grumble

Seems as though everything is better. Thanks for your help!

Security check output: Results of screen317's Security Check version 0.99.73 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! McAfee Anti-Virus and Anti-Spyware WMI entry may not exist for antivirus; attempting automatic update. `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 Java 7 Update 25 Adobe Flash Player 11.8.800.94 Adobe Reader XI Mozilla Firefox (23.0.1) Google Chrome 28.0.1500.95 Google Chrome 29.0.1547.57 ````````Process Check: objlist.exe by Laurent```````` `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````

Looks good! Mbam output: Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.08.26.06 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16660 Mary :: MARY-DESKTOP [administrator] 8/26/2013 8:21:43 PM mbam-log-2013-08-26 (20-21-43).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P Scan options disabled: Objects scanned: 241465 Time elapsed: 12 minute(s), 46 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

After checking and verifying that I didn't mind the files and directories listed being deleted, I hit clean and got popup from "google" complaining that someone was trying to change default search provider. I elected to retain google as default search provider. Running mbam Quick Scan with PUP > Select Show in Results List and Check for removal. AdwCleaner[s0].txt: # AdwCleaner v3.001 - Report created 26/08/2013 at 20:09:02 # Updated 24/08/2013 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Mary - MARY-DESKTOP # Running from : C:\Users\Mary\Desktop\AdwCleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\ProgramData\Ask Folder Deleted : C:\Program Files (x86)\Ask.com Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\Users\Mary\AppData\Local\Conduit Folder Deleted : C:\Users\Mary\AppData\Local\cre Folder Deleted : C:\Users\Mary\AppData\LocalLow\AskToolbar Folder Deleted : C:\Users\Mary\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Smartbar Folder Deleted : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\CT3268935 Folder Deleted : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\toolbar@ask.com Folder Deleted : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\{7f7f82f1-7c95-47cd-814f-950b56d58fc3} File Deleted : C:\END File Deleted : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\searchplugins\Askcom.xml File Deleted : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\user.js File Deleted : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd Key Deleted : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater] Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}] Key Deleted : HKCU\Software\APN Key Deleted : HKCU\Software\Ask.com Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\AskToolbar Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKLM\Software\APN Key Deleted : HKLM\Software\AskToolbar Key Deleted : HKLM\Software\Conduit Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE} ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16660 -\\ Mozilla Firefox v23.0.1 (en-US) [ File : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\prefs.js ] Line Deleted : user_pref("CT3268935.1000082.isDisplayHidden", "true"); Line Deleted : user_pref("CT3268935.1000234.TWC_TMP_city", "MINNEAPOLIS"); Line Deleted : user_pref("CT3268935.1000234.TWC_TMP_country", "US"); Line Deleted : user_pref("CT3268935.1000234.TWC_locId", "USMN0503"); Line Deleted : user_pref("CT3268935.1000234.TWC_location", "Minneapolis, MN"); Line Deleted : user_pref("CT3268935.1000234.TWC_region", "US"); Line Deleted : user_pref("CT3268935.1000234.TWC_temp_dis", "f"); Line Deleted : user_pref("CT3268935.1000234.TWC_wind_dis", "mph"); Line Deleted : user_pref("CT3268935.1000234.weatherData", "{\"icon\":\"20.png\",\"temperature\":\"30°F\",\"temperatureClear\":\"30°F\",\"highTemperature\":\"35°F\",\"lowTemperature\":\"13°F\",\"feelsLike\":\"23Â[...] Line Deleted : user_pref("CT3268935.CBOpenMAMSettings.enc", "MA=="); Line Deleted : user_pref("CT3268935.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3268935.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3268935.FirstTime", "true"); Line Deleted : user_pref("CT3268935.FirstTimeFF3", "true"); Line Deleted : user_pref("CT3268935.LoginRevertSettingsEnabled", true); Line Deleted : user_pref("CT3268935.RevertSettingsEnabled", true); Line Deleted : user_pref("CT3268935.UserID", "UN71756386110550840"); Line Deleted : user_pref("CT3268935.addressBarTakeOverEnabledInHidden", "true"); Line Deleted : user_pref("CT3268935.autoDisableScopes", -1); Line Deleted : user_pref("CT3268935.browser.search.defaultthis.engineName", true); Line Deleted : user_pref("CT3268935.cbcountry_001.enc", "VVM="); Line Deleted : user_pref("CT3268935.cbfirsttime.enc", "TW9uIEphbiAyOCAyMDEzIDE4OjI4OjU1IEdNVC0wNTAwIChFYXN0ZXJuIFN0YW5kYXJkIFRpbWUp"); Line Deleted : user_pref("CT3268935.defaultSearch", "true"); Line Deleted : user_pref("CT3268935.embeddedsData", "[{\"appId\":\"129991104163814579\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...] Line Deleted : user_pref("CT3268935.enableAlerts", "always"); Line Deleted : user_pref("CT3268935.enableSearchFromAddressBar", "true"); Line Deleted : user_pref("CT3268935.firstTimeDialogOpened", "true"); Line Deleted : user_pref("CT3268935.fixPageNotFoundError", "true"); Line Deleted : user_pref("CT3268935.fixPageNotFoundErrorInHidden", "true"); Line Deleted : user_pref("CT3268935.fixUrls", true); Line Deleted : user_pref("CT3268935.installDate", "28/1/2013 18:28:34"); Line Deleted : user_pref("CT3268935.installId", "conduitinstaller.exe"); Line Deleted : user_pref("CT3268935.installType", "conduitnsisintegration"); Line Deleted : user_pref("CT3268935.isCheckedStartAsHidden", true); Line Deleted : user_pref("CT3268935.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3268935.isFirstTimeToolbarLoading", "false"); Line Deleted : user_pref("CT3268935.isNewTabEnabled", false); Line Deleted : user_pref("CT3268935.isPerformedSmartBarTransition", "true"); Line Deleted : user_pref("CT3268935.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Line Deleted : user_pref("CT3268935.keyword", true); Line Deleted : user_pref("CT3268935.migrateAppsAndComponents", true); Line Deleted : user_pref("CT3268935.navigationAliasesJson", "{\"EB_MAIN_FRAME_URL\":\"hxxp%3A%2F%2Fforums.malwarebytes.org%2Findex.php%3Fshowtopic%3D131950%26p%3D721022\",\"EB_MAIN_FRAME_TITLE\":\"Can't%20get%20rid%[...] Line Deleted : user_pref("CT3268935.openThankYouPage", "false"); Line Deleted : user_pref("CT3268935.openUninstallPage", "true"); Line Deleted : user_pref("CT3268935.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"01\\\\/29\\\\/2013 02\\\"}\"}"); Line Deleted : user_pref("CT3268935.revertSettingsEnabled", "false"); Line Deleted : user_pref("CT3268935.search.searchAppId", "129991104163814579"); Line Deleted : user_pref("CT3268935.search.searchCount", "0"); Line Deleted : user_pref("CT3268935.searchInNewTabEnabled", "false"); Line Deleted : user_pref("CT3268935.searchInNewTabEnabledInHidden", "true"); Line Deleted : user_pref("CT3268935.searchProtector.notifyChanges", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3268935.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3268935.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3268935.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}"); Line Deleted : user_pref("CT3268935.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3268935\"}"); Line Deleted : user_pref("CT3268935.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Vgrabber v1\"}"); Line Deleted : user_pref("CT3268935.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Deleted : user_pref("CT3268935.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1359415726153"); Line Deleted : user_pref("CT3268935.serviceLayer_services_appsMetadata_lastUpdate", "1359421951507"); Line Deleted : user_pref("CT3268935.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1359415730435"); Line Deleted : user_pref("CT3268935.serviceLayer_services_login_10.13.40.15_lastUpdate", "1377547830966"); Line Deleted : user_pref("CT3268935.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1359415730515"); Line Deleted : user_pref("CT3268935.serviceLayer_services_searchAPI_lastUpdate", "1359415724069"); Line Deleted : user_pref("CT3268935.serviceLayer_services_serviceMap_lastUpdate", "1377479595936"); Line Deleted : user_pref("CT3268935.serviceLayer_services_toolbarContextMenu_lastUpdate", "1359415730305"); Line Deleted : user_pref("CT3268935.serviceLayer_services_toolbarSettings_lastUpdate", "1377558990146"); Line Deleted : user_pref("CT3268935.serviceLayer_services_translation_lastUpdate", "1377479596082"); Line Deleted : user_pref("CT3268935.serviceLayer_services_userApps_lastUpdate", "1359421906994"); Line Deleted : user_pref("CT3268935.settingsINI", true); Line Deleted : user_pref("CT3268935.shouldFirstTimeDialog", "false"); Line Deleted : user_pref("CT3268935.smartbar.CTID", "CT3268935"); Line Deleted : user_pref("CT3268935.smartbar.Uninstall", "0"); Line Deleted : user_pref("CT3268935.smartbar.homepage", true); Line Deleted : user_pref("CT3268935.smartbar.toolbarName", "Vgrabber v1 "); Line Deleted : user_pref("CT3268935.startPage", "userChanged"); Line Deleted : user_pref("CT3268935.toolbarBornServerTime", "29-1-2013"); Line Deleted : user_pref("CT3268935.toolbarCurrentServerTime", "26-8-2013"); Line Deleted : user_pref("CT3268935_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1377552427136,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]"); Line Deleted : user_pref("Smartbar.ConduitHomepagesList", ""); Line Deleted : user_pref("Smartbar.ConduitSearchEngineList", ""); Line Deleted : user_pref("Smartbar.ConduitSearchUrlList", ""); Line Deleted : user_pref("Smartbar.keywordURLSelectedCTID", "CT3268935"); Line Deleted : user_pref("browser.search.defaultengine", "Ask.com"); Line Deleted : user_pref("browser.search.defaultthis.engineName", "eMusic Customized Web Search"); Line Deleted : user_pref("extensions.asktb.ff-original-keyword-url", ""); Line Deleted : user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"msntoolbar@msn.com\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\MSN Toolbar\\\\Platform\\\\6.0.2282.0\\\\Firefo[...] Line Deleted : user_pref("smartbar.originalSearchEngine", "Google"); -\\ Google Chrome v29.0.1547.57 [ File : C:\Users\Mary\AppData\Local\Google\Chrome\User Data\Default\preferences ] Deleted : homepage ************************* AdwCleaner[R0].txt - [15131 octets] - [26/08/2013 19:47:51] AdwCleaner[R1].txt - [15192 octets] - [26/08/2013 20:06:58] AdwCleaner[s0].txt - [14947 octets] - [26/08/2013 20:09:02] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [15008 octets] ##########

# AdwCleaner v3.001 - Report created 26/08/2013 at 19:47:51 # Updated 24/08/2013 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Mary - MARY-DESKTOP # Running from : C:\Users\Mary\Desktop\AdwCleaner.exe # Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** File Found : C:\END File Found : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\searchplugins\Askcom.xml File Found : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\user.js File Found : C:\Windows\System32\Tasks\Scheduled Update for Ask Toolbar Folder Found : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\{7f7f82f1-7c95-47cd-814f-950b56d58fc3} Folder Found : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\toolbar@ask.com Folder Found C:\Program Files (x86)\Ask.com Folder Found C:\Program Files (x86)\Conduit Folder Found C:\ProgramData\Ask Folder Found C:\Users\Mary\AppData\Local\Conduit Folder Found C:\Users\Mary\AppData\Local\cre Folder Found C:\Users\Mary\AppData\LocalLow\AskToolbar Folder Found C:\Users\Mary\AppData\LocalLow\Conduit Folder Found C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\CT3268935 Folder Found C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Smartbar ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKCU\Software\APN Key Found : HKCU\Software\AppDataLow\Software\AskToolbar Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\Ask.com Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\{79A765E1-C399-405B-85AF-466F52E918B0} Key Found : [x64] HKCU\Software\APN Key Found : [x64] HKCU\Software\Ask.com Key Found : [x64] HKCU\Software\Conduit Key Found : HKLM\Software\APN Key Found : HKLM\Software\AskToolbar Key Found : HKLM\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874} Key Found : HKLM\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL Key Found : HKLM\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC} Key Found : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Key Found : HKLM\SOFTWARE\Classes\CLSID\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Found : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd Key Found : HKLM\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1 Key Found : HKLM\SOFTWARE\Classes\Interface\{6C434537-053E-486D-B62A-160059D9D456} Key Found : HKLM\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92} Key Found : HKLM\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56} Key Found : HKLM\Software\Conduit Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{898EA8C8-E7FF-479B-8935-AEC46303B9E5} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A5AA24EA-11B8-4113-95AE-9ED71DEAF12A} Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\TaskScheduler_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86D4B82A-ABED-442A-BE86-96357B70F4FE} Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{00000000-6E41-4FD3-8538-502F5495E5FC}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{D4027C7F-154A-4066-A1AD-4243D8127440}] Value Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [ApnUpdater] ***** [ Browsers ] ***** -\\ Internet Explorer v10.0.9200.16660 -\\ Mozilla Firefox v23.0.1 (en-US) [ File : C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\prefs.js ] Line Found : user_pref("CT3268935.1000082.isDisplayHidden", "true"); Line Found : user_pref("CT3268935.1000234.TWC_TMP_city", "MINNEAPOLIS"); Line