Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Alureon Removal causing start issue due to updated driver


  • This topic is locked This topic is locked
16 replies to this topic

#1 homemedic73

homemedic73

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 22 January 2014 - 01:45 PM

I found the Alureon Virus in my uncles computer used the MSE and WinDefender offline to remove but now Windows 7 will not start. I am getting a bad driver response that gives me error message that says an updated driver is interfering with startup. I Have tried to repair with recovery CD, tried system restore including all choices as well as the Last Known Good Configuration. Even with the LKGC choice I get same message. Is there anyone out there that can help to get past this driver update to get Windows to start up



BC AdBot (Login to Remove)

 


#2 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:57 PM

Posted 22 January 2014 - 08:28 PM


Hello homemedic73

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.


Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

  • Please do not run any tools unless instructed to do so.
    • We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
  • Please do not attach logs or use code boxes, just copy and paste the text.
    • Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
  • Please read every post completely before doing anything.
    • Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
  • Please provide feedback about your experience as we go.
    • A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.
NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:
  • Restart the computer.
  • As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
  • Use the arrow keys to select the Repair your computer menu item.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account an click Next.
To enter System Recovery Options by using Windows installation disc:
  • Insert the installation disc.
  • Restart your computer.
  • If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
  • Click Repair your computer.
  • Select US as the keyboard language settings, and then click Next.
  • Select the operating system you want to repair, and then click Next.
  • Select your user account and click Next.
On the System Recovery Options menu you will get the following options:

    • Startup Repair
      System Restore
      Windows Complete PC Restore
      Windows Memory Diagnostic Tool
      Command Prompt
  • Select Command Prompt
  • In the command window type in notepad and press Enter.
  • The notepad opens. Under File menu select Open.
  • Select "Computer" and find your flash drive letter and close the notepad.
  • In the command window type e:\frst64.exe or e:\frst.exe and press Enter
    Note: Replace letter e with the drive letter of your flash drive.
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • First Press the Scan button.
  • It will make a log (FRST.txt)
I want you to poste the FRST.txt report into your reply to me

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#3 homemedic73

homemedic73
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 23 January 2014 - 11:49 AM

I want to thank you for your quick response I have run the instructions as you posted an I am pasting the results below. I have one of my instructors here at school the line of code it was in and he opened it and it is quite the ugly little beast. I will be waiting your reply on the next step of action.

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-01-2014
Ran by SYSTEM on MININT-2PQ61EG on 23-01-2014 10:04:35
Running from E:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2589992 2011-04-12] (ELAN Microelectronics Corp.)
HKLM\...\Run: [RtHDVBg] - C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe [2188904 2011-01-17] (Realtek Semiconductor)
HKLM\...\Run: [IntelTBRunOnce] - C:\Program Files\Intel\TurboBoost\RunTBGadgetOnce.vbs [4526 2010-11-29] ()
HKLM\...\Run: [Logitech Download Assistant] - C:\Windows\System32\LogiLDA.dll [1832760 2012-09-20] (Logitech, Inc.)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ASUSPRP] - C:\Program Files (x86)\ASUS\APRP\APRP.EXE [3331312 2012-03-06] (ASUSTek Computer Inc.)
HKLM-x32\...\Run: [ASUSWebStorage] - C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe [737104 2011-07-29] (ecareme)
HKLM-x32\...\Run: [SonicMasterTray] - C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe [984400 2010-07-09] (Virage Logic Corporation / Sonic Focus)
HKLM-x32\...\Run: [ATKOSD2] - C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe [5716608 2011-07-21] (ASUS)
HKLM-x32\...\Run: [ATKMEDIA] - C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe [170624 2010-10-07] (ASUS)
HKLM-x32\...\Run: [HControlUser] - C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe [105016 2009-06-19] (ASUS)
HKLM-x32\...\Run: [Wireless Console 3] - C:\Program Files (x86)\ASUS\Wireless Console 3\wcourier.exe [2319536 2011-10-18] (ASUS)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-28] (Nullsoft, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$48eabb5f7c9f130bacb519ae6ffaa1f9\n. ATTENTION! ====> ZeroAccess?
HKU\buzzy\...\Run: [AROReminder] - C:\Program Files (x86)\ARO 2013\ARO.exe [3157336 2013-04-12] (Support.com, Inc.)
HKU\buzzy\...\Run: [Advanced SystemCare 7] - C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCTray.exe [2285344 2013-12-18] (IObit)
AppInit_DLLs-x32: c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll => File Not Found
Startup: C:\Users\BARBARA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Intel® Turbo Boost Technology Monitor 2.0.lnk
ShortcutTarget: Intel® Turbo Boost Technology Monitor 2.0.lnk -> C:\Program Files\Intel\TurboBoost\SignalIslandUi.exe (Intel® Corporation)

==================== Services (Whitelisted) =================

S2 AdvancedSystemCareService7; C:\Program Files (x86)\IObit\Advanced SystemCare 7\ASCService.exe [881440 2013-12-09] (IObit)
S2 LiveUpdateSvc; C:\Program Files (x86)\IObit\LiveUpdate\LiveUpdate.exe [2151200 2013-12-03] (IObit)
S2 IB Updater Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [x]
S2 IBUpdaterService; %SystemRoot%\system32\dmwu.exe [x]
S4 Service Sendori; C:\Program Files (x86)\Sendori\Sendori.Service.exe [x]
S2 sndappv2; C:\Program Files (x86)\Sendori\sndappv2.exe [x]

