whitey

Results of screen317's Security Check version 0.99.72 Windows 7 Service Pack 1 x64 (UAC is disabled!) Internet Explorer 10 ``````````````Antivirus/Firewall Check:`````````````` Windows Firewall Enabled! Microsoft Security Essentials Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware version 1.75.0.1300 Adobe Flash Player 10 Flash Player out of Date! Adobe Flash Player 11.8.800.94 Mozilla Firefox (23.0) ````````Process Check: objlist.exe by Laurent```````` Microsoft Security Essentials MSMpEng.exe Microsoft Security Essentials msseces.exe Malwarebytes Anti-Malware mbamservice.exe Malwarebytes Anti-Malware mbamgui.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: 0% ````````````````````End of Log``````````````````````

I think I'm good to go, unless you think there's any final scans I should run to confirm my computer is clean.

Hi Ron, After I ran the CHKDSK C: /R per your instructions and Dr.Web CureIt! My computer's start up time was a lot faster (2-3 minutes). I was able to access and delete the Firefox Profile files and folder I was having problems with. I can access the photo folder I was having problems with. I have installed Firefox v23 and have been running it without problem for the past 24 hours

SystemLook 30.07.11 by jpshortstuff Log created at 21:18 on 07/08/2013 by Chris Administrator - Elevation successful ========== folderfind ========== Searching for "*mozilla*" C:\Program Files (x86)\Mozilla Firefox d------ [04:45 07/08/2013] C:\Program Files (x86)\Mozilla Maintenance Service d------ [15:24 06/08/2013] C:\ProgramData\Mozilla d------ [23:02 09/05/2012] C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\Mozilla Firefox d------ [14:18 26/06/2013] C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\Mozilla Maintenance Service d------ [23:02 09/05/2012] C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\Mozilla Thunderbird d------ [23:45 10/06/2013] C:\System Volume Information\SystemRestore\FRStaging\Users\Chris\AppData\Local\Mozilla d------ [16:17 08/03/2012] C:\System Volume Information\SystemRestore\FRStaging\Users\Chris\AppData\Roaming\Mozilla d------ [16:17 08/03/2012] C:\Users\All Users\Mozilla d------ [23:02 09/05/2012] C:\Users\Chris\AppData\Local\Mozilla d------ [16:17 08/03/2012] C:\Users\Chris\AppData\Local\Mozilla\Firefox\Mozilla Firefox d------ [04:45 07/08/2013] C:\Users\Chris\AppData\Local\Temp\mozilla-temp-files d------ [20:03 07/08/2013] C:\Users\Chris\AppData\Roaming\Mozilla d------ [16:17 08/03/2012] Searching for "*firefox*" C:\Program Files (x86)\Mozilla Firefox d------ [04:45 07/08/2013] C:\System Volume Information\SystemRestore\FRStaging\Program Files (x86)\Mozilla Firefox d------ [14:18 26/06/2013] C:\System Volume Information\SystemRestore\FRStaging\Users\Chris\AppData\Local\Mozilla\Firefox d------ [16:17 08/03/2012] C:\System Volume Information\SystemRestore\FRStaging\Users\Chris\AppData\Roaming\Mozilla\Firefox d------ [16:17 08/03/2012] C:\System Volume Information\SystemRestore\FRStaging\Users\Chris\Desktop\Old Firefox Data d------ [18:14 02/07/2013] C:\System Volume Information\SystemRestore\FRStaging\Users\Chris\Desktop\Old Firefox Data-1 d------ [21:45 06/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_156daa843ecb2f895484ef69d6dc9cf4c09fb52d_129ade8b d----c- [22:56 26/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_17c1551494ba2e6b8e820f5524ec3dd1832b683_2a845609 d----c- [21:56 28/06/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_3092876b5fa470b04526853c79fc3e6fa8fe694_07fc31de d----c- [22:48 02/11/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_33c3a5c0f361e1bd452323a376a33d992c9b8_4f548edc d----c- [17:32 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_33c3a5c0f361e1bd452323a376a33d992c9b8_51a94ccd d----c- [17:33 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_33c3a5c0f361e1bd452323a376a33d992c9b8_55fdfc7c d----c- [17:34 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_33c3a5c0f361e1bd452323a376a33d992c9b8_5d8a7802 d----c- [17:34 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_33c3a5c0f361e1bd452323a376a33d992c9b8_74037489 d----c- [17:36 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_33c3a5c0f361e1bd452323a376a33d992c9b8_77574b28 d----c- [17:31 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_38c990199b58ee5f74588fa9ec6a45434f5ca3c_0c1fa6e2 d----c- [23:30 19/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_3bb1af553bd23e0d6c6f9466731c689c151baa_443d805c d----c- [21:41 06/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_4242d2724db76790cb2d149dbd253789c5343c14_016ec32f d----c- [04:19 12/06/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_42f0f2dc46deb99fae6e167151af3b223adced_27f12409 d----c- [14:31 28/06/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_477ef4d040903562e5604556994fb4d4ea3a8_462d984e d----c- [17:34 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_47aaae9952b118fdac6381ae1179e3abb31bdc4f_44a0e971 d----c- [20:00 01/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_4f80164ec0dbf427dd17447be4a64cce7c47c7a_51d34ca2 d----c- [23:02 09/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_54c2ea94548526abde9edde43d4d7a4142979_163ce696 d----c- [18:22 30/07/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_5b4a884ccebf2e1d62ca336c544a35b416f43a8_07897272 d----c- [18:16 30/07/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_747ef90afd9862d448d09ec35ff19443f256_1e914d6b d----c- [05:56 27/02/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_7cbbe8b584163a1e3851d040d392c8526838756_0e063cd6 d----c- [22:54 02/11/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_8ea8d3ee86e41d78abd364bed227dae09a7ccb_16fed844 d----c- [21:31 10/04/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_9da65eca2ba9e7ceada0b0bf5629e6883759987_77de3577 d----c- [21:42 06/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_b999b5325ab444fd6c41d4ef38d866e8c3426b37_1911fe7b