Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Used HitmanPro to try to remove TDSS, now PC won't boot


  • This topic is locked This topic is locked
2 replies to this topic

#1 Thanatosil

Thanatosil

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:04:49 AM

Posted 24 May 2013 - 03:34 PM

Hi--

 

I'm afraid I can't run the DDS tool, because I can't get to Windows, even in safe mode.  I scanned with HitmanPro (HMP) and found TDSS and boot sector virus infections.  I followed the recommended actions in HMP, and the machine now gets to the Windows splash screen then restarts with a STOP 0x7b BSOD.  The machine is running Windows 7 Home Premium, and I can get to System Recovery Options and the Command Prompt there.  I was able to run an FRST scan, and here is the result:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 24-05-2013 03
Ran by SYSTEM on 24-05-2013 19:09:58
Running from G:\
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Recovery
The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s [6629480 2011-04-14] (Realtek Semiconductor)
HKLM\...\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe [609144 2011-04-12] (Alps Electric Co., Ltd.)
HKLM\...\Run: [IntelPAN] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel PAN Tray [1935120 2011-11-01] (Intel® Corporation)
HKLM\...\Run: [BTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshell.dll",TrayApp [10357008 2011-10-18] (Intel Corporation)
HKLM\...\Run: [QuickSet] c:\Program Files\Dell\QuickSet\QuickSet.exe [4500640 2011-03-10] (Dell Inc.)
HKLM\...\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup [482661 2011-11-03] ()
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [503942 2011-04-13] (Creative Technology Ltd)
HKLM-x32\...\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [514544 2010-11-17] ()
HKLM-x32\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1535112 2012-09-12] (McAfee, Inc.)
HKLM-x32\...\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup [957440 2011-11-03] ()
HKLM-x32\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1557160 2012-04-03] (Ask)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-11-28] (Apple Inc.)
HKLM-x32\...\Run: [DATAMNGR] C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\DATAMN~1.EXE [1823184 2012-06-06] (iMesh, Inc)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-09-09] (Apple Inc.)
HKU\Danielle Drallmeier\...\Run: [Facebook Update] "C:\Users\Danielle Drallmeier\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2013-01-08] (Facebook Inc.)
HKU\Danielle Drallmeier\...\Run: [Spotify] "C:\Users\Danielle Drallmeier\AppData\Roaming\Spotify\Spotify.exe" /uri spotify:autostart [7880664 2012-11-27] (Spotify Ltd)
HKU\Danielle Drallmeier\...\Run: [Spotify Web Helper] "C:\Users\Danielle Drallmeier\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1199576 2012-11-27] (Spotify Ltd)
HKU\Danielle Drallmeier\...\Run: [Exetender] "C:\Program Files (x86)\Free Ride Games\GPlayer.exe" /runonstartup [4936152 2012-12-04] (Exent Technologies Ltd.)
HKU\Danielle Drallmeier\...\Run: [Desktop Software] "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe"  /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden [1102 2012-04-17] ()
HKU\Danielle Drallmeier\...\Run: [iMesh] rundll32.exe "C:\Users\Sheri Drallmeier\AppData\Local\PackageAware\iMesh\dxgsvj.dll",DllRegisterServerW [x]
HKU\Danielle Drallmeier\...\Policies\system: [LogonHoursAction] 2
HKU\Danielle Drallmeier\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Nina and Lizzy\...\Run: [Facebook Update] "C:\Users\Nina and Lizzy\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-08-25] (Facebook Inc.)
HKU\Nina and Lizzy\...\Run: [Desktop Software] "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe"  /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden [1102 2012-04-17] ()
HKU\Nina and Lizzy\...\Run: [Exetender] "C:\Program Files (x86)\Free Ride Games\GPlayer.exe" /runonstartup [4936152 2012-12-04] (Exent Technologies Ltd.)
HKU\Nina and Lizzy\...\Run: [Spotify Web Helper] "C:\Users\Nina and Lizzy\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [1103768 2013-03-12] (Spotify Ltd)
HKU\Nina and Lizzy\...\Run: [Spotify] "C:\Users\Nina and Lizzy\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart [4489112 2013-03-12] (Spotify Ltd)
HKU\Nina and Lizzy\...\Policies\system: [LogonHoursAction] 2
HKU\Nina and Lizzy\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Sheri Drallmeier\...\Run: [Desktop Software] "C:\Program Files (x86)\Common Files\SupportSoft\bin\bcont.exe"  /ini "C:\Program Files (x86)\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden [1102 2012-04-17] ()
HKU\Sheri Drallmeier\...\Run: [Facebook Update] "C:\Users\Sheri Drallmeier\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-23] (Facebook Inc.)
HKU\Sheri Drallmeier\...\Run: [Exetender] "C:\Program Files (x86)\Free Ride Games\GPlayer.exe" /runonstartup [4936152 2012-12-04] (Exent Technologies Ltd.)
HKU\Sheri Drallmeier\...\Policies\system: [LogonHoursAction] 2
HKU\Sheri Drallmeier\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
AppInit_DLLs: C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\x64\datamngr.dll C:\PROGRA~2\IMESHA~1\MediaBar\Datamngr\x64\IEBHO.dll  [1528744 2012-06-06] (iMesh, Inc)
Startup: C:\Users\Sheri Drallmeier\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tcbhn.lnk
ShortcutTarget: tcbhn.lnk ->  (No File)
BootExecute: autocheck autochk * bootdelete