==================== Drivers (Whitelisted) ====================

S3 kbfiltr; C:\Windows\System32\DRIVERS\kbfiltr.sys [15416 2009-07-20] ( )
S3 AmUStor; system32\drivers\AmUStor.SYS [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-01-23 10:04 - 2014-01-23 10:04 - 00000000 ____D C:\FRST
2014-01-21 16:31 - 2014-01-21 16:31 - 00058016 _____ C:\Users\BARBARA\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-21 16:31 - 2014-01-21 16:31 - 00000000 ____D C:\Users\Default\AppData\Roaming\IObit
2014-01-21 16:31 - 2014-01-21 16:31 - 00000000 ____D C:\Users\Default User\AppData\Roaming\IObit
2014-01-21 16:30 - 2014-01-21 16:30 - 00000000 ____D C:\Users\BARBARA\AppData\Roaming\IObit
2014-01-21 15:05 - 2014-01-21 20:13 - 00000000 ____D C:\Windows\Microsoft Antimalware
2014-01-21 12:44 - 2014-01-21 20:13 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2014-01-21 12:40 - 2014-01-21 12:40 - 170894064 _____ C:\Users\buzzy\Desktop\CyberLink.zip
2014-01-21 12:39 - 2014-01-21 12:39 - 05086865 _____ C:\Users\buzzy\Desktop\Digital Entertainer Ltd.zip
2014-01-21 12:28 - 2014-01-21 12:28 - 00003168 _____ C:\Windows\System32\Tasks\{346444AC-2E32-4185-A445-B37A8C6169B0}
2014-01-21 12:25 - 2014-01-21 12:25 - 00000794 _____ C:\Windows\setupact.log
2014-01-21 12:25 - 2014-01-21 12:25 - 00000000 _____ C:\Windows\setuperr.log
2014-01-21 11:59 - 2014-01-21 11:59 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Sammsoft
2014-01-21 11:25 - 2014-01-21 20:13 - 00000000 ____D C:\Program Files\Microsoft Security Client
2014-01-21 11:09 - 2014-01-21 11:10 - 97243136 _____ C:\Windows\System32\config\components.iodefrag.bak
2014-01-21 11:09 - 2014-01-21 11:09 - 00000000 _____ C:\asc_rdflag
2014-01-21 10:35 - 2013-06-27 16:05 - 00027456 _____ (IObit) C:\Windows\System32\RegistryDefragBootTime.exe
2014-01-21 10:34 - 2014-01-21 10:34 - 97243136 _____ C:\Windows\System32\config\components.iobit
2014-01-21 10:34 - 2014-01-21 10:34 - 69255168 _____ C:\Windows\System32\config\software.iobit
2014-01-21 10:34 - 2014-01-21 10:34 - 00864256 _____ C:\Windows\System32\config\default.iobit
2014-01-21 10:34 - 2014-01-21 10:34 - 00098304 _____ C:\Windows\System32\config\sam.iobit
2014-01-21 10:34 - 2014-01-21 10:34 - 00024576 _____ C:\Windows\System32\config\security.iobit
2014-01-21 10:26 - 2014-01-22 12:31 - 00000000 ____D C:\ProgramData\IObit
2014-01-21 10:26 - 2014-01-22 12:14 - 00000000 ____D C:\Program Files (x86)\IObit
2014-01-21 10:26 - 2014-01-21 13:24 - 00000000 ____D C:\ProgramData\ProductData
2014-01-21 10:26 - 2014-01-21 10:41 - 00002171 _____ C:\Users\Public\Desktop\Advanced SystemCare 7.lnk
2014-01-21 10:26 - 2014-01-21 10:26 - 00003094 _____ C:\Windows\System32\Tasks\ASC7_PerformanceMonitor
2014-01-21 10:26 - 2014-01-21 10:26 - 00002850 _____ C:\Windows\System32\Tasks\ASC7_SkipUac_buzzy
2014-01-21 10:26 - 2014-01-21 10:26 - 00001179 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-01-21 10:26 - 2014-01-21 10:26 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Apple Computer
2014-01-21 10:26 - 2014-01-21 10:26 - 00000000 ____D C:\ProgramData\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-01-21 10:24 - 2014-01-22 12:14 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\IObit
2014-01-21 10:22 - 2014-01-21 10:23 - 35641992 _____ (IObit                                                       ) C:\Users\buzzy\Downloads\advanced-systemcare-setup.exe
2014-01-21 10:03 - 2014-01-21 10:03 - 00001034 _____ C:\Users\buzzy\Desktop\Check PC For Errors.lnk
2014-01-21 10:02 - 2014-01-22 12:31 - 00000000 ____D C:\Program Files (x86)\ARO 2013
2014-01-21 10:00 - 2014-01-21 10:01 - 04579416 _____ (Support.com                                                 ) C:\Users\buzzy\Downloads\ARO2013_uc.exe
2014-01-21 09:56 - 2014-01-22 12:14 - 00000000 ____D C:\Program Files (x86)\WinASO
2014-01-21 09:55 - 2014-01-21 09:55 - 07982008 _____ (X.M.Y International LLC                                     ) C:\Users\buzzy\Downloads\WinASO_RO_v4.8.5.exe
2014-01-21 09:47 - 2014-01-19 12:33 - 00819176 _____ (Google Inc.) C:\Users\buzzy\Desktop\ChromeSetup.exe
2014-01-20 20:50 - 2014-01-21 16:48 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-20 19:58 - 2014-01-21 05:44 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-20 19:58 - 2014-01-20 19:58 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Malwarebytes
2014-01-20 19:58 - 2014-01-20 19:58 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-20 17:11 - 2014-01-20 17:11 - 00000000 ____D C:\ProgramData\Mozilla
2014-01-20 15:28 - 2014-01-20 15:28 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-20 07:02 - 2014-01-20 07:03 - 00000000 ____D C:\Users\Guest\AppData\Roaming\Mozilla
2014-01-20 07:02 - 2014-01-20 07:02 - 00000000 ____D C:\Users\Guest\AppData\Local\Mozilla
2014-01-20 07:01 - 2014-01-20 07:01 - 00000000 ____D C:\Users\Guest\AppData\Roaming\Adobe
2014-01-19 20:09 - 2014-01-19 20:11 - 17888136 _____ (Adobe Systems Incorporated) C:\Users\buzzy\Downloads\install_flash_player.exe
2014-01-19 17:27 - 2014-01-19 17:27 - 00000000 ____D C:\ProgramData\WRData
2014-01-19 14:28 - 2014-01-19 14:28 - 00000000 ____D C:\ProgramData\ErrorEND64
2014-01-19 13:36 - 2014-01-19 13:36 - 00819152 _____ (Google Inc.) C:\Users\buzzy\Downloads\ChromeSetup.exe
2014-01-19 13:24 - 2012-05-02 06:25 - 00232464 _____ (Trend Micro Inc.) C:\Windows\TmNSCIns.dll
2014-01-19 13:24 - 2012-05-02 06:24 - 00525792 _____ (Microsoft Corporation) C:\Windows\DIFxAPI.dll
2014-01-19 13:07 - 2014-01-22 12:31 - 00000000 ____D C:\Program Files\Waterfox
2014-01-19 13:07 - 2014-01-22 12:14 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Mozilla
2014-01-19 13:07 - 2014-01-19 13:07 - 00000884 _____ C:\Users\Public\Desktop\Waterfox.lnk
2014-01-19 13:07 - 2014-01-19 13:07 - 00000000 ____D C:\Users\buzzy\AppData\Local\Mozilla
2014-01-19 12:41 - 2014-01-19 13:24 - 00000000 ____D C:\Users\buzzy\AppData\Local\Trend Micro
2014-01-19 12:30 - 2014-01-19 12:30 - 00001981 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-01-19 12:13 - 2014-01-21 10:41 - 00000000 ___DC C:\Users\buzzy\AppData\Local\MigWiz
2014-01-19 11:41 - 2014-01-22 12:31 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-19 11:41 - 2014-01-21 05:44 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-17 10:56 - 2013-11-26 03:54 - 23183360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-01-17 10:56 - 2013-11-26 02:19 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-01-17 10:56 - 2013-11-26 02:18 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-01-17 10:56 - 2013-11-26 02:11 - 17112576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-01-17 10:56 - 2013-11-26 01:48 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-01-17 10:56 - 2013-11-26 01:46 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-01-17 10:56 - 2013-11-26 01:41 - 02764288 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-01-17 10:56 - 2013-11-26 01:29 - 00053760 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-01-17 10:56 - 2013-11-26 01:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-01-17 10:56 - 2013-11-26 01:23 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-01-17 10:56 - 2013-11-26 01:21 - 00574976 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-01-17 10:56 - 2013-11-26 01:18 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-01-17 10:56 - 2013-11-26 01:18 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-01-17 10:56 - 2013-11-26 01:16 - 00708608 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-01-17 10:56 - 2013-11-26 00:57 - 00218624 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-01-17 10:56 - 2013-11-26 00:38 - 02166784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-01-17 10:56 - 2013-11-26 00:38 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-01-17 10:56 - 2013-11-26 00:35 - 05769216 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-01-17 10:56 - 2013-11-26 00:32 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-01-17 10:56 - 2013-11-26 00:28 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-01-17 10:56 - 2013-11-26 00:16 - 04243968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-01-17 10:56 - 2013-11-26 00:02 - 01995264 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-01-17 10:56 - 2013-11-25 23:48 - 12996608 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-01-17 10:56 - 2013-11-25 23:32 - 01928192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-01-17 10:56 - 2013-11-25 23:26 - 11221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-01-17 10:56 - 2013-11-25 23:07 - 02334208 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-01-17 10:56 - 2013-11-25 22:40 - 01395200 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-01-17 10:56 - 2013-11-25 22:34 - 00817664 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-01-17 10:56 - 2013-11-25 22:34 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-01-17 10:56 - 2013-11-25 22:33 - 01820160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-01-17 10:56 - 2013-11-25 22:27 - 01157632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-01-17 09:08 - 2013-10-14 16:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\System32\IEUDINIT.EXE
2014-01-17 09:08 - 2013-05-09 21:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\System32\wmp.dll
2014-01-17 09:08 - 2013-05-09 21:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\System32\wmploc.DLL
2014-01-17 09:08 - 2013-05-09 20:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2014-01-17 09:08 - 2013-05-09 20:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-01-17 09:05 - 2014-01-17 09:05 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2014-01-17 09:05 - 2014-01-17 09:05 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2014-01-17 09:05 - 2014-01-17 09:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-01-17 09:05 - 2014-01-17 09:05 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2014-01-17 09:05 - 2014-01-17 09:05 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-01-17 09:05 - 2014-01-17 09:05 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 05549504 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00878080 _____ (Microsoft Corporation) C:\Windows\System32\advapi32.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\tdh.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-01-17 08:28 - 2013-11-23 10:26 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2014-01-17 08:28 - 2013-11-23 09:47 - 00465920 _____ (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll
2014-01-17 08:28 - 2013-11-11 18:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2014-01-17 08:28 - 2013-10-29 18:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\System32\msieftp.dll
2014-01-17 08:28 - 2013-10-18 18:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\imagehlp.dll
2014-01-17 08:28 - 2013-10-18 17:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll
2014-01-17 08:28 - 2013-10-03 18:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\drmk.sys
2014-01-17 08:28 - 2013-10-03 17:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\portcls.sys
2014-01-17 08:27 - 2013-10-11 18:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\System32\wshom.ocx
2014-01-17 08:27 - 2013-10-11 18:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\System32\scrrun.dll
2014-01-17 08:27 - 2013-10-11 18:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx
2014-01-17 08:27 - 2013-10-11 18:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll
2014-01-17 08:27 - 2013-10-11 17:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\System32\wscript.exe
2014-01-17 08:27 - 2013-10-11 17:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\System32\cscript.exe
2014-01-17 08:27 - 2013-10-11 17:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe
2014-01-17 08:27 - 2013-10-11 17:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe
2014-01-16 09:37 - 2013-08-01 18:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2014-01-16 09:37 - 2013-08-01 18:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2014-01-16 09:37 - 2013-08-01 18:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\apisetschema.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 18:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2014-01-16 09:37 - 2013-08-01 17:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 17:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2014-01-16 09:37 - 2013-08-01 16:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\System32\smss.exe
2014-01-16 09:37 - 2013-08-01 16:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 16:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 16:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2014-01-16 09:37 - 2013-08-01 16:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2014-01-16 09:36 - 2014-01-16 09:36 - 00000000 ____D C:\Users\buzzy\Desktop\New folder
2014-01-16 09:22 - 2013-11-26 17:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbhub.sys
2014-01-16 09:22 - 2013-11-26 17:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbport.sys
2014-01-16 09:22 - 2013-11-26 17:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbccgp.sys
2014-01-16 09:22 - 2013-11-26 17:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbehci.sys
2014-01-16 09:22 - 2013-11-26 17:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbuhci.sys
2014-01-16 09:22 - 2013-11-26 17:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbohci.sys
2014-01-16 09:22 - 2013-11-26 17:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\usbd.sys
2014-01-16 09:22 - 2013-11-26 03:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\netio.sys
2014-01-16 09:22 - 2013-11-26 02:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys

==================== One Month Modified Files and Folders =======

2014-01-23 10:04 - 2014-01-23 10:04 - 00000000 ____D C:\FRST
2014-01-22 13:13 - 2013-02-02 15:12 - 00000000 ____D C:\Program Files (x86)\Winamp
2014-01-22 12:49 - 2012-10-16 13:24 - 00000000 ____D C:\Looper 1
2014-01-22 12:34 - 2012-11-25 14:38 - 00000000 ____D C:\users\BARBARA
2014-01-22 12:34 - 2012-11-25 14:36 - 00000000 ____D C:\users\Guest
2014-01-22 12:34 - 2012-10-16 07:36 - 00000000 ____D C:\users\buzzy
2014-01-22 12:33 - 2009-07-13 23:45 - 00000000 ____D C:\Program Files\Windows Journal
2014-01-22 12:33 - 2009-07-13 19:20 - 00000000 ___HD C:\Windows\System32\GroupPolicy
2014-01-22 12:32 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\NDF
2014-01-22 12:31 - 2014-01-21 10:26 - 00000000 ____D C:\ProgramData\IObit
2014-01-22 12:31 - 2014-01-21 10:02 - 00000000 ____D C:\Program Files (x86)\ARO 2013
2014-01-22 12:31 - 2014-01-19 13:07 - 00000000 ____D C:\Program Files\Waterfox
2014-01-22 12:31 - 2014-01-19 11:41 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2014-01-22 12:31 - 2013-05-13 10:55 - 00000000 ____D C:\Program Files (x86)\EPSON
2014-01-22 12:31 - 2013-05-13 10:13 - 00000000 ____D C:\Program Files\Common Files\EPSON
2014-01-22 12:31 - 2013-02-28 16:53 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Winamp
2014-01-22 12:31 - 2012-10-15 16:05 - 00000000 ____D C:\ProgramData\P4G
2014-01-22 12:31 - 2012-10-15 16:05 - 00000000 ____D C:\Program Files\ASUS
2014-01-22 12:29 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\registration
2014-01-22 12:14 - 2014-01-21 10:26 - 00000000 ____D C:\Program Files (x86)\IObit
2014-01-22 12:14 - 2014-01-21 10:24 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\IObit
2014-01-22 12:14 - 2014-01-21 09:56 - 00000000 ____D C:\Program Files (x86)\WinASO
2014-01-22 12:14 - 2014-01-19 13:07 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Mozilla
2014-01-22 12:14 - 2013-05-13 10:13 - 00000000 ____D C:\ProgramData\EPSON
2014-01-21 20:13 - 2014-01-21 15:05 - 00000000 ____D C:\Windows\Microsoft Antimalware
2014-01-21 20:13 - 2014-01-21 12:44 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2014-01-21 20:13 - 2014-01-21 11:25 - 00000000 ____D C:\Program Files\Microsoft Security Client
2014-01-21 20:13 - 2014-01-21 10:26 - 00000000 ____D C:\ProgramData\ProductData
2014-01-21 16:58 - 2012-10-16 07:36 - 00000000 ___HD C:\ASUS.DAT
2014-01-21 16:48 - 2014-01-20 20:50 - 00000000 ____D C:\Program Files (x86)\Google
2014-01-21 16:31 - 2014-01-21 16:31 - 00058016 _____ C:\Users\BARBARA\AppData\Local\GDIPFONTCACHEV1.DAT
2014-01-21 16:31 - 2014-01-21 16:31 - 00000000 ____D C:\Users\Default\AppData\Roaming\IObit
2014-01-21 16:31 - 2014-01-21 16:31 - 00000000 ____D C:\Users\Default User\AppData\Roaming\IObit
2014-01-21 16:30 - 2014-01-21 16:30 - 00000000 ____D C:\Users\BARBARA\AppData\Roaming\IObit
2014-01-21 13:55 - 2013-02-24 05:54 - 00000000 ____D C:\Windows\pss
2014-01-21 12:40 - 2014-01-21 12:40 - 170894064 _____ C:\Users\buzzy\Desktop\CyberLink.zip
2014-01-21 12:39 - 2014-01-21 12:39 - 05086865 _____ C:\Users\buzzy\Desktop\Digital Entertainer Ltd.zip
2014-01-21 12:28 - 2014-01-21 12:28 - 00003168 _____ C:\Windows\System32\Tasks\{346444AC-2E32-4185-A445-B37A8C6169B0}
2014-01-21 12:26 - 2009-07-13 21:13 - 00798740 _____ C:\Windows\System32\PerfStringBackup.INI
2014-01-21 12:25 - 2014-01-21 12:25 - 00000794 _____ C:\Windows\setupact.log
2014-01-21 12:25 - 2014-01-21 12:25 - 00000000 _____ C:\Windows\setuperr.log
2014-01-21 12:05 - 2009-07-13 20:45 - 00009920 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-01-21 12:05 - 2009-07-13 20:45 - 00009920 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-01-21 12:01 - 2012-10-15 15:51 - 01207960 _____ C:\Windows\WindowsUpdate.log
2014-01-21 11:59 - 2014-01-21 11:59 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Sammsoft
2014-01-21 11:58 - 2012-10-15 16:06 - 00002358 _____ C:\Windows\System32\AutoRunFilter.ini
2014-01-21 11:58 - 2012-10-15 16:06 - 00001412 _____ C:\Windows\System32\ServiceFilter.ini
2014-01-21 11:57 - 2013-01-17 09:16 - 00000354 _____ C:\Windows\Tasks\ROC_JAN2013_TB_rmv.job
2014-01-21 11:57 - 2009-07-13 21:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2014-01-21 11:10 - 2014-01-21 11:09 - 97243136 _____ C:\Windows\System32\config\components.iodefrag.bak
2014-01-21 11:09 - 2014-01-21 11:09 - 00000000 _____ C:\asc_rdflag
2014-01-21 10:41 - 2014-01-21 10:26 - 00002171 _____ C:\Users\Public\Desktop\Advanced SystemCare 7.lnk
2014-01-21 10:41 - 2014-01-19 12:13 - 00000000 ___DC C:\Users\buzzy\AppData\Local\MigWiz
2014-01-21 10:41 - 2009-07-28 22:03 - 00000000 ____D C:\Windows\Panther
2014-01-21 10:40 - 2012-11-02 06:00 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-01-21 10:34 - 2014-01-21 10:34 - 97243136 _____ C:\Windows\System32\config\components.iobit
2014-01-21 10:34 - 2014-01-21 10:34 - 69255168 _____ C:\Windows\System32\config\software.iobit
2014-01-21 10:34 - 2014-01-21 10:34 - 00864256 _____ C:\Windows\System32\config\default.iobit
2014-01-21 10:34 - 2014-01-21 10:34 - 00098304 _____ C:\Windows\System32\config\sam.iobit
2014-01-21 10:34 - 2014-01-21 10:34 - 00024576 _____ C:\Windows\System32\config\security.iobit
2014-01-21 10:26 - 2014-01-21 10:26 - 00003094 _____ C:\Windows\System32\Tasks\ASC7_PerformanceMonitor
2014-01-21 10:26 - 2014-01-21 10:26 - 00002850 _____ C:\Windows\System32\Tasks\ASC7_SkipUac_buzzy
2014-01-21 10:26 - 2014-01-21 10:26 - 00001179 _____ C:\Users\Public\Desktop\IObit Uninstaller.lnk
2014-01-21 10:26 - 2014-01-21 10:26 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Apple Computer
2014-01-21 10:26 - 2014-01-21 10:26 - 00000000 ____D C:\ProgramData\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-01-21 10:23 - 2014-01-21 10:22 - 35641992 _____ (IObit                                                       ) C:\Users\buzzy\Downloads\advanced-systemcare-setup.exe
2014-01-21 10:03 - 2014-01-21 10:03 - 00001034 _____ C:\Users\buzzy\Desktop\Check PC For Errors.lnk
2014-01-21 10:01 - 2014-01-21 10:00 - 04579416 _____ (Support.com                                                 ) C:\Users\buzzy\Downloads\ARO2013_uc.exe
2014-01-21 09:55 - 2014-01-21 09:55 - 07982008 _____ (X.M.Y International LLC                                     ) C:\Users\buzzy\Downloads\WinASO_RO_v4.8.5.exe
2014-01-21 05:44 - 2014-01-20 19:58 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-01-21 05:44 - 2014-01-19 11:41 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2014-01-21 05:44 - 2009-07-13 21:09 - 00000000 ____D C:\Windows\System32\Tasks\WPD
2014-01-20 19:58 - 2014-01-20 19:58 - 00000000 ____D C:\Users\buzzy\AppData\Roaming\Malwarebytes
2014-01-20 19:58 - 2014-01-20 19:58 - 00000000 ____D C:\ProgramData\Malwarebytes
2014-01-20 17:11 - 2014-01-20 17:11 - 00000000 ____D C:\ProgramData\Mozilla
2014-01-20 15:28 - 2014-01-20 15:28 - 00000000 ____D C:\Windows\System32\Tasks\Safer-Networking
2014-01-20 07:03 - 2014-01-20 07:02 - 00000000 ____D C:\Users\Guest\AppData\Roaming\Mozilla
2014-01-20 07:02 - 2014-01-20 07:02 - 00000000 ____D C:\Users\Guest\AppData\Local\Mozilla
2014-01-20 07:01 - 2014-01-20 07:01 - 00000000 ____D C:\Users\Guest\AppData\Roaming\Adobe
2014-01-19 20:11 - 2014-01-19 20:09 - 17888136 _____ (Adobe Systems Incorporated) C:\Users\buzzy\Downloads\install_flash_player.exe
2014-01-19 17:27 - 2014-01-19 17:27 - 00000000 ____D C:\ProgramData\WRData
2014-01-19 14:28 - 2014-01-19 14:28 - 00000000 ____D C:\ProgramData\ErrorEND64
2014-01-19 14:23 - 2013-09-07 16:41 - 00000000 ____D C:\Windows\System32\MRT
2014-01-19 14:23 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\System32\Msdtc
2014-01-19 13:41 - 2013-02-23 10:43 - 00000000 ____D C:\Users\buzzy\AppData\Local\SwvUpdater
2014-01-19 13:36 - 2014-01-19 13:36 - 00819152 _____ (Google Inc.) C:\Users\buzzy\Downloads\ChromeSetup.exe
2014-01-19 13:31 - 2013-02-11 12:05 - 00001168 _____ C:\Windows\System32\TmInstall.log
2014-01-19 13:24 - 2014-01-19 12:41 - 00000000 ____D C:\Users\buzzy\AppData\Local\Trend Micro
2014-01-19 13:24 - 2012-03-06 02:59 - 00000258 __RSH C:\ProgramData\ntuser.pol
2014-01-19 13:24 - 2012-03-06 02:59 - 00000000 ____D C:\ProgramData\Trend Micro
2014-01-19 13:07 - 2014-01-19 13:07 - 00000884 _____ C:\Users\Public\Desktop\Waterfox.lnk
2014-01-19 13:07 - 2014-01-19 13:07 - 00000000 ____D C:\Users\buzzy\AppData\Local\Mozilla
2014-01-19 13:04 - 2012-03-06 02:48 - 00791354 _____ C:\Windows\SysWOW64\PerfStringBackup.INI
2014-01-19 12:54 - 2012-10-18 15:28 - 00000000 ____D C:\Users\buzzy\AppData\Local\Google
2014-01-19 12:33 - 2014-01-21 09:47 - 00819176 _____ (Google Inc.) C:\Users\buzzy\Desktop\ChromeSetup.exe
2014-01-19 12:30 - 2014-01-19 12:30 - 00001981 _____ C:\Users\Public\Desktop\Adobe Reader X.lnk
2014-01-18 06:55 - 2012-10-15 16:07 - 00045056 _____ C:\Windows\SysWOW64\acovcnt.exe
2014-01-17 19:58 - 2009-07-13 21:08 - 00032552 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2014-01-17 19:47 - 2013-05-12 13:44 - 00000633 _____ C:\Users\buzzy\AppData\Roaming\pacemaker.ini
2014-01-17 10:54 - 2013-01-09 16:35 - 86054176 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-01-17 10:39 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2014-01-17 10:16 - 2009-07-13 21:32 - 00000000 ____D C:\Windows\Offline Web Pages
2014-01-17 10:16 - 2009-07-13 19:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared
2014-01-17 09:05 - 2014-01-17 09:05 - 01228800 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00942592 _____ (Microsoft Corporation) C:\Windows\System32\jsIntl.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00774144 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00626176 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2014-01-17 09:05 - 2014-01-17 09:05 - 00616104 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2014-01-17 09:05 - 2014-01-17 09:05 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00453120 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00413696 _____ (Microsoft Corporation) C:\Windows\System32\html.iec
2014-01-17 09:05 - 2014-01-17 09:05 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2014-01-17 09:05 - 2014-01-17 09:05 - 00296960 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00263376 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00247808 _____ (Microsoft Corporation) C:\Windows\System32\msls31.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00243200 _____ (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00235008 _____ (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00167424 _____ (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00147968 _____ (Microsoft Corporation) C:\Windows\System32\occache.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00143872 _____ (Microsoft Corporation) C:\Windows\System32\wextract.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00135680 _____ (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00131072 _____ (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00105984 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00101376 _____ (Microsoft Corporation) C:\Windows\System32\inseng.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00090112 _____ (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00086016 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00084992 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00081408 _____ (Microsoft Corporation) C:\Windows\System32\icardie.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2014-01-17 09:05 - 2014-01-17 09:05 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2014-01-17 09:05 - 2014-01-17 09:05 - 00062464 _____ (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00052224 _____ (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00040448 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00030208 _____ (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2014-01-17 09:05 - 2014-01-17 09:05 - 00013824 _____ (Microsoft Corporation) C:\Windows\System32\mshta.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00013312 _____ (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2014-01-17 09:05 - 2014-01-17 09:05 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 05549504 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 01732032 _____ (Microsoft Corporation) C:\Windows\System32\ntdll.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00878080 _____ (Microsoft Corporation) C:\Windows\System32\advapi32.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00859648 _____ (Microsoft Corporation) C:\Windows\System32\tdh.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00243712 _____ (Microsoft Corporation) C:\Windows\System32\wow64.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2014-01-17 09:04 - 2014-01-17 09:04 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2014-01-17 09:04 - 2014-01-17 09:04 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2014-01-17 08:55 - 2013-02-11 10:42 - 00000000 ____D C:\Users\buzzy\AppData\Local\Deployment
2014-01-17 08:43 - 2012-10-18 15:41 - 00003926 _____ C:\Windows\System32\Tasks\User_Feed_Synchronization-{65A8505E-74F5-4BF1-B1F0-8FB049D61A9C}
2014-01-16 09:36 - 2014-01-16 09:36 - 00000000 ____D C:\Users\buzzy\Desktop\New folder
2014-01-16 09:27 - 2009-07-13 20:45 - 00275712 _____ C:\Windows\System32\FNTCACHE.DAT
2014-01-16 09:09 - 2009-07-13 19:20 - 00000000 ____D C:\Windows\servicing
2014-01-16 09:04 - 2012-03-06 02:49 - 00000000 ____D C:\ProgramData\Adobe

