Jump to content

Somethngcreative

Honorary Members
  • Posts

    98
  • Joined

  • Last visited

Reputation

0 Neutral
  1. I want a batman themed one, someone make one pretty pleaseeeeee
  2. I've been running Avast Internet Security with MBAM Pro on 3 different laptops, for 3+ years now, and I haven't noticed a single problem. You'll be okay
  3. No prob just returning the favor cause people here taught me all that stuff hehe. Also, if you want you can have people here in the forums help you clean your computer for free. They've helped me remove some of the nastiest viruses on my laptop years ago, including a backdoor virus that locked up my laptop. To do that, go the malware removal help section here on the forums (https://forums.malwarebytes.org/index.php?showforum=7) and click on "I'm infected-what do I do now?" Follow directions and make a new post there. Oh, and I forgot. Yup, don't delete internet explorer you actually need that for some stuff. I would use Mozilla Firefox for surfing though. Good luck!
  4. Hi, Sorry for asking but what exactly does this do? I'm really interested in it and I would like to learn more about it. In particular, what does it do, that my Antivurs Suite and Malwarebytes Pro won't? Thanks!
  5. Awesome, thanks guys. I'm clueless though how do I turn off auto-run?
  6. Hi, I plug my USB flash drive it into school computers and public computers and I've noticed that a few of the computers I've used have shown some signs of infection and they never seem to update their computers. My biggest concern is that I will unintentionally infect my laptop from my USB. I've scoured google but I couldn't find much info . What steps can I take to prevent this? I currently have Avast and Malwarebytes Pro installed, are there additional programs I can download that will help? Thanks!
  7. Thanks . Although, some programs still remain so i'll delete the system restore after removal. Can you please instruct how to uinstall the following: (1) Erunt (2) Mbar (3) Roguekiller (4) TFC -- is it ok to keep? (5) NTREGOPT
  8. None at all. Thanks so much for all your help . Am I allowed to delete all the tools we used now? Also, should I hide my files again? Thanks!
  9. Thanks, here's the log Rkill64.txt RogueKiller V8.7.1 _x64_ [Oct 3 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.adlice.com/forum/ Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Mark [Admin rights] Mode : Scan -- Date : 10/09/2013 20:17:43 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 4 ¤¤¤ [HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND [HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> FOUND [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - Hitachi HTS727575A9E364 +++++ --- User --- [MBR] 0f2a8580a6716b3f6efd2d6031cb2b29 [bSP] f7f1c757beb8e47a202f3937330092ed : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 699963 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1433933824 | Size: 15138 Mo 3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 1464936448 | Size: 102 Mo User = LL1 ... OK! User != LL2 ... KO! --- LL2 --- [MBR] 797a7018a22e68cc61f31786e4450c19 [bSP] f7f1c757beb8e47a202f3937330092ed : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 77823 Mo 1 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 159791104 | Size: 400 Mo Finished : << RKreport[0]_S_10092013_201743.txt >> RKreport[0]_S_10062013_022734.txt
  10. Sorry for the delay, been really busy with work. But here's the log you asked for: P.S. The laptop updated automatically when I restarted it, is that ok? Thanks again for all the help. Fixlog.txt Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013 Ran by Mark at 2013-10-09 11:51:44 Run:1 Running from C:\Users\Mark\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.amazon.co...field-keywords={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...ebay.com/?_nkw={searchTerms} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.co...ebay.com/?_nkw={searchTerms} BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File S3 ALSysIO; \??\C:\Users\ADMINI~1\AppData\Local\Temp\ALSysIO64.sys [x] C:\Users\Mark\AppData\Local\Temp\Extract.exe C:\Users\Mark\AppData\Local\Temp\install_reader11_en_mssd_aaa_aih.exe C:\Users\Mark\AppData\Local\Temp\ntdll_dump.dll C:\Users\Mark\AppData\Local\Temp\Quarantine.exe C:\Users\Mark\AppData\Local\Temp\SP53462.exe C:\Users\Mark\AppData\Local\Temp\SP54714.exe C:\Users\Mark\AppData\Local\Temp\SP54841.exe C:\Users\Mark\AppData\Local\Temp\SP54900.exe C:\Users\Mark\AppData\Local\Temp\SP55094.exe C:\Users\Mark\AppData\Local\Temp\SP55101.exe C:\Users\Mark\AppData\Local\Temp\SP55102.exe C:\Users\Mark\AppData\Local\Temp\SP55104.exe C:\Users\Mark\AppData\Local\Temp\SP55109.exe C:\Users\Mark\AppData\Local\Temp\SP55150.exe C:\Users\Mark\AppData\Local\Temp\SP55151.exe C:\Users\Mark\AppData\Local\Temp\SP55152.exe C:\Users\Mark\AppData\Local\Temp\sp58915.exe C:\Users\Mark\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Mark\AppData\Local\Temp\UninstallHPTCA.exe ***************** HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKCU\Software\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Default_Page_URL => Value was restored successfully. HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC} => Key deleted successfully. HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => Key not found. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{E347C1A5-F643-4D52-889F-7F04B466D97B} => Key deleted successfully. HKCR\CLSID\{E347C1A5-F643-4D52-889F-7F04B466D97B} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value deleted successfully. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC} => Key deleted successfully. HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC} => Key not found. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully. HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully. ALSysIO => Service deleted successfully. "C:\Users\Mark\AppData\Local\Temp\Extract.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\install_reader11_en_mssd_aaa_aih.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\ntdll_dump.dll" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\Quarantine.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP53462.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP54714.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP54841.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP54900.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP55094.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP55101.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP55102.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP55104.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP55109.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP55150.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP55151.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\SP55152.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\sp58915.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\UninstallHPSA.exe" => File/Directory not found. "C:\Users\Mark\AppData\Local\Temp\UninstallHPTCA.exe" => File/Directory not found. ==== End of Fixlog ====
