Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Avast Found Three Win64:Rootkit-gen Files - What Now?


  • This topic is locked This topic is locked
20 replies to this topic

#1 GreenAnteater

GreenAnteater

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:09 AM

Posted 19 September 2014 - 12:09 PM

Hello,

 

I scan my laptop with Avast Antivirus (Free) every day, and last night (18 Sept), it detected three threats. It asked to reboot to scan all files, and I left it all night on a black screen with it scanning my files. 

 

As of this morning, I can use my computer fully again, and the three rootkit files are in the "Virus Chest". All three are Win64:Rootkit-gen [Rtk], and their names are:

 

cachesrvr.exe 

cachesrvr.exe

unp232078075.tmp

 

Basically, now that they are in there, what do I do? I also have MalwareBytes (Free) and SUPERAntiSpyware (Free), and after scanning, they did not find anything. I use my computer for work and so I really would love for it to be nice and clean. 

 

I haven't experienced any slowness or any other problems as of this time. EDIT: No general slowness, but now it takes a very long time to open the sign-in screen when I wake it from sleep mode. The screensaver with the time pops up, but when I click it away, it remains on a blank color screen for several minutes before finally taking me to my "pin" so I can access the desktop.

 

I followed the directions in the Preparation Guide for this forum, and backed up my data and checked other topics, but unfortunately, I cannot download DDS. When I try to run it, it says "DDS cannot run in compatibility mode" and closes itself. As such, I cannot post any logs. 

 

Thank you to anyone who can help.


Edited by GreenAnteater, 19 September 2014 - 06:03 PM.


BC AdBot (Login to Remove)

 


#2 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:09 AM

Posted 20 September 2014 - 10:02 AM

Hello and welcome.  Please follow these guidelines while we work on your PC:

  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.”  Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please note that the forum is very busy and if I don't hear from you within five days this thread will be closed.

icon11.gif   Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.


Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#3 GreenAnteater

GreenAnteater
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:09 AM

Posted 20 September 2014 - 07:36 PM

Thank you, RP, for assisting me. 

 

Here is the FRST.txt log. Attached is the Addition.txt. 

 

[edited due to not running the program from the desktop; updated]

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-09-2014
Ran by Hayley (administrator) on HAYLEY-LAPTOP on 20-09-2014 23:09:26
Running from C:\Users\Hayley\Desktop
Platform: Windows 8.1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/


==================== Processes (Whitelisted) =================


(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)


(Softex Inc.) C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(SUPERAntiSpyware.com) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin\rpdsvc.exe
() C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\SkyDrive.exe
() C:\Program Files\Hewlett-Packard\SimplePass\opvapp.exe
(Microsoft Corporation) C:\Windows\System32\SettingSyncHost.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe
(Hewlett-Packard) C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe
(SUPERAntiSpyware) C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
() C:\Users\Hayley\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(CyberLink) C:\Program Files (x86)\CyberLink\Power2Go8\CLMLSvc_P2G8.exe
(Western Digital Technologies, Inc.) C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\Microsoft.Reader_6.3.9654.17044_x64__8wekyb3d8bbwe\glcnd.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(oDesk Corporation) C:\Program Files (x86)\oDesk\oDeskTeam.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreamsDownloader.exe
(Microsoft Corporation) C:\Windows\ImmersiveControlPanel\SystemSettings.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\SyncServer.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(oDesk Corporation) C:\Program Files (x86)\oDesk\oDeskHelper.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe




==================== Registry (Whitelisted) ==================


(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)


HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe [7204568 2013-11-04] (Realtek Semiconductor)
HKLM\...\Run: [SimplePass] => C:\Program Files\Hewlett-Packard\SimplePass\HPSmplPass.exe [2758200 2013-10-14] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBroker] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBroker.exe [155704 2013-10-14] (Hewlett-Packard)
HKLM\...\Run: [OPBHOBrokerDesktop] => C:\Program Files\Hewlett-Packard\SimplePass\OPBHOBrokerDsktop.exe [155704 2013-10-14] (Hewlett-Packard)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2771184 2013-07-26] (Synaptics Incorporated)
HKLM-x32\...\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [77088 2013-07-24] (Hewlett-Packard Company)
HKLM-x32\...\Run: [YouCam Service] => C:\Program Files (x86)\CyberLink\YouCam\YouCamService.exe [267224 2013-09-01] (CyberLink Corp.)
HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [4085896 2014-09-13] (AVAST Software)
HKLM-x32\...\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-12-25] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [WD Quick View] => C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe [5562736 2014-07-22] (Western Digital Technologies, Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] => c:\program files (x86)\real\realplayer\Update\realsched.exe [296520 2014-06-28] (RealNetworks, Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-08-19] (Hewlett-Packard)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-3914294095-3043128761-1344380093-1001\...\Run: [SUPERAntiSpyware] => C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe [7763736 2014-09-16] (SUPERAntiSpyware)
HKU\S-1-5-21-3914294095-3043128761-1344380093-1001\...\Run: [Amazon Cloud Player] => C:\Users\Hayley\AppData\Local\Amazon Cloud Player\Amazon Music Helper.exe [3145536 2014-05-08] ()
HKU\S-1-5-21-3914294095-3043128761-1344380093-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3914294095-3043128761-1344380093-1001\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\system32\StikyNot.exe [457728 2013-08-22] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Audible Download Manager.lnk
ShortcutTarget: Audible Download Manager.lnk -> C:\Program Files (x86)\Audible\Bin\AudibleDownloadHelper.exe (Audible, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\RealPlayer Cloud Service UI.lnk
ShortcutTarget: RealPlayer Cloud Service UI.lnk -> C:\Program Files (x86)\Real\RealPlayer\RPDS\Bin64\rpsystray.exe (RealNetworks, Inc.)
Startup: C:\Users\Hayley\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EvernoteClipper.lnk
ShortcutTarget: EvernoteClipper.lnk -> C:\Program Files (x86)\Evernote\Evernote\EvernoteClipper.exe (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)


==================== Internet (Whitelisted) ====================


(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)


HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT14/1
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT14/1
SearchScopes: HKLM - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKCU - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
BHO: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin64.dll (RealDownloader)
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer -> {3049C3E9-B461-4BC5-8870-4C09146192CA} -> C:\Program Files (x86)\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Evernote extension -> {92EF2EAD-A7CE-4424-B0DB-499CF856608E} -> C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll (Evernote Corp., 305 Walnut Street, Redwood City, CA 94063)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62


