Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Laptop plays adverts whilst no tabs are open...


  • This topic is locked This topic is locked
38 replies to this topic

#1 walige

walige

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 30 June 2014 - 02:29 AM

Hi;

 

I recently installed bearshare on my laptop and it was only a few days later that I have begun having problems with laptop.  Adverts opening on screen, adverts being opened on additional tabs by themselves and also audio adverts playing whilst there arent even any tabs open for them - as if they are playing themselves in the back ground. Looks like I will NOT be installing any P2P (I have been reading about this tonight) on my laptop or other devices again! Meanwhile.....I need your help! :)

 

First of all......I jumped the gun! Not intentionally though..

 

I uninstalled bearshare and a few other things that I didnt need/want from my lappy.

I then googled searched and read a few of your posts on the same issue.

I disabled Norton antivirus

I downloaded and installed Combofix

 

Here is the report below;  I realise 'now' that I should of waited for you guys.

It has not asked me to alter or change anything.  Just ran and then produced this report.

I also just read in your home screen under the software that I should of renamed it.....do you need to do that and how do I do that now?

 

Thanks so very much, Robyn. :)

 

 

ComboFix 14-06-30.01 - Robyn 30/06/2014  16:51:57.1.4 - x64
Microsoft Windows 8  6.2.9200.0.1252.61.1033.18.3546.1632 [GMT 10:00]
Running from: c:\users\Robyn\Downloads\ComboFix.exe
AV: Norton 360 Premier Edition *Disabled/Updated* {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 Premier Edition *Disabled* {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}
SP: Norton 360 Premier Edition *Enabled/Updated* {631E4324-D31C-783F-EC5C-35AD42B18466}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Robyn\AppData\Roaming\SearchProtect
c:\users\Robyn\AppData\Roaming\SearchProtect\ffprotect\SProtectorRepository\searchProtectorData
.
.
(((((((((((((((((((((((((   Files Created from 2014-05-28 to 2014-06-30  )))))))))))))))))))))))))))))))
.
.
2014-06-30 06:59 . 2014-06-30 06:59    --------    d-----w-    c:\users\Default\AppData\Local\temp
2014-06-30 06:15 . 2014-06-30 06:15    --------    d-----w-    c:\windows\SysWow64\N360_BACKUP
2014-06-30 05:21 . 2014-06-30 05:21    16152    ----a-w-    c:\windows\system32\drivers\SWDUMon.sys
2014-06-30 05:21 . 2014-06-30 05:21    --------    d-----w-    c:\users\Robyn\AppData\Local\SlimWare Utilities Inc
2014-06-30 05:21 . 2014-06-30 06:07    --------    d-----w-    c:\program files (x86)\DriverUpdate
2014-06-30 05:16 . 2014-06-30 05:18    --------    d-----w-    C:\FRST
2014-06-27 04:29 . 2014-06-30 06:46    --------    d-----w-    c:\program files\SupraSavings
2014-06-27 04:29 . 2014-06-27 14:15    --------    d-----w-    c:\program files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32
2014-06-22 02:37 . 2014-06-27 11:56    --------    d-----w-    c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-21 23:53 . 2014-06-21 23:53    --------    d-----w-    c:\users\Robyn\AppData\Roaming\MusicNet
2014-06-21 23:52 . 2014-06-27 11:45    --------    d-----w-    c:\program files (x86)\BearShare Applications
2014-06-21 23:51 . 2014-06-21 23:51    --------    d-----w-    c:\users\Robyn\AppData\Roaming\Music Toolbar
2014-06-13 04:52 . 2014-06-13 04:52    283312    ----a-w-    c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10242.bin
2014-06-12 19:05 . 2014-06-12 19:05    46376    ----a-w-    c:\windows\system32\drivers\netfilter64.sys
2014-06-12 14:07 . 2014-05-03 06:34    6974808    ----a-w-    c:\windows\system32\ntoskrnl.exe
2014-06-12 14:07 . 2014-05-03 06:33    1824808    ----a-w-    c:\windows\system32\ntdll.dll
2014-06-12 14:07 . 2014-05-01 22:37    1023488    ----a-w-    c:\windows\system32\localspl.dll
2014-06-12 14:07 . 2014-05-03 04:51    1408976    ----a-w-    c:\windows\SysWow64\ntdll.dll
2014-06-12 14:07 . 2014-04-29 22:32    126464    ----a-w-    c:\windows\system32\Robocopy.exe
2014-06-12 14:07 . 2014-04-29 22:32    106496    ----a-w-    c:\windows\SysWow64\Robocopy.exe
2014-06-12 14:07 . 2014-04-23 23:51    566784    ----a-w-    c:\windows\SysWow64\WSShared.dll
2014-06-12 14:07 . 2014-04-23 23:51    124928    ----a-w-    c:\windows\SysWow64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-12 14:07 . 2014-04-23 23:38    693760    ----a-w-    c:\windows\system32\WSShared.dll
2014-06-12 14:07 . 2014-04-23 23:38    163840    ----a-w-    c:\windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-12 14:07 . 2014-02-08 04:34    71168    ----a-w-    c:\windows\system32\drivers\hdaudbus.sys
2014-06-12 13:45 . 2014-06-12 13:45    --------    d-----w-    c:\users\Default\AppData\Local\Microsoft Help
2014-06-12 13:21 . 2014-06-12 13:44    --------    d-----w-    c:\program files (x86)\Microsoft Works
2014-06-12 13:17 . 2014-06-12 13:17    --------    d-----w-    c:\program files\Microsoft Office
2014-06-12 13:17 . 2014-06-12 13:17    --------    d-----w-    c:\users\Robyn\AppData\Local\Microsoft Help
2014-06-12 13:17 . 2014-06-16 01:20    --------    d-----w-    c:\programdata\Microsoft Help
2014-06-11 00:44 . 2014-05-24 02:46    3958784    ----a-w-    c:\windows\system32\jscript9.dll
2014-06-11 00:44 . 2014-05-24 02:46    2650112    ----a-w-    c:\windows\system32\iertutil.dll
2014-06-11 00:44 . 2014-05-24 01:25    2862080    ----a-w-    c:\windows\SysWow64\jscript9.dll
2014-06-11 00:44 . 2014-05-24 01:25    108032    ----a-w-    c:\program files (x86)\Internet Explorer\jsdebuggeride.dll
2014-06-11 00:44 . 2014-04-03 11:22    2233176    ----a-w-    c:\windows\system32\drivers\tcpip.sys
2014-06-11 00:44 . 2014-03-07 00:08    1845760    ----a-w-    c:\windows\system32\msxml3.dll
2014-06-11 00:44 . 2014-03-07 00:47    1419264    ----a-w-    c:\windows\SysWow64\msxml3.dll
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-30 01:29 . 2013-09-04 03:43    65536    ----a-w-    c:\windows\system32\spu_storage.bin
2014-06-21 02:26 . 2013-12-19 12:10    588496    ------w-    c:\programdata\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
2014-06-11 00:52 . 2014-01-23 11:22    95414520    ----a-w-    c:\windows\system32\MRT.exe
2014-05-31 05:16 . 2014-05-17 08:27    105464    ----a-w-    c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-31 05:16 . 2014-05-17 08:27    703992    ----a-w-    c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-19 09:39 . 2014-05-06 07:57    628024    ----a-w-    c:\windows\system32\NotificationUI.exe
2014-04-12 09:27 . 2014-05-14 04:48    172888    ----a-w-    c:\windows\system32\drivers\ksecpkg.sys
2014-04-12 09:10 . 2014-05-14 04:48    578048    ----a-w-    c:\windows\system32\winlogon.exe
2014-04-12 09:09 . 2014-05-14 04:48    208896    ----a-w-    c:\windows\system32\wdigest.dll
2014-04-12 09:09 . 2014-05-14 04:48    1043968    ----a-w-    c:\windows\system32\usercpl.dll
2014-04-12 09:09 . 2014-05-14 04:48    94720    ----a-w-    c:\windows\system32\TSpkg.dll
2014-04-12 09:09 . 2014-05-14 04:48    588288    ----a-w-    c:\windows\system32\SHCore.dll
2014-04-12 09:08 . 2014-05-14 04:48    318464    ----a-w-    c:\windows\system32\msv1_0.dll
2014-04-12 09:08 . 2014-05-14 04:48    1281536    ----a-w-    c:\windows\system32\lsasrv.dll
2014-04-12 09:08 . 2014-05-14 04:48    439808    ----a-w-    c:\windows\system32\lsm.dll
2014-04-12 09:08 . 2014-05-14 04:48    827904    ----a-w-    c:\windows\system32\kerberos.dll
2014-04-12 09:07 . 2014-05-14 04:48    20480    ----a-w-    c:\windows\system32\credssp.dll
2014-04-12 07:23 . 2014-05-14 04:48    178688    ----a-w-    c:\windows\SysWow64\wdigest.dll
2014-04-12 07:23 . 2014-05-14 04:48    961536    ----a-w-    c:\windows\SysWow64\usercpl.dll
2014-04-12 07:23 . 2014-05-14 04:48    76800    ----a-w-    c:\windows\SysWow64\TSpkg.dll
2014-04-12 07:23 . 2014-05-14 04:48    452608    ----a-w-    c:\windows\SysWow64\SHCore.dll
2014-04-12 07:23 . 2014-05-14 04:48    273920    ----a-w-    c:\windows\SysWow64\msv1_0.dll
2014-04-12 07:22 . 2014-05-14 04:48    666624    ----a-w-    c:\windows\SysWow64\kerberos.dll
2014-04-12 07:22 . 2014-05-14 04:48    17408    ----a-w-    c:\windows\SysWow64\credssp.dll
2014-04-12 06:58 . 2014-05-14 04:48    14848    ----a-w-    c:\windows\system32\workerdd.dll
2014-04-09 13:13 . 2014-04-09 13:13    489064    ----a-w-    C:\SecurityScanner.dll
.
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-12-19 12:14    220632    ----a-w-    c:\users\Robyn\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-12-19 12:14    220632    ----a-w-    c:\users\Robyn\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-12-19 12:14    220632    ----a-w-    c:\users\Robyn\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\SkyDriveShell.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NextLive"="c:\users\Robyn\AppData\Roaming\newnext.me\nengine.dll" [2013-11-14 1283584]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2013-04-17 642656]
"YouCam Service"="c:\program files (x86)\CyberLink\YouCam\YouCamService.exe" [2013-05-22 267224]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-04-23 43848]
"AccelerometerSysTrayApplet"="c:\program files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe" [2013-07-24 77088]
"BtTray"="c:\program files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe" [2013-05-14 387832]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
"HPMessageService"="c:\program files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe" [2014-03-26 475448]
.
c:\users\Robyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE /tsr [2009-2-26 97680]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
R0 SymELAM;Symantec ELAM Driver;c:\windows\system32\drivers\N360x64\1503000.00C\SymELAM.sys;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\SymELAM.sys [x]
R2 Update albrechto;Update albrechto;c:\program files (x86)\albrechto\updatealbrechto.exe;c:\program files (x86)\albrechto\updatealbrechto.exe [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys;c:\windows\SYSNATIVE\DRIVERS\ssudbus.sys [x]
R3 iaStorA;iaStorA;c:\windows\System32\drivers\iaStorA.sys;c:\windows\SYSNATIVE\drivers\iaStorA.sys [x]
R3 SmbDrv;SmbDrv;c:\windows\System32\drivers\Smb_driver_AMDASF.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_AMDASF.sys [x]
R3 SmbDrvI;SmbDrvI;c:\windows\System32\drivers\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\drivers\Smb_driver_Intel.sys [x]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ssudmdm.sys [x]
R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys;c:\windows\SYSNATIVE\DRIVERS\SWDUMon.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\System32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
S0 amd_sata;amd_sata;c:\windows\System32\drivers\amd_sata.sys;c:\windows\SYSNATIVE\drivers\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\System32\drivers\amd_xata.sys;c:\windows\SYSNATIVE\drivers\amd_xata.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\1503000.00C\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\1503000.00C\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\program files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\BASHDefs\20140606.001\BHDrvx64.sys;c:\program files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\BASHDefs\20140606.001\BHDrvx64.sys [x]
S1 ccSet_N360;N360 Settings Manager;c:\windows\system32\drivers\N360x64\1503000.00C\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\program files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\IPSDefs\20140627.001\IDSvia64.sys;c:\program files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\IPSDefs\20140627.001\IDSvia64.sys [x]
S1 netfilter64;netfilter64;c:\windows\system32\drivers\netfilter64.sys;c:\windows\SYSNATIVE\drivers\netfilter64.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\1503000.00C\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\N360x64\1503000.00C\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS;c:\windows\SYSNATIVE\Drivers\N360x64\1503000.00C\SYMNETS.SYS [x]
S2 AdaptiveSleepService;AdaptiveSleepService;c:\program files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe;c:\program files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe;c:\windows\SYSNATIVE\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [x]
S2 ClickToRunSvc;Microsoft Office ClickToRun Service;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
S2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x]
S2 hpsrv;HP Service;c:\windows\system32\Hpservice.exe;c:\windows\SYSNATIVE\Hpservice.exe [x]
S2 HPWMISVC;HPWMISVC;c:\program files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe;c:\program files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [x]
S2 N360;Norton 360;c:\program files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\N360.exe;c:\program files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\N360.exe [x]
S2 RtkAudioService;Realtek Audio Service;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe;c:\program files\Realtek\Audio\HDA\RtkAudioService64.exe [x]
S2 SupraSavingsService64;SupraSavingsService64;c:\program files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe;c:\program files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe [x]
S2 SWUpdateService;SW Update Service;c:\program files (x86)\Samsung\SW Update\SWMAgent.exe;c:\program files (x86)\Samsung\SW Update\SWMAgent.exe [x]
S2 vxlsnyaiet64;vxlsnyaiet64;c:\program files\003\vxlsnyaiet64.exe run options=01100010030000000000000000000000 sourceguid=A1E42196-7B72-4448-8D92-3F513155CC32;c:\program files\003\vxlsnyaiet64.exe run options=01100010030000000000000000000000 sourceguid=A1E42196-7B72-4448-8D92-3F513155CC32 [x]
S3 AmdAS4;AmdAS4 service;c:\windows\System32\drivers\AmdAS4.sys;c:\windows\SYSNATIVE\drivers\AmdAS4.sys [x]
S3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW86.sys;c:\windows\SYSNATIVE\drivers\AtihdW86.sys [x]
S3 BtAudioBusSrv;Ralink Bluetooth Audio Bus Service;c:\windows\System32\Drivers\BtAudioBus.sys;c:\windows\SYSNATIVE\Drivers\BtAudioBus.sys [x]
S3 BthL2caScoIfSrv;Bluetooth Profile Interface Driver Service;c:\windows\System32\Drivers\BtL2caScoIf.sys;c:\windows\SYSNATIVE\Drivers\BtL2caScoIf.sys [x]
S3 BthLEEnum;Bluetooth Low Energy Driver;c:\windows\system32\DRIVERS\BthLEEnum.sys;c:\windows\SYSNATIVE\DRIVERS\BthLEEnum.sys [x]
S3 btUrbFilterDrv;IVT URB Bluetooth Filter Driver Service;c:\windows\System32\Drivers\IvtUrbBtFlt.sys;c:\windows\SYSNATIVE\Drivers\IvtUrbBtFlt.sys [x]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys;c:\windows\SYSNATIVE\DRIVERS\clwvd.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
S3 netr28x;Ralink 802.11n Extensible Wireless Driver;c:\windows\system32\DRIVERS\netr28x.sys;c:\windows\SYSNATIVE\DRIVERS\netr28x.sys [x]
S3 RSP2STOR;Realtek PCIE CardReader Driver - P2;c:\windows\system32\DRIVERS\RtsP2Stor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsP2Stor.sys [x]
S3 rtbth;RTBTH Bluetooth Device Driver;c:\windows\System32\drivers\rtbth.sys;c:\windows\SYSNATIVE\drivers\rtbth.sys [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys;c:\windows\SYSNATIVE\DRIVERS\usbfilter.sys [x]
S3 WirelessButtonDriver;HP Wireless Button Driver Service;c:\windows\System32\drivers\WirelessButtonDriver64.sys;c:\windows\SYSNATIVE\drivers\WirelessButtonDriver64.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
apphost    REG_MULTI_SZ       apphostsvc
iissvcs    REG_MULTI_SZ       w3svc was
.
Contents of the 'Scheduled Tasks' folder
.
2014-06-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-22 00:06]
.
2014-06-29 c:\windows\Tasks\bench-sys.job
- c:\program files (x86)\Bench\Updater\updater.exe [2013-12-18 21:19]
.
2014-06-27 c:\windows\Tasks\HPCeeScheduleForRobyn.job
- c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-14 17:43]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
@="{F241C880-6982-4CE5-8CF7-7085BA96DA5A}"
[HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
2013-12-19 12:14    244696    ----a-w-    c:\users\Robyn\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
@="{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}"
[HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
2013-12-19 12:14    244696    ----a-w-    c:\users\Robyn\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
@="{BBACC218-34EA-4666-9D7A-C78F2274A524}"
[HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
2013-12-19 12:14    244696    ----a-w-    c:\users\Robyn\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64\SkyDriveShell64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2014-02-01 7203032]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="c:\program files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" [2014-06-24 21720]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.conduit.com?searchsource=10&cui=un20189207061796831&um=2&ctid=ct3298588
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office12\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
TCP: DhcpNameServer = 211.29.132.12 198.142.0.51 198.142.235.14
FF - ProfilePath - c:\users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298588&CUI=UN72910011511910144&UM=2&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Ask.com
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com.au
FF - user.js: extensions.shownSelectionUI - true
FF - user.js: plugin.state.npconduitfirefoxplugin - 0
FF - user.js: browser.search.defaultenginename - FindWide
FF - user.js: browser.keywordURLPromptDeclined - 1
FF - user.js: browser.startup.page - 1
FF - user.js: browser.newtab.url -
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-OutfoxTV - c:\program files\OutfoxTV\OutfoxTV\DesktopContainer.exe
Wow6432Node-HKLM-Run-mobilegeni daemon - c:\program files (x86)\Mobogenie\DaemonProcess.exe
Wow6432Node-HKLM-Run-fst_au_10 - (no file)
Toolbar-10 - (no file)
WebBrowser-{41B78170-3CD6-4072-B68D-F3DBDA8D1FCD} - (no file)
AddRemove-{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE} - c:\program files (x86)\InstallShield Installation Information\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}\setup.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\N360]
"ImagePath"="\"c:\program files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\N360.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\diMaster.dll\" /prefetch:1"
"ImagePath"="\SystemRoot\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS"
"TrustedImagePaths"="c:\program files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12;c:\program files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e96d-e325-11ce-bfc1-08002be10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Completion time: 2014-06-30  17:03:24
ComboFix-quarantined-files.txt  2014-06-30 07:03
.
Pre-Run: 675,006,697,472 bytes free
Post-Run: 674,444,869,632 bytes free
.
- - End Of File - - C1D93AEBEB0FDAC3F1FD270433894634
5FB38429D5D77768867C76DCBDB35194
 



