Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Possible infections, intermittent website connection issues


  • This topic is locked This topic is locked
10 replies to this topic

#1 catascopic

catascopic

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:33 AM

Posted 03 April 2014 - 10:57 PM

Hi, long time lurker, first time poster..

 

A couple weeks ago my father-in-law asked me to have a look at his new laptop as the internet was almost unusable, where his old one, on the same wireless point was still fast..

 

I scanned it with malwarebytes, adwcleaner and eset online scanner, they all found various items and deleted them and his internet was back to fast again..

 

Was over there again today and apparently in the last few days its gone bad again.. intermittently sites like craigslist or cnn can take 2, 3, 4 minutes to load on this computer.. where his old laptop, on the same access point, is still fast..

 

I figure he's got himself reinfected again.. or I didnt do enough before to dig it out.. so any help you can provide is appreciated..

 

Ive been through the 'before you post' checklist and have tried to run DDS.. apparently it wont run on Windows 8.1 however..

 

What scans can I provide to get us started please?

 

thanks,

 

Brad

 

 

 



BC AdBot (Login to Remove)

 


#2 catascopic

catascopic
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:33 AM

Posted 08 April 2014 - 08:27 AM

Hi,

 

Just wanted to follow up as I noticed many newer posts had responses.. figured mine might have got missed in the masses..

 

thanks,

 

Brad



#3 nasdaq

nasdaq

  • Malware Response Team
  • 40,182 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:33 PM

Posted 08 April 2014 - 08:48 AM

Hello, Welcome to BleepingComputer.
I'm nasdaq and will be helping you.

If you can please print this topic it will make it easier for you to follow the instructions and complete all of the necessary steps in the order listed.
===

Please download MiniToolBox to Desktop and run it.

Check mark the following boxes:

  • Flush DNS
  • Report IE Proxy Settings
  • Reset IE Proxy Settings
  • Report FF Proxy Settings
  • Reset FF Proxy Settings
  • List content of Hosts
  • List IP Configuration
  • List Winsock Entries
  • Click Go and copy/paste the log (Result.txt) into your next post.
  • Note: When using "Reset FF Proxy Settings" option Firefox should be closed.
Restart the computer normally
===


Use this tool. It's compatible with Windows 8.

Download the correct version of this tool for your operating system.
Farbar Recovery Scan Tool (64 bit)
Farbar Recovery Scan Tool (32 bit)
and save it to a folder on your computer's Desktop.
Double-click to run it. When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

===

Please paste the logs in your next reply DO NOT ATTACH THEM unless specified.

Let me know what problem persists.

#4 catascopic

catascopic
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:33 AM

Posted 08 April 2014 - 06:28 PM

Hi nasdaq.. thanks for your help..

 

minitoolbox:

 

MiniToolBox by Farbar  Version: 23-01-2014
Ran by Marke (administrator) on 08-04-2014 at 16:18:10
Running from "C:\Users\Marke\Downloads"
Microsoft Windows 8.1  (X64)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================


"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================


127.0.0.1    www.007guard.com
127.0.0.1    007guard.com
127.0.0.1    008i.com
127.0.0.1    www.008k.com
127.0.0.1    008k.com
127.0.0.1    www.00hq.com
127.0.0.1    00hq.com
127.0.0.1    010402.com
127.0.0.1    www.032439.com
127.0.0.1    032439.com
127.0.0.1    www.0scan.com
127.0.0.1    0scan.com
127.0.0.1    1000gratisproben.com
127.0.0.1    www.1000gratisproben.com
127.0.0.1    1001namen.com
127.0.0.1    www.1001namen.com
127.0.0.1    100888290cs.com
127.0.0.1    www.100888290cs.com
127.0.0.1    www.100sexlinks.com

There are 15472 more lines starting with "127.0.0.1"

========================= IP Configuration: ================================

Realtek RTL8188CE Wireless LAN 802.11n PCI-E NIC = Wi-Fi (Connected)
Qualcomm Atheros AR8162/8166/8168 PCI-E Fast Ethernet Controller (NDIS 6.30) = Ethernet (Media disconnected)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled
set interface interface="Local Area Connection* 1" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Wi-Fi" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="ethernet_3" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 21" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled


popd
# End of IPv4 configuration



Windows IP Configuration

   Host Name . . . . . . . . . . . . : Markelaptop
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No

Wireless LAN adapter Local Area Connection* 21:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
   Physical Address. . . . . . . . . : 20-16-D8-D1-FF-F8
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Realtek RTL8188CE Wireless LAN 802.11n PCI-E NIC
   Physical Address. . . . . . . . . : 20-16-D8-D1-FF-F8
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::e578:f97:aa39:3128%4(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.126(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : April-08-14 4:13:44 PM
   Lease Expires . . . . . . . . . . : April-09-14 4:13:44 PM
   Default Gateway . . . . . . . . . : 192.168.1.1
   DHCP Server . . . . . . . . . . . : 192.168.1.1
   DHCPv6 IAID . . . . . . . . . . . : 320870104
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-82-BF-EB-00-8C-FA-35-53-87
   DNS Servers . . . . . . . . . . . : 192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Ethernet:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : telus
   Description . . . . . . . . . . . : Qualcomm Atheros AR8162/8166/8168 PCI-E Fast Ethernet Controller (NDIS 6.30)
   Physical Address. . . . . . . . . : 00-8C-FA-35-53-87
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 14:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:90d7:1859:3d53:3f57:fe81(Preferred)
   Link-local IPv6 Address . . . . . : fe80::1859:3d53:3f57:fe81%6(Preferred)
   Default Gateway . . . . . . . . . : ::
   DHCPv6 IAID . . . . . . . . . . . : 117440512
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-18-82-BF-EB-00-8C-FA-35-53-87
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter isatap.{EB64E6A3-C26A-466F-B477-6D7108E454DD}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Server:  DD-WRT
Address:  192.168.1.1

Name:    google.com
Addresses:  2607:f8b0:400a:805::1009
      173.194.33.166
      173.194.33.164
      173.194.33.165
      173.194.33.169
      173.194.33.167
      173.194.33.174
      173.194.33.160
      173.194.33.162
      173.194.33.163
      173.194.33.168
      173.194.33.161


Pinging google.com [173.194.33.161] with 32 bytes of data:
Reply from 173.194.33.161: bytes=32 time=21ms TTL=56
Reply from 173.194.33.161: bytes=32 time=12ms TTL=57

Ping statistics for 173.194.33.161:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 12ms, Maximum = 21ms, Average = 16ms
Server:  DD-WRT
Address:  192.168.1.1

Name:    yahoo.com
Addresses:  98.138.253.109
      98.139.183.24
      206.190.36.45


Pinging yahoo.com [206.190.36.45] with 32 bytes of data:
Reply from 206.190.36.45: bytes=32 time=18ms TTL=54
Reply from 206.190.36.45: bytes=32 time=18ms TTL=54

