Printable View
I downloaded a piece of freeware that had the malware MiXDJ Toolbar and it installed myself onto my (brand new) computer and I can't get rid of it!
I tried following this thread, but got stuck at ComboFix because ComboFix doesn't have software for Windows 8. Any help would be greatly appreciated!
http://discussions.virtualdr.com/sho...-Mixdj-toolbar
Welcome aboard http://dev.discussions.virtualdr.forums.relay.cool/
Please, complete all steps listed here: http://discussions.virtualdr.com/sho...d.php?t=167915
Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
===============================
Never attempt to run Combofix on your own.
Thank you for your willingness to help me! I did do a factory restore because I just bought the computer a week ago, but it still seems to be there! I am running a full scan using Avast now and will post the log as soon as it is done!
Thank you again!
I did an Avast full system scan and no viruses were found. Running Malwarebytes next!
Malwarebytes Log
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Database version: v2013.04.20.03
Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16384
Jennifer :: JEN [administrator]
4/19/2013 11:06:07 PM
mbam-log-2013-04-19 (23-06-07).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 209017
Time elapsed: 2 minute(s), 31 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
aswMBR scan results
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-04-19 23:12:55
-----------------------------
23:12:55.858 OS Version: Windows x64 6.2.9200
23:12:55.858 Number of processors: 4 586 0x3A09
23:12:55.858 ComputerName: JEN UserName:
23:12:55.860 Initialze error 1
23:12:55.907 AVAST engine defs: 13041901
23:12:58.828 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\00000038
23:12:58.830 Disk 0 Vendor: HGST_HTS541075A9E680 JA2OA560 Size: 715404MB BusType: 11
23:12:58.837 Disk 0 MBR read successfully
23:12:58.839 Disk 0 MBR scan
23:12:58.840 Disk 0 unknown MBR code
23:12:58.842 Disk 0 Partition 1 00 EE GPT 2097151 MB offset 1
23:12:58.845 Disk 0 scanning C:\Windows\system32\drivers
23:12:58.847 Service scanning
23:12:59.535 Modules scanning
23:12:59.540 Disk 0 trace - called modules:
23:12:59.549 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys storport.sys hal.dll iaStorA.sys
23:12:59.555 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8008db6060]
23:12:59.561 3 CLASSPNP.SYS[fffff8800202d8aa] -> nt!IofCallDriver -> [0xfffffa800743f3c0]
23:12:59.570 5 ACPI.sys[fffff88001001a91] -> nt!IofCallDriver -> \Device\00000038[0xfffffa800743f7f0]
23:12:59.576 AVAST engine scan C:\
23:12:59.580 Scan finished successfully
23:13:08.521 Disk 0 MBR has been saved successfully to "C:\Users\Jennifer\Desktop\MBR.dat"
23:13:08.525 The log file has been saved successfully to "C:\Users\Jennifer\Desktop\aswMBR.txt"
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 8
Boot Device: \Device\HarddiskVolume1
Install Date: 4/19/2013 12:37:38 PM
System Uptime: 4/19/2013 8:42:42 PM (3 hours ago)
.
Motherboard: ASUSTeK COMPUTER INC. | | K55A
Processor: Intel(R) Core(TM) i5-3230M CPU @ 2.60GHz | SOCKET 0 | 2601/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 279 GiB total, 238.339 GiB free.
D: is FIXED (NTFS) - 398 GiB total, 397.233 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP2: 4/19/2013 3:34:00 PM - Language Pack Removal
RP3: 4/19/2013 9:42:03 PM - Initial Backup
.
==== Installed Programs ======================
.