  11. (3) ADWcleaner.txt # AdwCleaner v3.006 - Report created 06/10/2013 at 11:58:19 # Updated 01/10/2013 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Mark - MARK-HP # Running from : C:\Users\Mark\Desktop\AdwCleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{2FA28606-DE77-4029-AF96-B231E3B8F827} Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D43B3890-80C7-4010-A95D-1E77B5924DC3} ***** [ Browsers ] ***** -\\ Internet Explorer v9.0.8112.16506 -\\ Mozilla Firefox v24.0 (en-US) [ File : C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\l07ewr6q.default\prefs.js ] ************************* AdwCleaner[R0].txt - [1106 octets] - [06/10/2013 11:56:01] AdwCleaner[s0].txt - [1022 octets] - [06/10/2013 11:58:19] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [1082 octets] ########## (4) ESET cleaner **** No Logs Produced, Full scan found no viruses/malware ******* (5) Farbar (5a) Frs.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013 Ran by Mark (administrator) on MARK-HP on 06-10-2013 12:52:38 Running from C:\Users\Mark\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 9 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (HP) C:\Program Files (x86)\HP SimplePass 2011\TrueSuiteService.exe (AMD) C:\Windows\system32\atiesrxx.exe (IDT, Inc.) C:\Program Files\IDT\WDM\STacSV64.exe (Hewlett-Packard Company) C:\Windows\system32\Hpservice.exe (AMD) C:\Windows\system32\atieclxx.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Microsoft Corporation) C:\Windows\system32\WLANExt.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\afwServ.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (Andrea Electronics Corporation) C:\Program Files\IDT\WDM\AESTSr64.exe (Intel Corporation) C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Intel® Corporation) C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe (Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe (Realsil Microelectronics Inc.) C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (Roxio) C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe (Secunia) C:\Program Files (x86)\Secunia\PSI\sua.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (HP) C:\Program Files (x86)\HP SimplePass 2011\TouchControl.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (HP) C:\Program Files (x86)\HP SimplePass 2011\BioMonitor.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Intel Corporation) C:\Windows\System32\igfxtray.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe (Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe (CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (cyberlink) C:\Program Files (x86)\CyberLink\Shared files\brs.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpConnectionManager.exe (Hewlett-Packard Development Company L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\hpCMSrv.exe (Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\IELowutil.exe (Intel Corporation) C:\Windows\system32\igfxsrvc.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2837288 2011-10-14] (Synaptics Incorporated) HKLM\...\Run: [HotKeysCmds] - C:\Windows\system32\hkcmd.exe [ ] () HKLM\...\Run: [intelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-07-27] (Intel® Corporation) HKLM\...\Run: [sysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [1128448 2013-06-18] (IDT, Inc.) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1 HKCU\...\Run: [sUPERAntiSpyware] - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [6588144 2013-10-02] (SUPERAntiSpyware) HKLM-x32\...\Run: [iAStorIcon] - C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284440 2011-05-20] (Intel Corporation) HKLM-x32\...\Run: [startCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [336384 2011-03-15] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [NUSB3MON] - C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [113288 2013-06-18] (Renesas Electronics Corporation) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [HPConnectionManager] - C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\HPCMDelayStart.exe [94264 2011-02-15] (Hewlett-Packard Development Company L.P.) HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [61112 2011-03-16] (EasyBits Software AS) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) HKLM-x32\...\Run: [HPOSD] - C:\Program Files (x86)\Hewlett-Packard\HP On Screen Display\HPOSD.exe [379960 2011-08-19] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [574008 2011-07-11] (Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [avast] - C:\Program Files\AVAST Software\Avast\avastUI.exe [4858968 2013-08-30] (AVAST Software) HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [RemoteControl10] - C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe [93296 2012-07-13] (CyberLink Corp.) HKLM-x32\...\Run: [bDRegion] - C:\Program Files (x86)\Cyberlink\Shared files\brs.exe [78352 2012-09-03] (cyberlink) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-10-01] (Apple Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1 StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKLM - {E347C1A5-F643-4D52-889F-7F04B466D97B} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us2-vsb-20&link%5Fcode=qs&index=aps&field-keywords={searchTerms} SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms} SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/711-30572-11896-2/4?mpre=http://shop.ebay.com/?_nkw={searchTerms} BHO: avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\x64\IEBHO.dll (HP) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File BHO-x32: TrueSuite Website Log On - {8590886E-EC8C-43C1-A32C-E4C2B0B6395B} - C:\Program Files (x86)\HP SimplePass 2011\IEBHO.dll (HP) BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll No File BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM - avast! Online Security - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) Toolbar: HKLM-x32 - avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWow64\EZUPBH~1.DLL [52920 2011-03-31] (EasyBits Software Corp.) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 75.75.76.76 75.75.75.75 FireFox: ======== FF ProfilePath: C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\l07ewr6q.default FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll () FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.) FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Extension: No Name - C:\Users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\l07ewr6q.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi FF Extension: TrueSuite Website Logon - C:\Program Files (x86)\Mozilla Firefox\extensions\websitelogon@truesuite.com FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF ==================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [46808 2013-08-30] (AVAST Software) R2 avast! Firewall; C:\Program Files\AVAST Software\Avast\afwServ.exe [137960 2013-08-30] (AVAST Software) S2 CLKMSVC10_38F51D56; C:\Program Files (x86)\CyberLink\PowerDVD10\NavFilter\kmsvc.exe [245264 2012-09-03] (CyberLink) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-07-27] () S3 Secunia PSI Agent; C:\Program Files (x86)\Secunia\PSI\PSIA.exe [1227800 2013-04-18] (Secunia) R2 Secunia Update Agent; C:\Program Files (x86)\Secunia\PSI\sua.exe [659992 2013-04-18] (Secunia) ==================== Drivers (Whitelisted) ==================== R2 aswFsBlk; C:\Windows\System32\Drivers\aswFsBlk.sys [33400 2013-08-30] (AVAST Software) R1 aswFW; C:\Windows\System32\Drivers\aswFW.sys [131232 2013-08-30] (AVAST Software) R0 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-08-30] (AVAST Software) R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-08-30] (AVAST Software) R0 aswNdis; C:\Windows\System32\DRIVERS\aswNdis.sys [12368 2013-03-13] (ALWIL Software) R0 aswNdis2; C:\Windows\System32\Drivers\aswNdis2.sys [270824 2013-08-30] (AVAST Software) R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [72016 2013-08-30] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-08-30] () R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1030952 2013-08-30] (AVAST Software) R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [378944 2013-08-30] (AVAST Software) R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [64288 2013-08-30] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [204880 2013-08-30] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 PSI; C:\Windows\System32\DRIVERS\psi_mf_amd64.sys [18456 2013-04-18] (Secunia) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.) S3 ALSysIO; \??