Found : user_pref("CT3268935.1000234.TWC_TMP_country", "US"); Line Found : user_pref("CT3268935.1000234.TWC_locId", "USMN0503"); Line Found : user_pref("CT3268935.1000234.TWC_location", "Minneapolis, MN"); Line Found : user_pref("CT3268935.1000234.TWC_region", "US"); Line Found : user_pref("CT3268935.1000234.TWC_temp_dis", "f"); Line Found : user_pref("CT3268935.1000234.TWC_wind_dis", "mph"); Line Found : user_pref("CT3268935.1000234.weatherData", "{\"icon\":\"20.png\",\"temperature\":\"30°F\",\"temperatureClear\":\"30°F\",\"highTemperature\":\"35°F\",\"lowTemperature\":\"13°F\",\"feelsLike\":\"23Â[...] Line Found : user_pref("CT3268935.CBOpenMAMSettings.enc", "MA=="); Line Found : user_pref("CT3268935.ENABALE_HISTORY", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Found : user_pref("CT3268935.ENABLE_RETURN_WEB_SEARCH_ON_THE_PAGE", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Found : user_pref("CT3268935.FirstTime", "true"); Line Found : user_pref("CT3268935.FirstTimeFF3", "true"); Line Found : user_pref("CT3268935.LoginRevertSettingsEnabled", true); Line Found : user_pref("CT3268935.RevertSettingsEnabled", true); Line Found : user_pref("CT3268935.UserID", "UN71756386110550840"); Line Found : user_pref("CT3268935.addressBarTakeOverEnabledInHidden", "true"); Line Found : user_pref("CT3268935.autoDisableScopes", -1); Line Found : user_pref("CT3268935.browser.search.defaultthis.engineName", true); Line Found : user_pref("CT3268935.cbcountry_001.enc", "VVM="); Line Found : user_pref("CT3268935.cbfirsttime.enc", "TW9uIEphbiAyOCAyMDEzIDE4OjI4OjU1IEdNVC0wNTAwIChFYXN0ZXJuIFN0YW5kYXJkIFRpbWUp"); Line Found : user_pref("CT3268935.defaultSearch", "true"); Line Found : user_pref("CT3268935.embeddedsData", "[{\"appId\":\"129991104163814579\",\"apiPermissions\":{\"crossDomainAjax\":true,\"getMainFrameTitle\":true,\"getMainFrameUrl\":true,\"getSearchTerm\":true,\"insta[...] Line Found : user_pref("CT3268935.enableAlerts", "always"); Line Found : user_pref("CT3268935.enableSearchFromAddressBar", "true"); Line Found : user_pref("CT3268935.firstTimeDialogOpened", "true"); Line Found : user_pref("CT3268935.fixPageNotFoundError", "true"); Line Found : user_pref("CT3268935.fixPageNotFoundErrorInHidden", "true"); Line Found : user_pref("CT3268935.fixUrls", true); Line Found : user_pref("CT3268935.installDate", "28/1/2013 18:28:34"); Line Found : user_pref("CT3268935.installId", "conduitinstaller.exe"); Line Found : user_pref("CT3268935.installType", "conduitnsisintegration"); Line Found : user_pref("CT3268935.isCheckedStartAsHidden", true); Line Found : user_pref("CT3268935.isEnableAllDialogs", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Found : user_pref("CT3268935.isFirstTimeToolbarLoading", "false"); Line Found : user_pref("CT3268935.isNewTabEnabled", false); Line Found : user_pref("CT3268935.isPerformedSmartBarTransition", "true"); Line Found : user_pref("CT3268935.isToolbarShrinked", "{\"dataType\":\"string\",\"data\":\"false\"}"); Line Found : user_pref("CT3268935.keyword", true); Line Found : user_pref("CT3268935.migrateAppsAndComponents", true); Line Found : user_pref("CT3268935.openThankYouPage", "false"); Line Found : user_pref("CT3268935.openUninstallPage", "true"); Line Found : user_pref("CT3268935.price-gong.bornDate", "{\"dataType\":\"string\",\"data\":\"{\\\"Response\\\":\\\"01\\\\/29\\\\/2013 02\\\"}\"}"); Line Found : user_pref("CT3268935.revertSettingsEnabled", "false"); Line Found : user_pref("CT3268935.search.searchAppId", "129991104163814579"); Line Found : user_pref("CT3268935.search.searchCount", "0"); Line Found : user_pref("CT3268935.searchInNewTabEnabled", "false"); Line Found : user_pref("CT3268935.searchInNewTabEnabledInHidden", "true"); Line Found : user_pref("CT3268935.searchProtector.notifyChanges", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Found : user_pref("CT3268935.selectToSearchBoxEnabled", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Found : user_pref("CT3268935.serviceLayer_service_login_isFirstLoginInvoked", "{\"dataType\":\"boolean\",\"data\":\"true\"}"); Line Found : user_pref("CT3268935.serviceLayer_service_login_loginCount", "{\"dataType\":\"number\",\"data\":\"4\"}"); Line Found : user_pref("CT3268935.serviceLayer_service_toolbarGrouping_activeCTID", "{\"dataType\":\"string\",\"data\":\"CT3268935\"}"); Line Found : user_pref("CT3268935.serviceLayer_service_toolbarGrouping_activeToolbarName", "{\"dataType\":\"string\",\"data\":\"Vgrabber v1\"}"); Line Found : user_pref("CT3268935.serviceLayer_service_toolbarGrouping_invoked", "{\"dataType\":\"string\",\"data\":\"true\"}"); Line Found : user_pref("CT3268935.serviceLayer_services_appTrackingFirstTime_lastUpdate", "1359415726153"); Line Found : user_pref("CT3268935.serviceLayer_services_appsMetadata_lastUpdate", "1359421951507"); Line Found : user_pref("CT3268935.serviceLayer_services_gottenAppsContextMenu_lastUpdate", "1359415730435"); Line Found : user_pref("CT3268935.serviceLayer_services_login_10.13.40.15_lastUpdate", "1377547830966"); Line Found : user_pref("CT3268935.serviceLayer_services_otherAppsContextMenu_lastUpdate", "1359415730515"); Line Found : user_pref("CT3268935.serviceLayer_services_searchAPI_lastUpdate", "1359415724069"); Line Found : user_pref("CT3268935.serviceLayer_services_serviceMap_lastUpdate", "1377479595936"); Line Found : user_pref("CT3268935.serviceLayer_services_toolbarContextMenu_lastUpdate", "1359415730305"); Line Found : user_pref("CT3268935.serviceLayer_services_toolbarSettings_lastUpdate", "1377551790044"); Line Found : user_pref("CT3268935.serviceLayer_services_translation_lastUpdate", "1377479596082"); Line Found : user_pref("CT3268935.serviceLayer_services_userApps_lastUpdate", "1359421906994"); Line Found : user_pref("CT3268935.settingsINI", true); Line Found : user_pref("CT3268935.shouldFirstTimeDialog", "false"); Line Found : user_pref("CT3268935.smartbar.CTID", "CT3268935"); Line Found : user_pref("CT3268935.smartbar.Uninstall", "0"); Line Found : user_pref("CT3268935.smartbar.homepage", true); Line Found : user_pref("CT3268935.smartbar.toolbarName", "Vgrabber v1 "); Line Found : user_pref("CT3268935.startPage", "userChanged"); Line Found : user_pref("CT3268935.toolbarBornServerTime", "29-1-2013"); Line Found : user_pref("CT3268935.toolbarCurrentServerTime", "26-8-2013"); Line Found : user_pref("CT3268935_Firefox.csv", "[{\"from\":\"Abs Layer\",\"action\":\"loading toolbar\",\"time\":1377552427136,\"isWithState\":\"\",\"timeFromStart\":0,\"timeFromPrev\":0}]"); Line Found : user_pref("Smartbar.ConduitHomepagesList", ""); Line Found : user_pref("Smartbar.ConduitSearchEngineList", ""); Line Found : user_pref("Smartbar.ConduitSearchUrlList", ""); Line Found : user_pref("Smartbar.keywordURLSelectedCTID", "CT3268935"); Line Found : user_pref("browser.search.defaultengine", "Ask.com"); Line Found : user_pref("browser.search.defaultthis.engineName", "eMusic Customized Web Search"); Line Found : user_pref("extensions.asktb.ff-original-keyword-url", ""); Line Found : user_pref("extensions.installCache", "[{\"name\":\"winreg-app-global\",\"addons\":{\"msntoolbar@msn.com\":{\"descriptor\":\"C:\\\\Program Files (x86)\\\\MSN Toolbar\\\\Platform\\\\6.0.2282.0\\\\Firefo[...] Line Found : user_pref("smartbar.originalSearchEngine", "Google"); -\\ Google Chrome v29.0.1547.57 [ File : C:\Users\Mary\AppData\Local\Google\Chrome\User Data\Default\preferences ] Found : homepage Found : icon_url Found : search_url Found : suggest_url Found : keyword Found : urls_to_restore_on_startup Found : homepage Found : icon_url Found : search_url Found : suggest_url Found : keyword Found : urls_to_restore_on_startup Found : homepage Found : icon_url Found : search_url Found : suggest_url Found : keyword Found : urls_to_restore_on_startup ************************* AdwCleaner[R0].txt - [14977 octets] - [26/08/2013 19:47:51] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [15038 octets] ##########

RogueKiller log: RogueKiller V8.6.6 _x64_ [Aug 19 2013] by Tigzy mail : tigzyRK<at>gmail<dot>com Feedback : http://www.adlice.com/forum/ Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://tigzyrk.blogspot.com/ Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Mary [Admin rights] Mode : Scan -- Date : 08/26/2013 19:34:27 | ARK || FAK || MBR | ¤¤¤ Bad processes : 0 ¤¤¤ ¤¤¤ Registry Entries : 0 ¤¤¤ ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ -> E:\windows\system32\config\SYSTEM | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\windows\system32\config\SOFTWARE | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\windows\system32\config\SECURITY | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\windows\system32\config\SAM | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\windows\system32\config\DEFAULT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\Documents and Settings\Administrator\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\Documents and Settings\All Users\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - NOT_FOUND] -> E:\Documents and Settings\Default User\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\Documents and Settings\LocalService\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\Documents and Settings\Mary Marbach\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] -> E:\Documents and Settings\NetworkService\NTUSER.DAT | DRVINFO [Drv - E:] | SYSTEMINFO [sys - C:] [sys32 - FOUND] | USERINFO [startup - FOUND] ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: WDC WD5000AAKX-753CA0 ATA Device +++++ --- User --- [MBR] 5d8d24246364b8d2d88ec448f69c6296 [bSP] e1028fc63eac271fdd506963a76ee739 : Windows Vista MBR Code Partition table: 0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 81920 | Size: 12542 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 25767936 | Size: 464357 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive1: WDC WD5000AAKX-753CA0 ATA Device +++++ --- User --- [MBR] 6d0152fadeb8b8602eb9fba35cdd4596 [bSP] 3efdd157322bc54deb4f0f8435ac64f6 : MBR Code unknown Partition table: 0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo 1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 80325 | Size: 233617 Mo 2 - [XXXXXX] UNKNOWN (0x00) [VISIBLE] Offset (sectors): 478528155 | Size: 4753 Mo User = LL1 ... OK! User = LL2 ... OK! +++++ PhysicalDrive2: WDC WD5000AAKX-753CA0 ATA Device +++++ --- User --- [MBR] ffd513748955acea2a311ec7e6626e80 [bSP] 0aa7b47126457242ae67ea791b49585d : Windows XP MBR Code Partition table: 0 - [ACTIVE] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 63 | Size: 715402 Mo User = LL1 ... OK! Error reading LL2 MBR! +++++ PhysicalDrive3: WDC WD5000AAKX-753CA0 ATA Device +++++ --- User --- [MBR] 7a4ec4e08b9c0b7774c61db295f91382 [bSP] 000cdb9b089b6a5f1cdf8ae3e35760b8 : Windows XP MBR Code Partition table: 0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1907696 Mo User = LL1 ... OK! Error reading LL2 MBR! Finished : << RKreport[0]_S_08262013_193427.txt >>

No Malware Found. No reboot requested! Can access interwebs. Can check for windows updates ( 6 optional updates available ). And I get a "These settings are being managed by vendor application Mcafee Personal Firewall. So I didn't run fixdamage.exe

Fixlog.txt Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 27-08-2013 Ran by Mary at 2013-08-26 18:08:26 Run:1 Running from C:\Users\Mary\Desktop\Farbar Boot Mode: Normal ============================================== Content of fixlist: ***************** HKCU\...\Run: [Google Update*] - [x] ***************** HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\Google Update* => Value deleted successfully. ==== End of Fixlog ==== Download mbar

Thanks for quick response Frst.txt Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 26-08-2013 02 Ran by Mary (administrator) on 26-08-2013 17:40:19 Running from C:\Users\Mary\Desktop\Farbar Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (AMD) C:\Windows\system32\atiesrxx.exe (AMD) C:\Windows\system32\atieclxx.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (McAfee, Inc.) C:\Windows\system32\mfevtps.exe (Microsoft Corporation) C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (SoftThinks SAS) C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (McAfee, Inc.) C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (McAfee, Inc.) C:\PROGRA~1\McAfee\MSC\McAPExe.exe () C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe (SoftThinks - Dell) C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Microsoft Corporation) C:\Program Files\Microsoft IntelliType Pro\itype.exe (Google) C:\Users\Mary\AppData\Roaming\Google\Google Talk\googletalk.exe (GARMIN Corp.) C:\Garmin\TrainingCenter\gStart.exe (GARMIN Corp.) C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe (TomTom) C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe (McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (Belkin International, Inc.) C:\Program Files\Belkin\Network USB Hub Control Center\Connect.exe () C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe (Advanced Micro Devices Inc.) c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (Ask) C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (McAfee, Inc.) C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe (Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe (McAfee, Inc.) c:\PROGRA~2\mcafee\SITEAD~1\saui.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe (Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [8321568 2009-11-09] (Realtek Semiconductor) HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [207350 2011-01-25] () HKLM\...\Run: [itype] - C:\Program Files\Microsoft IntelliType Pro\itype.exe [1860496 2011-04-13] (Microsoft Corporation) HKLM-x32\...\RunOnce: [Launcher] - C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [163040 2010-08-11] (Softthinks) HKLM-x32\...\RunOnce: [DSUpdateLauncher] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe" [18240 2010-07-21] (Dell) HKLM-x32\...\RunOnce: [sTToasterLauncher] - C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe [120032 2010-08-11] () HKCU\...