BC AdBot (Login to Remove)

 


#2 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:07 PM

Posted 01 July 2014 - 11:46 PM

Hello! Welcome to BleepingComputer Forums! :welcome:
My name is Georgi and and I will be helping you with your computer problems.

Before we begin, please note the following:

  • I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The logs can take some time to research, so please be patient with me.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • Please do not run any tools until requested ! The reason for this is so I know what is going on with the machine at any time. Some programs can interfere with others and hamper the recovery process.
  • Please perform all steps in the order received. If you can't understand something don't hesitate to ask.
  • Again I would like to remind you to make no further changes to your computer unless I direct you to do so. I will not help you if you do not follow my instructions.

 

 

Please download the latest version of Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.

 

Regards,

Georgi


cXfZ4wS.png


#3 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 01:20 AM

Hi Georgi;

 

Thank you so much for helping me :)

Here are the details you requested.

 

FRST Scan Log Results:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-07-2014
Ran by Robyn (administrator) on HPACHOS on 03-07-2014 15:40:23
Running from C:\Users\Robyn\Downloads
Platform: Windows 8 (X64) OS Language: English (United States)
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\n360.exe
() C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
() C:\Program Files\003\vxlsnyaiet64.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\n360.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\core-static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\core-static\CCC.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_125.exe
(Microsoft Corporation) C:\Program Files (x86)\Internet Explorer\ielowutil.exe
(Farbar) C:\Users\Robyn\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7203032 2014-02-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-04-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-05-22] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [77088 2013-07-24] (Hewlett-Packard Company)
HKLM-x32\...\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [387832 2013-05-14] (IVT Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)
HKU\S-1-5-21-2700925841-1584683910-2212061445-1002\...\Run: [NextLive] => C:\Windows\SysWOW64\rundll32.exe "C:\Users\Robyn\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
Startup: C:\Users\Robyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?searchsource=10&cui=un20189207061796831&um=2&ctid=ct3298588
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/HPALL13/14
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/HPALL13/14
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/HPALL13/14
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {C6615190-FAF5-44C4-85D8-661B78E555AB} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {C6615190-FAF5-44C4-85D8-661B78E555AB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298588&CUI=UN20189207061796831&UM=2
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKCU - {A53C7379-2A3C-4389-8EC9-5C087FBF1A51} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10805
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=360&chn=retail&geo=AU&ver=20&locale=en_AU&gct=kwd&qsrc=2869
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL =
SearchScopes: HKCU - {C6615190-FAF5-44C4-85D8-661B78E555AB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298588&CUI=UN20189207061796831&UM=2
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - {DC0AD46A-E369-4C22-AD6C-70F669604BC6} URL = http://search.findwide.com/serp?guid={F28E1487-F82C-4207-8488-28C0346E94CC}&action=default_search&serpv=22&k={searchTerms}
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {41B78170-3CD6-4072-B68D-F3DBDA8D1FCD} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWow64\skype4com.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 211.29.132.12 198.142.0.51 198.142.235.14

FireFox:
========
FF ProfilePath: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Homepage: hxxp://www.msn.com.au
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=3 - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=9 - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF user.js: detected! => C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\user.js
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\Ask.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\findwide.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: MixiDJ V52  - C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\Extensions\{24a0cfe1-f479-4b19-b627-a96bf1ea3a56} [2013-12-22]
FF Extension: DealPly  Shopping - C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f} [2013-12-22]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\coFFPlgn [2014-07-02]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\IPSFF [2014-03-23]

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (DealPly  Shopping) - C:\Users\Robyn\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf [2013-12-22]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-30]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [103424 2013-04-17] () [File not signed]
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-04-17] (Advanced Micro Devices, Inc.) [File not signed]
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1630456 2013-06-07] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [145656 2013-05-14] (IVT Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)
R2 N360; C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\N360.exe [265040 2014-05-11] (Symantec Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-19] (Realtek Semiconductor)
R2 SupraSavingsService64; C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe [172544 2014-06-26] () [File not signed]
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2921520 2013-04-09] (Samsung Electronics CO., LTD.)
R2 vxlsnyaiet64; C:\Program Files\003\vxlsnyaiet64.exe [706560 2014-04-25] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 Update albrechto; "C:\Program Files (x86)\albrechto\updatealbrechto.exe" [X]