Ping statistics for 206.190.36.45:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 18ms, Maximum = 18ms, Average = 18ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
 26...20 16 d8 d1 ff f8 ......Microsoft Wi-Fi Direct Virtual Adapter
  4...20 16 d8 d1 ff f8 ......Realtek RTL8188CE Wireless LAN 802.11n PCI-E NIC
  3...00 8c fa 35 53 87 ......Qualcomm Atheros AR8162/8166/8168 PCI-E Fast Ethernet Controller (NDIS 6.30)
  1...........................Software Loopback Interface 1
  6...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.126     25
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.1.0    255.255.255.0         On-link     192.168.1.126    281
    192.168.1.126  255.255.255.255         On-link     192.168.1.126    281
    192.168.1.255  255.255.255.255         On-link     192.168.1.126    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link     192.168.1.126    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link     192.168.1.126    281
===========================================================================
Persistent Routes:
  None

IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  6    306 ::/0                     On-link
  1    306 ::1/128                  On-link
  6    306 2001::/32                On-link
  6    306 2001:0:9d38:90d7:1859:3d53:3f57:fe81/128
                                    On-link
  4    281 fe80::/64                On-link
  6    306 fe80::/64                On-link
  6    306 fe80::1859:3d53:3f57:fe81/128
                                    On-link
  4    281 fe80::e578:f97:aa39:3128/128
                                    On-link
  1    306 ff00::/8                 On-link
  4    281 ff00::/8                 On-link
  6    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
  None
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [53760] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [68096] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [68096] (Microsoft Corporation)
Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [64000] (Microsoft Corporation)
Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [21504] (Microsoft Corporation)
Catalog9 01 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\SysWOW64\mswsock.dll [270848] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\napinsp.dll [67584] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [87040] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [87040] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [84480] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [30208] (Microsoft Corporation)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [338432] (Microsoft Corporation)

**** End of log ****
 

farbar log:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014 (ATTENTION: ====> FRST version is 26 days old and could be outdated)
Ran by Marke (administrator) on MARKELAPTOP on 08-04-2014 16:24:15
Running from C:\Users\Marke\Downloads
Windows 8.1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\WINDOWS\system32\atiesrxx.exe
(AMD) C:\WINDOWS\system32\atieclxx.exe
(Microsoft Corporation) C:\WINDOWS\system32\WLANExt.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Microsoft Corporation) C:\WINDOWS\system32\dashost.exe
(TOSHIBA Corporation) C:\Windows\system32\TODDSrv.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20413_x64__8wekyb3d8bbwe\LiveComm.exe
(Synaptics Incorporated) C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
(Microsoft Corporation) C:\WINDOWS\syswow64\wwahost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(SRS Labs, Inc.) C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe
(TOSHIBA Corporation) C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe
(TOSHIBA Corporation) C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe
(AppEx Networks Corporation) C:\Program Files\AMD Quick Stream\AMDQuickStream.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe
() C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe
(Microsoft Corporation) C:\WINDOWS\system32\PrintIsolationHost.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\Brmfcmon\BrMfimon.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Advanced Micro Devices, Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [SRS Premium Sound HD] - C:\Program Files\SRS Labs\SRS Control Panel\SRSPanel_64.exe [2170784 2012-08-19] (SRS Labs, Inc.)
HKLM\...\Run: [TSleepSrv] - C:\Program Files (x86)\TOSHIBA\System Setting\TSleepSrv.exe [1548952 2012-08-04] (TOSHIBA Corporation)
HKLM\...\Run: [TODDMain] - C:\Program Files (x86)\TOSHIBA\System Setting\TODDMain.exe [213136 2012-08-04] ()
HKLM\...\Run: [TecoResident] - C:\Program Files\TOSHIBA\Teco\TecoResident.exe
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2916152 2012-08-16] (Synaptics Incorporated)
HKLM\...\Run: [TCrdMain] - C:\Program Files\TOSHIBA\Hotkey\TCrdMain_Win8.exe [2556768 2013-08-17] (TOSHIBA Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [BrMfcWnd] - C:\Program Files (x86)\Brother\Brmfcmon\BrMfcWnd.exe [1163264 2012-09-25] ()
HKLM-x32\...\Run: [ControlCenter3] - C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [267792 2013-01-17] (Research In Motion Limited)
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe [766208 2013-08-19] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKU\S-1-5-21-2152061174-73488574-469428568-1001\...\Run: [AppEx Accelerator UI] - C:\Program Files\AMD Quick Stream\AMDQuickStream.exe [429792 2013-04-11] (AppEx Networks Corporation)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshiba13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.toshiba.ca/welcome/?w=23
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.toshiba.ca/welcome/?w=23
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.shoptoshiba.ca/welcome
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.shoptoshiba.ca/welcome
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {F4ED0519-C584-4DDA-BE93-FA0B93D040F6} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATBJS
SearchScopes: HKLM-x32 - {F4ED0519-C584-4DDA-BE93-FA0B93D040F6} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATBJS
SearchScopes: HKCU - {F4ED0519-C584-4DDA-BE93-FA0B93D040F6} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=MATBJS
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Marke\AppData\Roaming\Mozilla\Firefox\Profiles\q17u34e6.default-1392655071411
FF Plugin: @adobe.com/FlashPlayer - C:\WINDOWS\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @RIM.com/WebSLLauncher,version=1.0 - C:\Program Files (x86)\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.23.9\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.5 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: intel.com/AppUp - C:\Program Files (x86)\Intel\IntelAppStore\bin\npAppUp.dll No File
FF Extension: Adblock Plus - C:\Users\Marke\AppData\Roaming\Mozilla\Firefox\Profiles\q17u34e6.default-1392655071411\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-03-21]

==================== Services (Whitelisted) =================

R3 Blackberry Device Manager; C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe [577536 2013-01-18] (Research In Motion Limited)
S2 THAccelSvc; C:\Program Files\TOSHIBA\HDD Accelerator\THAccelSvc.exe [214928 2013-10-17] (TOSHIBA CORPORATION)
R3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [348392 2013-10-30] (Microsoft Corporation)
R2 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2013-10-30] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