\C:\Users\ADMINI~1\AppData\Local\Temp\ALSysIO64.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-10-06 12:52 - 2013-10-06 12:52 - 00000000 ____D C:\FRST 2013-10-06 12:50 - 2013-10-06 12:49 - 01954124 _____ (Farbar) C:\Users\Mark\Desktop\FRST64.exe 2013-10-06 12:06 - 2013-10-06 12:06 - 00000000 ____D C:\Program Files (x86)\ESET 2013-10-06 12:00 - 2013-10-06 12:00 - 00001174 _____ C:\Users\Mark\Desktop\AdwCleaner[s0].txt 2013-10-06 11:52 - 2013-10-06 11:58 - 00000000 ____D C:\AdwCleaner 2013-10-06 11:52 - 2013-10-06 11:51 - 01045226 _____ C:\Users\Mark\Desktop\AdwCleaner.exe 2013-10-06 11:39 - 2013-10-06 11:39 - 00003296 _____ C:\Users\Mark\Desktop\JRT.txt 2013-10-06 11:32 - 2013-10-06 11:32 - 00000000 ____D C:\Windows\ERUNT 2013-10-06 11:31 - 2013-10-06 11:31 - 01032220 _____ (Thisisu) C:\Users\Mark\Desktop\JRT.exe 2013-10-06 11:09 - 2013-10-06 11:28 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-10-06 11:07 - 2013-10-06 11:28 - 00000000 ____D C:\Users\Mark\Desktop\mbar 2013-10-06 11:05 - 2013-10-06 11:05 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Mark\Desktop\mbar-1.07.0.1005.exe 2013-10-06 02:27 - 2013-10-06 02:27 - 00002004 _____ C:\Users\Mark\Desktop\RKreport[0]_S_10062013_022734.txt 2013-10-06 02:25 - 2013-10-06 02:28 - 00000000 ____D C:\Users\Mark\Desktop\RK_Quarantine 2013-10-06 02:24 - 2013-10-06 02:24 - 03980800 _____ C:\Users\Mark\Desktop\RogueKillerX64.exe 2013-10-06 02:23 - 2013-10-06 02:23 - 00000000 ____D C:\Windows\ERDNT 2013-10-06 02:21 - 2013-10-06 02:22 - 00000000 ____D C:\Program Files (x86)\ERUNT 2013-10-06 02:21 - 2013-10-06 02:21 - 00000888 _____ C:\Users\Mark\Desktop\NTREGOPT.lnk 2013-10-06 02:21 - 2013-10-06 02:21 - 00000888 _____ C:\Users\Administrator\Desktop\NTREGOPT.lnk 2013-10-06 02:21 - 2013-10-06 02:21 - 00000869 _____ C:\Users\Mark\Desktop\ERUNT.lnk 2013-10-06 02:21 - 2013-10-06 02:21 - 00000869 _____ C:\Users\Administrator\Desktop\ERUNT.lnk 2013-10-06 02:14 - 2013-10-06 02:14 - 00791393 _____ (Lars Hederer ) C:\Users\Mark\Desktop\erunt-setup.exe 2013-10-06 02:11 - 2013-10-06 02:12 - 00002702 _____ C:\Users\Mark\Desktop\Rkill.txt 2013-10-06 02:11 - 2013-10-06 02:11 - 00000000 ____D C:\Users\Mark\Desktop\rkill 2013-10-06 02:09 - 2013-10-06 02:09 - 01898112 _____ (Bleeping Computer, LLC) C:\Users\Mark\Desktop\rkill.exe 2013-10-05 02:36 - 2013-10-05 02:36 - 00024437 _____ C:\Users\Mark\Desktop\dds.txt 2013-10-05 02:36 - 2013-10-05 02:36 - 00009905 _____ C:\Users\Mark\Desktop\attach.txt 2013-10-05 02:33 - 2013-10-05 02:33 - 00688992 ____R (Swearware) C:\Users\Mark\Desktop\dds.scr 2013-10-04 12:19 - 2013-10-04 12:19 - 00001808 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk 2013-10-04 12:19 - 2013-10-04 12:19 - 00000000 ____D C:\Users\Mark\AppData\Roaming\SUPERAntiSpyware.com 2013-10-04 12:19 - 2013-10-04 12:19 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com 2013-10-04 12:19 - 2013-10-04 12:19 - 00000000 ____D C:\Program Files\SUPERAntiSpyware 2013-10-04 12:18 - 2013-10-04 12:18 - 27866848 _____ (SUPERAntiSpyware) C:\Users\Mark\Downloads\SUPERAntiSpyware.exe 2013-10-04 11:23 - 2013-10-04 11:23 - 04369632 _____ (Piriform Ltd) C:\Users\Mark\Downloads\ccsetup406.exe 2013-10-04 02:10 - 2013-10-04 02:14 - 00000000 ____D C:\ProgramData\HitmanPro 2013-10-04 02:09 - 2013-10-04 02:10 - 09879648 _____ (SurfRight B.V.) C:\Users\Mark\Downloads\HitmanPro_x64.exe 2013-10-04 00:50 - 2013-10-04 00:50 - 00001743 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-10-04 00:50 - 2013-10-04 00:50 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-10-04 00:50 - 2013-10-04 00:50 - 00000000 ____D C:\Program Files\iTunes 2013-10-04 00:50 - 2013-10-04 00:50 - 00000000 ____D C:\Program Files\iPod 2013-10-04 00:50 - 2013-10-04 00:50 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-10-03 19:21 - 2013-10-03 19:22 - 00000000 ____D C:\Users\Mark\EDV Photos 2013-09-26 02:30 - 2013-09-26 02:32 - 00000000 ____D C:\Users\Mark\Documents\jane's pics 2013-09-18 13:36 - 2013-09-18 13:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-13 14:36 - 2013-09-13 14:36 - 15769848 _____ (Adobe Systems Inc.) C:\Users\Mark\Downloads\Shockwave_Installer_Full(2).exe 2013-09-13 14:36 - 2013-09-13 14:36 - 00000000 ____D C:\Windows\SysWOW64\Adobe 2013-09-11 19:55 - 2013-09-11 19:55 - 15769848 _____ (Adobe Systems Inc.) C:\Users\Mark\Downloads\Shockwave_Installer_Full(1).exe 2013-09-11 19:55 - 2013-09-11 19:55 - 07912440 _____ (Adobe Systems Inc.) C:\Users\Mark\Downloads\Shockwave_Installer_Slim.exe 2013-09-11 19:40 - 2013-07-31 09:08 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-09-11 19:39 - 2013-07-31 10:17 - 17833472 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-09-11 19:39 - 2013-07-31 09:42 - 10926080 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-09-11 19:39 - 2013-07-31 09:29 - 02312704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-09-11 19:39 - 2013-07-31 09:20 - 01346560 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-09-11 19:39 - 2013-07-31 09:19 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-09-11 19:39 - 2013-07-31 09:18 - 01494528 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2013-09-11 19:39 - 2013-07-31 09:17 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2013-09-11 19:39 - 2013-07-31 09:16 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-09-11 19:39 - 2013-07-31 09:14 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2013-09-11 19:39 - 2013-07-31 09:13 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-09-11 19:39 - 2013-07-31 09:13 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2013-09-11 19:39 - 2013-07-31 09:11 - 02147840 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-09-11 19:39 - 2013-07-31 09:11 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-09-11 19:39 - 2013-07-31 09:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2013-09-11 19:39 - 2013-07-31 09:05 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-09-11 19:39 - 2013-07-31 06:30 - 12335104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-09-11 19:39 - 2013-07-31 06:05 - 09738752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-09-11 19:39 - 2013-07-31 06:00 - 01800704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-09-11 19:39 - 2013-07-31 05:53 - 01104896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-09-11 19:39 - 2013-07-31 05:52 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2013-09-11 19:39 - 2013-07-31 05:52 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-09-11 19:39 - 2013-07-31 05:51 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2013-09-11 19:39 - 2013-07-31 05:49 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-09-11 19:39 - 2013-07-31 05:48 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-09-11 19:39 - 2013-07-31 05:48 - 00420864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2013-09-11 19:39 - 2013-07-31 05:48 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2013-09-11 19:39 - 2013-07-31 05:47 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-09-11 19:39 - 2013-07-31 05:46 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-09-11 19:39 - 2013-07-31 05:45 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-09-11 19:39 - 2013-07-31 