (x86)\BUFFALO\NASNAVI\nassvc.exe [x] S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x] S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x] S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x] S2 PSI_SVC_2_x64;Protexis Licensing V2 x64;c:\program files\Common Files\Protexis\License Service\PsiService_2.exe;c:\program files\Common Files\Protexis\License Service\PsiService_2.exe [x] S2 RealNetworks Downloader Resolver Service;RealNetworks Downloader Resolver Service;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe;c:\program files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [x] S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x] S2 TabletServiceWacom;TabletServiceWacom;c:\windows\system32\Wacom_Tablet.exe;c:\windows\SYSNATIVE\Wacom_Tablet.exe [x] S2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x] S2 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x] S2 WTabletServicePro;Wacom Professional Service;c:\program files\Tablet\Wacom\WTabletServicePro.exe;c:\program files\Tablet\Wacom\WTabletServicePro.exe [x] S3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x] S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys;c:\windows\SYSNATIVE\drivers\MBAMSwissArmy.sys [x] S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x] S3 NvStreamKms;NvStreamKms;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys;c:\program files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys [x] S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x] S3 RDPDISPM;RDPDISPM;c:\windows\system32\DRIVERS\rdpdispm.sys;c:\windows\SYSNATIVE\DRIVERS\rdpdispm.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] S3 rusb3hub;Renesas Electronics USB 3.0 Hub Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3hub.sys [x] S3 rusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver (Version 3.0);c:\windows\system32\DRIVERS\rusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\rusb3xhc.sys [x] S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x] S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x] S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x] S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x] S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x] S3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x] S3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x] . . --- Other Services/Drivers In Memory --- . *NewlyCreated* - MBAMSWISSARMY . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost] iissvcs REG_MULTI_SZ w3svc was apphost REG_MULTI_SZ apphostsvc . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-10-27 20:19 1089352 ----a-w- c:\program files (x86)\Google\Chrome\Application\38.0.2125.111\Installer\chrmstp.exe . Contents of the 'Scheduled Tasks' folder . 2014-11-02 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-15 03:28] . 2014-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-19 15:27] . 2014-11-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-08-19 15:27] . 2014-11-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2398400545-2579640428-1289850962-1001Core.job - c:\users\Dad's\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-07 05:07] . 2014-11-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2398400545-2579640428-1289850962-1001UA.job - c:\users\Dad's\AppData\Local\Google\Update\GoogleUpdate.exe [2014-10-07 05:07] . 2012-09-17 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-2398400545-2579640428-1289850962-1001.job - c:\program files (x86)\Real\RealUpgrade\realupgrade.exe [2013-03-06 15:36] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco1] @="{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}" [HKEY_CLASSES_ROOT\CLSID\{AB9CF9F8-8A96-4F9D-BF21-CE85714C3A47}] 2014-03-20 15:24 667808 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco2] @="{853B7E05-C47D-4985-909A-D0DC5C6D7303}" [HKEY_CLASSES_ROOT\CLSID\{853B7E05-C47D-4985-909A-D0DC5C6D7303}] 2014-03-20 15:24 667808 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ AccExtIco3] @="{42D38F2E-98E9-4382-B546-E24E4D6D04BB}" [HKEY_CLASSES_ROOT\CLSID\{42D38F2E-98E9-4382-B546-E24E4D6D04BB}] 2014-03-20 15:24 667808 ----a-w- c:\program files (x86)\Adobe\Adobe Creative Cloud\CoreSync\CoreSync_x64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt1"] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2014-08-18 17:22 164760 ----a-w- c:\users\Dad's\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt2"] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2014-08-18 17:22 164760 ----a-w- c:\users\Dad's\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt3"] @="{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDD-A251-47B7-93E1-CDD82E34AF8B}] 2014-08-18 17:22 164760 ----a-w- c:\users\Dad's\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt4"] @="{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDE-A251-47B7-93E1-CDD82E34AF8B}] 