==================== Drivers (Whitelisted) ====================

R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17504 2013-02-09] (Advanced Micro Devices, INC.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-07-21] (Microsoft Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98744 2013-04-24] (Advanced Micro Devices)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\BASHDefs\20140606.001\BHDrvx64.sys [1530160 2014-05-10] (Symantec Corporation)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
S3 BrSerIf; C:\Windows\system32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
U4 BthAvrcpTg;
U4 BthHFEnum;
U4 bthhfhid;
R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [54064 2013-04-26] (Ralink Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [49584 2013-03-25] (Ralink Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1503000.00C\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\IPSDefs\20140702.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\VirusDefs\20140702.009\ENG64.SYS [126040 2014-05-30] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\VirusDefs\20140702.009\EX64.SYS [2099288 2014-05-30] (Symantec Corporation)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2014-06-13] (NetFilterSDK.com)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290008 2014-02-01] (Realtek Semiconductor Corp.)
R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [1204424 2013-12-02] (Ralink Technology, Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [29424 2013-06-05] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [33008 2013-06-05] (Synaptics Incorporated)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1503000.00C\SRTSP64.SYS [875736 2014-02-12] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1503000.00C\SRTSPX64.SYS [36952 2014-02-12] (Symantec Corporation)
S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2014-06-30] ()
R0 SymDS; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1503000.00C\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1503000.00C\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-09-01] (Hewlett-Packard Development Company, L.P.)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-03 15:32 - 2014-07-03 15:32 - 02083840 _____ (Farbar) C:\Users\Robyn\Downloads\FRST64(1).exe
2014-06-30 17:17 - 2014-06-30 17:17 - 00000310 _____ () C:\Windows\Tasks\bench-Updater removing.job
2014-06-30 17:03 - 2014-06-30 17:03 - 00021981 _____ () C:\ComboFix.txt
2014-06-30 16:49 - 2011-06-26 16:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-30 16:49 - 2010-11-08 03:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-30 16:49 - 2009-04-20 14:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-30 16:44 - 2014-06-30 17:03 - 00000000 ____D () C:\Qoobox
2014-06-30 16:43 - 2014-06-30 17:00 - 00000000 ____D () C:\Windows\erdnt
2014-06-30 16:42 - 2014-06-30 16:43 - 05212874 ____R (Swearware) C:\Users\Robyn\Downloads\ComboFix.exe
2014-06-30 16:15 - 2014-06-30 16:15 - 00000000 ____D () C:\Windows\SysWOW64\N360_BACKUP
2014-06-30 15:56 - 2014-06-30 15:56 - 00007602 _____ () C:\Users\Robyn\AppData\Local\Resmon.ResmonCfg
2014-06-30 15:21 - 2014-06-30 16:07 - 00000000 ____D () C:\Program Files (x86)\DriverUpdate
2014-06-30 15:21 - 2014-06-30 15:21 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-06-30 15:21 - 2014-06-30 15:21 - 00000000 ____D () C:\Users\Robyn\AppData\Local\SlimWare Utilities Inc
2014-06-30 15:21 - 2014-06-30 15:21 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2014-06-30 15:18 - 2014-06-30 15:18 - 00858552 _____ (SlimWare Utilities, Inc.) C:\Users\Robyn\Downloads\DriverUpdate-setup.exe
2014-06-30 15:16 - 2014-07-03 15:40 - 00021316 _____ () C:\Users\Robyn\Downloads\FRST.txt
2014-06-30 15:16 - 2014-07-03 15:40 - 00000000 ____D () C:\FRST
2014-06-30 15:15 - 2014-06-30 15:15 - 02083328 _____ (Farbar) C:\Users\Robyn\Downloads\FRST64.exe
2014-06-30 15:13 - 2014-06-30 15:13 - 01073664 _____ (Farbar) C:\Users\Robyn\Downloads\FRST.exe
2014-06-27 22:26 - 2014-06-27 22:26 - 00000000 ____D () C:\Users\Robyn\Documents\Symantec
2014-06-27 14:29 - 2014-07-03 15:33 - 00000000 ____D () C:\Program Files\SupraSavings
2014-06-27 14:29 - 2014-06-28 00:15 - 00000000 ____D () C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32
2014-06-22 12:37 - 2014-06-27 21:56 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\Documents\My Received Files
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\MusicNet
2014-06-22 09:52 - 2014-06-27 21:45 - 00000000 ____D () C:\Program Files (x86)\BearShare Applications
2014-06-22 09:51 - 2014-06-22 09:51 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\Music Toolbar
2014-06-16 12:29 - 2014-06-14 10:06 - 00000030 _____ () C:\AVScanner.ini
2014-06-13 22:08 - 2014-06-13 22:08 - 00000000 ____D () C:\Users\Robyn\Documents\OneNote Notebooks
2014-06-13 05:05 - 2014-06-13 05:05 - 00046376 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\netfilter64.sys
2014-06-13 00:07 - 2014-05-03 16:34 - 06974808 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-06-13 00:07 - 2014-05-03 16:33 - 01824808 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-06-13 00:07 - 2014-05-03 14:51 - 01408976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-06-13 00:07 - 2014-05-02 08:37 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-06-13 00:07 - 2014-04-30 08:32 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\Robocopy.exe
2014-06-13 00:07 - 2014-04-30 08:32 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Robocopy.exe
2014-06-13 00:07 - 2014-04-24 09:51 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-06-13 00:07 - 2014-04-24 09:51 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-13 00:07 - 2014-04-24 09:38 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-06-13 00:07 - 2014-04-24 09:38 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-13 00:07 - 2014-02-08 14:34 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-06-12 23:45 - 2014-06-12 23:45 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-06-12 23:45 - 2014-06-12 23:45 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-06-12 23:22 - 2014-06-30 17:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-12 23:21 - 2014-06-12 23:44 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-06-12 23:17 - 2014-06-30 17:17 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 23:17 - 2014-06-12 23:18 - 00004970 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for HPACHOS-Robyn HPachos
2014-06-12 23:17 - 2014-06-12 23:17 - 00000000 ____D () C:\Users\Robyn\AppData\Local\Microsoft Help
2014-06-12 23:17 - 2014-06-12 23:17 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-06-11 10:45 - 2014-05-24 12:48 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 10:45 - 2014-05-24 12:47 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 10:45 - 2014-05-24 12:47 - 01366016 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 10:45 - 2014-05-24 12:47 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-06-11 10:45 - 2014-05-24 12:47 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 19290112 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 15368704 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 10:45 - 2014-05-24 12:45 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 10:45 - 2014-05-24 12:45 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 10:45 - 2014-05-24 12:45 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 13731328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-11 10:45 - 2014-05-24 11:25 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-11 10:45 - 2014-05-24 11:09 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 10:45 - 2014-05-24 11:03 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 10:45 - 2014-05-24 08:37 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-06-11 10:45 - 2014-05-03 15:47 - 03246592 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 10:45 - 2014-05-03 13:34 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-06-11 10:45 - 2014-04-30 08:32 - 01301504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-06-11 10:45 - 2014-04-30 08:22 - 01023488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-06-11 10:45 - 2014-04-03 21:19 - 00328024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-06-11 10:45 - 2014-04-03 13:44 - 00619008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-06-11 10:45 - 2014-04-01 08:08 - 00387268 _____ () C:\Windows\system32\ApnDatabase.xml
2014-06-11 10:45 - 2014-03-25 09:42 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-06-11 10:45 - 2014-03-25 08:56 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-06-11 10:44 - 2014-05-24 12:46 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 10:44 - 2014-05-24 12:46 - 02650112 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 10:44 - 2014-05-24 11:26 - 14365696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 10:44 - 2014-05-24 11:26 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 10:44 - 2014-05-24 11:25 - 02862080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-11 10:44 - 2014-05-24 11:25 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 10:44 - 2014-05-24 11:25 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-06-11 10:44 - 2014-04-03 21:22 - 02233176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 10:44 - 2014-03-07 10:47 - 01419264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-11 10:44 - 2014-03-07 10:08 - 01845760 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-07-03 15:40 - 2014-06-30 15:16 - 00021316 _____ () C:\Users\Robyn\Downloads\FRST.txt
2014-07-03 15:40 - 2014-06-30 15:16 - 00000000 ____D () C:\FRST
2014-07-03 15:33 - 2014-06-27 14:29 - 00000000 ____D () C:\Program Files\SupraSavings
2014-07-03 15:32 - 2014-07-03 15:32 - 02083840 _____ (Farbar) C:\Users\Robyn\Downloads\FRST64(1).exe
2014-07-03 15:31 - 2013-12-19 21:50 - 01661627 _____ () C:\Windows\WindowsUpdate.log
2014-07-03 15:24 - 2013-12-19 21:54 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{005A7165-764E-443C-91EC-3C012CA2E9AE}
2014-07-03 15:21 - 2014-02-01 19:24 - 00003620 _____ () C:\Windows\SysWOW64\LOCALSERVICE.INI
2014-07-03 15:21 - 2014-02-01 19:24 - 00000043 _____ () C:\Windows\SysWOW64\LOCALDEVICE.INI
2014-07-03 15:21 - 2013-09-13 16:20 - 00001017 _____ () C:\Windows\SysWOW64\bscs.ini
2014-07-03 15:21 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\system32\sru
2014-07-02 22:30 - 2014-02-03 18:20 - 00000154 _____ () C:\Windows\SysWOW64\REMOTEDEVICE.INI
2014-07-02 22:30 - 2013-09-04 13:43 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-07-02 16:14 - 2013-12-22 15:07 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-02 14:34 - 2014-05-07 10:09 - 00000000 ____D () C:\Users\Robyn\Documents\Youcam
2014-07-02 14:32 - 2014-01-19 16:08 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForRobyn.job
2014-07-02 14:32 - 2012-07-26 17:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-02 14:32 - 2012-07-26 15:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-07-02 14:31 - 2012-08-04 08:23 - 00945370 _____ () C:\Windows\PFRO.log
2014-07-02 14:30 - 2012-07-26 15:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-07-02 09:17 - 2014-01-11 15:43 - 00000360 _____ () C:\Windows\Tasks\bench-sys.job
2014-06-30 22:14 - 2013-12-23 15:06 - 00000000 ____D () C:\Users\Robyn\AppData\Local\CrashDumps
2014-06-30 19:35 - 2014-01-19 16:08 - 00003162 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForRobyn
2014-06-30 19:35 - 2013-12-19 21:50 - 00000000 ____D () C:\Users\Robyn
2014-06-30 17:17 - 2014-06-30 17:17 - 00000310 _____ () C:\Windows\Tasks\bench-Updater removing.job
2014-06-30 17:17 - 2014-06-12 23:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-30 17:17 - 2014-06-12 23:17 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-30 17:17 - 2012-07-26 17:28 - 00941114 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-30 17:03 - 2014-06-30 17:03 - 00021981 _____ () C:\ComboFix.txt
2014-06-30 17:03 - 2014-06-30 16:44 - 00000000 ____D () C:\Qoobox
2014-06-30 17:03 - 2014-04-23 07:29 - 00000000 ____D () C:\Users\dub_cm_auto
2014-06-30 17:03 - 2012-07-26 15:37 - 00000000 __RHD () C:\Users\Default
2014-06-30 17:00 - 2014-06-30 16:43 - 00000000 ____D () C:\Windows\erdnt
2014-06-30 16:59 - 2012-07-26 15:26 - 00000215 _____ () C:\Windows\system.ini
2014-06-30 16:43 - 2014-06-30 16:42 - 05212874 ____R (Swearware) C:\Users\Robyn\Downloads\ComboFix.exe
2014-06-30 16:15 - 2014-06-30 16:15 - 00000000 ____D () C:\Windows\SysWOW64\N360_BACKUP
2014-06-30 16:07 - 2014-06-30 15:21 - 00000000 ____D () C:\Program Files (x86)\DriverUpdate
2014-06-30 16:01 - 2014-05-02 13:27 - 00008192 ___SH () C:\Users\Robyn\Downloads\Thumbs.db
2014-06-30 15:56 - 2014-06-30 15:56 - 00007602 _____ () C:\Users\Robyn\AppData\Local\Resmon.ResmonCfg
2014-06-30 15:21 - 2014-06-30 15:21 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-06-30 15:21 - 2014-06-30 15:21 - 00000000 ____D () C:\Users\Robyn\AppData\Local\SlimWare Utilities Inc
2014-06-30 15:21 - 2014-06-30 15:21 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2014-06-30 15:18 - 2014-06-30 15:18 - 00858552 _____ (SlimWare Utilities, Inc.) C:\Users\Robyn\Downloads\DriverUpdate-setup.exe
2014-06-30 15:15 - 2014-06-30 15:15 - 02083328 _____ (Farbar) C:\Users\Robyn\Downloads\FRST64.exe
2014-06-30 15:13 - 2014-06-30 15:13 - 01073664 _____ (Farbar) C:\Users\Robyn\Downloads\FRST.exe
2014-06-28 14:54 - 2014-01-09 12:45 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-06-28 14:54 - 2014-01-09 12:45 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-28 00:15 - 2014-06-27 14:29 - 00000000 ____D () C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32
2014-06-27 22:46 - 2013-12-19 22:02 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2700925841-1584683910-2212061445-1002
2014-06-27 22:26 - 2014-06-27 22:26 - 00000000 ____D () C:\Users\Robyn\Documents\Symantec
2014-06-27 22:13 - 2013-12-22 10:06 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\newnext.me
2014-06-27 21:58 - 2013-09-04 14:06 - 00000000 ____D () C:\ProgramData\Temp
2014-06-27 21:56 - 2014-06-22 12:37 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-27 21:52 - 2013-09-04 14:07 - 00000000 ____D () C:\Program Files (x86)\CyberLink
2014-06-27 21:52 - 2013-07-21 07:50 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-27 21:50 - 2013-09-04 14:09 - 00000000 ____D () C:\ProgramData\CyberLink
2014-06-27 21:45 - 2014-06-22 09:52 - 00000000 ____D () C:\Program Files (x86)\BearShare Applications
2014-06-26 15:07 - 2014-01-11 13:20 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\vlc
2014-06-22 12:53 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\rescache
2014-06-22 11:47 - 2012-07-26 17:21 - 00046620 _____ () C:\Windows\setupact.log
2014-06-22 11:32 - 2014-05-02 12:04 - 00438120 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\Documents\My Received Files
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\MusicNet
2014-06-22 09:51 - 2014-06-22 09:51 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\Music Toolbar
2014-06-21 16:27 - 2013-07-21 07:35 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-06-21 16:27 - 2012-08-04 10:02 - 00000000 ____D () C:\SWSetup
2014-06-21 12:42 - 2013-12-19 22:08 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-21 12:16 - 2013-12-22 15:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-18 17:28 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-06-18 14:05 - 2014-03-19 09:34 - 00024576 ___SH () C:\Users\Robyn\Documents\Thumbs.db
2014-06-14 10:06 - 2014-06-16 12:29 - 00000030 _____ () C:\AVScanner.ini
2014-06-14 10:06 - 2013-12-22 15:07 - 00003718 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-13 22:08 - 2014-06-13 22:08 - 00000000 ____D () C:\Users\Robyn\Documents\OneNote Notebooks
2014-06-13 20:09 - 2014-02-03 15:49 - 00000000 ____D () C:\Users\Robyn\Documents\TAFE
2014-06-13 05:05 - 2014-06-13 05:05 - 00046376 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\netfilter64.sys
2014-06-13 00:08 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\WinStore
2014-06-13 00:08 - 2012-07-26 17:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-06-12 23:45 - 2014-06-12 23:45 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-06-12 23:45 - 2014-06-12 23:45 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-06-12 23:44 - 2014-06-12 23:21 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-06-12 23:21 - 2013-07-21 07:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-06-12 23:20 - 2012-07-26 18:12 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-06-12 23:18 - 2014-06-12 23:17 - 00004970 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for HPACHOS-Robyn HPachos
2014-06-12 23:17 - 2014-06-12 23:17 - 00000000 ____D () C:\Users\Robyn\AppData\Local\Microsoft Help
2014-06-12 23:17 - 2014-06-12 23:17 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-06-12 23:17 - 2012-07-26 17:52 - 00000000 ____D () C:\Windows\ShellNew
2014-06-12 23:00 - 2012-07-26 18:12 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-06-12 22:15 - 2013-12-19 21:50 - 00000000 ____D () C:\Users\Robyn\AppData\Local\Packages
2014-06-11 10:57 - 2014-01-23 21:22 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 10:52 - 2014-01-23 21:22 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-07 22:49 - 2013-12-19 21:56 - 00000000 ____D () C:\Users\Robyn\AppData\Local\CyberLink
2014-06-07 22:49 - 2013-09-04 14:16 - 00000000 ____D () C:\Users\Public\CyberLink
2014-06-07 22:47 - 2013-12-30 23:14 - 00000000 ____D () C:\Users\Robyn\Documents\CyberLink