FireFox:
========
FF ProfilePath: C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default
FF Homepage: https://www.google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1204144.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3508.0205 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @real.com/nppl3260;version=17.0.11.0 -> c:\program files (x86)\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=17.0.11 -> C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=17.0.11.0 -> c:\program files (x86)\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer Cloud)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Extension: iCloud Bookmarks - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\firefoxdav@icloud.com [2014-05-19]
FF Extension: FT DeepDark - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66} [2014-08-29]
FF Extension: RequestPolicy - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\requestpolicy@requestpolicy.com.xpi [2014-04-20]
FF Extension: Leet Key - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\{3335F91D-2AEF-4097-B831-C96C60349822}.xpi [2014-06-13]
FF Extension: New Tab Homepage - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\{66E978CD-981F-47DF-AC42-E3CF417C1467}.xpi [2014-04-20]
FF Extension: NoScript - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014-04-20]
FF Extension: Public Fox - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\{9AA46F4F-4DC7-4c06-97AF-6665170634FE}.xpi [2014-04-20]
FF Extension: gTranslate - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\{aff87fa2-a58e-4edd-b852-0a20203c1e17}.xpi [2014-04-20]
FF Extension: Adblock Plus - C:\Users\Hayley\AppData\Roaming\Mozilla\Firefox\Profiles\3wuk3p4s.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-20]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2014-04-20]
FF HKLM-x32\...\Firefox\Extensions: [{1DD9AC48-0855-4AE7-9934-159B4377FFA2}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2014-06-28]


Chrome: 
=======
CHR HomePage: Default -> hxxp://www.google.com/
CHR StartupUrls: Default -> "hxxp://www.google.com/", "https://www.google.com/"
CHR Profile: C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Translate) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapbdbdomjkkjkaonfhkkikfgjllcleb [2014-04-20]
CHR Extension: (Missing e) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcjbagclppcgdbpobcpoojdjdmcjhpid [2014-04-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-25]
CHR Extension: (ColorZilla) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhlhnicpbhignbdhedgjhgdocnmhomnp [2014-06-22]
CHR Extension: (WOT) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp [2014-04-20]
CHR Extension: (avast! SafePrice) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2014-08-08]
CHR Extension: (XKit) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpfgeeomkfdefkckijiabdbogjkdaecd [2014-04-20]
CHR Extension: (HTTPS Everywhere) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\gcbommkclmclpchllfjekcdonpmejbdp [2014-04-20]
CHR Extension: (AdBlock) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-20]
CHR Extension: (A Journey through Middle-earth) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\gjgkjeheegjnnmheaflhdocglkiegoni [2014-04-20]
CHR Extension: (d3coder) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\gncnbkghencmkfgeepfaonmegemakcol [2014-06-13]
CHR Extension: (FlashBlock) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\gofhjkjmkpinhpoiabjplobcaignabnl [2014-04-20]
CHR Extension: (avast! Online Security) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-20]
CHR Extension: (Pin It Button) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic [2014-07-10]
CHR Extension: (RealPlayer Downloader) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-04-20]
CHR Extension: (Lab Ray Logger by Jellyneo) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\iepcfehgcfcoildehjncoefphpdfahhp [2014-08-02]
CHR Extension: (Google Wallet) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-20]
CHR Extension: (ImTranslator: Google Translate) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\noaijdpnepcgjemiklgfkcfbkokogabh [2014-08-08]
CHR Extension: (Link Revealer) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\nphhadgebjlmcfleikmiedhohdfbfoin [2014-04-20]
CHR Extension: (Tumblr Savior) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\oefddkjnflmjbclpnnoegglmmdfkidip [2014-04-20]
CHR Extension: (Abstract-Blue) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Default\Extensions\plnacehkknmafkjgkikclamogikoiaaa [2014-04-20]
CHR Profile: C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1
CHR Extension: (Google Docs) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\aohghmighlieiainnegkcijnfilokake [2014-04-20]
CHR Extension: (Google Drive) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-04-20]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-28]
CHR Extension: (YouTube) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-04-20]
CHR Extension: (Google Search) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-04-20]
CHR Extension: (avast! SafePrice) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\eofcbnmajmjmplflapaojjnihcjkigck [2014-08-11]
CHR Extension: (AdBlock) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gighmmpiobklfepjocnamgkkbiglidom [2014-04-23]
CHR Extension: (avast! Online Security) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-04-20]
CHR Extension: (RealPlayer Downloader) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\idhngdhcfkoamngbedgpaokgjbnpdiji [2014-04-21]
CHR Extension: (Google Wallet) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-20]
CHR Extension: (Gmail) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-04-20]
CHR Extension: (Wernicke) - C:\Users\Hayley\AppData\Local\Google\Chrome\User Data\Profile 1\Extensions\ppaffecefbompkhfipbekcfkbnlpkhlk [2014-06-09]
CHR HKLM-x32\...\Chrome\Extension: [eofcbnmajmjmplflapaojjnihcjkigck] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswwebrepchrome-sp.crx [2014-08-04]
CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-07-07]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2014-06-10]


==================== Services (Whitelisted) =================


(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)


R2 !SASCORE; C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE [172344 2014-08-13] (SUPERAntiSpyware.com)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-07-07] (AVAST Software)
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2369720 2014-08-01] (Microsoft Corporation)
R2 CyberLink PowerDVD 12 Media Server Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSMonitorServicePDVD12.exe [77576 2013-10-17] (CyberLink)
R2 CyberLink PowerDVD 12 Media Server Service; C:\Program Files (x86)\CyberLink\PowerDVD12\Kernel\DMS\CLMSServerPDVD12.exe [298760 2013-10-17] (CyberLink)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-12-16] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-12-25] (Hewlett-Packard Development Company, L.P.)
R2 IAStorDataMgrSvc; C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [15720 2014-04-24] (Intel Corporation)
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [733696 2013-05-11] (Intel(R) Corporation) [File not signed]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [822232 2013-05-11] (Intel(R) Corporation)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [131544 2013-09-03] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-03] (Intel Corporation)
R3 KeyIso; C:\Windows\SysWOW64\keyiso.dll [44032 2013-08-21] (Microsoft Corporation)
S3 lfsvc; C:\Windows\SysWOW64\GeofenceMonitorService.dll [357376 2014-03-13] (Microsoft Corporation)
S3 Netlogon; C:\Windows\SysWOW64\netlogon.dll [688640 2014-03-05] (Microsoft Corporation)
R2 omniserv; C:\Program Files\Hewlett-Packard\SimplePass\OmniServ.exe [87552 2013-10-14] (Softex Inc.) [File not signed]
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39568 2014-06-10] ()
R2 RealPlayer Cloud Service; c:\program files (x86)\real\realplayer\RPDS\Bin\rpdsvc.exe [1141848 2014-06-28] (RealNetworks, Inc.)
R2 RealPlayerUpdateSvc; C:\Program Files (x86)\Real\UpdateService\RealPlayerUpdateSvc.exe [23552 2014-06-10] () [File not signed]
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [289496 2013-10-16] (Realtek Semiconductor)
S3 smphost; C:\Windows\SysWOW64\smphost.dll [11776 2013-08-21] (Microsoft Corporation)
S3 StorSvc; C:\Windows\SysWOW64\storsvc.dll [18944 2013-08-21] (Microsoft Corporation)
S3 TunnelBearMaintenance; C:\Program Files (x86)\TunnelBear\TBear.Maintenance.exe [25536 2014-05-28] ()
S3 w3logsvc; C:\Windows\system32\inetsrv\w3logsvc.dll [76800 2013-08-25] (Microsoft Corporation)
R2 WDBackup; C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [1042808 2014-07-22] (Western Digital Technologies, Inc.)
R2 WDDriveService; C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [296312 2014-06-02] (Western Digital Technologies, Inc.)
S3 WdNisSvc; C:\Program Files\Windows Defender\NisSrv.exe [347880 2014-03-23] (Microsoft Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [23824 2014-03-23] (Microsoft Corporation)