Adobe Reader X MUI
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ASUS Instant Connect
ASUS InstantOn
ASUS Live Update
ASUS Smart Gesture
ASUSDVD
ATK Package
avast! Free Antivirus
Bonjour
Classic Shell
Dropbox
FileZilla Client 3.6.0.2
Google Chrome
Google Drive
Google Update Helper
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) SDK for OpenCL - CPU Only Runtime Package
Intel® Trusted Connect Service Client
iTunes
LastPass(uninstall only)
Malwarebytes Anti-Malware version 1.75.0.1300
McAfee Internet Security
Microsoft Office
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Mozilla Firefox 20.0.1 (x86 en-US)
Mozilla Maintenance Service
Qualcomm Atheros Bluetooth Suite (64)
Qualcomm Atheros Client Installation Program
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
Realtek PCIE Card Reader
Shared C Run-time for x64
Windows Driver Package - ASUS (ATP) Mouse (10/29/2012 1.0.0.148)
WinFlash
.
==== Event Viewer Messages From Past Week ========
.
4/19/2013 8:46:07 PM, Error: Service Control Manager [7003] - The McAfee Network Agent service depends on the following service: MfeFire. This service might not be installed.
4/19/2013 8:43:50 PM, Error: Server [2505] - The server could not bind to the transport \Device\NetBT_Tcpip_{DC47B852-3008-47DB-BB4E-5AD914CAF089} because another computer on the network has the same name. The server could not start.
4/19/2013 8:43:50 PM, Error: NetBT [4321] - The name "JEN :20" could not be registered on the interface with IP address 192.168.0.17. The computer with the IP address 192.168.0.15 did not allow the name to be claimed by this computer.
4/19/2013 8:43:45 PM, Error: Service Control Manager [7003] - The McAfee Anti-Spam Service service depends on the following service: MfeFire. This service might not be installed.
4/19/2013 8:29:17 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the McNASvc service.
4/19/2013 3:35:43 PM, Error: NetBT [4321] - The name "JEN :0" could not be registered on the interface with IP address 192.168.0.17. The computer with the IP address 192.168.0.15 did not allow the name to be claimed by this computer.
4/19/2013 3:12:29 PM, Error: volmgr [46] - Crash dump initialization failed!
4/19/2013 11:05:59 PM, Error: Service Control Manager [7023] - The Interactive Services Detection service terminated with the following error: Incorrect function.
.
==== End Of File ===========================
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16384
Run by Jennifer at 23:14:58 on 2013-04-19
Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.8078.6042 [GMT -5:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {ADA629C7-7F48-5689-624A-3B76997E0892}
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
AV: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {16C7C823-5972-5907-58FA-0004E2F9422F}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: McAfee Firewall *Disabled* {959DA8E2-3527-57D1-4915-924367AD4FE9}
.
============== Running Processes ===============
.
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\dwm.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Windows\system32\dashost.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files\Common Files\mcafee\McSvcHost\McSvHost.exe
C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
C:\Windows\system32\taskhostex.exe
C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe
C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
C:\Windows\SysWOW64\ACEngSvr.exe
C:\Windows\system32\igfxpers.exe
C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
C:\Windows\ImmersiveControlPanel\SystemSettings.exe
C:\Windows\explorer.exe
C:\Program Files\mcafee.com\agent\mcagent.exe
C:\Program Files\Classic Shell\ClassicShellService.exe
C:\Program Files\Classic Shell\ClassicStartMenu.exe
C:\Windows\SysWOW64\ctfmon.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
c:\PROGRA~1\mcafee\msc\mcupdmgr.exe
C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
C:\Windows\system32\mfevtps.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://asus13.msn.com
uDefault_Page_URL = hxxp://asus13.msn.com
mWinlogon: Userinit = userinit.exe
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll
TB: avast! WebRep: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll
mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
mRun: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe"
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRunOnce: [Malwarebytes Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
StartupFolder: C:\Users\Jennifer\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Jennifer\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\INSTAL~2.LNK - C:\Program Files (x86)\Common Files\lpuninstall.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\StartUp\INSTAL~1.LNK - C:\Program Files (x86)\Common Files\lpuninstall.exe
mPolicies-System: DisableCAD = dword:1
IE: LastPass - C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=lastpass
IE: LastPass Fill Forms - C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=fillforms
IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll
TCP: NameServer = 192.168.0.1
TCP: Interfaces\{DC47B852-3008-47DB-BB4E-5AD914CAF089} : DHCPNameServer = 192.168.0.1
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files (x86)\McAfee\msc\McSnIePl.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: CIESpeechBHO Class: {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
x64-BHO: LastPass Vault: {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll
x64-TB: avast! WebRep: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll
x64-Run: [IgfxTray] C:\Windows\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [BtTray] "C:\Program Files (x86)\Bluetooth Suite\BtTray.exe"
x64-Run: [BtvStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe"
x64-Run: [Persistence] C:\Windows\System32\igfxpers.exe
x64-mPolicies-System: DisableCAD = dword:1
x64-IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll
x64-IE: {7815BE26-237D-41A8-A98F-F7BD75F71086} - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll
x64-Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\Program Files\mcafee\msc\McSnIePl64.dll
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath -
.