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-29 20:11

==================== End Of Log ============================

 

Additional Scan Log Results:

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-07-2014
Ran by Robyn at 2014-07-03 15:41:29
Running from C:\Users\Robyn\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 Premier Edition (Enabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

==================== Installed Programs ======================

Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.125 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
AMD Accelerated Video Transcoding (Version: 12.10.100.30416 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{F196C498-5681-BCA2-8029-5BF070368F35}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
AMD Start Now (Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4.6515 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.4.6515 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.4.3021 - CyberLink Corp.)
CyberLink PowerDirector 10 (x32 Version: 10.0.4.3021 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 5.0.1.2922 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 5.0.1.2922 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DisableMSDefender (Version: 1.0.0 - Hewlett-Packard Company) Hidden
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HP 3D DriveGuard (HKLM-x32\...\{07F6DC37-0857-4B68-A675-4E35989E85E3}) (Version: 6.0.15.1 - Hewlett-Packard Company)
HP CoolSense (HKLM-x32\...\{394B14EA-B072-4440-9510-87797CB12371}) (Version: 2.20.21 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\...\{61245005-66F1-4001-AEE8-2E2D36F65C28}) (Version: 1.1.0.0 - Hewlett-Packard)
HP Postscript Converter (Version: 4.0.4100 - Hewlett-Packard) Hidden
HP Recovery Manager (x32 Version: 11.00 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6838.4521 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\...\{DEF23826-DB71-4654-BC00-D5D6C20802EA}) (Version: 1.1.4 - Hewlett-Packard Company)
HP Utility Center (HKLM\...\{A48BD764-CFDF-40A5-A07A-710908044F5D}) (Version: 2.2.2 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\...\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 16.4.6013.0910 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\...\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\...\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Mozilla Firefox 30.0 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 30.0 (x86 en-US)) (Version: 30.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Norton 360 (HKLM-x32\...\N360) (Version: 21.3.0.12 - Symantec Corporation)
OEM Application Profile (HKLM-x32\...\{70D5F822-F4C4-33D9-7EEC-2A4AF4EA7BDC}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
Ralink Bluetooth Stack64 (HKLM\...\{8A69F02D-A72B-AEE6-1CD3-6B05B9F9DD83}) (Version: 11.0.742.0 - Mediatek)
Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.45.0 - Mediatek)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.29068 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.15.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7071 - Realtek Semiconductor Corp.)
SW Update (HKLM-x32\...\{43C711D9-67C9-4793-80D4-E957D638D531}) (Version: 2.1.14 - Samsung Electronics CO., LTD.)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 17.0.6.2 - Synaptics Incorporated)
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version:  - Microsoft)
VLC media player 2.0.0 (HKLM-x32\...\VLC media player) (Version: 2.0.0 - VideoLAN)
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden

==================== Restore Points  =========================

14-06-2014 04:53:32 HPSF Applying updates
21-06-2014 06:25:36 HPSF Applying updates
27-06-2014 11:48:25 Configured PowerDVD
30-06-2014 06:05:03 Removed DriverUpdate

==================== Hosts content: ==========================

2012-07-26 15:26 - 2014-06-30 16:59 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {01FE95E6-7703-43B6-ADA3-90BB6940B52C} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {125AC4AD-43B6-4C03-AB7E-F3AB40808F3E} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\SymErr.exe [2014-01-31] (Symantec Corporation)
Task: {18713E99-6AB1-4743-8F3B-098F31A1DA00} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\WSCStub.exe [2014-05-11] (Symantec Corporation)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {1D4F3717-7285-494F-942D-D90A07D64E54} - System32\Tasks\Microsoft\Windows\Setup\Pre-staged GDR Notification => C:\Windows\system32\NotificationUI.exe [2014-04-19] (Microsoft Corporation)
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {23AF35A0-BFEA-4419-BFB1-2A89F59B8186} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {341C8D51-8FFF-48EE-BC67-BA8CADF63D2E} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe
Task: {3B603AA9-0E9D-4376-AE76-C90601DB1D36} - System32\Tasks\Microsoft Office 15 Sync Maintenance for HPACHOS-Robyn HPachos => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe
Task: {46EA4129-04AA-4FDE-AEEC-7F57D7B6D588} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-05-13] (Microsoft Corporation)
Task: {77DF84FE-988F-41C2-AB7A-E46894A2CF88} - System32\Tasks\bench-sys => C:\Program Files (x86)\Bench\Updater\updater.exe [2013-12-19] () <==== ATTENTION
Task: {7A77ED5F-5310-4B77-9E57-9A94139BEE04} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\SymErr.exe [2014-01-31] (Symantec Corporation)
Task: {9DB94D4C-7F77-4EB4-A34A-515A2A60362E} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2013-09-10] (Hewlett-Packard Development Company, L.P.)
Task: {A1C080B1-DBA6-4CEC-A596-A96E880FDDC7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-14] (Adobe Systems Incorporated)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AECD1015-14DF-4751-AF8E-FB7BE52FAF72} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {CC72C160-9509-4E18-AC1D-ABBAD7159239} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {DF2F2A5F-9C1C-4671-9CA4-EB9B84A617A7} - System32\Tasks\HPCeeScheduleForRobyn => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {E080B5A7-523D-4C93-9F00-D892A7886FA7} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-06-11] (Microsoft Corporation)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {F38B1048-25E0-472F-A86D-8DC6CB764BE0} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2014-02-01] (Synaptics Incorporated)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\bench-Updater removing.job => ? <==== ATTENTION
Task: C:\Windows\Tasks\HPCeeScheduleForRobyn.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2013-04-17 16:51 - 2013-04-17 16:51 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe
2013-04-17 16:50 - 2013-04-17 16:50 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-03-19 10:40 - 2013-10-31 18:13 - 00102568 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-06-26 03:58 - 2014-06-26 03:58 - 00172544 _____ () C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe
2014-06-13 05:05 - 2014-06-13 05:05 - 00110080 _____ () C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\nfapi.dll
2014-06-13 05:05 - 2014-06-13 05:05 - 00456192 _____ () C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\ProtocolFilters.dll
2014-04-25 18:46 - 2014-04-25 18:46 - 00706560 _____ () C:\Program Files\003\vxlsnyaiet64.exe
2013-05-14 16:33 - 2013-05-14 16:33 - 00016632 _____ () C:\Windows\system32\BsHelpCSps.dll
2014-05-14 15:50 - 2014-05-14 15:50 - 00176048 _____ () C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\ModernShared\ErrorReporting\ErrorReporting.dll
2013-04-17 16:51 - 2013-04-17 16:51 - 00016896 _____ () C:\Program Files\ATI Technologies\ATI.ACE\a4\AS4.NativeProxy.dll
2013-04-17 16:50 - 2013-04-17 16:50 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2013-05-14 16:33 - 2013-05-14 16:33 - 00029432 _____ () C:\Windows\SYSTEM32\BsTrace.dll
2013-05-14 16:33 - 2013-05-14 16:33 - 00016632 _____ () C:\Windows\SYSTEM32\BsHelpCSps.dll
2013-05-14 16:33 - 2013-05-14 16:33 - 00062200 _____ () C:\Windows\SYSTEM32\BlueSoleilCSps.dll
2013-05-24 09:22 - 2013-05-24 09:22 - 00334648 _____ () C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\Driver\USB\tl_filter.dll
2011-07-05 09:53 - 2011-07-05 09:53 - 00012800 _____ () C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\Driver\AMP\IVTAMPRL.dll
2013-05-14 16:33 - 2013-05-14 16:33 - 00080120 _____ () C:\Windows\SYSTEM32\BsProfilefunc.dll
2013-05-14 16:33 - 2013-05-14 16:33 - 00371448 _____ () C:\Windows\SYSTEM32\BsExtendFunc.dll
2013-12-22 15:23 - 2014-06-21 12:15 - 03852912 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:10894A2E
AlternateDataStreams: C:\ProgramData\Temp:373E1720

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SAWFP => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SecureAssist => ""="service"

==================== EXE Association (whitelisted) =============


==================== MSCONFIG/TASK MANAGER disabled items =========

HKLM\...\StartupApproved\Run32: => "APSDaemon"
HKLM\...\StartupApproved\Run32: => "mobilegeni daemon"
HKCU\...\StartupApproved\Run: => "NextLive"
HKCU\...\StartupApproved\Run: => "OutfoxTV"

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (07/02/2014 09:31:47 AM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (07/01/2014 11:51:52 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.

Error: (07/01/2014 11:50:00 AM) (Source: SideBySide) (EventID: 78) (User: )
Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest2" on line C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest3.
A component version required by the application conflicts with another component version already active.
Conflicting components are:.
Component 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_8937eec6860750f5.manifest.
Component 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.9200.16579_none_418ab7ef718b27ef.manifest.

Error: (07/01/2014 00:39:35 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: atieclxx.exe, version: 6.14.11.1143, time stamp: 0x516e1014
Faulting module name: atieclxx.exe, version: 6.14.11.1143, time stamp: 0x516e1014
Exception code: 0xc0000005
Fault offset: 0x000000000002ea19
Faulting process id: 0x29b8
Faulting application start time: 0xatieclxx.exe0
Faulting application path: atieclxx.exe1
Faulting module path: atieclxx.exe2
Report Id: atieclxx.exe3
Faulting package full name: atieclxx.exe4
Faulting package-relative application ID: atieclxx.exe5

Error: (06/30/2014 10:14:23 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program firefox.exe version 30.0.0.5269 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 32a8

Start Time: 01cf94440e276ae4

Termination Time: 42627

Application Path: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

Report Id: d5f80247-004f-11e4-be8d-70188b8ce0ae

Faulting package full name:

Faulting package-relative application ID:

Error: (06/30/2014 10:14:21 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 30.0.0.5269, time stamp: 0x53914233
Faulting module name: mozalloc.dll, version: 30.0.0.5269, time stamp: 0x53911393
Exception code: 0x80000003
Fault offset: 0x0000141b
Faulting process id: 0x14c0
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3
Faulting package full name: plugin-container.exe4
Faulting package-relative application ID: plugin-container.exe5

Error: (06/30/2014 04:52:02 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: NircmdB.exe, version: 2.3.5.189, time stamp: 0x49ec5532
Faulting module name: ntdll.dll, version: 6.2.9200.16912, time stamp: 0x53645e25
Exception code: 0xc0000005
Fault offset: 0x00058527
Faulting process id: 0x496c
Faulting application start time: 0xNircmdB.exe0
Faulting application path: NircmdB.exe1
Faulting module path: NircmdB.exe2
Report Id: NircmdB.exe3
Faulting package full name: NircmdB.exe4
Faulting package-relative application ID: NircmdB.exe5

Error: (06/30/2014 04:51:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: NIRCMD.exe, version: 2.3.5.189, time stamp: 0x49ec5532
Faulting module name: ntdll.dll, version: 6.2.9200.16912, time stamp: 0x53645e25
Exception code: 0xc0000005
Fault offset: 0x00058527
Faulting process id: 0x4bb4
Faulting application start time: 0xNIRCMD.exe0
Faulting application path: NIRCMD.exe1
Faulting module path: NIRCMD.exe2
Report Id: NIRCMD.exe3
Faulting package full name: NIRCMD.exe4
Faulting package-relative application ID: NIRCMD.exe5

Error: (06/30/2014 04:02:45 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program wwahost.exe version 6.2.9200.16420 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 3a40

Start Time: 01cf9428cb8c7495

Termination Time: 4294967295

Application Path: C:\Windows\system32\wwahost.exe

Report Id: 1382d5ec-001c-11e4-be8d-70188b8ce0ae

Faulting package full name: microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe

Faulting package-relative application ID: Microsoft.WindowsLive.ModernPhotos

Error: (06/30/2014 04:02:22 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: HPACHOS)
Description: Activation of app microsoft.windowsphotos_8wekyb3d8bbwe!Microsoft.WindowsLive.ModernPhotos failed with error: -2144927142 See the Microsoft-Windows-TWinUI/Operational log for additional information.


System errors:
=============
Error: (07/02/2014 02:32:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The Update albrechto service failed to start due to the following error:
%%2

Error: (06/30/2014 10:10:22 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPWMISVC service.

Error: (06/30/2014 10:09:52 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HPWMISVC service.

Error: (06/30/2014 09:55:09 PM) (Source: Service Control Manager) (EventID: 7011) (User: )
Description: A timeout (30000 milliseconds) was reached while waiting for a transaction response from the HP Support Assistant Service service.

Error: (06/30/2014 08:45:24 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (06/30/2014 08:44:54 PM) (Source: DCOM) (EventID: 10010) (User: NT AUTHORITY)
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}

Error: (06/30/2014 04:59:37 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Error: (06/30/2014 04:58:49 PM) (Source: Application Popup) (EventID: 1060) (User: )
Description: \??\C:\ComboFix\catchme.sys

Error: (06/30/2014 04:55:37 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service.  However, the system is configured to not allow interactive services.  This service may not function properly.