==================== Drivers (Whitelisted) ====================


(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)


R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-07-07] ()
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-07-07] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-07-07] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-07-07] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1041168 2014-07-07] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-09-13] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-07-07] (AVAST Software)
S3 aswTap; C:\Windows\system32\DRIVERS\aswTap.sys [44640 2014-04-20] (The OpenVPN Project)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-07-07] ()
R1 CLVirtualDrive; C:\Windows\system32\DRIVERS\CLVirtualDrive.sys [91712 2013-03-05] (CyberLink)
S3 dot4; C:\Windows\system32\DRIVERS\Dot4.sys [151968 2012-10-19] (Windows (R) Win 7 DDK provider)
S3 Dot4Print; C:\Windows\System32\drivers\Dot4Prt.sys [27040 2012-10-19] (Windows (R) Win 7 DDK provider)
R3 MEIx64; C:\Windows\system32\DRIVERS\TeeDriverx64.sys [99288 2013-12-19] (Intel Corporation)
R3 RTSPER; C:\Windows\system32\DRIVERS\RtsPer.sys [429272 2013-08-21] (Realsil Semiconductor Corporation)
R3 RTWlanE; C:\Windows\system32\DRIVERS\rtwlane.sys [3068120 2014-04-21] (Realtek Semiconductor Corporation                           )
R1 SASDIFSV; C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS [14928 2011-07-22] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
R1 SASKUTIL; C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS [12368 2011-07-12] (SUPERAdBlocker.com and SUPERAntiSpyware.com)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [30448 2013-07-26] (Synaptics Incorporated)
R3 SmbDrvI; C:\Windows\system32\DRIVERS\Smb_driver_Intel.sys [34544 2013-07-26] (Synaptics Incorporated)
S3 WdNisDrv; C:\Windows\System32\Drivers\WdNisDrv.sys [123224 2014-03-23] (Microsoft Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2013-07-22] (Hewlett-Packard Development Company, L.P.)
U3 McMPFSvc; No ImagePath
U3 McNaiAnn; No ImagePath
U3 mfecore; No ImagePath
U3 MSK80Service; No ImagePath


==================== NetSvcs (Whitelisted) ===================


(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)




==================== One Month Created Files and Folders ========


(If an entry is included in the fixlist, the file\folder will be moved.)