ZeroAccess:
C:\$Recycle.Bin\S-1-5-21-1924786492-3528150391-1333987427-1000\$48eabb5f7c9f130bacb519ae6ffaa1f9

Files to move or delete:
====================
C:\Users\Public\AlexaNSISPlugin.5568.dll

==================== Known DLLs (Whitelisted) ================

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

TDL4: custom:26000022 <===== ATTENTION!

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2014-01-19 12:56:18
Restore point made on: 2014-01-19 12:56:49
Restore point made on: 2014-01-19 12:57:49
Restore point made on: 2014-01-19 12:59:34
Restore point made on: 2014-01-19 13:37:53
Restore point made on: 2014-01-19 13:42:30
Restore point made on: 2014-01-21 10:02:50
Restore point made on: 2014-01-21 10:03:41
Restore point made on: 2014-01-21 10:16:43
Restore point made on: 2014-01-21 10:26:04
Restore point made on: 2014-01-21 10:52:36
Restore point made on: 2014-01-21 12:08:28
Restore point made on: 2014-01-21 12:16:10
Restore point made on: 2014-01-21 12:27:27
Restore point made on: 2014-01-21 12:28:26

==================== Memory info ===========================

Percentage of memory in use: 15%
Total physical RAM: 3873.14 MB
Available physical RAM: 3264.02 MB
Total Pagefile: 3871.29 MB
Available Pagefile: 3256.99 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:440.76 GB) (Free:383.22 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (GRMCULFRER_EN_) (CDROM) (Total:3.81 GB) (Free:0 GB) CDFS
Drive e: () (Removable) (Total:7.26 GB) (Free:4.41 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: E3102A4B)
Partition 1: (Not Active) - (Size=25 GB) - (Type=1C)
Partition 2: (Active) - (Size=441 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 7 GB) (Disk ID: 00000000)
Partition 1: (Active) - (Size=7 GB) - (Type=0C)

LastRegBack: 2013-09-08 14:33

==================== End Of Log ============================

 

Again I thank you for all your help. Even though I am currently only 2 quarters from my associates degree in Network Systems Administration I haven't had to deal with any Virus situations only malware which was easily removed. I hate that this happened to my unlces computer but I am thoroughly enjoying this learning expierience I am having with this virus. I am eagerly awaiting your reply.



#4 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:57 PM

Posted 23 January 2014 - 12:40 PM



Hello homemedic73



Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt

 
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$48eabb5f7c9f130bacb519ae6ffaa1f9\n. ATTENTION! ====> ZeroAccess?
S2 IB Updater Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [x]
S2 IBUpdaterService; %SystemRoot%\system32\dmwu.exe [x]
C:\$Recycle.Bin\S-1-5-21-1924786492-3528150391-1333987427-1000\$48eabb5f7c9f130bacb519ae6ffaa1f9
C:\Users\Public\AlexaNSISPlugin.5568.dll
TDL4: custom:26000022 <===== ATTENTION!
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST again like we did before but this time press the Fix button just once and wait.
The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Also boot the computer into normal mode and let me know how things are looking.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#5 homemedic73

homemedic73
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 23 January 2014 - 11:39 PM

Okay I have followed the instructions. I thank you for getting me back into Windows....BUT now MSE is no  longer installed and the computer is acting as it did before by not letting IE work or Google it still will not let the Computer protection my Uncle bought to access the internet will not let me reinstall Google. These are things that were happening before. Please tell me me we are starting from scratch with this removal. I will say I am impressed with the code you wrote to get the OS to boot up. I am anxious to learn how to do that as well as other things at school. I am pasting the fix log to this post. I hope to here from you quickly now because I would like to get my uncles computer back to him sometime in the next day or two.

 

 

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 23-01-2014
Ran by SYSTEM at 2014-01-23 22:00:37 Run:1
Running from E:\
Boot Mode: Recovery
==============================================
 
Content of fixlist:
*****************
HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox] C:\$Recycle.Bin\S-1-5-18\$48eabb5f7c9f130bacb519ae6ffaa1f9\n. ATTENTION! ====> ZeroAccess?
S2 IB Updater Updater; C:\Program Files\IB Updater\ExtensionUpdaterService.exe [x]
S2 IBUpdaterService; %SystemRoot%\system32\dmwu.exe [x]
C:\$Recycle.Bin\S-1-5-21-1924786492-3528150391-1333987427-1000\$48eabb5f7c9f130bacb519ae6ffaa1f9
C:\Users\Public\AlexaNSISPlugin.5568.dll
TDL4: custom:26000022 <===== ATTENTION!
*****************
 
HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce\\*Restore => Value deleted successfully.
HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
IB Updater Updater => Service deleted successfully.
IBUpdaterService => Service deleted successfully.
C:\$Recycle.Bin\S-1-5-21-1924786492-3528150391-1333987427-1000\$48eabb5f7c9f130bacb519ae6ffaa1f9 => Moved successfully.
C:\Users\Public\AlexaNSISPlugin.5568.dll => Moved successfully.
 
The operation completed successfully.
The operation completed successfully.
 
==== End of Fixlog ====


#6 homemedic73

homemedic73
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 23 January 2014 - 11:52 PM

Well let me say things re a little different.... I scanned with MSE again and this time no virus found. I guess this means I need to find the registry error and fix it so that Google and IE will work properly. Still curious as to whu Webroot is still not being able to connect to internet to install and update. I have confidence that you will help to finish this. I am so very appreciative of your help.



