Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Explorer.exe virus?


  • Please log in to reply
4 replies to this topic

#1 aresgraphics

aresgraphics

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:07:02 AM

Posted 24 May 2014 - 01:46 PM

http://gyazo.com/ca759fdd0a0e94f8fe5fcc644239527d

 

It sometimes goes up to 1-2 GB of memory, and 20-40 CPU.

I don't know why it does it. I had a virus before which used internet explorer process (iexplore.exe) but I fixed it by disabling internet explorer entirely!

I need help, and I've seen this forums via google and decided to ask here!

Thank you:) 


Edited by hamluis, 24 May 2014 - 03:10 PM.
Moved from MRL to AII - Hamluis.


BC AdBot (Login to Remove)

 


#2 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,680 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:04:02 AM

Posted 24 May 2014 - 05:50 PM

Welcome aboard p22002758.gif

 

p22002970.gif Download Security Check from here or here and save it to your Desktop.

  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

p22002970.gif Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
  • Make sure the following options are checked:
    • Internet Services
    • Windows Firewall
    • System Restore
    • Security Center/Action Center
    • Windows Update
    • Windows Defender
    • Other Services
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.


p22002970.gif Please download MiniToolBox and run it.

Checkmark following boxes:
  • Report IE Proxy Settings
  • Report FF Proxy Settings
  • List content of Hosts
  • List IP configuration
  • List Winsock Entries
  • List last 10 Event Viewer log
  • List Installed Programs
  • List Devices (do NOT change any settings here)
  • List Users, Partitions and Memory size
  • List Restore Points

Click Go and post the result.

p22002970.gif Please download Malwarebytes Anti-Malware to your desktop.
NOTE. If you already have MBAM 2.0 installed scroll down.

  • Double-click mb3-setup-1878.1878-3.5.1.2522.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:

    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.

  • Click Finish.
  • On the Dashboard, click the 'Update Now >>' link
  • After the update completes, click the 'Scan Now >>' button.
  • Or, on the Dashboard, click the Scan Now >> button.
  • If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
  • In most cases, a restart will be required.
  • Wait for the prompt to restart the computer to appear, then click on Yes.



If you already have MBAM 2.0 installed:

  • On the Dashboard, click the 'Update Now >>' link
  • After the update completes, click the 'Scan Now >>' button.
  • Or, on the Dashboard, click the Scan Now >> button.
  • If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
  • In most cases, a restart will be required.
  • Wait for the prompt to restart the computer to appear, then click on Yes.


How to get logs:
(Export log to save as txt)


  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Export'.
  • Click 'Text file (*.txt)'
  • In the Save File dialog box which appears, click on Desktop.
  • In the File name: box type a name for your scan log.
  • A message box named 'File Saved' should appear stating "Your file has been successfully exported".
  • Click Ok
  • Attach that saved log to your next reply.



(Copy to clipboard for pasting into forum replies or tickets)

  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.


p22002970.gifDownload Malwarebytes Anti-Rootkit from HERE to your Desktop.
  • Unzip downloaded file.
  • Open the folder where the contents were unzipped and run mbar.exe
  • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
  • DO NOT click on the Cleanup button. Simply exit the program.
  • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt


p22002970.gif Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.


If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.

NOTE Do NOT wrap your logs in "quote" or "code" brackets.
Do NOT use spoilers.
Do NOT edit your reply to post additional logs. Create new reply. I'll not get any email notifications about edits so I won't know you posted something new.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 


#3 aresgraphics

aresgraphics
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:07:02 AM

Posted 24 May 2014 - 10:22 PM

CHECKUP.txt

_____________________________________________________________________________________

Results of screen317's Security Check version 0.99.83  
   x64   
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
 Windows Security Center service is not running! This report may not be accurate! 
AVG Anti-Virus Free Edition 2012   
Microsoft Security Essentials      
 WMI entry may not exist for antivirus; attempting automatic update. 
 AVG2012 successfully updated! 
`````````Anti-malware/Other Utilities Check:````````` 
 Malwarebytes Anti-Malware version 1.75.0.1300  
 JavaFX 2.1.1    
 Java™ 6 Update 27  
 Java 7 Update 55  
 Visual Studio Extensions for Windows Library for JavaScript 
 Java version out of Date! 
 Adobe Flash Player 13.0.0.214  
 Mozilla Firefox (for.) 
 Google Chrome 34.0.1847.137  
 Google Chrome 35.0.1916.114  
 Google Chrome plugins...  
````````Process Check: objlist.exe by Laurent````````  
 Malwarebytes' Anti-Malware mbamscheduler.exe   
 Symantec Norton Online Backup NOBuAgent.exe  
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log`````````````````````` 
 

Rkill.txt

_____________________________________________________________________________________

 

 

Rkill 2.6.6 by Lawrence Abrams (Grinler)
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
 
Program started at: 05/24/2014 07:59:54 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1
 
Checking for Windows services to stop:
 
 * No malware services found to stop.
 
Checking for processes to terminate:
 
 * C:\Users\Ali\Downloads\SecurityCheck.exe (PID: 8144) [UP-HEUR]
 * C:\Users\Ali\AppData\Local\Temp\is-BJEAB.tmp\mbam-setup-2.0.2.1012.tmp (PID: 7512) [UP-HEUR]
 * C:\Users\Ali\AppData\Local\Temp\is-BJEAB.tmp\mbam-setup-2.0.2.1012.tmp (PID: 7512) [T-HEUR]
 
3 proccesses terminated!
 
Active Proxy Server Detected
 
 * Proxy Disabled.
 * ProxyOverride value deleted.
 * ProxyServer value deleted.
 * AutoConfigURL value deleted.
 * Proxy settings were backed up to Registry file.
 
Checking Registry for malware related settings:
 
 * No issues found in the Registry.
 
Backup Registry file created at:
 C:\Users\Ali\Desktop\rkill\rkill-05-24-2014-08-00-33.reg
 
Resetting .EXE, .COM, & .BAT associations in the Windows Registry.
 
Performing miscellaneous checks:
 
FSS.txt
_____________________________________________________________________________
Farbar Service Scanner Version: 21-05-2014
Ran by Ali (administrator) on 24-05-2014 at 19:51:34
Running from "C:\Users\Ali\Downloads"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************
 
Internet Services:
============
 
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.
IE proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
 
 
Windows Firewall:
=============
 
Firewall Disabled Policy: 
==================
 
 
System Restore:
============
 
System Restore Disabled Policy: 
========================
 
 
Action Center:
============
 
 
Windows Update:
============
 
Windows Autoupdate Disabled Policy: 
============================
 
 
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.
 
 
Windows Defender Disabled Policy: 
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
 
 
Other Services:
==============
 
 
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
 
 
**** End of log ****
 
Result.txt
________________________________________________________________________
 
 
MiniToolBox by Farbar  Version: 23-01-2014
Ran by Ali (administrator) on 24-05-2014 at 19:53:14
Running from "C:\Users\Ali\Downloads"
Microsoft Windows 7 Home Premium  Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************
 
========================= IE Proxy Settings: ============================== 
 
Proxy is enabled.
ProxyServer: http=127.0.0.1:8555;https=127.0.0.1:8555
 
========================= FF Proxy Settings: ============================== 
 
========================= Hosts content: =================================
 
 
 
127.0.0.1 activate.adobe.com
127.0.0.1 activate.adobe.com
 
========================= IP Configuration: ================================
 
Realtek PCIe GBE Family Controller = Local Area Connection (Connected)
Hamachi Network Interface = Hamachi (Connected)
802.11n Wireless LAN Card = Wireless Network Connection (Connected)
Microsoft Virtual WiFi Miniport Adapter = Wireless Network Connection 2 (Media disconnected)
 
 
# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4
 
reset
set global icmpredirects=enabled
add route prefix=0.0.0.0/0 interface="Hamachi" nexthop=25.0.0.1 publish=Yes
set interface interface="Hamachi" forwarding=disabled advertise=disabled metric=9000 siteprefixlength=0 nud=disabled routerdiscovery=disabled managedaddress=disabled otherstateful=disabled weakhostsend=disabled weakhostreceive=disabled ignoredefaultroutes=disabled advertisedrouterlifetime=0 advertisedefaultroute=disabled currenthoplimit=0 forcearpndwolpattern=disabled enabledirectedmacwolpattern=disabled
 
 
popd
# End of IPv4 configuration
 
 
 
Windows IP Configuration
 
   Host Name . . . . . . . . . . . . : Ali-HP
   Primary Dns Suffix  . . . . . . . : 
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
 
Ethernet adapter Local Area Connection* 12:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Anchorfree HSS VPN Adapter #2
   Physical Address. . . . . . . . . : 00-FF-5D-E9-AA-FD
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Ethernet adapter Local Area Connection* 9:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Anchorfree HSS VPN Adapter
   Physical Address. . . . . . . . . : 00-FF-8A-5A-A0-5B
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Wireless LAN adapter Wireless Network Connection 2:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Microsoft Virtual WiFi Miniport Adapter
   Physical Address. . . . . . . . . : D0-DF-9A-33-A4-19
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
 
Wireless LAN adapter Wireless Network Connection:
 
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : 802.11n Wireless LAN Card
   Physical Address. . . . . . . . . : D0-DF-9A-33-A4-18
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.0.14(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : May-24-14 7:45:00 PM
   Lease Expires . . . . . . . . . . : May-31-14 7:46:00 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DNS Servers . . . . . . . . . . . : 64.71.255.204
                                       64.71.255.198
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
Ethernet adapter Local Area Connection:
 
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
   Physical Address. . . . . . . . . : E0-69-95-F0-8B-EE
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.0.10(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : May-24-14 5:33:43 PM
   Lease Expires . . . . . . . . . . : May-31-14 7:45:00 PM
   Default Gateway . . . . . . . . . : 192.168.0.1
   DHCP Server . . . . . . . . . . . : 192.168.0.1
   DNS Servers . . . . . . . . . . . : 8.8.8.8
                                       8.8.4.4
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
Ethernet adapter Hamachi:
 
   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Hamachi Network Interface
   Physical Address. . . . . . . . . : 7A-79-19-10-0D-8B
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 25.16.13.139(Preferred) 
   Subnet Mask . . . . . . . . . . . : 255.0.0.0
   Lease Obtained. . . . . . . . . . : May-24-14 5:33:43 PM
   Lease Expires . . . . . . . . . . : May-24-15 7:44:57 PM
   Default Gateway . . . . . . . . . : 25.0.0.1
   DHCP Server . . . . . . . . . . . : 25.0.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled
Server:  dns.cp.net.rogers.com
Address:  64.71.255.204
 
Name:    google.com
Addresses:  2607:f8b0:400b:807::1004
 24.156.131.35
 24.156.131.40
 24.156.131.49
 24.156.131.24
 24.156.131.50
 24.156.131.44
 24.156.131.54
 24.156.131.39
 24.156.131.29
 24.156.131.55
 24.156.131.59
 24.156.131.34
 24.156.131.45
 24.156.131.30
 24.156.131.25
 24.156.131.20
 
 
Pinging google.com [66.185.95.54] with 32 bytes of data:
Reply from 66.185.95.54: bytes=32 time=21ms TTL=58
Reply from 66.185.95.54: bytes=32 time=17ms TTL=58
 
Ping statistics for 66.185.95.54:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 17ms, Maximum = 21ms, Average = 19ms
Server:  dns.cp.net.rogers.com
Address:  64.71.255.204
 