============= SERVICES / DRIVERS ===============
.
R0 iaStorA;iaStorA;C:\Windows\System32\Drivers\iaStorA.sys [2012-7-5 645952]
R0 mfehidk;McAfee Inc. mfehidk;C:\Windows\System32\Drivers\mfehidk.sys [2013-4-19 771536]
R0 mfewfpk;McAfee Inc. mfewfpk;C:\Windows\System32\Drivers\mfewfpk.sys [2013-4-19 340216]
R1 aswSP;aswSP;C:\Windows\System32\Drivers\aswSP.sys [2013-4-19 377920]
R1 ATKWMIACPIIO;ATKWMIACPI Driver;C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [2011-9-7 17536]
R2 ASMMAP64;ASMMAP64;C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [2009-7-2 15416]
R2 ASUS InstantOn;ASUS InstantOn Service;C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [2012-4-13 277120]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\Drivers\aswFsBlk.sys [2013-4-19 33400]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\Drivers\aswMonFlt.sys [2013-4-19 80816]
R2 AtherosSvc;AtherosSvc;C:\Program Files (x86)\Bluetooth Suite\AdminService.exe [2012-8-10 211584]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-4-19 45248]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2012-12-28 2451456]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-4-20 635104]
R2 Intel(R) ME Service;Intel(R) ME Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2012-12-28 129856]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2012-12-28 166720]
R2 McNaiAnn;McAfee VirusScan Announcer;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2013-4-19 201304]
R2 McOobeSv;McAfee OOBE Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2013-4-19 201304]
R2 mfevtp;McAfee Validation Trust Protection Service;C:\Windows\System32\mfevtps.exe [2013-4-19 182752]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-12-28 365376]
R2 ZAtheros Bt&Wlan Coex Agent;ZAtheros Bt&Wlan Coex Agent;C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [2012-8-10 323584]
R3 aswVmm;aswVmm;C:\Windows\System32\Drivers\aswVmm.sys [2013-4-19 178624]
R3 AthBTPort;Qualcomm Atheros Virtual Bluetooth Class;C:\Windows\System32\Drivers\btath_flt.sys [2012-12-28 88728]
R3 ATP;ASUS PS/2 Port Input Device;C:\Windows\System32\Drivers\AsusTP.sys [2012-10-31 61824]
R3 BTATH_A2DP;Bluetooth A2DP Audio Driver;C:\Windows\System32\Drivers\btath_a2dp.sys [2012-12-28 344216]
R3 btath_avdt;Qualcomm Atheros Bluetooth AVDT Service;C:\Windows\System32\Drivers\btath_avdt.sys [2012-12-28 114840]
R3 BTATH_BUS;Qualcomm Atheros Bluetooth Bus;C:\Windows\System32\Drivers\btath_bus.sys [2012-12-28 33944]