Error: (06/30/2014 11:14:32 AM) (Source: BTHUSB) (EventID: 17) (User: )
Description: The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2014-06-30 16:58:49.439
  Description: Windows is unable to verify the image integrity of the file \Device\HarddiskVolume4\ComboFix\catchme.sys because file hash could not be found on the system. A recent hardware or software change might have installed a file that is signed incorrectly or damaged, or that might be malicious software from an unknown source.


==================== Memory info ===========================

Percentage of memory in use: 53%
Total physical RAM: 3546.25 MB
Available physical RAM: 1662.27 MB
Total Pagefile: 4442.25 MB
Available Pagefile: 2363.67 MB
Total Virtual: 8192 MB
Available Virtual: 8191.85 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:673.2 GB) (Free:627.74 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:24.67 GB) (Free:2.5 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (Live_At_The_Enmore) (CDROM) (Total:6.32 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: AF7F468F)

Partition: GPT Partition Type.

==================== End Of Log ============================



#4 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 01:24 AM

Georgi, just so yu know......it seems to be opening up numerous tabs as well as running things in the background.  My battery has also just started to run out 'very' quickly all of a sudden.  Somethings is draining the battery - whatever it is.  Thanks again Georgi :) Cheers, Robyn.



#5 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:07 PM

Posted 03 July 2014 - 04:38 AM

Hello Robyn, :)

 

 

Please download the following file => [attachment=151976:fixlist.txt] and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

Run FRST and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

 

 

Next please go ahead and uninstall Google Update Helper if listed in the Control Panel.

 

Also it seems that your preferences file is corrupted so go ahead and reinstall Google Chrome as well:

 

Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION

 

Let me know how are things after the procedures above. :)

 

 

 

Regards,

Georgi


cXfZ4wS.png


#6 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 05:37 AM

Hi Georgi;

 

This is the FRST scan 'before' I ran the fix

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-07-2014
Ran by Robyn (administrator) on HPACHOS on 03-07-2014 20:26:50
Running from C:\Users\Robyn\Downloads
Platform: Windows 8 (X64) OS Language: English (United States)
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
() C:\Program Files\ATI Technologies\ATI.ACE\a4\AdaptiveSleepService.exe
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\n360.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
() C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe
(Samsung Electronics CO., LTD.) C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe
() C:\Program Files\003\vxlsnyaiet64.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\n360.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\core-static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\core-static\CCC.exe
(Microsoft Corporation) C:\Windows\SysWOW64\notepad.exe
(Farbar) C:\Users\Robyn\Downloads\FRST64(1).exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7203032 2014-02-01] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-04-17] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-05-22] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [77088 2013-07-24] (Hewlett-Packard Company)
HKLM-x32\...\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [387832 2013-05-14] (IVT Corporation)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [475448 2014-03-26] (Hewlett-Packard Development Company, L.P.)
HKU\S-1-5-21-2700925841-1584683910-2212061445-1002\...\Run: [NextLive] => C:\Windows\SysWOW64\rundll32.exe "C:\Users\Robyn\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
Startup: C:\Users\Robyn\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files (x86)\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?searchsource=10&cui=un20189207061796831&um=2&ctid=ct3298588
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/HPALL13/14
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.jp.msn.com/HPALL13/14
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.jp.msn.com/HPALL13/14
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {C6615190-FAF5-44C4-85D8-661B78E555AB} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {C6615190-FAF5-44C4-85D8-661B78E555AB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298588&CUI=UN20189207061796831&UM=2
SearchScopes: HKCU - {014DB5FA-EAFB-4592-A95B-F44D3EE87FA9} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKCU - {A53C7379-2A3C-4389-8EC9-5C087FBF1A51} URL = http://search.yahoo.com/search?p={searchTerms}&fr=tightropetb&type=10805
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=360&chn=retail&geo=AU&ver=20&locale=en_AU&gct=kwd&qsrc=2869
SearchScopes: HKCU - {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL =
SearchScopes: HKCU - {C6615190-FAF5-44C4-85D8-661B78E555AB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298588&CUI=UN20189207061796831&UM=2
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - {DC0AD46A-E369-4C22-AD6C-70F669604BC6} URL = http://search.findwide.com/serp?guid={F28E1487-F82C-4207-8488-28C0346E94CC}&action=default_search&serpv=22&k={searchTerms}
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {41B78170-3CD6-4072-B68D-F3DBDA8D1FCD} -  No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWow64\skype4com.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 211.29.132.12 198.142.0.51 198.142.235.14

FireFox:
========
FF ProfilePath: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default
FF NewTab: user_pref("browser.newtab.url", "");
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF Homepage: hxxp://www.msn.com.au
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_125.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_125.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=3 - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin-x32: @tools.dpliveupdate.com/DealPlyLive Update;version=9 - C:\Program Files (x86)\DealPlyLive\Update\1.3.23.0\npGoogleUpdate3.dll (DealPly Technologies Ltd)
FF Plugin-x32: @videolan.org/vlc,version=2.0.0 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin HKCU: @lightspark.github.com/Lightspark;version=1 - C:\Program Files (x86)\Lightspark 0.5.3-git\nplightsparkplugin.dll No File
FF user.js: detected! => C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\user.js
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\Ask.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\findwide.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: MixiDJ V52  - C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\Extensions\{24a0cfe1-f479-4b19-b627-a96bf1ea3a56} [2013-12-22]
FF Extension: DealPly  Shopping - C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f} [2013-12-22]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\coFFPlgn [2014-07-03]
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.1.7\IPSFF [2014-03-23]

Chrome:
=======
Error reading preferences. Please check "preferences" file for possible corruption. <======= ATTENTION
CHR Extension: (DealPly  Shopping) - C:\Users\Robyn\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf [2013-12-22]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\Exts\Chrome.crx [2014-05-30]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

==================== Services (Whitelisted) =================

R2 AdaptiveSleepService; C:\Program Files\ATI Technologies\ATI.ACE\A4\AdaptiveSleepService.exe [103424 2013-04-17] () [File not signed]
R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-04-17] (Advanced Micro Devices, Inc.) [File not signed]
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1630456 2013-06-07] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [145656 2013-05-14] (IVT Corporation)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2279608 2014-05-21] (Microsoft Corporation)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [469304 2014-03-26] (Hewlett-Packard Development Company, L.P.)
R2 N360; C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.3.0.12\N360.exe [265040 2014-05-11] (Symantec Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [246488 2013-06-19] (Realtek Semiconductor)
R2 SupraSavingsService64; C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe [172544 2014-06-26] () [File not signed]
R2 SWUpdateService; C:\Program Files (x86)\Samsung\SW Update\SWMAgent.exe [2921520 2013-04-09] (Samsung Electronics CO., LTD.)
R2 vxlsnyaiet64; C:\Program Files\003\vxlsnyaiet64.exe [706560 2014-04-25] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 Update albrechto; "C:\Program Files (x86)\albrechto\updatealbrechto.exe" [X]

==================== Drivers (Whitelisted) ====================

R3 AmdAS4; C:\Windows\System32\drivers\AmdAS4.sys [17504 2013-02-09] (Advanced Micro Devices, INC.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [29696 2013-07-21] (Microsoft Corporation)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [98744 2013-04-24] (Advanced Micro Devices)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\BASHDefs\20140606.001\BHDrvx64.sys [1530160 2014-05-10] (Symantec Corporation)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
S3 BrSerIf; C:\Windows\system32\DRIVERS\BrSerIf.sys [97280 2006-12-12] (Brother Industries Ltd.)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-15] (IVT Corporation)
U4 BthAvrcpTg;
U4 BthHFEnum;
U4 bthhfhid;
R3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [54064 2013-04-26] (Ralink Corporation)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
R3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [49584 2013-03-25] (Ralink Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1503000.00C\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-06-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\IPSDefs\20140702.001\IDSvia64.sys [525016 2014-03-26] (Symantec Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\VirusDefs\20140702.009\ENG64.SYS [126040 2014-05-30] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.1.1.7\Definitions\VirusDefs\20140702.009\EX64.SYS [2099288 2014-05-30] (Symantec Corporation)
R1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2014-06-13] (NetFilterSDK.com)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290008 2014-02-01] (Realtek Semiconductor Corp.)
R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [1204424 2013-12-02] (Ralink Technology, Corp.)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [29424 2013-06-05] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [33008 2013-06-05] (Synaptics Incorporated)
R1 SRTSP; C:\Windows\System32\Drivers\N360x64\1503000.00C\SRTSP64.SYS [875736 2014-02-12] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1503000.00C\SRTSPX64.SYS [36952 2014-02-12] (Symantec Corporation)
S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2014-06-30] ()
R0 SymDS; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1503000.00C\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1503000.00C\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-03-19] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1503000.00C\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1503000.00C\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-09-01] (Hewlett-Packard Development Company, L.P.)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [33968 2012-12-19] (IVT Corporation)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-03 20:21 - 2014-07-03 20:21 - 00010086 _____ () C:\Users\Robyn\Desktop\fixlist.txt
2014-07-03 16:08 - 2014-07-03 16:08 - 00042529 _____ () C:\Users\Robyn\Desktop\FRST.txt
2014-07-03 16:08 - 2014-07-03 16:08 - 00034878 _____ () C:\Users\Robyn\Desktop\Addition.txt
2014-07-03 15:41 - 2014-07-03 15:42 - 00034878 _____ () C:\Users\Robyn\Downloads\Addition.txt
2014-07-03 15:32 - 2014-07-03 15:32 - 02083840 _____ (Farbar) C:\Users\Robyn\Downloads\FRST64(1).exe
2014-06-30 17:17 - 2014-06-30 17:17 - 00000310 _____ () C:\Windows\Tasks\bench-Updater removing.job
2014-06-30 17:03 - 2014-06-30 17:03 - 00021981 _____ () C:\ComboFix.txt
2014-06-30 16:49 - 2011-06-26 16:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-06-30 16:49 - 2010-11-08 03:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-06-30 16:49 - 2009-04-20 14:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00212480 _____ (SteelWerX) C:\Windows\SWXCACLS.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00098816 _____ () C:\Windows\sed.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00080412 _____ () C:\Windows\grep.exe
2014-06-30 16:49 - 2000-08-31 10:00 - 00068096 _____ () C:\Windows\zip.exe
2014-06-30 16:44 - 2014-06-30 17:03 - 00000000 ____D () C:\Qoobox
2014-06-30 16:43 - 2014-06-30 17:00 - 00000000 ____D () C:\Windows\erdnt
2014-06-30 16:42 - 2014-06-30 16:43 - 05212874 ____R (Swearware) C:\Users\Robyn\Downloads\ComboFix.exe
2014-06-30 16:15 - 2014-06-30 16:15 - 00000000 ____D () C:\Windows\SysWOW64\N360_BACKUP
2014-06-30 15:56 - 2014-06-30 15:56 - 00007602 _____ () C:\Users\Robyn\AppData\Local\Resmon.ResmonCfg
2014-06-30 15:21 - 2014-06-30 16:07 - 00000000 ____D () C:\Program Files (x86)\DriverUpdate
2014-06-30 15:21 - 2014-06-30 15:21 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-06-30 15:21 - 2014-06-30 15:21 - 00000000 ____D () C:\Users\Robyn\AppData\Local\SlimWare Utilities Inc
2014-06-30 15:21 - 2014-06-30 15:21 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2014-06-30 15:18 - 2014-06-30 15:18 - 00858552 _____ (SlimWare Utilities, Inc.) C:\Users\Robyn\Downloads\DriverUpdate-setup.exe
2014-06-30 15:16 - 2014-07-03 20:26 - 00021111 _____ () C:\Users\Robyn\Downloads\FRST.txt
2014-06-30 15:16 - 2014-07-03 20:26 - 00000000 ____D () C:\FRST
2014-06-30 15:15 - 2014-06-30 15:15 - 02083328 _____ (Farbar) C:\Users\Robyn\Downloads\FRST64.exe
2014-06-30 15:13 - 2014-06-30 15:13 - 01073664 _____ (Farbar) C:\Users\Robyn\Downloads\FRST.exe
2014-06-27 22:26 - 2014-06-27 22:26 - 00000000 ____D () C:\Users\Robyn\Documents\Symantec
2014-06-27 14:29 - 2014-07-03 16:20 - 00000000 ____D () C:\Program Files\SupraSavings
2014-06-27 14:29 - 2014-06-28 00:15 - 00000000 ____D () C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32
2014-06-22 12:37 - 2014-06-27 21:56 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\Documents\My Received Files
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\MusicNet
2014-06-22 09:52 - 2014-06-27 21:45 - 00000000 ____D () C:\Program Files (x86)\BearShare Applications
2014-06-22 09:51 - 2014-06-22 09:51 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\Music Toolbar
2014-06-16 12:29 - 2014-06-14 10:06 - 00000030 _____ () C:\AVScanner.ini
2014-06-13 22:08 - 2014-06-13 22:08 - 00000000 ____D () C:\Users\Robyn\Documents\OneNote Notebooks
2014-06-13 05:05 - 2014-06-13 05:05 - 00046376 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\netfilter64.sys
2014-06-13 00:07 - 2014-05-03 16:34 - 06974808 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-06-13 00:07 - 2014-05-03 16:33 - 01824808 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-06-13 00:07 - 2014-05-03 14:51 - 01408976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-06-13 00:07 - 2014-05-02 08:37 - 01023488 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-06-13 00:07 - 2014-04-30 08:32 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\Robocopy.exe
2014-06-13 00:07 - 2014-04-30 08:32 - 00106496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Robocopy.exe
2014-06-13 00:07 - 2014-04-24 09:51 - 00566784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-06-13 00:07 - 2014-04-24 09:51 - 00124928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-13 00:07 - 2014-04-24 09:38 - 00693760 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-06-13 00:07 - 2014-04-24 09:38 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-06-13 00:07 - 2014-02-08 14:34 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-06-12 23:45 - 2014-06-12 23:45 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-06-12 23:45 - 2014-06-12 23:45 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-06-12 23:22 - 2014-06-30 17:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-12 23:21 - 2014-06-12 23:44 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-06-12 23:17 - 2014-06-30 17:17 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-12 23:17 - 2014-06-12 23:17 - 00000000 ____D () C:\Users\Robyn\AppData\Local\Microsoft Help
2014-06-12 23:17 - 2014-06-12 23:17 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-06-11 10:45 - 2014-05-24 12:48 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-11 10:45 - 2014-05-24 12:47 - 02239488 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-11 10:45 - 2014-05-24 12:47 - 01366016 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-11 10:45 - 2014-05-24 12:47 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-06-11 10:45 - 2014-05-24 12:47 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 19290112 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 15368704 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00097792 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-11 10:45 - 2014-05-24 12:46 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-11 10:45 - 2014-05-24 12:45 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-11 10:45 - 2014-05-24 12:45 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-11 10:45 - 2014-05-24 12:45 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-11 10:45 - 2014-05-24 11:26 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 13731328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-11 10:45 - 2014-05-24 11:25 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-11 10:45 - 2014-05-24 11:25 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-11 10:45 - 2014-05-24 11:09 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-11 10:45 - 2014-05-24 11:03 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-11 10:45 - 2014-05-24 08:37 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-06-11 10:45 - 2014-05-03 15:47 - 03246592 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-06-11 10:45 - 2014-05-03 13:34 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-06-11 10:45 - 2014-04-30 08:32 - 01301504 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-06-11 10:45 - 2014-04-30 08:22 - 01023488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-06-11 10:45 - 2014-04-03 21:19 - 00328024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-06-11 10:45 - 2014-04-03 13:44 - 00619008 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\srv2.sys
2014-06-11 10:45 - 2014-04-01 08:08 - 00387268 _____ () C:\Windows\system32\ApnDatabase.xml
2014-06-11 10:45 - 2014-03-25 09:42 - 00305152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wusa.exe
2014-06-11 10:45 - 2014-03-25 08:56 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\wusa.exe
2014-06-11 10:44 - 2014-05-24 12:46 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-11 10:44 - 2014-05-24 12:46 - 02650112 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-11 10:44 - 2014-05-24 11:26 - 14365696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-11 10:44 - 2014-05-24 11:26 - 00080896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-11 10:44 - 2014-05-24 11:25 - 02862080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-11 10:44 - 2014-05-24 11:25 - 02050560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-11 10:44 - 2014-05-24 11:25 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-06-11 10:44 - 2014-04-03 21:22 - 02233176 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-11 10:44 - 2014-03-07 10:47 - 01419264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-11 10:44 - 2014-03-07 10:08 - 01845760 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll

==================== One Month Modified Files and Folders =======

2014-07-03 20:27 - 2014-06-30 15:16 - 00021111 _____ () C:\Users\Robyn\Downloads\FRST.txt
2014-07-03 20:26 - 2014-06-30 15:16 - 00000000 ____D () C:\FRST
2014-07-03 20:21 - 2014-07-03 20:21 - 00010086 _____ () C:\Users\Robyn\Desktop\fixlist.txt
2014-07-03 20:18 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\system32\sru
2014-07-03 20:16 - 2014-02-01 19:24 - 00003620 _____ () C:\Windows\SysWOW64\LOCALSERVICE.INI
2014-07-03 20:16 - 2014-02-01 19:24 - 00000043 _____ () C:\Windows\SysWOW64\LOCALDEVICE.INI
2014-07-03 20:16 - 2013-09-13 16:20 - 00001017 _____ () C:\Windows\SysWOW64\bscs.ini
2014-07-03 20:09 - 2014-02-03 18:20 - 00000154 _____ () C:\Windows\SysWOW64\REMOTEDEVICE.INI
2014-07-03 20:09 - 2013-09-04 13:43 - 00065536 _____ () C:\Windows\system32\spu_storage.bin
2014-07-03 16:20 - 2014-06-27 14:29 - 00000000 ____D () C:\Program Files\SupraSavings
2014-07-03 16:14 - 2013-12-22 15:07 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-03 16:12 - 2014-05-07 10:09 - 00000000 ____D () C:\Users\Robyn\Documents\Youcam
2014-07-03 16:11 - 2013-12-19 21:50 - 01701400 _____ () C:\Windows\WindowsUpdate.log
2014-07-03 16:09 - 2012-07-26 17:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-03 16:08 - 2014-07-03 16:08 - 00042529 _____ () C:\Users\Robyn\Desktop\FRST.txt
2014-07-03 16:08 - 2014-07-03 16:08 - 00034878 _____ () C:\Users\Robyn\Desktop\Addition.txt
2014-07-03 16:08 - 2012-07-26 15:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-07-03 15:42 - 2014-07-03 15:41 - 00034878 _____ () C:\Users\Robyn\Downloads\Addition.txt
2014-07-03 15:32 - 2014-07-03 15:32 - 02083840 _____ (Farbar) C:\Users\Robyn\Downloads\FRST64(1).exe
2014-07-03 15:24 - 2013-12-19 21:54 - 00003922 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{005A7165-764E-443C-91EC-3C012CA2E9AE}
2014-07-02 14:32 - 2014-01-19 16:08 - 00000348 _____ () C:\Windows\Tasks\HPCeeScheduleForRobyn.job
2014-07-02 14:32 - 2012-07-26 15:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-07-02 14:31 - 2012-08-04 08:23 - 00945370 _____ () C:\Windows\PFRO.log
2014-07-02 09:17 - 2014-01-11 15:43 - 00000360 _____ () C:\Windows\Tasks\bench-sys.job
2014-06-30 22:14 - 2013-12-23 15:06 - 00000000 ____D () C:\Users\Robyn\AppData\Local\CrashDumps
2014-06-30 19:35 - 2014-01-19 16:08 - 00003162 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForRobyn
2014-06-30 19:35 - 2013-12-19 21:50 - 00000000 ____D () C:\Users\Robyn
2014-06-30 17:17 - 2014-06-30 17:17 - 00000310 _____ () C:\Windows\Tasks\bench-Updater removing.job
2014-06-30 17:17 - 2014-06-12 23:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
2014-06-30 17:17 - 2014-06-12 23:17 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-30 17:17 - 2012-07-26 17:28 - 00941114 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-06-30 17:03 - 2014-06-30 17:03 - 00021981 _____ () C:\ComboFix.txt
2014-06-30 17:03 - 2014-06-30 16:44 - 00000000 ____D () C:\Qoobox
2014-06-30 17:03 - 2014-04-23 07:29 - 00000000 ____D () C:\Users\dub_cm_auto
2014-06-30 17:03 - 2012-07-26 15:37 - 00000000 __RHD () C:\Users\Default
2014-06-30 17:00 - 2014-06-30 16:43 - 00000000 ____D () C:\Windows\erdnt
2014-06-30 16:59 - 2012-07-26 15:26 - 00000215 _____ () C:\Windows\system.ini
2014-06-30 16:43 - 2014-06-30 16:42 - 05212874 ____R (Swearware) C:\Users\Robyn\Downloads\ComboFix.exe
2014-06-30 16:15 - 2014-06-30 16:15 - 00000000 ____D () C:\Windows\SysWOW64\N360_BACKUP
2014-06-30 16:07 - 2014-06-30 15:21 - 00000000 ____D () C:\Program Files (x86)\DriverUpdate
2014-06-30 16:01 - 2014-05-02 13:27 - 00008192 ___SH () C:\Users\Robyn\Downloads\Thumbs.db
2014-06-30 15:56 - 2014-06-30 15:56 - 00007602 _____ () C:\Users\Robyn\AppData\Local\Resmon.ResmonCfg
2014-06-30 15:21 - 2014-06-30 15:21 - 00016152 _____ () C:\Windows\system32\Drivers\SWDUMon.sys
2014-06-30 15:21 - 2014-06-30 15:21 - 00000000 ____D () C:\Users\Robyn\AppData\Local\SlimWare Utilities Inc
2014-06-30 15:21 - 2014-06-30 15:21 - 00000000 ____D () C:\Users\Public\Documents\Downloaded Installers
2014-06-30 15:18 - 2014-06-30 15:18 - 00858552 _____ (SlimWare Utilities, Inc.) C:\Users\Robyn\Downloads\DriverUpdate-setup.exe
2014-06-30 15:15 - 2014-06-30 15:15 - 02083328 _____ (Farbar) C:\Users\Robyn\Downloads\FRST64.exe
2014-06-30 15:13 - 2014-06-30 15:13 - 01073664 _____ (Farbar) C:\Users\Robyn\Downloads\FRST.exe
2014-06-28 14:54 - 2014-01-09 12:45 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-06-28 14:54 - 2014-01-09 12:45 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-28 00:15 - 2014-06-27 14:29 - 00000000 ____D () C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32
2014-06-27 22:46 - 2013-12-19 22:02 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2700925841-1584683910-2212061445-1002
2014-06-27 22:26 - 2014-06-27 22:26 - 00000000 ____D () C:\Users\Robyn\Documents\Symantec
2014-06-27 22:13 - 2013-12-22 10:06 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\newnext.me
2014-06-27 21:58 - 2013-09-04 14:06 - 00000000 ____D () C:\ProgramData\Temp
2014-06-27 21:56 - 2014-06-22 12:37 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-06-27 21:52 - 2013-09-04 14:07 - 00000000 ____D () C:\Program Files (x86)\CyberLink
2014-06-27 21:52 - 2013-07-21 07:50 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-06-27 21:50 - 2013-09-04 14:09 - 00000000 ____D () C:\ProgramData\CyberLink
2014-06-27 21:45 - 2014-06-22 09:52 - 00000000 ____D () C:\Program Files (x86)\BearShare Applications
2014-06-26 15:07 - 2014-01-11 13:20 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\vlc
2014-06-22 12:53 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\rescache
2014-06-22 11:47 - 2012-07-26 17:21 - 00046620 _____ () C:\Windows\setupact.log
2014-06-22 11:32 - 2014-05-02 12:04 - 00438120 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\Documents\My Received Files
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\MusicNet
2014-06-22 09:51 - 2014-06-22 09:51 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\Music Toolbar
2014-06-21 16:27 - 2013-07-21 07:35 - 00000000 ____D () C:\Program Files (x86)\Hewlett-Packard
2014-06-21 16:27 - 2012-08-04 10:02 - 00000000 ____D () C:\SWSetup
2014-06-21 12:42 - 2013-12-19 22:08 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-06-21 12:16 - 2013-12-22 15:23 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-06-18 17:28 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-06-18 14:05 - 2014-03-19 09:34 - 00024576 ___SH () C:\Users\Robyn\Documents\Thumbs.db
2014-06-14 10:06 - 2014-06-16 12:29 - 00000030 _____ () C:\AVScanner.ini
2014-06-14 10:06 - 2013-12-22 15:07 - 00003718 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-06-13 22:08 - 2014-06-13 22:08 - 00000000 ____D () C:\Users\Robyn\Documents\OneNote Notebooks
2014-06-13 20:09 - 2014-02-03 15:49 - 00000000 ____D () C:\Users\Robyn\Documents\TAFE
2014-06-13 05:05 - 2014-06-13 05:05 - 00046376 _____ (NetFilterSDK.com) C:\Windows\system32\Drivers\netfilter64.sys
2014-06-13 00:08 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\WinStore
2014-06-13 00:08 - 2012-07-26 17:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-06-12 23:45 - 2014-06-12 23:45 - 00000000 ____D () C:\Users\Default\AppData\Local\Microsoft Help
2014-06-12 23:45 - 2014-06-12 23:45 - 00000000 ____D () C:\Users\Default User\AppData\Local\Microsoft Help
2014-06-12 23:44 - 2014-06-12 23:21 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works
2014-06-12 23:21 - 2013-07-21 07:39 - 00000000 ____D () C:\Program Files (x86)\Microsoft Office
2014-06-12 23:20 - 2012-07-26 18:12 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-06-12 23:17 - 2014-06-12 23:17 - 00000000 ____D () C:\Users\Robyn\AppData\Local\Microsoft Help
2014-06-12 23:17 - 2014-06-12 23:17 - 00000000 ____D () C:\Program Files\Microsoft Office
2014-06-12 23:17 - 2012-07-26 17:52 - 00000000 ____D () C:\Windows\ShellNew
2014-06-12 23:00 - 2012-07-26 18:12 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-06-12 22:15 - 2013-12-19 21:50 - 00000000 ____D () C:\Users\Robyn\AppData\Local\Packages
2014-06-11 10:57 - 2014-01-23 21:22 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-11 10:52 - 2014-01-23 21:22 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-07 22:49 - 2013-12-19 21:56 - 00000000 ____D () C:\Users\Robyn\AppData\Local\CyberLink
2014-06-07 22:49 - 2013-09-04 14:16 - 00000000 ____D () C:\Users\Public\CyberLink
2014-06-07 22:47 - 2013-12-30 23:14 - 00000000 ____D () C:\Users\Robyn\Documents\CyberLink