Name:    yahoo.com
Addresses:  98.139.183.24
 98.138.253.109
 206.190.36.45
 
 
Pinging yahoo.com [206.190.36.45] with 32 bytes of data:
Reply from 206.190.36.45: bytes=32 time=94ms TTL=51
Reply from 206.190.36.45: bytes=32 time=92ms TTL=51
 
Ping statistics for 206.190.36.45:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 92ms, Maximum = 94ms, Average = 93ms
 
Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
 
Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
 21...00 ff 5d e9 aa fd ......Anchorfree HSS VPN Adapter #2
 20...00 ff 8a 5a a0 5b ......Anchorfree HSS VPN Adapter
 13...d0 df 9a 33 a4 19 ......Microsoft Virtual WiFi Miniport Adapter
 12...d0 df 9a 33 a4 18 ......802.11n Wireless LAN Card
 11...e0 69 95 f0 8b ee ......Realtek PCIe GBE Family Controller
 19...7a 79 19 10 0d 8b ......Hamachi Network Interface
  1...........................Software Loopback Interface 1
===========================================================================
 
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0         25.0.0.1     25.16.13.139   9256
          0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.10     10
          0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.14     25
         25.0.0.0        255.0.0.0         On-link      25.16.13.139   9256
     25.16.13.139  255.255.255.255         On-link      25.16.13.139   9256
   25.255.255.255  255.255.255.255         On-link      25.16.13.139   9256
        127.0.0.0        255.0.0.0         On-link         127.0.0.1    306
        127.0.0.1  255.255.255.255         On-link         127.0.0.1    306
  127.255.255.255  255.255.255.255         On-link         127.0.0.1    306
      192.168.0.0    255.255.255.0         On-link      192.168.0.10    266
      192.168.0.0    255.255.255.0         On-link      192.168.0.14    281
     192.168.0.10  255.255.255.255         On-link      192.168.0.10    266
     192.168.0.14  255.255.255.255         On-link      192.168.0.14    281
    192.168.0.255  255.255.255.255         On-link      192.168.0.10    266
    192.168.0.255  255.255.255.255         On-link      192.168.0.14    281
        224.0.0.0        240.0.0.0         On-link         127.0.0.1    306
        224.0.0.0        240.0.0.0         On-link      192.168.0.10    266
        224.0.0.0        240.0.0.0         On-link      25.16.13.139   9256
        224.0.0.0        240.0.0.0         On-link      192.168.0.14    281
  255.255.255.255  255.255.255.255         On-link         127.0.0.1    306
  255.255.255.255  255.255.255.255         On-link      192.168.0.10    266
  255.255.255.255  255.255.255.255         On-link      25.16.13.139   9256
  255.255.255.255  255.255.255.255         On-link      192.168.0.14    281
===========================================================================
Persistent Routes:
  Network Address          Netmask  Gateway Address  Metric
          0.0.0.0          0.0.0.0         25.0.0.1  Default 
===========================================================================
 
IPv6 Route Table
===========================================================================
Active Routes:
 If Metric Network Destination      Gateway
  1    306 ::1/128                  On-link
  1    306 ff00::/8                 On-link
===========================================================================
Persistent Routes:
 If Metric Network Destination      Gateway
  0 4294967295 2620:9b::/96             On-link
  0   9000 ::/0                     2620:9b::1900:1
===========================================================================
========================= Winsock entries =====================================
 
Catalog5 01 C:\Windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation)
Catalog5 02 C:\Windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 03 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 04 C:\Windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 05 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog5 06 C:\Windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
Catalog5 07 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.)
Catalog5 09 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.)
Catalog9 01 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 02 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 03 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 04 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 05 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 06 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 07 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 08 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 09 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
Catalog9 10 C:\Windows\SysWOW64\mswsock.dll [232448] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
x64-Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
x64-Catalog5 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392] (Microsoft Corp.)
x64-Catalog5 09 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392] (Microsoft Corp.)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [326144] (Microsoft Corporation)
 
========================= Event log errors: ===============================
 
Application errors:
==================
Error: (05/24/2014 05:34:51 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/24/2014 04:59:25 PM) (Source: Application Error) (User: )
Description: Faulting application name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac
Faulting module name: rads_user_kernel.exe, version: 0.0.0.0, time stamp: 0x4e65c1ac
Exception code: 0xc0000005
Fault offset: 0x000b8554
Faulting process id: 0x32a4
Faulting application start time: 0xrads_user_kernel.exe0
Faulting application path: rads_user_kernel.exe1
Faulting module path: rads_user_kernel.exe2
Report Id: rads_user_kernel.exe3
 
Error: (05/24/2014 04:08:39 PM) (Source: Application Error) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000005
Fault offset: 0x0000000000020fa6
Faulting process id: 0x262c
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3
 
Error: (05/24/2014 04:08:21 PM) (Source: Application Error) (User: )
Description: Faulting application name: Explorer.EXE, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000374
Fault offset: 0x00000000000c40f2
Faulting process id: 0x262c
Faulting application start time: 0xExplorer.EXE0
Faulting application path: Explorer.EXE1
Faulting module path: Explorer.EXE2
Report Id: Explorer.EXE3
 
Error: (05/24/2014 11:53:17 AM) (Source: Application Error) (User: )
Description: Faulting application name: explorer.exe, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000022
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x3204
Faulting application start time: 0xexplorer.exe0
Faulting application path: explorer.exe1
Faulting module path: explorer.exe2
Report Id: explorer.exe3
 
Error: (05/24/2014 10:53:28 AM) (Source: Application Error) (User: )
Description: Faulting application name: explorer.exe, version: 6.1.7601.17567, time stamp: 0x4d672ee4
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x32f8
Faulting application start time: 0xexplorer.exe0
Faulting application path: explorer.exe1
Faulting module path: explorer.exe2
Report Id: explorer.exe3
 
Error: (05/24/2014 02:24:22 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8502
 
Error: (05/24/2014 02:24:22 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8502
 
Error: (05/24/2014 02:24:22 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (05/24/2014 02:24:21 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7473
 
 
System errors:
=============
Error: (05/24/2014 05:34:42 PM) (Source: Service Control Manager) (User: )
Description: A timeout was reached (30000 milliseconds) while waiting for the Ralink UPnP Media Server service to connect.
 
Error: (05/24/2014 05:33:50 PM) (Source: Service Control Manager) (User: )
Description: The Bluetooth Serial Driver service failed to start due to the following error: 
%%2
 
Error: (05/24/2014 05:33:38 PM) (Source: EventLog) (User: )
Description: The previous system shutdown at 5:08:45 PM on ?24/?05/?2014 was unexpected.
 
Error: (05/24/2014 02:32:41 PM) (Source: iaStor) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.
 
Error: (05/24/2014 11:55:42 AM) (Source: iaStor) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.
 
Error: (05/24/2014 11:55:37 AM) (Source: iaStor) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.
 
Error: (05/24/2014 11:16:18 AM) (Source: iaStor) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.
 
Error: (05/24/2014 00:20:26 AM) (Source: iaStor) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.
 
Error: (05/23/2014 10:21:10 PM) (Source: iaStor) (User: )
Description: The device, \Device\Ide\iaStor0, did not respond within the timeout period.
 
Error: (05/23/2014 07:55:37 PM) (Source: Service Control Manager) (User: )
Description: The Steam Client Service service failed to start due to the following error: 
%%1053
 
 
Microsoft Office Sessions:
=========================
Error: (05/24/2014 05:34:51 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
 
Error: (05/24/2014 04:59:25 PM) (Source: Application Error)(User: )
Description: rads_user_kernel.exe0.0.0.04e65c1acrads_user_kernel.exe0.0.0.04e65c1acc0000005000b855432a401cf77930a4b3dc6C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exeC:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe492e12ea-e386-11e3-a6ff-e06995f08bee
 
Error: (05/24/2014 04:08:39 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.177254ec4aa8ec00000050000000000020fa6262c01cf778b9700c9e6C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll31f563c8-e37f-11e3-a6ff-e06995f08bee
 
Error: (05/24/2014 04:08:21 PM) (Source: Application Error)(User: )
Description: Explorer.EXE6.1.7601.175674d672ee4ntdll.dll6.1.7601.177254ec4aa8ec000037400000000000c40f2262c01cf778b9700c9e6C:\Windows\Explorer.EXEC:\Windows\SYSTEM32\ntdll.dll272e2341-e37f-11e3-a6ff-e06995f08bee
 
Error: (05/24/2014 11:53:17 AM) (Source: Application Error)(User: )
Description: explorer.exe6.1.7601.175674d672ee4ntdll.dll6.1.7601.177254ec4aa8ec000002200000000000cd7d8320401cf775ff9c7a964C:\Windows\explorer.exeC:\Windows\SYSTEM32\ntdll.dll851d1da8-e35b-11e3-a6ff-e06995f08bee
 
Error: (05/24/2014 10:53:28 AM) (Source: Application Error)(User: )
Description: explorer.exe6.1.7601.175674d672ee4ntdll.dll6.1.7601.177254ec4aa8ec000002400000000000cd7d832f801cf770602cc0933C:\Windows\explorer.exeC:\Windows\SYSTEM32\ntdll.dll29ba4539-e353-11e3-a6ff-e06995f08bee
 
Error: (05/24/2014 02:24:22 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 8502
 
Error: (05/24/2014 02:24:22 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledEvent 8502
 
Error: (05/24/2014 02:24:22 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: Continuously busy for more than a second
 
Error: (05/24/2014 02:24:21 AM) (Source: Bonjour Service)(User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 7473
 
 
CodeIntegrity Errors:
===================================
  Date: 2014-05-24 17:33:15.299
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-24 17:33:15.268
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-21 17:55:55.277
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-21 17:55:55.261
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-19 23:59:29.369
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-19 23:59:29.338
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-18 14:17:43.335
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-18 14:17:43.304
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-17 17:27:26.829
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
  Date: 2014-05-17 17:27:26.798
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\btkrnl.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.
 
