Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

au_.exe, Mindspark.A, my.idlecrawler and who knows what else?


  • This topic is locked This topic is locked
24 replies to this topic

#1 snorky62

snorky62

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:16 PM

Posted 19 September 2014 - 03:32 AM

Hi again,

 

I am having problems once again, and hope you may be able to help once again?

 

My kids downloaded uTorrent today and now I have recurrent problems with au_.exe, Mindspark.A, idlecrawler.com and maybe SONAR.Heuristoc.120. I downloaded Malwarebytes and it found and removed 804 problems. The Norton product that I have installed as part of the new computer didn't seem to pick them up.

 

I have installed DDS, but I get the message "DDS is not meant to run in 'Çompatability Mode'. The program shall now exit." And that is where I am stuck.

 

Can you please help me?

 

Many thanks in advance.

 

Snorky



BC AdBot (Login to Remove)

 


m

#2 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:16 AM

Posted 19 September 2014 - 04:49 AM

Hi there,
my name is Marius and I will assist you with your malware related problems.

Before we move on, please read the following points carefully.

  • First, read my instructions completely. If there is anything that you do not understand kindly ask before proceeding.
  • Perform everything in the correct order. Sometimes one step requires the previous one.
  • If you have any problems while following my instructions, Stop there and tell me the exact nature of your problem.
  • Do not run any other scans without instruction or add/remove software unless I tell you to do so. This would change the output of our tools and could be confusing for me.
  • Post all logfiles as a reply rather than as an attachment unless I specifically ask you. If you can not post all logfiles in one reply, feel free to use more posts.
  • If I don't hear from you within 3 days from this initial or any subsequent post, then this thread will be closed.
  • Stay with me. I will give you some advice about prevention after the cleanup process. Absence of symptoms does not always mean the computer is clean.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.

  • Important: To help me reviewing your logs, please post them in code boxes. You can create them by clicking on the <>-symbol on top of the reply window.

 
 
 
 
HijackThis is not the preferred initial scanning tool in this forum. With today's malware, a more comprehensive set of logs is required to determine the presence of malware.
 
 
 
 
Scan with FRST in normal mode

Please download Farbar's Recovery Scan Tool to your desktop: FRST 32bit or FRST 64bit (If not sure: Start --> Computer (right click) --> properties)
 
  • Run FRST.
  • Don´t change one of the checkboxes and hit Scan.
  • Logfiles are created on your desktop.
  • Poste the FRST.txt and (after the first scan only!) the Addition.txt.

 
 
 
 
 Scan with aswMBR

Please download aswMBR ( 4.5MB ) to your desktop.
  • Double click the aswMBR.exe icon, and click Run.
  • There will be a short delay before the next dialog box comes up. Please just wait a minute or two.
  • When asked if you'd like to "download the latest Avast! virus definitions", click Yes.
  • Typically this is about a 100MB download so depending on your connection speed it can take a short while to download and become ready.
  • Click the Scan button to start the scan once the update has finished downloading
  • On completion of the scan, click the save log button, save it to your desktop, then copy and paste it in your next reply.

Note: There will also be a file on your desktop named MBR.dat do not delete this for now. It is an actual backup of the MBR (master boot record).


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#3 snorky62

snorky62
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:16 PM

Posted 19 September 2014 - 05:05 AM

Hi Marius and thanks for your help. At the moment Norton is stopping me from installing FRST. Not sure how to stop this, I'm quite basic with computers. 



#4 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:16 AM

Posted 19 September 2014 - 05:21 AM

Please right click on the NIS icon in the taskbar and select Disable Smart Firewall for a period of time that you wish and also disable Norton Antivirus Auto Protect from that menu too.

Proceed with the scans, when done.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#5 snorky62

snorky62
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:16 PM

Posted 19 September 2014 - 05:43 AM

Thanks Marius, I had to download the 64 bit version. I also have istartsurf as a problem.

 

Here are the logs-

 

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by karrin at 2014-09-19 20:26:02
Running from C:\Users\karrin\AppData\Local\Microsoft\Windows\INetCache\IE\DUG05270
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 Premier Edition (Disabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

#Idle-#.#-Crawler# (HKLM-x32\...\#Idle-#.#-Crawler#) (Version: 89.0.0.436 - SADDLEBACK PROC LTD) <==== ATTENTION
µTorrent (HKCU\...\uTorrent) (Version: 3.4.2.34024 - BitTorrent Inc.)
4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Reader XI (11.0.09) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
AMD APP SDK Runtime (Version: 10.0.1124.2 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{A6F679A1-A5F5-F698-1301-AFF4F2310053}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD VISION Engine Control Center (x32 Version: 2013.0207.105.1806 - Advanced Micro Devices, Inc.) Hidden
Ancestral Quest 14 (HKLM-x32\...\InstallShield_{F1B47EAC-235B-4732-9901-CB6C2BD7BCE5}) (Version: 14.00.0020 - Incline Software, LC)
Ancestral Quest 14 (x32 Version: 14.00.0020 - Incline Software, LC) Hidden
Ancestral Quest Collaboration Support (HKLM-x32\...\InstallShield_{4E2CCBC7-6BBF-4907-9A33-C3BB77366863}) (Version: 1.10.0010 - Incline Software)
Ancestral Quest Collaboration Support (x32 Version: 1.10.0010 - Incline Software) Hidden
Apple Application Support (HKLM-x32\...\{21ECABC3-40B2-42DF-8E21-ACF3A4D0D95A}) (Version: 3.0.5 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{6AF2AC2A-3532-43FD-9F4D-BDC9C0D724C7}) (Version: 7.1.2.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden
BCL easyConverter SDK 3 (Word Version) 64 (HKLM\...\{350CC85B-CA59-4F85-909D-8E4CDBF532FA}) (Version: 3.0.64 - BCL Technologies)
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0207.105.1806 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0207.105.1806 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0207.105.1806 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0207.0104.1806 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0207.0104.1806 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0207.0104.1806 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0207.0104.1806 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0207.0104.1806 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0207.0104.1806 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0207.0104.1806 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0207.0104.1806 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0207.105.1806 - Advanced Micro Devices, Inc.) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
CyberLink LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4.6522 - CyberLink Corp.)
CyberLink LabelPrint (x32 Version: 2.5.4.6522 - CyberLink Corp.) Hidden
CyberLink Media Suite 10 (HKLM-x32\...\InstallShield_{1FBF6C24-C1fD-4101-A42B-0C564F9E8E79}) (Version: 10.0.4.3003 - CyberLink Corp.)
CyberLink Media Suite 10 (x32 Version: 10.0.4.3003 - CyberLink Corp.) Hidden
Cyberlink PhotoDirector (HKLM-x32\...\InstallShield_{39337565-330E-4ab6-A9AE-AC81E0720B10}) (Version: 3.0.2.4016 - CyberLink Corp.)
Cyberlink PhotoDirector (x32 Version: 3.0.2.4016 - CyberLink Corp.) Hidden
CyberLink Power2Go 8 (HKLM-x32\...\InstallShield_{2A87D48D-3FDF-41fd-97CD-A1E370EFFFE2}) (Version: 8.0.4.2921 - CyberLink Corp.)
CyberLink Power2Go 8 (x32 Version: 8.0.4.2921 - CyberLink Corp.) Hidden
CyberLink PowerDirector 10 (HKLM-x32\...\InstallShield_{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}) (Version: 10.0.4.3007 - CyberLink Corp.)
CyberLink PowerDirector 10 (x32 Version: 10.0.4.3007 - CyberLink Corp.) Hidden
CyberLink PowerDVD 12 (HKLM-x32\...\InstallShield_{B46BEA36-0B71-4A4E-AE41-87241643FA0A}) (Version: 12.0.1.3007 - CyberLink Corp.)
CyberLink PowerDVD 12 (x32 Version: 12.0.1.3007 - CyberLink Corp.) Hidden
CyberLink YouCam (HKLM-x32\...\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.6.6119 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.6.6119 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
EndNote X7 (HKLM-x32\...\{86B3F2D6-AC2B-0017-8AE1-F2F77F781B0C}) (Version: 17.1.0.7705 - Thomson Reuters)
Energy Star (HKLM-x32\...\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
e-tax 2014 (HKLM-x32\...\{42D5C0B2-A309-4F84-9BD7-5DDDFE6C09E1}) (Version: 2.8.758 - Australian Taxation Office)
Family Tree Maker 2011 (HKLM-x32\...\Family Tree Maker 2011) (Version: 20.0.368 - Ancestry.com)
Family Tree Maker 2011 (x32 Version: 20.0.368 - Ancestry.com) Hidden
Family Tree Maker 2014 (HKLM-x32\...\Family Tree Maker 2014) (Version: 22.0.207 - Ancestry.com, Inc.)
Family Tree Maker 2014 (Version: 22.0.207 - Ancestry.com, Inc.) Hidden
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 37.0.2062.120 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.24.15 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
HL-2130 (HKLM-x32\...\{E2A97415-BD97-4867-B906-05E39E9EE51F}) (Version: 1.0.7.0 - Brother Industries, Ltd.)
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Officejet 6500 E710n-z Basic Device Software (HKLM\...\{D79A5962-7305-41B9-A39E-A98AB598F372}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Officejet 6500 E710n-z Help (HKLM-x32\...\{130E5108-547F-4482-91EE-F45C784E08C7}) (Version: 140.0.2.2 - Hewlett Packard)
HP Officejet 6500 E710n-z Product Improvement Study (HKLM\...\{4207BD5E-6F51-4C57-BC86-A0EBE9088A30}) (Version: 28.0.1315.0 - Hewlett-Packard Co.)
HP Postscript Converter (Version: 4.0.4100 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\...\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6668.4491 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 12.00.0000 - Hewlett-Packard)
HP Update (HKLM-x32\...\{6F1C00D2-25C2-4CBA-8126-AE9A6E2E9CD5}) (Version: 5.003.003.001 - Hewlett-Packard)
HPDiagnosticCoreDll (HKLM-x32\...\{9262B08F-E183-4FED-A2BD-23FF1A84EB79}) (Version: 1.0.15.0 - Hewlett Packard)
I.R.I.S. OCR (HKLM-x32\...\{CA6BCA2F-EDEB-408F-850B-31404BE16A61}) (Version: 12.3.4.0 - HP)
iTunes (HKLM\...\{33E28B58-7BA0-47B7-AA01-9225ABA2B8A9}) (Version: 11.3.0.54 - Apple Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Mahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft App Update for microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe (x64) (Version: 1.0.0.0 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office (HKLM-x32\...\{90150000-0138-0409-0000-0000000FF1CE}) (Version: 15.0.4454.1510 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version:  - Microsoft) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft OneDrive (HKCU\...\OneDriveSetup.exe) (Version: 17.3.1165.0612 - Microsoft Corporation)
Microsoft Primary Interoperability Assemblies 2005 (HKLM-x32\...\{D24DB8B9-BB6C-4334-9619-BA1C650E13D3}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.51106 (HKLM-x32\...\{6e8f74e0-43bd-4dce-8477-6ff6828acc07}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM-x32\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (x32 Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft WSE 3.0 Runtime (HKLM-x32\...\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}) (Version: 3.0.5305.0 - Microsoft Corp.)
Movie Maker (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Norton 360 (HKLM-x32\...\N360) (Version: 21.5.0.19 - Symantec Corporation)
PDF-XChange 3 (HKLM\...\PDF-XChange 3_is1) (Version:  - Tracker Software)
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Photo Gallery (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Qualcomm Atheros Driver Installation Program (HKLM-x32\...\{C3A32068-8AB1-4327-BB16-BED9C6219DC7}) (Version: 10.0 - Qualcomm Atheros)
Realtek Card Reader (HKLM-x32\...\{5BC2B5AB-80DE-4E83-B8CF-426902051D0A}) (Version: 6.2.9200.29068 - Realtek Semiconductor Corp.)
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.20.815.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7084 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.6208 - CyberLink Corp.) Hidden
ResearchSoft Direct Export Helper (HKLM-x32\...\ResearchSoft Direct Export Helper) (Version:  - Thomson Reuters)
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Royal Envoy 2 Collector's Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Skype™ 6.3 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.105 - Skype Technologies S.A.)
The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden
Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version:  - Microsoft)
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3528.0331 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 16.4.3528.0331 - Microsoft Corporation) Hidden
Windows Media Encoder 9 Series (HKLM-x32\...\Windows Media Encoder 9) (Version:  - )
Windows Media Encoder 9 Series (x32 Version: 9.00.2980 - Microsoft Corporation) Hidden
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-2327439692-3351121902-880068427-1001_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\karrin\AppData\Local\Microsoft\SkyDrive\17.3.1165.0612\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

01-09-2014 04:29:19 Windows Update
09-09-2014 09:59:17 Scheduled Checkpoint
14-09-2014 22:42:52 Windows Update
19-09-2014 02:44:04 Installed Java 7 Update 67