2014-09-20 17:25 - 2014-09-20 23:09 - 00032175 _____ () C:\Users\Hayley\Desktop\FRST.txt
2014-09-20 17:25 - 2014-09-20 23:09 - 00000000 ____D () C:\FRST
2014-09-20 17:25 - 2014-09-20 17:33 - 00042926 _____ () C:\Users\Hayley\Desktop\Addition.txt
2014-09-20 17:24 - 2014-09-20 17:24 - 02105856 _____ (Farbar) C:\Users\Hayley\Desktop\FRST64.exe
2014-09-19 10:46 - 2014-08-28 18:58 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-09-19 10:46 - 2014-08-28 18:32 - 02779136 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-09-19 10:46 - 2014-08-28 17:59 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-09-19 10:46 - 2014-08-28 16:56 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-09-19 10:46 - 2014-08-28 16:47 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-09-19 10:46 - 2014-08-25 15:27 - 04148736 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-09-19 10:46 - 2014-08-15 21:08 - 21195616 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-09-19 10:46 - 2014-08-15 21:08 - 01507648 _____ (Microsoft Corporation) C:\Windows\system32\propsys.dll
2014-09-19 10:46 - 2014-08-15 21:01 - 01710184 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-09-19 10:46 - 2014-08-15 20:58 - 01112512 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-09-19 10:46 - 2014-08-15 20:57 - 02498880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-09-19 10:46 - 2014-08-15 20:57 - 00428864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-09-19 10:46 - 2014-08-15 20:16 - 18722600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-09-19 10:46 - 2014-08-15 20:16 - 01205976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\propsys.dll
2014-09-19 10:46 - 2014-08-15 20:03 - 01467384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
2014-09-19 10:46 - 2014-08-15 18:31 - 00838144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-09-19 10:46 - 2014-08-15 18:04 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\Wldap32.dll
2014-09-19 10:46 - 2014-08-15 17:58 - 00287744 _____ (Microsoft Corporation) C:\Windows\system32\SystemEventsBrokerServer.dll
2014-09-19 10:46 - 2014-08-15 17:53 - 00118272 _____ (Microsoft Corporation) C:\Windows\system32\httpprxm.dll
2014-09-19 10:46 - 2014-08-15 17:46 - 00290816 _____ (Microsoft Corporation) C:\Windows\system32\ProximityService.dll
2014-09-19 10:46 - 2014-08-15 17:45 - 00267776 _____ (Microsoft Corporation) C:\Windows\system32\bisrv.dll
2014-09-19 10:46 - 2014-08-15 17:43 - 00321024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wldap32.dll
2014-09-19 10:46 - 2014-08-15 17:43 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\adhsvc.dll
2014-09-19 10:46 - 2014-08-15 17:31 - 00914432 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll
2014-09-19 10:46 - 2014-08-15 17:31 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\pcsvDevice.dll
2014-09-19 10:46 - 2014-08-15 17:29 - 00249344 _____ (Microsoft Corporation) C:\Windows\system32\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-19 10:46 - 2014-08-15 17:23 - 01106432 _____ (Microsoft Corporation) C:\Windows\system32\SearchFolder.dll
2014-09-19 10:46 - 2014-08-15 17:22 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveTelemetry.dll
2014-09-19 10:46 - 2014-08-15 17:22 - 00286208 _____ (Microsoft Corporation) C:\Windows\system32\SkyDriveShell.dll
2014-09-19 10:46 - 2014-08-15 17:20 - 00921600 _____ (Microsoft Corporation) C:\Windows\system32\MrmCoreR.dll
2014-09-19 10:46 - 2014-08-15 17:19 - 00189952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.ApplicationModel.Store.TestingFramework.dll
2014-09-19 10:46 - 2014-08-15 17:18 - 04758528 _____ (Microsoft Corporation) C:\Windows\system32\SyncEngine.dll
2014-09-19 10:46 - 2014-08-15 17:17 - 08757760 _____ (Microsoft Corporation) C:\Windows\system32\Windows.UI.Search.dll
2014-09-19 10:46 - 2014-08-15 17:14 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SkyDriveShell.dll
2014-09-19 10:46 - 2014-08-15 17:13 - 06649344 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-09-19 10:46 - 2014-08-15 17:13 - 05902848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Windows.UI.Search.dll
2014-09-19 10:46 - 2014-08-15 17:13 - 00840192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SearchFolder.dll
2014-09-19 10:46 - 2014-08-15 17:11 - 00920064 _____ (Microsoft Corporation) C:\Windows\system32\WSShared.dll
2014-09-19 10:46 - 2014-08-15 17:11 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MrmCoreR.dll
2014-09-19 10:46 - 2014-08-15 17:10 - 01120768 _____ (Microsoft Corporation) C:\Windows\system32\SkyDrive.exe
2014-09-19 10:46 - 2014-08-15 17:08 - 05777408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-09-19 10:46 - 2014-08-15 17:07 - 00756224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSShared.dll
2014-09-19 10:46 - 2014-07-31 16:22 - 00388729 _____ () C:\Windows\system32\ApnDatabase.xml
2014-09-19 09:53 - 2014-09-19 09:53 - 00688992 _____ (Swearware) C:\Users\Hayley\Downloads\dds.com
2014-09-19 08:28 - 2014-09-20 18:37 - 00197065 _____ () C:\Windows\WindowsUpdate.log
2014-09-19 08:28 - 2014-09-19 08:28 - 00000794 _____ () C:\Windows\setupact.log
2014-09-19 08:28 - 2014-09-19 08:28 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-17 16:50 - 2014-09-17 16:51 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-17 16:12 - 2014-09-17 16:12 - 12789816 _____ () C:\Users\Hayley\Downloads\Warriors-MP3.zip
2014-09-15 17:41 - 2014-09-15 17:41 - 01508744 _____ () C:\Users\Hayley\Downloads\TS102787940.potx
2014-09-15 17:40 - 2014-09-15 17:40 - 00672932 _____ () C:\Users\Hayley\Downloads\TP010288567.cab
2014-09-15 16:44 - 2014-09-15 16:44 - 00001802 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-09-15 16:44 - 2014-09-15 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-15 16:43 - 2014-09-15 16:44 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-15 16:43 - 2014-09-15 16:44 - 00000000 ____D () C:\Program Files\iTunes
2014-09-15 16:43 - 2014-09-15 16:44 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-09-15 16:43 - 2014-09-15 16:43 - 00000000 ____D () C:\Program Files\iPod
2014-09-15 13:38 - 2014-09-15 13:38 - 00020874 _____ () C:\Users\Hayley\Downloads\TLL-MitchellLevy-MichaelProcopio-039TeCoineMarkBabbitt-13Sep14.xlsx
2014-09-15 12:38 - 2014-09-19 07:52 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-15 12:38 - 2014-09-15 12:38 - 00002046 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-09-15 12:37 - 2014-09-15 12:40 - 00000000 ____D () C:\ProgramData\Adobe
2014-09-15 12:37 - 2014-09-15 12:37 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-09-15 11:13 - 2014-09-15 11:13 - 00646404 _____ () C:\Users\Hayley\Downloads\TS103978743.dotx
2014-09-15 07:51 - 2014-08-23 00:48 - 02374784 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-09-15 07:51 - 2014-08-23 00:13 - 02084520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2014-09-15 07:51 - 2014-08-22 23:10 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-09-15 07:51 - 2014-08-22 22:32 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-09-15 07:51 - 2014-08-22 21:44 - 02860032 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-09-15 07:51 - 2014-08-22 21:34 - 13423104 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-09-15 07:51 - 2014-08-22 21:33 - 00796672 _____ (Microsoft Corporation) C:\Windows\system32\uDWM.dll
