Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected with a virus. serw.clicksor.w32


  • This topic is locked This topic is locked
3 replies to this topic

#1 eclark53

eclark53

  • Members
  • 96 posts
  • OFFLINE
  •  
  • Local time:11:09 PM

Posted 28 August 2013 - 12:36 PM

I have run FRST program below are the logs

 

FRST,TXT

 

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 28-08-2013
Ran by Estelle Clark (administrator) on 28-08-2013 12:02:35
Running from C:\Users\Estelle Clark\Desktop
Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(Intel Corporation) C:\Program Files\Intel\AMT\atchksrv.exe
() C:\Program Files\DefaultTab\DefaultTabSearch.exe
() C:\Users\Estelle Clark\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe
(Nuance Communications, Inc.) C:\Program Files\Common Files\Nuance\dgnsvc.exe
() C:\Program Files\Fast Free Converter\FastFreeConverterUpdt.exe
(Ellora Assets Corp.) C:\Program Files\Freemake\CaptureLib\CaptureLibService.exe
(Intel) C:\Program Files\Intel\AMT\LMS.exe
(Nero AG) C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
(Symantec) C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(BitTorrent Inc.) C:\Users\Estelle Clark\AppData\Roaming\uTorrent\uTorrent.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
(Hewlett-Packard) C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\system32\mmc.exe
(SurfRight B.V.) Q:\HitmanPro.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Microsoft Corporation) c:\program files\windows defender\MpCmdRun.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [] -  [x]
HKLM\...\Run: [hpqSRMon] - C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [150528 2008-07-22] (Hewlett-Packard)
HKLM\...\Run: [MSC] - "C:\Program Files\Microsoft Security Client\mssecex.exe" -hide -runkey [x] <===== ATTENTION (File name is altered)
HKCU\...\Run: [uTorrent] - C:\Users\Estelle Clark\AppData\Roaming\uTorrent\uTorrent.exe [1130576 2013-08-13] (BitTorrent Inc.)
HKCU\...\Run: [Xvid] - C:\Program Files\Xvid\CheckUpdate.exe [8192 2011-01-17] ()
HKCU\...\Run: [Google Update*] -  [x] <===== ATTENTION (ZeroAccess rootkit hidden path)
HKCU\...\Run: [cdloader] - C:\Users\Estelle Clark\AppData\Roaming\mjusbsp\cdloader2.exe [50592 2012-02-01] (magicJack L.P.)
MountPoints2: E - E:\menu.exe
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
BootExecute: autocheck autochk /p \??\E:autocheck autochk *

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://cnn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp
URLSearchHook: (No Name) - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} -  No File
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={searchTerms}&s_it=webpickaol-ie&s_qt=sb&tb_uuid=7FB410B72A4C4623815E27EF254BB2D5&tb_oid=16-06-2013&tb_mrud=16-06-2013
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&r=312
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&r=312
SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://www1.delta-search.com/?q={searchTerms}&babsrc=SP_ss&mntrId=F432001A6B49283C&affID=120008&tsp=4983
SearchScopes: HKCU - {3FA0E3C1-861C-4773-87CF-E7A0761F2344} URL = http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=^TV&apn_dtid=^OSJ000^YY^US&apn_uid=3484989C-8F7F-42B4-BDF7-70CF69A975F1&apn_sauid=11B51A28-B5C1-4EA1-8936-E361FFA17DEC
SearchScopes: HKCU - {443789B7-F39C-4b5c-9287-DA72D38F4FE6} URL = http://slirsredirect.search.aol.com/redirector/sredir?sredir=843&q={searchTerms}&s_it=webpickaol-ie&s_qt=sb&tb_uuid=7FB410B72A4C4623815E27EF254BB2D5&tb_oid=16-06-2013&tb_mrud=16-06-2013
SearchScopes: HKCU - {AC854C18-2A1E-43f1-8513-0D2F26C796ED} URL = http://home.cloyim.com/search.php?q={searchTerms}
SearchScopes: HKCU - {C3602E34-DA6F-4A01-8268-ADEB7AB56F2B} URL = http://search.yahoo.com/search?p={searchTerms}&ei=UTF-8&fr=w3i&type=W3i_DS,136,0_0,Search,20130833,20028,0,25,0
SearchScopes: HKCU - {EBBAF41F-7892-493F-AA48-221BDEEB3808} URL = http://www.mysearchresults.com/search?&c=4001&t=10&q={searchTerms}
BHO: No Name - {02478D38-C3F9-4efb-9B51-7695ECA05670} -  No File
BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO: diamondata - {055af109-de93-4160-bcfc-7da70ecaa020} - C:\Program Files\diamondata\diamondatabho.dll (diamondata)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: safe saevoee - {606ECF80-8D4C-F82B-8745-83B693D433AD} - C:\ProgramData\safe saevoee\51be921b72de9.dll ()
BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: DefaultTab Browser Helper - {7F6AFBF1-E065-4627-A2FD-810366367D01} - C:\Users\Estelle Clark\AppData\Roaming\DefaultTab\DefaultTab\DefaultTabBHO.dll (Search Results LLC.)
BHO: Fast Free Converter 4.1 - {8232785C-5C98-4A6E-B7B4-911FFBED7582} - C:\PROGRA~1\Fast Free Converter\FastFreeConverter\FastFreeConverter.dll (Fast Free Converter)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: safe saevoee - {96111EBD-5CD5-FA99-17CB-7322745B79C6} - C:\ProgramData\safe saevoee\51be927bcb522.dll ()
BHO: Adobe Acrobat Create PDF Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~2\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: WeCareReminder Class - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\ProgramData\WeCareReminder\IEHelperv2.5.0.dll (We-Care.com)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: SweetPacks Browser Helper - {EEE6C35C-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
BHO: Adobe Acrobat Create PDF from Selection - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM - Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKLM - SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Toolbar: HKCU -Adobe Acrobat Create PDF Toolbar - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\WCIEActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
Toolbar: HKCU -No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Toolbar: HKCU -SweetPacks Toolbar for Internet Explorer - {EEE6C35B-6118-11DC-9C72-001320C79847} - C:\Program Files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll (SweetIM Technologies Ltd.)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll"
Winsock: Catalog5 05 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll"
Winsock: Catalog9 01 mswsock.dll File Not found ()
Winsock: Catalog9 02 mswsock.dll File Not found ()
Winsock: Catalog9 03 mswsock.dll File Not found ()
Winsock: Catalog9 04 mswsock.dll File Not found ()
Winsock: Catalog9 05 mswsock.dll File Not found ()
Winsock: Catalog9 06 mswsock.dll File Not found ()
Winsock: Catalog9 07 mswsock.dll File Not found ()
Winsock: Catalog9 08 mswsock.dll File Not found ()
Winsock: Catalog9 09 mswsock.dll File Not found ()
Winsock: Catalog9 10 mswsock.dll File Not found ()
Winsock: Catalog9 11 mswsock.dll File Not found ()
Winsock: Catalog9 12 mswsock.dll File Not found ()
Winsock: Catalog9 13 mswsock.dll File Not found ()
Winsock: Catalog9 14 mswsock.dll File Not found ()
Winsock: Catalog9 15 mswsock.dll File Not found ()
Winsock: Catalog9 16 mswsock.dll File Not found ()
Winsock: Catalog9 17 mswsock.dll File Not found ()
Winsock: Catalog9 18 mswsock.dll File Not found ()
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254

FireFox:
========
FF ProfilePath: C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default
FF user.js: detected! => C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\user.js
FF NewTab: about:blank
FF Homepage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=F432001A6B49283C&affID=120008&tsp=4983
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin: @alibaba.com/nptrademanager;version=1.0 - C:\Program Files\trademanager\nptrademanager.dll ( )
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/Lync,version=15.0 - C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @videolan.org/vlc,version=2.0.7 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Acrobat - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin: adobe.com/AdobeAAMDetect - C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF Plugin HKCU: @citrixonline.com/appdetectorplugin - C:\Users\Estelle Clark\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Estelle Clark\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Estelle Clark\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\searchplugins\search-here.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\searchplugins\Search the web.xml
FF Extension: No Name - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Extensions\{1FD91A9C-410C-4090-BBCC-55D3450EF433}
FF Extension: Foxdie - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\Foxdie@tanjihay.com
FF Extension: Savensharree  - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\km1eayi.oeoa@wa-aoueiai.org
FF Extension: savensHarE  - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\rbpo@cyeyi.co.uk
FF Extension: CWA App By We-Care.com - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\wecarereminder@bryan
FF Extension: FT Evo - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\{5c8c1470-d247-11e0-9572-0800200c9a66}
FF Extension: HP Detect - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\{ab91efd4-6975-4081-8552-1b3922ed79e2}
FF Extension: addon - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\addon@defaulttab.com.xpi
FF Extension: firefox - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\firefox@diamondata.net.xpi
FF Extension: No Name - C:\Users\Estelle Clark\AppData\Roaming\Mozilla\Firefox\Profiles\g3apg0ar.default\Extensions\{080955ad-b8bb-4500-806f-d2b9ad73d72e}.xpi
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM\...\Firefox\Extensions: [web2pdfextension@web2pdf.adobedotcom] C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF Extension: Adobe Acrobat - Create PDF - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCFirefoxExtn
FF HKLM\...\Firefox\Extensions: [extension@FastFreeConverter.com] C:\Program Files\Fast Free Converter\FastFreeConverter\extension@FastFreeConverter.com
FF Extension: Fast Free Converter - C:\Program Files\Fast Free Converter\FastFreeConverter\extension@FastFreeConverter.com
FF HKLM\...\Firefox\Extensions: [fmdownloader@gmail.com] C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com\
FF Extension: Freemake Video Downloader Plugin - C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\fmdownloader@gmail.com\
FF HKLM\...\Firefox\Extensions: [ytfmdownloader@gmail.com] C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com\
FF Extension: Freemake Youtube Download Button - C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Firefox\ytfmdownloader@gmail.com\
FF HKLM\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF HKCU\...\Firefox\Extensions: [smartwebprinting@hp.com] C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
FF Extension: HP Smart Web Printing - C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3

Chrome:
=======
CHR HomePage: hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=F432001A6B49283C&affID=120008&tsp=4983
CHR RestoreOnStartup: "hxxp://www1.delta-search.com/?babsrc=HP_ss&mntrId=F432001A6B49283C&affID=120008&tsp=4983"
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\29.0.1547.57\PepperFlash\pepflashplayer.dll No File
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\29.0.1547.57\ppGoogleNaClPluginChrome.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\29.0.1547.57\pdf.dll No File
CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
CHR Plugin: (TradeManager Plug-In For Firefox and Netscape) - C:\Program Files\Mozilla Firefox\plugins\nptrademanager.dll ( )
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.3) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2013) - C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (AdobeAAMDetect) - C:\Program Files\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
CHR Plugin: (Java™ Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Citrix Online Web Deployment Plugin 1.0.0.104) - C:\Users\Estelle Clark\AppData\Local\Citrix\Plugins\104\npappdetector.dll (Citrix Online)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
CHR Plugin: (Java Deployment Toolkit 7.0.250.17) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
CHR Extension: (Google Docs) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (YouTube) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Freemake Video Downloader) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf\1.0.0_0
CHR Extension: (uTorrentControl_v6) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\cflheckfmhopnialghigdlggahiomebp\10.16.100.504_0
CHR Extension: (Google Search) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Adobe Acrobat - Create PDF) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\efaidnbmnnnibpcajpcglclefindmkaj\11.0.0.379_0
CHR Extension: (Freemake Youtube Download Button) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ehgldbbpchgpcfagfpfjgoomddhccfgh\1.0.0_0
CHR Extension: (Delta Toolbar) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\eooncjejnppfjjklapaamhcdmjbilmde\1.4_0
CHR Extension: (savensHarE ) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\ggmohhaiodhfpilchdbljcpmmdnjjplf\5.10
CHR Extension: (eBuddy Chat) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\giacidpcfkbjnapjaklcdchjmmnajmpm\1.2.9_0
CHR Extension: (DefaultTab) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\kdidombaedgpfiiedeimiebkmbilgmlc\1.1.23_0
CHR Extension: (Torch Share) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\kiplfnciaokpcennlkldkdaeaaomamof\1.0.0.3604_0
CHR Extension: (Skype Click to Call) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.10.0.13089_0
CHR Extension: (sauvensHare! ) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\mmcpbjnogcjnikkbanbfgfoihhobgjgp\5.10
CHR Extension: (Chrome In-App Payments service) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.10_0
CHR Extension: (Gmail) - C:\Users\ESTELL~1\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\...\Chrome\Extension: [bpegkgagfojjbcpkihigfmkojdmmimdf] - C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx
CHR HKLM\...\Chrome\Extension: [cflheckfmhopnialghigdlggahiomebp] - C:\Users\Estelle Clark\AppData\Local\CRE\cflheckfmhopnialghigdlggahiomebp.crx
CHR HKLM\...\Chrome\Extension: [efaidnbmnnnibpcajpcglclefindmkaj] - C:\Program Files\Adobe\Acrobat 11.0\Acrobat\Browser\WCChromeExtn\WCChromeExtn.crx
CHR HKLM\...\Chrome\Extension: [ehgldbbpchgpcfagfpfjgoomddhccfgh] - C:\Program Files\Freemake\Freemake Video Downloader\BrowserPlugin\Chrome\ChromeYoutubePlugin.crx
CHR HKLM\...\Chrome\Extension: [eooncjejnppfjjklapaamhcdmjbilmde] - C:\Users\Estelle Clark\AppData\Roaming\BabSolution\CR\Delta.crx
CHR HKLM\...\Chrome\Extension: [kdidombaedgpfiiedeimiebkmbilgmlc] - C:\Program Files\DefaultTab\DefaultTab.crx
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx