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2013-08-22 23:25 - 2013-08-22 23:25 - 00000824 ____A C:\WINDOWS\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {01A35CB8-813F-4E98-AE6A-9C3E1AF6EA1D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-08-04] (Hewlett-Packard)
Task: {05293577-D647-4185-B859-C94839A0B2E3} - System32\Tasks\Microsoft\Windows\SettingSync\NetworkStateChangeTask
Task: {0AE36085-EBB2-4D38-8F3B-E02E7E72CBED} - System32\Tasks\Microsoft OneDrive Auto Update Task-S-1-5-21-2327439692-3351121902-880068427-1001 => %localappdata%\Microsoft\SkyDrive\SkyDrive.exe
Task: {0B545118-B563-42FC-8D07-B78F602FCF34} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {2085BF56-520D-4951-B7C0-DF34AF90CC6A} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {25FEAB6B-DD3A-43C2-9FF8-8B3DE87ABE69} - System32\Tasks\CLMLSvc_P2G8 => c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe [2013-03-13] (CyberLink)
Task: {2C9C0C6C-2A74-46F2-858A-4389D253EAD0} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCachePrepopulate
Task: {2D6C3633-D81F-475E-A9CB-42504A904C17} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\SymErr.exe [2014-01-31] (Symantec Corporation)
Task: {352E6CA0-7314-4DF4-89C4-682368D80D57} - System32\Tasks\Microsoft\Windows\Workplace Join\Automatic-Workplace-Join => C:\Windows\System32\AutoWorkplace.exe [2013-08-22] (Microsoft Corporation)
Task: {3B6D8A73-F20B-4C93-B8FB-56A154F172D2} - System32\Tasks\Microsoft\Windows\Time Zone\SynchronizeTimeZone => C:\Windows\system32\tzsync.exe [2013-08-22] (Microsoft Corporation)
Task: {407239AD-8964-494F-A518-741E1468B997} - System32\Tasks\PRUPKOB => C:\Users\karrin\AppData\Roaming\PRUPKOB.exe
Task: {429BA998-DAAB-4943-BF8A-C5D47570B1AF} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {49754026-21E1-41FC-94FD-727AFE414FE7} - System32\Tasks\Microsoft\Windows\Sysmain\HybridDriveCacheRebalance
Task: {4C565AF5-9ED0-4AA2-B7A7-303AE12D952D} - System32\Tasks\CLVDLauncher => c:\Program Files (x86)\CyberLink\Power2Go8\CLVDLauncher.exe [2013-03-13] (CyberLink Corp.)
Task: {547667AC-700D-4AB3-83D6-A03DF63F8841} - System32\Tasks\MsgUpdateCheck (ed5bac9b-5ca0-4f99-aa46-a881a08ff6f3) => C:\SmartDraw CI\MarkedUp\tray\TrayNotifierNET35.exe [2014-05-01] (MarkedUp Inc)
Task: {55489D70-87D3-41AE-BF9E-88232B71A1F3} - System32\Tasks\HPCustParticipation HP Officejet 6500 E710n-z => C:\Program Files\HP\HP Officejet 6500 E710n-z\Bin\HPCustPartic.exe [2012-10-17] (Hewlett-Packard Co.)
Task: {6A476032-410E-46E2-827F-F3D91742A344} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-10] (Google Inc.)
Task: {6AA91E8C-DDBD-4979-8464-4062F7681A19} - System32\Tasks\Microsoft\Windows\Plug and Play\Plug and Play Cleanup
Task: {6AEC74A2-5AF2-44F4-8CFE-D67CD95F01C7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-06-10] (Google Inc.)
Task: {6DFCB649-0769-4F83-BB10-F60F235F6D3D} - System32\Tasks\Microsoft\Windows\SkyDrive\Idle Sync Maintenance Task
Task: {73B1B253-CE67-4501-AE1A-377DD1D68B65} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: {77F1D869-6E65-4079-A2A0-E2023408EF97} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {7CBB52AC-0F01-484A-9A0B-F4954D240725} - System32\Tasks\SDMsgUpdate (TE) => C:\SmartDraw CI\Messages\SDNotify.exe [2012-08-14] ()
Task: {7CF12B60-F5FD-4945-96DF-8A09966DAC6A} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
Task: {872D0E53-FD2E-41E3-B431-698AF82882CE} - System32\Tasks\Microsoft\Windows\SkyDrive\Routine Maintenance Task
Task: {8CC813C9-712A-41EF-9512-B233444FC669} - System32\Tasks\Microsoft\Windows\AppxDeploymentClient\Pre-staged app cleanup => Rundll32.exe %windir%\system32\AppxDeploymentClient.dll,AppxPreStageCleanupRunTask
Task: {9486FB07-93AD-4ED9-976E-AD5D2FA8619A} - System32\Tasks\HPCeeScheduleForkarrin => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {9FF4C139-5234-410C-B7FA-23EE2FD2AB53} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Maintenance Work
Task: {A08610DF-E72C-419D-A4FA-03AE0E694D20} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\WSCStub.exe [2014-08-01] (Symantec Corporation)
Task: {A54B189C-B12C-49AA-B671-91FBB6653416} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {A65B3686-10E3-45F3-B072-B9E7371F9F4A} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {A9327D53-C54F-4DB8-B5BB-97E26F0DD783} - System32\Tasks\HUO => C:\Users\karrin\AppData\Roaming\HUO.exe
Task: {ADEE5A01-005B-4C07-A805-D62007673648} - System32\Tasks\Microsoft\Windows\Maintenance\IC Updater => %LOCALAPPDATA%\#Idle-#.#-Crawler#\IcRunner.exe
Task: {B52243F8-0AD1-4F8E-8D07-B7A46A199BD7} - System32\Tasks\Microsoft\Windows\WindowsUpdate\Scheduled Start With Network => Sc.exe start wuauserv
Task: {B80CFB8C-9407-4959-87CF-4CE6B365D82C} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\SymErr.exe [2014-01-31] (Symantec Corporation)
Task: {BF58E14B-1069-43E0-80DD-BB525A2FD9CD} - System32\Tasks\Microsoft\Windows\DiskFootprint\Diagnostics
Task: {CC515B4D-8893-4E10-8151-B28836115FB4} - System32\Tasks\SDMsgUpdate (Local) => C:\SmartDraw CI\Messages\SDNotify.exe [2012-08-14] ()
Task: {CFD7C21A-808B-487B-A6EC-8A10E44E8360} - System32\Tasks\Microsoft\Windows\SettingSync\BackupTask
Task: {D08F1AB1-8F5E-4779-937E-7A750E734C77} - System32\Tasks\Microsoft\Windows\DiskCleanup\SilentCleanup => C:\Windows\system32\cleanmgr.exe [2014-03-18] (Microsoft Corporation)
Task: {D88FEC9E-A82A-46F9-87E2-B6B97B301C1A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {DA46820F-FF8A-4B5E-A6B2-B12185DCFFFB} - System32\Tasks\Microsoft\Windows\Work Folders\Work Folders Logon Synchronization
Task: {E12FD797-6E56-4206-AA3B-571B650D1576} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {E2ACF668-4308-4463-9ECA-B3DD4467FB01} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Validation
Task: {E3BDCA69-0278-4D27-AE94-D673C4802877} - System32\Tasks\Microsoft\Windows\WOF\WIM-Hash-Management
Task: {E6D378FA-E068-4BCB-80DE-56D43A249507} - System32\Tasks\Microsoft\Windows\RecoveryEnvironment\VerifyWinRE
Task: {EBADB8AD-3737-45FF-8071-01EFDB88903B} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\WINDOWS\system32\MRT.exe [2014-09-15] (Microsoft Corporation)
Task: {F5F7FB57-3DE7-474C-8360-853CA624A3CE} - System32\Tasks\Microsoft\Windows\Shell\FamilySafetyUpload
Task: {F96DEB5F-5F79-4D0E-A5CE-C2BE6D62479B} - System32\Tasks\IC Runnner => %LOCALAPPDATA%\#Idle-#.#-Crawler#\IcRunner.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\WINDOWS\Tasks\HPCeeScheduleForkarrin.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe
Task: C:\WINDOWS\Tasks\HUO.job => C:\Users\karrin\AppData\Roaming\HUO.exe
Task: C:\WINDOWS\Tasks\PRUPKOB.job => C:\Users\karrin\AppData\Roaming\PRUPKOB.exe

==================== Loaded Modules (whitelisted) =============

2014-09-18 00:00 - 2014-09-18 00:00 - 00133216 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\IcRunner.exe
2013-01-23 08:50 - 2013-01-23 08:50 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\BrandingNet4.dll
2014-07-03 13:20 - 2014-07-03 13:20 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-07-03 13:19 - 2014-07-03 13:19 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-09-18 00:01 - 2014-09-18 00:01 - 00104032 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Modules\ManXec.dll
2014-09-18 00:01 - 2014-09-18 00:01 - 00074848 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Modules\CmdProc.dll
2014-09-18 00:02 - 2014-09-18 00:02 - 00048224 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Modules\PrfIns.dll
2014-09-18 00:02 - 2014-09-18 00:02 - 00056928 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Modules\WbSes.dll
2014-09-18 00:02 - 2014-09-18 00:02 - 00146016 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Modules\WdcMan.dll
2014-09-18 00:02 - 2014-09-18 00:02 - 00121952 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Modules\WblSupp.dll
2014-09-18 00:01 - 2014-09-18 00:01 - 00111200 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Modules\CmnUtls.dll
2014-04-11 12:40 - 2013-03-13 00:51 - 00626240 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMediaLibrary.dll
2013-03-13 15:53 - 2013-03-13 15:53 - 00015424 _____ () c:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvcPS.dll
2014-06-03 15:13 - 2009-02-27 16:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2014-09-19 15:53 - 2014-07-21 19:38 - 00393728 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Chrome-bin\ppGoogleNaClPluginChrome.dll
2014-09-19 15:53 - 2014-07-21 19:38 - 00788480 _____ () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\Chrome-bin\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\karrin\OneDrive:ms-properties

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (09/19/2014 07:05:03 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20605 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2938

Start Time: 01cfd3e813879cfe

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 0725e644-3fdc-11e4-be84-2025640f0ae1

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (09/19/2014 06:30:38 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20605 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 2864

Start Time: 01cfd3e33de0d6cc

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 3352ae67-3fd7-11e4-be84-2025640f0ae1

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (09/19/2014 06:04:00 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20605 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 231c

Start Time: 01cfd3df8aaf978a

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 82079b5a-3fd3-11e4-be84-2025640f0ae1

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (09/19/2014 05:58:47 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20605 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1030

Start Time: 01cfd3ded387fc5b

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: c71d1da8-3fd2-11e4-be84-2025640f0ae1

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (09/19/2014 05:50:30 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20605 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1ea0

Start Time: 01cfd3ddabbb46ec

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 9f41e922-3fd1-11e4-be84-2025640f0ae1

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (09/19/2014 05:35:26 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program LiveComm.exe version 17.5.9600.20605 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 1aa4

Start Time: 01cfd3db90a74d64

Termination Time: 4294967295

Application Path: C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe\LiveComm.exe

Report Id: 844373be-3fcf-11e4-be84-2025640f0ae1

Faulting package full name: microsoft.windowscommunicationsapps_17.5.9600.20605_x64__8wekyb3d8bbwe

Faulting package-relative application ID: ppleae38af2e007f4358a809ac99a64a67c1

Error: (09/19/2014 05:14:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: mbam.exe, version: 1.0.0.532, time stamp: 0x53518532
Faulting module name: mbamcore.dll, version: 1.0.11.0, time stamp: 0x536d8027
Exception code: 0xc0000005
Fault offset: 0x00007e37
Faulting process id: 0x1d0c
Faulting application start time: 0xmbam.exe0
Faulting application path: mbam.exe1
Faulting module path: mbam.exe2
Report Id: mbam.exe3
Faulting package full name: mbam.exe4
Faulting package-relative application ID: mbam.exe5

Error: (09/19/2014 04:31:33 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program IEXPLORE.EXE version 11.0.9600.17278 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 47c

Start Time: 01cfd3d33d410c89

Termination Time: 54

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id: 969d169c-3fc6-11e4-be83-2025640f0ae1

Faulting package full name:

Faulting package-relative application ID:

Error: (09/19/2014 04:30:49 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program IEXPLORE.EXE version 11.0.9600.17278 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 10bc

Start Time: 01cfd3d32f54366c

Termination Time: 67

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id: 7c151454-3fc6-11e4-be83-2025640f0ae1

Faulting package full name:

Faulting package-relative application ID:

Error: (09/19/2014 04:30:20 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: The program IEXPLORE.EXE version 11.0.9600.17278 stopped interacting with Windows and was closed. To see if more information about the problem is available, check the problem history in the Action Center control panel.

Process ID: 36c

Start Time: 01cfd3d31a4b7590

Termination Time: 48

Application Path: C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE

Report Id: 6a644a88-3fc6-11e4-be83-2025640f0ae1

Faulting package full name:

Faulting package-relative application ID:

System errors:
=============
Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Error: (09/19/2014 07:20:06 PM) (Source: DCOM) (EventID: 10010) (User: FAMILY)
Description: {4AA0A5C4-1B9B-4F2E-99D7-99C6AEC83474}

Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: AMD A6-5400K APU with Radeon™ HD Graphics
Percentage of memory in use: 21%
Total physical RAM: 7368.02 MB
Available physical RAM: 5769.8 MB
Total Pagefile: 8712.02 MB
Available Pagefile: 6639.22 MB
Total Virtual: 131072 MB
Available Virtual: 131071.8 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:1843.45 GB) (Free:1794.57 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (Recovery Image) (Fixed) (Total:17.65 GB) (Free:2.2 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: A79B8642)

Partition: GPT Partition Type.

==================== End Of Log ============================

 

 

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by karrin (administrator) on FAMILY on 19-09-2014 20:25:06
Running from C:\Users\karrin\AppData\Local\Microsoft\Windows\INetCache\IE\DUG05270
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\n360.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\n360.exe
() C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\IcRunner.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7205592 2014-07-07] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-02-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-08-19] (Hewlett-Packard)
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2014-06-10] (Google Inc.)
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [18643560 2013-03-01] (Skype Technologies S.A.)
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [TornTv Downloader] => C:\Users\karrin\AppData\Roaming\TornTV.com\Torntv Downloader.exe /c=startup
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [uTorrent] => "C:\Users\karrin\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\MountPoints2: {91330484-fdbe-11e3-be7b-2025640f0ae1} - "G:\StartClickFreeBackup.exe"
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\MountPoints2: {913305c8-fdbe-11e3-be7b-2025640f0ae1} - "G:\WD SmartWare.exe" autoplay=true
Startup: C:\Users\karrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet 6500 E710n-z.lnk
ShortcutTarget: Monitor Ink Alerts - HP Officejet 6500 E710n-z.lnk -> C:\Program Files\HP\HP Officejet 6500 E710n-z\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.au/webhp?sourceid=navclient&ie=UTF-8&gws_rd=ssl
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411095631&from=ild&uid=ST2000DM001-1CH164_W1E7P24B&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411095631&from=ild&uid=ST2000DM001-1CH164_W1E7P24B&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=360&chn=retail&geo=AU&ver=21&locale=en_AU&gct=kwd&qsrc=2869
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-06-01]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-09-19]