==================== Services (Whitelisted) =================

S2 HitmanPro37CrusaderBoot; C:\Users\Sheri Drallmeier\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OLLQEPOB\HitmanPro_x64.exe [9815288 2013-05-24] (SurfRight B.V.)
S3 McAWFwk; c:\PROGRA~1\mcafee\msc\mcawfwk.exe [224704 2011-03-08] (McAfee, Inc.)
S2 McMPFSvc; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 mcmscsvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNaiAnn; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McNASvc; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 McODS; C:\Program Files\mcafee\VirusScan\mcods.exe [383608 2012-11-16] (McAfee, Inc.)
S4 McOobeSv; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McProxy; C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S2 McShield; C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe [241016 2012-12-26] (McAfee, Inc.)
S2 mfefire; C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe [218320 2012-12-26] (McAfee, Inc.)
S2 mfevtp; C:\Windows\system32\mfevtps.exe [182312 2012-12-26] (McAfee, Inc.)
S2 MSK80Service; C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe [201304 2012-08-31] (McAfee, Inc.)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-11-01] ()

==================== Drivers (Whitelisted) ====================

S3 cfwids; C:\Windows\System32\drivers\cfwids.sys [69672 2012-12-26] (McAfee, Inc.)
S3 HipShieldK; C:\Windows\System32\drivers\HipShieldK.sys [196440 2012-04-20] (McAfee, Inc.)
S3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [32000 2013-05-24] ()
S3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [178840 2012-12-26] (McAfee, Inc.)
S3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [309400 2012-12-26] (McAfee, Inc.)
S3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [515528 2012-12-26] (McAfee, Inc.)
S0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [771096 2012-12-26] (McAfee, Inc.)
S3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [106112 2012-12-26] (McAfee, Inc.)
S0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [339776 2012-12-26] (McAfee, Inc.)
S2 X5XSEx_Pr143; C:\Program Files (x86)\Free Ride Games\X5XSEx_Pr143.Sys [56136 2012-08-02] (Exent Technologies Ltd.)
S3 mfeavfk01; No ImagePath