05:45 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2013-09-11 19:39 - 2013-07-31 05:42 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-09-11 19:34 - 2013-08-04 22:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys 2013-09-11 19:34 - 2013-08-01 22:23 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-09-11 19:34 - 2013-08-01 22:15 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-09-11 19:34 - 2013-08-01 22:15 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2013-09-11 19:34 - 2013-08-01 22:15 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2013-09-11 19:34 - 2013-08-01 22:15 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2013-09-11 19:34 - 2013-08-01 22:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2013-09-11 19:34 - 2013-08-01 22:14 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2013-09-11 19:34 - 2013-08-01 22:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2013-09-11 19:34 - 2013-08-01 22:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 22:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:59 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-09-11 19:34 - 2013-08-01 21:59 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-09-11 19:34 - 2013-08-01 21:51 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-09-11 19:34 - 2013-08-01 21:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2013-09-11 19:34 - 2013-08-01 21:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2013-09-11 19:34 - 2013-08-01 21:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 21:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2013-09-11 19:34 - 2013-08-01 20:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2013-09-11 19:34 - 2013-08-01 20:45 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-09-11 19:34 - 2013-08-01 20:45 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-09-11 19:34 - 2013-08-01 20:45 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-09-11 19:34 - 2013-08-01 20:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-09-11 19:34 - 2013-08-01 20:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 20:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 20:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2013-09-11 19:34 - 2013-08-01 20:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2013-09-11 19:33 - 2013-08-07 21:20 - 03155456 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2013-09-11 19:33 - 2013-07-25 22:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2013-09-11 19:33 - 2013-07-25 22:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll 2013-09-11 19:33 - 2013-07-25 21:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2013-09-11 19:33 - 2013-07-25 21:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll ==================== One Month Modified Files and Folders ======= 2013-10-06 12:52 - 2013-10-06 12:52 - 00000000 ____D C:\FRST 2013-10-06 12:52 - 2013-06-18 01:27 - 01551477 _____ C:\Windows\WindowsUpdate.log 2013-10-06 12:49 - 2013-10-06 12:50 - 01954124 _____ (Farbar) C:\Users\Mark\Desktop\FRST64.exe 2013-10-06 12:06 - 2013-10-06 12:06 - 00000000 ____D C:\Program Files (x86)\ESET 2013-10-06 12:06 - 2009-07-14 00:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-10-06 12:06 - 2009-07-14 00:45 - 00032064 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-10-06 12:04 - 2013-06-18 16:23 - 00003918 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{EB410BCB-C8D0-432E-B2DF-80AB98D4D364} 2013-10-06 12:02 - 2009-07-14 01:13 - 00726316 _____ C:\Windows\system32\PerfStringBackup.INI 2013-10-06 12:00 - 2013-10-06 12:00 - 00001174 _____ C:\Users\Mark\Desktop\AdwCleaner[s0].txt 2013-10-06 11:59 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-10-06 11:59 - 2009-07-14 00:51 - 00078498 _____ C:\Windows\setupact.log 2013-10-06 11:58 - 2013-10-06 11:52 - 00000000 ____D C:\AdwCleaner 2013-10-06 11:51 - 2013-10-06 11:52 - 01045226 _____ C:\Users\Mark\Desktop\AdwCleaner.exe 2013-10-06 11:39 - 2013-10-06 11:39 - 00003296 _____ C:\Users\Mark\Desktop\JRT.txt 2013-10-06 11:32 - 2013-10-06 11:32 - 00000000 ____D C:\Windows\ERUNT 2013-10-06 11:31 - 2013-10-06 11:31 - 01032220 _____ (Thisisu) C:\Users\Mark\Desktop\JRT.exe 2013-10-06 11:28 - 2013-10-06 11:09 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-10-06 11:28 - 2013-10-06 11:07 - 00000000 ____D C:\Users\Mark\Desktop\mbar 2013-10-06 11:05 - 2013-10-06 11:05 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Mark\Desktop\mbar-1.07.0.1005.exe 2013-10-06 02:28 - 2013-10-06 02:25 - 00000000 ____D C:\Users\Mark\Desktop\RK_Quarantine 2013-10-06 02:27 - 2013-10-06 02:27 - 00002004 _____ C:\Users\Mark\Desktop\RKreport[0]_S_10062013_022734.txt 2013-10-06 02:24 - 2013-10-06 02:24 - 03980800 _____ C:\Users\Mark\Desktop\RogueKillerX64.exe 2013-10-06 02:23 - 2013-10-06 02:23 - 00000000 ____D C:\Windows\ERDNT 2013-10-06 02:22 - 2013-10-06 02:21 - 00000000 ____D C:\Program Files (x86)\ERUNT 2013-10-06 02:21 - 2013-10-06 02:21 - 00000888 _____ C:\Users\Mark\Desktop\NTREGOPT.lnk 2013-10-06 02:21 - 2013-10-06 02:21 - 00000888 _____ C:\Users\Administrator\Desktop\NTREGOPT.lnk 2013-10-06 02:21 - 2013-10-06 02:21 - 00000869 _____ C:\Users\Mark\Desktop\ERUNT.lnk 2013-10-06 02:21 - 2013-10-06 02:21 - 00000869 _____ C:\Users\Administrator\Desktop\ERUNT.lnk 2013-10-06 02:14 - 2013-10-06 02:14 - 00791393 _____ (Lars Hederer ) C:\Users\Mark\Desktop\erunt-setup.exe 2013-10-06 02:12 - 2013-10-06 02:11 - 00002702 _____ C:\Users\Mark\Desktop\Rkill.txt 2013-10-06 02:11 - 2013-10-06 02:11 - 00000000 ____D C:\Users\Mark\Desktop\rkill 2013-10-06 02:09 - 2013-10-06 02:09 - 01898112 _____ (Bleeping Computer, LLC) C:\Users\Mark\Desktop\rkill.exe 2013-10-05 11:07 - 2013-06-22 00:38 - 00004182 _____ C:\Windows\System32\Tasks\avast! Emergency Update 2013-10-05 02:36 - 2013-10-05 02:36 - 00024437 _____ C:\Users\Mark\Desktop\dds.txt 2013-10-05 02:36 - 2013-10-05 02:36 - 00009905 _____ C:\Users\Mark\Desktop\attach.txt 2013-10-05 02:33 - 2013-10-05 02:33 - 00688992 ____R (Swearware) C:\Users\Mark\Desktop\dds.scr 2013-10-04 12:19 - 2013-10-04 12:19 - 00001808 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk 2013-10-04 12:19 - 2013-10-04 12:19 - 00000000 ____D C:\Users\Mark\AppData\Roaming\SUPERAntiSpyware.com 2013-10-04 12:19 - 2013-10-04 12:19 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com 2013-10-04 12:19 - 2013-10-04 12:19 - 00000000 ____D C:\Program Files\SUPERAntiSpyware 2013-10-04 12:18 - 2013-10-04 12:18 - 27866848 _____ (SUPERAntiSpyware) C:\Users\Mark\Downloads\SUPERAntiSpyware.exe 2013-10-04 11:36 - 2013-06-18 21:35 - 00000000 _____ C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2013-10-04 11:36 - 2013-06-18 21:17 - 00000052 _____ C:\Windows\SysWOW64\DOErrors.log 2013-10-04 11:24 - 2013-06-18 21:09 - 00000822 _____ C:\Users\Public\Desktop\CCleaner.lnk 2013-10-04 11:24 - 2013-06-18 21:09 - 00000000 ____D C:\Program Files\CCleaner 2013-10-04 11:23 - 2013-10-04 11:23 - 04369632 _____ (Piriform Ltd) C:\Users\Mark\Downloads\ccsetup406.exe 2013-10-04 02:14 - 2013-10-04 02:10 - 00000000 ____D C:\ProgramData\HitmanPro 2013-10-04 02:10 - 2013-10-04 02:09 - 09879648 _____ (SurfRight B.V.) C:\Users\Mark\Downloads\HitmanPro_x64.exe 2013-10-04 02:09 - 2013-06-18 21:30 - 00003180 _____ C:\Windows\System32\Tasks\HPCeeScheduleForMark 2013-10-04 02:09 - 2013-06-18 21:30 - 00000328 _____ C:\Windows\Tasks\HPCeeScheduleForMark.job 2013-10-04 02:07 - 2010-11-20 23:47 - 00322854 _____ C:\Windows\PFRO.log 2013-10-04 00:50 - 2013-10-04 00:50 - 00001743 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-10-04 00:50 - 2013-10-04 00:50 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-10-04 