Chrome:
=======
CHR Profile: C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-19]
CHR Extension: (Google Docs) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-23]
CHR Extension: (Google Drive) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-23]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-05]
CHR Extension: (YouTube) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-23]
CHR Extension: (Google Search) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-23]
CHR Extension: (Google Sheets) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-19]
CHR Extension: (Norton Identity Safe) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-15]
CHR Extension: (Norton Security Toolbar) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-07-23]
CHR Extension: (Google Wallet) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-23]
CHR Extension: (Gmail) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-23]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\Exts\Chrome.crx [2014-08-11]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 becldr3Service; C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [263168 2013-07-03] () [File not signed]
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 CLHNServiceForPowerDVD12; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [89864 2013-06-10] (CyberLink Corp.)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-06-10] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [294664 2013-06-10] (CyberLink)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-06-21] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\N360.exe [265040 2014-08-01] (Symantec Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-06-21] (Microsoft Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2014-07-07] (Realtek Semiconductor)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-06-21] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-06-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-06-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1505000.013\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-16] (CyberLink)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-09] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140918.003\IDSvia64.sys [633560 2014-08-30] (Symantec Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140918.016\ENG64.SYS [129752 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140918.016\EX64.SYS [2137304 2014-08-21] (Symantec Corporation)
R2 ntk_PowerDVD12; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [84168 2013-03-12] (Cyberlink Corp.)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290008 2014-06-23] (Realtek Semiconductor Corp.)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1505000.013\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1505000.013\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1505000.013\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1505000.013\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1505000.013\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-06-01] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1505000.013\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1505000.013\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-06-21] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-19 20:25 - 2014-09-19 20:25 - 00000000 ____D () C:\FRST
2014-09-19 19:19 - 2014-09-19 19:19 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwex.sys
2014-09-19 18:04 - 2014-09-19 18:05 - 01737546 _____ () C:\Users\karrin\Downloads\Unconfirmed 785114.crdownload
2014-09-19 17:50 - 2014-09-19 17:50 - 00688992 _____ (Swearware) C:\Users\karrin\Desktop\dds.com
2014-09-19 16:55 - 2014-09-19 19:29 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-09-19 16:55 - 2014-09-19 16:55 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-19 16:55 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-09-19 16:55 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-09-19 16:55 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-09-19 16:53 - 2014-09-19 16:54 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\karrin\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-19 16:00 - 2014-09-19 16:02 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 897004.crdownload
2014-09-19 15:59 - 2014-09-19 16:00 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 631860.crdownload
2014-09-19 15:59 - 2014-09-19 15:59 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 852372.crdownload
2014-09-19 15:51 - 2014-09-19 20:22 - 00000000 ____D () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#
2014-09-19 15:51 - 2014-09-19 15:51 - 00004580 _____ () C:\WINDOWS\System32\Tasks\IC Runnner
2014-09-19 13:06 - 2014-09-19 15:51 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\VOPackage
2014-09-19 13:00 - 2014-09-19 13:00 - 01943376 _____ (BitTorrent Inc.) C:\Users\karrin\Downloads\uTorrent (1).exe
2014-09-19 12:59 - 2014-09-19 19:11 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\uTorrent
2014-09-19 12:59 - 2014-09-19 16:05 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-09-19 12:59 - 2014-09-19 12:59 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-09-19 12:58 - 2014-09-19 19:29 - 00001350 _____ () C:\WINDOWS\Tasks\HUO.job
2014-09-19 12:58 - 2014-09-19 13:01 - 00004356 _____ () C:\WINDOWS\System32\Tasks\HUO
2014-09-19 12:58 - 2014-09-19 12:58 - 01943376 _____ (BitTorrent Inc.) C:\Users\karrin\Downloads\uTorrent.exe
2014-09-19 12:57 - 2014-09-19 19:29 - 00001702 _____ () C:\WINDOWS\Tasks\PRUPKOB.job
2014-09-19 12:57 - 2014-09-19 19:19 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-09-19 12:57 - 2014-09-19 13:00 - 00004706 _____ () C:\WINDOWS\System32\Tasks\PRUPKOB
2014-09-19 12:57 - 2014-09-19 12:57 - 00000000 ____D () C:\Users\karrin\AppData\Local\globalUpdate
2014-09-19 12:45 - 2014-09-19 12:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-09-19 12:44 - 2014-09-19 12:44 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\ProgramData\Sun
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\Program Files (x86)\Java
2014-09-19 12:41 - 2014-09-19 12:41 - 00918440 _____ (Oracle Corporation) C:\Users\karrin\Downloads\chromeinstall-7u67.exe
2014-09-15 12:39 - 2014-09-03 06:06 - 00706016 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-09-15 12:39 - 2014-09-03 06:06 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-15 08:41 - 2014-08-23 17:48 - 02374784 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2014-09-15 08:41 - 2014-08-23 17:13 - 02084520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2014-09-15 08:41 - 2014-08-23 16:10 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2014-09-15 08:41 - 2014-08-23 15:32 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2014-09-15 08:41 - 2014-08-23 14:44 - 02860032 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-09-15 08:41 - 2014-08-23 14:34 - 13423104 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-09-15 08:41 - 2014-08-23 14:33 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-09-15 08:41 - 2014-08-23 14:31 - 01038336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-09-15 08:41 - 2014-08-23 14:20 - 11818496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-09-15 08:41 - 2014-07-30 11:56 - 00299520 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSDMon.dll
2014-09-15 08:41 - 2014-07-29 15:22 - 00205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcpmon.dll
2014-09-15 08:41 - 2014-07-25 01:20 - 21266336 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-09-15 08:41 - 2014-07-24 19:44 - 16874496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-09-15 08:41 - 2014-07-24 17:39 - 02642944 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-09-15 08:41 - 2014-07-24 17:30 - 02318336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-09-15 08:40 - 2014-07-25 01:28 - 00468288 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-09-15 08:40 - 2014-07-25 01:28 - 00419648 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2014-09-15 08:40 - 2014-07-25 01:28 - 00412992 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2014-09-15 08:40 - 2014-07-25 01:28 - 00280384 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2014-09-15 08:40 - 2014-07-25 01:28 - 00143680 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbccgp.sys
2014-09-15 08:40 - 2014-07-25 01:25 - 00054752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-09-15 08:40 - 2014-07-25 01:23 - 01519488 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2014-09-15 08:40 - 2014-07-25 01:23 - 00125472 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll
2014-09-15 08:40 - 2014-07-25 01:20 - 00645592 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2014-09-15 08:40 - 2014-07-25 01:20 - 00263400 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2014-09-15 08:40 - 2014-07-25 01:16 - 02574208 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL
2014-09-15 08:40 - 2014-07-25 01:16 - 00211216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVol.exe
2014-09-15 08:40 - 2014-07-25 01:07 - 07424320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2014-09-15 08:40 - 2014-07-25 01:07 - 02009920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2014-09-15 08:40 - 2014-07-25 01:05 - 01660048 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2014-09-15 08:40 - 2014-07-25 01:05 - 01519560 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2014-09-15 08:40 - 2014-07-25 01:05 - 01488008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2014-09-15 08:40 - 2014-07-25 01:05 - 01356840 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2014-09-15 08:40 - 2014-07-25 01:03 - 02141920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00882136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00818624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00233888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00205512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mftranscode.dll
2014-09-15 08:40 - 2014-07-25 00:57 - 02515264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-09-15 08:40 - 2014-07-25 00:57 - 00475968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2014-09-15 08:40 - 2014-07-24 23:50 - 00098048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll
2014-09-15 08:40 - 2014-07-24 23:48 - 02410976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVDECOD.DLL
2014-09-15 08:40 - 2014-07-24 23:48 - 00180208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SndVol.exe
2014-09-15 08:40 - 2014-07-24 23:46 - 18760328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-09-15 08:40 - 2014-07-24 23:46 - 00477200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 02145472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 00707536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 00674512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 00355800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 00180720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mftranscode.dll
2014-09-15 08:40 - 2014-07-24 21:51 - 00008192 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRUM.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDYAK.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDTT102.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDTAT.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU1.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDBASH.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU.DLL
2014-09-15 08:40 - 2014-07-24 21:47 - 00132608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2014-09-15 08:40 - 2014-07-24 21:46 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
2014-09-15 08:40 - 2014-07-24 21:45 - 00076800 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hdaudbus.sys
2014-09-15 08:40 - 2014-07-24 21:44 - 00674816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2014-09-15 08:40 - 2014-07-24 21:43 - 00412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2014-09-15 08:40 - 2014-07-24 21:42 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2014-09-15 08:40 - 2014-07-24 21:42 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\NdisImPlatform.sys
2014-09-15 08:40 - 2014-07-24 21:41 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys
2014-09-15 08:40 - 2014-07-24 21:33 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-09-15 08:40 - 2014-07-24 21:33 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2014-09-15 08:40 - 2014-07-24 21:22 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2014-09-15 08:40 - 2014-07-24 21:06 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\iasnap.dll
2014-09-15 08:40 - 2014-07-24 21:05 - 00287232 _____ (Microsoft Corporation) C:\WINDOWS\system32\usbmon.dll
2014-09-15 08:40 - 2014-07-24 21:05 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2014-09-15 08:40 - 2014-07-24 20:52 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDYAK.DLL
2014-09-15 08:40 - 2014-07-24 20:52 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDTT102.DLL
2014-09-15 08:40 - 2014-07-24 20:52 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDTAT.DLL
2014-09-15 08:40 - 2014-07-24 20:51 - 00008192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRUM.DLL
2014-09-15 08:40 - 2014-07-24 20:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU1.DLL
2014-09-15 08:40 - 2014-07-24 20:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDBASH.DLL
2014-09-15 08:40 - 2014-07-24 20:51 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU.DLL
2014-09-15 08:40 - 2014-07-24 20:49 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersGPExt.dll
2014-09-15 08:40 - 2014-07-24 20:33 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2014-09-15 08:40 - 2014-07-24 20:32 - 00207360 _____ (Microsoft Corporation) C:\WINDOWS\system32\powercfg.cpl
2014-09-15 08:40 - 2014-07-24 20:20 - 02050560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2014-09-15 08:40 - 2014-07-24 20:18 - 01089024 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpedit.dll
2014-09-15 08:40 - 2014-07-24 20:12 - 00878592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2014-09-15 08:40 - 2014-07-24 20:10 - 01844224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2014-09-15 08:40 - 2014-07-24 20:10 - 00834560 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2014-09-15 08:40 - 2014-07-24 20:10 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2014-09-15 08:40 - 2014-07-24 20:10 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iasnap.dll
2014-09-15 08:40 - 2014-07-24 20:09 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2014-09-15 08:40 - 2014-07-24 20:06 - 00438272 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2014-09-15 08:40 - 2014-07-24 20:05 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersShell.dll
2014-09-15 08:40 - 2014-07-24 19:53 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2014-09-15 08:40 - 2014-07-24 19:52 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2014-09-15 08:40 - 2014-07-24 19:42 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\powercfg.cpl
2014-09-15 08:40 - 2014-07-24 19:40 - 00557056 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs.dll
2014-09-15 08:40 - 2014-07-24 19:39 - 00770048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2014-09-15 08:40 - 2014-07-24 19:33 - 01741824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2014-09-15 08:40 - 2014-07-24 19:32 - 01048064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpedit.dll
2014-09-15 08:40 - 2014-07-24 19:27 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2014-09-15 08:40 - 2014-07-24 19:27 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\osk.exe
2014-09-15 08:40 - 2014-07-24 19:25 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenter.dll
2014-09-15 08:40 - 2014-07-24 19:24 - 01817088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2014-09-15 08:40 - 2014-07-24 19:23 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2014-09-15 08:40 - 2014-07-24 19:21 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser.dll
2014-09-15 08:40 - 2014-07-24 19:18 - 00018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvcpal.dll
2014-09-15 08:40 - 2014-07-24 19:16 - 12730880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-09-15 08:40 - 2014-07-24 19:14 - 00443904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2014-09-15 08:40 - 2014-07-24 19:13 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2014-09-15 08:40 - 2014-07-24 19:12 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2014-09-15 08:40 - 2014-07-24 19:11 - 00356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\conhost.exe
2014-09-15 08:40 - 2014-07-24 19:11 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshbth.dll
2014-09-15 08:40 - 2014-07-24 19:10 - 00540672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2014-09-15 08:40 - 2014-07-24 19:09 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2014-09-15 08:40 - 2014-07-24 19:04 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintDialogs.dll
2014-09-15 08:40 - 2014-07-24 19:04 - 00183808 _____ (Microsoft Corp.) C:\WINDOWS\system32\Defrag.exe
2014-09-15 08:40 - 2014-07-24 19:03 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll
2014-09-15 08:40 - 2014-07-24 19:02 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2014-09-15 08:40 - 2014-07-24 18:58 - 00105472 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2014-09-15 08:40 - 2014-07-24 18:53 - 01261056 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll
2014-09-15 08:40 - 2014-07-24 18:53 - 00449536 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2014-09-15 08:40 - 2014-07-24 18:49 - 01361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2014-09-15 08:40 - 2014-07-24 18:49 - 01287680 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2014-09-15 08:40 - 2014-07-24 18:49 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2014-09-15 08:40 - 2014-07-24 18:49 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2014-09-15 08:40 - 2014-07-24 18:48 - 00659968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2014-09-15 08:40 - 2014-07-24 18:47 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2014-09-15 08:40 - 2014-07-24 18:43 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wshbth.dll
2014-09-15 08:40 - 2014-07-24 18:39 - 02397184 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2014-09-15 08:40 - 2014-07-24 18:38 - 00371200 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2014-09-15 08:40 - 2014-07-24 18:36 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2014-09-15 08:40 - 2014-07-24 18:32 - 01532416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2014-09-15 08:40 - 2014-07-24 18:30 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2014-09-15 08:40 - 2014-07-24 18:29 - 00439296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2014-09-15 08:40 - 2014-07-24 18:28 - 00595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2014-09-15 08:40 - 2014-07-24 18:27 - 00907776 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2014-09-15 08:40 - 2014-07-24 18:24 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-15 08:40 - 2014-07-24 18:23 - 01404416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2014-09-15 08:40 - 2014-07-24 18:22 - 00487936 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2014-09-15 08:40 - 2014-07-24 18:21 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2014-09-15 08:40 - 2014-07-24 18:21 - 00302080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanmsm.dll
2014-09-15 08:40 - 2014-07-24 18:20 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
2014-09-15 08:40 - 2014-07-24 18:19 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-09-15 08:40 - 2014-07-24 18:18 - 01144320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2014-09-15 08:40 - 2014-07-24 18:18 - 00795136 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2014-09-15 08:40 - 2014-07-24 18:18 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-09-15 08:40 - 2014-07-24 18:16 - 00505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\VAN.dll
2014-09-15 08:40 - 2014-07-24 18:16 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2014-09-15 08:40 - 2014-07-24 18:15 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-09-15 08:40 - 2014-07-24 18:15 - 00721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2014-09-15 08:40 - 2014-07-24 18:15 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2014-09-15 08:40 - 2014-07-24 18:13 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVolSSO.dll
2014-09-15 08:40 - 2014-07-24 18:12 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-15 08:40 - 2014-07-24 18:10 - 01029632 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-09-15 08:40 - 2014-07-24 18:10 - 00889344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2014-09-15 08:40 - 2014-07-24 18:10 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2014-09-15 08:40 - 2014-07-24 18:10 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2014-09-15 08:40 - 2014-07-24 18:08 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2014-09-15 08:40 - 2014-07-24 18:08 - 00162816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
2014-09-15 08:40 - 2014-07-24 18:07 - 01705472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-09-15 08:40 - 2014-07-24 18:06 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-09-15 08:40 - 2014-07-24 18:05 - 00448000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VAN.dll
2014-09-15 08:40 - 2014-07-24 18:04 - 00667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-09-15 08:40 - 2014-07-24 18:02 - 03465216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-09-15 08:40 - 2014-07-24 18:01 - 05833216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-09-15 08:40 - 2014-07-24 18:01 - 01992192 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2014-09-15 08:40 - 2014-07-24 18:01 - 01126912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-09-15 08:40 - 2014-07-24 18:00 - 02100736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2014-09-15 08:40 - 2014-07-24 17:58 - 00432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2014-09-15 08:40 - 2014-07-24 17:58 - 00288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2014-09-15 08:40 - 2014-07-24 17:54 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2014-09-15 08:40 - 2014-07-24 17:50 - 01182208 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.dll
2014-09-15 08:40 - 2014-07-24 17:50 - 00923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-09-15 08:40 - 2014-07-24 17:49 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
2014-09-15 08:40 - 2014-07-24 17:47 - 00576512 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2014-09-15 08:40 - 2014-07-24 17:46 - 08652800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-09-15 08:40 - 2014-07-24 17:44 - 01057792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.dll
2014-09-15 08:40 - 2014-07-24 17:43 - 02696704 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2014-09-15 08:40 - 2014-07-24 17:43 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-09-15 08:40 - 2014-07-24 17:43 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
2014-09-15 08:40 - 2014-07-24 17:41 - 00459264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2014-09-15 08:40 - 2014-07-24 17:38 - 06649344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-09-15 08:40 - 2014-07-24 17:38 - 05777408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-09-15 08:40 - 2014-07-24 17:33 - 03360768 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2014-09-15 08:40 - 2014-07-24 17:28 - 01600000 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2014-09-15 08:40 - 2014-07-24 14:11 - 00513544 _____ () C:\WINDOWS\SysWOW64\locale.nls
2014-09-15 08:40 - 2014-07-24 14:11 - 00513544 _____ () C:\WINDOWS\system32\locale.nls
2014-09-15 08:40 - 2014-07-12 15:55 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2014-09-15 08:40 - 2014-07-12 15:23 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2014-09-15 08:40 - 2014-07-12 14:58 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2014-09-15 08:40 - 2014-07-12 14:33 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2014-09-15 08:40 - 2014-07-12 14:13 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2014-09-15 08:40 - 2014-07-10 09:19 - 00387391 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-09-15 08:40 - 2014-07-04 22:59 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys
2014-09-15 08:40 - 2014-07-04 20:29 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSip.dll
2014-09-15 08:40 - 2014-07-04 20:20 - 01656832 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2014-09-15 08:40 - 2014-07-04 20:06 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxSip.dll
2014-09-15 08:40 - 2014-07-04 20:00 - 01351168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2014-09-15 08:40 - 2014-07-04 19:30 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2014-09-15 08:40 - 2014-07-04 19:27 - 00474112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2014-09-15 08:40 - 2014-06-27 16:22 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2014-09-15 08:40 - 2014-06-26 10:32 - 01029632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2014-09-15 08:40 - 2014-06-26 10:29 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2014-09-15 08:40 - 2014-06-20 09:37 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-09-15 08:40 - 2014-06-19 12:13 - 00310080 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2014-09-15 08:40 - 2014-06-14 16:03 - 02389504 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2014-09-15 08:40 - 2014-06-14 15:46 - 02071552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2014-09-15 08:40 - 2014-06-07 22:46 - 00216368 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2014-09-15 08:40 - 2014-06-07 20:20 - 00189016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2014-09-15 08:40 - 2014-06-06 00:00 - 01118040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2014-09-15 08:40 - 2014-06-05 20:18 - 01018368 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2014-09-15 08:40 - 2014-06-05 19:42 - 00889856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2014-09-15 08:40 - 2014-05-31 15:00 - 01463808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsecedit.dll
2014-09-15 08:40 - 2014-05-31 14:18 - 01319936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsecedit.dll
2014-09-15 08:40 - 2014-05-29 16:23 - 00427008 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2014-09-15 08:40 - 2014-05-29 15:25 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2014-09-15 08:40 - 2014-05-29 15:20 - 00427520 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2014-09-15 08:40 - 2014-05-29 14:36 - 00344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2014-09-15 08:40 - 2014-05-26 17:26 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2014-09-15 08:40 - 2014-05-10 20:12 - 00387896 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2014-09-15 08:40 - 2014-05-10 18:46 - 00335680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2014-09-15 08:40 - 2014-05-06 14:41 - 00486744 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll
2014-09-15 08:40 - 2014-05-06 10:55 - 00391000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
2014-09-15 08:40 - 2014-03-25 12:27 - 00160600 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll
2014-09-15 08:40 - 2014-03-25 12:27 - 00123920 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll
2014-09-15 08:40 - 2014-03-25 11:20 - 00128568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll
2014-09-15 08:40 - 2014-03-25 11:20 - 00127544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll
2014-09-15 08:20 - 2014-08-15 10:36 - 00146752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys
2014-09-10 09:02 - 2014-08-16 12:40 - 23591424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-09-10 09:02 - 2014-08-16 12:04 - 17455104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-09-10 09:02 - 2014-08-16 12:00 - 05833728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-09-10 09:02 - 2014-08-16 12:00 - 02793984 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-09-10 09:02 - 2014-08-16 11:56 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-09-10 09:02 - 2014-08-16 11:54 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-09-10 09:02 - 2014-08-16 11:45 - 04232704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-09-10 09:02 - 2014-08-16 11:43 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-09-10 09:02 - 2014-08-16 11:32 - 00446464 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-09-10 09:02 - 2014-08-16 11:25 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll
2014-09-10 09:02 - 2014-08-16 11:22 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-09-10 09:02 - 2014-08-16 11:20 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-09-10 09:02 - 2014-08-16 11:19 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-09-10 09:02 - 2014-08-16 11:18 - 02185728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-09-10 09:02 - 2014-08-16 11:18 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-09-10 09:02 - 2014-08-16 11:11 - 00597504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-09-10 09:02 - 2014-08-16 11:06 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-09-10 09:02 - 2014-08-16 11:05 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-09-10 09:02 - 2014-08-16 11:05 - 00707072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-09-10 09:02 - 2014-08-16 11:03 - 02104832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-09-10 09:02 - 2014-08-16 11:03 - 00365056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-09-10 09:02 - 2014-08-16 10:58 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-10 09:02 - 2014-08-16 10:56 - 02310656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-09-10 09:02 - 2014-08-16 10:53 - 13588480 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-09-10 09:02 - 2014-08-16 10:53 - 00243200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-09-10 09:02 - 2014-08-16 10:53 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-09-10 09:02 - 2014-08-16 10:51 - 11769856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-09-10 09:02 - 2014-08-16 10:45 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-09-10 09:02 - 2014-08-16 10:44 - 02014208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-09-10 09:02 - 2014-08-16 10:44 - 00312320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-09-10 09:02 - 2014-08-16 10:34 - 01447424 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-09-10 09:02 - 2014-08-16 10:20 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-09-10 09:02 - 2014-08-16 10:18 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-09-10 09:02 - 2014-08-16 10:14 - 01190400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-09-10 09:02 - 2014-08-16 10:12 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-09-10 08:57 - 2014-09-05 12:36 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-09-10 08:57 - 2014-09-05 12:31 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-09-10 08:57 - 2014-09-05 10:48 - 00738816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-09-10 08:57 - 2014-08-02 10:18 - 01212928 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2014-09-10 08:56 - 2014-07-24 13:20 - 00875688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll
2014-09-10 08:56 - 2014-07-24 13:20 - 00869544 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll
2014-09-09 15:01 - 2014-09-09 15:01 - 00012816 _____ () C:\Users\karrin\Documents\Copy of FAMILY HISTORY CERTS (1).xlsx
2014-09-08 21:40 - 2014-09-08 21:40 - 00014208 _____ () C:\Users\karrin\Documents\Copy of FAMILY HISTORY CERTS1.xlsx
2014-09-06 15:11 - 2014-09-11 08:05 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00002531 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ____D () C:\ProgramData\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-01 18:18 - 2014-09-01 18:18 - 00002086 _____ () C:\Users\karrin\AppData\Roaming\HUO
2014-09-01 18:18 - 2014-09-01 18:18 - 00001248 _____ () C:\Users\karrin\AppData\Roaming\PRUPKOB
2014-08-29 08:33 - 2014-08-23 10:42 - 04148224 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-08-25 19:37 - 2014-08-31 17:09 - 00018814 _____ () C:\Users\karrin\Documents\My EndNote Library.enl
2014-08-25 19:37 - 2014-08-25 19:37 - 00000000 ____D () C:\Users\karrin\Documents\My EndNote Library.Data
2014-08-25 19:33 - 2014-08-29 09:18 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\EndNote
2014-08-25 19:32 - 2014-08-25 19:43 - 00000000 ____D () C:\Users\Public\Documents\EndNote
2014-08-25 19:32 - 2014-08-25 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EndNote
2014-08-25 19:32 - 2014-08-25 19:43 - 00000000 ____D () C:\Program Files (x86)\EndNote X7
2014-08-25 19:31 - 2014-08-25 19:43 - 00000000 ____D () C:\ProgramData\Thomson.ResearchSoft.Installers
2014-08-25 19:22 - 2014-08-25 19:28 - 81971217 _____ () C:\Users\karrin\Desktop\ENX701 Installer.zip
2014-08-20 19:28 - 2014-08-20 19:28 - 00392308 _____ () C:\Users\karrin\Downloads\TheFox-obooko-per0001.epub
2014-08-20 17:12 - 2014-08-20 17:12 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\Windows Live Writer
2014-08-20 17:12 - 2014-08-20 17:12 - 00000000 ____D () C:\Users\karrin\AppData\Local\Windows Live Writer