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-05-24 19:09 - 2013-05-24 19:09 - 00000000 ____D C:\FRST
2013-05-24 13:39 - 2013-05-24 13:39 - 00019576 ____A C:\Windows\System32\.crusader
2013-05-24 13:39 - 2013-05-24 13:39 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-05-24 13:39 - 2013-05-24 13:39 - 00008726 ____A C:\Windows\System32\bootdelete.lst
2013-05-24 09:36 - 2013-05-24 13:39 - 00000000 ____D C:\ProgramData\HitmanPro
2013-05-24 09:36 - 2013-05-24 13:39 - 00000000 ____D C:\ProgramData\Application Data\HitmanPro
2013-05-24 09:36 - 2013-05-24 09:36 - 00032000 ____A C:\Windows\System32\Drivers\hitmanpro37.sys
2013-05-24 06:28 - 2013-05-24 06:28 - 00262144 ____A C:\Windows\Minidump\052413-43040-01.dmp
2013-05-24 05:22 - 2013-04-05 01:52 - 02242048 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-05-24 05:22 - 2013-04-05 01:52 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-05-24 05:22 - 2013-04-05 01:52 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-05-24 05:22 - 2013-04-05 01:50 - 19231232 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 15404032 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 02647552 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-05-24 05:22 - 2013-04-05 01:50 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-05-24 05:22 - 2013-04-05 00:28 - 01767424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-05-24 05:22 - 2013-04-05 00:28 - 01130496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 14323712 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 13760512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 02046976 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-05-24 05:22 - 2013-04-05 00:26 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-05-24 05:22 - 2013-04-04 23:43 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-05-24 05:22 - 2013-04-04 23:29 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-05-24 05:22 - 2013-04-04 22:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-05-24 05:22 - 2013-04-04 22:38 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-05-13 13:59 - 2013-05-13 14:00 - 00000000 ____D C:\Users\Nina and Lizzy\Downloads\random
2013-05-11 07:50 - 2013-05-11 07:50 - 00003288 ____N C:\bootsqm.dat
2013-05-11 05:34 - 2013-05-11 05:34 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-11 05:34 - 2013-05-11 05:34 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-11 05:34 - 2013-05-11 05:34 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-05-11 05:34 - 2013-05-11 05:34 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-05-11 05:34 - 2013-05-11 05:34 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-11 05:34 - 2013-05-11 05:34 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-05-11 05:34 - 2013-05-11 05:34 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-05-11 05:34 - 2013-05-11 05:34 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-05-11 05:33 - 2013-05-11 05:34 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-05-11 05:33 - 2013-05-11 05:33 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-05-11 05:30 - 2013-05-11 05:30 - 03928064 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 03419136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 02776576 ____A (Microsoft Corporation) C:\Windows\System32\msmpeg2vdec.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 02565120 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 02284544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01988096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01682432 ____A (Microsoft Corporation) C:\Windows\System32\XpsPrint.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01643520 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01504768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01238528 ____A (Microsoft Corporation) C:\Windows\System32\d3d10.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01175552 ____A (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01158144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01080832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00648192 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00604160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00522752 ____A (Microsoft Corporation) C:\Windows\System32\XpsGdiConverter.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00465920 ____A (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00417792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00364544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00363008 ____A (Microsoft Corporation) C:\Windows\System32\dxgi.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00333312 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00296960 ____A (Microsoft Corporation) C:\Windows\System32\d3d10core.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00293376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00249856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00245248 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecsExt.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00221184 ____A (Microsoft Corporation) C:\Windows\System32\UIAnimation.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00207872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00194560 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00187392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00010752 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00010752 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00009728 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00009728 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00002560 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00002560 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-11 05:26 - 2013-05-11 05:43 - 00007679 ____A C:\Windows\IE10_main.log
2013-05-11 05:00 - 2013-05-11 05:00 - 00262144 ____A C:\Windows\Minidump\051113-46082-01.dmp
2013-05-05 21:23 - 2013-05-05 21:23 - 00262144 ____A C:\Windows\Minidump\050513-41621-01.dmp
2013-04-28 14:16 - 2013-04-28 14:16 - 00266288 ____A C:\Windows\Minidump\042813-18657-01.dmp
2013-04-27 20:55 - 2013-05-24 13:38 - 00000518 ____A C:\Windows\Tasks\Arcadesafari.job
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\Users\Nina and Lizzy\Local Settings\Arcadesafari
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\Users\Nina and Lizzy\Local Settings\Application Data\Arcadesafari
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\Users\Nina and Lizzy\AppData\Local\Arcadesafari
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\ProgramData\Oberon Media
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\ProgramData\Application Data\Oberon Media
2013-04-27 17:41 - 2013-04-27 17:41 - 00262144 ____A C:\Windows\Minidump\042713-21871-01.dmp
2013-04-25 14:20 - 2013-04-12 09:45 - 01656680 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys

==================== One Month Modified Files and Folders =======

2013-05-24 19:09 - 2013-05-24 19:09 - 00000000 ____D C:\FRST
2013-05-24 13:40 - 2009-07-14 00:13 - 00006498 ____A C:\Windows\System32\PerfStringBackup.INI
2013-05-24 13:39 - 2013-05-24 13:39 - 00019576 ____A C:\Windows\System32\.crusader
2013-05-24 13:39 - 2013-05-24 13:39 - 00012872 ____A (SurfRight B.V.) C:\Windows\System32\bootdelete.exe
2013-05-24 13:39 - 2013-05-24 13:39 - 00008726 ____A C:\Windows\System32\bootdelete.lst
2013-05-24 13:39 - 2013-05-24 09:36 - 00000000 ____D C:\ProgramData\HitmanPro
2013-05-24 13:39 - 2013-05-24 09:36 - 00000000 ____D C:\ProgramData\Application Data\HitmanPro
2013-05-24 13:39 - 2012-05-28 20:19 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-05-24 13:39 - 2012-03-05 00:50 - 01658629 ____A C:\Windows\WindowsUpdate.log
2013-05-24 13:38 - 2013-04-27 20:55 - 00000518 ____A C:\Windows\Tasks\Arcadesafari.job
2013-05-24 13:38 - 2012-11-26 20:11 - 00000984 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-773173472-3999895563-3458605673-1003UA.job
2013-05-24 13:38 - 2012-08-25 17:15 - 00000964 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-773173472-3999895563-3458605673-1001UA.job
2013-05-24 13:38 - 2012-05-28 20:21 - 00000918 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-05-24 13:38 - 2012-05-28 20:19 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-05-24 13:38 - 2012-04-29 11:30 - 00000972 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-773173472-3999895563-3458605673-1000UA.job
2013-05-24 13:38 - 2012-04-28 21:51 - 00000924 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-773173472-3999895563-3458605673-1002UA.job
2013-05-24 13:38 - 2012-03-04 22:56 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-05-24 09:53 - 2012-05-28 20:21 - 00000914 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-05-24 09:42 - 2009-07-13 23:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-05-24 09:42 - 2009-07-13 23:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-05-24 09:36 - 2013-05-24 09:36 - 00032000 ____A C:\Windows\System32\Drivers\hitmanpro37.sys
2013-05-24 09:33 - 2012-03-04 23:55 - 00000000 ____D C:\ProgramData\Sonic
2013-05-24 09:33 - 2012-03-04 23:55 - 00000000 ____D C:\ProgramData\Application Data\Sonic
2013-05-24 06:30 - 2012-05-13 18:47 - 00000000 ____D C:\Users\Sheri Drallmeier\Application Data\BrowserCompanion
2013-05-24 06:30 - 2012-05-13 18:47 - 00000000 ____D C:\Users\Sheri Drallmeier\AppData\Roaming\BrowserCompanion
2013-05-24 06:28 - 2013-05-24 06:28 - 00262144 ____A C:\Windows\Minidump\052413-43040-01.dmp
2013-05-24 06:28 - 2012-08-28 22:05 - 567387701 ____A C:\Windows\MEMORY.DMP
2013-05-24 06:28 - 2012-08-28 22:05 - 00000000 ____D C:\Windows\Minidump
2013-05-24 06:28 - 2012-03-04 23:37 - 00000000 ____D C:\Users\Default\Local Settings\SoftThinks
2013-05-24 06:28 - 2012-03-04 23:37 - 00000000 ____D C:\Users\Default\Local Settings\Application Data\SoftThinks
2013-05-24 06:28 - 2012-03-04 23:37 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-05-24 06:28 - 2012-03-04 23:37 - 00000000 ____D C:\Users\Default User\Local Settings\SoftThinks
2013-05-24 06:28 - 2012-03-04 23:37 - 00000000 ____D C:\Users\Default User\Local Settings\Application Data\SoftThinks
2013-05-24 06:28 - 2012-03-04 23:37 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-05-24 06:28 - 2012-03-04 23:33 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-05-24 06:28 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-05-24 06:28 - 2009-07-13 23:51 - 00103114 ____A C:\Windows\setupact.log
2013-05-24 04:47 - 2012-11-23 13:58 - 00000000 ____D C:\users\Danielle Drallmeier
2013-05-24 04:47 - 2012-04-19 18:00 - 00000000 ____D C:\users\Nina and Lizzy
2013-05-24 04:47 - 2012-04-17 18:36 - 00000000 ____D C:\users\Sheri Drallmeier
2013-05-24 04:47 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\servicing
2013-05-24 04:47 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\L2Schemas
2013-05-24 04:47 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\IME
2013-05-24 04:47 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Cursors
2013-05-24 04:46 - 2013-02-25 20:09 - 00000000 ____D C:\Users\Nina and Lizzy\Application Data\Spotify
2013-05-24 04:46 - 2013-02-25 20:09 - 00000000 ____D C:\Users\Nina and Lizzy\AppData\Roaming\Spotify
2013-05-24 04:46 - 2013-01-07 03:51 - 00000000 ____D C:\Program Files (x86)\Free Ride Games
2013-05-24 04:46 - 2012-12-25 15:08 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-05-24 04:46 - 2012-05-28 10:11 - 00000000 ____D C:\Program Files (x86)\Safari
2013-05-24 04:46 - 2012-05-13 18:47 - 00000000 ____D C:\Program Files (x86)\BrowserCompanion
2013-05-24 04:46 - 2012-04-22 22:34 - 00000000 ____D C:\Program Files\Bonjour
2013-05-24 04:46 - 2012-04-19 18:00 - 00000000 ___RD C:\Users\Nina and Lizzy\Desktop\Play Games
2013-05-24 04:46 - 2012-04-17 19:08 - 00000000 ____D C:\Program Files (x86)\Ask.com
2013-05-24 04:46 - 2012-03-05 00:29 - 00000000 ____D C:\Program Files\Dell Games Folder
2013-05-24 04:46 - 2012-03-04 23:37 - 00000000 ____D C:\Program Files (x86)\eBay
2013-05-24 04:46 - 2012-03-04 23:20 - 00000000 ____D C:\Program Files\DellTPad
2013-05-24 04:46 - 2012-03-04 22:56 - 00000000 ____D C:\Windows\SysWOW64\Macromed
2013-05-24 04:46 - 2012-03-04 22:56 - 00000000 ____D C:\Windows\System32\Macromed
2013-05-24 04:46 - 2009-07-13 22:20 - 00000000 ___HD C:\Windows\System32\GroupPolicy
2013-05-24 04:40 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
2013-05-13 14:00 - 2013-05-13 13:59 - 00000000 ____D C:\Users\Nina and Lizzy\Downloads\random
2013-05-13 13:59 - 2012-09-24 02:36 - 00000000 ____D C:\Users\Nina and Lizzy\Downloads\bedrooms
2013-05-12 15:16 - 2012-04-20 08:05 - 00000000 ____D C:\Users\Nina and Lizzy\Application Data\SoftGrid Client
2013-05-12 15:16 - 2012-04-20 08:05 - 00000000 ____D C:\Users\Nina and Lizzy\AppData\Roaming\SoftGrid Client
2013-05-12 15:13 - 2012-04-29 11:30 - 00000950 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-773173472-3999895563-3458605673-1000Core.job
2013-05-12 07:43 - 2009-07-14 00:08 - 00032574 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2013-05-11 07:50 - 2013-05-11 07:50 - 00003288 ____N C:\bootsqm.dat
2013-05-11 05:58 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-05-11 05:58 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-05-11 05:58 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\zh-HK