2014-09-15 07:51 - 2014-08-22 21:31 - 01038336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-09-15 07:51 - 2014-08-22 21:20 - 11818496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-09-15 07:51 - 2014-08-14 17:36 - 00146752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\msgpioclx.sys
2014-09-15 07:51 - 2014-07-29 18:56 - 00299520 _____ (Microsoft Corporation) C:\Windows\system32\WSDMon.dll
2014-09-15 07:51 - 2014-07-28 22:22 - 00205824 _____ (Microsoft Corporation) C:\Windows\system32\tcpmon.dll
2014-09-13 23:21 - 2014-09-13 23:21 - 04901352 _____ (Piriform Ltd) C:\Users\Hayley\Downloads\ccsetup417.exe
2014-09-13 23:01 - 2014-09-19 11:51 - 00003374 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3914294095-3043128761-1344380093-1001
2014-09-13 23:01 - 2014-09-19 11:51 - 00003322 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3914294095-3043128761-1344380093-1001
2014-09-13 22:43 - 2014-09-13 22:43 - 04862664 _____ (AVAST Software) C:\Users\Hayley\Downloads\avast_free_antivirus_setup_online.exe
2014-09-13 11:28 - 2014-09-13 11:30 - 00001450 _____ () C:\Users\Hayley\Desktop\Internet Explorer.lnk
2014-09-12 07:48 - 2014-09-02 13:06 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-12 07:48 - 2014-09-02 13:06 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-11 15:53 - 2014-09-11 15:53 - 00000727 _____ () C:\Users\Hayley\Documents\Desktop - Shortcut.lnk
2014-09-11 15:53 - 2014-09-11 15:53 - 00000000 ____D () C:\Users\Hayley\Downloads\New folder
2014-09-11 15:40 - 2014-08-15 19:40 - 23591424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-11 15:40 - 2014-08-15 19:04 - 17455104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-11 15:40 - 2014-08-15 19:00 - 05833728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-11 15:40 - 2014-08-15 19:00 - 02793984 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-11 15:40 - 2014-08-15 18:56 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-11 15:40 - 2014-08-15 18:54 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-09-11 15:40 - 2014-08-15 18:45 - 04232704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-11 15:40 - 2014-08-15 18:43 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-09-11 15:40 - 2014-08-15 18:32 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-11 15:40 - 2014-08-15 18:25 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-09-11 15:40 - 2014-08-15 18:22 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-11 15:40 - 2014-08-15 18:20 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-09-11 15:40 - 2014-08-15 18:19 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-11 15:40 - 2014-08-15 18:18 - 02185728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-11 15:40 - 2014-08-15 18:18 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-11 15:40 - 2014-08-15 18:11 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-09-11 15:40 - 2014-08-15 18:06 - 00359424 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-09-11 15:40 - 2014-08-15 18:05 - 00727040 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-11 15:40 - 2014-08-15 18:05 - 00707072 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-09-11 15:40 - 2014-08-15 18:03 - 02104832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-11 15:40 - 2014-08-15 18:03 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-11 15:40 - 2014-08-15 17:58 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-09-11 15:40 - 2014-08-15 17:56 - 02310656 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-11 15:40 - 2014-08-15 17:53 - 13588480 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-11 15:40 - 2014-08-15 17:53 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-11 15:40 - 2014-08-15 17:53 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-11 15:40 - 2014-08-15 17:51 - 11769856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-11 15:40 - 2014-08-15 17:45 - 00603136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-11 15:40 - 2014-08-15 17:44 - 02014208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-11 15:40 - 2014-08-15 17:44 - 00312320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-09-11 15:40 - 2014-08-15 17:34 - 01447424 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-11 15:40 - 2014-08-15 17:20 - 01812992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-11 15:40 - 2014-08-15 17:18 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-09-11 15:40 - 2014-08-15 17:14 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-11 15:40 - 2014-08-15 17:12 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-09-11 08:20 - 2014-09-04 19:36 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-09-11 08:20 - 2014-09-04 19:31 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 08:20 - 2014-09-04 17:48 - 00738816 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 08:19 - 2014-07-23 20:20 - 00875688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msvcr120_clr0400.dll
2014-09-11 08:19 - 2014-07-23 20:20 - 00869544 _____ (Microsoft Corporation) C:\Windows\system32\msvcr120_clr0400.dll
2014-09-11 08:17 - 2014-08-01 17:18 - 01212928 _____ (Microsoft Corporation) C:\Windows\system32\schedsvc.dll
2014-09-09 10:40 - 2014-09-09 10:40 - 10036224 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-09-08 15:08 - 2014-09-08 15:08 - 00027193 _____ () C:\Users\Hayley\Downloads\GershonMader-AhaAmplifier-4Sept2014.xlsx
2014-09-08 11:58 - 2014-09-08 11:58 - 00020048 _____ () C:\Users\Hayley\Downloads\TLL-MitchellLevy-MichaelProcopio-038 JimCahill-05Sep14ml.xlsx
2014-09-07 10:00 - 2014-09-07 10:00 - 19010163 _____ () C:\Users\Hayley\Downloads\Attachments_201497.zip
2014-09-04 11:22 - 2014-09-04 11:22 - 00032183 _____ () C:\Users\Hayley\Downloads\MikeAgron-AhaAmplifier-3Sept14.xlsx
2014-09-01 21:12 - 2014-09-03 19:43 - 00000000 ____D () C:\Users\Hayley\Documents\Hannah's Stuff
2014-09-01 15:54 - 2014-09-01 15:54 - 00305332 _____ () C:\Users\Hayley\Downloads\Attachments_201491.zip
2014-09-01 14:50 - 2014-09-01 14:50 - 00024709 _____ () C:\Users\Hayley\Downloads\FrankSonnenberg-AhaAmplifier-28August2014.xlsx
2014-08-31 22:27 - 2014-08-31 22:27 - 00000000 ____D () C:\Users\Hayley\Documents\Nancy Drew
2014-08-31 08:25 - 2014-08-31 08:25 - 00021789 _____ () C:\Users\Hayley\Downloads\TLL-MitchellLevy-MichaelProcopio-037 WhitneyVosburgh-30Aug14.xlsx
2014-08-29 08:37 - 2014-08-29 08:37 - 00689204 _____ () C:\Users\Hayley\Downloads\1024by768_robot_day_2006.zip
2014-08-29 08:37 - 2014-08-29 08:37 - 00648062 _____ () C:\Users\Hayley\Downloads\800by600_robot_day_2006.zip
2014-08-25 16:56 - 2014-09-17 19:06 - 00000000 ____D () C:\Users\Hayley\Documents\Josh's Stuff
2014-08-23 15:44 - 2014-08-23 15:44 - 00020879 _____ () C:\Users\Hayley\Downloads\TLL-MitchellLevy-MichaelProcopio-036Tatyana Kanzaveli-23Aug14.xlsx