S0 ADP80XX; C:\Windows\System32\drivers\ADP80XX.SYS [782176 2013-08-22] (PMC-Sierra)
R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [36096 2013-05-21] (Advanced Micro Devices, Inc.)
R2 APXACC; C:\Windows\system32\DRIVERS\appexDrv.sys [219360 2013-04-18] (AppEx Networks Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdWB6.sys [138240 2013-06-22] (Advanced Micro Devices)
S3 bcmfn2; C:\Windows\System32\drivers\bcmfn2.sys [17624 2013-08-12] (Windows ® Win 7 DDK provider)
S3 iaLPSSi_GPIO; C:\Windows\System32\drivers\iaLPSSi_GPIO.sys [24568 2013-07-30] (Intel Corporation)
S3 iaLPSSi_I2C; C:\Windows\System32\drivers\iaLPSSi_I2C.sys [99320 2013-07-25] (Intel Corporation)
S0 iaStorAV; C:\Windows\System32\drivers\iaStorAV.sys [651248 2013-08-09] (Intel Corporation)
R0 intelpep; C:\Windows\System32\drivers\intelpep.sys [39768 2013-11-10] (Microsoft Corporation)
S0 LSI_SAS3; C:\Windows\System32\drivers\lsi_sas3.sys [81760 2013-08-22] (LSI Corporation)
R3 NdisVirtualBus; C:\Windows\System32\drivers\NdisVirtualBus.sys [16384 2013-08-22] (Microsoft Corporation)
S3 netvsc; C:\Windows\system32\DRIVERS\netvsc63.sys [87040 2013-08-22] (Microsoft Corporation)
S3 ReFS; C:\Windows\System32\Drivers\ReFS.sys [924512 2013-08-22] (Microsoft Corporation)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [78336 2013-01-03] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys [44544 2012-12-10] (Research in Motion Ltd)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [2944216 2013-08-21] (Realtek Semiconductor Corporation                           )
S3 SerCx2; C:\Windows\System32\drivers\SerCx2.sys [146776 2013-10-25] (Microsoft Corporation)
S0 stornvme; C:\Windows\System32\drivers\stornvme.sys [57176 2013-11-17] (Microsoft Corporation)
R0 THAccel; C:\Windows\System32\DRIVERS\THAccel.sys [111488 2013-10-15] (TOSHIBA Corporation)
R3 Thotkey; C:\Windows\System32\drivers\Thotkey.sys [32624 2013-08-19] (Windows ® Win 7 DDK provider)
S3 UEFI; C:\Windows\System32\drivers\UEFI.sys [26976 2013-08-22] (Microsoft Corporation)
R3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [124760 2013-10-30] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-04-08 16:24 - 2014-04-08 16:24 - 00011594 _____ () C:\Users\Marke\Downloads\FRST.txt
2014-04-08 16:24 - 2014-04-08 16:24 - 00000000 ____D () C:\FRST
2014-04-08 16:21 - 2014-04-08 16:21 - 00012353 _____ () C:\Users\Marke\Desktop\minitoolbox Result.txt
2014-04-08 16:18 - 2014-04-08 16:21 - 00012353 _____ () C:\Users\Marke\Downloads\Result.txt
2014-04-08 16:15 - 2014-04-08 16:15 - 02157056 _____ (Farbar) C:\Users\Marke\Downloads\FRST64.exe
2014-04-08 16:14 - 2014-04-08 16:14 - 00982016 _____ (Farbar) C:\Users\Marke\Downloads\MiniToolBox.exe
2014-04-03 20:43 - 2014-04-03 20:43 - 00688992 _____ (Swearware) C:\Users\Marke\Desktop\dds.com
2014-04-03 20:25 - 2014-04-03 20:26 - 01426178 _____ () C:\Users\Marke\Downloads\adwcleaner.exe
2014-03-30 10:06 - 2014-03-30 10:07 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-21 21:41 - 2014-03-21 21:41 - 04765152 _____ (Piriform Ltd) C:\Users\Marke\Downloads\ccsetup411.exe
2014-03-21 21:41 - 2014-03-21 21:41 - 00002772 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-03-21 21:41 - 2014-03-21 21:41 - 00000000 ____D () C:\Program Files\CCleaner
2014-03-21 18:00 - 2014-03-21 18:00 - 00000000 ____D () C:\Users\Marke\AppData\Roaming\Oracle
2014-03-21 18:00 - 2014-03-21 18:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-03-21 18:00 - 2014-03-21 17:59 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-03-21 18:00 - 2014-03-21 17:59 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-03-21 18:00 - 2014-03-21 17:59 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-03-21 18:00 - 2014-03-21 17:59 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-03-21 17:59 - 2014-03-21 17:59 - 00000000 ____D () C:\Program Files (x86)\Java
2014-03-21 17:57 - 2014-03-21 17:57 - 00921000 _____ (Oracle Corporation) C:\Users\Marke\Downloads\jxpiinstall.exe
2014-03-21 15:30 - 2014-03-21 15:30 - 00000000 ____D () C:\Users\Marke\AppData\Local\AppEx Networks
2014-03-20 16:59 - 2014-03-20 16:59 - 02347384 _____ (ESET) C:\Users\Marke\Downloads\esetsmartinstaller_enu.exe
2014-03-20 06:35 - 2014-03-20 06:35 - 01128396 _____ () C:\Users\Marke\AppData\Local\census.cache
2014-03-20 06:35 - 2014-03-20 06:35 - 00165059 _____ () C:\Users\Marke\AppData\Local\ars.cache
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atiuxpag.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atiumdva.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atiumdag.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atiu9pag.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atidxx32.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\aticfx32.dll
2014-03-20 06:08 - 2014-03-20 06:08 - 00000010 _____ () C:\Users\Marke\AppData\Local\sponge.last.runtime.cache
2014-03-20 06:05 - 2014-03-20 06:05 - 00000036 _____ () C:\Users\Marke\AppData\Local\housecall.guid.cache
2014-03-20 06:05 - 2013-09-02 00:58 - 00175528 _____ (Trend Micro Inc.) C:\WINDOWS\system32\Drivers\tmcomm.sys
2014-03-20 06:03 - 2014-03-20 06:04 - 02467424 _____ (Trend Micro Inc.) C:\Users\Marke\Downloads\HousecallLauncher64.exe
2014-03-20 06:00 - 2014-03-20 06:00 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-03-19 22:23 - 2014-03-19 22:23 - 00000000 ____D () C:\ProgramData\ATI
2014-03-19 22:11 - 2014-03-19 22:12 - 00000000 ____D () C:\Program Files\AMD Quick Stream
2014-03-19 22:11 - 2013-04-18 07:04 - 00219360 _____ (AppEx Networks Corporation) C:\WINDOWS\system32\Drivers\appexDrv.sys
2014-03-19 22:10 - 2014-03-19 22:10 - 00055445 _____ () C:\WINDOWS\SysWOW64\CCCInstall_201403192210486188.log