========================== Services (Whitelisted) =================

R2 atchksrv; C:\Program Files\Intel\AMT\atchksrv.exe [183064 2007-05-29] (Intel Corporation)
R2 DefaultTabSearch; C:\Program Files\DefaultTab\DefaultTabSearch.exe [573952 2013-05-30] ()
R2 DefaultTabUpdate; C:\Users\Estelle Clark\AppData\Roaming\DefaultTab\DefaultTab\DTUpdate.exe [107520 2013-08-15] ()
S3 DiskDoctorService; C:\Program Files\Symantec\Norton Utilities 16\Tools\Disk Doctor\DiskDoctorSrv.exe [1147424 2012-09-29] (Symantec Corporation)
R2 DragonSvc; C:\Program Files\Common Files\Nuance\dgnsvc.exe [296808 2010-07-23] (Nuance Communications, Inc.)
R2 FastFreeConverterUpdt; C:\Program Files\Fast Free Converter\FastFreeConverterUpdt.exe [687104 2012-11-26] ()
R2 FreemakeVideoCapture; C:\Program Files\Freemake\CaptureLib\CaptureLibService.exe [9216 2013-06-13] (Ellora Assets Corp.)
R2 LMS; C:\Program Files\Intel\AMT\LMS.exe [105240 2007-05-29] (Intel)
R2 NU16StartManagerSvc; C:\Program Files\Symantec\Norton Utilities 16\sMonitor\StartManSvc.exe [792608 2012-09-29] (Symantec)
R2 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3289472 2013-07-12] (Skype Technologies S.A.)
S3 SpeedDiskService; C:\Program Files\Symantec\Norton Utilities 16\Tools\SpeedDisk\SpeedDiskSrv.exe [1160224 2012-09-29] (Symantec Corporation)
S2 MsMpSvc; "c:\Program Files\Microsoft Security Client\MsMpEng.exe" [x]
S3 NisSrv; "c:\Program Files\Microsoft Security Client\NisSrv.exe" [x]