d----c- [00:52 27/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_c3717fecc3d20ef69bd9119c460cf46e2a326d_05bc4985 d----c- [02:02 29/11/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_d0d7eef653117f4982a98f997ef6db9b75a5a8_116f3e77 d----c- [00:44 27/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_d0e39d2829d22dda18f4639260dbdb7e6df3efaa_0f3a4e9f d----c- [03:39 01/08/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_d27da9fdfddce35ad55b3229419c3082556920f6_5c880d5e d----c- [17:32 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_d27da9fdfddce35ad55b3229419c3082556920f6_753fa2f8 d----c- [17:31 02/07/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_dd986fb9a87cfe6bd07166a4163343d967f482_5d186e5c d----c- [14:36 13/06/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_e4f6927ac06286fb5ce7b2fa57dc3e9a7324da6_1299001f d----c- [23:18 02/11/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_e84baea3168dfbcea565cdb409f2425fa3f744e_16151188 d----c- [18:42 07/05/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_f456225b72b6a97898d81d7334e4fcc2a8af492_1eff9994 d----c- [00:40 04/01/2013] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_f66a20f7758ed4a4f5139f2ea961744ede6b8113_0428ae77 d----c- [21:20 13/03/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_f66a20f7758ed4a4f5139f2ea961744ede6b8113_072d334f d----c- [13:50 13/03/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_f66a20f7758ed4a4f5139f2ea961744ede6b8113_0b392676 d----c- [16:25 16/03/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_f66a20f7758ed4a4f5139f2ea961744ede6b8113_0f5db5e8 d----c- [23:10 13/03/2012] C:\Users\Chris\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppHang_firefox.exe_f66a20f7758ed4a4f5139f2ea961744ede6b8113_11bafca6 d----c- [21:03 13/03/2012] C:\Users\Chris\AppData\Local\Mozilla\Firefox d------ [16:17 08/03/2012] C:\Users\Chris\AppData\Local\Mozilla\Firefox\Mozilla Firefox d------ [04:45 07/08/2013] C:\Users\Chris\AppData\Roaming\Mozilla\Firefox d------ [16:17 08/03/2012] C:\Users\Chris\Desktop\Old Firefox Data d------ [18:14 02/07/2013] C:\Users\Chris\Desktop\Old Firefox Data-1 d------ [21:45 06/07/2013] -= EOF =-

Directory of C:\Users\Chris 03/07/2012 04:56 PM <JUNCTION> Application Data [C:\Users\Chris\AppData\Roaming] 03/07/2012 04:56 PM <JUNCTION> Cookies [C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Cookies] 03/07/2012 04:56 PM <JUNCTION> Local Settings [C:\Users\Chris\AppData\Local] 03/07/2012 04:56 PM <JUNCTION> My Documents [C:\Users\Chris\Documents] 03/07/2012 04:56 PM <JUNCTION> NetHood [C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Network Shortcuts] 03/07/2012 04:56 PM <JUNCTION> PrintHood [C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Printer Shortcuts] 03/07/2012 04:56 PM <JUNCTION> Recent [C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Recent] 03/07/2012 04:56 PM <JUNCTION> SendTo [C:\Users\Chris\AppData\Roaming\Microsoft\Windows\SendTo] 03/07/2012 04:56 PM <JUNCTION> Start Menu [C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu] 03/07/2012 04:56 PM <JUNCTION> Templates [C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Templates] 0 File(s) 0 bytes Directory of C:\Users\Chris\AppData\Local 03/07/2012 04:56 PM <JUNCTION> Application Data [C:\Users\Chris\AppData\Local] 03/07/2012 04:56 PM <JUNCTION> History [C:\Users\Chris\AppData\Local\Microsoft\Windows\History] 03/07/2012 04:56 PM <JUNCTION> Temporary Internet Files [C:\Users\Chris\AppData\Local\Microsoft\Windows\Temporary Internet Files] 0 File(s) 0 bytes Directory of C:\Users\Chris\Documents 03/07/2012 04:56 PM <JUNCTION> My Music [C:\Users\Chris\Music] 03/07/2012 04:56 PM <JUNCTION> My Pictures [C:\Users\Chris\Pictures] 03/07/2012 04:56 PM <JUNCTION> My Videos [C:\Users\Chris\Videos] 0 File(s) 0 bytes Directory of C:\Users\Default 07/13/2009 10:08 PM <JUNCTION> Application Data [C:\Users\Default\AppData\Roaming] 07/13/2009 10:08 PM <JUNCTION> Local Settings [C:\Users\Default\AppData\Local] 07/13/2009 10:08 PM <JUNCTION> My Documents [C:\Users\Default\Documents] 07/13/2009 10:08 PM <JUNCTION> NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts] 07/13/2009 10:08 PM <JUNCTION> PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts] 07/13/2009 10:08 PM <JUNCTION> Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent] 07/13/2009 10:08 PM <JUNCTION> SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo] 07/13/2009 10:08 PM <JUNCTION> Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu] 07/13/2009 10:08 PM <JUNCTION> Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates] 0 File(s) 0 bytes Directory of C:\Users\Default\AppData\Local 07/13/2009 10:08 PM <JUNCTION> Application Data [C:\Users\Default\AppData\Local] 07/13/2009 10:08 PM <JUNCTION> History [C:\Users\Default\AppData\Local\Microsoft\Windows\History] 07/13/2009 10:08 PM <JUNCTION> Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files] 0 File(s) 0 bytes Directory of C:\Users\Default\Documents 07/13/2009 10:08 PM <JUNCTION> My Music [C:\Users\Default\Music] 07/13/2009 10:08 PM <JUNCTION> My Pictures [C:\Users\Default\Pictures] 07/13/2009 10:08 PM <JUNCTION> My Videos [C:\Users\Default\Videos] 0 File(s) 0 bytes Directory of C:\Users\Public\Documents 07/13/2009 10:08 PM <JUNCTION> My Music [C:\Users\Public\Music] 07/13/2009 10:08 PM <JUNCTION> My Pictures [C:\Users\Public\Pictures] 07/13/2009 10:08 PM <JUNCTION> My Videos [C:\Users\Public\Videos] 0 File(s) 0 bytes Total Files Listed: 0 File(s) 0 bytes 49 Dir(s) 655,723,692,032 bytes free

Hi Ron, I ran the CHKDSK C: /R per your instructions. I did the Dr.Web CureIt! and no infections were found but I was not offered a Open Report link so ran the scan again and again no Open Report link was offered so I cannot attach the Cureit.log Please advise if you want me to do something else to get the log.