00:50 - 2013-10-04 00:50 - 00000000 ____D C:\Program Files\iTunes 2013-10-04 00:50 - 2013-10-04 00:50 - 00000000 ____D C:\Program Files\iPod 2013-10-04 00:50 - 2013-10-04 00:50 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-10-03 19:22 - 2013-10-03 19:21 - 00000000 ____D C:\Users\Mark\EDV Photos 2013-10-03 19:22 - 2013-06-17 23:16 - 00000000 ____D C:\Users\Mark 2013-10-01 10:57 - 2013-06-18 16:30 - 00000000 _____ C:\Windows\SysWOW64\config.nt 2013-09-26 02:32 - 2013-09-26 02:30 - 00000000 ____D C:\Users\Mark\Documents\jane's pics 2013-09-24 12:05 - 2013-09-04 13:27 - 00000000 ____D C:\Users\Mark\Documents\LAW 2550 Computer Assisted Legal Research 2013-09-22 21:24 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\LiveKernelReports 2013-09-21 13:18 - 2013-08-12 20:57 - 00000000 ____D C:\Users\Mark\momsss 2013-09-18 15:08 - 2013-06-18 16:43 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-09-18 13:37 - 2013-06-18 16:43 - 00000000 ____D C:\Users\Mark\AppData\Local\Mozilla 2013-09-18 13:36 - 2013-09-18 13:36 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-09-13 14:36 - 2013-09-13 14:36 - 15769848 _____ (Adobe Systems Inc.) C:\Users\Mark\Downloads\Shockwave_Installer_Full(2).exe 2013-09-13 14:36 - 2013-09-13 14:36 - 00000000 ____D C:\Windows\SysWOW64\Adobe 2013-09-13 14:34 - 2011-03-31 00:24 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2013-09-11 22:34 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache 2013-09-11 20:00 - 2013-06-18 20:59 - 00000000 ____D C:\Users\Mark\AppData\Local\Adobe 2013-09-11 19:59 - 2013-06-18 20:59 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-09-11 19:59 - 2013-06-18 20:59 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-09-11 19:55 - 2013-09-11 19:55 - 15769848 _____ (Adobe Systems Inc.) C:\Users\Mark\Downloads\Shockwave_Installer_Full(1).exe 2013-09-11 19:55 - 2013-09-11 19:55 - 07912440 _____ (Adobe Systems Inc.) C:\Users\Mark\Downloads\Shockwave_Installer_Slim.exe 2013-09-11 19:44 - 2013-06-18 16:18 - 00000000 ___RD C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-09-11 19:44 - 2013-06-18 16:18 - 00000000 ___RD C:\Users\Mark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-09-11 19:44 - 2009-07-14 00:45 - 00417136 _____ C:\Windows\system32\FNTCACHE.DAT 2013-09-11 19:42 - 2013-07-14 02:43 - 00000000 ____D C:\Windows\system32\MRT 2013-09-11 19:41 - 2013-06-18 17:02 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-09-11 19:40 - 2013-06-18 18:58 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-09-09 13:39 - 2013-06-18 02:14 - 00000000 ___RD C:\Users\Public\Recorded TV Some content of TEMP: ==================== C:\Users\Mark\AppData\Local\Temp\Extract.exe C:\Users\Mark\AppData\Local\Temp\install_reader11_en_mssd_aaa_aih.exe C:\Users\Mark\AppData\Local\Temp\ntdll_dump.dll C:\Users\Mark\AppData\Local\Temp\Quarantine.exe C:\Users\Mark\AppData\Local\Temp\SP53462.exe C:\Users\Mark\AppData\Local\Temp\SP54714.exe C:\Users\Mark\AppData\Local\Temp\SP54841.exe C:\Users\Mark\AppData\Local\Temp\SP54900.exe C:\Users\Mark\AppData\Local\Temp\SP55094.exe C:\Users\Mark\AppData\Local\Temp\SP55101.exe C:\Users\Mark\AppData\Local\Temp\SP55102.exe C:\Users\Mark\AppData\Local\Temp\SP55104.exe C:\Users\Mark\AppData\Local\Temp\SP55109.exe C:\Users\Mark\AppData\Local\Temp\SP55150.exe C:\Users\Mark\AppData\Local\Temp\SP55151.exe C:\Users\Mark\AppData\Local\Temp\SP55152.exe C:\Users\Mark\AppData\Local\Temp\sp58915.exe C:\Users\Mark\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Mark\AppData\Local\Temp\UninstallHPTCA.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-10-01 11:50 ==================== End Of Log ============================ (5b) Addition.txt Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-10-2013 Ran by Mark at 2013-10-06 12:53:01 Running from C:\Users\Mark\Desktop Boot Mode: Normal ========================================================== ==================== Security Center ======================== AV: avast! Internet Security (Disabled - Up to date) {2B2D1395-420B-D5C9-657E-930FE358FC3C} AS: avast! Internet Security (Disabled - Up to date) {904CF271-6431-DA47-5FCE-A87D98DFB681} AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: avast! Internet Security (Disabled) {131692B0-0864-D491-4E21-3A3A1D8BBB47} ==================== Installed Programs ====================== Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.168) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.168) Adobe Reader XI (11.0.04) (x32 Version: 11.0.04) Adobe Shockwave Player 12.0 (x32 Version: 12.0.4.144) Apple Application Support (x32 Version: 2.3.6) Apple Mobile Device Support (Version: 7.0.0.117) Apple Software Update (x32 Version: 2.1.3.127) ATI Catalyst Install Manager (Version: 3.0.816.0) AuthenTec TrueAPI (Version: 1.2.1.33) avast! Internet Security (x32 Version: 8.0.1497.0) Bonjour (Version: 3.0.0.10) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center (x32 Version: 2011.0315.958.16016) Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0315.958.16016) Catalyst Control Center InstallProxy (x32 Version: 2011.0315.958.16016) Catalyst Control Center Localization All (x32 Version: 2011.0315.958.16016) Catalyst Control Center Profiles Mobile (x32 Version: 2011.0315.958.16016) CCC Help Chinese Standard (x32 Version: 2011.0315.0957.16016) CCC Help Chinese Traditional (x32 Version: 2011.0315.0957.16016) CCC Help Czech (x32 Version: 2011.0315.0957.16016) CCC Help Danish (x32 Version: 2011.0315.0957.16016) CCC Help Dutch (x32 Version: 2011.0315.0957.16016) CCC Help English (x32 Version: 2011.0315.0957.16016) CCC Help Finnish (x32 Version: 2011.0315.0957.16016) CCC Help French (x32 Version: 2011.0315.0957.16016) CCC Help German (x32 Version: 2011.0315.0957.16016) CCC Help Greek (x32 Version: 2011.0315.0957.16016) CCC Help Hungarian (x32 Version: 2011.0315.0957.16016) CCC Help Italian (x32 Version: 2011.0315.0957.16016) CCC Help Japanese (x32 Version: 2011.0315.0957.16016) CCC Help Korean (x32 Version: 2011.0315.0957.16016) CCC Help Norwegian (x32 Version: 2011.0315.0957.16016) CCC Help Polish (x32 Version: 2011.0315.0957.16016) CCC Help Portuguese (x32 Version: 2011.0315.0957.16016) CCC Help Russian (x32 Version: 2011.0315.0957.16016) CCC Help Spanish (x32 Version: 2011.0315.0957.16016) CCC Help Swedish (x32 Version: 2011.0315.0957.16016) CCC Help Thai (x32 Version: 2011.0315.0957.16016) CCC Help Turkish (x32 Version: 2011.0315.0957.16016) ccc-utility64 (Version: 2011.0315.958.16016) CCleaner (Version: 4.06) CyberLink PowerDVD (x32 Version: 10.0.5.4504) CyberLink YouCam (x32 Version: 3.5.1.3908) D3DX10 (x32 Version: 15.4.2368.0902) Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32) Energy Star Digital Logo (x32 Version: 1.0.1) EPSON WorkForce 630 Series Printer Uninstall ERUNT 1.1j (x32) ESU for Microsoft Windows 7 (x32 Version: 1.0.0) Evernote v. 4.2.2 (x32 Version: 4.2.2.3979) Hewlett-Packard ACLM.NET v1.2.1.1 (x32 Version: 1.00.0000) HP 3D DriveGuard (Version: 4.1.9.1) HP Auto (Version: 1.0.12935.3667) HP Client Services (Version: 1.1.12938.3539) HP Connection Manager (x32 Version: 4.0.45.1) HP Customer Experience Enhancements (x32 Version: 6.0.1.7) HP Documentation (x32 Version: 1.1.0.0) HP MovieStore (x32 Version: 1.0.047) HP MovieStore (x32 Version: 2.0) HP On Screen Display (x32 Version: 1.3.5) HP Power Manager (x32 Version: 1.4.4) HP Quick Launch (x32 Version: 2.5.2) HP Setup (x32 Version: 8.6.4530.3651) HP Setup Manager (x32 Version: 1.1.13231.3673) HP SimplePass 2011 (x32 Version: 5.1.0.495) HP Software Framework (x32 Version: 4.0.110.1) HP Support Assistant (x32 Version: 7.0.39.15) IDT Audio (x32 