==================== Drivers (Whitelisted) ====================

S1 aruzztxa; C:\Windows\system32\drivers\aruzztxa.sys [43600 2013-08-28] (Microsoft Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-13] (Microsoft Corporation)
R3 dvd43llh; C:\Windows\System32\DRIVERS\dvd43llh.sys [18816 2012-11-09] (RIF)
R3 hitmanpro37; C:\Windows\system32\drivers\hitmanpro37.sys [30976 2013-08-28] ()
S3 MBAMSwissArmy; C:\Windows\system32\drivers\mbamswissarmy.sys [40776 2013-05-01] (Malwarebytes Corporation)
R2 npf; C:\Windows\System32\drivers\npf.sys [35088 2011-02-11] (CACE Technologies, Inc.)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2012-02-15] (Samsung Electronics)
R2 {1BA31E5A-C098-42d8-8F88-3C9F78A2FDDC}; C:\Program Files\CyberLink\PowerDVD10\NavFilter\000.fcl [87536 2010-06-28] (CyberLink Corp.)
S3 ALSysIO; \??\C:\Users\ESTELL~1\AppData\Local\Temp\ALSysIO.sys [x]
S3 catchme; \??\C:\Users\ESTELL~1\AppData\Local\Temp\catchme.sys [x]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [x]
S3 tsusbhub; system32\drivers\tsusbhub.sys [x]
S3 VGPU; System32\drivers\rdvgkmd.sys [x]
S1 zqrlyodq; \??\C:\Windows\system32\drivers\zqrlyodq.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-28 12:00 - 2013-08-28 12:01 - 01072975 _____ (Farbar) C:\Users\Estelle Clark\Downloads\FRST(1).exe
2013-08-28 12:00 - 2013-08-28 12:00 - 00358507 _____ (Farbar) C:\Users\Estelle Clark\Downloads\FSS.exe
2013-08-28 11:59 - 2013-08-28 11:59 - 01072975 _____ (Farbar) C:\Users\Estelle Clark\Desktop\FRST.exe
2013-08-28 11:58 - 2013-08-28 11:59 - 01072975 _____ (Farbar) C:\Users\Estelle Clark\Downloads\FRST.exe
2013-08-28 11:51 - 2013-08-28 11:51 - 00030976 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2013-08-28 11:39 - 2013-08-28 11:39 - 00043600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\aruzztxa.sys
2013-08-28 10:54 - 2013-08-28 10:54 - 00001228 _____ C:\Users\Estelle Clark\Desktop\Windows Explorer.lnk
2013-08-28 10:43 - 2013-08-28 10:43 - 00001359 _____ C:\Users\Estelle Clark\Desktop\MSASCui.exe - Shortcut.lnk
2013-08-28 10:36 - 2013-08-28 10:38 - 00000000 ____D C:\Windows\system32\MpEngineStore
2013-08-28 10:12 - 2013-08-28 10:12 - 00080906 _____ C:\Users\Public\Documents\HitmanPro_20130828_1011.log
2013-08-28 09:28 - 2013-08-28 10:12 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-28 09:12 - 2013-08-28 10:10 - 00001908 _____ C:\Windows\diagwrn.xml
2013-08-28 09:12 - 2013-08-28 10:10 - 00001908 _____ C:\Windows\diagerr.xml
2013-08-28 08:36 - 2013-08-28 08:36 - 00000000 ____D C:\Windows\TempFED4D5F7-99A4-7D94-932F-0003A7B9363E-Signatures
2013-08-27 20:04 - 2013-08-27 20:04 - 00000036 _____ C:\Users\ESTELL~1\AppData\Local\housecall.guid.cache
2013-08-27 19:44 - 2013-08-27 19:44 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Computer Virus Scans
2013-08-27 19:29 - 2013-08-27 19:29 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-08-27 14:05 - 2013-08-28 10:39 - 00003552 _____ C:\Windows\PFRO.log
2013-08-27 13:49 - 2013-08-27 13:56 - 00000000 ___SD C:\ComboFix
2013-08-27 11:07 - 2013-08-27 11:07 - 00000000 ____D C:\Users\Estelle Clark\Documents\Freemake
2013-08-26 10:24 - 2013-08-26 10:24 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\x264 Video Codec
2013-08-26 10:24 - 2013-08-26 10:24 - 00000000 ____D C:\Program Files\x264 Video Codec
2013-08-26 09:41 - 2013-08-26 11:05 - 00000000 ____D C:\Users\Estelle Clark\Downloads\The Butler 2013 English (DVDScr)
2013-08-25 01:00 - 2013-08-28 11:26 - 00001003 _____ C:\Windows\setupact.log
2013-08-25 01:00 - 2013-08-28 09:12 - 00000000 _____ C:\Windows\setuperr.log
2013-08-24 15:04 - 2013-08-24 15:04 - 00016327 _____ C:\Users\Estelle Clark\Documents\Anti  Aging  Urls-1.txt
2013-08-24 14:36 - 2013-05-22 14:25 - 00016327 _____ C:\Users\Estelle Clark\Documents\Anti  Aging  Urls.txt
2013-08-24 14:36 - 2013-05-22 14:21 - 00016327 _____ C:\Users\Estelle Clark\Documents\Anti-Aging-Urls.txt
2013-08-24 13:18 - 2013-08-24 17:08 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Ideal crochet
2013-08-24 03:25 - 2013-08-24 04:03 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Crochet Patterns for Dummies
2013-08-24 02:48 - 2013-08-25 07:40 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Crochet Bags - 4 Books
2013-08-24 00:41 - 2013-08-24 00:54 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Hubert Margaret - Easy crochet bags - 2006
2013-08-24 00:36 - 2013-08-27 13:29 - 00000000 ____D C:\Users\Estelle Clark\Downloads\giftjap
2013-08-24 00:24 - 2013-08-24 10:36 - 00245248 _____ C:\Users\Estelle Clark\Documents\Yvonne Family Reunion Booklet.pub
2013-08-23 23:03 - 2013-08-23 23:22 - 00132908 _____ C:\Users\Estelle Clark\Downloads\pray_together.tif
2013-08-23 15:29 - 2013-08-23 16:54 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Pattern Collection
2013-08-23 15:28 - 2013-08-23 15:40 - 00000000 ____D C:\Users\Estelle Clark\Downloads\CROCHET - BAGS
2013-08-23 15:27 - 2013-08-23 15:28 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Encyclopedia of 300 Crochet Patterns, Stitches and Designs
2013-08-23 15:20 - 2013-08-23 15:18 - 00001590 _____ C:\Users\Estelle Clark\Desktop\PDF Password Remover.lnk
2013-08-23 15:03 - 2013-08-23 15:03 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDF Technologies
2013-08-23 14:46 - 2013-08-23 14:46 - 00002960 _____ C:\Users\Estelle Clark\Documents\cc_20130823_144644.reg
2013-08-23 14:26 - 2013-08-23 14:27 - 00000000 ____D C:\Program Files\diamondata
2013-08-23 14:26 - 2013-08-23 14:26 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\BabSolution
2013-08-23 14:26 - 2013-08-23 14:26 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\Babylon
2013-08-23 14:25 - 2013-08-23 14:25 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\YourFileDownloader
2013-08-23 14:24 - 2013-08-23 14:25 - 04556464 _____ (http://yourfiledownloader.com) C:\Users\Estelle Clark\Downloads\Hooked_Scarves-_20_Easy_Crochet_Projects_downloader_us_99535 (1).exe
2013-08-23 09:18 - 2013-08-24 01:53 - 00000000 ____D C:\ProgramData\sauvensHare!
2013-08-23 08:31 - 2013-08-23 08:31 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\iPumper
2013-08-23 08:30 - 2013-08-23 08:30 - 04869064 _____ C:\Users\Estelle Clark\Downloads\unleash_your_thin_Downloader.exe
2013-08-22 21:10 - 2013-08-22 21:11 - 00016183 _____ C:\LJCP1215.log
2013-08-21 13:14 - 2013-08-21 13:14 - 00000000 ____D C:\Users\Estelle Clark\Desktop\New folder (3)
2013-08-21 13:13 - 2013-08-21 13:13 - 00000000 ____D C:\Users\Estelle Clark\Desktop\New folder (2)
2013-08-21 13:13 - 2013-08-21 13:13 - 00000000 ____D C:\Users\Estelle Clark\Desktop\New folder
2013-08-21 00:07 - 2013-08-21 00:07 - 00004399 _____ C:\Users\Estelle Clark\Documents\Email List --  The Gang.txt
2013-08-21 00:06 - 2013-08-21 00:10 - 00002199 _____ C:\Users\Estelle Clark\Documents\The Gang Email List.txt
2013-08-20 16:32 - 2013-08-21 00:09 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-20 00:18 - 2013-08-20 00:18 - 00000000 ____D C:\Program Files\FileOpenerPro
2013-08-19 23:11 - 2013-08-19 23:11 - 00000959 _____ C:\Users\Public\Desktop\PowerISO.lnk
2013-08-19 23:10 - 2013-08-19 23:11 - 00000000 ____D C:\Program Files\PowerISO
2013-08-19 21:09 - 2013-08-19 21:54 - 00000000 ____D C:\Users\Estelle Clark\Desktop\WD Diagnotic Tools
2013-08-19 19:00 - 2013-08-19 19:00 - 00002906 _____ C:\Users\Estelle Clark\Documents\cc_20130819_190005.reg
2013-08-18 19:54 - 2011-05-30 08:42 - 00240640 _____ C:\Windows\system32\xvidvfw.dll
2013-08-18 19:54 - 2011-05-23 04:52 - 00153088 _____ C:\Windows\system32\xvid.ax
2013-08-18 19:54 - 2011-05-23 02:46 - 00645632 _____ C:\Windows\system32\xvidcore.dll
2013-08-18 19:53 - 2013-08-18 20:05 - 00000000 ____D C:\Program Files\Xvid
2013-08-18 19:48 - 2013-08-18 19:49 - 01064088 _____ C:\Users\Estelle Clark\Downloads\ZNES.exe
2013-08-18 18:55 - 2013-08-18 18:55 - 00523776 _____ C:\Users\Estelle Clark\Downloads\Xvid_RocketFuelInstaller.exe
2013-08-15 23:37 - 2013-08-15 23:37 - 00000000 ____D C:\ProgramData\WeCareReminder
2013-08-15 23:34 - 2013-08-15 23:35 - 00000000 ____D C:\Program Files\DefaultTab
2013-08-15 23:34 - 2013-08-15 23:34 - 00000884 __RSH C:\Users\Estelle Clark\ntuser.pol
2013-08-15 23:33 - 2013-08-15 23:33 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\DefaultTab
2013-08-15 15:05 - 2013-08-15 15:05 - 00000000 ____D C:\ProgramData\PC Optimizer Pro
2013-08-15 14:54 - 2013-08-16 13:49 - 00000000 ____D C:\ProgramData\Yahoo!
2013-08-15 09:19 - 2013-08-15 09:19 - 00000000 ____D C:\Users\Estelle Clark\Documents\Micro Niche Finder
2013-08-15 09:09 - 2013-08-16 20:18 - 00000000 ____D C:\ProgramData\savensHarE
2013-08-15 09:03 - 2013-08-15 09:04 - 00301480 _____ (StarApp) C:\Users\Estelle Clark\Downloads\devil-in-the-grove---thurgood-marshall,-the-groveland-boys,-and-the-dawn-of-a-new-america.full.rar.exe
2013-08-15 03:19 - 2013-08-15 03:35 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 03:06 - 2013-07-25 22:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 03:06 - 2013-07-25 22:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 03:06 - 2013-07-25 22:13 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-15 03:06 - 2013-07-25 22:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 03:06 - 2013-07-25 22:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 03:06 - 2013-07-25 22:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 03:06 - 2013-07-25 22:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 03:06 - 2013-07-25 22:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 03:06 - 2013-07-25 22:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 03:06 - 2013-07-25 22:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-15 03:06 - 2013-07-25 22:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-15 03:06 - 2013-07-25 22:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 03:06 - 2013-07-25 22:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 03:06 - 2013-07-25 22:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-15 03:06 - 2013-07-25 21:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 03:06 - 2013-07-25 20:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-14 05:54 - 2013-07-08 23:50 - 00652800 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 05:53 - 2013-07-25 03:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-14 05:53 - 2013-07-18 20:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 05:53 - 2013-07-09 00:03 - 03968960 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 05:53 - 2013-07-09 00:03 - 03913664 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 05:53 - 2013-07-08 23:53 - 01289096 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 05:53 - 2013-07-08 23:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 05:53 - 2013-07-08 23:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 05:53 - 2013-07-08 23:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 05:53 - 2013-07-08 23:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 05:53 - 2013-07-06 00:05 - 01293760 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 05:52 - 2013-06-14 22:38 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-13 07:23 - 2013-08-13 07:23 - 00000857 _____ C:\Users\Estelle Clark\Desktop\µTorrent.lnk
2013-08-13 07:23 - 2013-08-13 07:23 - 00000837 _____ C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2013-08-13 07:08 - 2013-08-24 21:35 - 00009728 ___SH C:\Users\Estelle Clark\Thumbs.db
2013-08-11 17:45 - 2013-08-11 17:48 - 00264744 _____ C:\Users\Estelle Clark\Downloads\Dead_Doctors_Dont_Lie_-_2001_(CDrip)_Mp3.exe
2013-08-11 17:30 - 2013-08-11 17:31 - 00824232 _____ (AirInstaller Inc.) C:\Users\Estelle Clark\Downloads\Setup.exe
2013-08-10 07:31 - 2013-08-10 07:31 - 00003967 _____ C:\Users\Estelle Clark\Downloads\mComet.jad
2013-08-10 06:10 - 2013-08-10 06:10 - 00001002 _____ C:\Users\Estelle Clark\Desktop\WinAVI Video Converter.lnk
2013-08-10 06:10 - 2013-08-10 06:10 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinAVI Video Converter
2013-08-10 06:10 - 2013-08-10 06:10 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\WinAVI
2013-08-10 06:10 - 2013-08-10 06:10 - 00000000 ____D C:\Program Files\Video Converter
2013-08-10 05:58 - 2013-08-10 07:04 - 2277607424 _____ C:\Users\Estelle Clark\Redemption - The Stan Tookie Williams Story.vob
2013-08-10 05:56 - 2013-08-10 05:56 - 00001171 _____ C:\Users\Public\Desktop\Free AVI to VOB Converter.lnk
2013-08-10 05:56 - 2013-08-10 05:56 - 00000000 ____D C:\Program Files\free-avi-to-vob-converter
2013-08-10 00:56 - 2013-08-10 05:51 - 00000000 ____D C:\Program Files\AviToDvdFree
2013-08-10 00:56 - 2013-08-10 05:48 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\AvitoDvd
2013-08-10 00:55 - 2013-08-10 00:55 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Babylon
2013-08-10 00:55 - 2013-08-10 00:55 - 00000000 ____D C:\ProgramData\Babylon
2013-08-10 00:35 - 2013-08-10 00:37 - 00000000 ____D C:\Users\Estelle Clark\Documents\CyberLink
2013-08-10 00:30 - 2013-08-10 00:30 - 00000000 ____D C:\Users\Estelle Clark\Documents\HP Photosmart Projects
2013-08-09 19:43 - 2013-08-09 19:43 - 00002119 _____ C:\Users\Public\Desktop\HP Photosmart Essential 3.5.lnk
2013-08-09 19:33 - 2009-07-08 05:51 - 00892928 _____ (Hewlett-Packard Co.) C:\Windows\system32\hpotiop4.dll
2013-08-09 19:33 - 2009-07-08 05:51 - 00675840 _____ (Hewlett-Packard) C:\Windows\system32\hpowiax4.dll
2013-08-09 19:33 - 2009-07-08 05:51 - 00452408 _____ (Hewlett-Packard) C:\Windows\system32\hpzids01.dll
2013-08-09 19:33 - 2009-07-08 05:51 - 00294912 _____ (Hewlett-Packard Co.) C:\Windows\system32\hpovst11.dll
2013-08-09 19:21 - 2013-08-22 21:23 - 00165090 _____ C:\Windows\hpoins13.dat
2013-08-09 19:21 - 2009-10-07 20:25 - 00000457 ____N C:\Windows\hpomdl13.dat
2013-08-09 18:40 - 2013-08-09 19:11 - 219873664 _____ C:\Users\Estelle Clark\Downloads\PS_AIO_C4200_NonNet_Full_Win_WW_130_140.exe
2013-08-09 15:14 - 2013-08-18 21:46 - 00000000 ____D C:\Users\Estelle Clark\Documents\My Kindle Content
2013-08-09 13:36 - 2013-08-09 13:36 - 00000000 ____D C:\Users\Estelle Clark\Documents\My Weblog Posts
2013-08-08 01:25 - 2013-08-08 01:25 - 00000941 _____ C:\Users\Estelle Clark\Downloads\bidwhist.jnlp
2013-08-07 21:27 - 2013-08-24 01:53 - 00000000 ____D C:\Program Files\SaveShare
2013-08-07 21:27 - 2013-08-15 03:57 - 00000000 ____D C:\ProgramData\Savensharree
2013-08-07 21:25 - 2013-08-07 21:25 - 00300752 _____ (StarApp) C:\Users\Estelle Clark\Downloads\Dr John R Christopher School Of Natural Healing.exe
2013-08-07 21:10 - 2013-08-07 21:10 - 00300680 _____ (StarApp) C:\Users\Estelle Clark\Downloads\9 Gerson Therapy Books.exe
2013-08-07 19:07 - 2013-08-07 19:08 - 00823720 _____ (AirInstaller Inc.) C:\Users\Estelle Clark\Downloads\Chrome.exe
2013-08-07 16:20 - 2013-08-07 16:20 - 00001095 _____ C:\Users\Estelle Clark\Desktop\Core Temp.lnk
2013-08-07 16:18 - 2013-08-07 16:18 - 00000000 ____D C:\ProgramData\APN
2013-08-06 15:52 - 2013-08-06 15:52 - 00000161 _____ C:\Users\Estelle Clark\AppData\Roaming\default.rss
2013-08-06 15:50 - 2013-08-10 00:40 - 00000069 _____ C:\Windows\NeroDigital.ini
2013-08-06 13:29 - 2013-08-06 13:30 - 00266096 _____ C:\Users\Estelle Clark\Downloads\Unconfirmed 494536.crdownload
2013-08-05 16:51 - 2013-08-05 16:51 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\TuneUp Software
2013-08-05 16:49 - 2013-08-06 05:44 - 00000000 __SHD C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-08-05 16:49 - 2013-08-05 16:51 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-08-05 15:25 - 2013-08-09 09:50 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Nero
2013-08-05 14:31 - 2013-08-05 14:31 - 00002660 _____ C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
2013-08-05 14:30 - 2013-08-05 14:46 - 00000000 ____D C:\Program Files\Nero
2013-08-05 14:29 - 2013-08-05 15:07 - 00000000 ____D C:\Program Files\Common Files\Nero
2013-08-05 14:29 - 2013-08-05 14:33 - 00000000 ____D C:\ProgramData\Nero
2013-08-05 14:27 - 2006-03-31 12:40 - 02388176 _____ (Microsoft Corporation) C:\Windows\system32\d3dx9_30.dll
2013-08-04 16:11 - 2013-08-04 16:12 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\WinRARPasswordCracker.com
2013-08-04 16:11 - 2013-08-04 16:11 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\WinRARPasswordCracker.com
2013-08-04 16:02 - 2013-08-04 16:10 - 00000000 ____D C:\Program Files\WinRAR-Password Remover
2013-08-04 16:02 - 2013-08-04 16:02 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRar Password Recovery
2013-08-03 10:02 - 2013-08-03 10:02 - 00000000 ____D C:\Users\Estelle Clark\Documents\Fax
2013-08-03 08:37 - 2013-08-03 08:38 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\ExpressFiles
2013-08-01 12:07 - 2013-08-01 12:07 - 00000636 _____ C:\Users\Estelle Clark\Documents\cc_20130801_120729.reg
2013-07-30 12:10 - 2013-08-23 15:18 - 00000000 ____D C:\Program Files\PDF Password Remover
2013-07-30 12:10 - 2013-08-08 03:05 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDF Password Remover
2013-07-30 12:09 - 2013-07-30 12:09 - 01834546 _____ (Weeny Software                                              ) C:\Users\Estelle Clark\Desktop\pdfpasswordremover.exe
2013-07-29 03:00 - 2013-07-29 03:00 - 00000000 ____D C:\Users\Estelle Clark\Documents\Norton Utilities 16