\Run: [googletalk] - C:\Users\Mary\AppData\Roaming\Google\Google Talk\googletalk.exe [3739648 2007-01-01] (Google) HKCU\...\Run: [gStart] - C:\Garmin\TrainingCenter\gStart.exe [1891416 2008-08-13] (GARMIN Corp.) HKCU\...\Run: [ANT Agent] - C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe [14749544 2012-03-23] (GARMIN Corp.) HKCU\...\Run: [MobileDocuments] - C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe [x] HKCU\...\Run: [TomTomHOME.exe] - C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe [247728 2012-04-20] (TomTom) HKCU\...\Run: [Google Update*] - [x] <===== ATTENTION (ZeroAccess rootkit hidden path) HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2013-08-01] (Google Inc.) HKLM-x32\...\Run: [startCCC] - c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-07-14] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [x] HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [RoxWatchTray] - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions) HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] () HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.) HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1561768 2012-05-04] (Ask) HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated) HKLM-x32\...\Run: [mcpltui_exe] - C:\Program Files\McAfee.com\Agent\mcagent.exe [454600 2013-02-28] (McAfee, Inc.) HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.) HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-08-16] (Apple Inc.) Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Mary\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Belkin Network USB Hub Control Center.lnk ShortcutTarget: Belkin Network USB Hub Control Center.lnk -> C:\Program Files\Belkin\Network USB Hub Control Center\Connect.exe (Belkin International, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.lawtalkers.com/ HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1 URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File SearchScopes: HKCU - {1BF2D488-C557-430F-BC39-A3B5DDE071B2} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=&src=kw&q={searchTerms}&locale=&apn_ptnrs=9M&apn_dtid=OSJ000&apn_uid=D812FD09-56D5-4E9F-A31A-A8DD29091721&apn_sauid=3665B652-680A-4922-A136-15F6BAA14FCE SearchScopes: HKCU - {49606DC7-976D-4030-A74E-9FB5C842FA68} URL = SearchScopes: HKCU - {F83CA719-AF6A-4A8F-B7BC-9B6FC65A5DE4} URL = http://search.yahoo.com/search?fr=mcafee&p={SearchTerms} BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\MSKAPB~1.DLL No File BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: MSS+ Identifier - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.) BHO-x32: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\progra~1\mcafee\msk\mskapbho.dll No File BHO-x32: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) BHO-x32: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) BHO-x32: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) BHO-x32: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation) BHO-x32: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) Toolbar: HKLM - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) Toolbar: HKLM-x32 - @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation) Toolbar: HKLM-x32 - Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) Toolbar: HKLM-x32 - McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) DPF: HKLM-x32 {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} http://support.dell.com/systemprofiler/DellSystemLite.CAB Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\x64\mcieplg.dll (McAfee, Inc.) Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File Handler-x32: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Handler-x32: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~2\mcafee\SITEAD~1\mcieplg.dll (McAfee, Inc.) Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies) Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~1\mcafee\msc\MCSNIE~1.DLL (McAfee, Inc.) Filter-x32: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\PROGRA~2\mcafee\msc\mcsniepl.dll (McAfee, Inc.) Winsock: Catalog5 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Winsock: Catalog5 05 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll" Winsock: Catalog5-x64 01 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Winsock: Catalog5-x64 05 mswsock.dll File Not found (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll" Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76 FireFox: ======== FF ProfilePath: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default FF user.js: detected! => C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\user.js FF NetworkProxy: "no_proxies_on", "localhost" FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @bestbuy.com/npBestBuyPcAppDetector,version=1.0 - C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy) FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin: @mcafee.com/MSC,version=10 - c:\PROGRA~1\mcafee\msc\NPMCSN~1.DLL () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @bestbuy.com/npBestBuyPcAppDetector,version=1.0 - C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll (Best Buy) FF Plugin-x32: @garmin.com/GpsControl - C:\Program Files (x86)\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.) FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @mcafee.com/McAfeeMssPlugin - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.) FF Plugin-x32: @mcafee.com/MSC,version=10 - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL () FF Plugin-x32: @mcafee.com/MVT - C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll (McAfee, Inc.) FF Plugin-x32: @mcafee.com/SAFFPlugin - C:\Program Files (x86)\McAfee\SiteAdvisor\npmcffplg32.dll (McAfee, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @Microsoft.com/NpWinExt,version=5.0 - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Mary\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF SearchPlugin: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\searchplugins\askcom.xml FF SearchPlugin: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\searchplugins\searchplugins-backup FF SearchPlugin: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\searchplugins\siteadvisor.xml FF SearchPlugin: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\searchplugins\vgrabber-v1-customized-web-search.xml FF SearchPlugin: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\searchplugins\webster.xml FF SearchPlugin: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\searchplugins\wikipedia-en.xml FF Extension: No Name - C:\Users\Mary\AppData\Roaming\Mozilla\Extensions\home2@tomtom.com FF Extension: Dictionnaire MySpell en Français (réforme 1990) - C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\fr@dictionaries.addons.mozilla.org FF Extension: Ask Toolbar - C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\toolbar@ask.com FF Extension: Garmin Communicator - C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E} FF Extension: Yahoo! Toolbar - C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} FF Extension: Vgrabber v1 - C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\{7f7f82f1-7c95-47cd-814f-950b56d58fc3} FF Extension: feedly - C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\feedly@devhd.xpi FF Extension: No Name - C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b}.xpi FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF HKLM-x32\...\Firefox\Extensions: [msntoolbar@msn.com] C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox FF Extension: Bing Bar - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\Firefox FF HKLM-x32\...\Firefox\Extensions: [{27182e60-b5f3-411c-b545-b44205977502}] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ FF Extension: No Name - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\firefoxextension\SearchHelperExtension\ FF HKLM-x32\...\Firefox\Extensions: [{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}] C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ FF Extension: Default Manager - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ FF HKLM-x32\...\Firefox\Extensions: [{4ED1F68A-5463-4931-9384-8FFF5ED91D92}] C:\Program Files (x86)\McAfee\SiteAdvisor FF Extension: McAfee SiteAdvisor - C:\Program Files (x86)\McAfee\SiteAdvisor FF HKLM-x32\...\Thunderbird\Extensions: [msktbird@mcafee.com] C:\Program Files\McAfee\MSK FF Extension: McAfee Anti-Spam Thunderbird Extension - C:\Program Files\McAfee\MSK Chrome: ======= CHR HKLM-x32\...\Chrome\Extension: [fheoggkfdfchfphceeifdbepaooicaho] - C:\Program Files (x86)\McAfee\SiteAdvisor\McChPlg.crx CHR HKLM-x32\...\Chrome\Extension: [jnidgldcbakaidffpjinopjbmobecifb] - C:\Users\Mary\AppData\Local\CRE\jnidgldcbakaidffpjinopjbmobecifb.crx ==================== Services (Whitelisted) ================= R2 HomeNetSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [221296 2013-03-05] (McAfee, Inc.) R2 McAfee SiteAdvisor Service; c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [120592 2013-05-22] (McAfee, Inc.) S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [235216 2013-02-05] (McAfee, Inc.) R2 McMPFSvc; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [221296 2013-03-05] (McAfee, Inc.) R2 McNaiAnn; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [221296 2013-03-05] (McAfee, Inc.) S3 McODS; C:\Program Files\McAfee\VirusScan\mcods.exe [388680 2013-07-16] (McAfee, Inc.) R2 mcpltsvc; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [221296 2013-03-05] (McAfee, Inc.) R2 McProxy; C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [221296 2013-03-05] (McAfee, Inc.) R2 mfecore; C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe [1017016 2013-02-28] (McAfee, Inc.) R2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218760 2013-04-03] (McAfee, Inc.) R2 mfevtp; C:\Windows\system32\mfevtps.exe [182752 2013-04-03] (McAfee, Inc.) R2 MSK80Service; C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe [221296 2013-03-05] (McAfee, Inc.) ==================== Drivers (Whitelisted) ==================== R3 AE1000; C:\Windows\System32\DRIVERS\ae1000w7.sys [1101600 2011-07-30] (Ralink Technology Corp.) R3 cfwids; C:\Windows\System32\drivers\cfwids.sys [70112 2013-04-03] (McAfee, Inc.) S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [197264 2012-05-28] (McAfee, Inc.) S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [44480 2011-05-13] (http://libusb-win32.sourceforge.net) R3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [179664 2013-04-03] (McAfee, Inc.) R3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309968 2013-04-03] (McAfee, Inc.) R3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [516608 2013-04-03] (McAfee, Inc.) R0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [772944 2013-04-03] (McAfee, Inc.) R3 mfencbdc; C:\Windows\System32\DRIVERS\mfencbdc.sys [337120 2013-02-18] (McAfee, Inc.) S3 mfencrk; C:\Windows\System32\DRIVERS\mfencrk.sys [95856 2013-02-18] (McAfee, Inc.) R0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [342416 2013-04-03] (McAfee, Inc.) R2 sxuptp; C:\Windows\System32\DRIVERS\sxuptp.sys [78952 2007-10-03] (silex technology, Inc.) S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0; \??\c:\program files\dell support center\pcdsrvc_x64.pkms [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-26 17:39 - 2013-08-26 17:39 - 00000000 ____D C:\Users\Mary\Desktop\Farbar 2013-08-26 17:39 - 2013-08-26 17:39 - 00000000 ____D C:\FRST 2013-08-26 17:02 - 2013-08-26 17:03 - 00084520 _____ C:\Users\Mary\Desktop\New Text Document.txt 2013-08-26 16:47 - 2013-08-26 16:47 - 00004629 _____ C:\Users\Mary\Desktop\RKreport[0]_D_08262013_164724.txt 2013-08-26 16:46 - 2013-08-26 16:46 - 00004552 _____ C:\Users\Mary\Desktop\RKreport[0]_S_08262013_164656.txt 2013-08-26 16:31 - 2013-08-26 16:31 - 00030097 _____ C:\Users\Mary\Desktop\dds.txt 2013-08-26 16:31 - 2013-08-26 16:31 - 00010176 _____ C:\Users\Mary\Desktop\attach.txt 2013-08-26 16:26 - 2013-08-26 16:26 - 00688992 ____R (Swearware) C:\Users\Mary\Desktop\dds.scr 2013-08-26 16:11 - 2013-08-26 16:25 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-08-26 15:16 - 2013-08-26 16:47 - 00000000 ____D C:\Users\Mary\Desktop\RK_Quarantine 2013-08-26 15:16 - 2013-08-26 15:16 - 03814400 _____ C:\Users\Mary\Desktop\RogueKillerX64.exe 2013-08-26 15:14 - 2013-08-26 15:14 - 03814400 _____ C:\Users\Mary\Downloads\RogueKillerX64.exe 2013-08-26 12:47 - 2013-08-26 12:47 - 00000000 ____D C:\Users\Mary\Desktop\mbar 2013-08-26 12:44 - 2013-08-26 12:44 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Mary\Downloads\mbar-1.07.0.1005.exe 2013-08-26 08:46 - 2013-08-26 08:46 - 00000000 ____D C:\Users\Mary\AppData\Local\{F3490FD7-438A-4F43-9B1D-E9B4242B4599} 2013-08-25 21:14 - 2013-08-25 21:14 - 00000758 _____ C:\Windows\comsetup.log 2013-08-25 20:45 - 2013-08-25 20:45 - 00000000 ____D C:\Users\Mary\AppData\Local\{2F50A2C6-E9C2-4A3D-BD26-4931FB7DED5A} 2013-08-25 13:24 - 2013-08-25 13:39 - 00000000 ____D C:\Program Files (x86)\stinger 2013-08-25 08:57 - 2013-08-25 14:09 - 00027256 _____ (Symantec Corporation) C:\Windows\system32\Drivers\FixZeroAccess.sys 2013-08-25 08:45 - 2013-08-25 08:45 - 00000000 ____D C:\Users\Mary\AppData\Local\{5ABDA21B-0923-4AA7-B866-5A2A301027E7} 2013-08-24 20:43 - 2013-08-24 20:43 - 00001785 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-08-24 20:40 - 2013-08-24 20:43 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-08-24 20:40 - 2013-08-24 20:43 - 00000000 ____D C:\Program Files\iTunes 2013-08-24 20:40 - 2013-08-24 20:40 - 00000000 ____D C:\Program Files\iPod 2013-08-24 20:27 - 2013-08-24 20:27 - 00000000 ____D C:\Users\Mary\AppData\Local\{BA68B3A3-3F18-46B4-95DD-97830A062F67} 2013-08-24 16:28 - 2013-08-24 16:28 - 00000000 ____D C:\Users\Mary\AppData\Local\{AFB020FD-1D22-4BF6-8DA0-D8F6E3E7855D} 2013-08-24 04:28 - 2013-08-24 04:28 - 00000000 ____D C:\Users\Mary\AppData\Local\{276DA7FF-4CDE-4428-84BC-014CBB7811D9} 2013-08-23 16:28 - 2013-08-23 16:28 - 00000000 ____D C:\Users\Mary\AppData\Local\{1523D0C8-3B49-4CAE-B923-0A1A8E49CD2A} 2013-08-22 18:57 - 2013-08-22 18:58 - 00000000 ____D