R3 BTATH_HCRP;Bluetooth HCRP Server driver;C:\Windows\System32\Drivers\btath_hcrp.sys [2012-12-28 178840]
R3 BTATH_LWFLT;Bluetooth LWFLT Device;C:\Windows\System32\Drivers\btath_lwflt.sys [2012-12-28 76952]
R3 BTATH_RCP;Bluetooth AVRCP Device;C:\Windows\System32\Drivers\btath_rcp.sys [2012-12-28 135832]
R3 BtFilter;BtFilter;C:\Windows\System32\Drivers\btfilter.sys [2012-12-28 567808]
R3 BthLEEnum;Bluetooth Low Energy Driver;C:\Windows\System32\Drivers\BthLEEnum.sys [2012-7-25 202752]
R3 HIDSwitch;ASUS Wireless Radio Control;C:\Windows\System32\Drivers\AsHIDSwitch64.sys [2012-11-9 21152]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\Drivers\IntcDAud.sys [2012-11-9 342528]
R3 mfeavfk;McAfee Inc. mfeavfk;C:\Windows\System32\Drivers\mfeavfk.sys [2013-4-19 309840]
R3 mfefirek;McAfee Inc. mfefirek;C:\Windows\System32\Drivers\mfefirek.sys [2013-4-19 515968]
R3 RSBASTOR;Realtek PCIE CardReader Driver - BA;C:\Windows\System32\Drivers\RtsBaStor.sys [2012-12-28 295056]
R3 RTL8168;Realtek 8168 NT Driver;C:\Windows\System32\Drivers\Rt630x64.sys [2012-12-28 683664]
S0 aswRvrt;aswRvrt;C:\Windows\System32\Drivers\aswRvrt.sys [2013-4-19 65336]
S0 mfeelamk;McAfee Inc. mfeelamk;C:\Windows\System32\Drivers\mfeelamk.sys [2013-4-19 69168]
S1 aswSnx;aswSnx;C:\Windows\System32\Drivers\aswSnx.sys [2013-4-19 1025808]
S2 0055481366430763mcinstcleanup;McAfee Application Installer Cleanup (0055481366430763);C:\Windows\TEMP\005548~1.EXE -cleanup -nolog --> C:\Windows\TEMP\005548~1.EXE -cleanup -nolog [?]
S2 McMPFSvc;McAfee Personal Firewall Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2013-4-19 201304]
S2 McProxy;McAfee Proxy Service;C:\Program Files\Common Files\mcafee\mcsvchost\McSvHost.exe [2013-4-19 201304]
S2 McShield;McAfee McShield;C:\Program Files\Common Files\mcafee\SystemCore\mcshield.exe [2013-4-19 241456]
S2 mfefire;McAfee Firewall Core Service;C:\Program Files\Common Files\mcafee\SystemCore\mfefire.exe [2013-4-19 218760]
S3 cfwids;McAfee Inc. cfwids;C:\Windows\System32\Drivers\cfwids.sys [2013-4-19 70112]
S3 HipShieldK;McAfee Inc. HipShieldK;C:\Windows\System32\Drivers\HipShieldK.sys [2013-4-19 196440]
S3 McAWFwk;McAfee Activation Service;C:\PROGRA~1\mcafee\msc\mcawfwk.exe [2012-8-4 332080]
S3 mferkdet;McAfee Inc. mferkdet;C:\Windows\System32\Drivers\mferkdet.sys [2013-4-19 106552]
.
=============== Created Last 30 ================
.