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-06-29 20:11

==================== End Of Log ============================



#7 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 05:44 AM

This is the Fixlog.txt result;

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 01-07-2014
Ran by Robyn at 2014-07-03 20:41:27 Run:1
Running from C:\Users\Robyn\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
start
() C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe
HKU\S-1-5-21-2700925841-1584683910-2212061445-1002\...\Run: [NextLive] => C:\Windows\SysWOW64\rundll32.exe "C:\Users\Robyn\AppData\Roaming\newnext.me\nengine.dll",EntryPoint -m l
C:\Users\Robyn\AppData\Roaming\newnext.me
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?searchsource=10&cui=un20189207061796831&um=2&ctid=ct3298588
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - DefaultScope {C6615190-FAF5-44C4-85D8-661B78E555AB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298588&CUI=UN20189207061796831&UM=2
SearchScopes: HKCU - {C6615190-FAF5-44C4-85D8-661B78E555AB} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3298588&CUI=UN20189207061796831&UM=2
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - {DC0AD46A-E369-4C22-AD6C-70F669604BC6} URL = http://search.findwide.com/serp?guid={F28E1487-F82C-4207-8488-28C0346E94CC}&action=default_search&serpv=22&k={searchTerms}
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKCU - No Name - {41B78170-3CD6-4072-B68D-F3DBDA8D1FCD} -  No File
FF DefaultSearchEngine: Ask.com
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Ask.com
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\Ask.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\conduit-search.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\conduit.xml
FF SearchPlugin: C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\findwide.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml
FF Extension: MixiDJ V52  - C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\Extensions\{24a0cfe1-f479-4b19-b627-a96bf1ea3a56} [2013-12-22]
FF Extension: DealPly  Shopping - C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f} [2013-12-22]
CHR Extension: (DealPly  Shopping) - C:\Users\Robyn\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf [2013-12-22]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
R2 SupraSavingsService64; C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe [172544 2014-06-26] () [File not signed]
R2 vxlsnyaiet64; C:\Program Files\003\vxlsnyaiet64.exe [706560 2014-04-25] () [File not signed]
C:\Program Files\003
S2 Update albrechto; "C:\Program Files (x86)\albrechto\updatealbrechto.exe" [X]
C:\Program Files (x86)\albrechto
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
2014-06-30 17:17 - 2014-06-30 17:17 - 00000310 _____ () C:\Windows\Tasks\bench-Updater removing.job
2014-06-27 14:29 - 2014-07-03 15:33 - 00000000 ____D () C:\Program Files\SupraSavings
2014-06-27 14:29 - 2014-06-28 00:15 - 00000000 ____D () C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\Documents\My Received Files
2014-06-22 09:53 - 2014-06-22 09:53 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\MusicNet
2014-06-22 09:52 - 2014-06-27 21:45 - 00000000 ____D () C:\Program Files (x86)\BearShare Applications
2014-06-22 09:51 - 2014-06-22 09:51 - 00000000 ____D () C:\Users\Robyn\AppData\Roaming\Music Toolbar
2014-06-16 12:29 - 2014-06-14 10:06 - 00000030 _____ () C:\AVScanner.ini
Google Update Helper (x32 Version: 1.3.23.0 - DealPly Technologies Ltd) Hidden <==== ATTENTION
Task: {77DF84FE-988F-41C2-AB7A-E46894A2CF88} - System32\Tasks\bench-sys => C:\Program Files (x86)\Bench\Updater\updater.exe [2013-12-19] () <==== ATTENTION
Task: C:\Windows\Tasks\bench-sys.job => C:\Program Files (x86)\Bench\Updater\updater.exe <==== ATTENTION
Task: C:\Windows\Tasks\bench-Updater removing.job => ? <==== ATTENTION
C:\Program Files (x86)\Bench
AlternateDataStreams: C:\ProgramData\Temp:10894A2E
AlternateDataStreams: C:\ProgramData\Temp:373E1720
HKLM\...\StartupApproved\Run32: => "mobilegeni daemon"
HKCU\...\StartupApproved\Run: => "NextLive"
HKCU\...\StartupApproved\Run: => "OutfoxTV"
end
*****************

[2328] C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32\SupraSavingsService64.exe => Process closed successfully.
HKU\S-1-5-21-2700925841-1584683910-2212061445-1002\Software\Microsoft\Windows\CurrentVersion\Run\\NextLive => value deleted successfully.
C:\Users\Robyn\AppData\Roaming\newnext.me => Moved successfully.
HKCU\Software\Microsoft\Internet Explorer\Main\\Start Page => Value was restored successfully.
'HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}' => Key deleted successfully.
'HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}'=> Key not found.
'HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}' => Key deleted successfully.
'HKCR\Wow6432Node\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}'=> Key not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => value deleted successfully.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{C6615190-FAF5-44C4-85D8-661B78E555AB}' => Key deleted successfully.
'HKCR\CLSID\{C6615190-FAF5-44C4-85D8-661B78E555AB}'=> Key not found.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}' => Key deleted successfully.
'HKCR\CLSID\{D944BB61-2E34-4DBF-A683-47E505C587DC}'=> Key not found.
'HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{DC0AD46A-E369-4C22-AD6C-70F669604BC6}' => Key deleted successfully.
'HKCR\CLSID\{DC0AD46A-E369-4C22-AD6C-70F669604BC6}'=> Key not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113} => value deleted successfully.
'HKCR\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}' => Key deleted successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113} => value deleted successfully.
'HKCR\Wow6432Node\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}' => Key deleted successfully.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{41B78170-3CD6-4072-B68D-F3DBDA8D1FCD} => value deleted successfully.
'HKCR\CLSID\{41B78170-3CD6-4072-B68D-F3DBDA8D1FCD}'=> Key not found.
Firefox DefaultSearchEngine deleted successfully.
Firefox SearchEngineOrder.1 deleted successfully.
Firefox SelectedSearchEngine deleted successfully.
C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\Ask.xml => Moved successfully.
C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\conduit-search.xml => Moved successfully.
C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\conduit.xml => Moved successfully.
C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\searchplugins\findwide.xml => Moved successfully.
C:\Program Files (x86)\mozilla firefox\browser\searchplugins\Ask.xml => Moved successfully.
C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\Extensions\{24a0cfe1-f479-4b19-b627-a96bf1ea3a56} => Moved successfully.
C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\Extensions\{906000a4-88d9-4d52-b209-7a772970d91f} => Moved successfully.
C:\Users\Robyn\AppData\Local\Google\Chrome\User Data\Default\Extensions\mphpbdjcljebbcnfopfngmfdackbbdgf => Moved successfully.
'HKLM\SOFTWARE\Policies\Google' => Key deleted successfully.
SupraSavingsService64 => Service deleted successfully.
vxlsnyaiet64 => Unable to stop service
vxlsnyaiet64 => Service deleted successfully.
C:\Program Files\003 => Moved successfully.
Update albrechto => Service deleted successfully.
"C:\Program Files (x86)\albrechto" => File/Directory not found.
catchme => Service deleted successfully.
C:\Windows\Tasks\bench-Updater removing.job => Moved successfully.
C:\Program Files\SupraSavings => Moved successfully.
C:\Program Files (x86)\A1E42196-7B72-4448-8D92-3F513155CC32 => Moved successfully.
C:\Users\Robyn\Documents\My Received Files => Moved successfully.
C:\Users\Robyn\AppData\Roaming\MusicNet => Moved successfully.
C:\Program Files (x86)\BearShare Applications => Moved successfully.
C:\Users\Robyn\AppData\Roaming\Music Toolbar => Moved successfully.
C:\AVScanner.ini => Moved successfully.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}\\SystemComponent => value deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{77DF84FE-988F-41C2-AB7A-E46894A2CF88}' => Key deleted successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{77DF84FE-988F-41C2-AB7A-E46894A2CF88}' => Key deleted successfully.
C:\Windows\System32\Tasks\bench-sys => Moved successfully.
'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\bench-sys' => Key deleted successfully.
C:\Windows\Tasks\bench-sys.job => Moved successfully.
C:\Windows\Tasks\bench-Updater removing.job not found.
C:\Program Files (x86)\Bench => Moved successfully.
C:\ProgramData\Temp => ":10894A2E" ADS removed successfully.
C:\ProgramData\Temp => ":373E1720" ADS removed successfully.


The system needed a reboot.

==== End of Fixlog ====



#8 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 05:48 AM

Georgi - I was having a lot of trouble even just replying to you.  For example, I could access the post, see your comments as well as mine.  I could post in the reply topic section <HERE>  ...but....when i click on 'post' it often would not post the comment.  I would have to click post.  Then More reply options.  Then go through and click 'add comments'  just to reply to you.  Interestingly now, since I have done what you have said, I just clicked the 'reply' button and it worked!  So thats good, makes it a little bit easier :) I will go and uninstall what you told me too and will get back to you once this is all done.  Thanks you :)



#9 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:07 PM

Posted 03 July 2014 - 06:00 AM

Hello,

 

 

Nice to hear that. :)

 

 

STEP 1

 

 

Please download AdwCleaner by Xplode and save to your Desktop.

  • Double click on AdwCleaner.exe to run the tool.
    Vista/Windows 7/8 users right-click and select Run As Administrator.
  • Click on the Scan button.
  • AdwCleaner will begin to scan your computer.
  • After the scan has finished click on the Clean button.
  • Press OK when asked to close all programs and follow the onscreen prompts.
  • Press OK again to allow AdwCleaner to restart the computer and complete the removal process.
  • After rebooting, a logfile report (AdwCleaner[S0].txt) will open automatically.
  • Copy and paste the contents of that logfile in your next reply.
  • A copy of that logfile will also be saved in the C:\AdwCleaner folder.

 

 

STEP 2

 

 

thisisujrt.gif  Please download Junkware Removal Tool to your desktop.

  • Shut down your protection software now to avoid potential conflicts.
  • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
  • The tool will open and start scanning your system.
  • Please be patient as this can take a while to complete depending on your system's specifications.
  • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
  • Post the contents of JRT.txt into your next message.

 

STEP 3

 

 

Please download Malwarebytes Anti-Malware to your desktop.
 

  • Double-click mbam-setup-2.0.2.1012.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
  • Click Finish.
  • On the Settings tab > Detection and Protection subtab, Detection Options, tick the box 'Scan for rootkits'.
  • Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • With some infections, you may see this message box.
    • 'Could not load DDA driver'
  • Click 'Yes' to this message, to allow the driver to load after a restart.
  • Allow the computer to restart. Continue with the rest of these instructions.
  • When the scan is complete, click Apply Actions.
  • Wait for the prompt to restart the computer to appear, then click on Yes.
  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.

 

Regards,

Georgi


Edited by B-boy/StyLe/, 03 July 2014 - 06:01 AM.

cXfZ4wS.png


#10 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 06:06 AM

All done Georgi;

 

Uninstalled Google Update Helper

Have installed Google Chrome

 

What happens next? :)



#11 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 06:07 AM

Ahhhhhhh right!  Im onto step 1 now! LOL :) :)



#12 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 06:16 AM

Hey;  here is the adware cleaning log details;

 

# AdwCleaner v3.214 - Report created 03/07/2014 at 21:11:09
# Updated 29/06/2014 by Xplode
# Operating System : Windows 8  (64 bits)
# Username : Robyn - HPACHOS
# Running from : C:\Users\Robyn\Downloads\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\ProgramData\Conduit
Folder Deleted : C:\ProgramData\DealPlyLive
Folder Deleted : C:\Program Files (x86)\Cling Clang
Folder Deleted : C:\Program Files (x86)\Conduit
Folder Deleted : C:\Program Files (x86)\DealPlyLive
Folder Deleted : C:\Program Files (x86)\Mobogenie
Folder Deleted : C:\Program Files (x86)\MyPC Backup
Folder Deleted : C:\Program Files (x86)\Optimizer Pro
Folder Deleted : C:\Program Files (x86)\predm
Folder Deleted : C:\Users\Robyn\AppData\Local\Conduit
Folder Deleted : C:\Users\Robyn\AppData\Local\DealPlyLive
Folder Deleted : C:\Users\Robyn\AppData\Local\genienext
Folder Deleted : C:\Users\Robyn\AppData\Local\Mobogenie
Folder Deleted : C:\Users\Robyn\AppData\LocalLow\Conduit
Folder Deleted : C:\Users\Robyn\AppData\LocalLow\PriceGong
Folder Deleted : C:\Users\Robyn\AppData\Roaming\DealPly
Folder Deleted : C:\Users\Robyn\AppData\Roaming\Systweak
Folder Deleted : C:\Users\Robyn\Documents\Mobogenie
File Deleted : C:\END
File Deleted : C:\Windows\System32\roboot64.exe
File Deleted : C:\Users\Robyn\daemonprocess.txt
File Deleted : C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\invalidprefs.js
File Deleted : C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\user.js