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-19 20:25 - 2014-09-19 20:25 - 00000000 ____D () C:\FRST
2014-09-19 20:22 - 2014-09-19 15:51 - 00000000 ____D () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#
2014-09-19 20:22 - 2014-06-20 19:09 - 00003922 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{40D24F33-9BC4-4288-9190-81C2FBEA07EE}
2014-09-19 20:02 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-09-19 19:39 - 2014-06-10 19:29 - 00000912 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-19 19:39 - 2014-05-31 15:49 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2327439692-3351121902-880068427-1001
2014-09-19 19:33 - 2014-03-18 20:03 - 00956476 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-09-19 19:30 - 2014-07-23 12:53 - 00002390 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-19 19:30 - 2014-06-10 19:29 - 00000908 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-19 19:29 - 2014-09-19 16:55 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-09-19 19:29 - 2014-09-19 12:58 - 00001350 _____ () C:\WINDOWS\Tasks\HUO.job
2014-09-19 19:29 - 2014-09-19 12:57 - 00001702 _____ () C:\WINDOWS\Tasks\PRUPKOB.job
2014-09-19 19:29 - 2014-06-20 18:39 - 00000000 __RDO () C:\Users\karrin\OneDrive
2014-09-19 19:28 - 2014-06-20 17:47 - 00000000 ____D () C:\Users\karrin
2014-09-19 19:28 - 2014-03-18 19:54 - 00636760 _____ () C:\WINDOWS\PFRO.log
2014-09-19 19:28 - 2013-08-23 00:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-09-19 19:19 - 2014-09-19 19:19 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwex.sys
2014-09-19 19:19 - 2014-09-19 12:57 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-09-19 19:19 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\schemas
2014-09-19 19:11 - 2014-09-19 12:59 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\uTorrent
2014-09-19 18:05 - 2014-09-19 18:04 - 01737546 _____ () C:\Users\karrin\Downloads\Unconfirmed 785114.crdownload
2014-09-19 17:50 - 2014-09-19 17:50 - 00688992 _____ (Swearware) C:\Users\karrin\Desktop\dds.com
2014-09-19 17:14 - 2014-06-04 19:35 - 00000000 ____D () C:\Users\karrin\AppData\Local\CrashDumps
2014-09-19 17:14 - 2013-08-22 23:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-09-19 16:55 - 2014-09-19 16:55 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-19 16:54 - 2014-09-19 16:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\karrin\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-19 16:10 - 2014-07-23 12:51 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-19 16:05 - 2014-09-19 12:59 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-09-19 16:05 - 2013-08-23 00:44 - 00387024 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-09-19 16:05 - 2013-08-22 23:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-09-19 16:04 - 2013-08-23 01:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-09-19 16:02 - 2014-09-19 16:00 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 897004.crdownload
2014-09-19 16:00 - 2014-09-19 15:59 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 631860.crdownload
2014-09-19 15:59 - 2014-09-19 15:59 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 852372.crdownload
2014-09-19 15:51 - 2014-09-19 15:51 - 00004580 _____ () C:\WINDOWS\System32\Tasks\IC Runnner
2014-09-19 15:51 - 2014-09-19 13:06 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\VOPackage
2014-09-19 13:22 - 2014-06-20 18:00 - 01972686 _____ () C:\WINDOWS\WindowsUpdate.log
2014-09-19 13:03 - 2014-06-20 18:36 - 00001641 _____ () C:\Users\karrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-19 13:03 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy
2014-09-19 13:01 - 2014-09-19 12:58 - 00004356 _____ () C:\WINDOWS\System32\Tasks\HUO
2014-09-19 13:00 - 2014-09-19 13:00 - 01943376 _____ (BitTorrent Inc.) C:\Users\karrin\Downloads\uTorrent (1).exe
2014-09-19 13:00 - 2014-09-19 12:57 - 00004706 _____ () C:\WINDOWS\System32\Tasks\PRUPKOB
2014-09-19 12:59 - 2014-09-19 12:59 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-09-19 12:59 - 2013-08-23 00:46 - 00310714 _____ () C:\WINDOWS\setupact.log
2014-09-19 12:58 - 2014-09-19 12:58 - 01943376 _____ (BitTorrent Inc.) C:\Users\karrin\Downloads\uTorrent.exe
2014-09-19 12:57 - 2014-09-19 12:57 - 00000000 ____D () C:\Users\karrin\AppData\Local\globalUpdate
2014-09-19 12:47 - 2014-06-04 17:16 - 00003166 _____ () C:\WINDOWS\System32\Tasks\HPCeeScheduleForkarrin
2014-09-19 12:47 - 2014-06-04 17:16 - 00000350 _____ () C:\WINDOWS\Tasks\HPCeeScheduleForkarrin.job
2014-09-19 12:45 - 2014-09-19 12:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-09-19 12:44 - 2014-09-19 12:44 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\ProgramData\Sun
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\Program Files (x86)\Java
2014-09-19 12:41 - 2014-09-19 12:41 - 00918440 _____ (Oracle Corporation) C:\Users\karrin\Downloads\chromeinstall-7u67.exe
2014-09-19 00:54 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-09-17 06:32 - 2012-07-26 17:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-09-16 13:00 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-09-15 12:47 - 2014-06-02 13:01 - 00000052 _____ () C:\WINDOWS\SysWOW64\DOErrors.log
2014-09-15 12:47 - 2014-06-02 13:01 - 00000000 _____ () C:\WINDOWS\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-09-15 12:36 - 2014-07-10 20:34 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-09-15 12:36 - 2014-03-18 19:45 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\setup
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\InputMethod
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\system32\setup
2014-09-15 12:36 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\system32\oobe
2014-09-15 12:35 - 2014-06-01 16:33 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-09-15 12:33 - 2014-06-01 16:33 - 101694776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-09-15 12:20 - 2014-06-01 09:48 - 00000000 ____D () C:\Users\karrin\Documents\Family Tree Maker
2014-09-11 08:05 - 2014-09-06 15:11 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\Skype
2014-09-10 09:02 - 2014-06-21 11:38 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe
2014-09-10 09:02 - 2014-06-21 11:38 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe
2014-09-10 09:02 - 2014-06-21 11:38 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe
2014-09-10 09:02 - 2014-06-21 11:38 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollectorres.dll
2014-09-10 09:02 - 2014-06-21 11:33 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-09-10 09:02 - 2014-06-21 11:33 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-09-09 15:01 - 2014-09-09 15:01 - 00012816 _____ () C:\Users\karrin\Documents\Copy of FAMILY HISTORY CERTS (1).xlsx
2014-09-08 21:40 - 2014-09-08 21:40 - 00014208 _____ () C:\Users\karrin\Documents\Copy of FAMILY HISTORY CERTS1.xlsx
2014-09-06 15:11 - 2014-09-06 15:11 - 00002531 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ____D () C:\ProgramData\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-06 15:11 - 2014-04-11 12:57 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-09-05 12:36 - 2014-09-10 08:57 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-09-05 12:31 - 2014-09-10 08:57 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-09-05 10:48 - 2014-09-10 08:57 - 00738816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-09-03 16:35 - 2014-06-29 17:15 - 00000000 ____D () C:\Users\karrin\Tracing
2014-09-03 16:35 - 2014-06-29 17:10 - 00000000 ____D () C:\Users\karrin\AppData\Local\Windows Live
2014-09-03 06:06 - 2014-09-15 12:39 - 00706016 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-09-03 06:06 - 2014-09-15 12:39 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-01 18:18 - 2014-09-01 18:18 - 00002086 _____ () C:\Users\karrin\AppData\Roaming\HUO
2014-09-01 18:18 - 2014-09-01 18:18 - 00001248 _____ () C:\Users\karrin\AppData\Roaming\PRUPKOB
2014-08-31 17:09 - 2014-08-25 19:37 - 00018814 _____ () C:\Users\karrin\Documents\My EndNote Library.enl
2014-08-29 09:18 - 2014-08-25 19:33 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\EndNote
2014-08-26 19:04 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-08-25 19:43 - 2014-08-25 19:32 - 00000000 ____D () C:\Users\Public\Documents\EndNote
2014-08-25 19:43 - 2014-08-25 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EndNote
2014-08-25 19:43 - 2014-08-25 19:32 - 00000000 ____D () C:\Program Files (x86)\EndNote X7
2014-08-25 19:43 - 2014-08-25 19:31 - 00000000 ____D () C:\ProgramData\Thomson.ResearchSoft.Installers
2014-08-25 19:37 - 2014-08-25 19:37 - 00000000 ____D () C:\Users\karrin\Documents\My EndNote Library.Data
2014-08-25 19:28 - 2014-08-25 19:22 - 81971217 _____ () C:\Users\karrin\Desktop\ENX701 Installer.zip
2014-08-24 10:33 - 2014-06-17 18:20 - 00086120 _____ () C:\Users\karrin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 17:48 - 2014-09-15 08:41 - 02374784 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2014-08-23 17:13 - 2014-09-15 08:41 - 02084520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2014-08-23 16:10 - 2014-09-15 08:41 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2014-08-23 15:32 - 2014-09-15 08:41 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2014-08-23 14:44 - 2014-09-15 08:41 - 02860032 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-08-23 14:34 - 2014-09-15 08:41 - 13423104 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-08-23 14:33 - 2014-09-15 08:41 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-08-23 14:31 - 2014-09-15 08:41 - 01038336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-08-23 14:20 - 2014-09-15 08:41 - 11818496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-08-23 10:42 - 2014-08-29 08:33 - 04148224 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-08-20 19:28 - 2014-08-20 19:28 - 00392308 _____ () C:\Users\karrin\Downloads\TheFox-obooko-per0001.epub
2014-08-20 17:12 - 2014-08-20 17:12 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\Windows Live Writer
2014-08-20 17:12 - 2014-08-20 17:12 - 00000000 ____D () C:\Users\karrin\AppData\Local\Windows Live Writer

Some content of TEMP:
====================
C:\Users\karrin\AppData\Local\Temp\Extract.exe
C:\Users\karrin\AppData\Local\Temp\post2.dll
C:\Users\karrin\AppData\Local\Temp\post2.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-09-19 19:39

==================== End Of Log ============================



#6 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:16 AM

Posted 19 September 2014 - 05:52 AM

Please proceed with the aswMBR scan.