2013-04-20 04:06:59 196440 ----a-w- C:\Windows\System32\drivers\HipShieldK.sys
2013-04-20 04:05:49 10728 ----a-w- C:\Windows\System32\drivers\mfeclnk.sys
2013-04-20 04:05:37 182752 ----a-w- C:\Windows\System32\mfevtps.exe
2013-04-20 04:05:33 340216 ----a-w- C:\Windows\System32\drivers\mfewfpk.sys
2013-04-20 04:05:32 771536 ----a-w- C:\Windows\System32\drivers\mfehidk.sys
2013-04-20 04:05:32 69168 ----a-w- C:\Windows\System32\drivers\mfeelamk.sys
2013-04-20 04:05:32 106552 ----a-w- C:\Windows\System32\drivers\mferkdet.sys
2013-04-20 04:05:31 70112 ----a-w- C:\Windows\System32\drivers\cfwids.sys
2013-04-20 04:05:31 515968 ----a-w- C:\Windows\System32\drivers\mfefirek.sys
2013-04-20 04:05:31 309840 ----a-w- C:\Windows\System32\drivers\mfeavfk.sys
2013-04-20 04:05:31 179280 ----a-w- C:\Windows\System32\drivers\mfeapfk.sys
2013-04-20 03:49:52 -------- d-----w- C:\Users\Jennifer\AppData\Local\CrashDumps
2013-04-20 03:34:25 14880256 ----a-w- C:\Program Files (x86)\Common Files\lpuninstall.exe
2013-04-20 03:34:19 -------- d-----w- C:\Program Files (x86)\LastPass
2013-04-20 03:27:54 -------- d-----w- C:\Users\Jennifer\AppData\Roaming\Malwarebytes
2013-04-20 03:12:47 70992 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2013-04-20 03:12:42 65336 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
2013-04-20 03:12:42 178624 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
2013-04-20 03:12:42 1025808 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2013-04-20 03:12:41 80816 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2013-04-20 03:12:07 41664 ----a-w- C:\Windows\avastSS.scr
2013-04-20 03:11:59 -------- d-----w- C:\ProgramData\AVAST Software
2013-04-20 03:11:59 -------- d-----w- C:\Program Files\AVAST Software
2013-04-20 03:11:42 -------- d-----w- C:\ProgramData\Malwarebytes
2013-04-20 03:11:41 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2013-04-20 03:11:41 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-04-20 03:11:40 -------- d-----w- C:\Users\Jennifer\AppData\Local\Programs
2013-04-20 03:11:36 -------- d-----w- C:\Users\Jennifer\AppData\Local\Apple Computer
2013-04-20 03:11:21 33240 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2013-04-20 03:10:58 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-04-20 03:10:58 -------- d-----w- C:\Program Files\iTunes
2013-04-20 03:10:58 -------- d-----w- C:\Program Files\iPod
2013-04-20 03:10:58 -------- d-----w- C:\Program Files (x86)\iTunes
2013-04-20 03:10:35 -------- d-----w- C:\Users\Jennifer\AppData\Local\Apple
2013-04-20 03:10:31 -------- d-----w- C:\Program Files\Bonjour
2013-04-20 03:10:31 -------- d-----w- C:\Program Files (x86)\Bonjour
2013-04-20 03:08:02 -------- d-----w- C:\Users\Jennifer\AppData\Roaming\Dropbox
2013-04-20 01:51:15 -------- d-----w- C:\Users\Jennifer\AppData\Local\Google
2013-04-20 01:34:49 -------- d-----w- C:\sources
2013-04-20 01:31:13 -------- d-----w- C:\Users\Jennifer\AppData\Local\Deployment
2013-04-20 01:31:13 -------- d-----w- C:\Users\Jennifer\AppData\Local\Apps
2013-04-19 17:41:13 -------- d-----w- C:\Users\Jennifer\AppData\Local\BMExplorer
2013-04-19 17:40:52 -------- d-----w- C:\Users\Jennifer\AppData\Roaming\ASUS WebStorage
2013-04-19 17:40:45 -------- d-----w- C:\Users\Jennifer\AppData\Roaming\Atheros
2013-04-19 17:40:18 -------- d-----r- C:\Users\Jennifer\Searches
2013-04-19 17:39:28 -------- d-----w- C:\ProgramData\FolderView
2013-04-19 17:38:38 -------- d-----r- C:\Users\Jennifer\Contacts
.
==================== Find3M ====================
.
2013-01-24 17:32:08 2177648 ----a-w- C:\Windows\System32\coin93.dll
.