 
=========================== Installed Programs ============================
 
 Tools for .Net 3.5 (Version: 3.11.50727)
µTorrent (Version: 3.1.2)
Adobe Acrobat X Pro - English, Français, Deutsch (Version: 10.1.7)
Adobe After Effects CC (Version: 12)
Adobe After Effects CS5.5 Third Party Content (Version: 10.5)
Adobe After Effects CS6 (Version: 11)
Adobe AIR (Version: 4.0.0.1390)
Adobe Content Viewer (Version: 1.4.0)
Adobe Creative Cloud (Version: 2.1.0.213)
Adobe Creative Suite 5.5 Master Collection (Version: 5.5)
Adobe Download Assistant (Version: 1.2.1)
Adobe Flash Player 13 ActiveX (Version: 13.0.0.214)
Adobe Flash Player 13 Plugin (Version: 13.0.0.214)
Adobe Help Manager (Version: 4.0.244)
Adobe Photoshop CC (Version: 14.0)
Adobe Photoshop CS5.1 (Version: 12.1)
Adobe Photoshop CS6 (Version: 13.0)
Adobe Story (Version: 1.0.571)
Adobe Widget Browser (Version: 2.0 Build 230)
Adobe Widget Browser (Version: 2.0.230)
Agatha Christie - Peril at End House (Version: 2.2.0.95)
A-PDF Restrictions Remover
Apple Application Support (Version: 2.3.4)
Apple Mobile Device Support (Version: 5.1.1.4)
Apple Software Update (Version: 2.1.3.127)
Auto Typer by MurGee v1.2 (Version: 1.2)
AVG 2012 (Version: 12.0.1831)
AVG 2012 (Version: 12.0.1869)
AVG 2012 (Version: 12.0.1873)
AVG 2012 (Version: 12.0.1890)
AVG 2012 (Version: 12.0.1901)
AVG 2012 (Version: 12.0.1913)
AVG 2012 (Version: 12.0.2195)
AVG 2012 (Version: 12.0.2197)
AVG 2012 (Version: 12.0.2221)
AVG 2012 (Version: 12.0.3722)
AVG 2012 (Version: 12.1.2238)
AVG 2012 (Version: 12.1.2240)
AVG 2012 (Version: 12.1.2241)
AVG 2012 (Version: 12.1.2242)
AVG 2012 (Version: 12.1.2247)
AVG 2012 (Version: 2012.1.2247)
Banner Design Studio v5.1 (Version: 5.1)
Batman: Arkham City™
Battle.net
Bejeweled 2 Deluxe (Version: 2.2.0.95)
Bejeweled 3 (Version: 2.2.0.95)
Bitcoin (Version: 0.8.6)
Blackhawk Striker 2 (Version: 2.2.0.95)
Blasterball 3 (Version: 2.2.0.95)
Blend for Visual Studio 2012 (Version: 5.0.30709.0)
Blend for Visual Studio 2012 ENU resources (Version: 5.0.30709.0)
Bonjour (Version: 3.0.0.10)
Borderlands 2
Bounce Symphony (Version: 2.2.0.95)
Brother MFL-Pro Suite MFC-J280W (Version: 1.0.13.0)
Build-a-lot 2 (Version: 2.2.0.95)
Burnout Paradise: The Ultimate Box
Cake Mania (Version: 2.2.0.95)
calibre (Version: 1.1.0)
Camtasia Studio 7 (Version: 7.1.1)
CCleaner (Version: 4.04)
Cheat Engine 6.1
Chuzzle Deluxe (Version: 2.2.0.95)
CINEMA 4D Demo 12.043 (Version: 12.043)
CINEMA 4D Demo 13.017 (Version: 13.017)
CINEMA 4D R14
Cinema 4D version R12 (Version: R12)
Cisco EAP-FAST Module (Version: 2.2.14)
Cisco LEAP Module (Version: 1.0.19)
Cisco PEAP Module (Version: 1.1.6)
Combat Arms
Connect (Version: 1.4.11266.0)
Counter-Strike: Global Offensive
Counter-Strike: Source
Curse (Version: 6.0.0.0)
D3DX10 (Version: 15.4.2368.0902)
Dead Space
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
DeskPins (remove only)
Diner Dash 2 Restaurant Rescue (Version: 2.2.0.95)
Dino D-Day
DivX Setup (Version: 2.6.0.34)
DLL Suite 2013
Dora's World Adventure (Version: 2.2.0.95)
Dota 2
Dotfuscator and Analytics Community Edition (Version: 5.5.4521.29298)
Dropbox (Version: 2.8.2)
Dungeonland
Effects Suite 32-bit (Version: 10.0.2)
Entity Framework Designer for Visual Studio 2012 - enu (Version: 11.1.20702.00)
f.lux
Farm Frenzy (Version: 2.2.0.95)
FATE - The Traitor Soul (Version: 2.2.0.95)
FBP - Facebook Blaster Pro (Version: 9.0.4)
Fences (Version: 1.0)
Final Drive Nitro (Version: 2.2.0.95)
FlappyBird Bundle (Version: 2.0.0.3)
FlappyBird by GamePacks (Version: 1)
FlappyBird version 1.0 (Version: 1.0)
FontForge 2012-07-31 (Version: 2012-07-31)
Fraps
Friend Bomber (Version: 1.0.73.0)
Galerie de photos Windows Live (Version: 15.4.3502.0922)
Game Booster 3 (Version: 3.3)
Garena Plus (Version: 2011)
GhostMouse (Version: Free V3.2.1)
Google Chrome (Version: 35.0.1916.114)
Google Earth (Version: 7.1.2.2041)
Google Talk (remove only)
Google Update Helper (Version: 1.3.24.7)
Graboid Video 3.05 (Version: 3.05)
Gyazo 1.2.1
Hawken
Hearthstone
Heroes of Newerth (Version: 2.3.0)
Hewlett-Packard ACLM.NET v1.2.2.3 (Version: 1.00.0000)
Hi-Rez Studios Authenticate and Update Service (Version: 3.0.0.0)
History Viewer v4.6
Hotspot Shield 3.41 (Version: 3.41)
HP Auto (Version: 1.0.12935.3667)
HP Client Services (Version: 1.1.12938.3539)
HP Customer Experience Enhancements (Version: 6.0.1.8)
HP Deskjet 3050 J610 series Basic Device Software (Version: 22.50.231.0)
HP Deskjet 3050 J610 series Help (Version: 140.0.63.63)
HP Deskjet 3050 J610 series Product Improvement Study (Version: 22.50.231.0)
HP ENVY 4500 series Basic Device Software (Version: 32.0.1180.44630)
HP ENVY 4500 series Help (Version: 30.0.0)
HP Games (Version: 1.0.2.4)
HP LinkUp (Version: 2.01.026)
HP Odometer (Version: 2.10.0000)
HP Photo Creations (Version: 1.0.0.3781)
HP Setup (Version: 8.6.4530.3651)
HP Setup Manager (Version: 1.1.13253.3682)
HP Support Assistant (Version: 7.4.45.4)
HP Support Information (Version: 10.1.1000)
HP Update (Version: 5.005.002.002)
HP Vision Hardware Diagnostics (Version: 2.5.0.0)
HPDiagnosticAlert (Version: 1.00.0000)
HTC Home Apis (Version: 3.0.620.0)
HyperCam 3 (Version: 3.4.1206.04)
IconPackager
IconPackager (Version: 5.00)
IIS 8.0 Express (Version: 8.0.1557)
IIS Express Application Compatibility Database for x64
IIS Express Application Compatibility Database for x86
Intel® Control Center (Version: 1.2.1.1007)
Intel® Management Engine Components (Version: 7.0.0.1144)
Intel® Processor Graphics (Version: 8.15.10.2291)
InterActual Player
Internet Explorer Toolbar 4.6 by SweetPacks (Version: 4.6.0003)
iTunes (Version: 10.6.1.7)
Jamestown
Java 7 Update 51 (64-bit) (Version: 7.0.510)
Java 7 Update 55 (Version: 7.0.550)
Java Auto Updater (Version: 2.0.6.1)
Java™ 6 Update 27 (64-bit) (Version: 6.0.270)
Java™ 6 Update 27 (Version: 6.0.270)
Java™ SE Development Kit 6 Update 27 (64-bit) (Version: 1.6.0.270)
Java™ SE Development Kit 7 (64-bit) (Version: 1.7.0.0)
Java™ SE Development Kit 7 Update 3 (64-bit) (Version: 1.7.0.30)
JavaFX 2.0.3 (64-bit) (Version: 2.0.3)
JavaFX 2.0.3 SDK (64-bit) (Version: 2.0.3)
JavaFX 2.1.1 (Version: 2.1.1)
Jing (Version: 2.6.12032.1)
Jungle Timer (Version: 1.0.0)
Junk Mail filter update (Version: 15.4.3502.0922)
KDT Web History Tracker (Version: 1.0.0)
LabelPrint (Version: 2.5.3609)
League of Legends (Version: 3.0.0)
Left 4 Dead
Left 4 Dead 2
LocalESPC (Version: 8.59.25584)
LocalESPCui for en-us (Version: 8.59.25584)
LogMeIn Hamachi (Version: 2.2.0.193)
LOLReplay (Version: 0.7.9.19)
Mac OS X Cursors (Version: 1.1)
Mah Jong Medley (Version: 2.2.0.95)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
ManyCam 4.0.78 (Version: 4.0.78)
McAfee Security Scan Plus (Version: 3.8.130.10)
Mesh Runtime (Version: 15.4.5722.2)
Microsoft .NET Framework 4 Multi-Targeting Pack (Version: 4.0.30319)
Microsoft .NET Framework 4.5 (Version: 4.5.50709)
Microsoft .NET Framework 4.5 Multi-Targeting Pack (Version: 4.5.50709)
Microsoft .NET Framework 4.5 SDK (Version: 4.5.50709)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft ASP.NET MVC 3 - Visual Studio 2012 Tools Update (Version: 3.0.30710.0)
Microsoft ASP.NET MVC 3 (Version: 3.0.20105.0)
Microsoft ASP.NET MVC 4 - Visual Studio 2012 Tools (Version: 4.0.20710.0)
Microsoft ASP.NET MVC 4 Runtime (Version: 4.0.20710.0)
Microsoft ASP.NET Web Pages - Visual Studio 2012 Tools (Version: 1.0.20710.0)
Microsoft ASP.NET Web Pages (Version: 1.0.20105.0)
Microsoft ASP.NET Web Pages 2 - Visual Studio 2012 Tools (Version: 2.0.20710.0)
Microsoft ASP.NET Web Pages 2 Runtime (Version: 2.0.20710.0)
Microsoft Help Viewer 2.0 (Version: 2.0.50727)
Microsoft LightSwitch for Visual Studio 2012 Core (Version: 11.0.50727)
Microsoft LightSwitch for Visual Studio 2012 CoreRes - ENU (Version: 11.0.50727)
Microsoft Maren (Version: 1.0.1.0)
Microsoft NuGet - Visual Studio 2012 (Version: 2.0.30625.9003)
Microsoft Office 2010 Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Access Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Excel MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Home and Business 2010 (Version: 14.0.6029.1000)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
Microsoft Office OneNote MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Outlook MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office PowerPoint MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (French) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proof (Spanish) 2010 (Version: 14.0.6029.1000)
Microsoft Office Proofing (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Publisher MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Office Single Image 2010 (Version: 14.0.6029.1000)
Microsoft Office Word MUI (English) 2010 (Version: 14.0.6029.1000)
Microsoft Portable Library Multi-Targeting Pack (Version: 11.0.50709.17929)
Microsoft Portable Library Multi-Targeting Pack Language Pack - enu (Version: 11.0.50709.17929)
Microsoft Report Viewer Add-On for Visual Studio 2012 (Version: 11.1.2802.16)
Microsoft Security Client (Version: 4.0.1526.0)
Microsoft Security Essentials (Version: 4.0.1526.0)
Microsoft Silverlight (Version: 5.1.10411.0)
Microsoft Silverlight 4 SDK (Version: 4.0.60310.0)
Microsoft Silverlight 5 SDK (Version: 5.0.61118.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft SQL Server 2012 Command Line Utilities  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Data-Tier App Framework  (Version: 11.0.2316.0)
Microsoft SQL Server 2012 Express LocalDB  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Management Objects  (x64) (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Native Client  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL Compiler Service  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 Transact-SQL ScriptDom  (Version: 11.0.2100.60)
Microsoft SQL Server 2012 T-SQL Language Service  (Version: 11.0.2100.60)
Microsoft SQL Server Compact 4.0 SP1 x64 ENU (Version: 4.0.8876.1)
Microsoft SQL Server Data Tools - enu (11.1.20627.00) (Version: 11.1.20627.00)
Microsoft SQL Server Data Tools Build Utilities - enu (11.1.20627.00) (Version: 11.1.20627.00)
Microsoft SQL Server System CLR Types (Version: 10.50.1600.1)
Microsoft SQL Server System CLR Types (x64) (Version: 10.50.1600.1)
Microsoft System CLR Types for SQL Server 2012 (Version: 11.0.2100.60)