2014-03-19 22:10 - 2014-03-19 22:10 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-03-19 22:07 - 2014-03-19 22:08 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2014-03-19 22:06 - 2014-03-19 22:06 - 00000000 ____D () C:\ProgramData\Package Cache
2014-03-19 22:06 - 2013-08-19 14:08 - 07257008 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd64.dll
2014-03-19 22:06 - 2013-08-19 14:08 - 06765704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiumd6a.dll
2014-03-19 22:06 - 2013-08-19 14:08 - 00156712 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\amdhcp64.dll
2014-03-19 22:06 - 2013-08-19 14:08 - 00141256 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\amdhcp32.dll
2014-03-19 22:06 - 2013-08-19 14:08 - 00114488 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiu9p64.dll
2014-03-19 22:06 - 2013-08-19 14:08 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atimpc64.dll
2014-03-19 22:06 - 2013-08-19 14:08 - 00078432 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdpcom64.dll
2014-03-19 22:06 - 2013-08-19 14:08 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atimpc32.dll
2014-03-19 22:06 - 2013-08-19 14:08 - 00071704 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdpcom32.dll
2014-03-19 22:06 - 2013-08-19 14:06 - 12521472 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmdag.sys
2014-03-19 22:06 - 2013-08-19 14:01 - 00781312 _____ () C:\WINDOWS\system32\amdmiracast.dll
2014-03-19 22:06 - 2013-08-19 13:50 - 00127488 _____ (AMD) C:\WINDOWS\system32\coinst_13.151.dll
2014-03-19 22:06 - 2013-08-19 13:49 - 28192256 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\amdocl64.dll
2014-03-19 22:06 - 2013-08-19 13:49 - 00229376 _____ () C:\WINDOWS\system32\clinfo.exe
2014-03-19 22:06 - 2013-08-19 13:49 - 00098816 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\OpenVideo64.dll
2014-03-19 22:06 - 2013-08-19 13:49 - 00086528 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\OVDecode64.dll
2014-03-19 22:06 - 2013-08-19 13:49 - 00083456 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\OpenVideo.dll
2014-03-19 22:06 - 2013-08-19 13:49 - 00073216 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\OVDecode.dll
2014-03-19 22:06 - 2013-08-19 13:46 - 23761408 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\amdocl.dll
2014-03-19 22:06 - 2013-08-19 13:45 - 00063488 _____ (Khronos Group) C:\WINDOWS\system32\OpenCL.dll
2014-03-19 22:06 - 2013-08-19 13:45 - 00057344 _____ (Khronos Group) C:\WINDOWS\SysWOW64\OpenCL.dll
2014-03-19 22:06 - 2013-08-19 13:32 - 25386496 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atio6axx.dll
2014-03-19 22:06 - 2013-08-19 13:31 - 00544432 _____ () C:\WINDOWS\SysWOW64\atiapfxx.blb
2014-03-19 22:06 - 2013-08-19 13:31 - 00544432 _____ () C:\WINDOWS\system32\atiapfxx.blb
2014-03-19 22:06 - 2013-08-19 13:31 - 00368640 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiapfxx.exe
2014-03-19 22:06 - 2013-08-19 13:30 - 15716352 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticaldd64.dll
2014-03-19 22:06 - 2013-08-19 13:30 - 00062464 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalrt64.dll
2014-03-19 22:06 - 2013-08-19 13:30 - 00055808 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\system32\aticalcl64.dll
2014-03-19 22:06 - 2013-08-19 13:30 - 00052224 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalrt.dll
2014-03-19 22:06 - 2013-08-19 13:30 - 00049152 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticalcl.dll
2014-03-19 22:06 - 2013-08-19 13:27 - 14302208 _____ (Advanced Micro Devices Inc.) C:\WINDOWS\SysWOW64\aticaldd.dll
2014-03-19 22:06 - 2013-08-19 13:14 - 21399040 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atioglxx.dll
2014-03-19 22:06 - 2013-08-19 13:10 - 00571904 _____ (AMD) C:\WINDOWS\system32\atieclxx.exe
2014-03-19 22:06 - 2013-08-19 13:10 - 00442368 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atidemgy.dll
2014-03-19 22:06 - 2013-08-19 13:10 - 00026112 _____ (AMD) C:\WINDOWS\system32\atimuixx.dll
2014-03-19 22:06 - 2013-08-19 13:09 - 00239616 _____ (AMD) C:\WINDOWS\system32\atiesrxx.exe
2014-03-19 22:06 - 2013-08-19 13:07 - 00190976 _____ (AMD) C:\WINDOWS\system32\atitmm64.dll
2014-03-19 22:06 - 2013-08-19 13:06 - 03388672 _____ () C:\WINDOWS\system32\atiumd6a.cap
2014-03-19 22:06 - 2013-08-19 12:52 - 03422720 _____ () C:\WINDOWS\SysWOW64\atiumdva.cap
2014-03-19 22:06 - 2013-08-19 12:43 - 00784384 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\atiadlxx.dll
2014-03-19 22:06 - 2013-08-19 12:43 - 00595456 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\SysWOW64\atiadlxy.dll
2014-03-19 22:06 - 2013-08-19 12:42 - 00617472 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\atikmpag.sys
2014-03-19 22:06 - 2013-08-19 12:42 - 00100352 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6txx.dll
2014-03-19 22:06 - 2013-08-19 12:42 - 00096768 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atigktxx.dll
2014-03-19 22:06 - 2013-08-19 12:42 - 00075264 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atig6pxx.dll
2014-03-19 22:06 - 2013-08-19 12:42 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atiglpxx.dll
2014-03-19 22:06 - 2013-08-19 12:42 - 00069632 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atiglpxx.dll
2014-03-19 22:06 - 2013-08-19 12:39 - 00096256 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\amdave64.dll
2014-03-19 22:06 - 2013-08-19 12:39 - 00090624 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\amdave32.dll
2014-03-19 22:06 - 2013-08-19 12:39 - 00089088 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\system32\atisamu64.dll
2014-03-19 22:06 - 2013-08-19 12:39 - 00080896 _____ (Advanced Micro Devices, Inc. ) C:\WINDOWS\SysWOW64\atisamu32.dll
2014-03-19 22:06 - 2013-08-19 12:37 - 00134656 _____ () C:\WINDOWS\system32\amdhdl64.dll