==================== One Month Modified Files and Folders =======

2013-08-28 12:02 - 2013-08-28 12:02 - 00000000 ____D C:\FRST
2013-08-28 12:02 - 2012-09-02 23:03 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\uTorrent
2013-08-28 12:01 - 2013-08-28 12:00 - 01072975 _____ (Farbar) C:\Users\Estelle Clark\Downloads\FRST(1).exe
2013-08-28 12:00 - 2013-08-28 12:00 - 00358507 _____ (Farbar) C:\Users\Estelle Clark\Downloads\FSS.exe
2013-08-28 11:59 - 2013-08-28 11:59 - 01072975 _____ (Farbar) C:\Users\Estelle Clark\Desktop\FRST.exe
2013-08-28 11:59 - 2013-08-28 11:58 - 01072975 _____ (Farbar) C:\Users\Estelle Clark\Downloads\FRST.exe
2013-08-28 11:51 - 2013-08-28 11:51 - 00030976 _____ C:\Windows\system32\Drivers\hitmanpro37.sys
2013-08-28 11:50 - 2013-03-12 16:28 - 00000940 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-819796642-3091356583-714134070-1001UA.job
2013-08-28 11:39 - 2013-08-28 11:39 - 00043600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\aruzztxa.sys
2013-08-28 11:33 - 2009-07-13 23:34 - 00017296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-28 11:33 - 2009-07-13 23:34 - 00017296 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-28 11:26 - 2013-08-25 01:00 - 00001003 _____ C:\Windows\setupact.log
2013-08-28 11:26 - 2013-03-29 18:22 - 00000384 _____ C:\Windows\Tasks\FinalTorrent Update Checker.job
2013-08-28 11:26 - 2012-12-14 09:19 - 00000292 _____ C:\Windows\Tasks\NUAutoUpdate.job
2013-08-28 11:26 - 2009-07-13 23:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-28 11:22 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\system32\NDF
2013-08-28 11:06 - 2012-09-15 21:05 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-28 10:54 - 2013-08-28 10:54 - 00001228 _____ C:\Users\Estelle Clark\Desktop\Windows Explorer.lnk
2013-08-28 10:44 - 2009-07-13 23:52 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-28 10:43 - 2013-08-28 10:43 - 00001359 _____ C:\Users\Estelle Clark\Desktop\MSASCui.exe - Shortcut.lnk
2013-08-28 10:43 - 2012-08-25 23:23 - 02067547 _____ C:\Windows\WindowsUpdate.log
2013-08-28 10:39 - 2013-08-27 14:05 - 00003552 _____ C:\Windows\PFRO.log
2013-08-28 10:38 - 2013-08-28 10:36 - 00000000 ____D C:\Windows\system32\MpEngineStore
2013-08-28 10:14 - 2012-08-26 21:35 - 00002150 _____ C:\Windows\epplauncher.mif
2013-08-28 10:12 - 2013-08-28 10:12 - 00080906 _____ C:\Users\Public\Documents\HitmanPro_20130828_1011.log
2013-08-28 10:12 - 2013-08-28 09:28 - 00000000 ____D C:\ProgramData\HitmanPro
2013-08-28 10:10 - 2013-08-28 09:12 - 00001908 _____ C:\Windows\diagwrn.xml
2013-08-28 10:10 - 2013-08-28 09:12 - 00001908 _____ C:\Windows\diagerr.xml
2013-08-28 09:12 - 2013-08-25 01:00 - 00000000 _____ C:\Windows\setuperr.log
2013-08-28 08:45 - 2012-12-14 15:23 - 00000334 _____ C:\Windows\Tasks\SpeedDiskSchedule.job
2013-08-28 08:42 - 2013-01-22 04:15 - 00000000 ____D C:\Users\Estelle Clark\Documents\Outlook Files
2013-08-28 08:36 - 2013-08-28 08:36 - 00000000 ____D C:\Windows\TempFED4D5F7-99A4-7D94-932F-0003A7B9363E-Signatures
2013-08-28 07:39 - 2012-12-14 09:19 - 00000284 _____ C:\Windows\Tasks\NUSchedule.job
2013-08-28 07:38 - 2012-12-15 04:00 - 00061232 _____ C:\Windows\system32\AppLog.log
2013-08-27 20:04 - 2013-08-27 20:04 - 00000036 _____ C:\Users\ESTELL~1\AppData\Local\housecall.guid.cache
2013-08-27 19:50 - 2013-03-12 16:28 - 00000888 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-819796642-3091356583-714134070-1001Core.job
2013-08-27 19:45 - 2012-11-22 20:00 - 00004518 _____ C:\Users\Estelle Clark\Desktop\Rkill.txt
2013-08-27 19:44 - 2013-08-27 19:44 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Computer Virus Scans
2013-08-27 19:44 - 2012-08-25 22:03 - 00782748 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-27 19:33 - 2012-08-25 23:00 - 00000000 ____D C:\Program Files\Google
2013-08-27 19:29 - 2013-08-27 19:29 - 00000000 ____D C:\TDSSKiller_Quarantine
2013-08-27 18:21 - 2013-03-29 18:18 - 00000000 ____D C:\Program Files\File Type Assistant
2013-08-27 13:56 - 2013-08-27 13:49 - 00000000 ___SD C:\ComboFix
2013-08-27 13:47 - 2009-07-13 23:53 - 00032608 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-27 13:29 - 2013-08-24 00:36 - 00000000 ____D C:\Users\Estelle Clark\Downloads\giftjap
2013-08-27 13:17 - 2012-12-15 14:43 - 00001019 _____ C:\Users\Estelle Clark\Desktop\magicJack.lnk
2013-08-27 13:17 - 2012-12-15 14:43 - 00001005 _____ C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\magicJack.lnk
2013-08-27 13:17 - 2012-12-15 14:42 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\mjusbsp
2013-08-27 11:07 - 2013-08-27 11:07 - 00000000 ____D C:\Users\Estelle Clark\Documents\Freemake
2013-08-26 11:05 - 2013-08-26 09:41 - 00000000 ____D C:\Users\Estelle Clark\Downloads\The Butler 2013 English (DVDScr)
2013-08-26 10:41 - 2012-08-25 23:00 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\Google
2013-08-26 10:30 - 2012-12-24 05:51 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\vlc
2013-08-26 10:24 - 2013-08-26 10:24 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\x264 Video Codec
2013-08-26 10:24 - 2013-08-26 10:24 - 00000000 ____D C:\Program Files\x264 Video Codec
2013-08-25 07:40 - 2013-08-24 02:48 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Crochet Bags - 4 Books
2013-08-24 21:35 - 2013-08-13 07:08 - 00009728 ___SH C:\Users\Estelle Clark\Thumbs.db
2013-08-24 17:08 - 2013-08-24 13:18 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Ideal crochet
2013-08-24 15:04 - 2013-08-24 15:04 - 00016327 _____ C:\Users\Estelle Clark\Documents\Anti  Aging  Urls-1.txt
2013-08-24 10:36 - 2013-08-24 00:24 - 00245248 _____ C:\Users\Estelle Clark\Documents\Yvonne Family Reunion Booklet.pub
2013-08-24 04:03 - 2013-08-24 03:25 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Crochet Patterns for Dummies
2013-08-24 01:53 - 2013-08-23 09:18 - 00000000 ____D C:\ProgramData\sauvensHare!
2013-08-24 01:53 - 2013-08-07 21:27 - 00000000 ____D C:\Program Files\SaveShare
2013-08-24 00:54 - 2013-08-24 00:41 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Hubert Margaret - Easy crochet bags - 2006
2013-08-23 23:22 - 2013-08-23 23:03 - 00132908 _____ C:\Users\Estelle Clark\Downloads\pray_together.tif
2013-08-23 16:54 - 2013-08-23 15:29 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Pattern Collection
2013-08-23 15:40 - 2013-08-23 15:28 - 00000000 ____D C:\Users\Estelle Clark\Downloads\CROCHET - BAGS
2013-08-23 15:28 - 2013-08-23 15:27 - 00000000 ____D C:\Users\Estelle Clark\Downloads\Encyclopedia of 300 Crochet Patterns, Stitches and Designs
2013-08-23 15:18 - 2013-08-23 15:20 - 00001590 _____ C:\Users\Estelle Clark\Desktop\PDF Password Remover.lnk
2013-08-23 15:18 - 2013-07-30 12:10 - 00000000 ____D C:\Program Files\PDF Password Remover
2013-08-23 15:06 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\Registration
2013-08-23 15:03 - 2013-08-23 15:03 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDF Technologies
2013-08-23 14:46 - 2013-08-23 14:46 - 00002960 _____ C:\Users\Estelle Clark\Documents\cc_20130823_144644.reg
2013-08-23 14:44 - 2013-01-02 17:13 - 00000000 ____D C:\Windows\Minidump
2013-08-23 14:27 - 2013-08-23 14:26 - 00000000 ____D C:\Program Files\diamondata
2013-08-23 14:26 - 2013-08-23 14:26 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\BabSolution
2013-08-23 14:26 - 2013-08-23 14:26 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\Babylon
2013-08-23 14:25 - 2013-08-23 14:25 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\YourFileDownloader
2013-08-23 14:25 - 2013-08-23 14:24 - 04556464 _____ (http://yourfiledownloader.com) C:\Users\Estelle Clark\Downloads\Hooked_Scarves-_20_Easy_Crochet_Projects_downloader_us_99535 (1).exe
2013-08-23 09:18 - 2013-05-25 04:38 - 00000000 ____D C:\ProgramData\InstallMate
2013-08-23 08:31 - 2013-08-23 08:31 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\iPumper
2013-08-23 08:30 - 2013-08-23 08:30 - 04869064 _____ C:\Users\Estelle Clark\Downloads\unleash_your_thin_Downloader.exe
2013-08-22 21:23 - 2013-08-09 19:21 - 00165090 _____ C:\Windows\hpoins13.dat
2013-08-22 21:23 - 2012-09-10 15:21 - 00007565 _____ C:\ProgramData\hpzinstall.log
2013-08-22 21:11 - 2013-08-22 21:10 - 00016183 _____ C:\LJCP1215.log
2013-08-21 13:43 - 2009-07-13 23:52 - 00000000 ____D C:\Windows\system32\FxsTmp
2013-08-21 13:14 - 2013-08-21 13:14 - 00000000 ____D C:\Users\Estelle Clark\Desktop\New folder (3)
2013-08-21 13:13 - 2013-08-21 13:13 - 00000000 ____D C:\Users\Estelle Clark\Desktop\New folder (2)
2013-08-21 13:13 - 2013-08-21 13:13 - 00000000 ____D C:\Users\Estelle Clark\Desktop\New folder
2013-08-21 13:04 - 2012-09-06 07:07 - 00000000 ____D C:\Program Files\Mozilla Maintenance Service
2013-08-21 04:07 - 2012-08-25 23:00 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-08-21 04:07 - 2012-08-25 23:00 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2013-08-21 00:10 - 2013-08-21 00:06 - 00002199 _____ C:\Users\Estelle Clark\Documents\The Gang Email List.txt
2013-08-21 00:09 - 2013-08-20 16:32 - 00000000 ____D C:\Program Files\Mozilla Firefox
2013-08-21 00:07 - 2013-08-21 00:07 - 00004399 _____ C:\Users\Estelle Clark\Documents\Email List --  The Gang.txt
2013-08-20 09:51 - 2012-12-18 09:35 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\mIRC
2013-08-20 00:18 - 2013-08-20 00:18 - 00000000 ____D C:\Program Files\FileOpenerPro
2013-08-19 23:11 - 2013-08-19 23:11 - 00000959 _____ C:\Users\Public\Desktop\PowerISO.lnk
2013-08-19 23:11 - 2013-08-19 23:10 - 00000000 ____D C:\Program Files\PowerISO
2013-08-19 21:54 - 2013-08-19 21:09 - 00000000 ____D C:\Users\Estelle Clark\Desktop\WD Diagnotic Tools
2013-08-19 19:48 - 2012-12-18 09:35 - 00000000 ____D C:\Program Files\mIRC
2013-08-19 19:00 - 2013-08-19 19:00 - 00002906 _____ C:\Users\Estelle Clark\Documents\cc_20130819_190005.reg
2013-08-19 18:56 - 2012-08-25 23:31 - 00000000 ____D C:\Windows\Panther
2013-08-18 21:46 - 2013-08-09 15:14 - 00000000 ____D C:\Users\Estelle Clark\Documents\My Kindle Content
2013-08-18 20:05 - 2013-08-18 19:53 - 00000000 ____D C:\Program Files\Xvid
2013-08-18 19:49 - 2013-08-18 19:48 - 01064088 _____ C:\Users\Estelle Clark\Downloads\ZNES.exe
2013-08-18 18:55 - 2013-08-18 18:55 - 00523776 _____ C:\Users\Estelle Clark\Downloads\Xvid_RocketFuelInstaller.exe
2013-08-18 03:03 - 2012-08-26 01:22 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-16 20:18 - 2013-08-15 09:09 - 00000000 ____D C:\ProgramData\savensHarE
2013-08-16 13:49 - 2013-08-15 14:54 - 00000000 ____D C:\ProgramData\Yahoo!
2013-08-15 23:37 - 2013-08-15 23:37 - 00000000 ____D C:\ProgramData\WeCareReminder
2013-08-15 23:35 - 2013-08-15 23:34 - 00000000 ____D C:\Program Files\DefaultTab
2013-08-15 23:34 - 2013-08-15 23:34 - 00000884 __RSH C:\Users\Estelle Clark\ntuser.pol
2013-08-15 23:34 - 2012-08-25 22:05 - 00000000 ____D C:\Users\Estelle Clark
2013-08-15 23:34 - 2009-07-13 21:37 - 00000000 ___HD C:\Windows\system32\GroupPolicy
2013-08-15 23:33 - 2013-08-15 23:33 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\DefaultTab
2013-08-15 15:05 - 2013-08-15 15:05 - 00000000 ____D C:\ProgramData\PC Optimizer Pro
2013-08-15 09:19 - 2013-08-15 09:19 - 00000000 ____D C:\Users\Estelle Clark\Documents\Micro Niche Finder
2013-08-15 09:04 - 2013-08-15 09:03 - 00301480 _____ (StarApp) C:\Users\Estelle Clark\Downloads\devil-in-the-grove---thurgood-marshall,-the-groveland-boys,-and-the-dawn-of-a-new-america.full.rar.exe
2013-08-15 08:33 - 2013-05-26 11:52 - 00000000 ____D C:\Users\Estelle Clark\Documents\AAA Services
2013-08-15 04:35 - 2013-05-24 03:54 - 00000000 ____D C:\Windows\rescache
2013-08-15 04:12 - 2009-07-13 21:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-15 03:57 - 2013-08-07 21:27 - 00000000 ____D C:\ProgramData\Savensharree
2013-08-15 03:35 - 2013-08-15 03:19 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 03:35 - 2009-07-13 21:04 - 00000513 _____ C:\Windows\win.ini
2013-08-15 03:19 - 2012-08-26 11:10 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-13 07:23 - 2013-08-13 07:23 - 00000857 _____ C:\Users\Estelle Clark\Desktop\µTorrent.lnk
2013-08-13 07:23 - 2013-08-13 07:23 - 00000837 _____ C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\µTorrent.lnk
2013-08-13 07:22 - 2012-09-02 23:04 - 00000891 _____ C:\Users\Public\Desktop\µTorrent.lnk
2013-08-12 07:27 - 2012-09-06 07:00 - 01082368 ___SH C:\Users\Estelle Clark\Documents\Thumbs.db
2013-08-11 17:48 - 2013-08-11 17:45 - 00264744 _____ C:\Users\Estelle Clark\Downloads\Dead_Doctors_Dont_Lie_-_2001_(CDrip)_Mp3.exe
2013-08-11 17:43 - 2013-05-02 03:22 - 00000917 _____ C:\Windows\BlogHatter.INI
2013-08-11 17:31 - 2013-08-11 17:30 - 00824232 _____ (AirInstaller Inc.) C:\Users\Estelle Clark\Downloads\Setup.exe
2013-08-11 03:38 - 2013-03-05 05:46 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\WEB2Print
2013-08-10 07:31 - 2013-08-10 07:31 - 00003967 _____ C:\Users\Estelle Clark\Downloads\mComet.jad
2013-08-10 07:04 - 2013-08-10 05:58 - 2277607424 _____ C:\Users\Estelle Clark\Redemption - The Stan Tookie Williams Story.vob
2013-08-10 06:10 - 2013-08-10 06:10 - 00001002 _____ C:\Users\Estelle Clark\Desktop\WinAVI Video Converter.lnk
2013-08-10 06:10 - 2013-08-10 06:10 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinAVI Video Converter
2013-08-10 06:10 - 2013-08-10 06:10 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\WinAVI
2013-08-10 06:10 - 2013-08-10 06:10 - 00000000 ____D C:\Program Files\Video Converter
2013-08-10 06:10 - 2012-11-09 07:55 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\WinAVI
2013-08-10 05:56 - 2013-08-10 05:56 - 00001171 _____ C:\Users\Public\Desktop\Free AVI to VOB Converter.lnk
2013-08-10 05:56 - 2013-08-10 05:56 - 00000000 ____D C:\Program Files\free-avi-to-vob-converter
2013-08-10 05:51 - 2013-08-10 00:56 - 00000000 ____D C:\Program Files\AviToDvdFree
2013-08-10 05:48 - 2013-08-10 00:56 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\AvitoDvd
2013-08-10 00:55 - 2013-08-10 00:55 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Babylon
2013-08-10 00:55 - 2013-08-10 00:55 - 00000000 ____D C:\ProgramData\Babylon
2013-08-10 00:40 - 2013-08-06 15:50 - 00000069 _____ C:\Windows\NeroDigital.ini
2013-08-10 00:37 - 2013-08-10 00:35 - 00000000 ____D C:\Users\Estelle Clark\Documents\CyberLink
2013-08-10 00:30 - 2013-08-10 00:30 - 00000000 ____D C:\Users\Estelle Clark\Documents\HP Photosmart Projects
2013-08-09 19:45 - 2012-09-10 15:53 - 00206660 _____ C:\Windows\hpwins28.dat
2013-08-09 19:43 - 2013-08-09 19:43 - 00002119 _____ C:\Users\Public\Desktop\HP Photosmart Essential 3.5.lnk
2013-08-09 19:36 - 2009-07-13 23:52 - 00000000 ____D C:\Windows\twain_32
2013-08-09 19:22 - 2012-12-01 05:52 - 00007238 _____ C:\Windows\wininit.ini
2013-08-09 19:11 - 2013-08-09 18:40 - 219873664 _____ C:\Users\Estelle Clark\Downloads\PS_AIO_C4200_NonNet_Full_Win_WW_130_140.exe
2013-08-09 13:36 - 2013-08-09 13:36 - 00000000 ____D C:\Users\Estelle Clark\Documents\My Weblog Posts
2013-08-09 09:50 - 2013-08-05 15:25 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Nero
2013-08-08 13:49 - 2012-11-23 20:08 - 00000000 ____D C:\Users\Estelle Clark\Desktop\Adobe Acrobat XI PRO Multilang WiN ALL WORKING Incl. Patch - MPT
2013-08-08 03:05 - 2013-07-30 12:10 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PDF Password Remover
2013-08-08 01:25 - 2013-08-08 01:25 - 00000941 _____ C:\Users\Estelle Clark\Downloads\bidwhist.jnlp
2013-08-07 21:25 - 2013-08-07 21:25 - 00300752 _____ (StarApp) C:\Users\Estelle Clark\Downloads\Dr John R Christopher School Of Natural Healing.exe
2013-08-07 21:10 - 2013-08-07 21:10 - 00300680 _____ (StarApp) C:\Users\Estelle Clark\Downloads\9 Gerson Therapy Books.exe
2013-08-07 19:26 - 2012-09-15 06:23 - 00000000 ____D C:\Program Files\WinRAR
2013-08-07 19:08 - 2013-08-07 19:07 - 00823720 _____ (AirInstaller Inc.) C:\Users\Estelle Clark\Downloads\Chrome.exe
2013-08-07 16:20 - 2013-08-07 16:20 - 00001095 _____ C:\Users\Estelle Clark\Desktop\Core Temp.lnk
2013-08-07 16:18 - 2013-08-07 16:18 - 00000000 ____D C:\ProgramData\APN
2013-08-07 04:22 - 2012-08-25 21:39 - 00238872 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2013-08-06 15:52 - 2013-08-06 15:52 - 00000161 _____ C:\Users\Estelle Clark\AppData\Roaming\default.rss
2013-08-06 13:30 - 2013-08-06 13:29 - 00266096 _____ C:\Users\Estelle Clark\Downloads\Unconfirmed 494536.crdownload
2013-08-06 05:44 - 2013-08-05 16:49 - 00000000 __SHD C:\ProgramData\{C4ABDBC8-1C81-42C9-BFFC-4A68511E9E4F}
2013-08-06 05:44 - 2012-11-13 02:57 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\HpUpdate
2013-08-06 05:44 - 2012-08-26 01:22 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\Microsoft Help
2013-08-05 16:51 - 2013-08-05 16:51 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\TuneUp Software
2013-08-05 16:51 - 2013-08-05 16:49 - 00000000 ____D C:\ProgramData\TuneUp Software
2013-08-05 15:07 - 2013-08-05 14:29 - 00000000 ____D C:\Program Files\Common Files\Nero
2013-08-05 14:46 - 2013-08-05 14:30 - 00000000 ____D C:\Program Files\Nero
2013-08-05 14:33 - 2013-08-05 14:29 - 00000000 ____D C:\ProgramData\Nero
2013-08-05 14:31 - 2013-08-05 14:31 - 00002660 _____ C:\Users\Public\Desktop\Nero StartSmart Essentials.lnk
2013-08-05 14:19 - 2013-05-24 10:38 - 00000000 ____D C:\Users\Estelle Clark\Downloads\MOWG
2013-08-04 16:19 - 2013-07-20 04:36 - 00000000 ____D C:\ProgramData\saofe isave
2013-08-04 16:12 - 2013-08-04 16:11 - 00000000 ____D C:\Users\ESTELL~1\AppData\Local\WinRARPasswordCracker.com
2013-08-04 16:11 - 2013-08-04 16:11 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\WinRARPasswordCracker.com
2013-08-04 16:10 - 2013-08-04 16:02 - 00000000 ____D C:\Program Files\WinRAR-Password Remover
2013-08-04 16:02 - 2013-08-04 16:02 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRar Password Recovery
2013-08-04 14:17 - 2012-09-02 23:04 - 00000000 ____D C:\Program Files\uTorrent
2013-08-03 10:02 - 2013-08-03 10:02 - 00000000 ____D C:\Users\Estelle Clark\Documents\Fax
2013-08-03 08:38 - 2013-08-03 08:37 - 00000000 ____D C:\Users\Estelle Clark\AppData\Roaming\ExpressFiles
2013-08-01 22:36 - 2013-05-22 10:36 - 00000000 ____D C:\Program Files\MOWG Toolbar V17
2013-08-01 12:07 - 2013-08-01 12:07 - 00000636 _____ C:\Users\Estelle Clark\Documents\cc_20130801_120729.reg
2013-07-30 12:09 - 2013-07-30 12:09 - 01834546 _____ (Weeny Software                                              ) C:\Users\Estelle Clark\Desktop\pdfpasswordremover.exe
2013-07-29 03:00 - 2013-07-29 03:00 - 00000000 ____D C:\Users\Estelle Clark\Documents\Norton Utilities 16