#7 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:57 PM

Posted 24 January 2014 - 01:33 AM



Hello homemedic73

These are the programs I would like you to run next, if you have any problems with one of these just skip it and move on to the next one.

-AdwCleaner-

Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Double click on AdwCleaner.exe to run the tool.
  • Click on Scan.
  • After the scan is complete click on "Clean"
  • Confirm each time with Ok.
  • Your computer will be rebooted automatically. A text file will open after the restart.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.
-Junkware-Removal-Tool-

Please download Junkware Removal Tool to your desktop.
  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.
When they are complete let me have the two reports and let me know how things are running.

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#8 homemedic73

homemedic73
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 24 January 2014 - 08:07 AM

I have now run the programs you asked me to run. Everything seems to be running fine but the computer still will not allow the Webroot Security to access the internet so that I can register the product key. I am assuming this still has something to do with the Alureon virus because I read that it corrupts drivers and does not let security programs update or install by denying them access to the internet. I am posting both logs below again I really appreciate all the help that you are providing.

 

# AdwCleaner v3.017 - Report created 24/01/2014 at 06:10:48
# Updated 12/01/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : buzzy - BUZZY-PC
# Running from : C:\Users\buzzy\Downloads\AdwCleaner.exe
# Option : Clean
 
***** [ Services ] *****
 
 
***** [ Files / Folders ] *****
 
Folder Deleted : C:\ProgramData\apn
Folder Deleted : C:\Windows\SysWOW64\WNLT
Folder Deleted : C:\Users\buzzy\AppData\Local\Giant Savings Extension
Folder Deleted : C:\Users\buzzy\AppData\Local\SwvUpdater
Folder Deleted : C:\Users\buzzy\AppData\Local\Zoom_Downloader
Folder Deleted : C:\Users\buzzy\AppData\LocalLow\BabylonToolbar
Folder Deleted : C:\Users\buzzy\AppData\LocalLow\Delta
Folder Deleted : C:\Users\buzzy\AppData\LocalLow\Inbox Toolbar
Folder Deleted : C:\Users\buzzy\AppData\Roaming\Babylon
Folder Deleted : C:\Users\buzzy\AppData\Roaming\DriverCure
Folder Deleted : C:\Users\buzzy\AppData\Roaming\SpeedyPC Software
Folder Deleted : C:\Users\BARBARA\AppData\LocalLow\AppGraffiti
Folder Deleted : C:\Users\BARBARA\AppData\LocalLow\Inbox Toolbar
Folder Deleted : C:\Users\BARBARA\AppData\LocalLow\incredibar.com
Folder Deleted : C:\Users\BARBARA\AppData\LocalLow\RebateInformer
File Deleted : C:\alotserviceruntime.log
File Deleted : C:\Users\buzzy\AppData\Roaming\Mozilla\Firefox\Profiles\2z9r561h.default\user.js
File Deleted : C:\Program Files (x86)\Mozilla Firefox\user.js
 
***** [ Shortcuts ] *****
 
 
***** [ Registry ] *****
 
Value Deleted : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Value Deleted : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{FE1DEEEA-DB6D-44B8-83F0-34FC0F9D1052}]
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\heoldelcflnigdllmlopiefhkkobendj
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}
Key Deleted : HKLM\SOFTWARE\Classes\Inbox.Toolbar
Key Deleted : HKLM\SOFTWARE\Classes\Prod.cap
Key Deleted : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\inbox
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\alotservice_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\alotservice_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\App24x7Help_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\App24x7Help_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Giant Savings Extension_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Giant Savings Extension_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Giant Savings Extension-InternalInstaller_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\Giant Savings Extension-InternalInstaller_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasapi32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\wajamupdater_rasmancs
Key Deleted : HKCU\Software\5a0dc88b76fe846
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_karafun_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\SoftonicDownloader_for_karafun_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{72D89EBF-0C5D-4190-91FD-398E45F1D007}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{9DC8FA51-B596-4F77-802C-5B295919C205}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{D616A4A2-7B38-4DBC-9093-6FE7A4A21B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4C836512-BB70-11D2-A5A7-00105A9C91C6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{94496571-6AC5-4836-82D5-D46260C44B17}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{BC9FD17D-30F6-4464-9E53-596A90AFF023}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC99A798-FD3D-4AB4-969E-6071612524F9}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DB797690-40E0-11D2-9BD5-0060082AE372}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{DE9028D0-5FFA-4E69-94E3-89EE8741F468}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{13ABD093-D46F-40DF-A608-47E162EC799D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DB797681-40E0-11D2-9BD5-0060082AE372}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{042DA63B-0933-403D-9395-B49307691690}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8736C681-37A0-40C6-A0F0-4C083409151C}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A1E28287-1A31-4B0F-8D05-AA8C465D3C5A}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{CC99A798-FD3D-4AB4-969E-6071612524F9}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{042DA63B-0933-403D-9395-B49307691690}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25CEE8EC-5730-41BC-8B58-22DDC8AB8C20}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D3D233D5-9F6D-436C-B6C7-E63F77503B30}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D7E97865-918F-41E4-9CD0-25AB1C574CE8}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{6F6A5334-78E9-4D9B-8182-8B41EA8C39EF}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{CCB69577-088B-4004-9ED8-FF5BCC83A039}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{865D7100-82C7-42F4-9C06-860DEC0871B2}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{612AD33D-9824-4E87-8396-92374E91C4BB}
Key Deleted : HKCU\Software\Alexa Internet
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\DataMngr
Key Deleted : HKCU\Software\distromatic
Key Deleted : HKCU\Software\IM
Key Deleted : HKCU\Software\ImInstaller
Key Deleted : HKCU\Software\Inbox Toolbar
Key Deleted : HKCU\Software\InstallCore
Key Deleted : HKCU\Software\Softonic
Key Deleted : HKCU\Software\SpeedyPC Software
Key Deleted : HKCU\Software\wnlt
Key Deleted : HKCU\Software\AppDataLow\Software\Crossrider
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKLM\Software\Babylon
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\firstsearch
Key Deleted : HKLM\Software\Freeze.com
Key Deleted : HKLM\Software\IB Updater
Key Deleted : HKLM\Software\Inbox Toolbar
Key Deleted : HKLM\Software\InstallIQ
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\Software\SpeedyPC Software
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\wnlt
Key Deleted : [x64] HKLM\SOFTWARE\IB Updater
Key Deleted : [x64] HKLM\SOFTWARE\wnlt
 
***** [ Browsers ] *****
 
-\\ Internet Explorer v11.0.9600.16428
 
 
-\\ Mozilla Firefox v
 
[ File : C:\Users\buzzy\AppData\Roaming\Mozilla\Firefox\Profiles\2z9r561h.default\prefs.js ]
 
 
*************************
 
AdwCleaner[R0].txt - [9288 octets] - [24/01/2014 06:09:26]
AdwCleaner[S0].txt - [8821 octets] - [24/01/2014 06:10:48]
 
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [8881 octets] ##########
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by buzzy on Fri 01/24/2014 at  6:39:05.86
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
 
 
~~~ Services
 
 
 
~~~ Registry Values
 
 
 
~~~ Registry Keys
 
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1924786492-3528150391-1333987427-1000\Software\ib updater
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-1924786492-3528150391-1333987427-1000\Software\sweetim
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\caphyon
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\strongvaultapp_rasapi32
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Tracing\strongvaultapp_rasmancs
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{11111111-1111-1111-1111-110211181110}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110211181110}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{48586444-0460-41E3-8FCE-FA3BADF73D4F}
 
 
 
~~~ Files
 
 
 
~~~ Folders
 
Successfully deleted: [Folder] "C:\Users\buzzy\AppData\Roaming\bargainmatch"
Successfully deleted: [Folder] "C:\Users\buzzy\AppData\Roaming\onlinevault"
Successfully deleted: [Folder] "C:\Users\buzzy\AppData\Roaming\pcpowerspeed"
Successfully deleted: [Folder] "C:\ai_recyclebin"
Successfully deleted: [Folder] "C:\Windows\syswow64\ai_recyclebin"
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{0001DD1F-CF1B-4ADF-B0D0-91837F1443F4}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{02C118CA-8C98-4E4C-BCA9-66E4D71FC47F}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{0928F6D3-252B-444B-9138-8F0DFCF0FCC0}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{1D777201-9584-48CE-8787-C7CE692D5744}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{5497688C-CCE4-46E0-B2AF-100F82585F43}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{8D087D47-53EF-49C7-861F-BAB32952EEBD}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{8EC9329E-335E-4D92-8ADD-44CED3453DC5}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{93205851-4CF3-4728-9477-D7971C5E77CA}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{B16D5738-3F6C-45EA-9066-94A78422DD7A}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{B7E6EDF0-EF4B-431E-B61C-87637063CB88}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{BDF442AD-F2B7-452F-BEC4-2A5E88D99968}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{F29B8986-5C83-42E6-B0C8-129CFDD3BA92}
Successfully deleted: [Empty Folder] C:\Users\buzzy\appdata\local\{F9591129-9870-4C44-80FF-41CDBA6C8A52}
 
 
 
~~~ Event Viewer Logs were cleared
 
 
 
 
 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 01/24/2014 at  6:43:13.31
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 


#9 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:57 PM

Posted 24 January 2014 - 06:48 PM


Hello homemedic73

I Would like you to do the following.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"
  • In your next post I need the following
  • Log from Combofix
  • let me know of any problems you may have had
  • How is the computer doing now?
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#10 homemedic73

homemedic73
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 24 January 2014 - 09:10 PM

Okay here is the combo fix log. Internet Explorer is still not responding so I am assuming that Google will not install or load either.