==================== One Month Modified Files and Folders =======


(If an entry is included in the fixlist, the file\folder will be moved.)


2014-09-20 23:09 - 2014-09-20 17:25 - 00032175 _____ () C:\Users\Hayley\Desktop\FRST.txt
2014-09-20 23:09 - 2014-09-20 17:25 - 00000000 ____D () C:\FRST
2014-09-20 23:00 - 2013-08-22 08:36 - 00000000 ____D () C:\Windows\system32\sru
2014-09-20 22:40 - 2014-04-23 11:30 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-09-20 22:10 - 2014-04-20 22:55 - 00000926 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-09-20 19:27 - 2014-04-20 23:37 - 00000000 ____D () C:\Program Files\SUPERAntiSpyware
2014-09-20 18:37 - 2014-09-19 08:28 - 00197065 _____ () C:\Windows\WindowsUpdate.log
2014-09-20 17:45 - 2014-04-20 22:16 - 00003950 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{3473DA11-7BE2-4853-9C36-4D96D4ADE47E}
2014-09-20 17:33 - 2014-09-20 17:25 - 00042926 _____ () C:\Users\Hayley\Desktop\Addition.txt
2014-09-20 17:24 - 2014-09-20 17:24 - 02105856 _____ (Farbar) C:\Users\Hayley\Desktop\FRST64.exe
2014-09-19 12:41 - 2014-04-20 22:13 - 00000000 ____D () C:\Users\Hayley\AppData\Local\Packages
2014-09-19 11:58 - 2014-04-20 22:19 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-3914294095-3043128761-1344380093-1001
2014-09-19 11:52 - 2014-04-20 22:15 - 00000000 ____D () C:\Users\Hayley\Documents\Youcam
2014-09-19 11:51 - 2014-09-13 23:01 - 00003374 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeScheduledTaskS-1-5-21-3914294095-3043128761-1344380093-1001
2014-09-19 11:51 - 2014-09-13 23:01 - 00003322 _____ () C:\Windows\System32\Tasks\RealDownloaderRealUpgradeLogonTaskS-1-5-21-3914294095-3043128761-1344380093-1001
2014-09-19 11:51 - 2014-04-29 19:18 - 00008192 _____ () C:\Windows\SysWOW64\WDPABKP.dat
2014-09-19 11:51 - 2014-04-20 22:55 - 00000922 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-09-19 11:51 - 2014-04-20 22:39 - 00000000 ___DO () C:\Users\Hayley\SkyDrive
2014-09-19 11:43 - 2013-08-22 08:36 - 00000000 ____D () C:\Windows\rescache
2014-09-19 11:29 - 2013-08-22 07:45 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-19 11:29 - 2013-08-22 07:44 - 00495664 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-09-19 11:27 - 2014-04-20 22:18 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-19 11:27 - 2013-08-22 06:25 - 00524288 ___SH () C:\Windows\system32\config\BBI
2014-09-19 11:26 - 2013-08-22 08:36 - 00000000 ___RD () C:\Windows\ToastData
2014-09-19 11:26 - 2013-08-22 08:36 - 00000000 ____D () C:\Windows\WinStore
2014-09-19 10:48 - 2013-08-22 08:20 - 00000000 ____D () C:\Windows\CbsTemp
2014-09-19 09:53 - 2014-09-19 09:53 - 00688992 _____ (Swearware) C:\Users\Hayley\Downloads\dds.com
2014-09-19 08:31 - 2013-08-25 23:09 - 00958356 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-19 08:28 - 2014-09-19 08:28 - 00000794 _____ () C:\Windows\setupact.log
2014-09-19 08:28 - 2014-09-19 08:28 - 00000000 _____ () C:\Windows\setuperr.log
2014-09-19 08:28 - 2013-08-22 08:36 - 00000000 ____D () C:\Windows\AppReadiness
2014-09-19 08:19 - 2014-07-07 19:27 - 00000000 ____D () C:\Windows\Minidump
2014-09-19 07:58 - 2014-04-20 23:22 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-19 07:52 - 2014-09-15 12:38 - 00002457 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-09-19 00:08 - 2014-04-20 22:13 - 00000000 ____D () C:\Users\Hayley
2014-09-18 22:35 - 2014-06-08 23:24 - 00000000 ____D () C:\Users\Hayley\AppData\Roaming\Audacity
2014-09-18 10:23 - 2013-08-22 08:36 - 00000000 ____D () C:\Windows\system32\NDF
2014-09-18 09:50 - 2014-04-25 23:58 - 00000000 ____D () C:\Users\Hayley\Documents\Miscellaneous
2014-09-17 19:06 - 2014-08-25 16:56 - 00000000 ____D () C:\Users\Hayley\Documents\Josh's Stuff
2014-09-17 16:51 - 2014-09-17 16:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-17 16:12 - 2014-09-17 16:12 - 12789816 _____ () C:\Users\Hayley\Downloads\Warriors-MP3.zip
2014-09-15 18:45 - 2014-04-21 18:10 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-09-15 18:44 - 2014-04-21 18:10 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-09-15 17:41 - 2014-09-15 17:41 - 01508744 _____ () C:\Users\Hayley\Downloads\TS102787940.potx
2014-09-15 17:40 - 2014-09-15 17:40 - 00672932 _____ () C:\Users\Hayley\Downloads\TP010288567.cab
2014-09-15 16:44 - 2014-09-15 16:44 - 00001802 _____ () C:\Users\Public\Desktop\iTunes.lnk
2014-09-15 16:44 - 2014-09-15 16:44 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
2014-09-15 16:44 - 2014-09-15 16:43 - 00000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2014-09-15 16:44 - 2014-09-15 16:43 - 00000000 ____D () C:\Program Files\iTunes
2014-09-15 16:44 - 2014-09-15 16:43 - 00000000 ____D () C:\Program Files (x86)\iTunes
2014-09-15 16:43 - 2014-09-15 16:43 - 00000000 ____D () C:\Program Files\iPod
2014-09-15 13:38 - 2014-09-15 13:38 - 00020874 _____ () C:\Users\Hayley\Downloads\TLL-MitchellLevy-MichaelProcopio-039TeCoineMarkBabbitt-13Sep14.xlsx
2014-09-15 12:40 - 2014-09-15 12:37 - 00000000 ____D () C:\ProgramData\Adobe
2014-09-15 12:40 - 2014-04-23 11:29 - 00000000 ____D () C:\Users\Hayley\AppData\Local\Adobe
2014-09-15 12:40 - 2014-04-20 22:14 - 00000000 ____D () C:\Users\Hayley\AppData\Roaming\Adobe
2014-09-15 12:38 - 2014-09-15 12:38 - 00002046 _____ () C:\Users\Public\Desktop\Adobe Reader XI.lnk
2014-09-15 12:37 - 2014-09-15 12:37 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-09-15 11:13 - 2014-09-15 11:13 - 00646404 _____ () C:\Users\Hayley\Downloads\TS103978743.dotx
2014-09-13 23:22 - 2014-04-21 16:33 - 00000801 _____ () C:\Users\Public\Desktop\CCleaner.lnk
2014-09-13 23:22 - 2014-04-21 16:33 - 00000000 ____D () C:\Program Files\CCleaner
2014-09-13 23:21 - 2014-09-13 23:21 - 04901352 _____ (Piriform Ltd) C:\Users\Hayley\Downloads\ccsetup417.exe
2014-09-13 22:46 - 2014-05-07 08:53 - 00001949 _____ () C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2014-09-13 22:46 - 2014-04-20 23:14 - 00003924 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-09-13 22:46 - 2014-04-20 23:13 - 00427360 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-09-13 22:43 - 2014-09-13 22:43 - 04862664 _____ (AVAST Software) C:\Users\Hayley\Downloads\avast_free_antivirus_setup_online.exe
2014-09-13 11:30 - 2014-09-13 11:28 - 00001450 _____ () C:\Users\Hayley\Desktop\Internet Explorer.lnk
2014-09-12 07:44 - 2014-07-09 23:55 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-11 15:53 - 2014-09-11 15:53 - 00000727 _____ () C:\Users\Hayley\Documents\Desktop - Shortcut.lnk
2014-09-11 15:53 - 2014-09-11 15:53 - 00000000 ____D () C:\Users\Hayley\Downloads\New folder
2014-09-11 15:41 - 2014-06-11 15:23 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-11 15:41 - 2014-06-11 15:15 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-11 15:41 - 2014-06-11 15:15 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-09-11 15:41 - 2014-06-11 15:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-09-11 15:41 - 2014-06-11 15:15 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-09-11 15:41 - 2014-04-21 23:46 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-11 15:41 - 2014-04-21 23:46 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-11 15:40 - 2014-06-11 15:23 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-11 15:40 - 2014-04-22 11:11 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-11 15:30 - 2014-04-22 11:11 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-09 10:40 - 2014-09-09 10:40 - 10036224 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-09-09 10:40 - 2014-04-23 11:30 - 00003718 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-08 15:08 - 2014-09-08 15:08 - 00027193 _____ () C:\Users\Hayley\Downloads\GershonMader-AhaAmplifier-4Sept2014.xlsx
2014-09-08 11:58 - 2014-09-08 11:58 - 00020048 _____ () C:\Users\Hayley\Downloads\TLL-MitchellLevy-MichaelProcopio-038 JimCahill-05Sep14ml.xlsx
2014-09-08 11:46 - 2014-04-23 11:44 - 00000000 ____D () C:\Users\Hayley\Documents\oDesk
2014-09-07 10:00 - 2014-09-07 10:00 - 19010163 _____ () C:\Users\Hayley\Downloads\Attachments_201497.zip
2014-09-06 19:39 - 2014-04-20 23:42 - 00000000 ____D () C:\Users\Hayley\AppData\Roaming\Real
2014-09-06 19:19 - 2014-08-11 11:46 - 00000000 ____D () C:\Users\Hayley\AppData\Local\Microsoft Help
2014-09-04 19:36 - 2014-09-11 08:20 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll
2014-09-04 19:31 - 2014-09-11 08:20 - 00527360 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-04 17:48 - 2014-09-11 08:20 - 00738816 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-04 11:22 - 2014-09-04 11:22 - 00032183 _____ () C:\Users\Hayley\Downloads\MikeAgron-AhaAmplifier-3Sept14.xlsx
2014-09-03 19:43 - 2014-09-01 21:12 - 00000000 ____D () C:\Users\Hayley\Documents\Hannah's Stuff
2014-09-02 13:06 - 2014-09-12 07:48 - 00706016 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-02 13:06 - 2014-09-12 07:48 - 00105440 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-01 15:54 - 2014-09-01 15:54 - 00305332 _____ () C:\Users\Hayley\Downloads\Attachments_201491.zip
2014-09-01 14:50 - 2014-09-01 14:50 - 00024709 _____ () C:\Users\Hayley\Downloads\FrankSonnenberg-AhaAmplifier-28August2014.xlsx
2014-08-31 22:28 - 2014-04-22 08:28 - 00000000 ____D () C:\Users\Hayley\Documents\Old Laptop
2014-08-31 22:27 - 2014-08-31 22:27 - 00000000 ____D () C:\Users\Hayley\Documents\Nancy Drew
2014-08-31 08:25 - 2014-08-31 08:25 - 00021789 _____ () C:\Users\Hayley\Downloads\TLL-MitchellLevy-MichaelProcopio-037 WhitneyVosburgh-30Aug14.xlsx
2014-08-29 08:37 - 2014-08-29 08:37 - 00689204 _____ () C:\Users\Hayley\Downloads\1024by768_robot_day_2006.zip
2014-08-29 08:37 - 2014-08-29 08:37 - 00648062 _____ () C:\Users\Hayley\Downloads\800by600_robot_day_2006.zip
2014-08-29 07:23 - 2014-04-23 09:55 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-08-28 18:58 - 2014-09-19 10:46 - 00109568 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll
2014-08-28 18:32 - 2014-09-19 10:46 - 02779136 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-28 17:59 - 2014-09-19 10:46 - 03117568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-28 16:56 - 2014-09-19 10:46 - 02646016 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-28 16:47 - 2014-09-19 10:46 - 02321920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-25 15:27 - 2014-09-19 10:46 - 04148736 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-23 15:44 - 2014-08-23 15:44 - 00020879 _____ () C:\Users\Hayley\Downloads\TLL-MitchellLevy-MichaelProcopio-036Tatyana Kanzaveli-23Aug14.xlsx
2014-08-23 00:48 - 2014-09-15 07:51 - 02374784 _____ (Microsoft Corporation) C:\Windows\explorer.exe
2014-08-23 00:13 - 2014-09-15 07:51 - 02084520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\explorer.exe
2014-08-22 23:10 - 2014-09-15 07:51 - 00068096 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-08-22 22:32 - 2014-09-15 07:51 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-08-22 21:44 - 2014-09-15 07:51 - 02860032 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-08-22 21:34 - 2014-09-15 07:51 - 13423104 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-08-22 21:33 - 2014-09-15 07:51 - 00796672 _____ (Microsoft Corporation) C:\Windows\system32\uDWM.dll
2014-08-22 21:31 - 2014-09-15 07:51 - 01038336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-08-22 21:20 - 2014-09-15 07:51 - 11818496 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-08-21 14:55 - 2014-05-18 22:29 - 00000000 ____D () C:\Users\Hayley\Documents\Writings