Microsoft System CLR Types for SQL Server 2012 (x64) (Version: 11.0.2100.60)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.56336)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.59192)
Microsoft Visual C++ 2005 Redistributable (x64) (Version: 8.0.61000)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2012  x64 Designtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 Compilers - ENU Resources (Version: 11.0.50727)
Microsoft Visual C++ 2012 Compilers (Version: 11.0.50727)
Microsoft Visual C++ 2012 Core Libraries (Version: 11.0.50727)
Microsoft Visual C++ 2012 Extended Libraries (Version: 11.0.50727)
Microsoft Visual C++ 2012 Microsoft Foundation Class Libraries (Version: 11.0.50727)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (Version: 11.0.51106.1)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Debug Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual C++ 2012 x86 Debug Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (Version: 11.0.50727)
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (Version: 11.0.51106)
Microsoft Visual Studio 2010 Office Developer Tools (x64) (Version: 11.0.50727)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.31125)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (Version: 10.0.31130)
Microsoft Visual Studio 2012 Devenv (Version: 11.0.50727)
Microsoft Visual Studio 2012 Devenv Resources (Version: 11.0.50727)
Microsoft Visual Studio 2012 IntelliTrace Core amd64 (Version: 11.0.50727)
Microsoft Visual Studio 2012 IntelliTrace Core x86 (Version: 11.0.50727)
Microsoft Visual Studio 2012 IntelliTrace Front End x86 (Version: 11.0.50727)
Microsoft Visual Studio 2012 Performance Collection Tools - ENU (Version: 11.0.50727)
Microsoft Visual Studio 2012 Performance Collection Tools (Version: 11.0.50727)
Microsoft Visual Studio 2012 Preparation (Version: 11.0.50727)
Microsoft Visual Studio 2012 SharePoint Developer Tools (Version: 11.0.50727)
Microsoft Visual Studio 2012 SharePoint Developer Tools ENU Language Pack (Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell (Minimum) (Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell (Minimum) Interop Assemblies (Version: 11.0.50727)
Microsoft Visual Studio 2012 Shell (Minimum) Resources (Version: 11.0.50727)
Microsoft Visual Studio 2012 Tools for SQL Server Compact 4.0 SP1 ENU (Version: 4.0.8876.1)
Microsoft Visual Studio Premium 2012 - ENU (Version: 11.0.50727)
Microsoft Visual Studio Premium 2012 (Version: 11.0.50727)
Microsoft Visual Studio Professional 2012 - ENU (Version: 11.0.50727)
Microsoft Visual Studio Professional 2012 (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Object Model (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Object Model Language Pack - ENU (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Storyboarding (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Storyboarding Language Pack - ENU (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Team Explorer (Version: 11.0.50727)
Microsoft Visual Studio Team Foundation Server 2012 Team Explorer Language Pack - ENU (Version: 11.0.50727)
Microsoft Visual Studio Ultimate 2012 - ENU (Version: 11.0.50727)
Microsoft Visual Studio Ultimate 2012 (Version: 11.0.50727)
Microsoft Visual Studio Ultimate 2012 (Version: 11.0.50727.26)
Microsoft Visual Studio Ultimate 2012 XAML UI Designer Core (Version: 11.0.50727)
Microsoft Visual Studio Ultimate 2012 XAML UI Designer enu Resources (Version: 11.0.50727)
Microsoft Web Deploy 3.0 (Version: 3.1236.1631)
Microsoft Web Deploy dbSqlPackage Provider - enu (Version: 10.3.20225.0)
Microsoft Web Developer Tools - Visual Studio 2012 (Version: 1.0.30710.0)
Microsoft Web Platform Installer 4.0 (Version: 4.0.1622)
Microsoft_VC80_ATL_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_ATL_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_CRT_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFC_x86_x64 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86 (Version: 8.0.50727.4053)
Microsoft_VC80_MFCLOC_x86_x64 (Version: 80.50727.4053)
Microsoft_VC90_ATL_x86 (Version: 1.00.0000)
Microsoft_VC90_ATL_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86 (Version: 1.00.0000)
Microsoft_VC90_CRT_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFC_x86_x64 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86 (Version: 1.00.0000)
Microsoft_VC90_MFCLOC_x86_x64 (Version: 1.00.0000)
MKLOL
Movie DVD Maker 2.9.0412
Movies Toolbar for Firefox (Dist. by Somoto Ltd.) (Version: 1.6.2.0)
Mozilla Firefox 29.0.1 (x86 en-US) (Version: 29.0.1)
Mozilla Maintenance Service (Version: 29.0.1)
MSVCRT (Version: 15.4.2862.0708)
MSVCRT Redists (Version: 1.0)
MSVCRT_amd64 (Version: 15.4.2862.0708)
MSXML 4.0 SP3 Parser (KB2721691) (Version: 4.30.2114.0)
MSXML 4.0 SP3 Parser (KB973685) (Version: 4.30.2107.0)
MSXML 4.0 SP3 Parser (Version: 4.30.2100.0)
Mullvad
Mystery P.I. - Stolen in San Francisco (Version: 2.2.0.95)
Namco All-Stars PAC-MAN (Version: 2.2.0.95)
NetBeans IDE 7.2 (Version: 7.2)
Nexon Game Manager
No-IP DUC (Version: 3.0.4)
Norton Online Backup (Version: 2.1.17869)
Notepad++ (Version: 5.9.6.2)
Nuance PDF Viewer Plus (Version: 5.30.3290)
NVIDIA PhysX (Version: 9.12.0613)
ObjectDock Plus 2 (Version: 1.00)
Oblivion (Version: 1.00.0000)
Open Broadcaster Software
OpenAL
OpenVPN 2.3.2-I003  (Version: 2.3.2-I003)
Optimizer Pro v3.0 (Version: 3.0)
osu! (Version: 0.0.0.0)
PacSteamT (Version: 1.1.6.9)
Pando Media Booster (Version: 2.6.0.7)
PAYDAY: The Heist
PC Speed Up (Version: 3.4.6.0)
PDF Complete Special Edition (Version: 4.0.35)
PDF Password Cracker Pro v3.2
PDF Password Remover v3.1
PDF Settings CC (Version: 12.0)
PDF Settings CS5 (Version: 10.0)
PDF Settings CS6 (Version: 11.0)
PDFtk - The PDF Toolkit version 2.02 (Version: 2.02)
Penguins! (Version: 2.2.0.95)
Plants vs. Zombies - Game of the Year (Version: 2.2.0.95)
PlayReady PC Runtime amd64 (Version: 1.3.0)
PlayReady PC Runtime x86 (Version: 1.3.0)
Poker Superstars III (Version: 2.2.0.95)
Polar Bowler (Version: 2.2.0.95)
Polar Golfer (Version: 2.2.0.95)
Portal
Portal 2
PowerISO (Version: 5.0)
PreEmptive Analytics Visual Studio Components (Version: 1.0.2180.1)
Prerequisites for SSDT  (Version: 11.0.2100.60)
PressReader (Version: 5.10.1217.0)
Product Improvement Study for HP ENVY 4500 series (Version: 32.0.1180.44630)
PxMergeModule (Version: 1.00.0000)
QuickTime (Version: 7.74.80.86)
RaidCall (Version: 7.3.0-1.0.10926.49)
Rainmeter (Version: 3.0 beta r2085)
Ralink 802.11n Wireless LAN Card (Version: 4.0.3.0)
Razer Comms (Version: 1.60.28)
Razer Core (Version: 1.0.1.37)
Reader for PC (Version: 2.0.00.07121)
Realtek High Definition Audio Driver (Version: 6.0.1.6531)
Recovery Manager (Version: 5.5.3621)
Registry Mechanic 10.0 (Version: 10.0)
Remote Graphics Receiver (Version: 5.4.5)
ROBLOX Player for Ali
Rogers Self Help Software 4059 (Version: 4059)
Rogers Update Manager (Version: 4059)
RSH Home Networking Wizard (Version: 4059)
RZ DVD Creator (Version: 4.52)
Scansoft PDF Professional
Security Task Manager 1.8g (Version: 1.8g)
SEO PowerSuite
SimpleOCR 3.1
Skype Click to Call (Version: 7.2.15747.10003)
Skype™ 6.3 (Version: 6.3.105)
Slingo Supreme (Version: 2.2.0.95)
Smite (Version: 0.1.1889.0)
Snagit 10.0.1 (Version: 10.0.1)
Software (Version: 1.0)
Source SDK Base 2006
ss u helper (Version: 2.1.0.1378)
Stardock Software (Version: 1.00)
Steam (Version: 1.0.0.0)
Super Meat Boy v1.5
SweetIM for Messenger 3.7 (Version: 3.7.0005)
Switch Sound File Converter
System Requirements Lab CYRI (Version: 5.0.6.0)
System Requirements Lab for Intel (Version: 4.5.9.0)
TAP-Windows 9.9.2 (Version: 9.9.2)
Team Fortress 2
TeamViewer 9 (Version: 9.0.28223)
Tiny Download Manager (remove only) (Version: 2)
Trapcode Particular
Trapcode Suite 64-bit (Version: 12.0.0)
tViewer 2.0 (Version: 2.0)
Uninstall LSI (Version: 3.0b)
Unity Web Player (Version: )
Update for  (KB2504637) (Version: 1)
Update for Microsoft Office 2010 (KB2553065)
Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553270) 32-Bit Edition
Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
Update for Microsoft Office 2010 (KB2566458)
Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597091) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
Update for Microsoft OneNote 2010 (KB2589345) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2553248) 32-Bit Edition
Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
Update Installer for WildTangent Games App
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
Vegas Pro 11.0 (Version: 11.0.424)
Vegas Pro 12.0 (64-bit) (Version: 12.0.563)
Ventrilo Client for Windows x64 (Version: 3.0.8.0)
Virtual Villagers 4 - The Tree of Life (Version: 2.2.0.95)
Visual Studio 2008 x64 Redistributables (Version: 10.0.0.2)
Visual Studio 2012 Prerequisites - ENU Language Pack (Version: 11.0.50727)
Visual Studio 2012 Prerequisites (Version: 11.0.50727)
Visual Studio Extensions for Windows Library for JavaScript (Version: 1.0.8514.0)
VLC media player 2.0.2 (Version: 2.0.2)
War of the Roses Balance Beta
War Thunder Launcher 1.0.1.278
Warlock - Master of the Arcane
WavePad Sound Editor (Version: 5.48)
WCF Data Services 5.0 (for OData v3) Primary Components (Version: 5.0.50628.0)
WCF Data Services Tools for Microsoft Visual Studio 2012 (Version: 5.0.50710.0)
WCF RIA Services V1.0 SP2 (Version: 4.1.61829.0)
WhiteSmoke (Version: 1.00.6034.13143)
WIDCOMM Bluetooth Software (Version: 5.0.1.1500)
WildTangent Games App (Version: 4.0.8.7)
Windows App Certification Kit Native Components (Version: 8.59.25584)
Windows App Certification Kit x64 (Version: 8.59.25584)
Windows Live (Version: 15.4.3502.0922)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Runtime Intellisense Content - en-us (Version: 8.59.25584)
Windows Software Development Kit (Version: 8.59.25584)
Windows Software Development Kit DirectX x64 Remote (Version: 8.59.25584)
Windows Software Development Kit DirectX x86 Remote (Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps (Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps DirectX x64 Remote (Version: 8.59.25584)
Windows Software Development Kit for Windows Store Apps DirectX x86 Remote (Version: 8.59.25584)
WinPcap 4.1.2 (Version: 4.1.0.2001)
WinRAR 4.10 beta 1 (64-bit) (Version: 4.10.1)
WolfQuest (Version: 2.5.1)
World of Warcraft
World of Warplanes
XSplit Broadcaster (Version: 1.3.1310.1103)
Xvid MPEG-4 Video Codec
Zinio Reader 4 (Version: 4.0.3184)
ZoneAlarm Security Toolbar  (Version: 1.8.22.0)
Zuma Deluxe (Version: 2.2.0.95)
 