ZeroAccess:
C:\Windows\assembly\GAC\Desktop.ini

Files to move or delete:
====================
ZeroAccess:
C:\Users\ESTELL~1\AppData\Local\Google\Desktop\Install\{977e912f-f4b3-4198-a2d9-3f5a73a69f61}
ZeroAccess:
C:\Program Files\Google\Desktop\Install\{977e912f-f4b3-4198-a2d9-3f5a73a69f61}
C:\Users\ESTELL~1\AppData\Local\Temp\catchme.dll
C:\Users\ESTELL~1\AppData\Local\Temp\IntResource.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\BPMNT.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\hc_core.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\ICRCHdler.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\libcurl.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\libeay32.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\libexpatw.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\perfiCrcPerfMonMgr.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\smv.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\ssleay32.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\TmEngDrv.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\tmfbeng.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\tmufeng.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\tscdll32.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\utilClientLoader.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\vsapi32.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\tmase\Inspect.exe
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\tmase\PerfMonitor.exe
C:\Users\ESTELL~1\AppData\Local\Temp\HouseCall\plugin\downloader.plugin.dll
C:\Users\ESTELL~1\AppData\Local\Temp\HCBackup\hcpackage.exe
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\CbsProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\CompatProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\DismCore.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\DismCorePS.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\DismHost.exe
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\DismProv.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\DmiProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\FolderProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\IntlProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\LogProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\MsiProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\OSProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\SmiProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\TransmogProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\UnattendProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\wdscore.dll
C:\Users\ESTELL~1\AppData\Local\Temp\CCD41DF7-896A-4537-B094-DC3E45A4A5B6\WimProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\be29e7f1-71ae-4703-50cb-1d52be512f51\twapi-be29e7f1-71ae-4703-50cb-1d52be512f51.dll
C:\Users\ESTELL~1\AppData\Local\Temp\7190CA19-5F8D-42CE-B983-896AD68FD82E\CbsProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\7190CA19-5F8D-42CE-B983-896AD68FD82E\CompatProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\7190CA19-5F8D-42CE-B983-896AD68FD82E\DismCore.dll
C:\Users\ESTELL~1\AppData\Local\Temp\7190CA19-5F8D-42CE-B983-896AD68FD82E\DismCorePS.dll
C:\Users\ESTELL~1\AppData\Local\Temp\7190CA19-5F8D-42CE-B983-896AD68FD82E\DismHost.exe
C:\Users\ESTELL~1\AppData\Local\Temp\7190CA19-5F8D-42CE-B983-896AD68FD82E\DismProv.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\CbsProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\CompatProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\DismCore.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\DismCorePS.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\DismHost.exe
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\DismProv.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\DmiProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\FolderProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\IntlProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\LogProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\MsiProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\OSProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\SmiProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\TransmogProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\UnattendProvider.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\wdscore.dll
C:\Users\ESTELL~1\AppData\Local\Temp\50C48F9F-9EF2-4B60-94C0-3F5D15D6052B\WimProvider.dll