I´ll provide further steps then.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#7 snorky62

snorky62
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:16 PM

Posted 19 September 2014 - 06:11 AM

Hi Marius here is the next log:

 

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by karrin (administrator) on FAMILY on 19-09-2014 20:25:06
Running from C:\Users\karrin\AppData\Local\Microsoft\Windows\INetCache\IE\DUG05270
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Andrea Electronics Corporation) C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\n360.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\n360.exe
() C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#\IcRunner.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Google Inc.) C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7205592 2014-07-07] (Realtek Semiconductor)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-02-07] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2621440 2010-06-10] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-22] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-08-19] (Hewlett-Packard)
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [swg] => C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2014-06-10] (Google Inc.)
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [Skype] => C:\Program Files (x86)\Skype\Phone\Skype.exe [18643560 2013-03-01] (Skype Technologies S.A.)
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [TornTv Downloader] => C:\Users\karrin\AppData\Roaming\TornTV.com\Torntv Downloader.exe /c=startup
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [uTorrent] => "C:\Users\karrin\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\MountPoints2: {91330484-fdbe-11e3-be7b-2025640f0ae1} - "G:\StartClickFreeBackup.exe"
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\MountPoints2: {913305c8-fdbe-11e3-be7b-2025640f0ae1} - "G:\WD SmartWare.exe" autoplay=true
Startup: C:\Users\karrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Officejet 6500 E710n-z.lnk
ShortcutTarget: Monitor Ink Alerts - HP Officejet 6500 E710n-z.lnk -> C:\Program Files\HP\HP Officejet 6500 E710n-z\Bin\HPStatusBL.dll (Hewlett-Packard Co.)
ShellIconOverlayIdentifiers:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers-x32:  SkyDrive1 -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive2 -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32:  SkyDrive3 -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com.au/webhp?sourceid=navclient&ie=UTF-8&gws_rd=ssl
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411095631&from=ild&uid=ST2000DM001-1CH164_W1E7P24B&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = www.google.com
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411095631&from=ild&uid=ST2000DM001-1CH164_W1E7P24B&q={searchTerms}
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPDTDFJS
SearchScopes: HKCU - {AFBCB7E0-F91A-4951-9F31-58FEE57A25C4} URL = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=360&chn=retail&geo=AU&ver=21&locale=en_AU&gct=kwd&qsrc=2869
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll No File
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3528.0331 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\IPSFF [2014-06-01]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.1.0.18\coFFPlgn [2014-09-19]