 

ComboFix 14-01-23.02 - buzzy 01/24/2014  19:41:04.1.4 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.1.1033.18.3873.1966 [GMT -6:00]
Running from: c:\users\buzzy\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Local Settings\Temp
c:\windows\msvcr71.dll
.
.
(((((((((((((((((((((((((   Files Created from 2013-12-25 to 2014-01-25  )))))))))))))))))))))))))))))))
.
.
2014-01-25 01:45 . 2014-01-25 01:45    --------    d-----w-    c:\users\Guest\AppData\Local\temp
2014-01-24 15:08 . 2014-01-24 15:08    --------    d-----w-    C:\$WINDOWS.~BT
2014-01-24 14:42 . 2014-01-24 14:47    --------    d-----w-    c:\users\buzzy\AppData\Roaming\GlarySoft
2014-01-24 13:56 . 2014-01-24 13:56    --------    d-----w-    c:\users\buzzy\AppData\Local\DriverTuner
2014-01-24 12:53 . 2014-01-24 12:53    111080    ----a-w-    c:\windows\system32\drivers\WRkrn.sys
2014-01-24 12:39 . 2014-01-24 12:39    --------    d-----w-    c:\windows\ERUNT
2014-01-24 12:09 . 2014-01-24 12:10    --------    d-----w-    C:\AdwCleaner
2014-01-24 05:15 . 2014-01-24 05:15    --------    d-----w-    C:\Intel
2014-01-24 05:06 . 2014-01-24 05:11    --------    d-----w-    c:\program files (x86)\Google
2014-01-23 18:04 . 2014-01-23 18:04    --------    d-----w-    C:\FRST
2014-01-22 00:31 . 2014-01-22 00:31    --------    d-----w-    c:\users\Default\AppData\Roaming\IObit
2014-01-22 00:30 . 2014-01-22 00:30    --------    d-----w-    c:\users\BARBARA\AppData\Roaming\IObit
2014-01-21 23:05 . 2014-01-22 04:13    --------    d-----w-    c:\windows\Microsoft Antimalware
2014-01-21 19:59 . 2014-01-21 19:59    --------    d-----w-    c:\users\buzzy\AppData\Roaming\Sammsoft
2014-01-21 18:35 . 2013-06-28 00:05    27456    ----a-w-    c:\windows\system32\RegistryDefragBootTime.exe
2014-01-21 18:26 . 2014-01-21 18:26    --------    d-----w-    c:\users\buzzy\AppData\Roaming\Apple Computer
2014-01-21 18:26 . 2014-01-24 04:08    --------    d-----w-    c:\programdata\ProductData
2014-01-21 18:26 . 2014-01-21 18:26    --------    d-----w-    c:\programdata\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-01-21 18:26 . 2014-01-22 20:31    --------    d-----w-    c:\programdata\IObit
2014-01-21 18:26 . 2014-01-24 04:09    --------    d-----w-    c:\program files (x86)\IObit
2014-01-21 18:24 . 2014-01-22 20:14    --------    d-----w-    c:\users\buzzy\AppData\Roaming\IObit
2014-01-21 17:56 . 2014-01-24 05:29    --------    d-----w-    c:\program files (x86)\WinASO
2014-01-21 12:37 . 2013-12-16 07:54    10315576    ----a-w-    c:\programdata\Microsoft\Windows Defender\Definition Updates\{204EB920-ED7A-47DC-8774-E785C7E9FD5D}\mpengine.dll
2014-01-21 03:58 . 2014-01-21 03:58    --------    d-----w-    c:\users\buzzy\AppData\Roaming\Malwarebytes
2014-01-21 03:58 . 2014-01-21 03:58    --------    d-----w-    c:\programdata\Malwarebytes
2014-01-21 03:58 . 2014-01-21 13:44    --------    d-----w-    c:\program files (x86)\Malwarebytes' Anti-Malware
2014-01-20 15:02 . 2014-01-20 15:02    --------    d-----w-    c:\users\Guest\AppData\Local\Mozilla
2014-01-20 01:27 . 2014-01-20 01:27    --------    d-----w-    c:\programdata\WRData
2014-01-19 22:28 . 2014-01-19 22:28    --------    d-----w-    c:\programdata\ErrorEND64
2014-01-19 21:24 . 2012-05-02 14:25    232464    ----a-w-    c:\windows\TmNSCIns.dll
2014-01-19 21:24 . 2012-05-02 14:24    525792    ----a-w-    c:\windows\DIFxAPI.dll
2014-01-19 21:07 . 2014-01-19 21:07    --------    d-----w-    c:\users\buzzy\AppData\Local\Mozilla
2014-01-19 21:07 . 2014-01-22 20:31    --------    d-----w-    c:\program files\Waterfox
2014-01-19 21:02 . 2014-01-22 20:32    --------    d-----w-    c:\windows\Migration
2014-01-19 21:02 . 2014-01-19 21:02    --------    d-----w-    C:\temp
2014-01-19 20:41 . 2014-01-19 21:24    --------    d-----w-    c:\users\buzzy\AppData\Local\Trend Micro
2014-01-19 20:13 . 2014-01-24 22:47    --------    dc----w-    c:\users\buzzy\AppData\Local\MigWiz
2014-01-19 19:41 . 2014-01-21 13:44    --------    d-----w-    c:\programdata\Spybot - Search & Destroy
2014-01-19 19:41 . 2014-01-22 20:31    --------    d-----w-    c:\program files (x86)\Spybot - Search & Destroy 2
2014-01-19 19:39 . 2014-01-19 19:39    --------    d-----w-    c:\users\buzzy\AppData\Local\Programs
2014-01-17 17:08 . 2013-05-10 04:30    167424    ----a-w-    c:\program files\Windows Media Player\wmplayer.exe
2014-01-17 17:08 . 2013-05-10 03:48    164864    ----a-w-    c:\program files (x86)\Windows Media Player\wmplayer.exe
2014-01-17 17:08 . 2013-05-10 05:56    12625920    ----a-w-    c:\windows\system32\wmploc.DLL
2014-01-17 17:08 . 2013-05-10 04:56    12625408    ----a-w-    c:\windows\SysWow64\wmploc.DLL
2014-01-17 17:08 . 2013-05-10 05:56    14631424    ----a-w-    c:\windows\system32\wmp.dll
2014-01-17 17:08 . 2013-10-15 00:00    28368    ----a-w-    c:\windows\system32\IEUDINIT.EXE
2014-01-17 17:04 . 2014-01-17 17:04    878080    ----a-w-    c:\windows\system32\advapi32.dll
2014-01-17 16:28 . 2013-10-30 02:32    335360    ----a-w-    c:\windows\system32\msieftp.dll
2014-01-17 16:28 . 2013-11-23 18:26    417792    ----a-w-    c:\windows\SysWow64\WMPhoto.dll
2014-01-17 16:28 . 2013-11-23 17:47    465920    ----a-w-    c:\windows\system32\WMPhoto.dll
2014-01-17 16:28 . 2013-10-19 02:18    81408    ----a-w-    c:\windows\system32\imagehlp.dll
2014-01-17 16:28 . 2013-10-19 01:36    159232    ----a-w-    c:\windows\SysWow64\imagehlp.dll
2014-01-17 16:28 . 2013-11-12 02:23    2048    ----a-w-    c:\windows\system32\tzres.dll
2014-01-17 16:28 . 2013-10-04 02:16    116736    ----a-w-    c:\windows\system32\drivers\drmk.sys
2014-01-17 16:28 . 2013-10-04 01:36    230400    ----a-w-    c:\windows\system32\drivers\portcls.sys
2014-01-17 16:27 . 2013-10-12 02:32    150016    ----a-w-    c:\windows\system32\wshom.ocx
2014-01-17 16:27 . 2013-10-12 02:31    202752    ----a-w-    c:\windows\system32\scrrun.dll
2014-01-17 16:27 . 2013-10-12 02:04    121856    ----a-w-    c:\windows\SysWow64\wshom.ocx
2014-01-17 16:27 . 2013-10-12 02:03    163840    ----a-w-    c:\windows\SysWow64\scrrun.dll
2014-01-17 16:27 . 2013-10-12 01:33    156160    ----a-w-    c:\windows\system32\cscript.exe
2014-01-17 16:27 . 2013-10-12 01:33    168960    ----a-w-    c:\windows\system32\wscript.exe
2014-01-17 16:27 . 2013-10-12 01:15    141824    ----a-w-    c:\windows\SysWow64\wscript.exe
2014-01-17 16:27 . 2013-10-12 01:15    126976    ----a-w-    c:\windows\SysWow64\cscript.exe
2014-01-16 17:22 . 2013-11-27 01:41    343040    ----a-w-    c:\windows\system32\drivers\usbhub.sys
2014-01-16 17:22 . 2013-11-27 01:41    99840    ----a-w-    c:\windows\system32\drivers\usbccgp.sys
2014-01-16 17:22 . 2013-11-27 01:41    53248    ----a-w-    c:\windows\system32\drivers\usbehci.sys
2014-01-16 17:22 . 2013-11-27 01:41    325120    ----a-w-    c:\windows\system32\drivers\usbport.sys
2014-01-16 17:22 . 2013-11-27 01:41    25600    ----a-w-    c:\windows\system32\drivers\usbohci.sys
2014-01-16 17:22 . 2013-11-27 01:41    30720    ----a-w-    c:\windows\system32\drivers\usbuhci.sys
2014-01-16 17:22 . 2013-11-27 01:41    7808    ----a-w-    c:\windows\system32\drivers\usbd.sys
2014-01-16 17:22 . 2013-11-26 10:32    3156480    ----a-w-    c:\windows\system32\win32k.sys
2014-01-16 17:22 . 2013-11-26 11:40    376768    ----a-w-    c:\windows\system32\drivers\netio.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-25 01:47 . 2012-10-16 00:07    45056    ----a-w-    c:\windows\SysWow64\acovcnt.exe
2014-01-19 07:33 . 2013-02-11 21:09    270496    ------w-    c:\windows\system32\MpSigStub.exe
2014-01-17 18:54 . 2013-01-10 00:35    86054176    ----a-w-    c:\windows\system32\MRT.exe
2014-01-17 17:04 . 2014-01-17 17:04    44032    ----a-w-    c:\windows\apppatch\acwow64.dll
2013-12-13 21:26 . 2013-12-13 21:26    195584    ----a-w-    c:\windows\system32\msrating.dll
2013-11-12 02:07 . 2013-12-13 15:18    2048    ----a-w-    c:\windows\SysWow64\tzres.dll
2013-11-07 07:52 . 2013-11-07 07:52    279000    ----a-w-    c:\windows\SysWow64\IntelCpHeciSvc.exe
2013-11-07 07:52 . 2013-11-07 07:52    524800    ----a-w-    c:\windows\system32\iglhsip64.dll
2013-11-07 07:52 . 2013-11-07 07:52    519680    ----a-w-    c:\windows\SysWow64\iglhsip32.dll
2013-11-07 07:52 . 2013-11-07 07:52    515544    ----a-w-    c:\windows\system32\igfxsrvc.exe
2013-11-07 07:52 . 2013-11-07 07:52    439296    ----a-w-    c:\windows\system32\igfxrrus.lrc
2013-11-07 07:52 . 2013-11-07 07:52    439296    ----a-w-    c:\windows\system32\igfxrrom.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438784    ----a-w-    c:\windows\system32\igfxrsky.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438784    ----a-w-    c:\windows\system32\igfxrptg.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438784    ----a-w-    c:\windows\system32\igfxrplk.lrc
2013-11-07 07:52 . 2013-11-07 07:52    437760    ----a-w-    c:\windows\system32\igfxrtrk.lrc
2013-11-07 07:52 . 2013-11-07 07:52    437760    ----a-w-    c:\windows\system32\igfxrsve.lrc
2013-11-07 07:52 . 2013-11-07 07:52    437760    ----a-w-    c:\windows\system32\igfxrslv.lrc
2013-11-07 07:52 . 2013-11-07 07:52    437760    ----a-w-    c:\windows\system32\igfxrptb.lrc
2013-11-07 07:52 . 2013-11-07 07:52    437760    ----a-w-    c:\windows\system32\igfxrnor.lrc
2013-11-07 07:52 . 2013-11-07 07:52    437248    ----a-w-    c:\windows\system32\igfxrtha.lrc
2013-11-07 07:52 . 2013-11-07 07:52    410624    ----a-w-    c:\windows\system32\igfxTMM.dll
2013-11-07 07:52 . 2013-11-07 07:52    272928    ----a-w-    c:\windows\system32\igvpkrng600.bin
2013-11-07 07:52 . 2013-11-07 07:52    216064    ----a-w-    c:\windows\system32\iglhcp64.dll
2013-11-07 07:52 . 2013-11-07 07:52    180224    ----a-w-    c:\windows\SysWow64\iglhcp32.dll
2013-11-07 07:52 . 2013-11-07 07:52    171992    ----a-w-    c:\windows\system32\igfxtray.exe
2013-11-07 07:52 . 2013-11-07 07:52    116224    ----a-w-    c:\windows\system32\igfxCoIn_v3347.dll
2013-11-07 07:52 . 2011-12-20 11:55    64000    ----a-w-    c:\windows\system32\igfxsrvc.dll
2013-11-07 07:52 . 2013-11-07 07:52    440320    ----a-w-    c:\windows\system32\igfxrell.lrc
2013-11-07 07:52 . 2013-11-07 07:52    439808    ----a-w-    c:\windows\system32\igfxrfra.lrc