Version: 1.0.6345.0) Intel PROSet Wireless Intel PROSet Wireless (x32) Intel® Control Center (x32 Version: 1.2.1.1007) Intel® Display Audio Driver (x32 Version: 6.14.00.3074) Intel® Management Engine Components (x32 Version: 7.0.0.1144) Intel® PROSet/Wireless WiFi Software (Version: 14.2.0000) Intel® Rapid Storage Technology (x32 Version: 10.6.0.1002) Intel® Wireless Display Intel® Wireless Display (x32 Version: 2.0.30.0) iTunes (Version: 11.1.1.11) Junk Mail filter update (x32 Version: 15.4.3502.0922) Magic Desktop (x32 Version: 3.0) Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000) Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Professional 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.7015.1000) Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000) Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000) Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.7015.1000) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (Version: 10.0.30319) Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0) Mozilla Firefox 24.0 (x86 en-US) (x32 Version: 24.0) Mozilla Maintenance Service (x32 Version: 24.0) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0) MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0) PlayReady PC Runtime x86 (x32 Version: 1.3.0) PX Profile Update (x32 Version: 1.00.1.) Realtek Ethernet Controller Driver (x32 Version: 7.41.216.2011) Realtek PCIE Card Reader (x32 Version: 6.1.7601.83) Recovery Manager (x32 Version: 2.0.0) Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.19.0) Revo Uninstaller Pro 3.0.5 (Version: 3.0.5) RoxioNow Player (x32 Version: 1.9.5.103) Secunia PSI (3.0.0.7009) (x32 Version: 3.0.0.7009) Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32) SUPERAntiSpyware (Version: 5.6.1040) swMSM (x32 Version: 12.0.0.1) Synaptics TouchPad Driver (Version: 15.3.29.0) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32) Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2553157) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589370) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2760758) 32-Bit Edition (x32) Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32) Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32) Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32) Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32) Validity WBF DDK (Version: 4.3.205.0) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3508.1109) Windows Live ID Sign-in Assistant (Version: 7.250.4225.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3508.1109) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3502.0922) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 13-09-2013 18:34:21 Removed Adobe Shockwave Player 12.0. 14-09-2013 12:06:21 Device Driver Package Install: TAP-Windows Provider V9 Network adapters 21-09-2013 15:19:16 Scheduled Checkpoint 30-09-2013 03:57:18 Scheduled Checkpoint ==================== Hosts content: ========================== 2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {0F1120EA-E199-4A7F-8AFB-1512296ADB9F} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard) Task: {2B35D3A7-3A1C-4F91-AC09-22500F4B7091} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-09-19] (Piriform Ltd) Task: {5F8555E3-6727-46E0-9444-23CDB0AF29A4} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2013-08-09] (Hewlett-Packard) Task: {60B1F19D-9F70-44BB-8B6F-637221092215} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-08-30] (AVAST Software) Task: {86CE57DF-8AEE-41DD-B1A3-FFA48DF453CE} - System32\Tasks\HPCeeScheduleForMark => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2010-09-14] (Hewlett-Packard) Task: {8EEEE264-B715-4604-9553-9B02E873989F} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc Task: {B11036C0-5A2E-41C3-A375-6381E2D8256C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2012-09-05] (Hewlett-Packard Company) Task: {BB1D236E-56BC-41BA-A985-C1BA628AC4F6} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2011-03-08] (CyberLink) Task: {C2083654-6359-4045-9012-B0A1879A5394} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: {C9DB4465-85B6-4291-93FF-7B4062885D76} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HPSAObjUtilTask => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\UtilTask.exe [2013-09-17] (Microsoft) Task: {FE6525FB-345B-4769-B599-364D0F85E05E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2012-09-27] (Hewlett-Packard Company) Task: C:\Windows\Tasks\HPCeeScheduleForMark.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe ==================== Loaded Modules (whitelisted) ============= 2013-06-18 01:24 - 2011-01-27 12:11 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll 2011-07-27 20:07 - 2011-07-27 20:07 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll 2011-03-14 17:21 - 2011-03-14 17:21 - 00016384 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll 2011-03-15 12:57 - 2011-03-15 12:57 - 00243712 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll 2010-06-24 05:21 - 2010-06-24 05:21 - 01102336 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\System.Data.SQLite.dll 2013-10-06 12:01 - 2013-10-06 10:01 - 02104832 _____ () C:\Program Files\AVAST Software\Avast\defs\13100601\algo.dll 2013-04-21 21:44 - 2013-04-21 21:44 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll 2013-04-21 21:44 - 2013-04-21 21:44 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll 2013-08-15 01:09 - 2013-08-15 01:09 - 00172544 _____ () C:\Windows\assembly\NativeImages_v2.0.50727_32\IsdiInterop\1beb84c27c2edeb38839916524b9df4d\IsdiInterop.ni.dll 2013-06-18 01:23 - 2011-05-20 10:05 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IsdiInterop.dll 2010-06-24 05:19 - 2010-06-24 05:19 - 00514570 _____ () C:\Program Files (x86)\Hewlett-Packard\HP Connection Manager\sqlite3.dll ==================== Alternate Data Streams (whitelisted) ========= ==================== Safe Mode (whitelisted) =================== ==================== Faulty Device Manager Devices ============= Name: avast! SecureLine TAP Adapter Description: avast! SecureLine TAP Adapter Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318} Manufacturer: TAP-Windows Provider V9 Service: tap0901 Problem: : This device is disabled. (Code 22) Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions. ==================== Event log errors: ========================= Application errors: ================== Error: (10/06/2013 11:59:45 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/06/2013 11:54:29 AM) (Source: WinMgmt) (User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 System errors: ============= Microsoft Office Sessions: ========================= Error: (10/06/2013 11:59:45 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 Error: (10/06/2013 11:54:29 AM) (Source: WinMgmt)(User: ) Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003 ==================== Memory info =========================== Percentage of memory in use: 36% Total physical RAM: 6091.86 MB Available physical RAM: 3870.48 MB Total Pagefile: 12181.9 MB Available Pagefile: 9406.26 MB Total Virtual: 8192 MB Available Virtual: 8191.8 MB ==================== Drives ================================ Drive c: () (Fixed) (Total:683.56 GB) (Free:574.28 GB) NTFS ==>[system with boot components (obtained from reading drive)] Drive d: (RECOVERY) (Fixed) (Total:14.78 GB) (Free:1.64 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or 8) (Size: 699 GB) (Disk ID: 15C975F3) Partition 1: (Active) - (Size=199 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=684 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=15 GB) - (Type=07 NTFS) Partition 4: (Not Active) - (Size=103 MB) - (Type=0C) ==================== End Of Log ============================