Chrome:
=======
CHR Profile: C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-09-19]
CHR Extension: (Google Docs) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-07-23]
CHR Extension: (Google Drive) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-07-23]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-08-05]
CHR Extension: (YouTube) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-07-23]
CHR Extension: (Google Search) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-07-23]
CHR Extension: (Google Sheets) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-09-19]
CHR Extension: (Norton Identity Safe) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\iikflkcanblccfahdhdonehdalibjnif [2014-09-15]
CHR Extension: (Norton Security Toolbar) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk [2014-07-23]
CHR Extension: (Google Wallet) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-07-23]
CHR Extension: (Gmail) - C:\Users\karrin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-07-23]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\Exts\Chrome.crx [2014-08-11]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 becldr3Service; C:\Program Files\BCL Technologies\easyConverter SDK 3\Common\becldr.exe [263168 2013-07-03] () [File not signed]
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [245760 2010-01-25] (Brother Industries, Ltd.) [File not signed]
R2 CLHNServiceForPowerDVD12; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\CLHNServiceForPowerDVD12.exe [89864 2013-06-10] (CyberLink Corp.)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-06-10] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [294664 2013-06-10] (CyberLink)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
S3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-22] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-06-21] (Microsoft Corporation)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton 360\Engine\21.5.0.19\N360.exe [265040 2014-08-01] (Symantec Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-06-21] (Microsoft Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2014-07-07] (Realtek Semiconductor)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-22] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-22] (Microsoft Corporation)
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2014-06-21] (Microsoft Corporation)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-06-21] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-06-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 athr; C:\Windows\system32\DRIVERS\athwbx.sys [3859968 2013-08-15] (Qualcomm Atheros Communications, Inc.)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140912.003\BHDrvx64.sys [1586904 2014-09-13] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1505000.013\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-16] (CyberLink)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [487216 2014-09-09] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142640 2014-09-09] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140918.003\IDSvia64.sys [633560 2014-08-30] (Symantec Corporation)
R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-19] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\WINDOWS\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140918.016\ENG64.SYS [129752 2014-08-21] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140918.016\EX64.SYS [2137304 2014-08-21] (Symantec Corporation)
R2 ntk_PowerDVD12; c:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMP\CLHNServer\ntk_PowerDVD12_64.sys [84168 2013-03-12] (Cyberlink Corp.)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [290008 2014-06-23] (Realtek Semiconductor Corp.)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1505000.013\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1505000.013\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\N360x64\1505000.013\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1505000.013\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1505000.013\SymELAM.sys [23568 2013-09-10] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-06-01] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1505000.013\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1505000.013\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-06-21] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-19 20:25 - 2014-09-19 20:25 - 00000000 ____D () C:\FRST
2014-09-19 19:19 - 2014-09-19 19:19 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwex.sys
2014-09-19 18:04 - 2014-09-19 18:05 - 01737546 _____ () C:\Users\karrin\Downloads\Unconfirmed 785114.crdownload
2014-09-19 17:50 - 2014-09-19 17:50 - 00688992 _____ (Swearware) C:\Users\karrin\Desktop\dds.com
2014-09-19 16:55 - 2014-09-19 19:29 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-09-19 16:55 - 2014-09-19 16:55 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-19 16:55 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbamchameleon.sys
2014-09-19 16:55 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwac.sys
2014-09-19 16:55 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys
2014-09-19 16:53 - 2014-09-19 16:54 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\karrin\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-19 16:00 - 2014-09-19 16:02 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 897004.crdownload
2014-09-19 15:59 - 2014-09-19 16:00 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 631860.crdownload
2014-09-19 15:59 - 2014-09-19 15:59 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 852372.crdownload
2014-09-19 15:51 - 2014-09-19 20:22 - 00000000 ____D () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#
2014-09-19 15:51 - 2014-09-19 15:51 - 00004580 _____ () C:\WINDOWS\System32\Tasks\IC Runnner
2014-09-19 13:06 - 2014-09-19 15:51 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\VOPackage
2014-09-19 13:00 - 2014-09-19 13:00 - 01943376 _____ (BitTorrent Inc.) C:\Users\karrin\Downloads\uTorrent (1).exe
2014-09-19 12:59 - 2014-09-19 19:11 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\uTorrent
2014-09-19 12:59 - 2014-09-19 16:05 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-09-19 12:59 - 2014-09-19 12:59 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-09-19 12:58 - 2014-09-19 19:29 - 00001350 _____ () C:\WINDOWS\Tasks\HUO.job
2014-09-19 12:58 - 2014-09-19 13:01 - 00004356 _____ () C:\WINDOWS\System32\Tasks\HUO
2014-09-19 12:58 - 2014-09-19 12:58 - 01943376 _____ (BitTorrent Inc.) C:\Users\karrin\Downloads\uTorrent.exe
2014-09-19 12:57 - 2014-09-19 19:29 - 00001702 _____ () C:\WINDOWS\Tasks\PRUPKOB.job
2014-09-19 12:57 - 2014-09-19 19:19 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-09-19 12:57 - 2014-09-19 13:00 - 00004706 _____ () C:\WINDOWS\System32\Tasks\PRUPKOB
2014-09-19 12:57 - 2014-09-19 12:57 - 00000000 ____D () C:\Users\karrin\AppData\Local\globalUpdate
2014-09-19 12:45 - 2014-09-19 12:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-09-19 12:44 - 2014-09-19 12:44 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\ProgramData\Sun
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\Program Files (x86)\Java
2014-09-19 12:41 - 2014-09-19 12:41 - 00918440 _____ (Oracle Corporation) C:\Users\karrin\Downloads\chromeinstall-7u67.exe
2014-09-15 12:39 - 2014-09-03 06:06 - 00706016 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-09-15 12:39 - 2014-09-03 06:06 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-15 08:41 - 2014-08-23 17:48 - 02374784 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2014-09-15 08:41 - 2014-08-23 17:13 - 02084520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2014-09-15 08:41 - 2014-08-23 16:10 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2014-09-15 08:41 - 2014-08-23 15:32 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2014-09-15 08:41 - 2014-08-23 14:44 - 02860032 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-09-15 08:41 - 2014-08-23 14:34 - 13423104 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-09-15 08:41 - 2014-08-23 14:33 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-09-15 08:41 - 2014-08-23 14:31 - 01038336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-09-15 08:41 - 2014-08-23 14:20 - 11818496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-09-15 08:41 - 2014-07-30 11:56 - 00299520 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSDMon.dll
2014-09-15 08:41 - 2014-07-29 15:22 - 00205824 _____ (Microsoft Corporation) C:\WINDOWS\system32\tcpmon.dll
2014-09-15 08:41 - 2014-07-25 01:20 - 21266336 _____ (Microsoft Corporation) C:\WINDOWS\system32\shell32.dll
2014-09-15 08:41 - 2014-07-24 19:44 - 16874496 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Xaml.dll
2014-09-15 08:41 - 2014-07-24 17:39 - 02642944 _____ (Microsoft Corporation) C:\WINDOWS\system32\authui.dll
2014-09-15 08:41 - 2014-07-24 17:30 - 02318336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\authui.dll
2014-09-15 08:40 - 2014-07-25 01:28 - 00468288 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\USBHUB3.SYS
2014-09-15 08:40 - 2014-07-25 01:28 - 00419648 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbhub.sys
2014-09-15 08:40 - 2014-07-25 01:28 - 00412992 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\spaceport.sys
2014-09-15 08:40 - 2014-07-25 01:28 - 00280384 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\pci.sys
2014-09-15 08:40 - 2014-07-25 01:28 - 00143680 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\usbccgp.sys
2014-09-15 08:40 - 2014-07-25 01:25 - 00054752 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuauclt.exe
2014-09-15 08:40 - 2014-07-25 01:23 - 01519488 _____ (Microsoft Corporation) C:\WINDOWS\system32\user32.dll
2014-09-15 08:40 - 2014-07-25 01:23 - 00125472 _____ (Microsoft Corporation) C:\WINDOWS\system32\dwmapi.dll
2014-09-15 08:40 - 2014-07-25 01:20 - 00645592 _____ (Microsoft Corporation) C:\WINDOWS\system32\SHCore.dll
2014-09-15 08:40 - 2014-07-25 01:20 - 00263400 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlows.exe
2014-09-15 08:40 - 2014-07-25 01:16 - 02574208 _____ (Microsoft Corporation) C:\WINDOWS\system32\WMVDECOD.DLL
2014-09-15 08:40 - 2014-07-25 01:16 - 00211216 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVol.exe
2014-09-15 08:40 - 2014-07-25 01:07 - 07424320 _____ (Microsoft Corporation) C:\WINDOWS\system32\ntoskrnl.exe
2014-09-15 08:40 - 2014-07-25 01:07 - 02009920 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ntfs.sys
2014-09-15 08:40 - 2014-07-25 01:05 - 01660048 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.efi
2014-09-15 08:40 - 2014-07-25 01:05 - 01519560 _____ (Microsoft Corporation) C:\WINDOWS\system32\winload.exe
2014-09-15 08:40 - 2014-07-25 01:05 - 01488008 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.efi
2014-09-15 08:40 - 2014-07-25 01:05 - 01356840 _____ (Microsoft Corporation) C:\WINDOWS\system32\winresume.exe
2014-09-15 08:40 - 2014-07-25 01:03 - 02141920 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfcore.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00882136 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfplat.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00818624 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfmp4srcsnk.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00360480 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfreadwrite.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00233888 _____ (Microsoft Corporation) C:\WINDOWS\system32\mfps.dll
2014-09-15 08:40 - 2014-07-25 01:03 - 00205512 _____ (Microsoft Corporation) C:\WINDOWS\system32\mftranscode.dll
2014-09-15 08:40 - 2014-07-25 00:57 - 02515264 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\tcpip.sys
2014-09-15 08:40 - 2014-07-25 00:57 - 00475968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\netio.sys
2014-09-15 08:40 - 2014-07-24 23:50 - 00098048 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dwmapi.dll
2014-09-15 08:40 - 2014-07-24 23:48 - 02410976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WMVDECOD.DLL
2014-09-15 08:40 - 2014-07-24 23:48 - 00180208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SndVol.exe
2014-09-15 08:40 - 2014-07-24 23:46 - 18760328 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\shell32.dll
2014-09-15 08:40 - 2014-07-24 23:46 - 00477200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SHCore.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 02145472 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfcore.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 00707536 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfplat.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 00674512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfmp4srcsnk.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 00355800 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mfreadwrite.dll
2014-09-15 08:40 - 2014-07-24 23:36 - 00180720 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mftranscode.dll
2014-09-15 08:40 - 2014-07-24 21:51 - 00008192 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRUM.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDYAK.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDTT102.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDTAT.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU1.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDBASH.DLL
2014-09-15 08:40 - 2014-07-24 21:51 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\system32\KBDRU.DLL
2014-09-15 08:40 - 2014-07-24 21:47 - 00132608 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpudd.dll
2014-09-15 08:40 - 2014-07-24 21:46 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\IPMIDrv.sys
2014-09-15 08:40 - 2014-07-24 21:45 - 00076800 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\hdaudbus.sys
2014-09-15 08:40 - 2014-07-24 21:44 - 00674816 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv2.sys
2014-09-15 08:40 - 2014-07-24 21:43 - 00412160 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srv.sys
2014-09-15 08:40 - 2014-07-24 21:42 - 00446976 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\nwifi.sys
2014-09-15 08:40 - 2014-07-24 21:42 - 00126464 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\NdisImPlatform.sys
2014-09-15 08:40 - 2014-07-24 21:41 - 00115712 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\bridge.sys
2014-09-15 08:40 - 2014-07-24 21:33 - 00059392 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups.dll
2014-09-15 08:40 - 2014-07-24 21:33 - 00050688 _____ (Microsoft Corporation) C:\WINDOWS\system32\wups2.dll
2014-09-15 08:40 - 2014-07-24 21:22 - 00308736 _____ (Microsoft Corporation) C:\WINDOWS\system32\compstui.dll
2014-09-15 08:40 - 2014-07-24 21:06 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\iasnap.dll
2014-09-15 08:40 - 2014-07-24 21:05 - 00287232 _____ (Microsoft Corporation) C:\WINDOWS\system32\usbmon.dll
2014-09-15 08:40 - 2014-07-24 21:05 - 00226816 _____ (Microsoft Corporation) C:\WINDOWS\system32\WebClnt.dll
2014-09-15 08:40 - 2014-07-24 20:52 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDYAK.DLL
2014-09-15 08:40 - 2014-07-24 20:52 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDTT102.DLL
2014-09-15 08:40 - 2014-07-24 20:52 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDTAT.DLL
2014-09-15 08:40 - 2014-07-24 20:51 - 00008192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRUM.DLL
2014-09-15 08:40 - 2014-07-24 20:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU1.DLL
2014-09-15 08:40 - 2014-07-24 20:51 - 00007168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDBASH.DLL
2014-09-15 08:40 - 2014-07-24 20:51 - 00006656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\KBDRU.DLL
2014-09-15 08:40 - 2014-07-24 20:49 - 00065536 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersGPExt.dll
2014-09-15 08:40 - 2014-07-24 20:33 - 00026112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wups.dll
2014-09-15 08:40 - 2014-07-24 20:32 - 00207360 _____ (Microsoft Corporation) C:\WINDOWS\system32\powercfg.cpl
2014-09-15 08:40 - 2014-07-24 20:20 - 02050560 _____ (Microsoft Corporation) C:\WINDOWS\system32\SRH.dll
2014-09-15 08:40 - 2014-07-24 20:18 - 01089024 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpedit.dll
2014-09-15 08:40 - 2014-07-24 20:12 - 00878592 _____ (Microsoft Corporation) C:\WINDOWS\system32\ActionCenter.dll
2014-09-15 08:40 - 2014-07-24 20:10 - 01844224 _____ (Microsoft Corporation) C:\WINDOWS\system32\Display.dll
2014-09-15 08:40 - 2014-07-24 20:10 - 00834560 _____ (Microsoft Corporation) C:\WINDOWS\system32\osk.exe
2014-09-15 08:40 - 2014-07-24 20:10 - 00198656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WebClnt.dll
2014-09-15 08:40 - 2014-07-24 20:10 - 00168960 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iasnap.dll
2014-09-15 08:40 - 2014-07-24 20:09 - 01057280 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdvidcrl.dll
2014-09-15 08:40 - 2014-07-24 20:06 - 00438272 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiobj.dll
2014-09-15 08:40 - 2014-07-24 20:05 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkFoldersShell.dll
2014-09-15 08:40 - 2014-07-24 19:53 - 00215552 _____ (Microsoft Corporation) C:\WINDOWS\system32\prnntfy.dll
2014-09-15 08:40 - 2014-07-24 19:52 - 00621056 _____ (Microsoft Corporation) C:\WINDOWS\system32\comdlg32.dll
2014-09-15 08:40 - 2014-07-24 19:42 - 00206336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\powercfg.cpl
2014-09-15 08:40 - 2014-07-24 19:40 - 00557056 _____ (Microsoft Corporation) C:\WINDOWS\system32\PrintDialogs.dll
2014-09-15 08:40 - 2014-07-24 19:39 - 00770048 _____ (Microsoft Corporation) C:\WINDOWS\system32\WorkfoldersControl.dll
2014-09-15 08:40 - 2014-07-24 19:33 - 01741824 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SRH.dll
2014-09-15 08:40 - 2014-07-24 19:32 - 01048064 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\gpedit.dll
2014-09-15 08:40 - 2014-07-24 19:27 - 00855552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rdvidcrl.dll
2014-09-15 08:40 - 2014-07-24 19:27 - 00779264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\osk.exe
2014-09-15 08:40 - 2014-07-24 19:25 - 00832512 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ActionCenter.dll
2014-09-15 08:40 - 2014-07-24 19:24 - 01817088 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Display.dll
2014-09-15 08:40 - 2014-07-24 19:23 - 00328704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiobj.dll
2014-09-15 08:40 - 2014-07-24 19:21 - 00134144 _____ (Microsoft Corporation) C:\WINDOWS\system32\browser.dll
2014-09-15 08:40 - 2014-07-24 19:18 - 00018432 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvcpal.dll
2014-09-15 08:40 - 2014-07-24 19:16 - 12730880 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Xaml.dll
2014-09-15 08:40 - 2014-07-24 19:14 - 00443904 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansec.dll
2014-09-15 08:40 - 2014-07-24 19:13 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\prnntfy.dll
2014-09-15 08:40 - 2014-07-24 19:12 - 00127488 _____ (Microsoft Corporation) C:\WINDOWS\system32\WiFiDisplay.dll
2014-09-15 08:40 - 2014-07-24 19:11 - 00356864 _____ (Microsoft Corporation) C:\WINDOWS\system32\conhost.exe
2014-09-15 08:40 - 2014-07-24 19:11 - 00063488 _____ (Microsoft Corporation) C:\WINDOWS\system32\wshbth.dll
2014-09-15 08:40 - 2014-07-24 19:10 - 00540672 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\comdlg32.dll
2014-09-15 08:40 - 2014-07-24 19:09 - 00116736 _____ (Microsoft Corporation) C:\WINDOWS\system32\httpprxm.dll
2014-09-15 08:40 - 2014-07-24 19:04 - 00492032 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\PrintDialogs.dll
2014-09-15 08:40 - 2014-07-24 19:04 - 00183808 _____ (Microsoft Corp.) C:\WINDOWS\system32\Defrag.exe
2014-09-15 08:40 - 2014-07-24 19:03 - 00324096 _____ (Microsoft Corporation) C:\WINDOWS\system32\srvsvc.dll
2014-09-15 08:40 - 2014-07-24 19:02 - 00220160 _____ (Microsoft Corporation) C:\WINDOWS\system32\profsvc.dll
2014-09-15 08:40 - 2014-07-24 18:58 - 00105472 _____ (Microsoft Corporation) C:\WINDOWS\system32\BluetoothApis.dll
2014-09-15 08:40 - 2014-07-24 18:53 - 01261056 _____ (Microsoft Corporation) C:\WINDOWS\system32\gpsvc.dll
2014-09-15 08:40 - 2014-07-24 18:53 - 00449536 _____ (Microsoft Corporation) C:\WINDOWS\system32\defragsvc.dll
2014-09-15 08:40 - 2014-07-24 18:49 - 01361408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\user32.dll
2014-09-15 08:40 - 2014-07-24 18:49 - 01287680 _____ (Microsoft Corporation) C:\WINDOWS\system32\mispace.dll
2014-09-15 08:40 - 2014-07-24 18:49 - 00296960 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanapi.dll
2014-09-15 08:40 - 2014-07-24 18:49 - 00075776 _____ (Microsoft Corporation) C:\WINDOWS\system32\adhsvc.dll
2014-09-15 08:40 - 2014-07-24 18:48 - 00659968 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Devices.Bluetooth.dll
2014-09-15 08:40 - 2014-07-24 18:47 - 00102912 _____ (Microsoft Corporation) C:\WINDOWS\system32\wcmcsp.dll
2014-09-15 08:40 - 2014-07-24 18:43 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wshbth.dll
2014-09-15 08:40 - 2014-07-24 18:39 - 02397184 _____ (Microsoft Corporation) C:\WINDOWS\system32\storagewmi.dll
2014-09-15 08:40 - 2014-07-24 18:38 - 00371200 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlanmsm.dll
2014-09-15 08:40 - 2014-07-24 18:36 - 00079872 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\BluetoothApis.dll
2014-09-15 08:40 - 2014-07-24 18:32 - 01532416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wlansvc.dll
2014-09-15 08:40 - 2014-07-24 18:30 - 00230400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanapi.dll
2014-09-15 08:40 - 2014-07-24 18:29 - 00439296 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Devices.Bluetooth.dll
2014-09-15 08:40 - 2014-07-24 18:28 - 00595456 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Networking.dll
2014-09-15 08:40 - 2014-07-24 18:27 - 00907776 _____ (Microsoft Corporation) C:\WINDOWS\system32\iphlpsvc.dll
2014-09-15 08:40 - 2014-07-24 18:24 - 00249344 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-15 08:40 - 2014-07-24 18:23 - 01404416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\storagewmi.dll
2014-09-15 08:40 - 2014-07-24 18:22 - 00487936 _____ (Microsoft Corporation) C:\WINDOWS\system32\winspool.drv
2014-09-15 08:40 - 2014-07-24 18:21 - 01231872 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.Media.dll
2014-09-15 08:40 - 2014-07-24 18:21 - 00302080 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wlanmsm.dll
2014-09-15 08:40 - 2014-07-24 18:20 - 00187392 _____ (Microsoft Corporation) C:\WINDOWS\system32\puiapi.dll
2014-09-15 08:40 - 2014-07-24 18:19 - 00388608 _____ (Microsoft Corporation) C:\WINDOWS\system32\WUSettingsProvider.dll
2014-09-15 08:40 - 2014-07-24 18:18 - 01144320 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanmm.dll
2014-09-15 08:40 - 2014-07-24 18:18 - 00795136 _____ (Microsoft Corporation) C:\WINDOWS\system32\spoolsv.exe
2014-09-15 08:40 - 2014-07-24 18:18 - 00093696 _____ (Microsoft Corporation) C:\WINDOWS\system32\wudriver.dll
2014-09-15 08:40 - 2014-07-24 18:16 - 00505344 _____ (Microsoft Corporation) C:\WINDOWS\system32\VAN.dll
2014-09-15 08:40 - 2014-07-24 18:16 - 00084480 _____ (Microsoft Corporation) C:\WINDOWS\system32\wpdbusenum.dll
2014-09-15 08:40 - 2014-07-24 18:15 - 00828416 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuapi.dll
2014-09-15 08:40 - 2014-07-24 18:15 - 00721408 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinapi.dll
2014-09-15 08:40 - 2014-07-24 18:15 - 00432128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Networking.dll
2014-09-15 08:40 - 2014-07-24 18:13 - 00226304 _____ (Microsoft Corporation) C:\WINDOWS\system32\SndVolSSO.dll
2014-09-15 08:40 - 2014-07-24 18:12 - 00189952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-15 08:40 - 2014-07-24 18:10 - 01029632 _____ (Microsoft Corporation) C:\WINDOWS\system32\localspl.dll
2014-09-15 08:40 - 2014-07-24 18:10 - 00889344 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.Media.dll
2014-09-15 08:40 - 2014-07-24 18:10 - 00806400 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32spl.dll
2014-09-15 08:40 - 2014-07-24 18:10 - 00371712 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winspool.drv
2014-09-15 08:40 - 2014-07-24 18:08 - 00321536 _____ (Microsoft Corporation) C:\WINDOWS\system32\stobject.dll
2014-09-15 08:40 - 2014-07-24 18:08 - 00162816 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\puiapi.dll
2014-09-15 08:40 - 2014-07-24 18:07 - 01705472 _____ (Microsoft Corporation) C:\WINDOWS\system32\wucltux.dll
2014-09-15 08:40 - 2014-07-24 18:06 - 00080896 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wudriver.dll
2014-09-15 08:40 - 2014-07-24 18:05 - 00448000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\VAN.dll
2014-09-15 08:40 - 2014-07-24 18:04 - 00667136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wuapi.dll
2014-09-15 08:40 - 2014-07-24 18:02 - 03465216 _____ (Microsoft Corporation) C:\WINDOWS\system32\wuaueng.dll
2014-09-15 08:40 - 2014-07-24 18:01 - 05833216 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\Windows.UI.Search.dll
2014-09-15 08:40 - 2014-07-24 18:01 - 01992192 _____ (Microsoft Corporation) C:\WINDOWS\system32\XpsPrint.dll
2014-09-15 08:40 - 2014-07-24 18:01 - 01126912 _____ (Microsoft Corporation) C:\WINDOWS\system32\SearchFolder.dll
2014-09-15 08:40 - 2014-07-24 18:00 - 02100736 _____ (Microsoft Corporation) C:\WINDOWS\system32\SystemSettingsAdminFlowUI.dll
2014-09-15 08:40 - 2014-07-24 17:58 - 00432640 _____ (Microsoft Corporation) C:\WINDOWS\system32\wwanconn.dll
2014-09-15 08:40 - 2014-07-24 17:58 - 00288768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\stobject.dll
2014-09-15 08:40 - 2014-07-24 17:54 - 01290752 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\XpsPrint.dll
2014-09-15 08:40 - 2014-07-24 17:50 - 01182208 _____ (Microsoft Corporation) C:\WINDOWS\system32\printui.dll
2014-09-15 08:40 - 2014-07-24 17:50 - 00923136 _____ (Microsoft Corporation) C:\WINDOWS\system32\WSShared.dll
2014-09-15 08:40 - 2014-07-24 17:49 - 00263680 _____ (Microsoft Corporation) C:\WINDOWS\system32\DafPrintProvider.dll
2014-09-15 08:40 - 2014-07-24 17:47 - 00576512 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingSync.dll
2014-09-15 08:40 - 2014-07-24 17:46 - 08652800 _____ (Microsoft Corporation) C:\WINDOWS\system32\Windows.UI.Search.dll
2014-09-15 08:40 - 2014-07-24 17:44 - 01057792 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\printui.dll
2014-09-15 08:40 - 2014-07-24 17:43 - 02696704 _____ (Microsoft Corporation) C:\WINDOWS\system32\SettingsHandlers.dll
2014-09-15 08:40 - 2014-07-24 17:43 - 00756224 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\WSShared.dll
2014-09-15 08:40 - 2014-07-24 17:43 - 00200192 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\DafPrintProvider.dll
2014-09-15 08:40 - 2014-07-24 17:41 - 00459264 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\SettingSync.dll
2014-09-15 08:40 - 2014-07-24 17:38 - 06649344 _____ (Microsoft Corporation) C:\WINDOWS\system32\mstscax.dll
2014-09-15 08:40 - 2014-07-24 17:38 - 05777408 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mstscax.dll
2014-09-15 08:40 - 2014-07-24 17:33 - 03360768 _____ (Microsoft Corporation) C:\WINDOWS\system32\rdpcorets.dll
2014-09-15 08:40 - 2014-07-24 17:28 - 01600000 _____ (Microsoft Corporation) C:\WINDOWS\system32\workfolderssvc.dll
2014-09-15 08:40 - 2014-07-24 14:11 - 00513544 _____ () C:\WINDOWS\SysWOW64\locale.nls
2014-09-15 08:40 - 2014-07-24 14:11 - 00513544 _____ () C:\WINDOWS\system32\locale.nls
2014-09-15 08:40 - 2014-07-12 15:55 - 00268288 _____ (Microsoft Corporation) C:\WINDOWS\system32\wisp.dll
2014-09-15 08:40 - 2014-07-12 15:23 - 00436224 _____ (Microsoft Corporation) C:\WINDOWS\system32\certcli.dll
2014-09-15 08:40 - 2014-07-12 14:58 - 00210944 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wisp.dll
2014-09-15 08:40 - 2014-07-12 14:33 - 00318976 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\certcli.dll
2014-09-15 08:40 - 2014-07-12 14:13 - 01417216 _____ (Microsoft Corporation) C:\WINDOWS\system32\lsasrv.dll
2014-09-15 08:40 - 2014-07-10 09:19 - 00387391 _____ () C:\WINDOWS\system32\ApnDatabase.xml
2014-09-15 08:40 - 2014-07-04 22:59 - 00295424 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ks.sys
2014-09-15 08:40 - 2014-07-04 20:29 - 00117248 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSip.dll
2014-09-15 08:40 - 2014-07-04 20:20 - 01656832 _____ (Microsoft Corporation) C:\WINDOWS\system32\GdiPlus.dll
2014-09-15 08:40 - 2014-07-04 20:06 - 00095232 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxSip.dll
2014-09-15 08:40 - 2014-07-04 20:00 - 01351168 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\GdiPlus.dll
2014-09-15 08:40 - 2014-07-04 19:30 - 00544768 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxPackaging.dll
2014-09-15 08:40 - 2014-07-04 19:27 - 00474112 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\AppxPackaging.dll
2014-09-15 08:40 - 2014-06-27 16:22 - 00246272 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\srvnet.sys
2014-09-15 08:40 - 2014-06-26 10:32 - 01029632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mispace.dll
2014-09-15 08:40 - 2014-06-26 10:29 - 00092160 _____ (Microsoft Corporation) C:\WINDOWS\system32\dab.dll
2014-09-15 08:40 - 2014-06-20 09:37 - 00206848 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\mrxsmb20.sys
2014-09-15 08:40 - 2014-06-19 12:13 - 00310080 ____C (Microsoft Corporation) C:\WINDOWS\system32\Drivers\volsnap.sys
2014-09-15 08:40 - 2014-06-14 16:03 - 02389504 _____ (Microsoft Corporation) C:\WINDOWS\system32\d3d10warp.dll
2014-09-15 08:40 - 2014-06-14 15:46 - 02071552 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\d3d10warp.dll
2014-09-15 08:40 - 2014-06-07 22:46 - 00216368 _____ (Microsoft Corporation) C:\WINDOWS\system32\rsaenh.dll
2014-09-15 08:40 - 2014-06-07 20:20 - 00189016 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\rsaenh.dll
2014-09-15 08:40 - 2014-06-06 00:00 - 01118040 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\ndis.sys
2014-09-15 08:40 - 2014-06-05 20:18 - 01018368 _____ (Microsoft Corporation) C:\WINDOWS\system32\aclui.dll
2014-09-15 08:40 - 2014-06-05 19:42 - 00889856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\aclui.dll
2014-09-15 08:40 - 2014-05-31 15:00 - 01463808 _____ (Microsoft Corporation) C:\WINDOWS\system32\wsecedit.dll
2014-09-15 08:40 - 2014-05-31 14:18 - 01319936 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wsecedit.dll
2014-09-15 08:40 - 2014-05-29 16:23 - 00427008 _____ (Microsoft Corporation) C:\WINDOWS\system32\clusapi.dll
2014-09-15 08:40 - 2014-05-29 15:25 - 00313856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\clusapi.dll
2014-09-15 08:40 - 2014-05-29 15:20 - 00427520 _____ (Microsoft Corporation) C:\WINDOWS\system32\schannel.dll
2014-09-15 08:40 - 2014-05-29 14:36 - 00344576 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\schannel.dll
2014-09-15 08:40 - 2014-05-26 17:26 - 00053248 _____ (Microsoft Corporation) C:\WINDOWS\system32\AppxSysprep.dll
2014-09-15 08:40 - 2014-05-10 20:12 - 00387896 _____ (Microsoft Corporation) C:\WINDOWS\system32\bcryptprimitives.dll
2014-09-15 08:40 - 2014-05-10 18:46 - 00335680 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\bcryptprimitives.dll
2014-09-15 08:40 - 2014-05-06 14:41 - 00486744 _____ (Microsoft Corporation) C:\WINDOWS\system32\netcfgx.dll
2014-09-15 08:40 - 2014-05-06 10:55 - 00391000 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\netcfgx.dll
2014-09-15 08:40 - 2014-03-25 12:27 - 00160600 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmmbase.dll
2014-09-15 08:40 - 2014-03-25 12:27 - 00123920 _____ (Microsoft Corporation) C:\WINDOWS\system32\winmm.dll
2014-09-15 08:40 - 2014-03-25 11:20 - 00128568 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmm.dll
2014-09-15 08:40 - 2014-03-25 11:20 - 00127544 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\winmmbase.dll
2014-09-15 08:20 - 2014-08-15 10:36 - 00146752 _____ (Microsoft Corporation) C:\WINDOWS\system32\Drivers\msgpioclx.sys
2014-09-10 09:02 - 2014-08-16 12:40 - 23591424 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.dll
2014-09-10 09:02 - 2014-08-16 12:04 - 17455104 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.dll
2014-09-10 09:02 - 2014-08-16 12:00 - 05833728 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9.dll
2014-09-10 09:02 - 2014-08-16 12:00 - 02793984 _____ (Microsoft Corporation) C:\WINDOWS\system32\iertutil.dll
2014-09-10 09:02 - 2014-08-16 11:56 - 00547328 _____ (Microsoft Corporation) C:\WINDOWS\system32\vbscript.dll
2014-09-10 09:02 - 2014-08-16 11:54 - 00083968 _____ (Microsoft Corporation) C:\WINDOWS\system32\MshtmlDac.dll
2014-09-10 09:02 - 2014-08-16 11:45 - 04232704 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9.dll
2014-09-10 09:02 - 2014-08-16 11:43 - 00758272 _____ (Microsoft Corporation) C:\WINDOWS\system32\jscript9diag.dll
2014-09-10 09:02 - 2014-08-16 11:32 - 00446464 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtmsft.dll
2014-09-10 09:02 - 2014-08-16 11:25 - 00072704 _____ (Microsoft Corporation) C:\WINDOWS\system32\JavaScriptCollectionAgent.dll
2014-09-10 09:02 - 2014-08-16 11:22 - 00454656 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\vbscript.dll
2014-09-10 09:02 - 2014-08-16 11:20 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\MshtmlDac.dll
2014-09-10 09:02 - 2014-08-16 11:19 - 00085504 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtmled.dll
2014-09-10 09:02 - 2014-08-16 11:18 - 02185728 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iertutil.dll
2014-09-10 09:02 - 2014-08-16 11:18 - 00289280 _____ (Microsoft Corporation) C:\WINDOWS\system32\dxtrans.dll
2014-09-10 09:02 - 2014-08-16 11:11 - 00597504 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jscript9diag.dll
2014-09-10 09:02 - 2014-08-16 11:06 - 00359424 _____ (Microsoft Corporation) C:\WINDOWS\system32\iedkcs32.dll
2014-09-10 09:02 - 2014-08-16 11:05 - 00727040 _____ (Microsoft Corporation) C:\WINDOWS\system32\msfeeds.dll
2014-09-10 09:02 - 2014-08-16 11:05 - 00707072 _____ (Microsoft Corporation) C:\WINDOWS\system32\ie4uinit.exe
2014-09-10 09:02 - 2014-08-16 11:03 - 02104832 _____ (Microsoft Corporation) C:\WINDOWS\system32\inetcpl.cpl
2014-09-10 09:02 - 2014-08-16 11:03 - 00365056 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtmsft.dll
2014-09-10 09:02 - 2014-08-16 10:58 - 00060416 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-10 09:02 - 2014-08-16 10:56 - 02310656 _____ (Microsoft Corporation) C:\WINDOWS\system32\wininet.dll
2014-09-10 09:02 - 2014-08-16 10:53 - 13588480 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieframe.dll
2014-09-10 09:02 - 2014-08-16 10:53 - 00243200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\dxtrans.dll
2014-09-10 09:02 - 2014-08-16 10:53 - 00069632 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtmled.dll
2014-09-10 09:02 - 2014-08-16 10:51 - 11769856 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieframe.dll
2014-09-10 09:02 - 2014-08-16 10:45 - 00603136 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msfeeds.dll
2014-09-10 09:02 - 2014-08-16 10:44 - 02014208 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\inetcpl.cpl
2014-09-10 09:02 - 2014-08-16 10:44 - 00312320 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iedkcs32.dll
2014-09-10 09:02 - 2014-08-16 10:34 - 01447424 _____ (Microsoft Corporation) C:\WINDOWS\system32\urlmon.dll
2014-09-10 09:02 - 2014-08-16 10:20 - 01812992 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\wininet.dll
2014-09-10 09:02 - 2014-08-16 10:18 - 00775168 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieapfltr.dll
2014-09-10 09:02 - 2014-08-16 10:14 - 01190400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\urlmon.dll
2014-09-10 09:02 - 2014-08-16 10:12 - 00678400 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieapfltr.dll
2014-09-10 08:57 - 2014-09-05 12:36 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-09-10 08:57 - 2014-09-05 12:31 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-09-10 08:57 - 2014-09-05 10:48 - 00738816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-09-10 08:57 - 2014-08-02 10:18 - 01212928 _____ (Microsoft Corporation) C:\WINDOWS\system32\schedsvc.dll
2014-09-10 08:56 - 2014-07-24 13:20 - 00875688 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msvcr120_clr0400.dll
2014-09-10 08:56 - 2014-07-24 13:20 - 00869544 _____ (Microsoft Corporation) C:\WINDOWS\system32\msvcr120_clr0400.dll
2014-09-09 15:01 - 2014-09-09 15:01 - 00012816 _____ () C:\Users\karrin\Documents\Copy of FAMILY HISTORY CERTS (1).xlsx
2014-09-08 21:40 - 2014-09-08 21:40 - 00014208 _____ () C:\Users\karrin\Documents\Copy of FAMILY HISTORY CERTS1.xlsx
2014-09-06 15:11 - 2014-09-11 08:05 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00002531 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ____D () C:\ProgramData\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-01 18:18 - 2014-09-01 18:18 - 00002086 _____ () C:\Users\karrin\AppData\Roaming\HUO
2014-09-01 18:18 - 2014-09-01 18:18 - 00001248 _____ () C:\Users\karrin\AppData\Roaming\PRUPKOB
2014-08-29 08:33 - 2014-08-23 10:42 - 04148224 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-08-25 19:37 - 2014-08-31 17:09 - 00018814 _____ () C:\Users\karrin\Documents\My EndNote Library.enl
2014-08-25 19:37 - 2014-08-25 19:37 - 00000000 ____D () C:\Users\karrin\Documents\My EndNote Library.Data
2014-08-25 19:33 - 2014-08-29 09:18 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\EndNote
2014-08-25 19:32 - 2014-08-25 19:43 - 00000000 ____D () C:\Users\Public\Documents\EndNote
2014-08-25 19:32 - 2014-08-25 19:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EndNote
2014-08-25 19:32 - 2014-08-25 19:43 - 00000000 ____D () C:\Program Files (x86)\EndNote X7
2014-08-25 19:31 - 2014-08-25 19:43 - 00000000 ____D () C:\ProgramData\Thomson.ResearchSoft.Installers
2014-08-25 19:22 - 2014-08-25 19:28 - 81971217 _____ () C:\Users\karrin\Desktop\ENX701 Installer.zip
2014-08-20 19:28 - 2014-08-20 19:28 - 00392308 _____ () C:\Users\karrin\Downloads\TheFox-obooko-per0001.epub
2014-08-20 17:12 - 2014-08-20 17:12 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\Windows Live Writer
2014-08-20 17:12 - 2014-08-20 17:12 - 00000000 ____D () C:\Users\karrin\AppData\Local\Windows Live Writer