2013-05-11 05:58 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\tr-TR
2013-05-11 05:58 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-05-11 05:43 - 2013-05-11 05:26 - 00007679 ____A C:\Windows\IE10_main.log
2013-05-11 05:34 - 2013-05-11 05:34 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-05-11 05:34 - 2013-05-11 05:34 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-05-11 05:34 - 2013-05-11 05:34 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-05-11 05:34 - 2013-05-11 05:34 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-05-11 05:34 - 2013-05-11 05:34 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-05-11 05:34 - 2013-05-11 05:34 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-05-11 05:34 - 2013-05-11 05:34 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-05-11 05:34 - 2013-05-11 05:34 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-05-11 05:34 - 2013-05-11 05:34 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-05-11 05:34 - 2013-05-11 05:34 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-05-11 05:34 - 2013-05-11 05:33 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-05-11 05:33 - 2013-05-11 05:33 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-05-11 05:33 - 2013-05-11 05:33 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-05-11 05:33 - 2013-05-11 05:33 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-05-11 05:30 - 2013-05-11 05:30 - 03928064 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 03419136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 02776576 ____A (Microsoft Corporation) C:\Windows\System32\msmpeg2vdec.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 02565120 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 02284544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01988096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01682432 ____A (Microsoft Corporation) C:\Windows\System32\XpsPrint.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01643520 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01504768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01238528 ____A (Microsoft Corporation) C:\Windows\System32\d3d10.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01175552 ____A (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01158144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 01080832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00648192 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00604160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00522752 ____A (Microsoft Corporation) C:\Windows\System32\XpsGdiConverter.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00465920 ____A (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00417792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00364544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00363008 ____A (Microsoft Corporation) C:\Windows\System32\dxgi.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00333312 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00296960 ____A (Microsoft Corporation) C:\Windows\System32\d3d10core.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00293376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00249856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00245248 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecsExt.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00221184 ____A (Microsoft Corporation) C:\Windows\System32\UIAnimation.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00207872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00194560 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00187392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00010752 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00010752 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00009728 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00009728 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00002560 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-11 05:30 - 2013-05-11 05:30 - 00002560 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-05-11 05:00 - 2013-05-11 05:00 - 00262144 ____A C:\Windows\Minidump\051113-46082-01.dmp
2013-05-11 04:45 - 2012-04-28 17:00 - 00000000 ____D C:\ProgramData\PCDr
2013-05-11 04:45 - 2012-04-28 17:00 - 00000000 ____D C:\ProgramData\Application Data\PCDr
2013-05-11 04:43 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\NDF
2013-05-06 11:28 - 2012-04-22 22:34 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-05-06 11:28 - 2012-04-19 19:47 - 00000000 ____D C:\Program Files (x86)\Microsoft Application Virtualization Client
2013-05-06 11:28 - 2012-04-17 19:08 - 00000000 ____D C:\Program Files (x86)\ooVoo
2013-05-06 11:28 - 2012-03-04 23:35 - 00000000 ____D C:\Program Files (x86)\Cozi Express
2013-05-05 21:23 - 2013-05-05 21:23 - 00262144 ____A C:\Windows\Minidump\050513-41621-01.dmp
2013-05-05 20:15 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\Offline Web Pages
2013-05-05 20:15 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\Dism
2013-05-05 20:14 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2013-05-03 01:03 - 2012-04-17 19:12 - 00000000 ___RD C:\Program Files (x86)\Skype
2013-05-03 01:03 - 2012-03-04 23:35 - 00000000 ____D C:\ProgramData\Skype
2013-05-03 01:03 - 2012-03-04 23:35 - 00000000 ____D C:\ProgramData\Application Data\Skype
2013-04-28 14:16 - 2013-04-28 14:16 - 00266288 ____A C:\Windows\Minidump\042813-18657-01.dmp
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\Users\Nina and Lizzy\Local Settings\Arcadesafari
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\Users\Nina and Lizzy\Local Settings\Application Data\Arcadesafari
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\Users\Nina and Lizzy\AppData\Local\Arcadesafari
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\ProgramData\Oberon Media
2013-04-27 20:55 - 2013-04-27 20:55 - 00000000 ____D C:\ProgramData\Application Data\Oberon Media
2013-04-27 17:41 - 2013-04-27 17:41 - 00262144 ____A C:\Windows\Minidump\042713-21871-01.dmp
2013-04-26 18:51 - 2012-11-26 20:11 - 00000962 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-773173472-3999895563-3458605673-1003Core.job