============= FINISH: 23:15:22.82 ===============
http://dev.discussions.virtualdr.forums.relay.cool/ You're running 3 AV programs, McAfee, Avast and Windows Defender (that's MSE in Windows 8)./
You need to uninstall TWO of them.
If McAfee is one of them use this tool: http://majorgeeks.com/McAfee_Consume...ool_d5420.html
If Windows Defender (MSE) is another one you have to disable it (WD can't be uninstalled).
http://dev.discussions.virtualdr.forums.relay.cool/ Download RogueKiller on the desktop
- Close all the running programs
- Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
- Otherwise just double-click on RogueKiller.exe
- Pre-scan will start. Let it finish.
- Click on SCAN button.
- Wait until the Status box shows Scan Finished
- Click on Delete.
- Wait until the Status box shows Deleting Finished.
- Click on Report and copy/paste the content of the Notepad into your next reply.
- RKreport.txt could also be found on your desktop.
- If more than one log is produced post all logs.
- If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again
http://dev.discussions.virtualdr.forums.relay.cool/ Download Malwarebytes Anti-Rootkit (MBAR) from HERE
- Unzip downloaded file.
- Open the folder where the contents were unzipped and run mbar.exe
- Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
- Click on the Cleanup button to remove any threats and reboot if prompted to do so.
- Wait while the system shuts down and the cleanup process is performed.
- Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
- When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
RK Log 1
RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files...3-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Normal mode
User : Jennifer [Admin rights]
Mode : Scan -- Date : 04/20/2013 08:41:24
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: HGST HTS541075A9E680 +++++
--- User ---
[MBR] 376354a5f1fea24eecbf5881810ed65e
[BSP] 36cd65d2c5dae24661a4f793aca37976 : Empty MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0xee) [VISIBLE] Offset (sectors): 1 | Size: 2097151 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[1]_S_04202013_02d0841.txt >>
RKreport[1]_S_04202013_02d0841.txt
RK Log 2
RogueKiller V8.5.4 [Mar 18 2013] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://www.geekstogo.com/forum/files...3-roguekiller/
Website : http://tigzy.geekstogo.com/roguekiller.php
Blog : http://tigzyrk.blogspot.com/
Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Normal mode
User : Jennifer [Admin rights]
Mode : Remove -- Date : 04/20/2013 08:43:39
| ARK || FAK || MBR |
¤¤¤ Bad processes : 0 ¤¤¤
¤¤¤ Registry Entries : 2 ¤¤¤
[HJ DESK] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)
¤¤¤ Particular Files / Folders: ¤¤¤
¤¤¤ Driver : [NOT LOADED] ¤¤¤
¤¤¤ HOSTS File: ¤¤¤
--> C:\Windows\system32\drivers\etc\hosts
¤¤¤ MBR Check: ¤¤¤
+++++ PhysicalDrive0: HGST HTS541075A9E680 +++++
--- User ---
[MBR] 376354a5f1fea24eecbf5881810ed65e
[BSP] 36cd65d2c5dae24661a4f793aca37976 : Empty MBR Code
Partition table:
0 - [XXXXXX] UNKNOWN (0xee) [VISIBLE] Offset (sectors): 1 | Size: 2097151 Mo
User = LL1 ... OK!
User = LL2 ... OK!