2014-03-19 22:06 - 2013-08-19 12:37 - 00123392 _____ () C:\WINDOWS\SysWOW64\amdhdl32.dll
2014-03-19 22:06 - 2013-08-19 12:35 - 00043520 _____ (Advanced Micro Devices, Inc.) C:\WINDOWS\system32\Drivers\ati2erec.dll
2014-03-19 22:06 - 2013-08-07 11:18 - 00233396 _____ () C:\WINDOWS\system32\ativvaxy_cik.dat
2014-03-19 22:06 - 2013-07-24 15:12 - 00081920 _____ () C:\WINDOWS\system32\ativce02.dat
2014-03-19 17:06 - 2014-04-03 20:26 - 00000000 ____D () C:\AdwCleaner
2014-03-19 17:04 - 2014-03-19 17:06 - 04358144 _____ (Malwarebytes Corporation ) C:\Users\Marke\Downloads\mbam-setup-1.75.0.1300.exe.part
2014-03-19 16:47 - 2014-03-19 16:47 - 00001128 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-19 16:47 - 2014-03-19 16:47 - 00000000 ____D () C:\Users\Marke\AppData\Roaming\Malwarebytes
2014-03-19 16:47 - 2014-03-19 16:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-19 16:47 - 2014-03-19 16:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-19 16:47 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-03-18 10:23 - 2014-01-02 16:54 - 00461312 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsGdiConverter.dll
2014-03-18 10:23 - 2013-12-27 01:57 - 00628736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncHost.exe
2014-03-18 10:23 - 2013-12-27 01:23 - 00749056 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSyncCore.dll
2014-03-18 10:23 - 2013-12-27 00:03 - 00478208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncHost.exe
2014-03-18 10:23 - 2013-12-26 23:37 - 00588800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSyncCore.dll
2014-03-18 10:23 - 2013-12-09 01:05 - 21199256 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-03-18 10:20 - 2013-12-13 23:31 - 13949440 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-03-18 10:20 - 2013-12-13 23:19 - 18576384 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-03-18 10:20 - 2013-12-08 21:51 - 18643560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-03-18 10:19 - 2014-01-07 18:41 - 01530712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgkrnl.sys
2014-03-18 10:19 - 2014-01-04 08:54 - 00138240 _____ () C:\WINDOWS\system32\OEMLicense.dll
2014-03-18 10:19 - 2014-01-04 08:08 - 00103936 _____ () C:\WINDOWS\SysWOW64\OEMLicense.dll
2014-03-18 10:19 - 2014-01-04 07:08 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSClient.dll
2014-03-18 10:19 - 2014-01-04 06:53 - 00174592 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSClient.dll
2014-03-18 10:19 - 2014-01-02 16:48 - 00336896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsGdiConverter.dll
2014-03-18 10:19 - 2013-12-31 16:56 - 00960512 _____ (Microsoft Corporation) C:\WINDOWS\system32\MFMediaEngine.dll
2014-03-18 10:18 - 2014-01-07 18:46 - 00325464 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBXHCI.SYS
2014-03-18 10:18 - 2014-01-07 18:41 - 00382808 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\dxgmms1.sys
2014-03-18 10:18 - 2013-12-31 18:55 - 01720560 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntdll.dll
2014-03-18 10:18 - 2013-12-31 18:52 - 00481944 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfsvr.dll
2014-03-18 10:18 - 2013-12-31 17:56 - 01472048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ntdll.dll
2014-03-18 10:18 - 2013-12-31 17:55 - 00381168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfsvr.dll
2014-03-18 10:18 - 2013-12-31 16:59 - 00802816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MFMediaEngine.dll
2014-03-18 10:18 - 2013-12-31 16:57 - 01214976 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2014-03-18 10:18 - 2013-12-30 16:33 - 00770560 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ReAgent.dll
2014-03-18 10:18 - 2013-12-30 16:32 - 00303616 _____ (Microsoft Corporation) C:\WINDOWS\system32\sti.dll
2014-03-18 10:18 - 2013-12-30 16:31 - 00947712 _____ (Microsoft Corporation) C:\WINDOWS\system32\reseteng.dll
2014-03-18 10:18 - 2013-12-30 16:31 - 00914944 _____ (Microsoft Corporation) C:\WINDOWS\system32\ReAgent.dll
2014-03-18 10:18 - 2013-12-27 08:09 - 00419160 _____ (Microsoft Corporation) C:\WINDOWS\system32\hal.dll
2014-03-18 10:18 - 2013-12-27 01:57 - 00842752 _____ (Microsoft Corporation) C:\WINDOWS\system32\MsSpellCheckingFacility.dll
2014-03-18 10:18 - 2013-12-27 00:03 - 00630272 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MsSpellCheckingFacility.dll
2014-03-18 10:18 - 2013-12-21 00:21 - 00376320 _____ (Microsoft Corporation) C:\WINDOWS\system32\pnrpsvc.dll
2014-03-18 10:18 - 2013-12-17 00:21 - 00408576 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\rdbss.sys
2014-03-18 10:18 - 2013-12-13 03:54 - 00131160 _____ (Microsoft Corporation) C:\WINDOWS\system32\easinvoker.exe
2014-03-18 10:17 - 2013-12-30 16:34 - 00218112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\sti.dll
2014-03-18 10:17 - 2013-12-12 23:36 - 00178176 _____ (Microsoft Corporation) C:\WINDOWS\system32\easwrt.dll
2014-03-18 10:17 - 2013-12-12 22:32 - 00140800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\easwrt.dll
2014-03-18 09:47 - 2014-03-02 23:04 - 00450712 ____R () C:\WINDOWS\system32\Drivers\etc\hosts.20140318-094710.backup
2014-03-16 21:39 - 2014-03-16 21:40 - 00739808 _____ (SlimWare Utilities, Inc.) C:\Users\Marke\Desktop\DriverUpdate-setup(1).exe
2014-03-16 21:39 - 2014-03-16 21:39 - 00739808 _____ (SlimWare Utilities, Inc.) C:\Users\Marke\Downloads\DriverUpdate-setup.exe
2014-03-16 21:39 - 2014-02-22 05:16 - 00139776 _____ (Microsoft Corporation) C:\WINDOWS\system32\poqexec.exe
2014-03-16 21:39 - 2014-02-22 04:24 - 00124416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\poqexec.exe