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-19 20:25 - 2014-09-19 20:25 - 00000000 ____D () C:\FRST
2014-09-19 20:22 - 2014-09-19 15:51 - 00000000 ____D () C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#
2014-09-19 20:22 - 2014-06-20 19:09 - 00003922 _____ () C:\WINDOWS\System32\Tasks\User_Feed_Synchronization-{40D24F33-9BC4-4288-9190-81C2FBEA07EE}
2014-09-19 20:02 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\system32\sru
2014-09-19 19:39 - 2014-06-10 19:29 - 00000912 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-19 19:39 - 2014-05-31 15:49 - 00003598 _____ () C:\WINDOWS\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-2327439692-3351121902-880068427-1001
2014-09-19 19:33 - 2014-03-18 20:03 - 00956476 _____ () C:\WINDOWS\system32\PerfStringBackup.INI
2014-09-19 19:30 - 2014-07-23 12:53 - 00002390 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-19 19:30 - 2014-06-10 19:29 - 00000908 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-19 19:29 - 2014-09-19 16:55 - 00122584 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys
2014-09-19 19:29 - 2014-09-19 12:58 - 00001350 _____ () C:\WINDOWS\Tasks\HUO.job
2014-09-19 19:29 - 2014-09-19 12:57 - 00001702 _____ () C:\WINDOWS\Tasks\PRUPKOB.job
2014-09-19 19:29 - 2014-06-20 18:39 - 00000000 __RDO () C:\Users\karrin\OneDrive
2014-09-19 19:28 - 2014-06-20 17:47 - 00000000 ____D () C:\Users\karrin
2014-09-19 19:28 - 2014-03-18 19:54 - 00636760 _____ () C:\WINDOWS\PFRO.log
2014-09-19 19:28 - 2013-08-23 00:45 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT
2014-09-19 19:19 - 2014-09-19 19:19 - 00079064 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mwex.sys
2014-09-19 19:19 - 2014-09-19 12:57 - 00000000 ____D () C:\Program Files (x86)\globalUpdate
2014-09-19 19:19 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\schemas
2014-09-19 19:11 - 2014-09-19 12:59 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\uTorrent
2014-09-19 18:05 - 2014-09-19 18:04 - 01737546 _____ () C:\Users\karrin\Downloads\Unconfirmed 785114.crdownload
2014-09-19 17:50 - 2014-09-19 17:50 - 00688992 _____ (Swearware) C:\Users\karrin\Desktop\dds.com
2014-09-19 17:14 - 2014-06-04 19:35 - 00000000 ____D () C:\Users\karrin\AppData\Local\CrashDumps
2014-09-19 17:14 - 2013-08-22 23:25 - 00262144 ___SH () C:\WINDOWS\system32\config\BBI
2014-09-19 16:55 - 2014-09-19 16:55 - 00001121 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-09-19 16:55 - 2014-09-19 16:55 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-09-19 16:54 - 2014-09-19 16:53 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\karrin\Downloads\mbam-setup-2.0.2.1012.exe
2014-09-19 16:10 - 2014-07-23 12:51 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-19 16:05 - 2014-09-19 12:59 - 00000008 __RSH () C:\ProgramData\ntuser.pol
2014-09-19 16:05 - 2013-08-23 00:44 - 00387024 _____ () C:\WINDOWS\system32\FNTCACHE.DAT
2014-09-19 16:05 - 2013-08-22 23:25 - 00262144 ___SH () C:\WINDOWS\system32\config\ELAM
2014-09-19 16:04 - 2013-08-23 01:36 - 00000000 ___HD () C:\WINDOWS\system32\GroupPolicy
2014-09-19 16:02 - 2014-09-19 16:00 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 897004.crdownload
2014-09-19 16:00 - 2014-09-19 15:59 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 631860.crdownload
2014-09-19 15:59 - 2014-09-19 15:59 - 01006488 _____ (Kromtech) C:\Users\karrin\Downloads\Unconfirmed 852372.crdownload
2014-09-19 15:51 - 2014-09-19 15:51 - 00004580 _____ () C:\WINDOWS\System32\Tasks\IC Runnner
2014-09-19 15:51 - 2014-09-19 13:06 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\VOPackage
2014-09-19 13:22 - 2014-06-20 18:00 - 01972686 _____ () C:\WINDOWS\WindowsUpdate.log
2014-09-19 13:03 - 2014-06-20 18:36 - 00001641 _____ () C:\Users\karrin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
2014-09-19 13:03 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\GroupPolicy
2014-09-19 13:01 - 2014-09-19 12:58 - 00004356 _____ () C:\WINDOWS\System32\Tasks\HUO
2014-09-19 13:00 - 2014-09-19 13:00 - 01943376 _____ (BitTorrent Inc.) C:\Users\karrin\Downloads\uTorrent (1).exe
2014-09-19 13:00 - 2014-09-19 12:57 - 00004706 _____ () C:\WINDOWS\System32\Tasks\PRUPKOB
2014-09-19 12:59 - 2014-09-19 12:59 - 00000000 ____H () C:\WINDOWS\system32\Drivers\Msft_Kernel_webinstr_01009.Wdf
2014-09-19 12:59 - 2013-08-23 00:46 - 00310714 _____ () C:\WINDOWS\setupact.log
2014-09-19 12:58 - 2014-09-19 12:58 - 01943376 _____ (BitTorrent Inc.) C:\Users\karrin\Downloads\uTorrent.exe
2014-09-19 12:57 - 2014-09-19 12:57 - 00000000 ____D () C:\Users\karrin\AppData\Local\globalUpdate
2014-09-19 12:47 - 2014-06-04 17:16 - 00003166 _____ () C:\WINDOWS\System32\Tasks\HPCeeScheduleForkarrin
2014-09-19 12:47 - 2014-06-04 17:16 - 00000350 _____ () C:\WINDOWS\Tasks\HPCeeScheduleForkarrin.job
2014-09-19 12:45 - 2014-09-19 12:45 - 00000000 ____D () C:\ProgramData\Oracle
2014-09-19 12:44 - 2014-09-19 12:44 - 00272808 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaws.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\javaw.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00175528 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\java.exe
2014-09-19 12:44 - 2014-09-19 12:44 - 00098216 _____ (Oracle Corporation) C:\WINDOWS\SysWOW64\WindowsAccessBridge-32.dll
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\ProgramData\Sun
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-09-19 12:44 - 2014-09-19 12:44 - 00000000 ____D () C:\Program Files (x86)\Java
2014-09-19 12:41 - 2014-09-19 12:41 - 00918440 _____ (Oracle Corporation) C:\Users\karrin\Downloads\chromeinstall-7u67.exe
2014-09-19 00:54 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\AppReadiness
2014-09-17 06:32 - 2012-07-26 17:59 - 00000000 ____D () C:\WINDOWS\CbsTemp
2014-09-16 13:00 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\rescache
2014-09-15 12:47 - 2014-06-02 13:01 - 00000052 _____ () C:\WINDOWS\SysWOW64\DOErrors.log
2014-09-15 12:47 - 2014-06-02 13:01 - 00000000 _____ () C:\WINDOWS\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-09-15 12:36 - 2014-07-10 20:34 - 00000000 ___SD () C:\WINDOWS\system32\CompatTel
2014-09-15 12:36 - 2014-03-18 19:45 - 00000000 ____D () C:\Program Files\Windows Journal
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ___RD () C:\WINDOWS\ToastData
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ___RD () C:\WINDOWS\ImmersiveControlPanel
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ___RD () C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ___RD () C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\WinStore
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\setup
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\SysWOW64\InputMethod
2014-09-15 12:36 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\system32\setup
2014-09-15 12:36 - 2013-08-22 23:36 - 00000000 ____D () C:\WINDOWS\system32\oobe
2014-09-15 12:35 - 2014-06-01 16:33 - 00000000 ____D () C:\WINDOWS\system32\MRT
2014-09-15 12:33 - 2014-06-01 16:33 - 101694776 _____ (Microsoft Corporation) C:\WINDOWS\system32\MRT.exe
2014-09-15 12:20 - 2014-06-01 09:48 - 00000000 ____D () C:\Users\karrin\Documents\Family Tree Maker
2014-09-11 08:05 - 2014-09-06 15:11 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\Skype
2014-09-10 09:02 - 2014-06-21 11:38 - 00195584 _____ (Microsoft Corporation) C:\WINDOWS\system32\msrating.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00164864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\msrating.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00139264 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieUnatt.exe
2014-09-10 09:02 - 2014-06-21 11:38 - 00112128 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieUnatt.exe
2014-09-10 09:02 - 2014-06-21 11:38 - 00111616 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollector.exe
2014-09-10 09:02 - 2014-06-21 11:38 - 00066048 _____ (Microsoft Corporation) C:\WINDOWS\system32\iesetup.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00061952 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iesetup.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\ieetwproxystub.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00051200 _____ (Microsoft Corporation) C:\WINDOWS\system32\jsproxy.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00048640 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwproxystub.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00043008 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\jsproxy.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00033792 _____ (Microsoft Corporation) C:\WINDOWS\system32\iernonce.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00032768 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\iernonce.dll
2014-09-10 09:02 - 2014-06-21 11:38 - 00004096 _____ (Microsoft Corporation) C:\WINDOWS\system32\ieetwcollectorres.dll
2014-09-10 09:02 - 2014-06-21 11:33 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\mshtml.tlb
2014-09-10 09:02 - 2014-06-21 11:33 - 02724864 _____ (Microsoft Corporation) C:\WINDOWS\system32\mshtml.tlb
2014-09-09 15:01 - 2014-09-09 15:01 - 00012816 _____ () C:\Users\karrin\Documents\Copy of FAMILY HISTORY CERTS (1).xlsx
2014-09-08 21:40 - 2014-09-08 21:40 - 00014208 _____ () C:\Users\karrin\Documents\Copy of FAMILY HISTORY CERTS1.xlsx
2014-09-06 15:11 - 2014-09-06 15:11 - 00002531 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ____D () C:\ProgramData\Skype
2014-09-06 15:11 - 2014-09-06 15:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-09-06 15:11 - 2014-04-11 12:57 - 00000000 ____D () C:\Program Files (x86)\Windows Live
2014-09-05 12:36 - 2014-09-10 08:57 - 00097280 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepic.dll
2014-09-05 12:31 - 2014-09-10 08:57 - 00527360 _____ (Microsoft Corporation) C:\WINDOWS\system32\aeinv.dll
2014-09-05 10:48 - 2014-09-10 08:57 - 00738816 _____ (Microsoft Corporation) C:\WINDOWS\system32\aepdu.dll
2014-09-03 16:35 - 2014-06-29 17:15 - 00000000 ____D () C:\Users\karrin\Tracing
2014-09-03 16:35 - 2014-06-29 17:10 - 00000000 ____D () C:\Users\karrin\AppData\Local\Windows Live
2014-09-03 06:06 - 2014-09-15 12:39 - 00706016 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerApp.exe
2014-09-03 06:06 - 2014-09-15 12:39 - 00105440 _____ (Adobe Systems Incorporated) C:\WINDOWS\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-01 18:18 - 2014-09-01 18:18 - 00002086 _____ () C:\Users\karrin\AppData\Roaming\HUO
2014-09-01 18:18 - 2014-09-01 18:18 - 00001248 _____ () C:\Users\karrin\AppData\Roaming\PRUPKOB
2014-08-31 17:09 - 2014-08-25 19:37 - 00018814 _____ () C:\Users\karrin\Documents\My EndNote Library.enl
2014-08-29 09:18 - 2014-08-25 19:33 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\EndNote
2014-08-26 19:04 - 2013-08-23 01:36 - 00000000 ____D () C:\WINDOWS\system32\NDF
2014-08-25 19:43 - 2014-08-25 19:32 - 00000000 ____D () C:\Users\Public\Documents\EndNote
2014-08-25 19:43 - 2014-08-25 19:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EndNote
2014-08-25 19:43 - 2014-08-25 19:32 - 00000000 ____D () C:\Program Files (x86)\EndNote X7
2014-08-25 19:43 - 2014-08-25 19:31 - 00000000 ____D () C:\ProgramData\Thomson.ResearchSoft.Installers
2014-08-25 19:37 - 2014-08-25 19:37 - 00000000 ____D () C:\Users\karrin\Documents\My EndNote Library.Data
2014-08-25 19:28 - 2014-08-25 19:22 - 81971217 _____ () C:\Users\karrin\Desktop\ENX701 Installer.zip
2014-08-24 10:33 - 2014-06-17 18:20 - 00086120 _____ () C:\Users\karrin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-08-23 17:48 - 2014-09-15 08:41 - 02374784 _____ (Microsoft Corporation) C:\WINDOWS\explorer.exe
2014-08-23 17:13 - 2014-09-15 08:41 - 02084520 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\explorer.exe
2014-08-23 16:10 - 2014-09-15 08:41 - 00068096 _____ (Microsoft Corporation) C:\WINDOWS\system32\UXInit.dll
2014-08-23 15:32 - 2014-09-15 08:41 - 00050176 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\UXInit.dll
2014-08-23 14:44 - 2014-09-15 08:41 - 02860032 _____ (Microsoft Corporation) C:\WINDOWS\system32\actxprxy.dll
2014-08-23 14:34 - 2014-09-15 08:41 - 13423104 _____ (Microsoft Corporation) C:\WINDOWS\system32\twinui.dll
2014-08-23 14:33 - 2014-09-15 08:41 - 00796672 _____ (Microsoft Corporation) C:\WINDOWS\system32\uDWM.dll
2014-08-23 14:31 - 2014-09-15 08:41 - 01038336 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\actxprxy.dll
2014-08-23 14:20 - 2014-09-15 08:41 - 11818496 _____ (Microsoft Corporation) C:\WINDOWS\SysWOW64\twinui.dll
2014-08-23 10:42 - 2014-08-29 08:33 - 04148224 _____ (Microsoft Corporation) C:\WINDOWS\system32\win32k.sys
2014-08-20 19:28 - 2014-08-20 19:28 - 00392308 _____ () C:\Users\karrin\Downloads\TheFox-obooko-per0001.epub
2014-08-20 17:12 - 2014-08-20 17:12 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\Windows Live Writer
2014-08-20 17:12 - 2014-08-20 17:12 - 00000000 ____D () C:\Users\karrin\AppData\Local\Windows Live Writer