========================= Devices: ================================
 
Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.
 
 
========================= Memory info: ===================================
 
Percentage of memory in use: 63%
Total physical RAM: 6050.52 MB
Available physical RAM: 2215.73 MB
Total Pagefile: 12401.03 MB
Available Pagefile: 7403.44 MB
Total Virtual: 4095.88 MB
Available Virtual: 3959.77 MB
 
========================= Partitions: =====================================
 
1 Drive c: (OS) (Fixed) (Total:686.61 GB) (Free:138.6 GB) NTFS
2 Drive d: (HP_RECOVERY) (Fixed) (Total:11.93 GB) (Free:1.46 GB) NTFS
 
========================= Users: ========================================
 
User accounts for \\ALI-HP
 
Administrator            Ali                      Big Ali                  
fbwuser043C              fbwuser1F08              fbwuserF6FC              
Guest                    
 
========================= Restore Points ==================================
 
20-05-2014 03:50:41 Windows Modules Installer
21-05-2014 22:26:26 Windows Update
 
**** End of log ****
 
system-log.txt
_______________________________________________________________________________

 

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009
 
© Malwarebytes Corporation 2011-2012
 
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
 
Account is Administrative
 
Internet Explorer version: 9.0.8112.16421
 
Java version: 1.6.0_27
 
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.093000 GHz
Memory total: 6344425472, free: 2140426240
 
Could not load protection driver
Downloaded database version: v2014.05.24.08
Downloaded database version: v2014.05.21.01
=======================================
Initializing...
------------ Kernel report ------------
     05/24/2014 19:56:12
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\iaStor.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\PxHlpa64.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\system32\drivers\RzFilter.sys
\SystemRoot\system32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\avgrkx64.sys
\SystemRoot\system32\DRIVERS\avgidsha.sys
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\avgmfx64.sys
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\avgtdia.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\hssdrv6.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\System32\Drivers\SCDEmu.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\drivers\blbdrive.sys
\SystemRoot\system32\DRIVERS\avgldx64.sys
\??\C:\Windows\system32\drivers\RzDxgk.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\system32\drivers\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\netr28x.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\drivers\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\mcvidrv.sys
\SystemRoot\system32\DRIVERS\STREAM.SYS
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\mcaudrv_x64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\taphss6.sys
\SystemRoot\system32\DRIVERS\hamachi.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\DRIVERS\avgidsfiltera.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\npf.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\avgidsdrivera.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\system32\drivers\MSPQM.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk4\DR4
Upper Device Object: 0xfffffa8009779060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007a\
Lower Device Object: 0xfffffa800977cb60
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk3\DR3
Upper Device Object: 0xfffffa800977a060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000079\
Lower Device Object: 0xfffffa800977c060
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa800977b060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000078\
Lower Device Object: 0xfffffa8009766750
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800977d060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000077\
Lower Device Object: 0xfffffa800973f660
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8007e66060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa8006bd9050
Lower Device Driver Name: \Driver\iaStor\
IRP handler 15 of \Driver\iaStor is hooked
Unhooking enabled.
<<<1>>>
Upper Device Name: \Device\Harddisk4\DR4
Upper Device Object: 0xfffffa8009779060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007a\
Lower Device Object: 0xfffffa800977cb60
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk3\DR3
Upper Device Object: 0xfffffa800977a060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000079\
Lower Device Object: 0xfffffa800977c060
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa800977b060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000078\
Lower Device Object: 0xfffffa8009766750
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800977d060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000077\
Lower Device Object: 0xfffffa800973f660
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8007e66060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa8006bd9050
Lower Device Driver Name: \Driver\iaStor\
Driver name found: iaStor
Initialization returned 0x0
Load Function returned 0x0
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8007e66060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007e66b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007e66060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8006bd9050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a011bf18d0, 0xfffffa8007e66060, 0xfffffa800bb92640
Lower DeviceData: 0xfffff8a001d1a2a0, 0xfffffa8006bd9050, 0xfffffa800a1fc690
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 23C0725C
 
Partition information:
 
    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition file system is NTFS
    Partition is bootable
 
    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1439918080
 
    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1440124928  Numsec = 25020416
 
    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
 
Disk Size: 750156374016 bytes
Sector size: 512 bytes
 
Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1465129168-1465149168)...
Sectors 1 - 93 --> [Forged physical sectors]
Sectors 211 - 550 --> [Forged physical sectors]
Done!
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xfffffa800977d060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800976fb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800977d060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800973f660, DeviceName: \Device\00000077\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 2, DevicePointer: 0xfffffa800977b060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8009741b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800977b060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8009766750, DeviceName: \Device\00000078\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 3, DevicePointer: 0xfffffa800977a060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800977ab90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800977a060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800977c060, DeviceName: \Device\00000079\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 4, DevicePointer: 0xfffffa8009779060, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8009779b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8009779060, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800977cb60, DeviceName: \Device\0000007a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Read File:  File "c:\programdata\avg2012\chjw\683c67363c66ff06.dat:8f807335-591b-4a29-be92-2a3e1e576860" is sparse (flags = 32768)
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scan finished
=======================================
 
 
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-1-u.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-1-k.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-211-u.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-211-k.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009
 
© Malwarebytes Corporation 2011-2012
 
OS version: 6.1.7601 Windows 7 Service Pack 1 x64
 
Account is Administrative
 
Internet Explorer version: 9.0.8112.16421
 
Java version: 1.6.0_27
 
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 3.093000 GHz
Memory total: 6344425472, free: 2140426240
 
Could not load protection driver
Downloaded database version: v2014.05.24.08
Downloaded database version: v2014.05.21.01
=======================================
Initializing...
------------ Kernel report ------------
     05/24/2014 19:56:12
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\iaStor.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\DRIVERS\MpFilter.sys
\SystemRoot\System32\Drivers\PxHlpa64.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\system32\drivers\RzFilter.sys
\SystemRoot\system32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\avgrkx64.sys
\SystemRoot\system32\DRIVERS\avgidsha.sys
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\avgmfx64.sys
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\avgtdia.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\hssdrv6.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\termdd.sys
\SystemRoot\System32\Drivers\SCDEmu.SYS
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\drivers\blbdrive.sys
\SystemRoot\system32\DRIVERS\avgldx64.sys
\??\C:\Windows\system32\drivers\RzDxgk.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\system32\drivers\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\netr28x.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\drivers\intelppm.sys
\SystemRoot\system32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\mcvidrv.sys
\SystemRoot\system32\DRIVERS\STREAM.SYS
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\drivers\mcaudrv_x64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\taphss6.sys
\SystemRoot\system32\DRIVERS\hamachi.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\serscan.sys
\SystemRoot\system32\drivers\swenum.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\drivers\usbaudio.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\DRIVERS\avgidsfiltera.sys
\SystemRoot\system32\DRIVERS\NisDrvWFP.sys
\SystemRoot\system32\drivers\npf.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\avgidsdrivera.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\system32\drivers\MSPQM.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk4\DR4
Upper Device Object: 0xfffffa8009779060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007a\
Lower Device Object: 0xfffffa800977cb60
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk3\DR3
Upper Device Object: 0xfffffa800977a060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000079\
Lower Device Object: 0xfffffa800977c060
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa800977b060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000078\
Lower Device Object: 0xfffffa8009766750
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800977d060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000077\
Lower Device Object: 0xfffffa800973f660
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8007e66060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa8006bd9050
Lower Device Driver Name: \Driver\iaStor\
IRP handler 15 of \Driver\iaStor is hooked
Unhooking enabled.
<<<1>>>
Upper Device Name: \Device\Harddisk4\DR4
Upper Device Object: 0xfffffa8009779060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000007a\
Lower Device Object: 0xfffffa800977cb60
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
Initialization returned 0x0
Load Function returned 0x0
<<<1>>>
Upper Device Name: \Device\Harddisk3\DR3
Upper Device Object: 0xfffffa800977a060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000079\
Lower Device Object: 0xfffffa800977c060
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa800977b060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000078\
Lower Device Object: 0xfffffa8009766750
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800977d060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\00000077\
Lower Device Object: 0xfffffa800973f660
Lower Device Driver Name: \Driver\USBSTOR\
Driver name found: USBSTOR
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8007e66060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa8006bd9050
Lower Device Driver Name: \Driver\iaStor\
Driver name found: iaStor
Initialization returned 0x0
Load Function returned 0x0
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8007e66060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007e66b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007e66060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8006bd9050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0xfffff8a011bf18d0, 0xfffffa8007e66060, 0xfffffa800bb92640
Lower DeviceData: 0xfffff8a001d1a2a0, 0xfffffa8006bd9050, 0xfffffa800a1fc690
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 23C0725C
 
Partition information:
 
    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048  Numsec = 204800
    Partition file system is NTFS
    Partition is bootable
 
    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 206848  Numsec = 1439918080
 
    Partition 2 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 1440124928  Numsec = 25020416
 
    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0  Numsec = 0
 
Disk Size: 750156374016 bytes
Sector size: 512 bytes
 
Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1465129168-1465149168)...
Sectors 1 - 93 --> [Forged physical sectors]
Sectors 211 - 550 --> [Forged physical sectors]
Done!
Physical Sector Size: 0
Drive: 1, DevicePointer: 0xfffffa800977d060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800976fb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800977d060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800973f660, DeviceName: \Device\00000077\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 2, DevicePointer: 0xfffffa800977b060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8009741b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800977b060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8009766750, DeviceName: \Device\00000078\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 3, DevicePointer: 0xfffffa800977a060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800977ab90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800977a060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800977c060, DeviceName: \Device\00000079\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 4, DevicePointer: 0xfffffa8009779060, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8009779b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8009779060, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800977cb60, DeviceName: \Device\0000007a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Read File:  File "c:\programdata\avg2012\chjw\683c67363c66ff06.dat:8f807335-591b-4a29-be92-2a3e1e576860" is sparse (flags = 32768)
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scan finished
=======================================
 
 
Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-1-u.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-1-k.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-211-u.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\LBA-0-211-k.mbam...
Removal finished
 

mbar.txt

________________________________________________________________________________________________

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org
 
Database version: v2014.05.24.08
 
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Ali :: ALI-HP [administrator]
 
24/05/2014 7:56:18 PM
mbar-log-2014-05-24 (19-56-18).txt
 
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 561691
Time elapsed: 2 hour(s), 19 minute(s), 25 second(s)
 
Memory Processes Detected: 0
(No malicious items detected)
 
Memory Modules Detected: 0
(No malicious items detected)
 
Registry Keys Detected: 0
(No malicious items detected)
 
Registry Values Detected: 0
(No malicious items detected)
 
Registry Data Items Detected: 0
(No malicious items detected)
 
Folders Detected: 0
(No malicious items detected)
 
Files Detected: 0
(No malicious items detected)
 
Physical Sectors Detected: 2
Physical Sector #1 on Drive #0 (Forged physical sector) -> No action taken.
Physical Sector #211 on Drive #0 (Forged physical sector) -> No action taken.
 