  12. Awesome, looking really good so far. I'll post two different replies so it's easier for you to read . (1) Malwarebytes Rootkit logs (1A) mbarlog.txt Malwarebytes Anti-Rootkit BETA 1.07.0.1005 www.malwarebytes.org Database version: v2013.10.06.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 Mark :: MARK-HP [administrator] 10/6/2013 11:09:15 AM mbar-log-2013-10-06 (11-09-15).txt Scan type: Quick scan Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken Scan options disabled: Objects scanned: 247490 Time elapsed: 12 minute(s), 3 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) Physical Sectors Detected: 0 (No malicious items detected) (end) (1B) System-log.txt --------------------------------------- Malwarebytes Anti-Rootkit BETA 1.07.0.1005 © Malwarebytes Corporation 2011-2012 OS version: 6.1.7601 Windows 7 Service Pack 1 x64 Account is Administrative Internet Explorer version: 9.0.8112.16421 File system is: NTFS Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED CPU speed: 1.995000 GHz Memory total: 6387777536, free: 4360585216 Downloaded database version: v2013.10.06.03 Downloaded database version: v2013.09.30.01 ======================================= Initializing... ------------ Kernel report ------------ 10/06/2013 11:09:12 ------------ Loaded modules ----------- \SystemRoot\system32\ntoskrnl.exe \SystemRoot\system32\hal.dll \SystemRoot\system32\kdcom.dll \SystemRoot\system32\mcupdate_GenuineIntel.dll \SystemRoot\system32\PSHED.dll \SystemRoot\system32\CLFS.SYS \SystemRoot\system32\CI.dll \SystemRoot\system32\drivers\Wdf01000.sys \SystemRoot\system32\drivers\WDFLDR.SYS \SystemRoot\system32\drivers\ACPI.sys \SystemRoot\system32\drivers\WMILIB.SYS \SystemRoot\system32\drivers\msisadrv.sys \SystemRoot\system32\drivers\pci.sys \SystemRoot\system32\drivers\vdrvroot.sys \SystemRoot\System32\drivers\partmgr.sys \SystemRoot\system32\drivers\compbatt.sys \SystemRoot\system32\drivers\BATTC.SYS \SystemRoot\system32\drivers\volmgr.sys \SystemRoot\System32\drivers\volmgrx.sys \SystemRoot\System32\drivers\mountmgr.sys \SystemRoot\system32\DRIVERS\iaStor.sys \SystemRoot\system32\drivers\atapi.sys \SystemRoot\system32\drivers\ataport.SYS \SystemRoot\system32\drivers\msahci.sys \SystemRoot\system32\drivers\PCIIDEX.SYS \SystemRoot\system32\drivers\amdxata.sys \SystemRoot\system32\drivers\fltmgr.sys \SystemRoot\system32\drivers\fileinfo.sys \SystemRoot\System32\Drivers\Ntfs.sys \SystemRoot\System32\Drivers\msrpc.sys \SystemRoot\System32\Drivers\ksecdd.sys \SystemRoot\System32\Drivers\cng.sys \SystemRoot\System32\drivers\pcw.sys \SystemRoot\System32\Drivers\aswKbd.sys \SystemRoot\System32\Drivers\Fs_Rec.sys \SystemRoot\system32\drivers\ndis.sys \SystemRoot\system32\drivers\NETIO.SYS \SystemRoot\System32\Drivers\aswNdis2.sys \SystemRoot\System32\Drivers\ksecpkg.sys \SystemRoot\System32\drivers\tcpip.sys \SystemRoot\System32\drivers\fwpkclnt.sys \SystemRoot\system32\DRIVERS\aswNdis.sys \SystemRoot\system32\drivers\volsnap.sys \SystemRoot\System32\Drivers\spldr.sys \SystemRoot\System32\drivers\rdyboost.sys \SystemRoot\System32\Drivers\mup.sys \SystemRoot\System32\drivers\hwpolicy.sys \SystemRoot\system32\DRIVERS\hpdskflt.sys \SystemRoot\System32\DRIVERS\fvevol.sys \SystemRoot\system32\drivers\disk.sys \SystemRoot\system32\drivers\CLASSPNP.SYS \SystemRoot\System32\Drivers\aswVmm.sys \SystemRoot\System32\Drivers\aswRvrt.sys \SystemRoot\system32\DRIVERS\cdrom.sys \SystemRoot\System32\Drivers\aswSnx.SYS \SystemRoot\System32\Drivers\Null.SYS \SystemRoot\System32\Drivers\Beep.SYS \SystemRoot\System32\drivers\vga.sys \SystemRoot\System32\drivers\VIDEOPRT.SYS \SystemRoot\System32\drivers\watchdog.sys \SystemRoot\System32\DRIVERS\RDPCDD.sys \SystemRoot\system32\drivers\rdpencdd.sys \SystemRoot\system32\drivers\rdprefmp.sys \SystemRoot\System32\Drivers\Msfs.SYS \SystemRoot\System32\Drivers\Npfs.SYS \SystemRoot\system32\DRIVERS\tdx.sys \SystemRoot\system32\DRIVERS\TDI.SYS \SystemRoot\System32\Drivers\aswFW.SYS \SystemRoot\System32\Drivers\aswTdi.SYS \SystemRoot\system32\drivers\afd.sys \SystemRoot\System32\Drivers\aswrdr2.sys \SystemRoot\System32\DRIVERS\netbt.sys \SystemRoot\system32\DRIVERS\wfplwf.sys \SystemRoot\system32\DRIVERS\pacer.sys \SystemRoot\system32\DRIVERS\vwififlt.sys \SystemRoot\system32\DRIVERS\netbios.sys \SystemRoot\system32\DRIVERS\wanarp.sys \SystemRoot\system32\drivers\termdd.sys \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS \??\C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS \SystemRoot\system32\DRIVERS\rdbss.sys \SystemRoot\system32\drivers\nsiproxy.sys \SystemRoot\system32\drivers\mssmbios.sys \SystemRoot\System32\drivers\discache.sys \SystemRoot\System32\Drivers\dfsc.sys \SystemRoot\system32\drivers\blbdrive.sys \SystemRoot\System32\Drivers\aswSP.SYS \SystemRoot\system32\DRIVERS\tunnel.sys \SystemRoot\system32\DRIVERS\atikmpag.sys \SystemRoot\system32\DRIVERS\atikmdag.sys \SystemRoot\system32\DRIVERS\igdpmd64.sys \SystemRoot\System32\drivers\dxgkrnl.sys \SystemRoot\System32\drivers\dxgmms1.sys \SystemRoot\system32\DRIVERS\HECIx64.sys \SystemRoot\system32\drivers\usbehci.sys \SystemRoot\system32\drivers\USBPORT.SYS \SystemRoot\system32\DRIVERS\HDAudBus.sys \SystemRoot\system32\DRIVERS\Rt64win7.sys \SystemRoot\system32\DRIVERS\NETwNs64.sys \SystemRoot\system32\DRIVERS\vwifibus.sys \SystemRoot\system32\DRIVERS\RtsPStor.sys \SystemRoot\System32\Drivers\fastfat.SYS \SystemRoot\system32\DRIVERS\nusb3xhc.sys \SystemRoot\system32\DRIVERS\USBD.SYS \SystemRoot\system32\DRIVERS\i8042prt.sys \SystemRoot\system32\DRIVERS\kbdclass.sys \SystemRoot\system32\DRIVERS\SynTP.sys \SystemRoot\system32\DRIVERS\mouclass.sys \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys \SystemRoot\system32\drivers\CmBatt.sys \SystemRoot\system32\DRIVERS\Accelerometer.sys \SystemRoot\system32\drivers\wmiacpi.sys \SystemRoot\system32\DRIVERS\intelppm.sys \SystemRoot\system32\DRIVERS\AMPPAL.sys \SystemRoot\system32\drivers\CompositeBus.sys \SystemRoot\system32\DRIVERS\clwvd.sys \SystemRoot\system32\DRIVERS\ks.sys \SystemRoot\system32\drivers\ksthunk.sys \SystemRoot\system32\DRIVERS\AgileVpn.sys \SystemRoot\system32\DRIVERS\rasl2tp.sys \SystemRoot\system32\DRIVERS\ndistapi.sys \SystemRoot\system32\DRIVERS\ndiswan.sys \SystemRoot\system32\DRIVERS\raspppoe.sys \SystemRoot\system32\DRIVERS\raspptp.sys \SystemRoot\system32\DRIVERS\rassstp.sys \SystemRoot\system32\drivers\swenum.sys \SystemRoot\system32\DRIVERS\umbus.sys \SystemRoot\system32\DRIVERS\WDKMD.sys \SystemRoot\system32\DRIVERS\usbhub.sys \SystemRoot\System32\Drivers\NDProxy.SYS \SystemRoot\system32\DRIVERS\stwrt64.sys \SystemRoot\system32\DRIVERS\portcls.sys \SystemRoot\system32\DRIVERS\drmk.sys \SystemRoot\system32\DRIVERS\IntcDAud.sys \SystemRoot\system32\DRIVERS\nusb3hub.sys \SystemRoot\System32\win32k.sys \SystemRoot\System32\drivers\Dxapi.sys \SystemRoot\System32\Drivers\crashdmp.sys \SystemRoot\System32\Drivers\dump_iaStor.sys \SystemRoot\System32\Drivers\dump_dumpfve.sys \SystemRoot\system32\DRIVERS\usbccgp.sys \SystemRoot\System32\Drivers\usbvideo.sys \SystemRoot\system32\DRIVERS\monitor.sys \SystemRoot\System32\TSDDD.dll \SystemRoot\System32\cdd.dll \SystemRoot\System32\ATMFD.DLL \SystemRoot\system32\drivers\luafv.sys \??\C:\Windows\system32\drivers\aswMonFlt.sys \??