Finished : << RKreport[2]_D_04202013_02d0843.txt >>
RKreport[1]_S_04202013_02d0841.txt ; RKreport[2]_D_04202013_02d0843.txt
Malwarebytes Anti-Rootkit BETA 1.05.0.1001
www.malwarebytes.org
Database version: v2013.04.20.05
Windows 8 x64 NTFS
Internet Explorer 10.0.9200.16384
Jennifer :: JEN [administrator]
4/20/2013 9:03:14 AM
mbar-log-2013-04-20 (09-03-14).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 7177
Time elapsed: 13 minute(s), 53 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.05.0.1001
(c) Malwarebytes Corporation 2011-2012
OS version: 6.2.9200 Windows 8 x64
Account is Administrative
Internet Explorer version: 10.0.9200.16384
File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.594000 GHz
Memory total: 8469909504, free: 6465867776
------------ Kernel report ------------
04/20/2013 08:48:19
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\iaStorA.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\wfplwfs.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\System32\Drivers\aswSnx.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\Drivers\aswTdi.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\System32\Drivers\aswrdr2.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\??\C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys
\SystemRoot\System32\Drivers\aswSP.SYS
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\System32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\System32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\HECIx64.sys
\SystemRoot\System32\drivers\usbehci.sys
\SystemRoot\System32\drivers\USBPORT.SYS
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athw8x.sys
\SystemRoot\System32\drivers\vwifibus.sys
\SystemRoot\system32\DRIVERS\RtsBaStor.sys
\SystemRoot\system32\DRIVERS\Rt630x64.sys
\SystemRoot\System32\drivers\i8042prt.sys
\SystemRoot\System32\drivers\AsusTP.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\drivers\kbfiltr.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\System32\drivers\CmBatt.sys
\SystemRoot\System32\drivers\BATTC.SYS
\SystemRoot\System32\drivers\intelppm.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\System32\drivers\AsHIDSwitch64.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\btath_bus.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\System32\drivers\usbhub.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\drivers\dc3d.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_iaStorA.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\system32\DRIVERS\btfilter.sys
\SystemRoot\System32\Drivers\BTHUSB.sys
\SystemRoot\System32\Drivers\bthport.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\DRIVERS\BthLEEnum.sys
\SystemRoot\system32\DRIVERS\rfcomm.sys
\SystemRoot\System32\drivers\BthEnum.sys
\SystemRoot\system32\DRIVERS\bthpan.sys
\SystemRoot\System32\drivers\btath_rcp.sys
\SystemRoot\system32\drivers\btath_avdt.sys
\SystemRoot\system32\drivers\btath_a2dp.sys
\SystemRoot\System32\drivers\btath_hcrp.sys
\SystemRoot\system32\DRIVERS\btath_flt.sys
\SystemRoot\system32\DRIVERS\btath_lwflt.sys
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\SystemRoot\System32\Drivers\aswFsBlk.SYS
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\??\C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys
\SystemRoot\System32\drivers\condrv.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\Ndu.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
----------- End -----------
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8008cf3060
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000038\
Lower Device Object: 0xfffffa8007427060
Lower Device Driver Name: \Driver\iaStorA\
Driver name found: iaStorA
Initialization returned 0x0
Port sub-driver loaded: \??\C:\Windows\System32\Drivers\storport.sys (0x0)
Load Function returned 0x0
Downloaded database version: v2013.04.20.05
Downloaded database version: v2013.04.17.03
Initializing...
Done!
<<<2>>>
Device number: 0, partition: 4
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8008cf3060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8008cf3b10, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8008cf3060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xfffffa80074282a0, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007427060, DeviceName: \Device\00000038\, DriverName: \Driver\iaStorA\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0xfffff8a00ab57f20, 0xfffffa8008cf3060, 0xfffffa800766e740
Lower DeviceData: 0xfffff8a00a0c3580, 0xfffffa8007427060, 0xfffffa800d8b8450
Partition type: GUID
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning directory: C:\Windows\system32\drivers...
<<<2>>>
Device number: 0, partition: 4
Partition type: GUID
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
This drive is a GPT Drive.
MBR Signature: 55AA
Disk Signature: C2B20764
GPT Protective MBR Partition information:
Partition 0 type is EFI-GPT (0xee)
Partition is NOT ACTIVE.