2013-11-07 07:52 . 2013-11-07 07:52    439808    ----a-w-    c:\windows\system32\igfxresn.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438784    ----a-w-    c:\windows\system32\igfxrnld.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438784    ----a-w-    c:\windows\system32\igfxrita.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438784    ----a-w-    c:\windows\system32\igfxrhrv.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438784    ----a-w-    c:\windows\system32\igfxrdeu.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438272    ----a-w-    c:\windows\system32\igfxrhun.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438272    ----a-w-    c:\windows\system32\igfxrfin.lrc
2013-11-07 07:52 . 2013-11-07 07:52    438272    ----a-w-    c:\windows\system32\igfxrcsy.lrc
2013-11-07 07:52 . 2013-11-07 07:52    437248    ----a-w-    c:\windows\system32\igfxrdan.lrc
2013-11-07 07:52 . 2013-11-07 07:52    435712    ----a-w-    c:\windows\system32\igfxrheb.lrc
2013-11-07 07:52 . 2013-11-07 07:52    435712    ----a-w-    c:\windows\system32\igfxrara.lrc
2013-11-07 07:52 . 2013-11-07 07:52    432128    ----a-w-    c:\windows\system32\igfxrjpn.lrc
2013-11-07 07:52 . 2013-11-07 07:52    431104    ----a-w-    c:\windows\system32\igfxrkor.lrc
2013-11-07 07:52 . 2013-11-07 07:52    429056    ----a-w-    c:\windows\system32\igfxrcht.lrc
2013-11-07 07:52 . 2013-11-07 07:52    428544    ----a-w-    c:\windows\system32\igfxrchs.lrc
2013-11-07 07:52 . 2013-11-07 07:52    384512    ----a-w-    c:\windows\system32\igfxpph.dll
2013-11-07 07:52 . 2013-11-07 07:52    286208    ----a-w-    c:\windows\system32\igfxrenu.lrc
2013-11-07 07:52 . 2011-12-20 11:55    9007616    ----a-w-    c:\windows\system32\igfxress.dll
2013-11-07 07:52 . 2013-11-07 07:52    9728    ----a-w-    c:\windows\system32\IGFXDEVLib.dll
2013-11-07 07:52 . 2013-11-07 07:52    931840    ----a-w-    c:\windows\SysWow64\igfxcmrt32.dll
2013-11-07 07:52 . 2013-11-07 07:52    575488    ----a-w-    c:\windows\system32\igfx11cmrt64.dll
2013-11-07 07:52 . 2013-11-07 07:52    542720    ----a-w-    c:\windows\SysWow64\igfx11cmrt32.dll
2013-11-07 07:52 . 2013-11-07 07:52    442880    ----a-w-    c:\windows\system32\igfxdev.dll
2013-11-07 07:52 . 2013-11-07 07:52    442328    ----a-w-    c:\windows\system32\igfxpers.exe
2013-11-07 07:52 . 2013-11-07 07:52    3511296    ----a-w-    c:\windows\system32\igfxcmjit64.dll
2013-11-07 07:52 . 2013-11-07 07:52    330752    ----a-w-    c:\windows\SysWow64\igfxdv32.dll
2013-11-07 07:52 . 2013-11-07 07:52    3121152    ----a-w-    c:\windows\SysWow64\igfxcmjit32.dll
2013-11-07 07:52 . 2013-11-07 07:52    254936    ----a-w-    c:\windows\system32\igfxext.exe
2013-11-07 07:52 . 2013-11-07 07:52    25088    ----a-w-    c:\windows\SysWow64\igfxexps32.dll
2013-11-07 07:52 . 2013-11-07 07:52    142336    ----a-w-    c:\windows\system32\igfxdo.dll
2013-11-07 07:52 . 2013-11-07 07:52    126976    ----a-w-    c:\windows\system32\igfxcpl.cpl
2013-11-07 07:52 . 2013-11-07 07:52    1040384    ----a-w-    c:\windows\system32\igfxcmrt64.dll
2013-11-07 07:52 . 2011-12-20 11:55    28672    ----a-w-    c:\windows\system32\igfxexps.dll
2013-11-07 07:52 . 2011-12-20 11:55    12617216    ----a-w-    c:\windows\system32\igdumd64.dll
2013-11-07 07:52 . 2013-11-07 07:52    11049472    ----a-w-    c:\windows\SysWow64\igdumd32.dll
2013-11-07 07:52 . 2013-11-07 07:52    5363200    ----a-w-    c:\windows\system32\drivers\igdkmd64.sys
2013-11-07 07:52 . 2013-11-07 07:52    98304    ----a-w-    c:\windows\system32\igdde64.dll
2013-11-07 07:52 . 2013-11-07 07:52    77312    ----a-w-    c:\windows\SysWow64\igdde32.dll
2013-11-07 07:52 . 2013-11-07 07:52    963452    ----a-w-    c:\windows\system32\igcodeckrng600.bin
2013-11-07 07:52 . 2013-11-07 07:52    11176448    ----a-w-    c:\windows\SysWow64\igd10umd32.dll
2013-11-07 07:52 . 2011-12-20 11:55    12859392    ----a-w-    c:\windows\system32\igd10umd64.dll
2013-11-07 07:52 . 2013-11-07 07:52    13031424    ----a-w-    c:\windows\system32\ig4icd64.dll
2013-11-07 07:52 . 2013-11-07 07:52    5904856    ----a-w-    c:\windows\system32\GfxUI.exe
2013-11-07 07:52 . 2013-11-07 07:52    399832    ----a-w-    c:\windows\system32\hkcmd.exe
2013-11-07 07:52 . 2013-11-07 07:52    175104    ----a-w-    c:\windows\system32\gfxSrvc.dll
2013-11-07 07:52 . 2013-11-07 07:52    10812928    ----a-w-    c:\windows\SysWow64\ig4icd32.dll
2013-11-07 07:52 . 2011-12-20 11:55    110592    ----a-w-    c:\windows\system32\hccutils.dll
2013-11-07 07:52 . 2013-11-07 07:52    185816    ----a-w-    c:\windows\system32\difx64.exe
2013-10-30 02:19 . 2013-12-13 15:19    301568    ----a-w-    c:\windows\SysWow64\msieftp.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"ASUSPRP"="c:\program files (x86)\ASUS\APRP\APRP.EXE" [2012-03-06 3331312]
"ASUSWebStorage"="c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe" [2011-07-29 737104]
"SonicMasterTray"="c:\program files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe" [2010-07-10 984400]
"ATKOSD2"="c:\program files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe" [2011-07-21 5716608]
"ATKMEDIA"="c:\program files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe" [2010-10-07 170624]
"HControlUser"="c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe" [2009-06-19 105016]
"Wireless Console 3"="c:\program files (x86)\ASUS\Wireless Console 3\wcourier.exe" [2011-10-19 2319536]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2012-06-28 74752]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"EPLTarget\P0000000000000000"="c:\windows\system32\spool\DRIVERS\x64\3\E_YATIIUE.EXE" [2012-02-28 283232]
.
c:\users\BARBARA\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Intel® Turbo Boost Technology Monitor 2.0.lnk - c:\program files\Intel\TurboBoost\SignalIslandUi.exe [2010-11-29 204288]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
AsusVibeLauncher.lnk - c:\program files (x86)\ASUS\AsusVibe\AsusVibeLauncher.exe /start [2012-3-6 549040]
FancyStart daemon.lnk - c:\windows\Installer\{C944B4C5-1C4D-4D95-8AC0-7CEF13914131}\_77B5857C27147149171BE7.exe -d [2012-10-15 12862]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 sndappv2;sndappv2; [x]
R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [x]
R3 AmUStor;AM USB Stroage Driver;c:\windows\system32\drivers\AmUStor.SYS;c:\windows\SYSNATIVE\drivers\AmUStor.SYS [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 SiSGbeLH;SiS191/SiS190 Ethernet Device NDIS 6.0 Driver;c:\windows\system32\DRIVERS\SiSG664.sys;c:\windows\SYSNATIVE\DRIVERS\SiSG664.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 TurboBoost;Intel® Turbo Boost Technology Monitor 2.0;c:\program files\Intel\TurboBoost\TurboBoost.exe;c:\program files\Intel\TurboBoost\TurboBoost.exe [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 Service Sendori;Service Sendori; [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 WRkrn;WRkrn;c:\windows\System32\drivers\WRkrn.sys;c:\windows\SYSNATIVE\drivers\WRkrn.sys [x]
S1 ATKWMIACPIIO;ATKWMIACPI Driver;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys;c:\program files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [x]
S2 AFBAgent;AFBAgent;c:\windows\system32\FBAgent.exe;c:\windows\SYSNATIVE\FBAgent.exe [x]
S2 ASMMAP64;ASMMAP64;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys;c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [x]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [x]
S2 LiveUpdateSvc;LiveUpdate;c:\program files (x86)\IObit\LiveUpdate\LiveUpdate.exe;c:\program files (x86)\IObit\LiveUpdate\LiveUpdate.exe [x]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [x]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys;c:\windows\SYSNATIVE\DRIVERS\TurboB.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 ETD;ELAN PS/2 Port Input Device;c:\windows\system32\DRIVERS\ETD.sys;c:\windows\SYSNATIVE\DRIVERS\ETD.sys [x]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftfslh.sys [x]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftplaylh.sys [x]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftredirlh.sys [x]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys;c:\windows\SYSNATIVE\DRIVERS\Sftvollh.sys [x]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-01-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-11-02 16:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}]
2014-01-21 18:26    2486592    ----a-w-    c:\program files (x86)\IObit\IObit Uninstaller\UninstallExplorer64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_B]
@="{6D4133E5-0742-4ADC-8A8C-9303440F7190}"
[HKEY_CLASSES_ROOT\CLSID\{6D4133E5-0742-4ADC-8A8C-9303440F7190}]
2011-05-25 07:09    227840    ----a-w-    c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AsusWSShellExt_O]
@="{64174815-8D98-4CE6-8646-4C039977D808}"
[HKEY_CLASSES_ROOT\CLSID\{64174815-8D98-4CE6-8646-4C039977D808}]
2011-05-25 07:09    227840    ----a-w-    c:\program files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSShellExt64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-01-18 2188904]
"IntelTBRunOnce"="wscript.exe" [2013-10-12 168960]
"Logitech Download Assistant"="c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2013-11-07 171992]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2013-11-07 399832]
"Persistence"="c:\windows\system32\igfxpers.exe" [2013-11-07 442328]
.
------- Supplementary Scan -------
.
TCP: DhcpNameServer = 97.64.209.36 97.64.168.13 192.168.1.1
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
Toolbar-Locked - (no file)
HKLM-Run-ETDCtrl - c:\program files (x86)\Elantech\ETDCtrl.exe
.
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_7_700_224_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_7_700_224.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Other Running Processes ------------------------
.
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
c:\program files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Common Files\microsoft shared\virtualization handler\OfficeVirt.exe
c:\program files (x86)\ASUS\FaceLogon\sensorsrv.exe
c:\program files (x86)\ASUS\Splendid\ACMON.exe
c:\program files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
c:\windows\SysWOW64\ACEngSvr.exe
.
**************************************************************************
.
Completion time: 2014-01-24  19:51:31 - machine was rebooted
ComboFix-quarantined-files.txt  2014-01-25 01:51
.
Pre-Run: 416,630,624,256 bytes free
Post-Run: 416,441,155,584 bytes free
.
- - End Of File - - 969201F4DF6BD414E69F6D5238BCD161
 