My computer takes 8-12 minutes to start-up from the log on screen. The original problem still exists. I cannot delete my Firefox profile folder even though I have completely uninstalled Firefox. When I open the profile folder, or right click on it, or try to delete it windows explorer freezes and I have to run task manager to kill the program. Additionally, I still am having this problem and explorer freezes when I try to open it: When I backed it up there was one folder that was stubborn and reacted the same way my Firefox profile folder did. I was able to back up about half the photos from that individual folder but the other half kept freezing windows explorer when it reached a particular photo in the photo, so I was unable to back-up the photo's in the numerical sequence after that. Sometimes I get "error 0x8007045D" when trying to delete, copy or access these folders. Before I contacted you, I tried restoring to a previous restore point & none of my restore points worked. Everytime when windows would restart I would get the message the restore point failed.

I uninstalled Java and the MSE icon re-appeared.

The icon for Microsoft Security Essentials has disappeared from the system tray (in the lower right corner.) This just happened this weekend after taking the steps you had me take. The MSE icon was always in the tray up until this weekend. I confirmed MSE is still running but the icon is gone. Was this a change you made?

I really appreciate all your time and help, Ron. Please see attached. attach.txt dds.txt

Sorry. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-08-2013 Ran by Chris at 2013-08-03 21:59:23 Run:1 Running from C:\Users\Chris\Desktop Boot Mode: Normal ============================================== HKLM\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\\ => Value deleted successfully. HKLM\System\CurrentControlSet\Control\Session Manager\\BootExecute => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully. HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully. HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} => Key not found. HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} => Key deleted successfully. HKCR\CLSID\{{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} => Key not found. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully. HKCR\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} => Key deleted successfully. HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully. HKCR\Wow6432Node\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9} => Key deleted successfully. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Value deleted successfully. HKCR\CLSID\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} => Key not found. HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully. HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found. ==== End of Fixlog ====

HKLM-x32\...\Run: [] - [x] BootExecute: autocheck autochk * sdnclean64.exe SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-08-2013 Ran by Chris (administrator) on 03-08-2013 07:03:52 Running from C:\Users\Chris\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) Internet Explorer Version 10 Boot Mode: Normal ==================== Processes (Whitelisted) ================= (Microsoft Corporation) C:\windows\system32\WLANExt.exe (SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE (Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe (Cincinnati Fan) C:\Program Files (x86)\Cincinnati Fan\FanQuote\CinFanUpdaterService.exe (Intel® Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe (Intuit) C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe (TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TOSHIBA Corporation) C:\windows\system32\ThpSrv.exe (TOSHIBA Corporation) C:\windows\system32\TODDSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe (Intel® Corporation) C:\Program Files\Intel\WiMAX\Bin\AppSrv.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Red Bend Ltd.) C:\Program Files\Intel\WiMAX\Bin\DMAgent.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\TecoService.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\widimon\widimon.exe (Intel Corporation) C:\windows\system32\igfxext.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (TOSHIBA Corporation) C:\Windows\System32\ThpSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TECO\Teco.exe (Intel® Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe (Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe (TOSHIBA CORPORATION) C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe (Adobe Systems Inc.) C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\acrotray.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe () C:\Program Files\TOSHIBA\FlashCards\Hotkey\TcrdKBB.exe (TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\ToshibaServiceStation.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe (TOSHIBA Corporation) C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe (Acresso Software Inc.) C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe (Intel Corporation) C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe (Microsoft Corporation) c:\Program Files\Microsoft Security Client\NisSrv.exe (Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) C:\windows\System32\MsSpellCheckingFacility.exe () C:\Users\Chris\Desktop\SystemLook_x64.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [TPwrMain] - C:\Program Files\TOSHIBA\Power Saver\TPwrMain.EXE [590256 2011-05-17] (TOSHIBA Corporation) HKLM\...