2014-03-13 09:41 - 2014-02-28 23:05 - 23133696 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-03-13 09:41 - 2014-02-28 21:58 - 02765824 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-03-13 09:41 - 2014-02-28 21:30 - 17074688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-03-13 09:41 - 2014-02-28 21:17 - 00218624 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-03-13 09:41 - 2014-02-28 20:54 - 05768704 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-03-13 09:41 - 2014-02-28 20:47 - 02168320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-03-13 09:41 - 2014-02-28 20:42 - 00627200 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-03-13 09:41 - 2014-02-28 20:18 - 13051904 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-03-13 09:41 - 2014-02-28 20:14 - 04244480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-03-13 09:41 - 2014-02-28 20:10 - 02334208 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-03-13 09:41 - 2014-02-28 20:03 - 00524288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-03-13 09:41 - 2014-02-28 19:57 - 11266048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-03-13 09:41 - 2014-02-28 19:38 - 01393664 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-03-13 09:41 - 2014-02-28 19:32 - 01820160 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-03-13 09:41 - 2014-02-28 19:27 - 01156096 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-03-13 09:41 - 2014-02-28 19:25 - 00817664 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-03-13 09:41 - 2014-02-28 19:25 - 00703488 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-03-13 09:41 - 2013-12-20 03:18 - 01643584 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2014-03-13 09:41 - 2013-12-20 03:18 - 01507704 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2014-03-13 09:40 - 2014-02-10 20:04 - 04189184 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-03-13 09:40 - 2014-02-10 19:43 - 00488448 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\qedit.dll
2014-03-13 09:40 - 2014-02-10 19:04 - 00586240 _____ (Microsoft Corporation) C:\WINDOWS\system32\qedit.dll
2014-03-13 09:40 - 2014-01-31 09:15 - 00311640 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2014-03-13 09:40 - 2014-01-31 09:07 - 00233920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2014-03-13 09:40 - 2014-01-31 09:06 - 02133208 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-03-13 09:40 - 2014-01-31 06:47 - 02143960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-03-13 09:40 - 2014-01-31 02:06 - 00716288 _____ (Microsoft Corporation) C:\WINDOWS\system32\swprv.dll
2014-03-13 09:40 - 2014-01-29 02:55 - 01287064 _____ (Microsoft Corporation) C:\WINDOWS\system32\kernel32.dll
2014-03-13 09:40 - 2014-01-29 01:53 - 00458616 _____ (Microsoft Corporation) C:\WINDOWS\system32\WerFault.exe
2014-03-13 09:40 - 2014-01-29 01:53 - 00407024 _____ (Microsoft Corporation) C:\WINDOWS\system32\Faultrep.dll
2014-03-13 09:40 - 2014-01-29 01:49 - 01928144 _____ (Microsoft Corporation) C:\WINDOWS\system32\combase.dll
2014-03-13 09:40 - 2014-01-29 01:47 - 02543960 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-03-13 09:40 - 2014-01-29 00:44 - 01371824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\combase.dll
2014-03-13 09:40 - 2014-01-29 00:44 - 00408480 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WerFault.exe
2014-03-13 09:40 - 2014-01-29 00:44 - 00369280 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Faultrep.dll
2014-03-13 09:40 - 2014-01-28 23:41 - 00208896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdpencom.dll
2014-03-13 09:40 - 2014-01-28 17:36 - 00249856 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpencom.dll
2014-03-13 09:40 - 2014-01-27 12:07 - 04175360 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbgeng.dll
2014-03-13 09:40 - 2014-01-27 12:06 - 00064512 _____ (Microsoft Corporation) C:\WINDOWS\system32\tsgqec.dll
2014-03-13 09:40 - 2014-01-27 12:04 - 00160256 _____ (Microsoft Corporation) C:\WINDOWS\system32\DWWIN.EXE
2014-03-13 09:40 - 2014-01-27 11:52 - 01036288 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\kernel32.dll
2014-03-13 09:40 - 2014-01-27 11:23 - 02873344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbgeng.dll
2014-03-13 09:40 - 2014-01-27 11:21 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\tsgqec.dll
2014-03-13 09:40 - 2014-01-27 11:20 - 00138752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DWWIN.EXE
2014-03-13 09:40 - 2014-01-27 11:15 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2014-03-13 09:40 - 2014-01-27 10:43 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2014-03-13 09:40 - 2014-01-27 10:18 - 01486848 _____ (Microsoft Corporation) C:\WINDOWS\system32\dbghelp.dll
2014-03-13 09:40 - 2014-01-27 10:00 - 01238016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dbghelp.dll
2014-03-13 09:40 - 2014-01-27 08:58 - 05770752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-03-13 09:40 - 2014-01-27 08:50 - 06640640 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-03-13 09:40 - 2014-01-27 04:45 - 00386722 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-03-13 09:40 - 2014-01-17 16:04 - 00764864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmpeg2srcsnk.dll
2014-03-13 09:40 - 2014-01-17 14:54 - 00669352 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmpeg2srcsnk.dll
2014-03-13 09:40 - 2013-12-21 07:51 - 06353960 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppsvc.exe
2014-03-13 09:40 - 2013-12-21 01:54 - 00447488 _____ (Microsoft Corporation) C:\WINDOWS\system32\sppcomapi.dll
2014-03-13 09:40 - 2013-10-30 17:29 - 00236888 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdFilter.sys
2014-03-13 09:40 - 2013-10-30 17:29 - 00124760 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdNisDrv.sys
2014-03-13 09:40 - 2013-10-30 17:28 - 00035856 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\WdBoot.sys