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-22 03:33

==================== End Of Log ============================

 

 

 

FRST Addition.TXT

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 28-08-2013
Ran by Estelle Clark at 2013-08-28 12:05:34
Running from C:\Users\Estelle Clark\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

 Updater (HKCU Version: 1.2.5.36191)
µTorrent (HKCU Version: 3.3.1.30017)
32 Bit HP CIO Components Installer (Version: 7.1.8)
4500_G510nz_Help (Version: 000.0.439.000)
4500G510nz (Version: 000.0.439.000)
4500G510nz_Software_Min (Version: 000.0.423.000)
7-Zip 9.20
Adobe Acrobat XI Pro (Version: 11.0.00)
Adobe AIR (Version: 3.7.0.2090)
Adobe Creative Suite 6 Master Collection (Version: 6)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)
Adobe Flash Player 11 Plugin (Version: 11.8.800.94)
Adobe Help Manager (Version: 4.0.244)
Adobe Reader X (10.1.4) (Version: 10.1.4)
Adobe SendNow for Microsoft Outlook (Version: 1.0.1.20667)
Adobe Shockwave Player 12.0 (Version: 12.0.2.122)
Adobe Widget Browser (Version: 2.0 Build 230)
Adobe Widget Browser (Version: 2.0.230)
Advertising Center (Version: 0.0.0.1)
AIO_Scan (Version: 130.0.365.000)
Amazon Kindle
A-PDF To Excel
Apple Application Support (Version: 2.3)
Apple Software Update (Version: 2.1.3.127)
BitTorrent (Version: 7.8.0.29421)
BlogHatter Pro 2010 v3.3
BufferChm (Version: 130.0.331.000)
Bulk Rename Utility 2.7.1.2
C4200 (Version: 130.0.365.000)
c4200_Help (Version: 82.0.210.000)
calibre (Version: 0.9.24)
CCleaner (Version: 3.25)
Citrix Online Launcher (Version: 1.0.109)
Common Desktop Agent (Version: 1.62.0)
CoPilot Health Management System (Version: 4.2.584)
Copy (Version: 130.0.428.000)
Core Temp 1.0 RC5 (Version: 1.0)
CyberLink PowerDVD 10 (Version: 10.0.1830)
D3DX10 (Version: 15.4.2368.0902)
DefaultTab (Version: 2.2.16.0)
Definition Update for Microsoft Office 2013 (KB2760587) 32-Bit Edition
Destinations (Version: 130.0.0.0)
DeviceDiscovery (Version: 130.0.465.000)
DocMgr (Version: 130.0.000.000)
DocProc (Version: 13.0.0.0)
DolbyFiles (Version: 0.1)
Dragon NaturallySpeaking 11 (Version: 11.50.100)
DVD Audio Extractor 6.3.0
DVD Audio Ripper 4 (Version: 4.0.53.0804)
DVD43 v4.6.0
DYMO Stamps (Version: 3.3)
EaseUS Data Recovery Wizard 5.6.1
Fast Free Converter (Version: 4.1)
Fax (Version: 130.0.418.000)
File Opener Pro
File Renamer - Basic (Version: 6.3)
File Type Assistant (Version: 2013.4.8.0)
FileZilla Client 3.7.1 (Version: 3.7.1)
FinalTorrent 2012 (Version: 2012.12.09.27)
Free AVI to VOB Converter 1.0.1 (Version: 1.0.1)
Free YouTube Downloader 3.5.128
Freemake Video Downloader (Version: 3.5.1)
Full Uninstall version 2.12 (Version: 2.12)
GnuWin32: Wget-1.11.4-1 (Version: 1.11.4-1)
Google Chrome (Version: 29.0.1547.62)
GoToMeeting 5.5.0.1132 (HKCU Version: 5.5.0.1132)
GPBaseService2 (Version: 130.0.371.000)
HP Customer Participation Program 13.0 (Version: 13.0)
HP Document Manager 2.0 (Version: 2.0)
HP Imaging Device Functions 13.0 (Version: 13.0)
HP Officejet 4500 G510n-z (Version: 13.0)
HP Photosmart C4200 All-In-One Driver Software 13.0 Rel. 1 (Version: 13.0)
HP Photosmart Essential 3.5 (Version: 3.5)
HP Product Detection (Version: 11.14.0006)
HP Smart Web Printing 4.51 (Version: 4.51)
HP Solution Center 13.0 (Version: 13.0)
HP Update (Version: 5.005.000.002)
HPDiagnosticAlert (Version: 1.00.0000)
HPPhotoGadget (Version: 130.0.282.000)
HPPhotoSmartDiscLabelContent1 (Version: 2.04.0000)
HPPhotosmartEssential (Version: 2.04.0000)
HPProductAssistant (Version: 130.0.371.000)
HPSSupply (Version: 130.0.371.000)
HSH Home Buyer's Calculator Suite, 2.2.05 (Version: 2.2.05)
ImagXpress (Version: 7.0.74.0)
InCD Help (Version: 6.4.0.0)
Inpaint 4.3
Intel® Active Management Technology Device Software
Intel® Graphics Media Accelerator Driver (Version: 8.15.10.1930)
Internet Explorer Toolbar 4.8 by SweetPacks (Version: 4.8.0000)
IsoBuster 3.0 (Version: 3.0)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Kindle Azw Drm Removal (Version: 6.0.1)
Kindle DRM Removal (Version: 1.4.1)
LSI Digger (Version: 1.9.3)
LSI Digger (Version: v1.9.3)
Magic ISO Maker v5.5 (build 0272)
magicJack (HKCU Version: 2.0.6073.4413)
MarketResearch (Version: 130.0.374.000)
Micro Niche Finder 5.0 (Version: 5.7.19.0)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft .NET Framework 4 Extended (Version: 4.0.30319)
Microsoft Access database engine 2010 (English) (Version: 14.0.6029.1000)
Microsoft Access MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Access Setup Metadata MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft DCF MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Excel MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Groove MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft InfoPath MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Lync MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Office OSM MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Office OSM UX MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Office Outlook Connector (Version: 14.0.6123.5001)
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017)
Microsoft Office Proofing (English) 2013 (Version: 15.0.4420.1017)
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017)
Microsoft Office Proofing Tools 2013 - Español (Version: 15.0.4420.1017)
Microsoft Office Shared MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Office Shared Setup Metadata MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft OneNote MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Outlook MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft PowerPoint MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Publisher MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft Streets & Trips 2013 (Version: 19.0.18.1100)
Microsoft VC9 runtime libraries (Version: 2.0.0)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Word MUI (English) 2013 (Version: 15.0.4420.1017)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)
mIRC (Version: 7.29)
Mobipocket Converter (Version: )
Mozilla Firefox 23.0.1 (x86 en-US) (Version: 23.0.1)
Mozilla Maintenance Service (Version: 23.0.1)
MSVCRT (Version: 15.4.2862.0708)
MSVCRT110 (Version: 16.4.1108.0727)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
Music Manager
Nero 9 Essentials
Nero BurnRights (Version: 3.4.10.100)
Nero BurnRights Help (Version: 3.4.4.100)
Nero ControlCenter (Version: 9.0.0.1)
Nero CoverDesigner (Version: 4.4.9.203)
Nero CoverDesigner Help (Version: 4.4.9.100)
Nero Disc Copy Gadget (Version: 2.4.22.0)
Nero Disc Copy Gadget Help (Version: 2.4.22.0)
Nero DiscSpeed (Version: 5.4.12.100)
Nero DiscSpeed Help (Version: 5.4.4.100)
Nero DriveSpeed (Version: 4.4.10.100)
Nero DriveSpeed Help (Version: 4.4.4.100)
Nero Express Help (Version: 9.4.14.100)
Nero InfoTool (Version: 6.4.10.100)
Nero InfoTool Help (Version: 6.4.4.100)
Nero Installer (Version: 4.4.9.0)
Nero Online Upgrade (Version: 1.3.0.0)
Nero PhotoSnap (Version: 1.53.2.0)
Nero PhotoSnap Help (Version: 1.53.2.0)
Nero Recode (Version: 4.4.22.54)
Nero Recode Help (Version: 4.4.22.0)
Nero ShowTime (Version: 5.4.0.100)
Nero ShowTime (Version: 5.4.13.202)
Nero StartSmart (Version: 9.4.11.210)
Nero StartSmart Help (Version: 9.4.11.100)
Nero StartSmart OEM (Version: 9.4.10.100)
Nero Vision (Version: 6.4.10.205)
Nero Vision Help (Version: 6.4.8.100)
NeroExpress (Version: 9.4.10.506)
neroxml (Version: 1.0.0)
Network (Version: 130.0.374.000)
Norton Utilities 16 (Version: 16.0)
OCR Software by I.R.I.S. 13.0 (Version: 13.0)
Octoshape add-in for Adobe Flash Player
Open DVD ripper 2.50 Build 439 (Version: 2.50.0.439)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4420.1017)
Pamela Pro 4.7 (Version: 4.7)
PDF Password Remover (Version: 1.0.6)
PDF Settings CS6 (Version: 11.0)
Photo Editor
Photo Stamp Remover 5.2 (Version: 5.2)
PLRExtractor v1.0
PowerISO (Version: 4.8)
PS_AIO_Software_min (Version: 130.0.365.000)
PSPad editor (Version: 4.5.7.2450)
QuickPar 0.9 (Version: 0.9)
QuickTime (Version: 7.73.80.64)
RAR Password Recovery v1.1 RC16 (remove only)
Revo Uninstaller Pro 2.5.8 (Version: 2.5.8)
Samsung Easy Printer Manager (Version: 1.02.49.01(5/23/2012))
Samsung ML-331x Series (Version: 1.31 (1/16/2013))
Samsung Printer Live Update (Version: 1.01.00:04(2013-04-22))
Scan (Version: 13.0.0.0)
Shop for HP Supplies (Version: 13.0)
Skype Click to Call (Version: 6.10.13089)
Skype™ 6.1 (Version: 6.1.129)
SmartWebPrinting (Version: 130.0.457.000)
SolutionCenter (Version: 130.0.373.000)
SQL-Splitter 1.2.0.1
Status (Version: 130.0.469.000)
swMSM (Version: 12.0.0.1)
System Requirements Lab for Intel (Version: 4.5.13.0)
SysTools PDF Watermark Remover v1.0
Toolbox (Version: 130.0.648.000)
TradeManager 2012
TrayApp (Version: 130.0.422.000)
TuneUp Utilities Language Pack (de-DE) (Version: 13.0.3020.2)
UnloadSupport (Version: 11.0.0)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2600217) (Version: 1)
Update for Microsoft .NET Framework 4 Extended (KB2836939) (Version: 1)
Update for Microsoft Access 2013 (KB2760350) 32-Bit Edition
Update for Microsoft Excel 2013 (KB2760339) 32-Bit Edition
Update for Microsoft Lync 2013 (KB2817621) 32-Bit Edition
Update for Microsoft Office 2013 (KB2726954) 32-Bit Edition
Update for Microsoft Office 2013 (KB2726996) 32-Bit Edition
Update for Microsoft Office 2013 (KB2727096) 32-Bit Edition
Update for Microsoft Office 2013 (KB2737954) 32-Bit Edition
Update for Microsoft Office 2013 (KB2752025) 32-Bit Edition
Update for Microsoft Office 2013 (KB2752094) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760224) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760538) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760553) 32-Bit Edition
Update for Microsoft Office 2013 (KB2760610) 32-Bit Edition
Update for Microsoft Office 2013 (KB2767845) 32-Bit Edition
Update for Microsoft Office 2013 (KB2767851) 32-Bit Edition
Update for Microsoft Office 2013 (KB2767860) 32-Bit Edition
Update for Microsoft Office 2013 (KB2768016) 32-Bit Edition
Update for Microsoft Office 2013 (KB2810010) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817320) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817482) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817489) 32-Bit Edition
Update for Microsoft Office 2013 (KB2817492) 32-Bit Edition
Update for Microsoft OneNote 2013 (KB2817467) 32-Bit Edition
Update for Microsoft Outlook 2013 (KB2817629) 32-Bit Edition
Update for Microsoft PowerPoint 2013 (KB2726947) 32-Bit Edition
Update for Microsoft PowerPoint 2013 (KB2810006) 32-Bit Edition
Update for Microsoft SkyDrive Pro (KB2817622) 32-Bit Edition
Update for Microsoft Visio 2013 (KB2810008) 32-Bit Edition
Update for Microsoft Visio Viewer 2013 (KB2768338) 32-Bit Edition
Update for Microsoft Word 2013 (KB2767863) 32-Bit Edition
Update for Microsoft Word 2013 (KB2810086) 32-Bit Edition
Visual C++ 9.0 CRT (x86) WinSXS MSM (Version: 9.0)
Visual C++ 9.0 OpenMP (x86) WinSXS MSM (Version: 9.0)
Visual C++ 9.0 Runtime for Dragon NaturallySpeaking (Version: 11.0.0)
Visual Studio Tools for the Office system 3.0 Runtime
Visual Studio Tools for the Office system 3.0 Runtime (Version: 9.0.21022)
VLC media player 2.0.7 (Version: 2.0.7)
WebReg (Version: 130.0.132.017)
WinAVI Video Converter (Version: 11.0.0.3995)
Windows Live Communications Platform (Version: 16.4.3508.0205)
Windows Live Essentials (Version: 16.4.3508.0205)
Windows Live ID Sign-in Assistant (Version: 7.250.4311.0)
Windows Live Installer (Version: 16.4.3508.0205)
Windows Live PIMT Platform (Version: 16.4.3508.0205)
Windows Live SOXE (Version: 16.4.3508.0205)
Windows Live SOXE Definitions (Version: 16.4.3508.0205)
Windows Live UX Platform (Version: 16.4.3508.0205)
Windows Live UX Platform Language Pack (Version: 16.4.3508.0205)
Windows Live Writer (Version: 16.4.3508.0205)
Windows Live Writer Resources (Version: 16.4.3508.0205)
WinPcap 4.1.2 (Version: 4.1.0.2001)
WinRAR archiver
WinZip 17.5 (Version: 17.5.10480)
xPollinate (Version: 1.0.5)
Xvid Video Codec (Version: 1.3.2)
 