\C:\Windows\system32\drivers\mbam.sys \SystemRoot\System32\Drivers\aswFsBlk.SYS \SystemRoot\system32\drivers\WudfPf.sys \SystemRoot\system32\DRIVERS\WinUSB.sys \SystemRoot\system32\DRIVERS\WUDFRd.sys \SystemRoot\system32\DRIVERS\lltdio.sys \SystemRoot\system32\DRIVERS\nwifi.sys \SystemRoot\system32\DRIVERS\ndisuio.sys \SystemRoot\system32\DRIVERS\rspndr.sys \SystemRoot\system32\drivers\HTTP.sys \SystemRoot\system32\DRIVERS\bowser.sys \SystemRoot\System32\drivers\mpsdrv.sys \SystemRoot\system32\DRIVERS\mrxsmb.sys \SystemRoot\system32\DRIVERS\mrxsmb10.sys \SystemRoot\system32\DRIVERS\mrxsmb20.sys \??\C:\Windows\system32\Drivers\rikvm_38F51D56.sys \SystemRoot\system32\drivers\peauth.sys \SystemRoot\System32\Drivers\secdrv.SYS \SystemRoot\System32\DRIVERS\srvnet.sys \SystemRoot\System32\drivers\tcpipreg.sys \SystemRoot\System32\DRIVERS\srv2.sys \SystemRoot\System32\DRIVERS\srv.sys \SystemRoot\system32\DRIVERS\vwifimp.sys \SystemRoot\system32\drivers\spsys.sys \??\C:\Windows\system32\drivers\mbamchameleon.sys \??\C:\Windows\system32\drivers\MBAMSwissArmy.sys \Windows\System32\ntdll.dll \Windows\System32\smss.exe \Windows\System32\apisetschema.dll \Windows\System32\autochk.exe \Windows\System32\advapi32.dll \Windows\System32\rpcrt4.dll \Windows\System32\difxapi.dll \Windows\System32\Wldap32.dll \Windows\System32\msvcrt.dll \Windows\System32\lpk.dll \Windows\System32\nsi.dll \Windows\System32\setupapi.dll \Windows\System32\normaliz.dll \Windows\System32\shlwapi.dll \Windows\System32\shell32.dll \Windows\System32\gdi32.dll \Windows\System32\ole32.dll \Windows\System32\oleaut32.dll \Windows\System32\user32.dll \Windows\System32\kernel32.dll \Windows\System32\comdlg32.dll \Windows\System32\msctf.dll \Windows\System32\iertutil.dll \Windows\System32\wininet.dll \Windows\System32\imm32.dll \Windows\System32\sechost.dll \Windows\System32\usp10.dll \Windows\System32\clbcatq.dll \Windows\System32\urlmon.dll \Windows\System32\ws2_32.dll \Windows\System32\psapi.dll \Windows\System32\imagehlp.dll \Windows\System32\wintrust.dll \Windows\System32\cfgmgr32.dll \Windows\System32\devobj.dll \Windows\System32\comctl32.dll \Windows\System32\KernelBase.dll \Windows\System32\crypt32.dll \Windows\System32\msasn1.dll \Windows\SysWOW64\normaliz.dll ----------- End ----------- Done! <<<1>>> Upper Device Name: \Device\Harddisk0\DR0 Upper Device Object: 0xfffffa8006ba6060 Upper Device Driver Name: \Driver\Disk\ Lower Device Name: \Device\Ide\IAAStorageDevice-1\ Lower Device Object: 0xfffffa800690c050 Lower Device Driver Name: \Driver\iaStor\ <<<2>>> Physical Sector Size: 512 Drive: 0, DevicePointer: 0xfffffa8006ba6060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ --------- Disk Stack ------ DevicePointer: 0xfffffa8006ba6b90, DeviceName: Unknown, DriverName: \Driver\partmgr\ DevicePointer: 0xfffffa8006ba6060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ DevicePointer: 0xfffffa8006a49b10, DeviceName: Unknown, DriverName: \Driver\hpdskflt\ DevicePointer: 0xfffffa800690c050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\ ------------ End ---------- Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\ Upper DeviceData: 0x0, 0x0, 0x0 Lower DeviceData: 0x0, 0x0, 0x0 <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes <<<2>>> <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers... <<<2>>> <<<3>>> Volume: C: File system type: NTFS SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes Done! Drive 0 Scanning MBR on drive 0... Inspecting partition table: MBR Signature: 55AA Disk Signature: 15C975F3 Partition information: Partition 0 type is Primary (0x7) Partition is ACTIVE. Partition starts at LBA: 2048 Numsec = 407552 Partition file system is NTFS Partition is bootable Partition 1 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 409600 Numsec = 1433524224 Partition 2 type is Primary (0x7) Partition is NOT ACTIVE. Partition starts at LBA: 1433933824 Numsec = 31002624 Partition 3 type is Other (0xc) Partition is NOT ACTIVE. Partition starts at LBA: 1464936448 Numsec = 210672 Disk Size: 750156374016 bytes Sector size: 512 bytes Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1465129168-1465149168)... Done! Scan finished ======================================= Removal queue found; removal started Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_i.mbam... Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\Bootstrap_0_0_2048_i.mbam... Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR_0_r.mbam... Removal finished (2) JRT.TXT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 6.0.4 (10.06.2013:1) OS: Windows 7 Home Premium x64 Ran by Mark on Sun 10/06/2013 at 11:32:52.62 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values ~~~ Registry Keys Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{E347C1A5-F643-4D52-889F-7F04B466D97B} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{2fa28606-de77-4029-af96-b231e3b8f827} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{d43b3890-80c7-4010-a95d-1e77b5924dc3} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{E347C1A5-F643-4D52-889F-7F04B466D97B} Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{B7FCA997-D0FB-4FE0-8AFD-255E89CF9671} ~~~ Files ~~~ Folders Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{20A8D269-A6CC-4A31-BD89-E908873BCE1C} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{246486D9-7FA6-4AD6-ACAD-30C633995F08} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{2D03BBC7-72DC-4AF4-BC74-39BC4FCDB15C} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{2F5138A3-6010-4BD5-834B-5C748D1EEBB5} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{42D6E0E7-E1DC-43BA-AC35-2AED6AB97460} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{54BD3296-F6EB-409D-AEC3-D42060FD8064} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{73C7C2EB-E452-4CBE-9EE5-3791234A1D7F} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{74BBC507-FB35-4E6C-8363-29059F1AC2C6} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{7B4F275B-CFF8-4BB6-933E-675B4095E138} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{D09DC2BA-D3F9-4106-B543-9B16D5D5B38E} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{D403E3B7-57B4-454C-8DE1-E5A893EB5AA2} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{DB09A0D1-0375-4975-928D-5AC189C1649D} Successfully deleted: [Empty Folder] C:\Users\Mark\appdata\local\{EC2EC7E5-5F49-41CD-AC3B-9B6AB30E893A} ~~~ FireFox Emptied folder: C:\Users\Mark\AppData\Roaming\mozilla\firefox\profiles\l07ewr6q.default\minidumps [15 files] ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sun 10/06/2013 at 11:39:50.20 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  13. Thanks for the help . Here's the log you asked for: Rougekiller Log RogueKiller V8.7.1 _x64_ [Oct 3 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.adlice.com/forum/ Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Mark [Admin rights] Mode : Scan -- Date : 10/06/2013 02:27:34 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 2 ¤¤¤ [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) (Standard disk drives) - Hitachi HTS727575A9E364 +++++ --- User --- [MBR] 0f2a8580a6716b3f6efd2d6031cb2b29 [bSP] f7f1c757beb8e47a202f3937330092ed : Windows 7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 199 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 699963 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 1433933824 | Size: 15138 Mo 3 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 1464936448 | Size: 102 Mo User = LL1 ... OK! User != LL2 ... KO! --- LL2 --- [MBR] 797a7018a22e68cc61f31786e4450c19 [bSP] f7f1c757beb8e47a202f3937330092ed : Windows 7/8 MBR Code Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 409600 | Size: 77823 Mo 1 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 159791104 | Size: 400 Mo Finished : << RKreport[0]_S_10062013_022734.txt >>
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.