\Run: [HSON] - C:\Program Files\TOSHIBA\TBS\HSON.exe [296824 2010-09-25] (TOSHIBA Corporation) HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe [972672 2011-04-27] (TOSHIBA Corporation) HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11775592 2011-01-26] (Realtek Semiconductor) HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2188904 2011-01-18] (Realtek Semiconductor) HKLM\...\Run: [synTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2679592 2011-02-03] (Synaptics Incorporated) HKLM\...\Run: [ThpSrv] - C:\windows\system32\thpsrv /logon [x] HKLM\...\Run: [Teco] - C:\Program Files\TOSHIBA\TECO\Teco.exe [1544624 2011-05-24] (TOSHIBA Corporation) HKLM\...\Run: [intelPAN] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-06-01] (Intel® Corporation) HKLM\...\Run: [TosSENotify] - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe [710560 2011-06-09] (TOSHIBA Corporation) HKLM\...\Run: [TosVolRegulator] - C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe [24376 2009-11-11] (TOSHIBA Corporation) HKLM\...\Run: [TosReelTimeMonitor] - C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [38824 2011-06-28] (TOSHIBA Corporation) HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [1356240 2013-06-20] (Microsoft Corporation) HKLM-x32\...\Run: [sVPWUTIL] - C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe [532480 2010-11-09] (TOSHIBA CORPORATION) HKLM-x32\...\Run: [HWSetup] - C:\Program Files\TOSHIBA\Utilities\HWSetup.exe [423936 2011-03-10] (TOSHIBA Electronics, Inc.) HKLM-x32\...\Run: [KeNotify] - C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe [34160 2010-08-16] (TOSHIBA CORPORATION) HKLM-x32\...\Run: [Acrobat Assistant 8.0] - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [624056 2011-08-30] (Adobe Systems Inc.) HKLM-x32\...\Run: [] - [x] HKLM-x32\...\Run: [DelayTSS] - C:\Program Files\Toshiba\DelayTSS\DelayTSS.exe [2153328 2011-11-21] () HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-05-11] (Adobe Systems Incorporated) BootExecute: autocheck autochk * sdnclean64.exe ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM - DefaultScope value is missing. SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKCU - {{67A2568C-7A0A-4EED-AECC-B5405DE63B64}} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation) BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\x64\TOSHIBAMediaControllerIE.dll (<TOSHIBA>) BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO-x32: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll (<TOSHIBA>) Toolbar: HKLM-x32 - Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) Toolbar: HKCU - No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - No File Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - No File Handler-x32: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files (x86)\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll (Intuit, Inc.) Handler-x32: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - C:\Windows\\SysWOW64\mscoree.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 FireFox: ======== FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll () FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF Plugin-x32: @java.com/DTPlugin,version=10.25.2 - C:\windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\Chris\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online) ==================== Services (Whitelisted) ================= R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [143120 2013-05-23] (SUPERAntiSpyware.com) R2 CinFanUpdater; C:\Program Files (x86)\Cincinnati Fan\FanQuote\CinFanUpdaterService.exe [15872 2011-10-31] (Cincinnati Fan) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2013-06-20] (Microsoft Corporation) S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-06-01] () R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [366600 2013-06-20] (Microsoft Corporation) R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.) ==================== Drivers (Whitelisted) ==================== R3 AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [138360 2012-05-01] (SlySoft, Inc.) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [247216 2013-06-18] (Microsoft Corporation) R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [139616 2013-06-18] (Microsoft Corporation) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com) S3 catchme; \??\C:\ComboFix\catchme.sys [x] ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2013-08-02 22:25 - 2013-08-02 22:28 - 00000432 _____ C:\Users\Chris\Desktop\SystemLook.txt 2013-08-02 22:25 - 2013-08-02 22:25 - 00165376 _____ C:\Users\Chris\Desktop\SystemLook_x64.exe 2013-08-02 19:16 - 2013-07-31 20:43 - 00000000 ____D C:\Users\Chris\Documents\zkgg0xyt.default-1373147129970 2013-08-01 23:17 - 2013-08-01 23:17 - 02240864 _____ (Kaspersky Lab ZAO) C:\Users\Chris\Desktop\tdsskiller.exe 2013-08-01 22:45 - 2013-08-01 22:45 - 00019866 _____ C:\ComboFix.txt 2013-08-01 22:30 - 2011-06-25 23:45 - 00256000 _____ C:\windows\PEV.exe 2013-08-01 22:30 - 2010-11-07 10:20 - 00208896 _____ C:\windows\MBR.exe 2013-08-01 22:30 - 2009-04-19 21:56 - 00060416 _____ (NirSoft) C:\windows\NIRCMD.exe 2013-08-01 22:30 - 2000-08-30 17:00 - 00518144 _____ (SteelWerX) C:\windows\SWREG.exe 2013-08-01 22:30 - 2000-08-30 17:00 - 00406528 _____ (SteelWerX) C:\windows\SWSC.exe 2013-08-01 22:30 - 2000-08-30 17:00 - 00098816 _____ C:\windows\sed.exe 2013-08-01 22:30 - 2000-08-30 17:00 - 00080412 _____ C:\windows\grep.exe 2013-08-01 22:30 - 2000-08-30 17:00 - 00068096 _____ C:\windows\zip.exe 2013-08-01 22:24 - 2013-08-01 22:24 - 00000000 ____D C:\Users\Chris\Documents\ProcAlyzer Dumps 2013-08-01 22:18 - 2013-08-01 22:45 - 00000000 ____D C:\Qoobox 2013-08-01 22:18 - 2013-08-01 22:43 - 00000000 ____D C:\windows\erdnt 2013-08-01 22:00 - 2013-08-01 22:00 - 05097176 ____R (Swearware) C:\Users\Chris\Desktop\ComboFix.exe 2013-08-01 15:19 - 2013-08-01 15:20 - 01781485 _____ (Farbar) C:\Users\Chris\Desktop\FRST64.exe 2013-08-01 15:15 - 2013-08-01 15:15 - 00000256 _____ C:\Users\Chris\Desktop\ESET online scanner - list of threats.txt 2013-08-01 13:27 - 2013-08-01 13:27 - 00000862 _____ C:\AdwCleaner[s2].txt 2013-08-01 13:17 - 2013-08-01 13:17 - 00003414 _____ C:\Users\Chris\Desktop\JRT.txt 2013-08-01 13:13 - 2013-08-01 13:13 - 00000000 ____D C:\windows\ERUNT 2013-08-01 13:06 - 2013-08-01 13:06 - 00562430 _____ (Oleg N. Scherbakov) C:\Users\Chris\Desktop\JRT.exe 2013-08-01 11:53 - 2013-08-01 13:01 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-08-01 11:51 - 2013-08-01 11:51 - 00000000 ____D C:\Users\Chris\Desktop\mbar-1.06.0.1004 2013-08-01 11:49 - 2013-08-01 11:49 - 13399154 _____ C:\Users\Chris\Desktop\mbar-1.06.0.1004.zip 2013-08-01 11:44 - 2013-08-01 11:44 - 00001847 _____ C:\Users\Chris\Desktop\RKreport[0]_S_08012013_114408.txt 2013-08-01 11:40 - 2013-08-01 11:44 - 00000000 ____D C:\Users\Chris\Desktop\RK_Quarantine 2013-08-01 11:40 - 2013-08-01 11:40 - 03782656 _____ C:\Users\Chris\Desktop\RogueKillerX64.exe 2013-08-01 11:34 - 2013-08-01 11:34 - 00000935 _____ C:\Users\Chris\Desktop\NTREGOPT.lnk 2013-08-01 11:34 - 2013-08-01 11:34 - 00000916 _____ C:\Users\Chris\Desktop\ERUNT.lnk 2013-08-01 11:34 - 2013-08-01 11:34 - 00000000 ____D C:\Program Files (x86)\ERUNT 2013-08-01 11:20 - 2013-08-01 11:20 - 00791393 _____ (Lars Hederer ) C:\Users\Chris\Desktop\erunt-setup.exe 2013-07-31 23:42 - 2013-07-31 23:42 - 00000325 _____ C:\AdwCleaner[s1].txt 2013-07-31 23:39 - 2013-07-31 23:39 - 00666633 _____ C:\Users\Chris\Desktop\AdwCleaner.exe 2013-07-31 23:39 - 2013-07-31 23:39 - 00000811 _____ C:\AdwCleaner[R1].txt 2013-07-31 22:56 - 2013-07-31 22:56 - 00688992 _____ (Swearware) C:\Users\Chris\Desktop\dds.scr 2013-07-31 22:56 - 2013-07-31 22:56 - 00688992 _____ (Swearware) C:\Users\Chris\Desktop\dds.com 2013-07-31 22:14 - 2013-07-31 22:14 - 00021796 _____ C:\Users\Chris\Desktop\Addition.txt 2013-07-31 22:13 - 2013-07-31 22:13 - 00000000 ____D C:\FRST 2013-07-31 21:04 - 2013-07-31 21:04 - 00001819 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk 2013-07-31 21:04 - 2013-07-31 21:04 - 00000000 ____D C:\Users\Chris\AppData\Roaming\SUPERAntiSpyware.com 2013-07-31 21:04 - 2013-07-31 21:04 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com 2013-07-31 21:04 - 2013-07-31 21:04 - 00000000 ____D C:\Program Files\SUPERAntiSpyware 2013-07-31 21:02 - 2013-07-31 21:04 - 26785808 _____ (SUPERAntiSpyware) C:\Users\Chris\Desktop\SUPERAntiSpyware.exe 2013-07-31 20:59 - 2013-07-31 21:04 - 00002383 _____ C:\Users\Chris\Desktop\FSS.txt 2013-07-31 20:58 - 2013-07-31 20:59 - 00357145 _____ (Farbar) C:\Users\Chris\Downloads\FSS.exe 2013-07-31 19:28 - 2013-08-01 22:28 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-07-31 19:28 - 2013-07-31 19:28 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking 2013-07-31 16:54 - 2013-07-31 16:55 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Chris\Desktop\spybotsd-2.1.21-SR2.exe 2013-07-31 16:48 - 2013-07-31 16:49 - 00000000 ____D C:\windows\system32\MRT 2013-07-31 16:40 - 2013-07-31 16:40 - 01402880 _____ C:\Users\Chris\Desktop\HiJackThis.msi 2013-07-31 16:40 - 2013-07-31 16:40 - 00002975 _____ C:\Users\Chris\Desktop\HiJackThis.lnk 2013-07-31 16:40 - 2013-07-31 16:40 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis 2013-07-31 16:40 - 2013-07-31 16:40 - 00000000 ____D C:\Program Files (x86)\Trend Micro 2013-07-31 16:31 - 2013-07-31 16:32 - 00891098 _____ C:\Users\Chris\Downloads\SecurityCheck.exe 2013-07-31 08:27 - 2013-07-31 08:27 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2013-07-29 16:33 - 2013-07-29 16:33 - 00000000 ____D C:\windows\pss 2013-07-27 07:40 - 2013-07-27 07:40 - 00000000 ____D C:\Users\Chris\Desktop\ProcessExplorer 2013-07-27 07:39 - 2013-07-27 07:39 - 01176629 _____ C:\Users\Chris\Desktop\ProcessExplorer.zip 2013-07-27 07:04 - 2013-06-24 00:57 - 78277128 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe 2013-07-26 18:10 - 2013-07-30 21:17 - 00007607 _____ C:\Users\Chris\AppData\Local\Resmon.ResmonCfg 2013-07-22 21:21 - 2012-05-11 13:34 - 00157472 _____ (Sun Microsystems, Inc.) C:\windows\SysWOW64\javaws.exe 2013-07-22 21:21 - 2012-05-11 13:34 - 00145184 _____ (Sun Microsystems, Inc.) C:\windows\SysWOW64\javaw.exe 2013-07-22 21:21 - 2012-05-11 13:34 - 00145184 _____ (Sun Microsystems, Inc.) C:\windows\SysWOW64\java.exe 2013-07-22 21:20 - 2013-07-22 21:20 - 00000000 ____D C:\ProgramData\McAfee 2013-07-22 21:19 - 2013-07-22 21:19 - 00903080 _____ (Oracle Corporation) C:\Users\Chris\Downloads\jxpiinstall(1).exe 2013-07-21 22:57 - 2013-07-21 22:57 - 01035696 _____ (Ask.com) C:\Users\Chris\Downloads\OffercastInstaller_AVR_U-0087-01-PlateauLines-0805-01-en_.exe 2013-07-21 19:09 - 2013-07-21 19:09 - 00000000 ____D C:\Users\Chris\Documents\QBBackupTemp Sun, Jul 21 2013 07 09 26 PM 2013-07-18 22:03 - 2013-07-18 22:03 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Malwarebytes 2013-07-18 22:03 - 2013-07-18 22:03 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-07-18 22:02 - 2013-07-26 16:47 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-18 22:02 - 2013-07-18 22:02 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Chris\Downloads\mbam-setup-1.75.0.1300.exe 2013-07-18 22:02 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\mbam.sys 2013-07-18 10:22 - 2013-07-18 10:22 - 01069944 _____ (Solid State Networks) C:\Users\Chris\Downloads\install_reader11_en_mssd_aaa_aih.exe 2013-07-12 15:57 - 2013-07-12 15:57 - 30360152 _____ C:\Users\Chris\Downloads\OJ4620_Basicx64_1315.exe 2013-07-12 15:57 - 2013-07-12 15:57 - 00000057 _____ C:\ProgramData\Ament.ini 2013-07-11 10:38 - 2013-07-11 10:38 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf 2013-07-11 06:50 - 2013-06-11 16:43 - 14329856 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll 2013-07-11 06:50 - 2013-06-11 16:43 - 02877440 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll 2013-07-11 06:50 - 2013-06-11 16:43 - 01767936 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll 2013-07-11 06:50 - 2013-06-11 16:43 - 01141248 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll 2013-07-11 06:50 - 2013-06-11 16:43 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll 2013-07-11 06:50 - 2013-06-11 16:43 - 00493056 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll 2013-07-11 06:50 - 2013-06-11 16:43 - 00039424 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll 2013-07-11 06:50 - 2013-06-11 16:42 - 13760512 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll 2013-07-11 06:50 - 2013-06-11 16:42 - 02046976 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll 2013-07-11 06:50 - 2013-06-11 16:42 - 00391168 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll 2013-07-11 06:50 - 2013-06-11 16:42 - 00109056 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesysprep.dll 2013-07-11 06:50 - 2013-06-11 16:42 - 00061440 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll 2013-07-11 06:50 - 2013-06-11 16:42 - 00033280 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll 2013-07-11 06:50 - 2013-06-11 16:26 - 02241024 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll 2013-07-11 06:50 - 2013-06-11 16:26 - 01365504 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll 2013-07-11 06:50 - 2013-06-11 16:26 - 00051712 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe 2013-07-11 06:50 - 2013-06-11 16:25 - 19238912 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 15404032 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 03958784 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 02648576 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 00855552 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 00603136 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 00526336 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 00136704 _____ (Microsoft Corporation) C:\windows\system32\iesysprep.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 00067072 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll 2013-07-11 06:50 - 2013-06-11 16:25 - 00039936 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll 2013-07-11 06:50 - 2013-06-11 15:51 - 00071680 _____ (Microsoft Corporation) C:\windows\SysWOW64\RegisterIEPKEYs.exe 2013-07-11 06:50 - 2013-06-11 15:50 - 00089600 _____ (Microsoft Corporation) C:\windows\system32\RegisterIEPKEYs.exe 2013-07-11 06:50 - 2013-06-06 20:22 - 02706432 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb 2013-07-11 06:50 - 2013-06-06 19:37 - 02706432 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb 2013-07-10 07:00 - 2013-06-04 20:34 - 03153920 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys 2013-07-10 07:00 - 2013-06-03 23:00 - 00624128 _____ (Microsoft Corporation) C:\windows\system32\qedit.dll 2013-07-10 07:00 - 2013-06-03 21:53 - 00509440 _____ (Microsoft Corporation) C:\windows\SysWOW64\qedit.dll 2013-07-10 07:00 - 2013-05-05 23:03 - 01887744 _____ (Microsoft Corporation) C:\windows\system32\WMVDECOD.DLL 2013-07-10 07:00 - 2013-05-05 21:56 - 01620480 _____ (Microsoft Corporation) C:\windows\SysWOW64\WMVDECOD.DLL 2013-07-10 07:00 - 2013-04-09 16:34 - 01247744 _____ (Microsoft Corporation) C:\windows\SysWOW64\DWrite.dll 2013-07-10 07:00 - 2013-04-02 15:51 - 01643520 _____ (Microsoft Corporation) C:\windows\system32\DWrite.dll 2013-07-09 16:48 - 2013-07-09 16:48 - 00260506 _____ C:\Users\Chris\Downloads\SSMauii Conversion XPRF Fan Quote.tiff 2013-07-07 15:16 - 2013-07-07 15:18 - 33397640 _____ (Amazon) C:\Users\Chris\Downloads\AmazonCloudPlayerInstaller332._V381017050_.exe 2013-07-06 14:45 - 2013-07-06 14:45 - 00000000 ____D C:\Users\Chris\Desktop\Old Firefox Data-1 2013-07-05 08:00 - 2013-07-05 08:00 - 00000000 _____ C:\Users\Chris\Sti_Trace.log 183 ==================== One Month Modified Files and Folders ======= 2013-08-02 22:48 - 2012-02-23 11:31 - 01242088 _____ C:\windows\WindowsUpdate.log 2013-08-02 22:28 - 2013-08-02 22:25 - 00000432 _____ C:\Users\Chris\Desktop\SystemLook.txt 2013-08-02 22:25 - 2013-08-02 22:25 - 00165376 _____ C:\Users\Chris\Desktop\SystemLook_x64.exe 2013-08-02 22:03 - 2009-07-13 21:45 - 00025120 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-08-02 22:03 - 2009-07-13 21:45 - 00025120 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-08-02 21:59 - 2009-07-13 22:13 - 00779266 _____ C:\windows\system32\PerfStringBackup.INI 2013-08-02 21:54 - 2009-07-13 22:08 - 00000006 ____H C:\windows\Tasks\SA.DAT 2013-08-02 21:54 - 2009-07-13 21:51 - 00096601 _____ C:\windows\setupact.log 2013-08-02 18:35 - 2012-03-08 12:39 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Cincinnati Fan 2013-08-02 18:21 - 2013-02-13 12:59 - 00011264 ___SH C:\Users\Chris\Documents\Thumbs.db 2013-08-02 18:17 - 2012-12-12 13:47 - 00000000 ____D C:\Users\Chris\Documents\Solberg 2013-08-02 17:00 - 2012-03-08 14:17 - 14225408 _____ C:\Users\Chris\Documents\Air Handling Equipment, Inc..QBW 2013-08-02 16:41 - 2012-03-08 14:17 - 00196608 _____ C:\Users\Chris\Documents\Air Handling Equipment, Inc..QBW.TLG 2013-08-02 10:40 - 2012-03-08 14:17 - 00000391 _____ C:\Users\Chris\Documents\Air Handling Equipment, Inc..QBW.ND 2013-08-02 09:33 - 2010-11-20 20:47 - 00417558 _____ C:\windows\PFRO.log 2013-08-01 23:17 - 2013-08-01 23:17 - 02240864 _____ (Kaspersky Lab ZAO) C:\Users\Chris\Desktop\tdsskiller.exe 2013-08-01 22:45 - 2013-08-01 22:45 - 00019866 _____ C:\ComboFix.txt 2013-08-01 22:45 - 2013-08-01 22:18 - 