==================== One Month Modified Files and Folders =======

2014-04-08 16:24 - 2014-04-08 16:24 - 00011594 _____ () C:\Users\Marke\Downloads\FRST.txt
2014-04-08 16:24 - 2014-04-08 16:24 - 00000000 ____D () C:\FRST
2014-04-08 16:23 - 2013-08-22 07:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-04-08 16:23 - 2013-04-10 19:49 - 00000916 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-04-08 16:22 - 2013-11-17 01:00 - 01251409 _____ () C:\WINDOWS\WindowsUpdate.log
2014-04-08 16:22 - 2013-08-22 06:25 - 00524288 ___SH () C:\WINDOWS\system32\config\BBI
2014-04-08 16:21 - 2014-04-08 16:21 - 00012353 _____ () C:\Users\Marke\Desktop\minitoolbox Result.txt
2014-04-08 16:21 - 2014-04-08 16:18 - 00012353 _____ () C:\Users\Marke\Downloads\Result.txt
2014-04-08 16:16 - 2014-01-13 00:01 - 00003938 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{3B532F6F-4C0C-4745-B5F8-44BDB4344A07}
2014-04-08 16:15 - 2014-04-08 16:15 - 02157056 _____ (Farbar) C:\Users\Marke\Downloads\FRST64.exe
2014-04-08 16:15 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-04-08 16:14 - 2014-04-08 16:14 - 00982016 _____ (Farbar) C:\Users\Marke\Downloads\MiniToolBox.exe
2014-04-08 16:14 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-04-03 21:13 - 2013-04-10 19:49 - 00000830 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job
2014-04-03 21:01 - 2013-02-24 10:37 - 00003594 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2152061174-73488574-469428568-1001
2014-04-03 20:43 - 2014-04-03 20:43 - 00688992 _____ (Swearware) C:\Users\Marke\Desktop\dds.com
2014-04-03 20:40 - 2013-04-10 19:49 - 00000920 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-04-03 20:26 - 2014-04-03 20:25 - 01426178 _____ () C:\Users\Marke\Downloads\adwcleaner.exe
2014-04-03 20:26 - 2014-03-19 17:06 - 00000000 ____D () C:\AdwCleaner
2014-04-03 17:27 - 2013-09-29 21:04 - 00863592 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-04-03 12:35 - 2013-04-10 19:49 - 00003892 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineUA
2014-04-03 12:35 - 2013-04-10 19:49 - 00003656 _____ () C:\WINDOWS\System32\Tasks\GoogleUpdateTaskMachineCore
2014-04-01 22:36 - 2013-02-24 10:58 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-30 10:07 - 2014-03-30 10:06 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-21 21:43 - 2013-12-11 07:38 - 00000000 ____D () C:\WINDOWS\Minidump
2014-03-21 21:43 - 2013-11-17 00:35 - 00000000 ___DC () C:\WINDOWS\Panther
2014-03-21 21:41 - 2014-03-21 21:41 - 04765152 _____ (Piriform Ltd) C:\Users\Marke\Downloads\ccsetup411.exe
2014-03-21 21:41 - 2014-03-21 21:41 - 00002772 _____ () C:\WINDOWS\System32\Tasks\CCleanerSkipUAC
2014-03-21 21:41 - 2014-03-21 21:41 - 00000000 ____D () C:\Program Files\CCleaner
2014-03-21 18:02 - 2013-11-17 00:45 - 00000000 ____D () C:\Users\Marke
2014-03-21 18:00 - 2014-03-21 18:00 - 00000000 ____D () C:\Users\Marke\AppData\Roaming\Oracle
2014-03-21 18:00 - 2014-03-21 18:00 - 00000000 ____D () C:\ProgramData\Oracle
2014-03-21 17:59 - 2014-03-21 18:00 - 00264616 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-03-21 17:59 - 2014-03-21 18:00 - 00175016 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-03-21 17:59 - 2014-03-21 18:00 - 00174504 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-03-21 17:59 - 2014-03-21 18:00 - 00096168 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-03-21 17:59 - 2014-03-21 17:59 - 00000000 ____D () C:\Program Files (x86)\Java
2014-03-21 17:57 - 2014-03-21 17:57 - 00921000 _____ (Oracle Corporation) C:\Users\Marke\Downloads\jxpiinstall.exe
2014-03-21 17:56 - 2013-01-12 00:22 - 00000000 ____D () C:\ProgramData\Intel
2014-03-21 17:56 - 2013-01-12 00:22 - 00000000 ____D () C:\Program Files (x86)\Intel
2014-03-21 17:53 - 2012-09-19 21:25 - 00000000 ____D () C:\Program Files (x86)\TOSHIBA
2014-03-21 17:53 - 2012-09-19 21:24 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-03-21 17:52 - 2014-03-02 15:41 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-03-21 17:52 - 2014-03-02 15:41 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-03-21 17:51 - 2013-01-12 00:09 - 00000000 ____D () C:\WINDOWS\System32\Tasks\TOSHIBA
2014-03-21 17:51 - 2012-09-19 21:24 - 00000000 ____D () C:\Program Files\TOSHIBA
2014-03-21 15:30 - 2014-03-21 15:30 - 00000000 ____D () C:\Users\Marke\AppData\Local\AppEx Networks
2014-03-20 16:59 - 2014-03-20 16:59 - 02347384 _____ (ESET) C:\Users\Marke\Downloads\esetsmartinstaller_enu.exe
2014-03-20 06:35 - 2014-03-20 06:35 - 01128396 _____ () C:\Users\Marke\AppData\Local\census.cache
2014-03-20 06:35 - 2014-03-20 06:35 - 00165059 _____ () C:\Users\Marke\AppData\Local\ars.cache
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atiuxpag.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atiumdva.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atiumdag.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atiu9pag.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\atidxx32.dll
2014-03-20 06:18 - 2014-03-20 06:18 - 00000000 _____ () C:\WINDOWS\system32\aticfx32.dll
2014-03-20 06:08 - 2014-03-20 06:08 - 00000010 _____ () C:\Users\Marke\AppData\Local\sponge.last.runtime.cache
2014-03-20 06:05 - 2014-03-20 06:05 - 00000036 _____ () C:\Users\Marke\AppData\Local\housecall.guid.cache
2014-03-20 06:04 - 2014-03-20 06:03 - 02467424 _____ (Trend Micro Inc.) C:\Users\Marke\Downloads\HousecallLauncher64.exe
2014-03-20 06:00 - 2014-03-20 06:00 - 00000000 ____D () C:\Program Files (x86)\Cisco
2014-03-20 05:59 - 2013-01-11 23:58 - 00000000 ____D () C:\Program Files (x86)\Realtek
2014-03-19 22:23 - 2014-03-19 22:23 - 00000000 ____D () C:\ProgramData\ATI
2014-03-19 22:12 - 2014-03-19 22:11 - 00000000 ____D () C:\Program Files\AMD Quick Stream
2014-03-19 22:10 - 2014-03-19 22:10 - 00055445 _____ () C:\WINDOWS\SysWOW64\CCCInstall_201403192210486188.log
2014-03-19 22:10 - 2014-03-19 22:10 - 00000000 ____D () C:\Program Files (x86)\AMD AVT
2014-03-19 22:10 - 2013-01-11 23:56 - 00000000 ____D () C:\ProgramData\AMD
2014-03-19 22:10 - 2013-01-11 23:55 - 00000000 ____D () C:\Program Files (x86)\ATI Technologies
2014-03-19 22:08 - 2014-03-19 22:07 - 00000000 ____D () C:\WINDOWS\LastGood.Tmp
2014-03-19 22:06 - 2014-03-19 22:06 - 00000000 ____D () C:\ProgramData\Package Cache
2014-03-19 17:06 - 2014-03-19 17:04 - 04358144 _____ (Malwarebytes Corporation ) C:\Users\Marke\Downloads\mbam-setup-1.75.0.1300.exe.part
2014-03-19 17:02 - 2013-02-24 10:31 - 00000000 ___RD () C:\Users\Marke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-03-19 16:47 - 2014-03-19 16:47 - 00001128 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-03-19 16:47 - 2014-03-19 16:47 - 00000000 ____D () C:\Users\Marke\AppData\Roaming\Malwarebytes
2014-03-19 16:47 - 2014-03-19 16:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-19 16:47 - 2014-03-19 16:47 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-18 22:54 - 2013-08-22 08:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-03-18 10:46 - 2013-02-24 10:31 - 00000000 ___RD () C:\Users\Marke\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-03-18 10:44 - 2013-08-22 08:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-03-18 10:43 - 2013-08-13 22:05 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-03-18 10:42 - 2013-02-25 21:00 - 90015360 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-03-16 21:40 - 2014-03-16 21:39 - 00739808 _____ (SlimWare Utilities, Inc.) C:\Users\Marke\Desktop\DriverUpdate-setup(1).exe
2014-03-16 21:39 - 2014-03-16 21:39 - 00739808 _____ (SlimWare Utilities, Inc.) C:\Users\Marke\Downloads\DriverUpdate-setup.exe
2014-03-16 09:12 - 2013-08-22 07:44 - 00409688 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-03-16 09:10 - 2013-08-22 08:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-03-16 09:10 - 2013-08-22 08:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
2014-03-16 09:10 - 2013-08-22 08:36 - 00000000 ____D () C:\Program Files\Windows Defender
2014-03-16 09:10 - 2013-08-22 08:36 - 00000000 ____D () C:\Program Files (x86)\Windows Defender
2014-03-13 10:03 - 2013-02-24 11:04 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-03-11 23:14 - 2013-08-22 06:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-03-11 13:13 - 2014-02-20 18:16 - 05777288 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerInstaller.exe
2014-03-11 13:13 - 2013-04-10 19:49 - 00003718 _____ () C:\WINDOWS\System32\Tasks\Adobe Flash Player Updater