C:\Users\Mary\AppData\Local\{0D75E1F3-8A42-47B7-B7F4-130C47728B92} 2013-08-21 21:11 - 2013-08-21 21:11 - 00000000 ____D C:\Users\Mary\AppData\Local\{D1FF8090-C5EA-4358-B6FE-496FAA44842D} 2013-08-21 16:09 - 2013-08-21 16:09 - 00675988 _____ C:\Users\Mary\Desktop\Minecraft(1).exe 2013-08-20 18:21 - 2013-08-20 18:21 - 00000000 ____D C:\Users\Mary\AppData\Local\{1369FFD1-0449-4A77-AD21-6CAF8A550A0D} 2013-08-19 19:39 - 2013-08-19 19:40 - 00000000 ____D C:\Users\Mary\AppData\Local\{29F595D7-FFE1-4447-B4D3-EF66DF055393} 2013-08-18 19:21 - 2013-08-18 19:22 - 00000000 ____D C:\Users\Mary\AppData\Local\{67866234-8DA6-402A-A746-6017F9A8C04D} 2013-08-17 06:40 - 2013-08-17 06:40 - 00000000 ____D C:\Users\Mary\AppData\Local\{2C5BD34B-B447-4015-B0E4-239ACA300FBF} 2013-08-16 19:39 - 2013-08-16 19:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-16 18:39 - 2013-08-16 18:40 - 00000000 ____D C:\Users\Mary\AppData\Local\{4A772E7F-9181-46E9-9591-D501429EB85A} 2013-08-16 06:39 - 2013-08-16 06:39 - 00000000 ____D C:\Users\Mary\AppData\Local\{CA20C74F-0DF7-43B6-A6EB-62C169F3CC8F} 2013-08-15 18:39 - 2013-08-15 18:39 - 00000000 ____D C:\Users\Mary\AppData\Local\{33F74B76-53AA-4CEE-BA22-25275BA667EE} 2013-08-15 06:38 - 2013-08-15 06:39 - 00000000 ____D C:\Users\Mary\AppData\Local\{0D65B658-8F4C-4026-848D-C0ABCAD72377} 2013-08-15 03:10 - 2013-07-26 01:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2013-08-15 03:10 - 2013-07-26 01:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2013-08-15 03:10 - 2013-07-26 01:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2013-08-15 03:10 - 2013-07-26 01:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2013-08-15 03:10 - 2013-07-26 01:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2013-08-15 03:10 - 2013-07-25 23:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2013-08-15 03:10 - 2013-07-25 23:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2013-08-15 03:10 - 2013-07-25 23:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2013-08-15 03:10 - 2013-07-25 23:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2013-08-15 03:10 - 2013-07-25 23:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2013-08-15 03:10 - 2013-07-25 23:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2013-08-15 03:10 - 2013-07-25 22:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2013-08-15 03:10 - 2013-07-25 22:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2013-08-15 03:10 - 2013-07-25 21:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2013-08-15 03:01 - 2013-08-24 17:10 - 00000000 ____D C:\Windows\system32\MRT 2013-08-15 03:01 - 2013-08-15 03:04 - 00000000 ____D C:\8d978519985f056930df0364bccb 2013-08-14 22:30 - 2013-07-18 21:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2013-08-14 22:30 - 2013-07-18 21:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2013-08-14 22:30 - 2013-07-09 01:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2013-08-14 22:30 - 2013-07-09 01:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2013-08-14 22:30 - 2013-07-09 01:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2013-08-14 22:30 - 2013-07-09 01:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2013-08-14 22:30 - 2013-07-09 00:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2013-08-14 22:30 - 2013-07-09 00:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2013-08-14 22:30 - 2013-07-09 00:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2013-08-14 22:30 - 2013-07-09 00:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2013-08-14 22:29 - 2013-07-25 05:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2013-08-14 22:29 - 2013-07-25 04:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2013-08-14 22:29 - 2013-07-09 02:03 - 05550528 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2013-08-14 22:29 - 2013-07-09 01:54 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2013-08-14 22:29 - 2013-07-09 01:53 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2013-08-14 22:29 - 2013-07-09 01:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2013-08-14 22:29 - 2013-07-09 01:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2013-08-14 22:29 - 2013-07-09 01:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2013-08-14 22:29 - 2013-07-09 00:53 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2013-08-14 22:29 - 2013-07-09 00:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2013-08-14 22:29 - 2013-07-09 00:52 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-08-14 22:29 - 2013-07-08 22:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-08-14 22:29 - 2013-07-08 22:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-08-14 22:29 - 2013-07-08 22:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-08-14 22:29 - 2013-07-08 22:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-08-14 22:29 - 2013-07-06 02:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2013-08-14 22:29 - 2013-06-15 00:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2013-08-14 18:38 - 2013-08-14 18:38 - 00000000 ____D C:\Users\Mary\AppData\Local\{3BC16868-3D6E-4842-BA63-D8AC3847A740} 2013-08-14 06:38 - 2013-08-14 06:38 - 00000000 ____D C:\Users\Mary\AppData\Local\{EF19346A-32A2-431A-9499-054FE0135865} 2013-08-13 18:37 - 2013-08-13 18:38 - 00000000 ____D C:\Users\Mary\AppData\Local\{18EB5E82-6AF9-4AEC-9069-55E59884B524} 2013-08-13 06:37 - 2013-08-13 06:37 - 00000000 ____D C:\Users\Mary\AppData\Local\{437C29AB-A94F-481A-9E8D-3993282823CB} 2013-08-12 18:37 - 2013-08-12 18:37 - 00000000 ____D C:\Users\Mary\AppData\Local\{49E7D91A-D5FE-42AD-9682-9E3E7B3BD53D} 2013-08-11 20:03 - 2013-08-11 20:03 - 00000000 ____D C:\Users\Mary\AppData\Local\{744C013A-B045-4A65-AB7B-516CC38D822B} 2013-08-11 08:03 - 2013-08-11 08:03 - 00000000 ____D C:\Users\Mary\AppData\Local\{BFB51042-6F28-40DA-84C8-465EAF55F5F6} 2013-08-10 20:03 - 2013-08-10 20:03 - 00000000 ____D C:\Users\Mary\AppData\Local\{58B68BA3-1B06-46AA-8149-4FA6BD17A716} 2013-08-10 08:02 - 2013-08-10 08:02 - 00000000 ____D C:\Users\Mary\AppData\Local\{9AB692DB-5F4A-4DB1-B2FF-21D4BC4AE9A1} 2013-08-09 19:11 - 2013-08-09 19:11 - 00000000 ____D C:\Users\Mary\AppData\Local\{F105C54E-CD6E-4C90-B317-3746773A385B} 2013-08-09 07:10 - 2013-08-09 07:10 - 00000000 ____D C:\Users\Mary\AppData\Local\{5C52D20F-C30C-4D48-AA63-47AFD52AB772} 2013-08-08 19:10 - 2013-08-08 19:10 - 00000000 ____D C:\Users\Mary\AppData\Local\{F47F69A7-623C-4988-84AF-2EFB897CD0F3} 2013-08-07 19:59 - 2013-08-07 19:59 - 00000000 ____D C:\Users\Mary\AppData\Local\{688DE1D3-5E40-435E-B64E-7FC27F4BC248} 2013-08-07 06:46 - 2013-08-07 06:46 - 00000000 ____D C:\Users\Mary\AppData\Local\{97E0C4D2-9009-48DA-8D03-0CF5B27CACEC} 2013-08-06 18:46 - 2013-08-06 18:46 - 00000000 ____D C:\Users\Mary\AppData\Local\{43CE817D-494E-45DD-814A-C6205EE36B25} 2013-08-06 06:11 - 2013-08-06 06:11 - 00000000 ____D C:\Users\Mary\AppData\Local\{CE463F15-6B80-41D2-B7B7-ABC14B0159EA} 2013-08-05 18:11 - 2013-08-05 18:11 - 00000000 ____D C:\Users\Mary\AppData\Local\{3E821056-86C0-49DB-8598-BDD2ACAE05EB} 2013-08-05 06:08 - 2013-08-05 06:08 - 00000000 ____D C:\Users\Mary\AppData\Local\{BBF80BDD-2459-4D14-BEF0-4BFC800166D7} 2013-08-04 18:08 - 2013-08-04 18:08 - 00000000 ____D C:\Users\Mary\AppData\Local\{E009F493-8601-42AF-8E48-F14921A7CAA7} 2013-08-02 07:26 - 2013-08-02 07:27 - 00000000 ____D C:\Users\Mary\AppData\Local\{1ED6FC48-63DC-40BC-BBDB-A7DCEF86AD42} 2013-08-02 01:01 - 2013-08-02 01:01 - 00000000 ____D C:\Program Files\HitmanPro 2013-08-02 01:00 - 2013-08-02 01:06 - 00000000 ____D C:\ProgramData\HitmanPro 2013-08-02 00:11 - 2013-08-02 00:11 - 00001847 _____ C:\Users\Public\Desktop\QuickTime Player.lnk 2013-08-02 00:10 - 2013-08-02 00:11 - 00000000 ____D C:\Program Files (x86)\QuickTime 2013-08-02 00:04 - 2013-08-02 00:04 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-08-02 00:04 - 2013-08-02 00:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-08-02 00:04 - 2013-08-02 00:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-08-02 00:04 - 2013-08-02 00:04 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-08-01 23:52 - 2013-08-26 17:30 - 00001846 _____ C:\Users\Public\Desktop\McAfee Security Center.lnk 2013-08-01 23:51 - 2013-08-01 23:51 - 00000000 ____D C:\Program Files (x86)\McAfee.com 2013-08-01 23:51 - 2012-05-28 10:28 - 00197264 _____ (McAfee, Inc.) C:\Windows\system32\Drivers\HipShieldK.sys 2013-08-01 23:49 - 2013-08-24 20:30 - 00000000 ____D C:\Program Files\McAfee 2013-08-01 23:49 - 2013-08-01 23:49 - 00000000 ____D C:\Program Files\McAfee.com 2013-08-01 23:44 - 2013-04-03 13:34 - 00182752 _____ (McAfee, Inc.) C:\Windows\system32\mfevtps.exe 2013-08-01 23:01 - 2013-08-01 23:01 - 00000000 ____D C:\ProgramData\Google 2013-08-01 23:01 - 2013-08-01 23:01 - 00000000 ____D C:\Program Files\Google 2013-08-01 20:22 - 2013-08-01 20:22 - 00000000 ____D C:\mfe 2013-08-01 19:15 - 2013-08-01 20:11 - 00000000 ____D C:\Program Files\stinger 2013-08-01 07:31 - 2013-08-01 07:31 - 00000000 ____D C:\Users\Mary\AppData\Local\{697DF7B7-5699-473B-A7E7-5F2E2EE19CDC} 2013-07-31 19:30 - 2013-07-31 19:31 - 00000000 ____D C:\Users\Mary\AppData\Local\{A4A72CE0-8485-43B3-94A8-82AE68BBC8A7} 2013-07-30 21:33 - 2013-07-30 21:33 - 00000000 ____D C:\Users\Mary\AppData\Local\{3B433F84-906C-4CAD-BF3C-78D147E0AA68} 2013-07-29 18:32 - 2013-07-29 18:33 - 00000000 ____D C:\Users\Mary\AppData\Local\{36B5B97C-E55B-43DE-9AD3-8EA8E4955D8C} 2013-07-29 06:32 - 2013-07-29 06:32 - 00000000 ____D C:\Users\Mary\AppData\Local\{6D3A18DE-2BC6-49F4-8C2B-9FE002AB9A82} 2013-07-28 18:32 - 2013-07-28 18:32 - 00000000 ____D C:\Users\Mary\AppData\Local\{94E236F2-7028-4F0A-8CC1-95015707C9A3} 2013-07-28 06:32 - 2013-07-28 06:32 - 00000000 ____D C:\Users\Mary\AppData\Local\{4A3379E6-3CF0-4CFB-AFFA-1DF0AC280EF8} 2013-07-27 18:31 - 2013-07-27 18:32 - 00000000 ____D C:\Users\Mary\AppData\Local\{967B64F0-27A9-4F77-8091-D95D76260548} 2013-07-27 06:31 - 2013-07-27 06:31 - 00000000 ____D C:\Users\Mary\AppData\Local\{CA8F338F-3DFC-4C5B-BC0F-DAE0B46BD2AF} ==================== One Month Modified Files and Folders ======= 2013-08-26 17:39 - 2013-08-26 17:39 - 01578228 _____ (Farbar) C:\Users\Mary\Downloads\FRST64.exe 2013-08-26 17:39 - 2013-08-26 17:39 - 00000000 ____D C:\Users\Mary\Desktop\Farbar 2013-08-26 17:39 - 2013-08-26 17:39 - 00000000 ____D C:\FRST 2013-08-26 17:32 - 2009-07-14 00:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-26 17:32 - 2009-07-14 00:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-26 17:30 - 2013-08-01 23:52 - 00001846 _____ C:\Users\Public\Desktop\McAfee Security Center.lnk 2013-08-26 17:25 - 2013-04-24 14:57 - 00003696 _____ C:\Windows\setupact.log 2013-08-26 17:25 - 2011-08-01 21:13 - 00000890 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-08-26 17:25 - 2011-07-30 14:46 - 00000072 _____ C:\Windows\SysWOW64\ToasterLauncherLog.log 2013-08-26 17:25 - 2011-07-30 14:44 - 00000000 ____D C:\Users\Mary\AppData\Local\SoftThinks 2013-08-26 17:25 - 2011-05-30 17:43 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup 2013-08-26 17:25 - 2009-07-14 01:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT 2013-08-26 17:24 - 2009-07-14 01:10 - 01292019 _____ C:\Windows\WindowsUpdate.log 2013-08-26 17:19 - 2011-08-01 21:13 - 00000894 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-08-26 17:03 - 2013-08-26 17:02 - 00084520 _____ C:\Users\Mary\Desktop\New Text Document.txt 2013-08-26 17:02 - 2012-04-30 07:19 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-08-26 16:47 - 2013-08-26 16:47 - 00004629 _____ C:\Users\Mary\Desktop\RKreport[0]_D_08262013_164724.txt 2013-08-26 16:47 - 2013-08-26 15:16 - 00000000 ____D C:\Users\Mary\Desktop\RK_Quarantine 2013-08-26 16:46 - 2013-08-26 16:46 - 00004552 _____ C:\Users\Mary\Desktop\RKreport[0]_S_08262013_164656.txt 2013-08-26 16:31 - 2013-08-26 16:31 - 00030097 _____ C:\Users\Mary\Desktop\dds.txt 2013-08-26 16:31 - 2013-08-26 16:31 - 00010176 _____ C:\Users\Mary\Desktop\attach.txt 2013-08-26 16:26 - 2013-08-26 16:26 - 00688992 ____R (Swearware) C:\Users\Mary\Desktop\dds.scr 2013-08-26 16:25 - 2013-08-26 16:11 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-08-26 15:16 - 2013-08-26 15:16 - 03814400 _____ C:\Users\Mary\Desktop\RogueKillerX64.exe 2013-08-26 15:14 - 2013-08-26 15:14 - 03814400 _____ C:\Users\Mary\Downloads\RogueKillerX64.exe 2013-08-26 13:53 - 2011-05-30 19:17 - 00060558 _____ C:\Windows\PFRO.log 2013-08-26 13:53 - 2009-07-13 23:20 - 00000000 __RSD C:\Windows\Media 2013-08-26 12:47 - 2013-08-26 12:47 - 00000000 ____D C:\Users\Mary\Desktop\mbar 2013-08-26 12:44 - 2013-08-26 12:44 - 12907592 _____ (Malwarebytes Corp.) C:\Users\Mary\Downloads\mbar-1.07.0.1005.exe 2013-08-26 11:02 - 2011-07-30 14:46 - 00000422 _____ C:\Windows\Tasks\SystemToolsDailyTest.job 2013-08-26 11:00 - 2011-07-31 11:01 - 00003488 _____ C:\Windows\System32\Tasks\PCDEventLauncher 2013-08-26 11:00 - 2011-07-30 14:46 - 00003454 _____ C:\Windows\System32\Tasks\SystemToolsDailyTest 2013-08-26 08:46 - 2013-08-26 08:46 - 00000000 ____D C:\Users\Mary\AppData\Local\{F3490FD7-438A-4F43-9B1D-E9B4242B4599} 2013-08-25 21:26 - 2011-07-31 11:23 - 00000000 ___DC C:\Users\Mary\AppData\Local\MigWiz 2013-08-25 21:14 - 2013-08-25 21:14 - 00000758 _____ C:\Windows\comsetup.log 2013-08-25 21:14 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\registration 2013-08-25 21:07 - 2009-07-14 01:13 - 00726444 _____ C:\Windows\system32\PerfStringBackup.INI 2013-08-25 20:45 - 2013-08-25 20:45 - 00000000 ____D C:\Users\Mary\AppData\Local\{2F50A2C6-E9C2-4A3D-BD26-4931FB7DED5A} 2013-08-25 16:11 - 2011-10-05 06:52 - 01092608 ___SH C:\Users\Mary\Documents\Thumbs.db 2013-08-25 14:09 - 2013-08-25 08:57 - 00027256 _____ (Symantec Corporation) C:\Windows\system32\Drivers\FixZeroAccess.sys 2013-08-25 13:39 - 2013-08-25 13:24 - 00000000 ____D C:\Program Files (x86)\stinger 2013-08-25 09:06 - 2011-05-30 18:05 - 00000000 ____D C:\ProgramData\Sonic 2013-08-25 08:45 - 2013-08-25 08:45 - 00000000 ____D C:\Users\Mary\AppData\Local\{5ABDA21B-0923-4AA7-B866-5A2A301027E7} 2013-08-25 08:33 - 2011-07-31 12:54 - 00000000 ____D C:\Users\Mary\AppData\Local\Google 2013-08-24 20:43 - 2013-08-24 20:43 - 00001785 _____ C:\Users\Public\Desktop\iTunes.lnk 2013-08-24 20:43 - 2013-08-24 20:40 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-08-24 20:43 - 2013-08-24 20:40 - 00000000 ____D C:\Program Files\iTunes 2013-08-24 20:43 - 2011-12-15 08:13 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-08-24 20:40 - 2013-08-24 20:40 - 00000000 ____D C:\Program Files\iPod 2013-08-24 20:30 - 2013-08-01 23:49 - 00000000 ____D C:\Program Files\McAfee 2013-08-24 20:27 - 2013-08-24 20:27 - 00000000 ____D C:\Users\Mary\AppData\Local\{BA68B3A3-3F18-46B4-95DD-97830A062F67} 2013-08-24 20:26 - 2012-11-26 20:13 - 00000000 ____D C:\Users\Mary\AppData\Roaming\.minecraft 2013-08-24 17:10 - 2013-08-15 03:01 - 00000000 ____D C:\Windows\system32\MRT 2013-08-24 17:06 - 2012-05-02 18:40 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-08-24 16:28 - 2013-08-24 16:28 - 00000000 ____D C:\Users\Mary\AppData\Local\{AFB020FD-1D22-4BF6-8DA0-D8F6E3E7855D} 2013-08-24 04:28 - 2013-08-24 04:28 - 00000000 ____D C:\Users\Mary\AppData\Local\{276DA7FF-4CDE-4428-84BC-014CBB7811D9} 2013-08-23 16:28 - 2013-08-23 16:28 - 00000000 ____D C:\Users\Mary\AppData\Local\{1523D0C8-3B49-4CAE-B923-0A1A8E49CD2A} 2013-08-22 18:58 - 2013-08-22 18:57 - 00000000 ____D C:\Users\Mary\AppData\Local\{0D75E1F3-8A42-47B7-B7F4-130C47728B92} 2013-08-21 21:11 - 2013-08-21 21:11 - 00000000 ____D C:\Users\Mary\AppData\Local\{D1FF8090-C5EA-4358-B6FE-496FAA44842D} 2013-08-21 16:09 - 2013-08-21 16:09 - 00675988 _____ C:\Users\Mary\Desktop\Minecraft(1).exe 2013-08-21 09:02 - 2012-04-30 07:19 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-08-21 09:02 - 2012-04-30 07:19 - 00003768 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater 2013-08-21 09:02 - 2011-08-01 21:13 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-08-20 18:21 - 2013-08-20 18:21 - 00000000 ____D C:\Users\Mary\AppData\Local\{1369FFD1-0449-4A77-AD21-6CAF8A550A0D} 2013-08-19 19:40 - 2013-08-19 19:39 - 00000000 ____D C:\Users\Mary\AppData\Local\{29F595D7-FFE1-4447-B4D3-EF66DF055393} 2013-08-18 19:22 - 2013-08-18 19:21 - 00000000 ____D C:\Users\Mary\AppData\Local\{67866234-8DA6-402A-A746-6017F9A8C04D} 2013-08-17 06:40 - 2013-08-17 06:40 - 00000000 ____D C:\Users\Mary\AppData\Local\{2C5BD34B-B447-4015-B0E4-239ACA300FBF} 2013-08-16 19:39 - 2013-08-16 19:39 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-08-16 18:40 - 2013-08-16 18:39 - 00000000 ____D C:\Users\Mary\AppData\Local\{4A772E7F-9181-46E9-9591-D501429EB85A} 2013-08-16 06:39 - 2013-08-16 06:39 - 00000000 ____D C:\Users\Mary\AppData\Local\{CA20C74F-0DF7-43B6-A6EB-62C169F3CC8F} 2013-08-15 18:39 - 2013-08-15 18:39 - 00000000 ____D C:\Users\Mary\AppData\Local\{33F74B76-53AA-4CEE-BA22-25275BA667EE} 2013-08-15 06:39 - 2013-08-15 06:38 - 00000000 ____D C:\Users\Mary\AppData\Local\{0D65B658-8F4C-4026-848D-C0ABCAD72377} 2013-08-15 04:41 - 2009-07-13 23:20 - 00000000 ____D C:\Windows\rescache 2013-08-15 03:05 - 2011-08-04 13:30 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-08-15 03:04 - 2013-08-15 03:01 - 00000000 ____D C:\8d978519985f056930df0364bccb 2013-08-15 03:01 - 2011-07-31 08:39 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2013-08-14 18:38 - 2013-08-14 18:38 - 00000000 ____D C:\Users\Mary\AppData\Local\{3BC16868-3D6E-4842-BA63-D8AC3847A740} 2013-08-14 06:38 - 2013-08-14 06:38 - 00000000 ____D C:\Users\Mary\AppData\Local\{EF19346A-32A2-431A-9499-054FE0135865} 2013-08-13 18:38 - 2013-08-13 18:37 - 00000000 ____D C:\Users\Mary\AppData\Local\{18EB5E82-6AF9-4AEC-9069-55E59884B524} 2013-08-13 06:37 - 2013-08-13 06:37 - 00000000 ____D C:\Users\Mary\AppData\Local\{437C29AB-A94F-481A-9E8D-3993282823CB} 2013-08-12 18:37 - 2013-08-12 18:37 - 00000000 ____D C:\Users\Mary\AppData\Local\{49E7D91A-D5FE-42AD-9682-9E3E7B3BD53D} 2013-08-11 20:03 - 2013-08-11 20:03 - 00000000 ____D C:\Users\Mary\AppData\Local\{744C013A-B045-4A65-AB7B-516CC38D822B} 2013-08-11 08:03 - 2013-08-11 08:03 - 00000000 ____D C:\Users\Mary\AppData\Local\{BFB51042-6F28-40DA-84C8-465EAF55F5F6} 2013-08-10 20:03 - 2013-08-10 20:03 - 00000000 ____D C:\Users\Mary\AppData\Local\{58B68BA3-1B06-46AA-8149-4FA6BD17A716} 2013-08-10 08:02 - 2013-08-10 08:02 - 00000000 ____D C:\Users\Mary\AppData\Local\{9AB692DB-5F4A-4DB1-B2FF-21D4BC4AE9A1} 2013-08-10 08:00 - 2011-07-30 14:46 - 00000564 _____ C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job 2013-08-09 19:11 - 2013-08-09 19:11 - 00000000 ____D C:\Users\Mary\AppData\Local\{F105C54E-CD6E-4C90-B317-3746773A385B} 2013-08-09 07:10 - 2013-08-09 07:10 - 00000000 ____D C:\Users\Mary\AppData\Local\{5C52D20F-C30C-4D48-AA63-47AFD52AB772} 2013-08-08 19:10 - 2013-08-08 19:10 - 00000000 ____D C:\Users\Mary\AppData\Local\{F47F69A7-623C-4988-84AF-2EFB897CD0F3} 2013-08-07 19:59 - 2013-08-07 19:59 - 00000000 ____D C:\Users\Mary\AppData\Local\{688DE1D3-5E40-435E-B64E-7FC27F4BC248} 2013-08-07 06:46 - 2013-08-07 06:46 - 00000000 ____D C:\Users\Mary\AppData\Local\{97E0C4D2-9009-48DA-8D03-0CF5B27CACEC} 2013-08-06 18:46 - 2013-08-06 18:46 - 00000000 ____D C:\Users\Mary\AppData\Local\{43CE817D-494E-45DD-814A-C6205EE36B25} 2013-08-06 06:11 - 2013-08-06 06:11 - 00000000 ____D C:\Users\Mary\AppData\Local\{CE463F15-6B80-41D2-B7B7-ABC14B0159EA} 2013-08-05 18:11 - 2013-08-05 18:11 - 00000000 ____D C:\Users\Mary\AppData\Local\{3E821056-86C0-49DB-8598-BDD2ACAE05EB} 2013-08-05 06:08 - 2013-08-05 06:08 - 00000000 ____D C:\Users\Mary\AppData\Local\{BBF80BDD-2459-4D14-BEF0-4BFC800166D7} 2013-08-04 18:17 - 2011-07-30 14:46 - 00004272 _____ C:\Windows\System32\Tasks\PCDoctorBackgroundMonitorTask 2013-08-04 18:08 - 2013-08-04 18:08 - 00000000 ____D C:\Users\Mary\AppData\Local\{E009F493-8601-42AF-8E48-F14921A7CAA7} 2013-08-02 15:00 - 2011-05-30 17:57 - 00000000 ____D C:\ProgramData\McAfee 2013-08-02 07:27 - 2013-08-02 07:26 - 00000000 ____D C:\Users\Mary\AppData\Local\{1ED6FC48-63DC-40BC-BBDB-A7DCEF86AD42} 2013-08-02 01:06 - 2013-08-02 01:00 - 00000000 ____D C:\ProgramData\HitmanPro 2013-08-02 01:01 - 2013-08-02 01:01 - 00000000 ____D C:\Program Files\HitmanPro 2013-08-02 00:14 - 2011-07-30 19:47 - 00000000 ____D C:\Users\Mary\AppData\Local\Adobe 2013-08-02 00:11 - 2013-08-02 00:11 - 00001847 _____ C:\Users\Public\Desktop\QuickTime Player.lnk 2013-08-02 00:11 - 2013-08-02 00:10 - 00000000 ____D C:\Program Files (x86)\QuickTime 2013-08-02 00:04 - 2013-08-02 00:04 - 00263592 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe 2013-08-02 00:04 - 2013-08-02 00:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe 2013-08-02 00:04 - 2013-08-02 00:04 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe 2013-08-02 00:04 - 2013-08-02 00:04 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll 2013-08-02 00:04 - 2012-07-21 09:58 - 00867240 _____ (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll 2013-08-02 00:04 - 2011-05-30 17:41 - 00789416 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll 2013-08-02 00:04 - 2011-05-30 17:41 - 00000000 ____D C:\Program Files (x86)\Java 2013-08-01 23:51 - 2013-08-01 23:51 - 00000000 ____D C:\Program Files (x86)\McAfee.com 2013-08-01 23:51 - 2011-05-30 17:57 - 00000000 ____D C:\Program Files\Common Files\mcafee 2013-08-01 23:51 - 2011-05-30 17:57 - 00000000 ____D C:\Program Files (x86)\McAfee 2013-08-01 23:49 - 2013-08-01 23:49 - 00000000 ____D C:\Program Files\McAfee.com 2013-08-01 23:21 - 2009-07-14 00:54 - 00000749 ___RH C:\Windows\WindowsShell.Manifest 2013-08-01 23:21 - 2009-07-13 23:20 - 00000000 __RHD C:\Users\Public\Libraries 2013-08-01 23:04 - 2011-07-31 12:54 - 00000000 ____D C:\Users\Mary\AppData\Roaming\Google 2013-08-01 23:01 - 2013-08-01 23:01 - 00000000 ____D C:\ProgramData\Google 2013-08-01 23:01 - 2013-08-01 23:01 - 00000000 ____D C:\Program Files\Google 2013-08-01 23:01 - 2011-08-01 21:12 - 00000000 ____D C:\Program Files (x86)\Google 2013-08-01 21:51 - 2011-07-30 21:25 - 00000000 ____D C:\Users\Mary\Documents\Stuff Tripp Downloaded 2013-08-01 20:22 - 2013-08-01 20:22 - 00000000 ____D C:\mfe 2013-08-01 20:11 - 2013-08-01 19:15 - 00000000 ____D C:\Program Files\stinger 2013-08-01 07:31 - 2013-08-01 07:31 - 00000000 ____D C:\Users\Mary\AppData\Local\{697DF7B7-5699-473B-A7E7-5F2E2EE19CDC} 2013-07-31 19:31 - 2013-07-31 19:30 - 00000000 ____D C:\Users\Mary\AppData\Local\{A4A72CE0-8485-43B3-94A8-82AE68BBC8A7} 2013-07-31 16:21 - 2012-09-25 17:43 - 00000000 _____ C:\Windows\system32\OxpsConverter.exe 2013-07-30 21:33 - 2013-07-30 21:33 - 00000000 ____D C:\Users\Mary\AppData\Local\{3B433F84-906C-4CAD-BF3C-78D147E0AA68} 2013-07-29 18:33 - 2013-07-29 18:32 - 00000000 ____D C:\Users\Mary\AppData\Local\{36B5B97C-E55B-43DE-9AD3-8EA8E4955D8C} 2013-07-29 06:32 - 2013-07-29 06:32 - 00000000 ____D C:\Users\Mary\AppData\Local\{6D3A18DE-2BC6-49F4-8C2B-9FE002AB9A82} 2013-07-28 18:32 - 2013-07-28 18:32 - 00000000 ____D C:\Users\Mary\AppData\Local\{94E236F2-7028-4F0A-8CC1-95015707C9A3} 2013-07-28 06:32 - 2013-07-28 06:32 - 00000000 ____D C:\Users\Mary\AppData\Local\{4A3379E6-3CF0-4CFB-AFFA-1DF0AC280EF8} 2013-07-27 18:32 - 2013-07-27 18:31 - 00000000 ____D C:\Users\Mary\AppData\Local\{967B64F0-27A9-4F77-8091-D95D76260548} 2013-07-27 06:31 - 2013-07-27 06:31 - 00000000 ____D C:\Users\Mary\AppData\Local\{CA8F338F-3DFC-4C5B-BC0F-DAE0B46BD2AF} Files to move or delete: ==================== C:\Users\Mary\AppData\Local\Temp\Garmin Software Updates\Garmin ANT Agent.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-08-22 00:58 ==================== End Of Log ============================ Addition.txt: Additional scan result of Farbar Recovery Scan Tool (x64) Version: 26-08-2013 02 Ran by Mary at 2013-08-26 17:41:33 Running from C:\Users\Mary\Desktop\Farbar Boot Mode: Normal ========================================================== ==================== Installed Programs ======================= Update for Microsoft Office 2007 (KB2508958) (x32) Adobe AIR (x32 Version: 3.5.0.880) Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94) Adobe Flash Player 11 Plugin (x32 Version: 11.8.800.94) Adobe Reader XI (11.0.03) (x32 Version: 11.0.03) Apple Application Support (x32 Version: 2.3.4) Apple Mobile Device Support (Version: 6.1.0.13) Apple Software Update (x32 Version: 2.1.3.127) Ask Toolbar (x32 Version: 1.15.2.0) Ask Toolbar Updater (HKCU Version: 1.2.1.23037) Belkin Network USB Hub Control Center (Version: 1.4.0) Best Buy pc app (HKCU Version: 3.2.523.2) Best Buy pc app (Version: 3.1.0.0) Best Buy pc app (x32 Version: 3.1.0.0) Bing Bar (x32 Version: 6.0.2282.0) Bing Bar Platform (x32 Version: 6.0.2282.0) Bing Rewards Client Installer (x32 Version: 16.0.345.0) Bonjour (Version: 3.0.0.10) Canon MP Navigator EX 2.0 (x32) Catalyst Control Center - Branding (x32 Version: 1.00.0000) Catalyst Control Center Core Implementation (x32 Version: 2009.0714.2132.36830) Catalyst Control Center Graphics Full Existing (x32 Version: 2009.0714.2132.36830) Catalyst Control Center Graphics Full New (x32 Version: 2009.0714.2132.36830) Catalyst Control Center Graphics Light (x32 Version: 2009.0714.2132.36830) Catalyst Control Center Graphics Previews Common (x32 Version: 2009.0714.2132.36830) Catalyst Control Center Graphics Previews Vista (x32 Version: 2009.0714.2132.36830) Catalyst Control Center InstallProxy (x32 Version: 2009.0714.2132.36830) Catalyst Control Center Localization All (x32 Version: 2009.0714.2132.36830) CCC Help Chinese Standard (x32 Version: 2009.0714.2131.36830) CCC Help Chinese Traditional (x32 Version: 2009.0714.2131.36830) CCC Help Czech (x32 Version: 2009.0714.2131.36830) CCC Help Danish (x32 Version: 2009.0714.2131.36830) CCC Help Dutch (x32 Version: 2009.0714.2131.36830) CCC Help English (x32 Version: 2009.0714.2131.36830) CCC Help Finnish (x32 Version: 2009.0714.2131.36830) CCC Help French (x32 Version: 2009.0714.2131.36830) CCC Help German (x32 Version: 2009.0714.2131.36830) CCC Help Greek (x32 Version: 2009.0714.2131.36830) CCC Help Hungarian (x32 Version: 2009.0714.2131.36830) CCC Help Italian (x32 Version: 2009.0714.2131.36830) CCC Help Japanese (x32 Version: 2009.0714.2131.36830) CCC Help Korean (x32 Version: 2009.0714.2131.36830) CCC Help Norwegian (x32 Version: 2009.0714.2131.36830) CCC Help Polish (x32 Version: 2009.0714.2131.36830) CCC Help Portuguese (x32 Version: 2009.0714.2131.36830) CCC Help Russian (x32 Version: 2009.0714.2131.36830) CCC Help Spanish (x32 Version: 2009.0714.2131.36830) CCC Help Swedish (x32 Version: 2009.0714.2131.36830) CCC Help Thai (x32 Version: 2009.0714.2131.36830) CCC Help Turkish (x32 Version: 2009.0714.2131.36830) ccc-core-static (x32 Version: 2009.0714.2132.36830) ccc-utility64 (Version: 2009.0714.2132.36830) Compatibility Pack for the 2007 Office system (x32 Version: 12.0.6612.1000) D3DX10 (x32 Version: 15.4.2368.0902) Dell DataSafe Local Backup - Support Software (x32) Dell DataSafe Local Backup (x32 Version: 9.4.47) Dell Edoc Viewer (Version: 1.0.0) Dell Getting Started Guide (x32 Version: 1.00.0000) Dell MusicStage (x32 Version: 1.4.162.0) Dell PhotoStage (x32 Version: 1.5.0.30) Dell Stage (x32 Version: 1.4.173.0) Dell Support Center (Version: 3.1.5803.11) Dell VideoStage (x32 Version: 1.1.1.1408) DirectX 9 Runtime (x32 Version: 1.00.0000) dows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) (Version: 07/07/2009 1.12.2) Garmin ANT Agent (x32 Version: 2.3.3) Garmin Communicator Plugin (x32 Version: 4.0.4) Garmin Communicator Plugin x64 (Version: 4.0.4) Garmin Training Center (x32 Version: 3.6.5) Garmin Training Center v5 (x32 Version: 5.0.0.0) Garmin USB Drivers (x32 Version: 2.3.0.0) Google Chrome (x32 Version: 29.0.1547.57) Google Talk (remove only) (HKCU) Google Toolbar for Internet Explorer (x32 Version: 1.0.0) Google Toolbar for Internet Explorer (x32 Version: 7.5.4413.1752) Google Update Helper (x32 Version: 1.3.21.153) iCloud (Version: 2.1.2.8) iTunes (Version: 11.0.5.5) Java 7 Update 25 (x32 Version: 7.0.250) Java Auto Updater (x32 Version: 2.1.9.5) Java 6 Update 24 (64-bit) (Version: 6.0.240) Junk Mail filter update (x32 Version: 15.4.3502.0922) Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300) McAfee Security Scan Plus (x32 Version: 3.0.318.3) McAfee SecurityCenter (x32 Version: 12.1.353) McAfee