2014-08-18 17:22 164760 ----a-w- c:\users\Dad's\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt5"] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2014-08-18 17:22 164760 ----a-w- c:\users\Dad's\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt6"] @="{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDF-A251-47B7-93E1-CDD82E34AF8B}] 2014-08-18 17:22 164760 ----a-w- c:\users\Dad's\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt7"] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2014-08-18 17:22 164760 ----a-w- c:\users\Dad's\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\"DropboxExt8"] @="{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EE0-A251-47B7-93E1-CDD82E34AF8B}] 2014-08-18 17:22 164760 ----a-w- c:\users\Dad's\AppData\Roaming\Dropbox\bin\DropboxExt64.24.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveBlacklistedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedEditOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSharedViewOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D43}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncedOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\GDriveSyncingOverlay] @="{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}" [HKEY_CLASSES_ROOT\CLSID\{81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41}] 2014-08-08 14:34 777032 ----a-w- c:\program files (x86)\Google\Drive\googledrivesync64.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-12-21 170264] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-12-21 398104] "Persistence"="c:\windows\system32\igfxpers.exe" [2011-12-21 440600] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-09-05 12850792] "UpdatePRCShortCut"="c:\program files\Lenovo\OneKey App\Lenovo Rescue System\MUITransfer\MUIStartMenu.exe" [2011-12-07 214312] "ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-09-17 2799784] "NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-09-17 2460488] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2014-02-28 558496] . ------- Supplementary Scan ------- . uLocal Page = c:\windows\system32\blank.htm uStart Page = about:blank mStart Page = hxxp://www.google.com mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local IE: Clip bookmark - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=0 IE: Clip image - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=4 IE: Clip selection - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=3 IE: Clip this page - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\Clip.html?clipAction=1 IE: Clip URL - c:\program files (x86)\Evernote\Evernote\\EvernoteIERes\Clip.html?clipAction=0 IE: New note - c:\program files (x86)\Evernote\Evernote\EvernoteIERes\NewNote.html Trusted Zone: clonewarsadventures.com Trusted Zone: freerealms.com Trusted Zone: soe.com Trusted Zone: sony.com TCP: Interfaces\{33528216-F323-4DE3-941C-A59FDB6341CB}: NameServer = 4.4.4.4,8.8.8.8 FF - ProfilePath - c:\users\Dad's\AppData\Roaming\Mozilla\Firefox\Profiles\s5mgfb9m.default\ FF - prefs.js: browser.startup.homepage - about:home . - - - - ORPHANS REMOVED - - - - . Wow6432Node-HKLM-Run-<NO NAME> - (no file) HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start HKLM-Run-Nvtmru - c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe AddRemove-Aces High - c:\hitech creations\Aces High\uninstall.exe AddRemove-Wacom WebTabletPlugin for IE - c:\program files (x86)\TabletPlugins\ieUninstall.exe AddRemove-Wacom WebTabletPlugin for Netscape - c:\program files (x86)\TabletPlugins\npUninstall.exe AddRemove-Octoshape add-in for Adobe Flash Player - c:\users\Dad's\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe . . . --------------------- LOCKED REGISTRY KEYS --------------------- . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_15_0_0_167_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_15_0_0_167_ActiveX.exe" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B019E3BF-E7E5-453C-A2E4-D2C18CA0866F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.15" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_15_0_0_167.ocx, 1" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}] @Denied: (A 2) (Everyone) @="IFlashBroker6" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{299817DA-1FAC-4CE2-8F48-A108237013BD}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}] @Denied: (A) (Everyone) "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3] @Denied: (A) (Everyone) . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0] "Key"="ActionsPane3" "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd" . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Other Running Processes ------------------------ . c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe c:\program files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe c:\program files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe c:\program files (x86)\Malwarebytes Anti-Malware\mbam.exe c:\program files\Tablet\Wacom\WacomHost.exe c:\program files (x86)\Avira\AntiVir Desktop\avwsc.exe . ************************************************************************** . Completion time: 2014-11-02 16:06:52 - machine was rebooted ComboFix-quarantined-files.txt 2014-11-02 21:06 . Pre-Run: 640,314,114,048 bytes free Post-Run: 642,229,813,248 bytes free . - - End Of File - - 3FE89DEA56EE8E24B960F1F76ADBCED6