==================== Restore Points  =========================

28-08-2013 15:57:02 Windows Defender Checkpoint

==================== Hosts content: ==========================

2009-07-13 21:04 - 2013-02-06 04:55 - 00445018 ___RA C:\Windows\system32\Drivers\etc\hosts
127.0.0.1    activate.adobe.com
127.0.0.1    practivate.adobe.com
127.0.0.1    activate.adobe.com
127.0.0.1    practivate.adobe.com
127.0.0.1    activate.adobe.com
127.0.0.1    practivate.adobe.com
127.0.0.1    www.007guard.com
127.0.0.1    007guard.com
127.0.0.1    008i.com
127.0.0.1    www.008k.com
127.0.0.1    008k.com
127.0.0.1    www.00hq.com
127.0.0.1    00hq.com
127.0.0.1    010402.com
127.0.0.1    www.032439.com
127.0.0.1    032439.com
127.0.0.1    www.0scan.com
127.0.0.1    0scan.com
127.0.0.1    www.1000gratisproben.com
127.0.0.1    1000gratisproben.com
127.0.0.1    1001namen.com
127.0.0.1    www.1001namen.com
127.0.0.1    100888290cs.com
127.0.0.1    www.100888290cs.com
127.0.0.1    www.100sexlinks.com
127.0.0.1    100sexlinks.com
127.0.0.1    www.10sek.com
127.0.0.1    10sek.com
127.0.0.1    www.1-2005-search.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {001B2D68-F12E-40F3-85E6-218A242CE45A} - System32\Tasks\NUAutoUpdate => C:\Program Files\Symantec\Norton Utilities 16\SULauncher.exe [2012-09-29] (Symantec)
Task: {05EE699F-AB25-42D8-8781-558C5D1D2FAD} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict1 => C:\Windows\System32\ndfapi.dll [2009-07-13] (Microsoft Corporation)
Task: {0D02205A-5BEF-4549-A5FE-86E80D46B976} - System32\Tasks\LaunchApp => C:\Program Files\JustCloud\JustCloud.exe No File
Task: {0E12083C-0335-49DB-9542-BA1EC6D83ECC} - System32\Tasks\Microsoft\Windows\Tcpip\IpAddressConflict2 => C:\Windows\System32\ndfapi.dll [2009-07-13] (Microsoft Corporation)
Task: {18E6D428-D26C-4169-BEDF-3B5BDDC952F6} - System32\Tasks\Microsoft\Windows\Application Experience\ProgramDataUpdater => C:\Windows\System32\aepdu.dll [2010-11-20] (Microsoft Corporation)
Task: {196B3588-1276-4E13-8F1C-F7ECBC6DD2C6} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-21] (Adobe Systems Incorporated)
Task: {1EC9510D-A439-4950-9399-B6399EDF9EA7} - System32\Tasks\Microsoft\Windows\Autochk\Proxy => C:\Windows\System32\acproxy.dll [2009-07-13] (Microsoft Corporation)
Task: {27C675F9-7A8D-4157-ABCB-56FBC25B43E8} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Lenovo-Estelle Clark Lenovo => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2012-10-01] (Microsoft Corporation)
Task: {2EB5E3B9-D2B0-4E50-B8A8-38B702EC6357} - System32\Tasks\Google Updater and Installer => C:\Users\Estelle Clark\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: {3B57FA9C-E373-43FB-8630-EFE9DAF57A5B} - System32\Tasks\AdobeAAMUpdater-1.0-Lenovo-Estelle Clark => C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [2012-09-20] (Adobe Systems Incorporated)
Task: {3F58589A-536D-43E3-84AC-60F6C011C81D} - System32\Tasks\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector => C:\Windows\System32\dfdts.dll [2009-07-13] (Microsoft Corporation)
Task: {41A20181-123F-4A42-A2C0-432CCA241259} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Scan => c:\program files\windows defender\MpCmdRun.exe [2009-07-13] (Microsoft Corporation)
Task: {500300B2-316C-490E-B1FD-90579230A839} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-819796642-3091356583-714134070-1001Core => C:\Users\Estelle Clark\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: {5246E59F-29AB-4350-960E-E09A502B705C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {58D4A93B-809D-4E8B-B347-05040772E64F} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: {5C2C622F-70E9-4194-A7DA-033E827365AD} - System32\Tasks\Microsoft\Windows\Windows Filtering Platform\BfeOnServiceStartTypeChange => C:\Windows\System32\bfe.dll [2010-11-20] (Microsoft Corporation)
Task: {5CDC9F4A-053C-44A2-9A6D-EBF6E5514879} - System32\Tasks\RunAsStdUser Task => C:\Users\Estelle Clark\AppData\Local\gameflakeSA\bin\1.0.10.0\GameFlakeSA.exe No File
Task: {5D87711C-77AF-47C8-AD89-85E9873C3ADA} - System32\Tasks\FinalTorrent Update Checker => C:\Program Files\FinalTorrent\FTCheckForUpdates.exe [2013-03-25] (Bitberry Software)
Task: {606823D3-ADA1-439B-BB72-11F77D3B4980} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-819796642-3091356583-714134070-1001UA => C:\Users\Estelle Clark\AppData\Local\Google\Update\GoogleUpdate.exe [2013-03-12] (Google Inc.)
Task: {6AEBE555-6129-4087-AC73-9E67932FF11F} - System32\Tasks\FGRun => C:\Users\Estelle No File
Task: {781514A3-7F33-4EF2-A10C-ADFBADA37AE0} - System32\Tasks\YourFile DownloaderUpdate => C:\Program Files\YourFileDownloader\YourFileUpdater.exe No File
Task: {80127F54-132F-4F42-8677-DEEC39A6B81F} - System32\Tasks\GoforFilesUpdate => C:\Program Files\GoforFiles\GFFUpdater.exe No File
Task: {86F386A4-6545-4438-BE81-C65326343D42} - System32\Tasks\BuzzSocialPoints_DNS_Checker => C:\Windows\BuzzSocialPointsChecker\BSP_li.exe No File
Task: {881D154E-ABBC-45A4-B360-622372FDDB76} - System32\Tasks\Express FilesUpdate => C:\Program Files\ExpressFiles\EFUpdater.exe No File
Task: {9334C323-F100-4656-9BA0-E4AA69C0F9C2} - System32\Tasks\Microsoft\Windows\SystemRestore\SR => C:\Windows\System32\srrstr.dll [2010-11-20] (Microsoft Corporation)
Task: {9BC5D030-D618-4A5F-9B10-D53DE567920A} - System32\Tasks\WPD\SqmUpload_S-1-5-21-819796642-3091356583-714134070-1001 => C:\Windows\System32\portabledeviceapi.dll [2010-11-20] (Microsoft Corporation)
Task: {9E22E1D3-1D26-4D3D-B49C-B85712FDEDD3} - System32\Tasks\ProgramRefresh-ATFST => C:\Program Files\File Type Assistant\tsasetup.exe [2013-04-11] (                                                            )
Task: {AC8A2CF5-0BF4-4608-B3A1-6EE05531C8A5} - System32\Tasks\NUSchedule => C:\Program Files\Symantec\Norton Utilities 16\nu.exe [2012-09-29] (Symantec)
Task: {B32E7249-4539-4852-955C-4E6CF5BA0DBD} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2012-11-23] (Piriform Ltd)
Task: {B7713C31-494B-4FC5-B1A2-37D25097620C} - System32\Tasks\Go for FilesUpdate => C:\Program Files\GoforFiles\GFFUpdater.exe No File
Task: {C5B5FF57-61F0-4C10-8E7C-0F74AEF76897} - System32\Tasks\Microsoft\Windows\Media Center\mcupdate_scheduled => C:\Windows\ehome\mcupdate.exe [2010-11-20] (Microsoft Corporation)
Task: {C621530C-637E-41BA-885F-17EA8A51D79F} - System32\Tasks\EPUpdater => C:\Users\ESTELL~1\AppData\Roaming\BabSolution\Shared\BabMaint.exe No File
Task: {D3320902-9B44-48CE-BBD1-3246D27F7642} - System32\Tasks\AutoKMS => C:\WINDOWS\AutoKMS\AutoKMS.exe No File
Task: {DEF52FE1-04F6-4F3D-ACA1-5A3BAC9D3186} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {E42F860F-8336-4D60-A62C-1A851919C45D} - System32\Tasks\Microsoft\Windows Defender\MpIdleTask => c:\program files\windows defender\MpCmdRun.exe [2009-07-13] (Microsoft Corporation)
Task: {EAF8C46D-FE97-4A01-BDA6-B583076D57BB} - System32\Tasks\ProgramUpdateCheck => C:\Program Files\File Type Assistant\TSAssist.exe [2013-04-08] (Trusted Software ApS)
Task: {F99B8582-E903-4400-BD41-45F2AF44841C} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {FA9B51BC-7209-4765-9785-C66DC30AE824} - System32\Tasks\YourFile Update => C:\Program Files\YourFileDownloader\YourFileUpdater.exe No File
Task: {FB944D98-0E43-4819-AEAD-95254AF51755} - System32\Tasks\SpeedDiskSchedule => C:\Program Files\Symantec\Norton Utilities 16\Tools\SpeedDisk\ScheduledDefrag.exe [2012-09-29] ()
Task: {FE6E368E-448E-4E47-A539-157CF9647012} - System32\Tasks\Microsoft\Microsoft Antimalware\Microsoft Antimalware Scheduled Scan => c:\Program Files\Microsoft Security Client\MpCmdRun.exe No File
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FinalTorrent Update Checker.job => C:\Program Files\FinalTorrent\FTCheckForUpdates.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-819796642-3091356583-714134070-1001Core.job => C:\Users\Estelle Clark\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-819796642-3091356583-714134070-1001UA.job => C:\Users\Estelle Clark\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\NUAutoUpdate.job => C:\Program Files\Symantec\Norton Utilities 16\SULauncher.exe
Task: C:\Windows\Tasks\NUSchedule.job => C:\Program Files\Symantec\Norton Utilities 16\nu.exe
Task: C:\Windows\Tasks\SpeedDiskSchedule.job => C:\Program Files\Symantec\Norton Utilities 16\Tools\SpeedDisk\ScheduledDefrag.exe

==================== Alternate Data Streams (whitelisted) ==========

AlternateDataStreams: C:\Windows\system32\Drivers\aruzztxa.sys:changelist
AlternateDataStreams: C:\ProgramData\TEMP:03DBFDCF
AlternateDataStreams: C:\ProgramData\TEMP:0FF263E8
AlternateDataStreams: C:\ProgramData\TEMP:792D4CF1
AlternateDataStreams: C:\Users\Estelle Clark\Thumbs.db:encryptable
AlternateDataStreams: C:\Users\Estelle Clark\Documents\Thumbs.db:encryptable

==================== Faulty Device Manager Devices =============

Name: Officejet 4500 G510n-z
Description: Officejet 4500 G510n-z
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: PCI Simple Communications Controller
Description: PCI Simple Communications Controller
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/28/2013 11:26:12 AM) (Source: LMS) (User: NT AUTHORITY)
Description: LMS Service cannot connect to HECI driver

Error: (08/28/2013 11:23:23 AM) (Source: Application Error) (User: )
Description: Faulting application name: firefox.exe, version: 23.0.1.4974, time stamp: 0x520bc252
Faulting module name: xul.dll, version: 23.0.1.4974, time stamp: 0x520bc166
Exception code: 0xc0000005
Fault offset: 0x0017af08
Faulting process id: 0x70c
Faulting application start time: 0xfirefox.exe0
Faulting application path: firefox.exe1
Faulting module path: firefox.exe2
Report Id: firefox.exe3

Error: (08/28/2013 10:57:02 AM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {a4423671-08c1-4692-9ac3-861cafdb06d6}

Error: (08/28/2013 10:39:42 AM) (Source: LMS) (User: NT AUTHORITY)
Description: LMS Service cannot connect to HECI driver

Error: (08/28/2013 10:14:07 AM) (Source: Microsoft Security Client Setup) (User: Lenovo)
Description: HRESULT:0x80070643
Description:Cannot complete the Security Essentials installation. An error has prevented the Security Essentials setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070643. Fatal error during installation.