(end)
 
malware log.txt, I couldn't save it as a text file as it would crash, so I made an xmp I hope it still works
______________________________________________________________________________________________
 
<?xml version="1.0" encoding="UTF-8" ?>
<logs>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:04:46.863101-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="135c94d0-714a-4c78-9182-8e438eef6695" result="Starting" subtype="Malware Protection"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:04:47.060113-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="d9c0df22-b4b8-463b-ae26-cd2512b8b7e5" result="Started" subtype="Malware Protection"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:04:47.791155-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="3eade409-27d9-48d4-b41e-b03e4203c8d0" result="Starting" subtype="Malicious Website Protection"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:05:06.525226-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="6fd30f5b-f6c4-4473-b907-9477718dbe14" result="Started" subtype="Malicious Website Protection"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:06:36.059347-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="a9559f02-7e36-4eab-944f-7b8bf8061e9a" subtype="Malicious Website Protection" direction="Outbound" domain="flyclick.biz" ip="88.214.193.174" malwaretype="IP" port="10127"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:06:36.553375-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="428482d6-9dd9-4e83-9109-f99a889a6bba" subtype="Malicious Website Protection" direction="Outbound" domain="flyclick.biz" ip="88.214.193.174" malwaretype="IP" port="10127"></record>
   <record severity="debug" LoggingEventType="1" datetime="2014-05-24T20:08:40.611471-04:00" source="Manual" type="Update" username="SYSTEM" systemname="ALI-HP" fromVersion="2014.2.20.1" last_modified_tag="e8e95bc0-04a5-44f3-8ad5-eac8da008dde" name="Rootkit Database" toVersion="2014.5.21.1"></record>
   <record severity="debug" LoggingEventType="1" datetime="2014-05-24T20:08:51.668104-04:00" source="Manual" type="Update" username="SYSTEM" systemname="ALI-HP" fromVersion="2014.3.4.9" last_modified_tag="81f42041-ab8d-4fb3-810f-febf23395d7f" name="Malware Database" toVersion="2014.5.24.8"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:09:01.865687-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="40fa2cdb-d17d-4c5f-ba49-1fda32c07e18" result="Starting" subtype="Refresh"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:09:01.950692-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="6f29fe5f-5bb9-4a26-9346-e78cef098d76" result="Stopping" subtype="Malicious Website Protection"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:09:02.606729-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="2921c1f7-74b5-49b7-98d4-95229049fb5b" result="Stopped" subtype="Malicious Website Protection"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:10:00.922065-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="b7006548-fc1a-46a9-89ff-3cff5c9083c5" result="Success" subtype="Refresh"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:10:01.457095-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="2728d867-bcba-47eb-99b7-06f9bf0569e5" result="Starting" subtype="Malicious Website Protection"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T20:10:06.207367-04:00" source="Protection" type="Protection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="b014c0fc-7970-47ad-90dd-b68221e22efc" result="Started" subtype="Malicious Website Protection"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T20:10:21.403236-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="d7ff9031-063f-400a-ba75-3a52643769ea" subtype="Malicious Website Protection" direction="Outbound" domain="taiborucheng.com" ip="76.84.249.229" malwaretype="IP" port="55232"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T20:10:22.099276-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="af8367af-acec-4259-9937-270c72640428" subtype="Malicious Website Protection" direction="Outbound" domain="taiborucheng.com" ip="76.84.249.229" malwaretype="IP" port="55232"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T20:10:22.297287-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="41f2b1c1-1397-4b94-88e8-c716840e8da1" subtype="Malicious Website Protection" direction="Outbound" domain="taiborucheng.com" ip="109.87.71.45" malwaretype="IP" port="55233"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T20:10:22.484298-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="2da1ebe9-2caf-4643-bb20-572286034bbd" subtype="Malicious Website Protection" direction="Outbound" domain="taiborucheng.com" ip="109.87.71.45" malwaretype="IP" port="55233"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T20:10:43.405495-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="879ecec1-355d-4d7a-8ca7-58c496bf37bb" subtype="Malicious Website Protection" direction="Outbound" domain="taiborucheng.com" ip="76.84.249.229" malwaretype="IP" port="55238"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T20:10:43.570504-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="1898b1c5-cfb1-41f9-a30c-faa44f579670" subtype="Malicious Website Protection" direction="Outbound" domain="taiborucheng.com" ip="109.87.71.45" malwaretype="IP" port="55239"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:10:58.776374-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="401ecea6-0d0b-4a15-9944-447f3905063c" subtype="Malicious Website Protection" direction="Outbound" domain="ownership-search.com" ip="192.162.19.34" malwaretype="IP" port="59045"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:10:58.961384-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="73bd7ff8-019c-453a-ad41-c99a21d06428" subtype="Malicious Website Protection" direction="Outbound" domain="ownership-search.com" ip="192.162.19.34" malwaretype="IP" port="59045"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T20:11:08.725943-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="4530d62f-824d-4326-81e6-543617a84027" subtype="Malicious Website Protection" direction="Outbound" domain="taiborucheng.com" ip="76.84.249.229" malwaretype="IP" port="55242"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T20:11:08.809948-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="795b1001-629b-4d8f-bd27-060b8b5757fc" subtype="Malicious Website Protection" direction="Outbound" domain="taiborucheng.com" ip="109.87.71.45" malwaretype="IP" port="55243"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:11:47.915184-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="8cdf0454-73e6-4f6f-9eec-918e4bf63417" subtype="Malicious Website Protection" direction="Outbound" domain="report-search.com" ip="192.162.19.34" malwaretype="IP" port="59225"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:11:47.969187-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="e86041bd-96ba-4631-ba89-52f0b9ce2064" subtype="Malicious Website Protection" direction="Outbound" domain="report-search.com" ip="192.162.19.34" malwaretype="IP" port="59225"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:13:08.688804-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="0c93fa40-b424-40ef-8580-cd92fae64805" subtype="Malicious Website Protection" direction="Outbound" domain="aquariums-search.com" ip="192.162.19.34" malwaretype="IP" port="59599"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:13:09.273838-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="85a87821-b1ba-406a-9190-d51a81bfa179" subtype="Malicious Website Protection" direction="Outbound" domain="aquariums-search.com" ip="192.162.19.34" malwaretype="IP" port="59599"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:16:51.666558-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="35b7e96d-b093-432c-a9b0-45fb0596c5ea" subtype="Malicious Website Protection" direction="Outbound" domain="aquariums-search.com" ip="192.162.19.34" malwaretype="IP" port="60331"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:16:51.892571-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="66558717-ce4d-442b-818e-ba8a1885f8ca" subtype="Malicious Website Protection" direction="Outbound" domain="perimeter-search.com" ip="192.162.19.34" malwaretype="IP" port="60334"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:16:51.921572-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="d0d29659-3944-4ebf-bb13-2ee4cbf6961c" subtype="Malicious Website Protection" direction="Outbound" domain="perimeter-search.com" ip="192.162.19.34" malwaretype="IP" port="60334"></record>
   <record severity="debug" process="C:\Users\Ali\AppData\Local\Google\Chrome\Application\chrome.exe" LoggingEventType="0" datetime="2014-05-24T20:17:33.402945-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="819ae106-f5c1-4d6e-8e5b-6ce6d472df34" subtype="Malicious Website Protection" direction="Outbound" domain="perimeter-search.com" ip="192.162.19.34" malwaretype="IP" port="60455"></record>
   <record severity="debug" process="C:\Users\Ali\AppData\Local\Google\Chrome\Application\chrome.exe" LoggingEventType="0" datetime="2014-05-24T20:17:33.436947-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="01e3c785-9744-4035-ba17-ec3d08c8e972" subtype="Malicious Website Protection" direction="Outbound" domain="perimeter-search.com" ip="192.162.19.34" malwaretype="IP" port="60456"></record>
   <record severity="debug" process="C:\Users\Ali\AppData\Local\Google\Chrome\Application\chrome.exe" LoggingEventType="0" datetime="2014-05-24T20:17:33.575955-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="8ec1137a-cae6-42d4-b58d-7dc2e91da1bb" subtype="Malicious Website Protection" direction="Outbound" domain="perimeter-search.com" ip="192.162.19.34" malwaretype="IP" port="60457"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:18:13.143218-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="7e246217-69ab-4018-8237-ef93cde7e455" subtype="Malicious Website Protection" direction="Outbound" domain="bubblegum-search.com" ip="192.162.19.34" malwaretype="IP" port="60532"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:18:13.168219-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="969c6399-3775-4e46-8e66-7a70136e7660" subtype="Malicious Website Protection" direction="Outbound" domain="bubblegum-search.com" ip="192.162.19.34" malwaretype="IP" port="60532"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:19:33.990842-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="4b525e74-b3c8-42f1-97dd-76c35f32385c" subtype="Malicious Website Protection" direction="Outbound" domain="ecored-search.com" ip="192.162.19.34" malwaretype="IP" port="60731"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:19:34.020844-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="8e8a9f1f-67a3-43e1-856d-001e1d63a81c" subtype="Malicious Website Protection" direction="Outbound" domain="ecored-search.com" ip="192.162.19.34" malwaretype="IP" port="60731"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:20:33.977273-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="a4452c7d-3f3e-4f6e-b989-47a863053905" subtype="Malicious Website Protection" direction="Outbound" domain="services-search.com" ip="192.162.19.34" malwaretype="IP" port="60901"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:20:34.008275-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="a7965caf-0570-431c-ab62-0b09ebec542b" subtype="Malicious Website Protection" direction="Outbound" domain="services-search.com" ip="192.162.19.34" malwaretype="IP" port="60901"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:21:39.465019-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="18109772-8185-4dc5-912d-7c6fc1f7009b" subtype="Malicious Website Protection" direction="Outbound" domain="submission-search.com" ip="192.162.19.34" malwaretype="IP" port="60979"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:21:39.577025-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="9265ab6c-e1a3-4fbb-afb1-95e137cbf4cf" subtype="Malicious Website Protection" direction="Outbound" domain="submission-search.com" ip="192.162.19.34" malwaretype="IP" port="60979"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:22:20.513367-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="fbbe14fc-a8f8-4594-8019-065341ec0e6b" subtype="Malicious Website Protection" direction="Outbound" domain="truth-search.com" ip="192.162.19.34" malwaretype="IP" port="61034"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:22:20.589371-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="21f50730-446d-41f1-a533-269a5afd1653" subtype="Malicious Website Protection" direction="Outbound" domain="truth-search.com" ip="192.162.19.34" malwaretype="IP" port="61034"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:26:13.165674-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="18e9c97a-022a-42eb-81ed-581725ca6db3" subtype="Malicious Website Protection" direction="Outbound" domain="convoy-search.com" ip="192.162.19.34" malwaretype="IP" port="61359"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:26:13.239678-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="c941c905-7cbf-43e8-b93b-7966f2ffc78b" subtype="Malicious Website Protection" direction="Outbound" domain="convoy-search.com" ip="192.162.19.34" malwaretype="IP" port="61359"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:27:33.931293-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="cf7603da-34c0-4248-bca0-d6a5512f36ce" subtype="Malicious Website Protection" direction="Outbound" domain="perimeter-search.com" ip="192.162.19.34" malwaretype="IP" port="61447"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:28:56.632024-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="7d4c28d2-bc0c-4077-91f3-f1bc596e42d6" subtype="Malicious Website Protection" direction="Outbound" domain="country-search.com" ip="192.162.19.34" malwaretype="IP" port="61560"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:28:56.663025-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="8ead68f4-2df0-496e-8d5b-3dbfd9a7e6dc" subtype="Malicious Website Protection" direction="Outbound" domain="country-search.com" ip="192.162.19.34" malwaretype="IP" port="61560"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:28:56.821034-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="6837f18a-3c24-474d-bf24-9bc1a9408612" subtype="Malicious Website Protection" direction="Outbound" domain="phantom-search.com" ip="192.162.19.34" malwaretype="IP" port="61561"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:28:56.854036-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="43eb841d-5861-4705-b0b0-1972dcf28964" subtype="Malicious Website Protection" direction="Outbound" domain="phantom-search.com" ip="192.162.19.34" malwaretype="IP" port="61561"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:30:40.353956-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="72a5c2ac-ae04-4c8d-aebe-c5608473d925" subtype="Malicious Website Protection" direction="Outbound" domain="truth-search.com" ip="192.162.19.34" malwaretype="IP" port="61660"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:32:16.405450-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="779c8a62-e8fa-401a-bad5-012b0b9b6b5f" subtype="Malicious Website Protection" direction="Outbound" domain="ecored-search.com" ip="192.162.19.34" malwaretype="IP" port="61812"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:33:12.497658-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="5ed94525-7a39-482b-8285-2a1beb6f95c8" subtype="Malicious Website Protection" direction="Outbound" domain="ownership-search.com" ip="192.162.19.34" malwaretype="IP" port="61950"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:34:35.747420-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="694e9208-4647-49fe-9585-a45225a373e2" subtype="Malicious Website Protection" direction="Outbound" domain="aquariums-search.com" ip="192.162.19.34" malwaretype="IP" port="62043"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:35:56.447036-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="7bb4f90a-7fcd-417c-ab67-e0e113321432" subtype="Malicious Website Protection" direction="Outbound" domain="ecored-search.com" ip="192.162.19.34" malwaretype="IP" port="62196"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:35:56.726052-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="248213fb-b61c-41e7-8365-cc1bd6f59c07" subtype="Malicious Website Protection" direction="Outbound" domain="ecored-search.com" ip="192.162.19.34" malwaretype="IP" port="62197"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:38:42.641541-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="84765c40-0a33-491c-a4e2-c53ad5a8d65b" subtype="Malicious Website Protection" direction="Outbound" domain="aquariums-search.com" ip="192.162.19.34" malwaretype="IP" port="62430"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:39:40.305840-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="0a33e620-d532-49c6-94fe-31a33fe8259f" subtype="Malicious Website Protection" direction="Outbound" domain="projects-search.com" ip="192.162.19.34" malwaretype="IP" port="62518"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:39:40.351842-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="75ca2848-cd43-46c7-a0ef-a04209061f90" subtype="Malicious Website Protection" direction="Outbound" domain="projects-search.com" ip="192.162.19.34" malwaretype="IP" port="62518"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:39:40.511851-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="410adc93-4df9-4aba-87fa-715d006fe061" subtype="Malicious Website Protection" direction="Outbound" domain="phantom-search.com" ip="192.162.19.34" malwaretype="IP" port="62522"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:40:39.761240-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="7241ed92-6917-439e-afd5-1873fa9efec4" subtype="Malicious Website Protection" direction="Outbound" domain="report-search.com" ip="192.162.19.34" malwaretype="IP" port="62590"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T20:40:39.803243-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="b806ca3a-bf82-4e06-99ec-62db0017177a" subtype="Malicious Website Protection" direc