#11 homemedic73

homemedic73
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 24 January 2014 - 09:32 PM

Another update to my last post:: Google still unresponsive also and Webroot still cannot access internet or be installed.



#12 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:57 PM

Posted 24 January 2014 - 11:07 PM





Hello homemedic73

Malwarebytes Anti-Rootkit

1.Download Malwarebytes Anti-Rootkit
2.Unzip the contents to a folder in a convenient location.
3.Open the folder where the contents were unzipped and run mbar.exe
4.Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
5.Click on the Cleanup button to remove any threats and reboot if prompted to do so.
6.Wait while the system shuts down and the cleanup process is performed.
7.Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
8.If no additional threats were found, verify that your system is now running normally, making sure that the following items are functional:
  • •Internet access
    •Windows Update
    •Windows Firewall
9.If there are additional problems with your system, such as any of those listed above or other system issues, then run the 'fixdamage' tool included with Malwarebytes Anti-Rootkit and reboot.
10.Verify that your system is now functioning normally.


--RogueKiller--

Download & SAVE to your Desktop RogueKiller for 32bit or Roguekiller for 64bit
  • Quit all programs that you may have started.
  • Please disconnect any external drives from the computer before you run this scan!
  • For Vista or Windows 7, right-click and select "Run as Administrator to start"
  • For Windows XP, double-click to start.
  • Wait until Prescan has finished ...
  • Then Click on "Scan" button
  • Wait until the Status box shows "Scan Finished"
  • click on "delete"
  • Wait until the Status box shows "Deleting Finished"
  • Click on "Report" and copy/paste the content of the Notepad into your next reply.
  • the scan will make two reports the one I would like to see is called RKreport[2].txt on your Desktop
  • Exit/Close RogueKiller+
send me the reports made from MBAR and Roguekiller and also let me know how the computer is doing at this time.

Gringo






When you are complete please send me both reports

Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#13 homemedic73

homemedic73
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 25 January 2014 - 01:27 AM

I ran MBAR no infections found but IE still would not work neither would google. Ran the RougeKiller download from your site but did not get any report with a 2 in it so I will post as per the time stamp on the reports. Computer still refuses to let me use IE or Chrome. Waterfox is the only browser I am able to use but still cannot install Webroot Secure.

 

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2013.10.02.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16476
buzzy :: BUZZY-PC [administrator]

1/24/2014 10:20:52 PM
mbar-log-2014-01-24 (22-20-52).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 264978
Time elapsed: 10 minute(s), 53 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
 

RogueKiller V8.8.3 [Jan 24 2014] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.adlice.com/forum/
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : buzzy [Admin rights]
Mode : Scan -- Date : 01/24/2014 22:46:03
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 4 ¤¤¤
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection :  ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts


127.0.0.1       localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS545050B9A300 +++++
--- User ---
[MBR] 55bf99ac773e13ff8333e88e3df106e2
[BSP] 6038da5abdb86a32e945c2c6aa172f56 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x1c) [HIDDEN!] Offset (sectors): 2048 | Size: 25600 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 52430848 | Size: 451338 Mo
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_01242014_224603.txt >>

Looks to me like a driver still may not be working correctly but you are the expert. I will be waiting anxiously.

 



#14 gringo_pr

gringo_pr

    Bleepin Gringo


  • Malware Response Team
  • 136,772 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Puerto rico
  • Local time:12:57 PM

Posted 25 January 2014 - 09:39 PM


Hello homemedic73



Please download Farbar Recovery Scan Tool and save it to your desktop.


Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.
Gringo
I Close My Topics If You Have Not Replied In 5 Days If You Will Be Longer Please Let Me Know

If I Have Not Replied To One Of My Topics In 48 Hrs Please Bump The Topic



My help is free, however, if you wish to make a small donation to show your appreciation or to help me continue the fight against Malware, then click here -->btn_donate_SM.gif<-- Don't worry every little bit helps.

Proud Graduate Of Malware Removal University

#15 homemedic73

homemedic73
  • Topic Starter

  • Members
  • 9 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Mobile, Alabama
  • Local time:11:57 AM

Posted 26 January 2014 - 03:12 AM

I ran the 64 bit version. I do know alot from school I had alrready ran MBAR before I even started the thread. But I spoke with my professor and the IT  manger at school and both suggested I save the personal settings and wipe the disk and start new. I shared with them all that we had done and they informed me that it might still take a few more days at the rate we were going. So I spoke to my uncle he said he was fine with that and he really needed his computer back. So I completed a disk wipe and reinstalled Windows 7. All is well with the PC and the "old Windows" that had been infected has been installed in a Virtual machine. I am going to use it as a learning tool and figure the issue out with the help of my professor. I thank you for all your but we started running programs that I had already run and kept getting the same result I figured it was time to bite the bullet. Thank You






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users