Some content of TEMP:
====================
C:\Users\Marke\AppData\Local\Temp\Quarantine.exe


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys
[2014-03-13 09:40] - [2014-01-31 09:15] - 0311640 ___AC (Microsoft Corporation) C85C075DE5B6D0FE116043054DE8EE02



LastRegBack: 2014-04-03 20:40

==================== End Of Log ============================



#5 catascopic

catascopic
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:33 AM

Posted 08 April 2014 - 06:29 PM

farbar addition report

 

thanks,

 

Brad

Attached Files



#6 catascopic

catascopic
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:33 AM

Posted 08 April 2014 - 06:37 PM

The last 10 minutes of use have been ok .. I'll continue using the system this evening and see if the problem reoccurs..

 

Brad



#7 nasdaq

nasdaq

  • Malware Response Team
  • 40,182 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:33 PM

Posted 09 April 2014 - 07:39 AM

One last scan.

Download Security Check by screen317 from here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
p.s.
If the SecurityCheck program fails to run for any reason, run it as an Administrator.
===

#8 catascopic

catascopic
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:33 AM

Posted 09 April 2014 - 08:44 AM

here we go:

 

 Results of screen317's Security Check version 0.99.81  
   x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:``````````````
 Windows Firewall Enabled!  
Windows Defender   
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 MVPS Hosts File  
 Malwarebytes Anti-Malware version 1.75.0.1300  
 Java 7 Update 51  
 Adobe Flash Player     12.0.0.77  
 Mozilla Firefox (28.0)
````````Process Check: objlist.exe by Laurent````````  
 Windows Defender MSMpEng.exe
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  %
````````````````````End of Log``````````````````````
 



#9 nasdaq

nasdaq

  • Malware Response Team
  • 40,182 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:33 PM

Posted 09 April 2014 - 12:34 PM

Looking good.

MediaPlayerplusIf all is well:

Please consider using these ideas to help secure your computer. While there is no way to guarantee safety when you use a computer, these steps will make it much less likely that you will need to endure another infection. While we really like to help people, we would rather help you protect yourself so that you won't need that help in the future.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates or get into the habit of checking Windows Update regularly. They usually have security updates every month. You can set Windows to notify you of Updates so that you can choose, but only do this if you believe you are able to understand which ones are needed. This is a crucial security measure.

Having an effective antivirus is a must for everyone.
In addition to many excellent commercial products there are plenty of good free antivirus programs available. I can recommend:

If you are satisfied with your current protection programs you can ignore the instructions on Antivirus or Firewall listed below.In addition to an antivirus I recommend using a firewall. A software firewall is a software program that helps screen out hackers, viruses, and worms that try to reach your computer over the Internet. I can recommend one of the following free products:Please note: Many installer offer third-party downloads that are installed automatically when you do not uncheck certain checkboxes. While most of the time not being malicious you usually do not want these on your computer. Be careful during the installation process and you will avoid seeing tons of new unwanted toolbars in your favorite web browser.

Please consider installing and running some of the following programs; they are either free or have free versions of commercial programs:

Malwarebytes Anti-Malware (MBAM)
The free version of MBAM can be used to scan the system for traces of malware. Scanning your system regularly will make it harder for malware to reside on your system.
A tutorial on using MBAM can be found here.
Please Note: Only the paid for version has real time capabilities.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent malware from ever installing on your computer may be found here.

Please keep these programs up-to-date and run them whenever you suspect a problem to prevent malware problems. A number of programs have resident protection and it is a good idea to run the resident protection of one of each type of program to maintain protection. However, it is important to run only one resident program of each type since they can conflict and become less effective. That means only one antivirus, firewall and scanning anti-spyware program at a time. Passive protectors, like SpywareBlaster can be run with any of them.

Note that there are a lot of rogue programs out there that want to scare you into giving them your money and some malware actually claims to be security programs. If you get a popup for a security program that you did not install yourself, do NOT click on it and ask for help immediately. It is very important to run an antivirus and firewall, but you can't always rely on reviews and ads for information. Ask in a security forum that you trust if you are not sure. If you are unsure and looking for anti-spyware programs, you can find out if it is a rogue here:A similar category of programs is now called "scareware." Scareware programs are active infections that will pop-up on your computer and tell you that you are infected. If you look closely, it will usually have a name that looks like it might be legitimate, but it is NOT one of the programs you installed. It tells you to click and install it right away. If you click on any part of it, including the 'X' to close it, you may actually help it infect your computer further. Keeping protection updated and running resident protection can help prevent these infections. If it happens anyway, get offline as quickly as you can. Pull the internet connection cable or shut down the computer if you have to. Contact someone to help by using another computer if possible. These programs are also sometimes called 'rogues', but they are different than the older version of rogues mentioned above.

Please keep your programs up to date. This applies to Java, Adobe Flashplayer, Adobe Reader and your Internet Browsers in particular. Vulnerabilities in these programs are often exploited in order to install malware on your PC. Visiting a prepared web page suffices to infect your system.

In general Firefox, Opera and Google Chrome are considered to be more secure than Internet Explorer. In addition there are many useful add-ons that can protect you from possible risks:
  • WOT will warn you when you try to visit sites with poor reputation. The reputation is based on user ratings and is usually very accurate.
  • Script Blocker can help blocking many attempts to infect your system via malicious websites by only allowing scripts at sites you trust.
  • NoScript is a popular Firefox addon,
  • ScriptNo a popular Google Chrome addon.
For much more useful information, please also read Tony Klein's excellent article: How did I get infected in the first place

Hopefully these steps will help to keep you error free. If you run into more difficulty, we will certainly do what we can to help.
===

#10 catascopic

catascopic
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:11:33 AM

Posted 09 April 2014 - 10:39 PM

thanks again for your help.. It all appears good at the moment.. I'll give it back to the father-in-law tomorrow and hopefully he can't break it again..

 

cheers,

 

Brad



#11 nasdaq

nasdaq

  • Malware Response Team
  • 40,182 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Montreal, QC. Canada
  • Local time:02:33 PM

Posted 10 April 2014 - 09:51 AM

It appears that this issue is resolved, therefore I am closing the topic. If that is not the case and you need or wish to continue with this topic, please send me or any Moderator a Personal Message (PM) that you would like this topic re-opened.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users