Error: (08/28/2013 09:11:56 AM) (Source: Application Error) (User: )
Description: Faulting application name: DefaultTabSearch.exe, version: 0.0.0.0, time stamp: 0x51a70ae7
Faulting module name: DefaultTabSearch.exe, version: 0.0.0.0, time stamp: 0x51a70ae7
Exception code: 0xc0000005
Fault offset: 0x00002db0
Faulting process id: 0x1a4
Faulting application start time: 0xDefaultTabSearch.exe0
Faulting application path: DefaultTabSearch.exe1
Faulting module path: DefaultTabSearch.exe2
Report Id: DefaultTabSearch.exe3

Error: (08/28/2013 09:11:49 AM) (Source: LMS) (User: NT AUTHORITY)
Description: LMS Service cannot connect to HECI driver

Error: (08/28/2013 08:52:08 AM) (Source: Application Error) (User: )
Description: Faulting application name: DefaultTabSearch.exe, version: 0.0.0.0, time stamp: 0x51a70ae7
Faulting module name: DefaultTabSearch.exe, version: 0.0.0.0, time stamp: 0x51a70ae7
Exception code: 0xc0000005
Fault offset: 0x00002db0
Faulting process id: 0x650
Faulting application start time: 0xDefaultTabSearch.exe0
Faulting application path: DefaultTabSearch.exe1
Faulting module path: DefaultTabSearch.exe2
Report Id: DefaultTabSearch.exe3

Error: (08/28/2013 08:51:50 AM) (Source: LMS) (User: NT AUTHORITY)
Description: LMS Service cannot connect to HECI driver

Error: (08/28/2013 08:48:52 AM) (Source: Wininit) (User: )
Description: A critical system process, C:\Windows\system32\lsm.exe, failed with status code 1.  The machine must now be restarted.


System errors:
=============
Error: (08/28/2013 11:28:45 AM) (Source: Disk) (User: )
Description: The driver detected a controller error on \Device\Harddisk11\DR11.

Error: (08/28/2013 11:27:25 AM) (Source: Ntfs) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Q:.

Error: (08/28/2013 11:27:25 AM) (Source: Ntfs) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Q:.

Error: (08/28/2013 11:27:25 AM) (Source: Ntfs) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Q:.

Error: (08/28/2013 11:27:25 AM) (Source: DCOM) (User: NT AUTHORITY)
Description: application-specificLocalLaunch{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}{344ED43D-D086-4961-86A6-1106F4ACAD9B}NT AUTHORITYSYSTEMS-1-5-18LocalHost (Using LRPC)

Error: (08/28/2013 11:27:24 AM) (Source: Ntfs) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Q:.

Error: (08/28/2013 11:27:23 AM) (Source: Ntfs) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Q:.

Error: (08/28/2013 11:27:23 AM) (Source: Ntfs) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Q:.

Error: (08/28/2013 11:27:23 AM) (Source: Ntfs) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Q:.

Error: (08/28/2013 11:27:23 AM) (Source: Ntfs) (User: )
Description: The file system structure on the disk is corrupt and unusable.
Please run the chkdsk utility on the volume Q:.


Microsoft Office Sessions:
=========================
Error: (08/28/2013 11:26:12 AM) (Source: LMS)(User: NT AUTHORITY)
Description: LMS Service cannot connect to HECI driver

Error: (08/28/2013 11:23:23 AM) (Source: Application Error)(User: )
Description: firefox.exe23.0.1.4974520bc252xul.dll23.0.1.4974520bc166c00000050017af0870c01cea4096b33257eC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Mozilla Firefox\xul.dll28203760-0ffe-11e3-87c4-001a6b49283c

Error: (08/28/2013 10:57:02 AM) (Source: VSS)(User: )
Description: 0x80070005, Access is denied.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {a4423671-08c1-4692-9ac3-861cafdb06d6}

Error: (08/28/2013 10:39:42 AM) (Source: LMS)(User: NT AUTHORITY)
Description: LMS Service cannot connect to HECI driver

Error: (08/28/2013 10:14:07 AM) (Source: Microsoft Security Client Setup)(User: Lenovo)
Description: HRESULT:0x80070643
Description:Cannot complete the Security Essentials installation. An error has prevented the Security Essentials setup wizard from completing successfully. Please restart your computer and try again. Error code:0x80070643. Fatal error during installation.

Error: (08/28/2013 09:11:56 AM) (Source: Application Error)(User: )
Description: DefaultTabSearch.exe0.0.0.051a70ae7DefaultTabSearch.exe0.0.0.051a70ae7c000000500002db01a401cea3f883231c3aC:\Program Files\DefaultTab\DefaultTabSearch.exeC:\Program Files\DefaultTab\DefaultTabSearch.execb9f8c18-0feb-11e3-a82f-001a6b49283c

Error: (08/28/2013 09:11:49 AM) (Source: LMS)(User: NT AUTHORITY)
Description: LMS Service cannot connect to HECI driver

Error: (08/28/2013 08:52:08 AM) (Source: Application Error)(User: )
Description: DefaultTabSearch.exe0.0.0.051a70ae7DefaultTabSearch.exe0.0.0.051a70ae7c000000500002db065001cea3f5be7742c8C:\Program Files\DefaultTab\DefaultTabSearch.exeC:\Program Files\DefaultTab\DefaultTabSearch.exe068167ec-0fe9-11e3-8731-001a6b49283c

Error: (08/28/2013 08:51:50 AM) (Source: LMS)(User: NT AUTHORITY)
Description: LMS Service cannot connect to HECI driver

Error: (08/28/2013 08:48:52 AM) (Source: Wininit)(User: )
Description: C:\Windows\system32\lsm.exe1


==================== Memory info ===========================

Percentage of memory in use: 69%
Total physical RAM: 2542.3 MB
Available physical RAM: 766.82 MB
Total Pagefile: 5082.88 MB
Available Pagefile: 3313.84 MB
Total Virtual: 2047.88 MB
Available Virtual: 1893.53 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:74.54 GB) (Free:1.08 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Windows 7) (CDROM) (Total:3.59 GB) (Free:0 GB) UDF
Drive e: (NEW VOLUME) (Removable) (Total:7.46 GB) (Free:0.6 GB) FAT32
Drive f: (New Volume) (Removable) (Total:7.19 GB) (Free:4.33 GB) FAT32
Drive g: () (Removable) (Total:14.4 GB) (Free:4.69 GB) FAT32
Drive h: (USB DISK) (Removable) (Total:28.85 GB) (Free:0.9 GB) FAT32
Drive i: (USB DISK) (Removable) (Total:29.81 GB) (Free:5.08 GB) FAT32
Drive j: () (Removable) (Total:14.91 GB) (Free:11.35 GB) NTFS
Drive k: (PNY) (Removable) (Total:30.45 GB) (Free:4.28 GB) NTFS
Drive l: () (Removable) (Total:14.42 GB) (Free:5.13 GB) FAT32
Drive m: (Lexar) (Removable) (Total:29.25 GB) (Free:5.19 GB) NTFS
Drive n: () (Removable) (Total:29.82 GB) (Free:2.21 GB) NTFS
Drive q: () (Removable) (Total:29.27 GB) (Free:29.15 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 75 GB) (Disk ID: 59A8604F)
Partition 1: (Active) - (Size=75 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 29 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0C)

========================================================
Disk: 3 (MBR Code: Windows XP) (Size: 30 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=30 GB) - (Type=07 NTFS)

========================================================
Disk: 4 (MBR Code: Windows XP) (Size: 14 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=14 GB) - (Type=0C)

========================================================
Disk: 5 (MBR Code: Windows XP) (Size: 29 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=29 GB) - (Type=07 NTFS)

========================================================
Disk: 6 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: B4E2B4E2)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0B)

========================================================
Disk: 7 (MBR Code: Windows XP) (Size: 7 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=7 GB) - (Type=0C)

========================================================
Disk: 8 (MBR Code: Windows XP) (Size: 30 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=30 GB) - (Type=07 NTFS)

========================================================
Disk: 9 (MBR Code: Windows XP) (Size: 30 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=30 GB) - (Type=0C)

========================================================
Disk: 10 (MBR Code: Windows XP) (Size: 29 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=29 GB) - (Type=0C)

========================================================
Disk: 11 (Size: 14 GB) (Disk ID: 00000000)
Partition 1: (Not Active) - (Size=14 GB) - (Type=0C)

========================================================
Disk: 12 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Not Active) - (Size=15 GB) - (Type=07 NTFS)

==================== End Of Log ============================

 

 

 

 

 

Please help


Edited by hamluis, 28 August 2013 - 12:52 PM.
Moved from Win 7 to Malware Removal Logs - Hamluis.


BC AdBot (Login to Remove)

 


#2 eclark53

eclark53
  • Topic Starter

  • Members
  • 96 posts
  • OFFLINE
  •  
  • Local time:11:09 PM

Posted 29 August 2013 - 02:12 PM

Problem solved.  Found a program on tweaking.com which solved the known issues.

 

Thanks,



#3 nasdaq

nasdaq

  • Malware Response Team
  • 40,171 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:01:09 AM

Posted 02 September 2013 - 09:50 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

May I suggest you execute these tools just to make sure you are all clean.

Search and delete the AdWare, PUP (Potentially Unwanted Program) installed on your computer.

Please download AdwCleaner by Xplode onto your Desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Click the Report button and the report will open in Notepad.

  • IMPORTANT

  • If you click the Clean button all items listed in the report will be removed.

  • If you find some false positive items or programs that you wish to keep, Close the AdwCleaner windows.

  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click the Scan button and wait for the process to complete.
  • Check off the element(s) you wish to keep.
  • Click on the Clean button follow the prompts.
  • A log file will automatically open after the scan has finished.
  • Please post the content of that log file with your next answer.
  • You can find the log file at C:\AdwCleaner[Sn].txt (n is a number).

  • thisisujrt.gif Please download
    Junkware Removal Tool to your Desktop.
  • Please close your security software to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista or 7, right-mouse click it and select Run as administrator.
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete, depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your Desktop and will automatically open.
  • Please post the contents of JRT.txt into your reply.
  • ===


    Please download and run this DDS Scanning Tool. Nothing will be deleted. It will just give me some additional information about your system.

    Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.

    1: DDS.scr (Not recommended if you use Chrome to download this .scr file. Use the other options.)
    2: DDS.pif
    3: DDS.COM

    Double click on the DDS icon, allow it to run.
    A small box will open, with an explanation about the tool. No input is needed, the scan is running.
    Notepad will open with the results.
    Follow the instructions that pop up for posting the results.Please note: You may have to disable any script protection running if the scan fails to run.

    dds_scr.gif

    Please just paste the contents of the DDS.txt log in your next post. DO NOT attach the log.


    Please paste the logs in your next reply DO NOT ATTACH THEM.
    Let me know what problem persists.
  • [/list]


#4 nasdaq

nasdaq

  • Malware Response Team
  • 40,171 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:01:09 AM

Posted 08 September 2013 - 09:02 AM

Due to the lack of feedback, this topic is now closed.

In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days.

Please include a link to your topic in the Private Message. Thank you.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users