00000000 ____D C:\Qoobox 2013-08-01 22:43 - 2013-08-01 22:18 - 00000000 ____D C:\windows\erdnt 2013-08-01 22:43 - 2009-07-13 19:34 - 00000215 _____ C:\windows\system.ini 2013-08-01 22:41 - 2012-03-07 16:55 - 00000000 ____D C:\Users\Chris 2013-08-01 22:28 - 2013-07-31 19:28 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy 2013-08-01 22:24 - 2013-08-01 22:24 - 00000000 ____D C:\Users\Chris\Documents\ProcAlyzer Dumps 2013-08-01 22:00 - 2013-08-01 22:00 - 05097176 ____R (Swearware) C:\Users\Chris\Desktop\ComboFix.exe 2013-08-01 15:20 - 2013-08-01 15:19 - 01781485 _____ (Farbar) C:\Users\Chris\Desktop\FRST64.exe 2013-08-01 15:15 - 2013-08-01 15:15 - 00000256 _____ C:\Users\Chris\Desktop\ESET online scanner - list of threats.txt 2013-08-01 13:27 - 2013-08-01 13:27 - 00000862 _____ C:\AdwCleaner[s2].txt 2013-08-01 13:17 - 2013-08-01 13:17 - 00003414 _____ C:\Users\Chris\Desktop\JRT.txt 2013-08-01 13:13 - 2013-08-01 13:13 - 00000000 ____D C:\windows\ERUNT 2013-08-01 13:06 - 2013-08-01 13:06 - 00562430 _____ (Oleg N. Scherbakov) C:\Users\Chris\Desktop\JRT.exe 2013-08-01 13:01 - 2013-08-01 11:53 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2013-08-01 11:51 - 2013-08-01 11:51 - 00000000 ____D C:\Users\Chris\Desktop\mbar-1.06.0.1004 2013-08-01 11:49 - 2013-08-01 11:49 - 13399154 _____ C:\Users\Chris\Desktop\mbar-1.06.0.1004.zip 2013-08-01 11:44 - 2013-08-01 11:44 - 00001847 _____ C:\Users\Chris\Desktop\RKreport[0]_S_08012013_114408.txt 2013-08-01 11:44 - 2013-08-01 11:40 - 00000000 ____D C:\Users\Chris\Desktop\RK_Quarantine 2013-08-01 11:40 - 2013-08-01 11:40 - 03782656 _____ C:\Users\Chris\Desktop\RogueKillerX64.exe 2013-08-01 11:34 - 2013-08-01 11:34 - 00000935 _____ C:\Users\Chris\Desktop\NTREGOPT.lnk 2013-08-01 11:34 - 2013-08-01 11:34 - 00000916 _____ C:\Users\Chris\Desktop\ERUNT.lnk 2013-08-01 11:34 - 2013-08-01 11:34 - 00000000 ____D C:\Program Files (x86)\ERUNT 2013-08-01 11:20 - 2013-08-01 11:20 - 00791393 _____ (Lars Hederer ) C:\Users\Chris\Desktop\erunt-setup.exe 2013-07-31 23:42 - 2013-07-31 23:42 - 00000325 _____ C:\AdwCleaner[s1].txt 2013-07-31 23:39 - 2013-07-31 23:39 - 00666633 _____ C:\Users\Chris\Desktop\AdwCleaner.exe 2013-07-31 23:39 - 2013-07-31 23:39 - 00000811 _____ C:\AdwCleaner[R1].txt 2013-07-31 22:56 - 2013-07-31 22:56 - 00688992 _____ (Swearware) C:\Users\Chris\Desktop\dds.scr 2013-07-31 22:56 - 2013-07-31 22:56 - 00688992 _____ (Swearware) C:\Users\Chris\Desktop\dds.com 2013-07-31 22:14 - 2013-07-31 22:14 - 00021796 _____ C:\Users\Chris\Desktop\Addition.txt 2013-07-31 22:13 - 2013-07-31 22:13 - 00000000 ____D C:\FRST 2013-07-31 21:10 - 2012-03-07 17:26 - 00000000 ____D C:\Users\Chris\AppData\Local\Google 2013-07-31 21:10 - 2012-02-23 11:54 - 00000000 ____D C:\Program Files (x86)\Google 2013-07-31 21:04 - 2013-07-31 21:04 - 00001819 _____ C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk 2013-07-31 21:04 - 2013-07-31 21:04 - 00000000 ____D C:\Users\Chris\AppData\Roaming\SUPERAntiSpyware.com 2013-07-31 21:04 - 2013-07-31 21:04 - 00000000 ____D C:\ProgramData\SUPERAntiSpyware.com 2013-07-31 21:04 - 2013-07-31 21:04 - 00000000 ____D C:\Program Files\SUPERAntiSpyware 2013-07-31 21:04 - 2013-07-31 21:02 - 26785808 _____ (SUPERAntiSpyware) C:\Users\Chris\Desktop\SUPERAntiSpyware.exe 2013-07-31 21:04 - 2013-07-31 20:59 - 00002383 _____ C:\Users\Chris\Desktop\FSS.txt 2013-07-31 20:59 - 2013-07-31 20:58 - 00357145 _____ (Farbar) C:\Users\Chris\Downloads\FSS.exe 2013-07-31 20:43 - 2013-08-02 19:16 - 00000000 ____D C:\Users\Chris\Documents\zkgg0xyt.default-1373147129970 2013-07-31 20:43 - 2013-06-26 07:18 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-07-31 20:43 - 2012-03-08 09:17 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Mozilla 2013-07-31 19:28 - 2013-07-31 19:28 - 00000000 ____D C:\windows\System32\Tasks\Safer-Networking 2013-07-31 16:55 - 2013-07-31 16:54 - 37672592 _____ (Safer-Networking Ltd. ) C:\Users\Chris\Desktop\spybotsd-2.1.21-SR2.exe 2013-07-31 16:49 - 2013-07-31 16:48 - 00000000 ____D C:\windows\system32\MRT 2013-07-31 16:40 - 2013-07-31 16:40 - 01402880 _____ C:\Users\Chris\Desktop\HiJackThis.msi 2013-07-31 16:40 - 2013-07-31 16:40 - 00002975 _____ C:\Users\Chris\Desktop\HiJackThis.lnk 2013-07-31 16:40 - 2013-07-31 16:40 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis 2013-07-31 16:40 - 2013-07-31 16:40 - 00000000 ____D C:\Program Files (x86)\Trend Micro 2013-07-31 16:32 - 2013-07-31 16:31 - 00891098 _____ C:\Users\Chris\Downloads\SecurityCheck.exe 2013-07-31 08:27 - 2013-07-31 08:27 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Games 2013-07-30 21:17 - 2013-07-26 18:10 - 00007607 _____ C:\Users\Chris\AppData\Local\Resmon.ResmonCfg 2013-07-30 18:44 - 2012-10-05 14:53 - 00692104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe 2013-07-30 18:44 - 2012-03-07 17:11 - 00000000 ____D C:\Users\Chris\AppData\Local\Adobe 2013-07-30 18:44 - 2011-11-21 21:31 - 00071048 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-07-29 22:03 - 2009-07-13 20:20 - 00000000 ____D C:\windows\system32\NDF 2013-07-29 21:13 - 2012-07-17 18:32 - 00000125 ___SH C:\ProgramData\.zreglib 2013-07-29 20:19 - 2012-03-07 17:02 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Toshiba 2013-07-29 16:33 - 2013-07-29 16:33 - 00000000 ____D C:\windows\pss 2013-07-27 07:40 - 2013-07-27 07:40 - 00000000 ____D C:\Users\Chris\Desktop\ProcessExplorer 2013-07-27 07:39 - 2013-07-27 07:39 - 01176629 _____ C:\Users\Chris\Desktop\ProcessExplorer.zip 2013-07-26 18:20 - 2012-05-11 13:01 - 00000000 ____D C:\Program Files (x86)\Citrix 2013-07-26 17:48 - 2012-05-11 13:34 - 00000000 ____D C:\Program Files (x86)\Java 2013-07-26 17:15 - 2013-07-03 11:46 - 00000000 ____D C:\Users\Chris\AppData\Local\Citrix 2013-07-26 