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:52:09.296496-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" hash="93a586cf314a9e98b4a9493dcf333fc1" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="8e49653c-b102-43dc-9ef2-7f710b58402a" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T22:52:09.469506-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Error" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="fbcfdddc-a358-4c60-9a4c-af1ad8a78398" result="Failed"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:52:13.287724-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" hash="3602b0a57dfeab8b5a03b3d3da286898" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="0af84cf0-89e3-4444-9549-b7934634a146" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:52:13.302725-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" hash="93a586cf314a9e98b4a9493dcf333fc1" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="fcc351d0-d2f3-47df-b654-fb952fc56b97" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T22:52:13.656745-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Protection" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="5528ab03-5173-4a69-851d-b50ec7b9c700" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T22:52:13.673746-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Error" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="5528ab03-5173-4a69-851d-b50ec7b9c700" result="Failed"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T22:52:13.674746-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Protection" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="ed0a4645-b1ce-48ca-83c7-c7a2d5dc343a" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T22:52:13.693747-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Error" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="ed0a4645-b1ce-48ca-83c7-c7a2d5dc343a" result="Failed"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:52:17.559968-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" hash="93a586cf314a9e98b4a9493dcf333fc1" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="2d960fcb-8bc7-4969-8d30-cb7b1afded9c" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T22:52:17.676975-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Protection" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="59678200-1515-43d5-83d1-6843066fe829" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T22:52:17.688976-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Error" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="59678200-1515-43d5-83d1-6843066fe829" result="Failed"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:52:40.434277-04:00" filename="C:\Program Files (x86)\SweetIM\Messenger\mgconfig.dll" source="Protection" hash="37018bca5d1ec96d53ff0872ef15ed13" type="Detection" vendor="PUP.Optional.SweetIM" username="SYSTEM" systemname="ALI-HP" last_modified_tag="9adc7fbe-2884-411d-8dc8-d0a5acb90fd2" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:52:53.071000-04:00" filename="C:\Program Files (x86)\SweetIM\Messenger\SweetIM.exe" source="Protection" hash="cd6b292c84f7b284c68c3446d33142be" type="Detection" vendor="PUP.Optional.SweetIM" username="SYSTEM" systemname="ALI-HP" last_modified_tag="5d8519d4-da55-430f-8c88-64add4662878" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:53:10.944022-04:00" filename="C:\Program Files (x86)\SweetIM\Messenger\mgArchive.dll" source="Protection" hash="de5aee675f1cf2445af8136721e3aa56" type="Detection" vendor="PUP.Optional.SweetIM" username="SYSTEM" systemname="ALI-HP" last_modified_tag="ce5ce38d-19d1-4e5b-b9db-9bc4979301e7" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:53:13.812186-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" hash="3602b0a57dfeab8b5a03b3d3da286898" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="c8b96a51-0f83-459e-a2e9-0e8d3a57d74a" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:53:13.886190-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" hash="93a586cf314a9e98b4a9493dcf333fc1" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="4afc5f44-0622-4ffd-9e78-dd9ea3dc4cd2" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T22:53:13.954194-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Protection" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="dd99747f-7928-426f-a79c-d245ab72696f" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T22:53:13.967195-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Error" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="2aa63490-406c-4fe9-9cba-7b08ab50f9c4" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T22:53:13.977195-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Error" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="dd99747f-7928-426f-a79c-d245ab72696f" result="Failed"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:53:18.177436-04:00" filename="C:\Program Files (x86)\SweetIM\Messenger\mgxml_wrapper.dll" source="Protection" hash="cc6c4c09f98241f52b27a6d4f50f16ea" type="Detection" vendor="PUP.Optional.SweetIM" username="SYSTEM" systemname="ALI-HP" last_modified_tag="c6c31532-b28e-423a-912a-c996766c27a0" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:53:31.440194-04:00" filename="C:\Program Files (x86)\SweetIM\Messenger\mglogger.dll" source="Protection" hash="52e6ca8b14670a2cc48e3e3cd82c8779" type="Detection" vendor="PUP.Optional.SweetIM" username="SYSTEM" systemname="ALI-HP" last_modified_tag="ce70da8a-4c9d-4621-8d49-c14e5c64cde2" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:53:41.563773-04:00" filename="C:\Program Files (x86)\SweetIM\Messenger\mgICQMessengerAdapter.dll" source="Protection" hash="da5e90c54536989ecb87dc9e818349b7" type="Detection" vendor="PUP.Optional.SweetIM" username="SYSTEM" systemname="ALI-HP" last_modified_tag="96bc0043-e859-4cb9-80df-053b11b9a665" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:56:59.554098-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" hash="3602b0a57dfeab8b5a03b3d3da286898" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="57679730-9c0a-4121-9e63-0a4853c95f09" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T22:56:59.655103-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Protection" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="9996d544-e0a4-47a6-8837-3666d0f25677" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T22:56:59.666104-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Error" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="9996d544-e0a4-47a6-8837-3666d0f25677" result="Failed"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:57:00.113130-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" hash="93a586cf314a9e98b4a9493dcf333fc1" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="89516212-36b4-44f6-ac6c-f5335a22b311" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T22:57:00.241137-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Protection" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="9db22367-2217-4d69-95f9-3b29c63013ba" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T22:57:00.252138-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Error" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="9db22367-2217-4d69-95f9-3b29c63013ba" result="Failed"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:57:03.079299-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="35f61d98-d211-4642-a1f8-c769e57fcffd" subtype="Malicious Website Protection" direction="Outbound" domain="documents-search.com" ip="192.162.19.34" malwaretype="IP" port="55080"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:57:03.347315-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="89efe585-a3d1-4135-b580-1b1704d97f0a" subtype="Malicious Website Protection" direction="Outbound" domain="services-search.com" ip="192.162.19.34" malwaretype="IP" port="55081"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:57:03.376316-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="4344ab39-502b-478e-ad41-daa323e324ae" subtype="Malicious Website Protection" direction="Outbound" domain="available-search.com" ip="192.162.19.34" malwaretype="IP" port="55082"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:57:03.412318-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="54560795-8ec8-4d8b-9116-e78f4c3bcae9" subtype="Malicious Website Protection" direction="Outbound" domain="cargo-search.com" ip="192.162.19.34" malwaretype="IP" port="55083"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T22:57:12.993866-04:00" filename="C:\Program Files (x86)\Yontoo Layers Runtime\YontooIEClient.dll" source="Protection" hash="1c1c87ce0a71b0863b206e18c141867a" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="3260a665-09d3-4346-a705-0fc7b5abd4e8" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:58:04.735826-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="9d17f0df-0d85-4c03-9543-00a9dcfee434" subtype="Malicious Website Protection" direction="Outbound" domain="username-search.com" ip="192.162.19.34" malwaretype="IP" port="55093"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:58:04.900835-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="bad3a13b-52cf-446f-9602-70d9804d7d53" subtype="Malicious Website Protection" direction="Outbound" domain="services-search.com" ip="192.162.19.34" malwaretype="IP" port="55094"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:58:04.923837-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="447076b1-742e-41db-8bef-515a06974b1a" subtype="Malicious Website Protection" direction="Outbound" domain="cargo-search.com" ip="192.162.19.34" malwaretype="IP" port="55095"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:58:48.485328-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="65a50d76-6e85-418b-b080-e1b2edb75f87" subtype="Malicious Website Protection" direction="Outbound" domain="helped-search.com" ip="192.162.19.34" malwaretype="IP" port="55103"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T22:58:48.518330-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="04c4f840-468b-4672-b5d3-ab6331358782" subtype="Malicious Website Protection" direction="Outbound" domain="username-search.com" ip="192.162.19.34" malwaretype="IP" port="55104"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T22:59:17.639996-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="540a6509-d377-4593-830d-959f477078d3" subtype="Malicious Website Protection" direction="Outbound" domain="joye-luck.com" ip="81.200.148.6" malwaretype="IP" port="64495"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T22:59:17.656997-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="7abc5ae5-8195-4061-91be-a628d7aebf11" subtype="Malicious Website Protection" direction="Outbound" domain="joye-luck.com" ip="81.200.148.6" malwaretype="IP" port="64495"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:01:42.527283-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="15d72566-abd9-48a7-be6d-4309a20afe7b" subtype="Malicious Website Protection" direction="Outbound" domain="aqua-search.com" ip="192.162.19.34" malwaretype="IP" port="55114"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:01:42.555284-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="3c5c1900-a406-4d7c-a992-e15b2385807a" subtype="Malicious Website Protection" direction="Outbound" domain="cargo-search.com" ip="192.162.19.34" malwaretype="IP" port="55115"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:01:42.585286-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="cff7940d-e9a1-4f8a-8691-c9877eeacba8" subtype="Malicious Website Protection" direction="Outbound" domain="perimeter-search.com" ip="192.162.19.34" malwaretype="IP" port="55116"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:01:42.616288-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="74c72729-4cfa-4dae-8945-046c475d70ee" subtype="Malicious Website Protection" direction="Outbound" domain="sitemap-search.com" ip="192.162.19.34" malwaretype="IP" port="55117"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:01:42.645289-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="729570a3-650d-4254-96fd-1b15eca08d3e" subtype="Malicious Website Protection" direction="Outbound" domain="thousands-search.com" ip="192.162.19.34" malwaretype="IP" port="55118"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:01:42.670291-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="ad0a044b-2113-4353-af9b-bca0d3748cc0" subtype="Malicious Website Protection" direction="Outbound" domain="companies-search.com" ip="192.162.19.34" malwaretype="IP" port="55119"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:02:25.964767-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="e9688a1e-9005-4078-b86e-bb2e107419e4" subtype="Malicious Website Protection" direction="Outbound" domain="projects-search.com" ip="192.162.19.34" malwaretype="IP" port="55136"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T23:03:57.762018-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" hash="3602b0a57dfeab8b5a03b3d3da286898" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="167e7f9f-5ed3-4295-91ee-f78bf9ddf5f5" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T23:03:57.776019-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" hash="93a586cf314a9e98b4a9493dcf333fc1" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="5e509c4e-33db-4c63-82dc-6a10bc475755" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T23:03:57.914026-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Protection" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="2321ad7f-72d5-45b5-85ee-a31d71537256" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T23:03:57.927027-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Error" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="92f39038-a960-4349-8d37-aa76fceac030" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T23:03:57.938028-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Error" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="2321ad7f-72d5-45b5-85ee-a31d71537256" result="Failed"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T23:06:38.310201-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" hash="3602b0a57dfeab8b5a03b3d3da286898" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="40b221d1-3d72-4958-8384-e8f913c391f9" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T23:06:38.320201-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" hash="93a586cf314a9e98b4a9493dcf333fc1" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="83b902a0-aa8f-4bfc-94a8-e9d19c0e9a19" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T23:06:38.459209-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Error" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="0a69ab5b-cabe-4866-ade3-d42f375dc9cf" result="Failed"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.381352-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="66e8d5c6-a7ff-4e5a-bcf6-990f4307f77c" subtype="Malicious Website Protection" direction="Outbound" domain="diseases-search.com" ip="192.162.19.34" malwaretype="IP" port="55179"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.421355-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="44fb4371-c854-4737-a808-b91631a93cf6" subtype="Malicious Website Protection" direction="Outbound" domain="report-search.com" ip="192.162.19.34" malwaretype="IP" port="55180"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.459357-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="cad43d02-9a7e-46f3-9bfa-6f781579b097" subtype="Malicious Website Protection" direction="Outbound" domain="travels-search.com" ip="192.162.19.34" malwaretype="IP" port="55181"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.501359-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="2a57757e-416f-4715-83e5-4099c7261b26" subtype="Malicious Website Protection" direction="Outbound" domain="ecored-search.com" ip="192.162.19.34" malwaretype="IP" port="55182"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.540361-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="764c9cca-c876-4167-86e2-2b449487c57b" subtype="Malicious Website Protection" direction="Outbound" domain="thousands-search.com" ip="192.162.19.34" malwaretype="IP" port="55183"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.583364-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="e15509b2-4491-476d-92d0-f27490cecd57" subtype="Malicious Website Protection" direction="Outbound" domain="forest-search.com" ip="192.162.19.34" malwaretype="IP" port="55184"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.622366-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="a0a3cf6c-305a-45b1-8323-51c5cc48f729" subtype="Malicious Website Protection" direction="Outbound" domain="aqua-search.com" ip="192.162.19.34" malwaretype="IP" port="55185"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.664369-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="e0cd7c95-5a6a-4389-aa25-f84657a783eb" subtype="Malicious Website Protection" direction="Outbound" domain="services-search.com" ip="192.162.19.34" malwaretype="IP" port="55186"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.704371-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="5498dfd7-a412-4aa0-a215-b85b4cf1607f" subtype="Malicious Website Protection" direction="Outbound" domain="thousands-search.com" ip="192.162.19.34" malwaretype="IP" port="55187"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:08:08.740373-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="dfb38c7c-c5ea-4f4a-9fa1-7cfa91e1a201" subtype="Malicious Website Protection" direction="Outbound" domain="country-search.com" ip="192.162.19.34" malwaretype="IP" port="55188"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:08:31.334665-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="53fefa94-c983-45b3-9d80-e14ca773bcba" subtype="Malicious Website Protection" direction="Outbound" domain="joye-luck.com" ip="81.200.148.6" malwaretype="IP" port="64568"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:10:23.235066-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="cdca7cce-3c80-4d9e-af80-118dbd3476d5" subtype="Malicious Website Protection" direction="Outbound" domain="satisfaction-search.com" ip="192.162.19.34" malwaretype="IP" port="55209"></record>
   <record severity="debug" process="C:\Program Files (x86)\Hotspot Shield\bin\af_proxy_cmd.exe" LoggingEventType="0" datetime="2014-05-24T23:14:29.963178-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="08cc2c46-87a5-4de7-a6be-e42109e247e5" subtype="Malicious Website Protection" direction="Outbound" domain="provide-search.com" ip="192.162.19.34" malwaretype="IP" port="55210"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T23:14:29.982179-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" hash="3602b0a57dfeab8b5a03b3d3da286898" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="22c5c5d0-7c62-4dbd-91a9-335727e29f3c" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="0" action="Quarantine" datetime="2014-05-24T23:14:30.049182-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" hash="93a586cf314a9e98b4a9493dcf333fc1" type="Detection" vendor="PUP.Optional.Yontoo.A" username="SYSTEM" systemname="ALI-HP" last_modified_tag="c8ed3ca9-701f-40db-8afd-60c1b7856bd5" subtype="Malware Protection" malwaretype="File"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T23:14:30.108186-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Protection" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="af7177a9-ef7a-4b1f-ada2-5a2ce0f051fb" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T23:14:30.129187-04:00" filename="C:\Users\Ali\AppData\Roaming\Yontoo\YontooDesktop.exe" source="Protection" type="Error" username="SYSTEM" code="5" systemname="ALI-HP" message="DeleteFile" last_modified_tag="af7177a9-ef7a-4b1f-ada2-5a2ce0f051fb" result="Failed"></record>
   <record severity="debug" LoggingEventType="2" datetime="2014-05-24T23:14:30.149188-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Protection" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="b45a67de-4b5b-4ccc-840d-4d57bf2360c7" result="Failed"></record>
   <record severity="debug" LoggingEventType="4" datetime="2014-05-24T23:14:30.179190-04:00" filename="c:\users\ali\appdata\roaming\yontoo\dat\desktop.os.plugin.dll" source="Protection" type="Error" username="SYSTEM" code="2" systemname="ALI-HP" message="SDKQuarantine" last_modified_tag="b45a67de-4b5b-4ccc-840d-4d57bf2360c7" result="Failed"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:58.721822-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="fbc49d3e-24e7-4bb1-be20-097f058f15e0" subtype="Malicious Website Protection" direction="Outbound" domain="forest-search.com" ip="192.162.19.34" malwaretype="IP" port="65048"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:58.790826-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="9f33d64f-00b3-4203-a1c4-65a30bf01e63" subtype="Malicious Website Protection" direction="Outbound" domain="services-search.com" ip="192.162.19.34" malwaretype="IP" port="65049"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:58.825828-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="3cb4529f-b1dc-424f-8b6f-bfeb4c1011d1" subtype="Malicious Website Protection" direction="Outbound" domain="services-search.com" ip="192.162.19.34" malwaretype="IP" port="65050"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:58.862831-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="8c698b2d-84be-4aa2-9d4b-bf39905b7419" subtype="Malicious Website Protection" direction="Outbound" domain="available-search.com" ip="192.162.19.34" malwaretype="IP" port="65052"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:58.901833-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="d7baff93-dfaf-466a-b06f-e6f6bcb2c63b" subtype="Malicious Website Protection" direction="Outbound" domain="available-search.com" ip="192.162.19.34" malwaretype="IP" port="65051"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:58.937835-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="c3f36080-d380-4eed-a06b-f7b8443a9550" subtype="Malicious Website Protection" direction="Outbound" domain="projects-search.com" ip="192.162.19.34" malwaretype="IP" port="65053"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:58.972837-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="9cde9d57-bfa3-412c-8392-1eff5a2675ee" subtype="Malicious Website Protection" direction="Outbound" domain="projects-search.com" ip="192.162.19.34" malwaretype="IP" port="65054"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:59.008839-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="09c99387-97fb-4cd3-8e2d-3e2130356d10" subtype="Malicious Website Protection" direction="Outbound" domain="cargo-search.com" ip="192.162.19.34" malwaretype="IP" port="65055"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:59.049841-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="2e9edd4a-9f9d-4b50-99d6-dccf3b232b1f" subtype="Malicious Website Protection" direction="Outbound" domain="cargo-search.com" ip="192.162.19.34" malwaretype="IP" port="65056"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:14:59.090844-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="2cbd7ef9-a1d2-4451-916f-23c690ef7a90" subtype="Malicious Website Protection" direction="Outbound" domain="helped-search.com" ip="192.162.19.34" malwaretype="IP" port="65057"></record>
   <record severity="debug" process="C:\Windows\explorer.exe" LoggingEventType="0" datetime="2014-05-24T23:15:51.253827-04:00" source="Protection" type="Detection" username="SYSTEM" systemname="ALI-HP" last_modified_tag="336228d7-d251-4c0a-b385-650a0ffcf64a" subtype="Malicious Website Protection" direction="Outbound" domain="aqua-search.com" ip="192.162.19.34" malwaretype="IP" port="65068"></record>
</logs>
 