  5. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 25-10-2014 Ran by Dad's at 2014-10-26 21:56:32 Run:1 Running from C:\Users\Dad's\Desktop Loaded Profiles: Dad's & (Available profiles: Dad's & Kathy & DefaultAppPool) Boot Mode: Normal ============================================== Content of fixlist: ***************** Start SearchScopes: HKLM-x32 - DefaultScope value is missing. SearchScopes: HKCU - DefaultScope {4058339A-6A61- 6E15-428A-7DCE02F0A42C} URL = SearchScopes: HKCU - {0633EE93-D776-472f-A0FF- E1416B8B2E3A} URL = SearchScopes: HKCU - {4058339A-6A61-6E15-428A- 7DCE02F0A42C} URL = Winsock: Catalog5 01 C:\Windows \SysWOW64\mswsock.dll [231424] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Winsock: Catalog5-x64 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Winsock: Catalog5-x64 05 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll" End ***************** HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer \SearchScopes\\DefaultScope => value deleted successfully. "HKCU\SOFTWARE\Microsoft\Internet Explorer \SearchScopes\{0633EE93-D776-472f-A0FF- E1416B8B2E3A}" => Key deleted successfully. "HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" => Key not found. "HKCU\SOFTWARE\Microsoft\Internet Explorer \SearchScopes\{4058339A-6A61-6E15-428A- 7DCE02F0A42C}" => Key deleted successfully. "HKCR\CLSID\{4058339A-6A61-6E15-428A-7DCE02F0A42C}" => Key not found. Winsock: Catalog5 entry 000000000001\\LibraryPath was set successfully to %SystemRoot% \system32\NLAapi.dll Winsock: Catalog5-x64 entry 000000000001\ \LibraryPath was set successfully to %SystemRoot% \system32\NLAapi.dll Winsock: Catalog5-x64 entry 000000000005\ \LibraryPath was set successfully to %SystemRoot% \System32\mswsock.dll ==== End of Fixlog ==== Malwarebytes Anti-Malware www.malwarebytes.org Scan Date: 10/26/2014 Scan Time: 10:00:20 PM Logfile: Malwarebytes Log.txt Administrator: Yes Version: 2.00.3.1025 Malware Database: v2014.10.26.08 Rootkit Database: v2014.10.22.01 License: Premium Malware Protection: Enabled Malicious Website Protection: Enabled Self-protection: Enabled OS: Windows 7 Service Pack 1 CPU: x64 File System: NTFS User: Dad's Scan Type: Threat Scan Result: Completed Objects Scanned: 438970 Time Elapsed: 22 min, 48 sec Memory: Enabled Startup: Enabled Filesystem: Enabled Archives: Enabled Rootkits: Enabled Heuristics: Enabled PUP: Enabled PUM: Enabled Processes: 0 (No malicious items detected) Modules: 0 (No malicious items detected) Registry Keys: 0 (No malicious items detected) Registry Values: 0 (No malicious items detected) Registry Data: 0 (No malicious items detected) Folders: 0 (No malicious items detected) Files: 0 (No malicious items detected) Physical Sectors: 0 (No malicious items detected) (end)
  6. I am unable to uninstall FromDocToPDF Toolbar. I get the following message: There was a problem starting C:\PROGRA~2\FROMDO~2\bar\1.bin\65bar.dll The specified module could not be found.
  7. This warning was spamming so badly I could not operate. I did get Malwarebytes to run and it removed one thing, my Avira detected and removed a trojan, I rebooted and ran Malwarebytes again, and it found nothing. Here are the requested files: FRST.txtAddition.txt
  8. Outstanding work Mr.C, thank you for the assistance. Good suggestions at the ends as well, thanks!

  9. Finally I can bloody paste!!!!... here it is: Results of screen317's Security Check version 0.99.82 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 11 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Avira Desktop Antivirus up to date! (On Access scanning disabled!) `````````Anti-malware/Other Utilities Check:````````` JavaFX 2.1.1 Java 7 Update 25 Java version out of Date! Adobe Flash Player 12.0.0.77 Flash Player out of Date! Adobe Reader 10.1.4 Adobe Reader out of Date! Mozilla Firefox (28.0) Google Chrome 33.0.1750.154 Google Chrome 34.0.1847.116 ````````Process Check: objlist.exe by Laurent```````` Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbam.exe Avira Antivir avgnt.exe
  10. Malwarebytes scan. April23MBAMThreatScan.txt
  11. Yes I ran it, apologies, thought it was attached. Here it is. AdwCleanerS0.txt
  12. And the results are attached. JRT.txt mbam-log-2014-04-22.txt FRST.txt Addition.txt
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.