Other Malware:
===========
C:\Windows\svchost.exe
ATTENTION ====> Check for partition/boot infection.

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

TDL4: custom:26000022 <===== ATTENTION!

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-04-25 14:12:07
Restore point made on: 2013-04-26 17:12:23
Restore point made on: 2013-04-27 17:50:18
Restore point made on: 2013-04-28 14:24:05
Restore point made on: 2013-04-30 23:07:40
Restore point made on: 2013-05-05 03:50:55
Restore point made on: 2013-05-05 21:30:32
Restore point made on: 2013-05-06 06:34:48
Restore point made on: 2013-05-11 05:25:53
Restore point made on: 2013-05-11 11:23:27
Restore point made on: 2013-05-12 07:04:40
Restore point made on: 2013-05-12 07:52:36
Restore point made on: 2013-05-13 03:02:41
Restore point made on: 2013-05-13 09:48:15
Restore point made on: 2013-05-15 12:21:54
Restore point made on: 2013-05-24 05:21:48

==================== Memory info ===========================

Percentage of memory in use: 16%
Total physical RAM: 3990.17 MB
Available physical RAM: 3321.25 MB
Total Pagefile: 3988.37 MB
Available Pagefile: 3308.88 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:446.13 GB) (Free:360.1 GB) NTFS (Disk=0 Partition=3)
Drive d: (RECOVERY) (Fixed) (Total:19.53 GB) (Free:11.12 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
ATTENTION: Malware custom entry on BCD on drive d: detected.
Drive g: (My Passport) (Fixed) (Total:931.48 GB) (Free:819.3 GB) NTFS (Disk=2 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 07F2837E)
Partition 1: (Not Active) - (Size=102 MB) - (Type=DE)
Partition 2: (Active) - (Size=20 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=446 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (MBR Code: Windows XP) (Size: 931 GB) (Disk ID: 00023F15)
Partition 1: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

Last Boot: 2013-05-06 08:18

==================== End Of Log ============================

 



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:05:49 AM

Posted 24 May 2013 - 06:07 PM

duplicate post
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:05:49 AM

Posted 28 May 2013 - 08:40 PM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users