Some content of TEMP:
====================
C:\Users\karrin\AppData\Local\Temp\Extract.exe
C:\Users\karrin\AppData\Local\Temp\post2.dll
C:\Users\karrin\AppData\Local\Temp\post2.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-09-19 19:39

==================== End Of Log ============================



#8 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:16 AM

Posted 19 September 2014 - 06:52 AM

You have posted the FRST.txt again.

I need the log by aswMBR.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#9 snorky62

snorky62
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:16 PM

Posted 19 September 2014 - 07:00 AM

Whoops, here it is:

 

aswMBR version 1.0.1.2041 Copyright© 2014 AVAST Software
Run date: 2014-09-19 20:44:54
-----------------------------
20:44:54.995    OS Version: Windows x64 6.2.9200
20:44:54.995    Number of processors: 2 586 0x1001
20:44:54.997    ComputerName: FAMILY  UserName: karrin
20:44:57.957    Initialize success
20:44:58.180    VM: initialized successfully
20:44:58.247    VM: Amd CPU BiosDisabled
20:45:01.409    VM: supported disk I/O storport.sys
20:51:36.751    AVAST engine defs: 14091900
20:51:42.846    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000025
20:51:42.849    Disk 0 Vendor: ST2000DM001-1CH164 HP34 Size: 1907729MB BusType: 11
20:51:42.980    Disk 0 MBR read successfully
20:51:42.985    Disk 0 MBR scan
20:51:42.998    Disk 0 unknown MBR code
20:51:43.006    Disk 0 Partition 1 00     EE          GPT           2097151 MB offset 1
20:51:43.040    Disk 0 scanning C:\WINDOWS\system32\drivers
20:51:54.137    Service scanning
20:51:57.458    Service BHDrvx64 C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\BASHDefs\20140912.003\BHDrvx64.sys **LOCKED** 5
20:51:59.821    Service eeCtrl C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys **LOCKED** 5
20:51:59.925    Service EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys **LOCKED** 5
20:52:02.307    Service IDSVia64 C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\IPSDefs\20140918.003\IDSvia64.sys **LOCKED** 5
20:52:05.328    Service NAVENG C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140918.016\ENG64.SYS **LOCKED** 5
20:52:05.457    Service NAVEX15 C:\Program Files (x86)\Norton 360\NortonData\21.1.0.18\Definitions\VirusDefs\20140918.016\EX64.SYS **LOCKED** 5
20:52:16.973    Modules scanning
20:52:16.990    Disk 0 trace - called modules:
20:52:17.036    ntoskrnl.exe CLASSPNP.SYS disk.sys storport.sys hal.dll storahci.sys
20:52:17.044    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xffffe00185a36770]
20:52:17.050    3 CLASSPNP.SYS[fffff80127a0227b] -> nt!IofCallDriver -> \Device\00000025[0xffffe001855ff060]
20:52:18.777    AVAST engine scan C:\WINDOWS
20:52:21.851    AVAST engine scan C:\WINDOWS\system32
20:56:03.039    AVAST engine scan C:\WINDOWS\system32\drivers
20:56:22.152    AVAST engine scan C:\Users\karrin
21:04:02.542    AVAST engine scan C:\ProgramData
21:05:54.060    Scan finished successfully
21:09:38.037    Disk 0 MBR has been saved successfully to "C:\Users\karrin\OneDrive\Documents\MBR.dat"
21:09:38.049    The log file has been saved successfully to "C:\Users\karrin\OneDrive\Documents\aswMBR.txt"

 



#10 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:16 AM

Posted 19 September 2014 - 07:21 AM

Going over your logs I noticed that you have µTorrent installed.

  • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a wide variety of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.

It is pretty much certain that if you continue to use P2P programs, you will get infected again.
I would recommend that you uninstall µTorrent, however that choice is up to you. If you choose to remove these programs, you can do so via Start > Control Panel > Add/Remove Programs.
If you wish to keep it, please do not use it until your computer is cleaned.

 

 

 

 

 

We need to remove some programs with Revo Uninstaller Free:


Note: Revo Uninstaller is more thorough in deleting programs on your computer than using the Add/Remove option in Windows. Since it is a more powerful tool, please be sure to follow the instructions carefully.
Note: If the program you want to uninstall is not listed by Revo, let me know and we will try an altenate method of removal.

  • Please download and install Revo Uninstaller Free
    note: there is no need to click anything on that page, the download will start automatically
  • Double click Revo Uninstaller to run it
  • From the list of programs double click on the listed program(s), or anything similar, to remove it:
    #Idle-#.#-Crawler#
  • When prompted if you want to uninstall click Yes
  • Be sure the Moderate option is selected then click Next
  • The program will run, If prompted again click Yes
  • When the built-in uninstaller is finished click on Next
  • Once the program has searched for leftovers click Next
  • Check the items in bold only on the list then click Delete
    note: you may have to expand some folders by clicking the "+" mark
  • When prompted click on Yes and then on Next
  • Put a check on any folders that are found and select Delete
  • When prompted select Yes then Next
  • Once done click Finish

 

 

 

 

 

Fix with FRST (normal mode)

WARNING: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system
 

  • Download the attached fixlist.txt and save it to the location where FRST is saved to.
  • Run FRST.exe (on 64bit, run FRST64.exe) and press the Fix button just once and wait.
  • The tool will make a log (Fixlog.txt) which you find where you saved FRST. Please post it to your reply.

 

 

 

 

 

Full System Scan with Malwarebytes Antimalware
 

  • If not existing, please download Malwarebytes Anti-Malware to your desktop.
  • Double-click the downloaded setup file and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to the following:
    • Launch Malwarebytes Anti-Malware
    • A 14 day trial of the Premium features is pre-selected. You may deselect this if you wish, and it will not diminish the scanning and removal capabilities of the program.
  • Click Finish.

If the program is already installed:

  • Run Malwarebytes Antimalware
  • On the Dashboard, click the 'Update Now >>' link
  • After the update completes, click the 'Scan Now >>' button.
  • Or, on the Dashboard, click the Scan Now >> button.
  • If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • When the scan is complete, if there have been detections, click Apply Actions to allow MBAM to clean what was detected.
  • In most cases, a restart will be required.
  • Wait for the prompt to restart the computer to appear, then click on Yes.

  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.

 

Attached Files


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#11 snorky62

snorky62
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:16 PM

Posted 19 September 2014 - 08:03 AM

Hi Marius,

 

Here is a copy of the fixlog:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014
Ran by karrin at 2014-09-19 22:58:11 Run:3
Running from C:\Users\karrin\Downloads
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
Task: C:\WINDOWS\Tasks\HUO.job => C:\Users\karrin\AppData\Roaming\HUO.exe
Task: C:\WINDOWS\Tasks\PRUPKOB.job => C:\Users\karrin\AppData\Roaming\PRUPKOB.exe
Task: {F96DEB5F-5F79-4D0E-A5CE-C2BE6D62479B} - System32\Tasks\IC Runnner => %LOCALAPPDATA%\#Idle-#.#-Crawler#\IcRunner.exe
Task: {A9327D53-C54F-4DB8-B5BB-97E26F0DD783} - System32\Tasks\HUO => C:\Users\karrin\AppData\Roaming\HUO.exe
Task: {ADEE5A01-005B-4C07-A805-D62007673648} - System32\Tasks\Microsoft\Windows\Maintenance\IC Updater => %LOCALAPPDATA%\#Idle-#.#-Crawler#\IcRunner.exe
Task: {407239AD-8964-494F-A518-741E1468B997} - System32\Tasks\PRUPKOB => C:\Users\karrin\AppData\Roaming\PRUPKOB.exe
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411095631&from=ild&uid=ST2000DM001-1CH164_W1E7P24B&q={searchTerms}
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.istartsurf.com/web/?type=ds&ts=1411095631&from=ild&uid=ST2000DM001-1CH164_W1E7P24B&q={searchTerms}
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\...\Run: [TornTv Downloader] => C:\Users\karrin\AppData\Roaming\TornTV.com\Torntv Downloader.exe /c=startup

C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#
C:\Users\karrin\AppData\Roaming\HUO.exe
C:\Users\karrin\AppData\Roaming\PRUPKOB.exe
2014-09-01 18:18 - 2014-09-01 18:18 - 00002086 _____ () C:\Users\karrin\AppData\Roaming\HUO
2014-09-01 18:18 - 2014-09-01 18:18 - 00001248 _____ () C:\Users\karrin\AppData\Roaming\PRUPKOB
2014-09-19 15:51 - 2014-09-19 15:51 - 00004580 _____ () C:\WINDOWS\System32\Tasks\IC Runnner
2014-09-19 13:06 - 2014-09-19 15:51 - 00000000 ____D () C:\Users\karrin\AppData\Roaming\VOPackage
C:\Users\karrin\AppData\Roaming\TornTV.com

Emptytemp:

*****************

C:\WINDOWS\Tasks\HUO.job not found.
C:\WINDOWS\Tasks\PRUPKOB.job not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{F96DEB5F-5F79-4D0E-A5CE-C2BE6D62479B}" => Key not found.
C:\Windows\System32\Tasks\IC Runnner not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\IC Runnner" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A9327D53-C54F-4DB8-B5BB-97E26F0DD783}" => Key not found.
C:\Windows\System32\Tasks\HUO not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\HUO" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{ADEE5A01-005B-4C07-A805-D62007673648}" => Key not found.
C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance\IC Updater not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Maintenance\IC Updater" => Key not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{407239AD-8964-494F-A518-741E1468B997}" => Key not found.
C:\Windows\System32\Tasks\PRUPKOB not found.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\PRUPKOB" => Key not found.
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKLM\Software\\Microsoft\Internet Explorer\Main\\Search Page => Value was restored successfully.
HKU\S-1-5-21-2327439692-3351121902-880068427-1001\Software\Microsoft\Windows\CurrentVersion\Run\\TornTv Downloader => Value not found.
"C:\Users\karrin\AppData\Local\#Idle-#.#-Crawler#" => File/Directory not found.
"C:\Users\karrin\AppData\Roaming\HUO.exe" => File/Directory not found.
"C:\Users\karrin\AppData\Roaming\PRUPKOB.exe" => File/Directory not found.
"C:\Users\karrin\AppData\Roaming\HUO" => File/Directory not found.
"C:\Users\karrin\AppData\Roaming\PRUPKOB" => File/Directory not found.
"C:\WINDOWS\System32\Tasks\IC Runnner" => File/Directory not found.
"C:\Users\karrin\AppData\Roaming\VOPackage" => File/Directory not found.
"C:\Users\karrin\AppData\Roaming\TornTV.com" => File/Directory not found.
EmptyTemp: => Removed 22.5 MB temporary data.

The system needed a reboot.

==== End of Fixlog ====



#12 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:16 AM

Posted 19 September 2014 - 08:15 AM

then proceed with the mbam scan as requested, please


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)

#13 snorky62

snorky62
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:16 PM

Posted 19 September 2014 - 08:21 AM

Here is the Malwarebytes log:

 

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 19/09/2014
Scan Time: 11:03:43 PM
Logfile: mbamresults.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.09.19.03
Rootkit Database: v2014.09.18.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: karrin

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 317637
Time Elapsed: 11 min, 40 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 3
PUP.Optional.TornTV.A, HKLM\SOFTWARE\TheTorntv V10-nv, Quarantined, [e49b19d6413a171f8720016ee0248a76],
PUP.Optional.TornTV.A, HKLM\SOFTWARE\WOW6432NODE\TheTorntv V10-nv, Quarantined, [89f68a65fe7d24123572b5ba0ff54ab6],
PUP.Optional.TornTV.A, HKU\S-1-5-21-2327439692-3351121902-880068427-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\TheTorntv V10, Quarantined, [6c135d925b20df572c7d2d42e024ff01],

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)



#14 snorky62

snorky62
  • Topic Starter

  • Members
  • 20 posts
  • OFFLINE
  •  
  • Local time:09:16 PM

Posted 19 September 2014 - 08:23 AM

I also have a problem with a browser hijacker called istartsurf. Could you please help me with that as well?

 

Many thanks in advance.

 

Snorky



#15 TB-Psychotic

TB-Psychotic

  • Malware Response Team
  • 6,349 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:11:16 AM

Posted 19 September 2014 - 09:08 AM

We´re removing all of them at the moment. :)

 

Scan with ESET Online Scan

Go here to run an online scannner from ESET. Windows Vista/Windows 7/Windows 8 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator

  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Here's how.
  • Click the blue Run ESET Online Scanner button
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the program to install the "OnlineScanner.cab" activex control by clicking the Install button
  • Once the activex control is installed, on the next screen click on Enable detection of potentially unwanted applications
  • Click on Advanced Settings
  • Make sure that the option Remove found threats is unticked.
  • Ensure these options are ticked
    • Scan archives
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth technology
  • Click Start
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.
  • Close the ESET online scan, and let me know how things are now.


Proud Member of UNITE & TB
 
My help is free, however, if you want to support my fight against malware, click here --> btn_donate_SM.gif <--(no worries, every little bit helps)




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users