***** [ Shortcuts ] *****

Shortcut Disinfected : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Start Now Technology.lnk

***** [ Registry ] *****

Key Deleted : HKCU\Software\Microsoft\Internet Explorer\DOMStorage\conduit.com
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com
Key Deleted : HKLM\SOFTWARE\Classes\AppID\dealplylive.exe
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickCtrl.9
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLive.OneClickProcessLauncherMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLive.Update3WebControl.3
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoCreateAsync.1.0
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.coreclass
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreClass.1
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.CoreMachineClass.1
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.credentialdialogmachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachine
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassMachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclassmachinefallback.1.0
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.OnDemandCOMClassSvc
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.ondemandcomclasssvc.1.0
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.ProcessLauncher.1.0
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService
Key Deleted : HKLM\SOFTWARE\Classes\DealPlyLiveUpdate.Update3COMClassService.1.0
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachine.1.0
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3webmachinefallback.1.0
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc
Key Deleted : HKLM\SOFTWARE\Classes\dealplyliveupdate.update3websvc.1.0
Key Deleted : HKLM\SOFTWARE\Classes\speedupmypc
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AdvancedSystemProtector_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\QuickShare_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatealbrechto_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\updatealbrechto_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=3
Key Deleted : HKLM\SOFTWARE\MozillaPlugins\@tools.dpliveupdate.com/DealPlyLive Update;version=9
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3298588
Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3321118
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Key Deleted : HKLM\SOFTWARE\Classes\AppID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{0D89DE71-3D99-4288-84DC-F18F1047A7D8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1E0C9B2A-6447-452C-B012-2314A0C29412}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{34A8CEB6-89BB-49F1-B5E4-0D0D6C21F3B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3A4DBD3A-98CC-41CE-AD21-352D42B6F754}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{4F8A50F6-69DE-4BE3-A33A-A1079B9AC0DB}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{501CB57A-D4E2-4855-96AD-EDB0A9083395}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6FF2C4DD-77A4-4BB5-BA4C-B42DEFBF9137}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80FABB17-63AF-4655-9F07-B6509EE37AF2}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{83ABA270-8390-4CA6-AE48-FC089F55629E}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8B218A5F-1A3D-4347-94EF-A79575EB8094}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{9BDB5E09-4BBA-4422-8C2B-529B281C32B8}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{C536F080-57B7-46D6-8894-C647553F2889}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA5D945F-E738-4D0B-A0B5-25AC51C64659}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F48FC5B2-094A-44C7-B48C-289738C9582D}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{F7698761-4ABA-45C2-A5BB-D2163922C725}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{FFCC53E6-2655-47FC-A89B-54E8D7F305D1}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9863E762-BACC-46E4-8CAA-2A6ADA06B65B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C4C4F1F4-3074-4CB6-9FB8-0A64273166F0}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{DCABB943-792E-44C4-9029-ECBEE6265AF9}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DEDAF650-12B8-48F5-A843-BBA100716106}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE48ED75-5A56-4C5F-BBCE-6F1AC3875F66}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7C3B01BC-53A5-48A0-A43B-0C67731134B9}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0ABE0FED-50E7-4E42-A125-57C0A11DBCDE}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7F1796B2-BEC6-427B-B734-F9C75ED94A80}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C338DDB-19FC-4C1F-B74D-6931EE55F7A1}
Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C536F080-57B7-46D6-8894-C647553F2889}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{E5A7A645-8318-4895-B85C-EDC606B80DB6}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{3408AC0D-510E-4808-8F7B-6B70B1F88534}
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\DealPlyLive
Key Deleted : HKCU\Software\TutoTag
Key Deleted : HKCU\Software\AppDataLow\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKCU\Software\AppDataLow\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Deleted : HKCU\Software\AppDataLow\Software\PriceGong
Key Deleted : HKCU\Software\AppDataLow\Software\Rr Savings
Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar
Key Deleted : HKCU\Software\AppDataLow\Software\Supra Savings
Key Deleted : HKLM\Software\{1146AC44-2F03-4431-B4FD-889BC837521F}
Key Deleted : HKLM\Software\{3A7D3E19-1B79-4E4E-BD96-5467DA2C4EF0}
Key Deleted : HKLM\Software\{6791A2F3-FC80-475C-A002-C014AF797E9C}
Key Deleted : HKLM\Software\Bench
Key Deleted : HKLM\Software\Conduit
Key Deleted : HKLM\Software\DataMngr
Key Deleted : HKLM\Software\DealPlyLive
Key Deleted : HKLM\Software\FreeSoftToday
Key Deleted : HKLM\Software\Lightspark Team
Key Deleted : HKLM\Software\suprasavings
Key Deleted : HKLM\Software\systweak
Key Deleted : HKLM\Software\Tutorials
Key Deleted : HKLM\Software\Uniblue
Key Deleted : [x64] HKLM\SOFTWARE\DomaIQ
Key Deleted : [x64] HKLM\SOFTWARE\LevelQualityWatcher
Key Deleted : [x64] HKLM\SOFTWARE\Supra Savings
Key Deleted : [x64] HKLM\SOFTWARE\suprasavings
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SearchProtect

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16921


-\\ Mozilla Firefox v30.0 (en-US)

[ File : C:\Users\Robyn\AppData\Roaming\Mozilla\Firefox\Profiles\kob9m8ts.default\prefs.js ]

Line Deleted : user_pref("CT3298588.FF19Solved", "true");
Line Deleted : user_pref("CT3298588.UserID", "UN72910011511910144");
Line Deleted : user_pref("CT3298588.browser.search.defaultthis.engineName", "true");
Line Deleted : user_pref("CT3298588.fullUserID", "UN72910011511910144.IN.20131222111830");
Line Deleted : user_pref("CT3298588.installDate", "22/12/2013 11:18:36");
Line Deleted : user_pref("CT3298588.installSessionId", "{7825388A-4237-4D1E-BFAA-3D898F370B26}");
Line Deleted : user_pref("CT3298588.installSp", "TRUE");
Line Deleted : user_pref("CT3298588.installerVersion", "1.8.1.4");
Line Deleted : user_pref("CT3298588.keyword", "true");
Line Deleted : user_pref("CT3298588.originalHomepage", "about:home");
Line Deleted : user_pref("CT3298588.originalSearchAddressUrl", "");
Line Deleted : user_pref("CT3298588.originalSearchEngine", "");
Line Deleted : user_pref("CT3298588.originalSearchEngineName", "");
Line Deleted : user_pref("CT3298588.searchRevert", "false");
Line Deleted : user_pref("CT3298588.searchUninstallUserMode", "2");
Line Deleted : user_pref("CT3298588.searchUserMode", "2");
Line Deleted : user_pref("CT3298588.smartbar.homepage", "true");
Line Deleted : user_pref("CT3298588.toolbarInstallDate", "22-12-2013 11:18:30");
Line Deleted : user_pref("CT3298588.versionFromInstaller", "10.23.0.722");
Line Deleted : user_pref("CT3298588.xpeMode", "0");
Line Deleted : user_pref("Smartbar.SearchFromAddressBarSavedUrl", "");
Line Deleted : user_pref("browser.search.defaultenginename", "FindWide");
Line Deleted : user_pref("browser.search.defaultthis.engineName", "MixiDJ V52 Customized Web Search");
Line Deleted : user_pref("browser.search.defaulturl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT3298588&CUI=UN72910011511910144&UM=2&SearchSource=3&q={searchTerms}");
Line Deleted : user_pref("plugin.state.npconduitfirefoxplugin", 0);

-\\ Google Chrome v35.0.1916.153

[ File : C:\Users\Robyn\AppData\Local\Google\Chrome\User Data\Default\preferences ]


*************************

AdwCleaner[R0].txt - [13052 octets] - [03/07/2014 21:09:38]
AdwCleaner[S0].txt - [12791 octets] - [03/07/2014 21:11:09]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [12852 octets] ##########
 



#13 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 06:38 AM

Junkware Removal Tool log results are;

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by Robyn on Thu 03/07/2014 at 21:22:48.48
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files
 



#14 B-boy/StyLe/

B-boy/StyLe/

    Bleepin' Freestyler


  • Malware Response Team
  • 8,307 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Bulgaria
  • Local time:12:07 PM

Posted 03 July 2014 - 07:06 AM

Hi,

 

The log is cut off. Can you please post the full log from JRT please? :)

 

 

Regards,

Georgi


cXfZ4wS.png


#15 walige

walige
  • Topic Starter

  • Members
  • 30 posts
  • OFFLINE
  •  
  • Local time:09:07 AM

Posted 03 July 2014 - 07:12 AM

Hey Georgi;

 

Here are the results for Malwarebytes (step 3) as requested :)

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 3/07/2014
Scan Time: 9:41:11 PM
Logfile: malwarebytesscanlog.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.07.03.02
Rootkit Database: v2014.07.01.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Robyn

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 300780
Time Elapsed: 19 min, 13 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 4
PUP.Optional.SupraSavings.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Supra Savings, Quarantined, [94c36e2c85f633035ac41cab1fe339c7],
PUP.Optional.SuperFish.A, HKU\S-1-5-21-2700925841-1584683910-2212061445-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\DOMSTORAGE\superfish.com, Quarantined, [570025753c3f231317f62b876a98c53b],
PUP.Optional.TidyNetwork.A, HKLM\SOFTWARE\CLASSES\CLSID\{0FEB2313-F89B-4AC6-8153-84025604A06A}, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, HKLM\SOFTWARE\CLASSES\INTERFACE\{0FEB2313-F89B-4AC6-8153-84025604A06A}, Quarantined, [b3a4afeb1368ae88c3926831f210be42],

Registry Values: 1
PUP.Optional.FindWide, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\ABOUTURLS|Tabs, http://search.findwide.com/?guid={F28E1487-F82C-4207-8488-28C0346E94CC}&serpv=22, Quarantined, [0f481e7c0f6c1d19f49a1ae341c248b8]

Registry Data: 0
(No malicious items detected)

Folders: 10
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Common, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\2.0.0.1702, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\Profiles, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\Profiles\10805, Quarantined, [b3a4afeb1368ae88c3926831f210be42],

Files: 61
PUP.Optional.AdPeak.A, C:\temp\InstallFilter64.msi, Quarantined, [f067dac0aecd072ff5939ba2b9478a76],
PUP.Optional.SupraSavings.A, C:\temp\t.msi, Quarantined, [381f6139d3a8c373d27eaecb63a1e020],
PUP.Optional.OptimumInstaller.A, C:\Users\Robyn\Downloads\Player-Firefox.exe, Quarantined, [67f06a30c8b35fd73482c58eab561ae6],
PUP.Optional.Conduit.A, C:\Users\Robyn\Downloads\InstallConverter_brff(1).exe, Quarantined, [ba9de2b81566f442ed8c5cf45ca51be5],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\passport.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\TNT2UserPS.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\log.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\MinecraftShims64.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\npTNT2.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\npTNT2Ghost.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\PARTNER.TNT, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\passport64.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\pinnedSearch.htm, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\pinnedSearch_FindWide.htm, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\progress.1.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\regsvr.1.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\RemoteSkin.wms, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\sqlite.1.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\tnt2chrome.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\TNT2User.exe, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\TNT2UserPS64.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\TntMagicDel.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\UnInjLib.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\UnInjLib64.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\UNINSTALL.TNT, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\UninstallDlg.1.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\untar.1.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\UPDATE.TNT, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\xpi.tar, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\2.0.0.1702\zipunzip.1.dll, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Common\GameConsole.exe, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Common\pinnedSearch.htm, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\icon.ico, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\inst.ini, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\LastSession.log, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\os10805.xml, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\PARTNER.1.TNT, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\PARTNER.2.TNT, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\PARTNER.3.TNT, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\partner.dat, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\runt.ini, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\tnt_32x32.png, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\toolbar10805@findwide.com.xpi, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\yah10805.xml, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\174800aa848d25a8046ebe0627075e40, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\2acb3d320e6d06a1f53e26c88680578d, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\33d24483a26d2821cdf1424a88101c64, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\3b4af445da352763e9d749e3903a2a74, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\53347a1539592b7d0a13dee56d899d9d, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\6548291f8a8708c759468d383b69c32d, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\69eabf03002c2f08dc31f764265e0e84, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\9272262bbd60e7676a5afab5416ef7cb, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\ac7829f5a96db79589f0014e26c21af1, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\bbdc194061ce660e5e4224f5179609b8, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Users\Robyn\AppData\Local\TNT2\Profiles\10805\Cache\e00c254ae55a4ba7b4eebbe03f39152c, Quarantined, [35228e0c1a61ce682f250e8b0200d32d],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\TNT2UserPS.dll, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\TNT2UserPS64.dll, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\2.0.0.1702\IEToolbar.dll, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\2.0.0.1702\IEToolbar64.dll, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\Profiles\10805\passport.dll, Quarantined, [b3a4afeb1368ae88c3926831f210be42],
PUP.Optional.TidyNetwork.A, C:\Program Files (x86)\TNT2\Profiles\10805\passport64.dll, Quarantined, [b3a4afeb1368ae88c3926831f210be42],

Physical Sectors: 0
(No malicious items detected)


(end)






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users