#4 aresgraphics

aresgraphics
  • Topic Starter

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:07:02 AM

Posted 25 May 2014 - 08:05 PM

Someone help me please, I've just gotten the blue screen of death and am in safe mode :(



#5 Broni

Broni

    The Coolest BC Computer


  • BC Advisor
  • 42,680 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Daly City, CA
  • Local time:04:02 AM

Posted 25 May 2014 - 08:16 PM

It looks like you have an infected fake partition there.

That will require elevated help.

 

Please follow the instructions in THIS GUIDE starting at Step 6. If you cannot complete a step, skip it and continue.

Once the proper logs are created, then make a NEW TOPIC and post it HERE. Please include a description of your computer issues, what you have done to resolve them, and a link to this topic.

If you can produce at least some of the logs, then please create the new topic and explain what happens when you try to create the log(s) that you couldn't get. If you cannot produce any of the logs, then still post the topic and explain that you followed the Prep. Guide, were unable to create the logs, and describe what happens when you try to create the logs.

It would be helpful if you post a note here once you have completed the steps in the guide and have started your topic in malware removal. Good luck and be patient.

If HelpBot replies to your topic, PLEASE follow Step One so it will report your topic to the team members.


My Website

p4433470.gif

My help doesn't cost a penny, but if you'd like to consider a donation, click p22001735.gif


 





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users