==================== Bamital & volsnap Check =================


(There is no automatic fix for files that do not pass verification.)


C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed




LastRegBack: 2014-09-17 17:09


==================== End Of Log ============================

Attached Files


Edited by GreenAnteater, 21 September 2014 - 01:13 AM.


#4 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:09 AM

Posted 21 September 2014 - 10:42 AM

Please do this next:

icon11.gif   Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it in the same location as FRST (usually your desktop) as fixlist.txt

U3 McMPFSvc; No ImagePath
U3 McNaiAnn; No ImagePath
U3 mfecore; No ImagePath
U3 MSK80Service; No ImagePath
Folder: C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
Folder: C:\Windows\system32\sru
EmptyTemp:
NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Now run FRST again.
  • When the tool opens click Yes to disclaimer.
  • Press the Fix button just once and wait.
  • The tool will make a log (Fixlog.txt) please post it to your reply.

icon11.gif   Run FRST again.
  • When the tool opens click Yes to disclaimer.
  • Enter the following into the search box:  cachesrvr.exe
  • Press the Search File(s) button
  • The tool will make another log (Search.txt) please post it to your reply.

Please include the following in your next post:
  • fixlog.txt Report
  • Search.txt Report

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#5 GreenAnteater

GreenAnteater
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:09 AM

Posted 21 September 2014 - 11:35 AM

After creating the txt file and running FRST, it restarted the computer. The restart took longer than usual to get back to the desktop. 

 

Here is the fixlog.txt Report:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-09-2014
Ran by Hayley at 2014-09-21 09:19:03 Run:1
Running from C:\Users\Hayley\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
U3 McMPFSvc; No ImagePath
U3 McNaiAnn; No ImagePath
U3 mfecore; No ImagePath
U3 MSK80Service; No ImagePath
Folder: C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
Folder: C:\Windows\system32\sru
EmptyTemp:
*****************

McMPFSvc => Service deleted successfully.
McNaiAnn => Service deleted successfully.
mfecore => Service deleted successfully.
MSK80Service => Service deleted successfully.

========================= Folder: C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 ========================

2012-08-21 13:01 - 2012-08-21 13:01 - 1977816 _____ (GEAR Software, Inc.) C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\GEARDIFx.exe
2014-09-15 16:44 - 2014-09-15 16:44 - 0000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64
2012-08-21 13:01 - 2012-08-21 13:01 - 0519048 _____ (Microsoft Corporation) C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\DIFxAPI.dll
2012-08-21 13:01 - 2012-08-21 13:01 - 0131544 _____ (GEAR Software, Inc.) C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\DifXInst64.exe
2014-09-15 16:44 - 2014-09-15 16:44 - 0004842 _____ () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\DIFxInstallLog.txt
2012-08-21 13:01 - 2012-08-21 13:01 - 0106928 _____ (GEAR Software Inc.) C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\GEARAspi.dll
2012-08-21 13:01 - 2012-08-21 13:01 - 0125872 _____ (GEAR Software Inc.) C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\GEARAspi64.dll
2012-08-21 13:01 - 2012-08-21 13:01 - 0002561 _____ () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\GEARAspiWDM.inf
2012-08-21 13:01 - 2012-08-21 13:01 - 0007638 _____ () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\gearaspiwdmx64.cat
2014-09-15 16:44 - 2014-09-15 16:44 - 0000000 ____D () C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\x64
2012-08-21 13:01 - 2012-08-21 13:01 - 0033240 _____ (GEAR Software Inc.) C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69\x64\x64\GEARAspiWDM.sys

====== End of Folder: ======


========================= Folder: C:\Windows\system32\sru ========================

2014-01-17 17:00 - 2014-09-20 23:02 - 0008192 _____ () C:\Windows\system32\sru\SRU.chk
2014-01-17 17:00 - 2014-09-21 09:17 - 0065536 _____ () C:\Windows\system32\sru\SRU.log
2014-01-17 17:00 - 2014-09-21 09:17 - 0065536 _____ () C:\Windows\system32\sru\SRU00DDA.log
2014-01-17 17:00 - 2014-09-21 09:17 - 25698304 _____ () C:\Windows\system32\sru\SRUDB.dat
2014-01-17 17:00 - 2014-01-17 17:00 - 0065536 _____ () C:\Windows\system32\sru\SRUres00001.jrs
2014-01-17 17:00 - 2014-01-17 17:00 - 0065536 _____ () C:\Windows\system32\sru\SRUres00002.jrs
2014-01-17 17:00 - 2014-09-20 23:00 - 0065536 _____ () C:\Windows\system32\sru\SRUtmp.log

====== End of Folder: ======

EmptyTemp: => Removed 574 MB temporary data.