Virtual Technician (x32 Version: 7.1.0.2483) Mesh Runtime (x32 Version: 15.4.5722.2) Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319) Microsoft Application Error Reporting (Version: 12.0.6015.5000) Microsoft Default Manager (x32 Version: 2.2.114.0) Microsoft IntelliType Pro 8.1 (Version: 8.15.406.0) Microsoft Office 2007 Service Pack 3 (SP3) (x32) Microsoft Office 2010 (x32 Version: 14.0.4763.1000) Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office File Validation Add-In (x32 Version: 14.0.5130.5003) Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000) Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014) Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32) Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000) Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000) Microsoft Search Enhancement Pack (x32 Version: 3.0.131.0) Microsoft Silverlight (Version: 5.1.20513.0) Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193) Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729) Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161) Mozilla Firefox 23.0.1 (x86 en-US) (x32 Version: 23.0.1) Mozilla Maintenance Service (x32 Version: 23.0.1) MSVCRT (x32 Version: 15.4.2862.0708) MSVCRT_amd64 (x32 Version: 15.4.2862.0708) MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0) MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0) PhotoShowExpress (x32 Version: 2.0.063) QuickTime (x32 Version: 7.74.80.86) RBVirtualFolder64Inst (Version: 1.00.0000) Realtek High Definition Audio Driver (x32 Version: 6.0.1.5977) Roxio Activation Module (x32 Version: 1.0) Roxio BackOnTrack (x32 Version: 1.3.3) Roxio Burn (x32 Version: 1.8) Roxio Creator Starter (x32 Version: 1.0.439) Roxio Creator Starter (x32 Version: 12.1.77.0) Roxio Creator Starter (x32 Version: 5.0.0) Roxio Express Labeler 3 (x32 Version: 3.2.2) Roxio File Backup (Version: 1.3.2) Shared C Run-time for x64 (Version: 10.0.0) Shutterfly Express Uploader (x32 Version: 1.2.0) Shutterfly Express Uploader (x32 Version: 1.2.0.0) Skins (x32 Version: 2009.0714.2132.36830) Skype Toolbars (x32 Version: 1.0.4051) Skype™ 5.10 (x32 Version: 5.10.116) Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0) TomTom HOME 2.8.4.2596 (x32 Version: 2.8.4.2596) TomTom HOME Visual Studio Merge Modules (x32 Version: 1.0.2) Type to Learn 4 1.21 (x32 Version: 1.21) Unity Web Player (HKCU Version: ) Update for 2007 Microsoft Office System (KB967642) (x32) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1) Update for Microsoft Office 2007 Help for Common Features (KB963673) (x32) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (x32) Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (x32) Update for Microsoft Office Excel 2007 Help (KB963678) (x32) Update for Microsoft Office OneNote 2007 Help (KB963670) (x32) Update for Microsoft Office Powerpoint 2007 Help (KB963669) (x32) Update for Microsoft Office Script Editor Help (KB963671) (x32) Update for Microsoft Office Word 2007 Help (KB963665) (x32) VoiceOver Kit (x32 Version: 1.42.128.0) Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) (Version: 06/03/2009 2.3.0.0) Windows Live Communications Platform (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3502.0922) Windows Live Essentials (x32 Version: 15.4.3555.0308) Windows Live ID Sign-in Assistant (Version: 7.250.4232.0) Windows Live Installer (x32 Version: 15.4.3502.0922) Windows Live Language Selector (Version: 15.4.3555.0308) Windows Live Mail (x32 Version: 15.4.3502.0922) Windows Live Mesh (x32 Version: 15.4.3502.0922) Windows Live Mesh ActiveX Control for Remote Connections (x32 Version: 15.4.5722.2) Windows Live Messenger (x32 Version: 15.4.3538.0513) Windows Live MIME IFilter (Version: 15.4.3502.0922) Windows Live Movie Maker (x32 Version: 15.4.3502.0922) Windows Live Photo Common (x32 Version: 15.4.3502.0922) Windows Live Photo Gallery (x32 Version: 15.4.3502.0922) Windows Live PIMT Platform (x32 Version: 15.4.3508.1109) Windows Live Remote Client (Version: 15.4.5722.2) Windows Live Remote Client Resources (Version: 15.4.5722.2) Windows Live Remote Service (Version: 15.4.5722.2) Windows Live Remote Service Resources (Version: 15.4.5722.2) Windows Live SOXE (x32 Version: 15.4.3502.0922) Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922) Windows Live UX Platform (x32 Version: 15.4.3502.0922) Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109) Windows Live Writer (x32 Version: 15.4.3502.0922) Windows Live Writer Resources (x32 Version: 15.4.3502.0922) ==================== Restore Points ========================= 11-08-2013 07:00:18 Windows Backup 15-08-2013 07:00:21 Windows Update 18-08-2013 07:00:11 Windows Backup 25-08-2013 07:00:08 Windows Backup 26-08-2013 17:26:51 Malwarebytes Anti-Rootkit Restore Point ==================== Hosts content: ========================== 2009-07-13 22:34 - 2009-06-10 17:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts ==================== Scheduled Tasks (whitelisted) ============= Task: {01592CE4-73FF-4C6F-BAA4-572955831FB4} - System32\Tasks\Microsoft_Hardware_Launch_IType_exe => C:\Program Files\Microsoft IntelliType Pro\IType.exe [2011-04-13] (Microsoft Corporation) Task: {01F6B114-1901-438A-8104-0494497578F2} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-08-01] (Google Inc.) Task: {0219F72F-4E6C-4B9D-B268-43E14071F58F} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task Task: {1506642C-7415-4E14-9D05-BA244E0A8E65} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe [2012-05-04] () Task: {1B9E88EA-86E6-4325-90D0-9909416EB0C5} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.) Task: {50C74F3F-6988-4FB3-8E2A-EAFB1A291E93} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2011-08-01] (Google Inc.) Task: {6367CE5D-4C08-4DE8-8547-CC9B3DE61DB4} - System32\Tasks\Microsoft\Windows\WindowsBackup\Windows Backup Monitor => C:\Windows\system32\sdclt.exe [2010-11-20] (Microsoft Corporation) Task: {69BBB905-2FC9-410D-82EB-6EF99C0EBD0B} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\Dell Support Center\uaclauncher.exe [2011-03-22] (PC-Doctor, Inc.) Task: {86B9A5B3-4E63-43F2-BCF5-824C525D92FC} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => C:\Windows\system32\rundll32.exe [2009-07-13] (Microsoft Corporation) Task: {8E8D1FDB-CC39-4012-BB21-E5EBCA72426C} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\Dell Support Center\pcdrcui.exe [2011-03-22] (PC-Doctor, Inc.) Task: {9CCBF331-8255-4549-933A-577353988BD8} - System32\Tasks\PCDEventLauncher => C:\Program Files\Dell Support Center\sessionchecker.exe [2011-03-22] (PC-Doctor, Inc.) Task: {AEA0B949-9B10-4C75-A32C-412B74345F01} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-21] (Adobe Systems Incorporated) Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\Dell Support Center\uaclauncher.exe Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\Dell Support Center\pcdrcui.exe ==================== Faulty Device Manager Devices ============= ==================== Event log errors: ========================= Application errors: ================== Error: (08/24/2013 05:12:01 PM) (Source: Application Error) (User: ) Description: Faulting application name: ANT Agent.exe, version: 2.3.3.0, time stamp: 0x4f6cf3f8 Faulting module name: ANT Agent.exe, version: 2.3.3.0, time stamp: 0x4f6cf3f8 Exception code: 0xc0000417 Fault offset: 0x0002a380 Faulting process id: 0xef0 Faulting application start time: 0xANT Agent.exe0 Faulting application path: ANT Agent.exe1 Faulting module path: ANT Agent.exe2 Report Id: ANT Agent.exe3 Error: (08/22/2013 05:45:58 PM) (Source: Application Error) (User: ) Description: Faulting application name: mcsacore.exe, version: 3.6.2.124, time stamp: 0x519cd4f0 Faulting module name: saupkeep.dll_unloaded, version: 0.0.0.0, time stamp: 0x519cd67d Exception code: 0xc0000005 Fault offset: 0x000007fef77d1019 Faulting process id: 0xd8c Faulting application start time: 0xmcsacore.exe0 Faulting application path: mcsacore.exe1 Faulting module path: mcsacore.exe2 Report Id: mcsacore.exe3 Error: (08/08/2013 05:00:17 AM) (Source: Bonjour Service) (User: ) Description: 324: DNSServiceResolve 34:51:c9:c0:36:b7@fe80::3651:c9ff:fec0:36b7._apple-mobdev._tcp.local. Error: (08/08/2013 05:00:17 AM) (Source: Bonjour Service) (User: ) Description: 324: Client unresponsive; aborting connection Error: (08/08/2013 05:00:17 AM) (Source: Bonjour Service) (User: ) Description: 324: Could not write data to client after 600 seconds, 3 replies waiting Error: (08/08/2013 05:00:16 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/08/2013 05:00:15 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/08/2013 05:00:14 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/08/2013 05:00:13 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second Error: (08/08/2013 05:00:12 AM) (Source: Bonjour Service) (User: ) Description: Task Scheduling Error: Continuously busy for more than a second System errors: ============= Error: (08/26/2013 05:25:52 PM) (Source: VDS Basic Provider) (User: ) Description: Unexpected failure. Error code: D@01010004 Error: (08/26/2013 05:23:58 PM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (08/26/2013 05:06:09 PM) (Source: VDS Basic Provider) (User: ) Description: Unexpected failure. Error code: D@01010004 Error: (08/26/2013 05:04:15 PM) (Source: DCOM) (User: ) Description: {E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E} Error: (08/26/2013 04:11:17 PM) (Source: mbamchameleon) (User: ) Description: \Device\HarddiskVolume3\PROGRA~2\MCAFEE\SITEAD~1\SAUI.EXE Error: (08/26/2013 04:11:17 PM) (Source: mbamchameleon) (User: ) Description: \Device\HarddiskVolume3\PROGRAM FILES\COMMON FILES\MCAFEE\PLATFORM\MCUICNT.EXE Error: (08/26/2013 04:11:17 PM) (Source: mbamchameleon) (User: ) Description: \Device\HarddiskVolume3\PROGRAM FILES (X86)\MCAFEE SECURITY SCAN\3.0.318\SSSCHEDULER.EXE Error: (08/26/2013 04:11:17 PM) (Source: mbamchameleon) (User: ) Description: \Device\HarddiskVolume3\PROGRA~1\MCAFEE\MSC\MCAPEXE.EXE Error: (08/26/2013 04:11:17 PM) (Source: mbamchameleon) (User: ) Description: \Device\HarddiskVolume3\PROGRAM FILES\COMMON FILES\MCAFEE\PLATFORM\MCSVCHOST\MCSVHOST.EXE Error: (08/26/2013 04:11:17 PM) (Source: mbamchameleon) (User: ) Description: \Device\HarddiskVolume3\PROGRAM FILES\COMMON FILES\MCAFEE\SYSTEMCORE\MFEFIRE.EXE Microsoft Office Sessions: ========================= Error: (07/05/2013 03:19:59 AM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6665.5003, Microsoft Office Version: 12.0.6612.1000. This session lasted 126981 seconds with 240 seconds of active time. This session ended with a crash. Error: (06/10/2012 04:17:33 PM) (Source: Microsoft Office 12 Sessions)(User: ) Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 1200 seconds with 840 seconds of active time. This session ended with a crash. CodeIntegrity Errors: =================================== Date: 2013-08-24 17:18:24.257 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-08-24 17:18:24.249 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-08-24 17:18:24.244 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-08-01 13:17:14.748 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-08-01 13:17:14.748 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-08-01 13:17:14.748 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-08-01 08:29:11.625 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-08-01 08:29:11.625 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-08-01 08:29:11.625 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. Date: 2013-07-30 08:44:55.730 Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume3\Program Files\Common Files\mcafee\VSCore\mfeelamk.sys because the set of per-page image hashes could not be found on the system. ==================== Memory info =========================== Percentage of memory in use: 53% Total physical RAM: 3838.98 MB Available physical RAM: 1802.79 MB Total Pagefile: 7676.14 MB Available Pagefile: 5527.5 MB Total Virtual: 8192 MB Available Virtual: 8191.82 MB ==================== Drives ================================ Drive c: (OS) (Fixed) (Total:453.47 GB) (Free:211.13 GB) NTFS Drive e: () (Fixed) (Total:228.14 GB) (Free:78.88 GB) NTFS Drive j: (My Book) (Fixed) (Total:698.46 GB) (Free:127.49 GB) FAT32 Drive k: (My Book) (Fixed) (Total:1862.98 GB) (Free:1703.71 GB) NTFS ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 466 GB) (Disk ID: 4FE439C0) Partition 1: (Not Active) - (Size=39 MB) - (Type=DE) Partition 2: (Active) - (Size=12 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=453 GB) - (Type=07 NTFS) ======================================================== Disk: 1 (Size: 233 GB) (Disk ID: E686F016) Partition 1: (Not Active) - (Size=39 MB) - (Type=DE) Partition 2: (Active) - (Size=228 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=5 GB) - (Type=DB) ======================================================== Disk: 2 (Size: 699 GB) (Disk ID: 41FFC810) Partition 1: (Active) - (Size=699 GB) - (Type=0C) ======================================================== Disk: 3 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 0005F107) Partition 1: (Not Active) - (Size=-198659014656) - (Type=07 NTFS) ==================== End Of Log ============================