17:13 - 2012-06-25 06:57 - 00000000 ____D C:\Users\Chris\AppData\Local\ATT Connect 2013-07-26 17:11 - 2012-08-22 10:50 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Amazon 2013-07-26 17:11 - 2012-08-22 10:36 - 00000000 ____D C:\Program Files (x86)\Amazon 2013-07-26 16:49 - 2009-07-13 22:08 - 00032578 _____ C:\windows\Tasks\SCHEDLGU.TXT 2013-07-26 16:47 - 2013-07-18 22:02 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-07-26 16:47 - 2012-05-01 03:00 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client 2013-07-26 16:46 - 2013-07-02 11:14 - 00000000 ____D C:\Users\Chris\Desktop\Old Firefox Data 2013-07-26 16:46 - 2012-03-08 14:08 - 00000000 ____D C:\Users\Chris\AppData\Local\Intuit 2013-07-26 16:46 - 2012-03-08 13:23 - 00000000 ____D C:\ProgramData\FLEXnet 2013-07-26 16:46 - 2012-03-08 10:15 - 00000000 ____D C:\Program Files\Microsoft Security Client 2013-07-26 16:46 - 2012-03-08 09:04 - 00000000 ____D C:\ProgramData\Microsoft Help 2013-07-26 16:46 - 2012-03-07 16:59 - 00000000 ___RD C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2013-07-26 16:46 - 2012-03-07 16:59 - 00000000 ___RD C:\Users\Chris\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2013-07-26 16:46 - 2010-11-21 00:17 - 00000000 ____D C:\Program Files\Windows Journal 2013-07-26 16:46 - 2010-11-21 00:16 - 00000000 ___RD C:\Users\Public\Recorded TV 2013-07-26 16:46 - 2009-07-13 22:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-07-26 16:46 - 2009-07-13 22:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-07-26 16:46 - 2009-07-13 20:20 - 00000000 ____D C:\windows\AppCompat 2013-07-26 16:46 - 2009-07-13 20:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-07-26 16:45 - 2010-11-21 00:16 - 00000000 ____D C:\windows\ShellNew 2013-07-26 16:45 - 2009-07-13 20:20 - 00000000 ____D C:\windows\rescache 2013-07-26 16:45 - 2009-07-13 20:20 - 00000000 ____D C:\windows\L2Schemas 2013-07-26 16:43 - 2009-07-13 20:20 - 00000000 ____D C:\windows\registration 2013-07-26 15:18 - 2012-03-08 10:21 - 00001945 _____ C:\windows\epplauncher.mif 2013-07-25 07:45 - 2012-10-10 07:54 - 00000000 ____D C:\Users\Chris\Desktop\Mobile files need to be saved 2013-07-22 21:21 - 2012-05-09 15:43 - 00867240 _____ (Oracle Corporation) C:\windows\SysWOW64\npDeployJava1.dll 2013-07-22 21:21 - 2011-11-21 21:31 - 00789416 _____ (Oracle Corporation) C:\windows\SysWOW64\deployJava1.dll 2013-07-22 21:20 - 2013-07-22 21:20 - 00000000 ____D C:\ProgramData\McAfee 2013-07-22 21:19 - 2013-07-22 21:19 - 00903080 _____ (Oracle Corporation) C:\Users\Chris\Downloads\jxpiinstall(1).exe 2013-07-22 21:16 - 2011-11-21 21:31 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-07-21 22:57 - 2013-07-21 22:57 - 01035696 _____ (Ask.com) C:\Users\Chris\Downloads\OffercastInstaller_AVR_U-0087-01-PlateauLines-0805-01-en_.exe 2013-07-21 19:33 - 2012-03-08 12:35 - 00000000 ____D C:\Program Files (x86)\Cincinnati Fan 2013-07-21 19:09 - 2013-07-21 19:09 - 00000000 ____D C:\Users\Chris\Documents\QBBackupTemp Sun, Jul 21 2013 07 09 26 PM 2013-07-20 19:48 - 2012-03-13 20:33 - 00000000 ____D C:\Users\Chris\Documents\AHE Financial 2013-07-18 22:03 - 2013-07-18 22:03 - 00000000 ____D C:\Users\Chris\AppData\Roaming\Malwarebytes 2013-07-18 22:03 - 2013-07-18 22:03 - 00000000 ____D C:\ProgramData\Malwarebytes 2013-07-18 22:02 - 2013-07-18 22:02 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Chris\Downloads\mbam-setup-1.75.0.1300.exe 2013-07-18 10:22 - 2013-07-18 10:22 - 01069944 _____ (Solid State Networks) C:\Users\Chris\Downloads\install_reader11_en_mssd_aaa_aih.exe 2013-07-17 12:04 - 2012-12-12 23:39 - 00000000 ____D C:\ProgramData\HP 2013-07-17 12:04 - 2012-12-12 23:39 - 00000000 ____D C:\Program Files (x86)\HP 2013-07-17 12:04 - 2012-12-12 23:38 - 00000000 ____D C:\Program Files\HP 2013-07-12 15:59 - 2012-03-12 13:34 - 00000000 ____D C:\Users\Chris\AppData\Local\HP 2013-07-12 15:57 - 2013-07-12 15:57 - 30360152 _____ C:\Users\Chris\Downloads\OJ4620_Basicx64_1315.exe 2013-07-12 15:57 - 2013-07-12 15:57 - 00000057 _____ C:\ProgramData\Ament.ini 2013-07-11 15:20 - 2009-07-13 21:45 - 00461088 _____ C:\windows\system32\FNTCACHE.DAT 2013-07-11 10:38 - 2013-07-11 10:38 - 00000000 ____H C:\windows\system32\Drivers\Msft_Kernel_dc3d_01011.Wdf 2013-07-09 16:48 - 2013-07-09 16:48 - 00260506 _____ C:\Users\Chris\Downloads\SSMauii Conversion XPRF Fan Quote.tiff 2013-07-07 15:18 - 2013-07-07 15:16 - 33397640 _____ (Amazon) C:\Users\Chris\Downloads\AmazonCloudPlayerInstaller332._V381017050_.exe 2013-07-06 14:45 - 2013-07-06 14:45 - 00000000 ____D C:\Users\Chris\Desktop\Old Firefox Data-1 2013-07-05 08:00 - 2013-07-05 08:00 - 00000000 _____ C:\Users\Chris\Sti_Trace.log ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2013-07-23 17:35 ==================== End Of Log ============================

SystemLook 30.07.11 by jpshortstuff Log created at 22:25 on 02/08/2013 by Chris Administrator - Elevation successful ========== filefind ========== Searching for "sdnclean64.exe" No files found. -= EOF =-

Sorry for the delay. When you reminded me to back-up data I remembered a photos folder I forgot to back-up. When I backed it up there was one folder that was stubborn and reacted the same way my Firefox profile folder did. I was able to back up about half the photos from that individual folder but the other half kept freezing windows explorer when it reached a particular photo in the photo, so I was unable to back-up the photo's in the numerical sequence after that. I spend some time a few different ways trying to get around that identified photo but finally gave up. TDSSkiller log attached (I kept getting an error that the post was too long if I pasted it into my post) TDSSKiller.2.8.18.0_02.08.2013_21.56.07_log.txt