The system needed a reboot. 

==== End of Fixlog ====

And here is the Search.txt Report:

Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Hayley at 2014-09-21 09:23:40
Running from C:\Users\Hayley\Desktop
Boot Mode: Normal

================== Search Files: "cachesrvr.exe" =============

====== End Of Search ======


#6 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:09 AM

Posted 21 September 2014 - 09:46 PM

Please do this next:

icon11.gif  Open Malwarebytes AntiMalware (MBAM)

  • On the Settings tab > Detection and Protection subtab, Detection Options, tick the box 'Scan for rootkits'.
  • Click on the Scan tab, then click on Scan Now >> . If an update is available, click the Update Now button.
  • A Threat Scan will begin.
  • With some infections, you may see this message box.
    • 'Could not load DDA driver'
  • Click 'Yes' to this message, to allow the driver to load after a restart.
  • Allow the computer to restart. Continue with the rest of these instructions.
  • When the scan is complete, click Apply Actions.
  • Wait for the prompt to restart the computer to appear, then click on Yes.
  • After the restart once you are back at your desktop, open MBAM once more.
  • Click on the History tab > Application Logs.
  • Double click on the scan log which shows the Date and time of the scan just performed.
  • Click 'Copy to Clipboard'
  • Paste the contents of the clipboard into your reply.

Please include the following in your next post:

  • MBAM log

Edited by RPMcMurphy, 21 September 2014 - 09:47 PM.

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#7 GreenAnteater

GreenAnteater
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:09 AM

Posted 21 September 2014 - 10:07 PM

There was no "Could not load DDA driver" message, and there was no request to restart the computer. When the scan was complete, it said "No malicious items were detected", and thus, no "Apply Actions" button. I have copy and pasted the Application log for this scan, in any case.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 21-Sep-14
Scan Time: 19:50:21
Logfile: 
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.09.22.01
Rootkit Database: v2014.09.19.01
License: Free
Malware Protection: Disabled
Malicious Website Protection: Disabled
Self-protection: Disabled

OS: Windows 8.1
CPU: x64
File System: NTFS
User: Hayley

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 330054
Time Elapsed: 12 min, 1 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Enabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)


(end)


#8 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:09 AM

Posted 22 September 2014 - 10:37 AM

Please do this next:

icon11.gif   Run FRST again.

  • When the tool opens click Yes to disclaimer.
  • Enter the following into the search box:  cachesrvr.*
  • Press the Search File(s) button
  • The tool will make another log (Search.txt) please post it to your reply.

icon11.gif  Go here to run an online scannner from ESET. Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator
  • Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts.
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
  • Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
  • Click Scan
  • Wait for the scan to finish
  • When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file..."
  • Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic.

Please include the following in your next post:
  • Search.txt log
  • ESET log


Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#9 GreenAnteater

GreenAnteater
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:09 AM

Posted 22 September 2014 - 01:04 PM

Here is the FRST Search.txt log:

Farbar Recovery Scan Tool (x64) Version: 12-09-2014
Ran by Hayley at 2014-09-22 08:43:15
Running from C:\Users\Hayley\Desktop
Boot Mode: Normal

================== Search Files: "cachesrvr.*" =============

====== End Of Search ======

And the ESET log:

C:\Users\Hayley\Downloads\ccsetup412.exe	Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Hayley\Downloads\ccsetup416.exe	Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Hayley\Downloads\ccsetup417.exe	Win32/Bundled.Toolbar.Google.D potentially unsafe application
C:\Users\Hayley\Downloads\CuteWriter.exe	a variant of Win32/Bundled.Toolbar.Ask.D potentially unsafe application


#10 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:09 AM

Posted 23 September 2014 - 02:57 PM

Do you know if those files avast detected are still in quarantine somewhere on your comptuter.  I have reason to believe they were false positives, but I can't seem to locate them to check.  Those ESET detections are nothing concerning - just freeware that comes bundled with a toolbar.


Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#11 GreenAnteater

GreenAnteater
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:09 AM

Posted 23 September 2014 - 03:33 PM

When I open up Avast and click on Quarantine (Virus Chest), they're still in there. If it helps, this is what it says:

 

Name - cachesrvr.exe 

Original Location - C:\Program Files\Hewlett-Packard\SimplePass

Last Changed - 14 Oct 13

 

Name - cachesrvr.exe

Original Location - C:\SWSetup\HPSP\x64\Data1.cab

Last Changed - 19 Sep 14

 

Name - unp232078075.tmp

Original Location - C:\WIndows\Temp\_avast_

Last Changed - 14 Oct 13

 

The dates are a bit weird, since I've only had this laptop since April 2014. 



#12 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:09 AM

Posted 24 September 2014 - 02:18 PM

Can you find the exact path to the quarantined files?


Edited by RPMcMurphy, 24 September 2014 - 02:19 PM.
correct spelling error

Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#13 GreenAnteater

GreenAnteater
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:09 AM

Posted 24 September 2014 - 03:13 PM

I'm sorry, I'm not quite sure how to do that.



#14 RPMcMurphy

RPMcMurphy

    Bleeping *^#@%~


  • Malware Response Team
  • 3,970 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:10:09 AM

Posted 26 September 2014 - 09:04 PM

Let's try this:

Follow the instructions in this LINK to copy the files in the virus chest to your desktop.

Once they are there, go to this LINK, click on "Choose File", navigate to the copies on your desktop and press "Send File"

Let me know when you have completed this, or if you have trouble.


Threads are closed after 5 days of inactivity.

ASAP & UNITE Member


The help you receive here is free. If you wish to show your appreciation, then you may btn_donate_SM.gif


#15 GreenAnteater

GreenAnteater
  • Topic Starter

  • Members
  • 10 posts
  • OFFLINE
  •  
  • Gender:Female
  • Local time:07:09 AM

Posted 27 September 2014 - 12:39 AM

It wouldn't let me save this one to the deskop:

 

Name - cachesrvr.exe

Original Location - C:\SWSetup\HPSP\x64\Data1.cab

Last Changed - 19 Sep 14

 

Said, "You are trying to restore a file from the Chest. The file already exists. Should the program overwrite the existing file?"

Overwriting or skipping doesn't make a difference. 

 

The other two files I sent via that link. 






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users