Thanks in advance. Am being humbled by zaccess. Have pre-emptively requested win7 install disks from Dell ( had tracking number in 3 hrs, 'course would've been happier with disks in box ) and started backing up all data, but don't really want to start over. mbam finds: Registry Values Detected: 1 HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Google Update (Trojan.Zaccess) -> Data: -> Quarantined and deleted successfully. But it comes right back. RogueKiller v8.6.6 X64 fails with [0xc0000034] trying to delete keys: [RUN][ZeroAccess] HKCU\[...]\Run : Google Update ("C:\Users\Mary\AppData\Local\Google\Desktop\Install\{de8a9a68-6d2e-b38c-2b83-ce619613ff63}\???\???\???๛\{de8a9a68-6d2e-b38c-2b83-ce619613ff63}\GoogleUpdate.exe" >) -> [0xc0000034] Unknown error [RUN][ZeroAccess] HKUS\S-1-5-21-533849793-3111552998-1685056747-1000\[...]\Run : Google Update ("C:\Users\Mary\AppData\Local\Google\Desktop\Install\{de8a9a68-6d2e-b38c-2b83-ce619613ff63}\???\???\???๛\{de8a9a68-6d2e-b38c-2b83-ce619613ff63}\GoogleUpdate.exe" >) -> [0xc0000034] Unknown error dds.txt: DDS (Ver_2012-11-20.01) - NTFS_AMD64 Internet Explorer: 10.0.9200.16660 BrowserJavaVersion: 10.25.2 Run by Mary at 16:27:12 on 2013-08-26 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3839.1726 [GMT -4:00] . AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892} SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} FW: McAfee Firewall *Enabled* {959DA8E2-3527-57D1-4915-924367AD4FE9} . ============== Running Processes =============== . C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\system32\atiesrxx.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\atieclxx.exe C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\taskhost.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe C:\Windows\system32\mfevtps.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe C:\Windows\system32\rundll32.exe C:\Windows\system32\rundll32.exe C:\Windows\SysWOW64\rundll32.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\McAfee\AMCore\mcshield.exe C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\PROGRA~1\McAfee\MSC\McAPExe.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\WUDFHost.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Toaster.exe C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Users\Mary\AppData\Roaming\Google\Google Talk\googletalk.exe C:\Garmin\TrainingCenter\gStart.exe C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe C:\Program Files\Belkin\Network USB Hub Control Center\Connect.exe C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe C:\Program Files (x86)\Ask.com\Updater\Updater.exe c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files\Common Files\McAfee\Platform\mcuicnt.exe C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe C:\Program Files\iPod\bin\iPodService.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\system32\taskeng.exe c:\PROGRA~2\mcafee\SITEAD~1\saui.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\System32\cscript.exe . ============== Pseudo HJT Report =============== . uURLSearchHooks: UrlSearchHook Class: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll mWinlogon: Userinit = userinit.exe, BHO: MSS+ Identifier: {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Program Files (x86)\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - BHO: Search Helper: {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll BHO: Java Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll BHO: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll TB: @C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll TB: Ask Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll uRun: [googletalk] C:\Users\Mary\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart uRun: [gStart] C:\Garmin\TrainingCenter\gStart.exe uRun: [ANT Agent] C:\Program Files (x86)\Garmin\ANT Agent\ANT Agent.exe uRun: [MobileDocuments] C:\Program Files (x86)\Common Files\Apple\Internet Services\ubd.exe uRun: [TomTomHOME.exe] "C:\Program Files (x86)\TomTom HOME 2\TomTomHOMERunner.exe" uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" mRun: [startCCC] "c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun mRun: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [mcpltui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey mRun: [sunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe mRunOnce: [DSUpdateLauncher] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe" /NOCONSOLE /D="C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate" /RUNAS "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe" mRunOnce: [sTToasterLauncher] C:\Program Files (x86)\Dell DataSafe Local Backup\toasterLauncher.exe StartupFolder: C:\Users\Mary\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\BELKIN~1.LNK - C:\Program Files\Belkin\Network USB Hub Control Center\Connect.exe StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MCAFEE~1.LNK - C:\Program Files (x86)\McAfee Security Scan\3.0.318\SSScheduler.exe mPolicies-Explorer: NoActiveDesktop = dword:1 mPolicies-System: ConsentPromptBehaviorAdmin = dword:5 mPolicies-System: ConsentPromptBehaviorUser = dword:3 mPolicies-System: EnableUIADesktopToggle = dword:0 IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office12\ONBttnIE.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} TCP: NameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{06F21099-84B9-461F-9BD3-92874DC06196} : DHCPNameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{06F21099-84B9-461F-9BD3-92874DC06196}\84F6D656 : DHCPNameServer = 75.75.75.75 75.75.76.76 TCP: Interfaces\{C41DA6E7-2B6E-4881-ABEF-294DC70CA591} : DHCPNameServer = 75.75.75.75 75.75.76.76 Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\MSC\McSnIePl.dll Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\McIEPlg.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll SSODL: WebCheck - <orphaned> mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\29.0.1547.57\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome x64-BHO: McAfee Phishing Filter: {27B4851A-3207-45A2-B947-BE8AFE6163AB} - x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-BHO: McAfee SiteAdvisor BHO: {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll x64-BHO: Java Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll x64-TB: McAfee SiteAdvisor Toolbar: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s x64-Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup x64-Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" x64-Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\McAfee\MSC\McSnIePl64.dll x64-Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll x64-Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files (x86)\McAfee\SiteAdvisor\x64\McIEPlg.dll x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned> x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned> x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned> x64-SSODL: WebCheck - <orphaned> . ================= FIREFOX =================== . FF - ProfilePath - C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\ FF - plugin: c:\PROGRA~2\mcafee\msc\npMcSnFFPl.dll FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll FF - plugin: C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll FF - plugin: C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMSS.dll FF - plugin: C:\Program Files (x86)\McAfee\SiteAdvisor\NPMcFFPlg32.dll FF - plugin: C:\Program Files (x86)\McAfee\Supportability\MVT\NPMVTPlugin.dll FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrlui.dll FF - plugin: C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll FF - plugin: C:\ProgramData\Best Buy pc app\npBestBuyPcAppDetector.dll FF - plugin: C:\Users\Mary\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll FF - plugin: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}\plugins\npGarmin.dll FF - plugin: C:\Users\Mary\AppData\Roaming\Mozilla\Firefox\Profiles\jjcg7inv.default\extensions\{7f7f82f1-7c95-47cd-814f-950b56d58fc3}\plugins\np-mswmp.dll FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll FF - plugin: C:\Windows\SysWOW64\npdeployJava1.dll FF - plugin: C:\Windows\SysWOW64\npmproxy.dll FF - ExtSQL: 2013-08-01 23:55; {4ED1F68A-5463-4931-9384-8FFF5ED91D92}; C:\Program Files (x86)\McAfee\SiteAdvisor . ---- FIREFOX POLICIES ---- FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service FF - user.js: yahoo.ytff.general.dontshowhpoffer - true ============= SERVICES / DRIVERS =============== . R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\drivers\mfehidk.sys [2012-12-26 772944] R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\drivers\mfewfpk.sys [2013-4-3 342416] R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-5-30 55856] R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-5-30 203776] R2 HomeNetSvc;McAfee Home Network;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-8-1 221296] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\PROGRA~2\mcafee\SITEAD~1\mcsacore.exe [2013-8-24 120592] R2 McMPFSvc;McAfee Personal Firewall;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-8-1 221296] R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-8-1 221296] R2 mcpltsvc;McAfee Platform Services;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-8-1 221296] R2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\Platform\McSvcHost\McSvHost.exe [2013-8-1 221296] R2 mfecore;McAfee Anti-Malware Core;C:\Program Files\Common Files\mcafee\AMCore\mcshield.exe [2013-8-1 1017016] R2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\SystemCore\mfefire.exe [2013-8-1 218760] R2 mfevtp;McAfee Validation Trust Protection Service;C:\Windows\System32\mfevtps.exe [2013-8-1 182752] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-5-30 689472] R2 sxuptp;SXUPTP Driver;C:\Windows\System32\drivers\sxuptp.sys [2007-10-3 78952] R2 TomTomHOMEService;TomTomHOMEService;C:\Program Files (x86)\TomTom HOME 2\TomTomHOMEService.exe [2012-4-20 92592] R3 AE1000;Linksys AE1000 Driver;C:\Windows\System32\drivers\ae1000w7.sys [2011-7-30 1101600] R3 cfwids;McAfee Inc. cfwids;C:\Windows\System32\drivers\cfwids.sys [2013-4-3 70112] R3 k57nd60a;Broadcom NetLink Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2011-5-30 320040] R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\drivers\mfeavfk.sys [2013-4-3 309968] R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\System32\drivers\mfefirek.sys [2013-4-3 516608] R3 mfencbdc;McAfee Inc. mfencbdc;C:\Windows\System32\drivers\mfencbdc.sys [2013-2-18 337120] R3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944] S3 HipShieldK;McAfee Inc. HipShieldK;C:\Windows\System32\drivers\HipShieldK.sys [2013-8-1 197264] S3 libusb0;libusb-win32 - Kernel Driver 04/08/2011 1.2.4.0;C:\Windows\System32\drivers\libusb0.sys [2011-5-13 44480] S3 McComponentHostService;McAfee Security Scan Component Host Service;C:\Program Files (x86)\McAfee Security Scan\3.0.318\McCHSvc.exe [2013-2-5 235216] S3 mfencrk;McAfee Inc. mfencrk;C:\Windows\System32\drivers\mfencrk.sys [2013-2-18 95856] S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;C:\Program Files\Dell Support Center\pcdsrvc_x64.pkms [2011-3-18 25072] S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-7-31 59392] S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784] S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2011-7-31 1255736] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2013-08-26 20:11:28 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-08-26 12:46:13 -------- d-----w- C:\Users\Mary\AppData\Local\{F3490FD7-438A-4F43-9B1D-E9B4242B4599} 2013-08-26 00:45:48 -------- d-----w- C:\Users\Mary\AppData\Local\{2F50A2C6-E9C2-4A3D-BD26-4931FB7DED5A} 2013-08-25 17:24:16 -------- d-----w- C:\Program Files (x86)\stinger 2013-08-25 12:57:53 27256 ----a-w- C:\Windows\System32\drivers\FixZeroAccess.sys 2013-08-25 12:45:25 -------- d-----w- C:\Users\Mary\AppData\Local\{5ABDA21B-0923-4AA7-B866-5A2A301027E7} 2013-08-25 00:40:58 -------- d-----w- C:\Program Files\iPod 2013-08-25 00:40:51 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-08-25 00:40:51 -------- d-----w- C:\Program Files\iTunes 2013-08-25 00:27:36 -------- d-----w- C:\Users\Mary\AppData\Local\{BA68B3A3-3F18-46B4-95DD-97830A062F67} 2013-08-24 20:28:44 -------- d-----w- C:\Users\Mary\AppData\Local\{AFB020FD-1D22-4BF6-8DA0-D8F6E3E7855D} 2013-08-24 08:28:18 -------- d-----w- C:\Users\Mary\AppData\Local\{276DA7FF-4CDE-4428-84BC-014CBB7811D9} 2013-08-23 20:28:07 -------- d-----w- C:\Users\Mary\AppData\Local\{1523D0C8-3B49-4CAE-B923-0A1A8E49CD2A} 2013-08-22 22:57:55 -------- d-----w- C:\Users\Mary\AppData\Local\{0D75E1F3-8A42-47B7-B7F4-130C47728B92} 2013-08-22 01:11:44 -------- d-----w- C:\Users\Mary\AppData\Local\{D1FF8090-C5EA-4358-B6FE-496FAA44842D} 2013-08-20 22:21:08 -------- d-----w- C:\Users\Mary\AppData\Local\{1369FFD1-0449-4A77-AD21-6CAF8A550A0D} 2013-08-19 23:39:58 -------- d-----w- C:\Users\Mary\AppData\Local\{29F595D7-FFE1-4447-B4D3-EF66DF055393} 2013-08-18 23:21:54 -------- d-----w- C:\Users\Mary\AppData\Local\{67866234-8DA6-402A-A746-6017F9A8C04D} 2013-08-17 10:40:07 -------- d-----w- C:\Users\Mary\AppData\Local\{2C5BD34B-B447-4015-B0E4-239ACA300FBF} 2013-08-16 22:39:55 -------- d-----w- C:\Users\Mary\AppData\Local\{4A772E7F-9181-46E9-9591-D501429EB85A} 2013-08-16 10:39:31 -------- d-----w- C:\Users\Mary\AppData\Local\{CA20C74F-0DF7-43B6-A6EB-62C169F3CC8F} 2013-08-15 22:39:20 -------- d-----w- C:\Users\Mary\AppData\Local\{33F74B76-53AA-4CEE-BA22-25275BA667EE} 2013-08-15 10:38:57 -------- d-----w- C:\Users\Mary\AppData\Local\{0D65B658-8F4C-4026-848D-C0ABCAD72377} 2013-08-15 07:01:48 -------- d-----w- C:\Windows\System32\MRT 2013-08-15 07:01:40 -------- d-----w- C:\8d978519985f056930df0364bccb 2013-08-15 02:30:55 1472512 ----a-w- C:\Windows\System32\crypt32.dll 2013-08-15 02:30:55 1166848 ----a-w- C:\Windows\SysWow64\crypt32.dll 2013-08-15 02:30:54 224256 ----a-w- C:\Windows\System32\wintrust.dll 2013-08-15 02:30:54 184320 ----a-w- C:\Windows\System32\cryptsvc.dll 2013-08-15 02:30:54 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll 2013-08-15 02:30:54 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll 2013-08-15 02:30:53 139776 ----a-w- C:\Windows\System32\cryptnet.dll 2013-08-15 02:30:53 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll 2013-08-15 02:30:10 2048 ----a-w- C:\Windows\System32\tzres.dll 2013-08-15 02:30:09 2048 ----a-w- C:\Windows\SysWow64\tzres.dll 2013-08-14 22:38:33 -------- d-----w- C:\Users\Mary\AppData\Local\{3BC16868-3D6E-4842-BA63-D8AC3847A740} 2013-08-14 10:38:10 -------- d-----w- C:\Users\Mary\AppData\Local\{EF19346A-32A2-431A-9499-054FE0135865} 2013-08-13 22:37:58 -------- d-----w- C:\Users\Mary\AppData\Local\{18EB5E82-6AF9-4AEC-9069-55E59884B524} 2013-08-13 10:37:35 -------- d-----w- C:\Users\Mary\AppData\Local\{437C29AB-A94F-481A-9E8D-3993282823CB} 2013-08-12 22:37:22 -------- d-----w- C:\Users\Mary\AppData\Local\{49E7D91A-D5FE-42AD-9682-9E3E7B3BD53D} 2013-08-12 00:03:35 -------- d-----w- C:\Users\Mary\AppData\Local\{744C013A-B045-4A65-AB7B-516CC38D822B} 2013-08-11 12:03:24 -------- d-----w- C:\Users\Mary\AppData\Local\{BFB51042-6F28-40DA-84C8-465EAF55F5F6} 2013-08-11 00:03:00 -------- d-----w- C:\Users\Mary\AppData\Local\{58B68BA3-1B06-46AA-8149-4FA6BD17A716} 2013-08-10 12:02:49 -------- d-----w- C:\Users\Mary\AppData\Local\{9AB692DB-5F4A-4DB1-B2FF-21D4BC4AE9A1} 2013-08-09 23:11:12 -------- d-----w- C:\Users\Mary\AppData\Local\{F105C54E-CD6E-4C90-B317-3746773A385B} 2013-08-09 11:10:47 -------- d-----w- C:\Users\Mary\AppData\Local\{5C52D20F-C30C-4D48-AA63-47AFD52AB772} 2013-08-08 23:10:36 -------- d-----w- C:\Users\Mary\AppData\Local\{F47F69A7-623C-4988-84AF-2EFB897CD0F3} 2013-08-07 23:59:19 -------- d-----w- C:\Users\Mary\AppData\Local\{688DE1D3-5E40-435E-B64E-7FC27F4BC248} 2013-08-07 10:46:44 -------- d-----w- C:\Users\Mary\AppData\Local\{97E0C4D2-9009-48DA-8D03-0CF5B27CACEC} 2013-08-06 22:46:34 -------- d-----w- C:\Users\Mary\AppData\Local\{43CE817D-494E-45DD-814A-C6205EE36B25} 2013-08-06 10:11:20 -------- d-----w- C:\Users\Mary\AppData\Local\{CE463F15-6B80-41D2-B7B7-ABC14B0159EA} 2013-08-05 22:11:09 -------- d-----w- C:\Users\Mary\AppData\Local\{3E821056-86C0-49DB-8598-BDD2ACAE05EB} 2013-08-05 10:08:22 -------- d-----w- C:\Users\Mary\AppData\Local\{BBF80BDD-2459-4D14-BEF0-4BFC800166D7} 2013-08-04 22:08:10 -------- d-----w- C:\Users\Mary\AppData\Local\{E009F493-8601-42AF-8E48-F14921A7CAA7} 2013-08-02 11:26:50 -------- d-----w- C:\Users\Mary\AppData\Local\{1ED6FC48-63DC-40BC-BBDB-A7DCEF86AD42} 2013-08-02 05:01:23 -------- d-----w- C:\Program Files\HitmanPro 2013-08-02 05:00:41 -------- d-----w- C:\ProgramData\HitmanPro 2013-08-02 04:11:12 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll 2013-08-02 04:11:12 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll 2013-08-02 04:11:12 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll 2013-08-02 04:11:12 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll 2013-08-02 04:11:12 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll 2013-08-02 04:04:42 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll 2013-08-02 03:51:50 197264 ----a-w- C:\Windows\System32\drivers\HipShieldK.sys 2013-08-02 03:51:09 -------- d-----w- C:\Program Files (x86)\McAfee.com 2013-08-02 03:49:57 -------- d-----w- C:\Program Files\McAfee.com 2013-08-02 03:49:57 -------- d-----w- C:\Program Files\McAfee 2013-08-02 03:44:07 182752 ----a-w- C:\Windows\System32\mfevtps.exe 2013-08-02 00:22:24 -------- d-----w- C:\mfe 2013-08-01 23:15:00 -------- d-----w- C:\Program Files\stinger 2013-08-01 11:31:08 -------- d-----w- C:\Users\Mary\AppData\Local\{697DF7B7-5699-473B-A7E7-5F2E2EE19CDC} 2013-07-31 23:30:57 -------- d-----w- C:\Users\Mary\AppData\Local\{A4A72CE0-8485-43B3-94A8-82AE68BBC8A7} 2013-07-31 01:33:16 -------- d-----w- C:\Users\Mary\AppData\Local\{3B433F84-906C-4CAD-BF3C-78D147E0AA68} 2013-07-29 22:32:54 -------- d-----w- C:\Users\Mary\AppData\Local\{36B5B97C-E55B-43DE-9AD3-8EA8E4955D8C} 2013-07-29 10:32:30 -------- d-----w- C:\Users\Mary\AppData\Local\{6D3A18DE-2BC6-49F4-8C2B-9FE002AB9A82} 2013-07-28 22:32:19 -------- d-----w- C:\Users\Mary\AppData\Local\{94E236F2-7028-4F0A-8CC1-95015707C9A3} 2013-07-28 10:32:08 -------- d-----w- C:\Users\Mary\AppData\Local\{4A3379E6-3CF0-4CFB-AFFA-1DF0AC280EF8} 2013-07-27 22:31:57 -------- d-----w- C:\Users\Mary\AppData\Local\{967B64F0-27A9-4F77-8091-D95D76260548} . ==================== Find3M ==================== . 2013-08-21 13:02:25 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl 2013-08-21 13:02:25 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe 2013-08-02 04:04:35 867240 ----a-w- C:\Windows\SysWow64\npdeployJava1.dll 2013-08-02 04:04:35 789416 ----a-w- C:\Windows\SysWow64\deployJava1.dll 2013-07-31 20:21:18 0 ----a-w- C:\Windows\System32\OxpsConverter.exe 2013-07-26 05:13:37 2241024 ----a-w- C:\Windows\System32\wininet.dll 2013-07-26 05:12:08 3958784 ----a-w- C:\Windows\System32\jscript9.dll 2013-07-26 05:12:04 136704 ----a-w- C:\Windows\System32\iesysprep.dll 2013-07-26 05:12:03 67072 ----a-w- C:\Windows\System32\iesetup.dll 2013-07-26 03:35:08 2706432 ----a-w- C:\Windows\System32\mshtml.tlb 2013-07-26 03:13:24 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll 2013-07-26 03:12:04 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll 2013-07-26 03:12:00 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll 2013-07-26 03:12:00 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll 2013-07-26 02:49:14 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb 2013-07-26 02:39:38 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe 2013-07-26 01:59:38 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe 2013-07-25 09:25:54 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL 2013-07-25 08:57:27 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL 2013-07-09 06:03:30 5550528 ----a-w- C:\Windows\System32\ntoskrnl.exe 2013-07-09 05:54:22 1732032 ----a-w- C:\Windows\System32\ntdll.dll 2013-07-09 05:53:12 243712 ----a-w- C:\Windows\System32\wow64.dll 2013-07-09 05:51:16 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll 2013-07-09 05:03:34 3968960 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe 2013-07-09 05:03:34 3913664 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe 2013-07-09 04:53:47 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll 2013-07-09 04:52:33 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll 2013-07-09 04:52:33 5120 ----a-w- C:\Windows\SysWow64\wow32.dll 2013-07-09 04:45:07 44032 ----a-w- C:\Windows\apppatch\acwow64.dll 2013-07-09 02:49:42 25600 ----a-w- C:\Windows\SysWow64\setup16.exe 2013-07-09 02:49:41 7680 ----a-w- C:\Windows\SysWow64\instnm.exe 2013-07-09 02:49:39 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll 2013-07-09 02:49:38 2048 ----a-w- C:\Windows\SysWow64\user.exe 2013-07-06 06:03:53 1910208 ----a-w- C:\Windows\System32\drivers\tcpip.sys 2013-06-25 07:03:47 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2013-06-15 04:32:16 39936 ----a-w- C:\Windows\System32\drivers\tssecsrv.sys 2013-06-05 03:34:27 3153920 ----a-w- C:\Windows\System32\win32k.sys 2013-06-04 06:00:13 624128 ----a-w- C:\Windows\System32\qedit.dll 2013-06-04 04:53:07 509440 ----a-w- C:\Windows\SysWow64\qedit.dll . ============= FINISH: 16:31:00.96 =============== attach.txt: . UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG. IF REQUESTED, ZIP IT UP & ATTACH IT . DDS (Ver_2012-11-20.01) . Microsoft Windows 7 Home Premium Boot Device: \Device\HarddiskVolume2 Install Date: 7/30/2011 2:44:31 PM System Uptime: 8/26/2013 4:02:23 PM (0 hours ago) . Motherboard: Dell Inc. | | 04GJJT Processor: AMD Athlon II X2 245 Processor | CPU 1 | 2900/200mhz . ==== Disk Partitions ========================= . C: is FIXED (NTFS) - 453 GiB total, 211.232 GiB free. D: is CDROM () E: is FIXED (NTFS) - 228 GiB total, 78.883 GiB free. F: is Removable G: is Removable H: is Removable I: is Removable J: is FIXED (FAT32) - 698 GiB total, 127.486 GiB free. K: is FIXED (NTFS) - 1863 GiB total, 1703.708 GiB free. . ==== Disabled Device Manager Items ============= . ==== System Restore Points =================== . RP212: 8/11/2013 3:00:18 AM - Windows Backup RP213: 8/15/2013 3:00:21 AM - Windows Update RP214: 8/18/2013 3:00:11 AM - Windows Backup RP215: 8/25/2013 3:00:08 AM - Windows Backup RP216: 8/26/2013 1:26:51 PM - Malwarebytes Anti-Rootkit Restore Point . ==== Installed Programs ====================== . Update for Microsoft Office 2007 (KB2508958) Adobe AIR Adobe Flash Player 11 ActiveX Adobe Flash Player 11 Plugin Adobe Reader XI (11.0.03) Apple Application Support Apple Mobile Device Support Apple Software Update Ask Toolbar Ask Toolbar Updater Belkin Network USB Hub Control Center Best Buy pc app Bing Bar Bing Bar Platform Bing Rewards Client Installer Bonjour Canon MP Navigator EX 2.0 Catalyst Control Center - Branding Catalyst Control Center Core Implementation Catalyst Control Center Graphics Full Existing Catalyst Control Center Graphics Full New Catalyst Control Center Graphics Light Catalyst Control Center Graphics Previews Common Catalyst Control Center Graphics Previews Vista Catalyst Control Center InstallProxy Catalyst Control Center Localization All ccc-core-static ccc-utility64 CCC Help Chinese Standard CCC Help Chinese Traditional CCC Help Czech CCC Help Danish CCC Help Dutch CCC Help English CCC Help Finnish CCC Help French CCC Help German CCC Help Greek CCC Help Hungarian CCC Help Italian CCC Help Japanese CCC Help Korean CCC Help Norwegian CCC Help Polish CCC Help Portuguese CCC Help Russian CCC Help Spanish CCC Help Swedish CCC Help Thai CCC Help Turkish Compatibility Pack for the 2007 Office system D3DX10 Dell DataSafe Local Backup Dell DataSafe Local Backup - Support Software Dell Edoc Viewer Dell Getting Started Guide Dell MusicStage Dell PhotoStage Dell Stage Dell Support Center Dell VideoStage DirectX 9 Runtime Garmin ANT Agent Garmin Communicator Plugin Garmin Communicator Plugin x64 Garmin Training Center Garmin Training Center v5 Garmin USB Drivers Google Chrome Google Talk (remove only) Google Toolbar for Internet Explorer Google Update Helper iCloud iTunes Java 7 Update 25 Java Auto Updater Java 6 Update 24 (64-bit) Junk Mail filter update Malwarebytes Anti-Malware version 1.75.0.1300 McAfee Security Scan Plus McAfee SecurityCenter McAfee Virtual Technician Mesh Runtime Microsoft .NET Framework 4 Client Profile Microsoft Application Error Reporting Microsoft Default Manager Microsoft IntelliType Pro 8.1 Microsoft Office 2007 Service Pack 3 (SP3) Microsoft Office 2010 Microsoft Office Excel MUI (English) 2007 Microsoft Office File Validation Add-In Microsoft Office Home and Student 2007 Microsoft Office Office 64-bit Components 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) Microsoft Office Shared 64-bit MUI (English) 2007 Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Word MUI (English) 2007 Microsoft Search Enhancement Pack Microsoft Silverlight Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft Visual C++ 2005 Redistributable Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Mozilla Firefox 23.0.1 (x86 en-US) Mozilla Maintenance Service MSVCRT MSVCRT_amd64 MSXML 4.0 SP2 (KB954430) MSXML 4.0 SP2 (KB973688) PhotoShowExpress QuickTime RBVirtualFolder64Inst Realtek High Definition Audio Driver Roxio Activation Module Roxio BackOnTrack Roxio Burn Roxio Creator Starter Roxio Express Labeler 3 Roxio File Backup Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663) Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636) Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078) Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121) Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2) Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405) Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827) Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449) Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019) Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595) Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642) Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576) Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628) Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2) Security Update for Microsoft Office 2007 suites (KB2596615) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687309) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2687311) 32-Bit Edition Security Update for Microsoft Office 2007 suites (KB2760416) 32-Bit Edition Security Update for Microsoft Office Excel 2007 (KB2687307) 32-Bit Edition Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition Security Update for Microsoft Office Word 2007 (KB2760421) 32-Bit Edition Shared C Run-time for x64 Shutterfly Express Uploader Skins Skype Toolbars Skype™ 5.10 Sonic CinePlayer Decoder Pack TomTom HOME 2.8.4.2596 TomTom HOME Visual Studio Merge Modules Type to Learn 4 1.21 Unity Web Player Update for 2007 Microsoft Office System (KB967642) Update for Microsoft .NET Framework 4 Client Profile (KB2468871) Update for Microsoft .NET Framework 4 Client Profile (KB2533523) Update for Microsoft .NET Framework 4 Client Profile (KB2600217) Update for Microsoft .NET Framework 4 Client Profile (KB2836939) Update for Microsoft Office 2007 Help for Common Features (KB963673) Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition Update for Microsoft Office Excel 2007 Help (KB963678) Update for Microsoft Office OneNote 2007 Help (KB963670) Update for Microsoft Office Powerpoint 2007 Help (KB963669) Update for Microsoft Office Script Editor Help (KB963671) Update for Microsoft Office Word 2007 Help (KB963665) VoiceOver Kit Windows Driver Package - Dynastream Innovations (libusb0) LibUsbDevices (07/07/2009 1.12.2) Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0) Windows Live Communications Platform Windows Live Essentials Windows Live ID Sign-in Assistant Windows Live Installer Windows Live Language Selector Windows Live Mail Windows Live Mesh Windows Live Mesh ActiveX Control for Remote Connections Windows Live Messenger Windows Live MIME IFilter Windows Live Movie Maker Windows Live Photo Common Windows Live Photo Gallery Windows Live PIMT Platform Windows Live Remote Client Windows Live Remote Client Resources Windows Live Remote Service Windows Live Remote Service Resources Windows Live SOXE Windows Live SOXE Definitions Windows Live UX Platform Windows Live UX Platform Language Pack Windows Live Writer Windows Live Writer Resources . ==== Event Viewer Messages From Past Week ======== . 8/26/2013 4:11:17 PM, Error: mbamchameleon [61440] - 8/26/2013 4:03:19 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004 8/25/2013 2:12:33 PM, Error: Service Control Manager [7023] - The Windows Defender service terminated with the following error: The specified module could not be found. 8/25/2013 1:24:48 PM, Error: Service Control Manager [7034] - The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s). . ==== End Of File ===========================