Partition starts at LBA: 1 Numsec = 4294967295
Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0
GPT Partition information:
GPT Header Signature 4546492050415254
GPT Header Revision 65536 Size 92 CRC 703931948
GPT Header CurrentLba = 1 BackupLba 1465149167
GPT Header FirstUsableLba 34 LastUsableLba 1465149134
GPT Header Guid dc9eb263-3b9e-41d0-b370-bab1e79722c6
GPT Header Contains 128 partition entries starting at LBA 2
GPT Header Partition entry size = 128
Backup GPT header Signature 4546492050415254
Backup GPT header Revision 65536 Size 92 CRC 703931948
Backup GPT header CurrentLba = 1465149167 BackupLba 1
Backup GPT header FirstUsableLba 34 LastUsableLba 1465149134
Backup GPT header Guid dc9eb263-3b9e-41d0-b370-bab1e79722c6
Backup GPT header Contains 128 partition entries starting at LBA 1465149135
Backup GPT header Partition entry size = 128
Partition 0 Type c12a7328-f81f-11d2-ba4b-0a0c93ec93b
Partition ID a567588-aa2-4b12-907-2f5ec24cb9c0
FirstLBA 2048 Last LBA 616447
Attributes 0
Partition Name EFI system partition
GPT Partition 0 is bootable
Partition 1 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
Partition ID 925318e6-d763-42d8-a2a9-3137e7dd6b2e
FirstLBA 616448 Last LBA 2459647
Attributes 1
Partition Name Basic data partition
Partition 2 Type e3c9e316-b5c-4db8-817d-f92df0215ae
Partition ID 49ad7db-ea38-4f9b-adab-8560926784ff
FirstLBA 2459648 Last LBA 2721791
Attributes 0
Partition Name Microsoft reserved partition
Partition 3 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Partition ID 7ec4a428-9d7e-46fd-8d43-7c01413c6c7
FirstLBA 2721792 Last LBA 588779519
Attributes 0
Partition Name Basic data partition
Partition 4 Type ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Partition ID efc5d252-3e36-40c0-9d1b-ce66e21bc166
FirstLBA 588779520 Last LBA 1423183871
Attributes 0
Partition Name Basic data partition
Partition 5 Type de94bba4-6d1-4d40-a16a-bfd5179d6ac
Partition ID cf5f903a-c49c-497e-a398-ad68d367015
FirstLBA 1423183872 Last LBA 1465147391
Attributes 1
Partition Name Basic data partition
Disk Size: 750156374016 bytes
Sector size: 512 bytes
Done!
Performing system, memory and registry scan...
Done!
Scan finished
=======================================
http://dev.discussions.virtualdr.forums.relay.cool/ Create new restore point before proceeding with the next step....
How to:
- Windows 8: http://www.vikitech.com/11302/system-restore-windows-8
- Windows 7: http://www.howtogeek.com/howto/3195/...-in-windows-7/
- Vista: http://www.howtogeek.com/howto/windo...ystem-restore/
- XP: http://support.microsoft.com/kb/948247
http://dev.discussions.virtualdr.forums.relay.cool/ Please download ComboFix from Here, Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.- Double click on combofix.exe & follow the prompts.
- NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.
Make sure, you re-enable your security programs, when you're done with Combofix.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTE.
If, for some reason, Combofix refuses to run, try the following...
Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/
Restart computer in safe mode
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista or Windows 7 right-click on it and choose Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- Do not reboot until instructed.
- If the tool does not run from any of the links provided, please let me know.
When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.
IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
I downloaded ComboFix and it said it doesn't work with Windows 8. Windows 8 then offers to install it as a compatible program. Should I try to run it that way?
My apology :)
Please download Farbar Recovery Scan Tool and save it to your desktop.
Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
- Double-click to run it. When the tool opens click Yes to disclaimer.[/*]
- Press Scan button.[/*]
- It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.[/*]
- The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.[/*]
No problem! I just appreciate all of your help!
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-04-2013 01
Ran by Jennifer (administrator) on 20-04-2013 21:11:51
Running from C:\Users\Jennifer\Desktop
Windows 8 (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(IvoSoft) [1104] C:\Program Files\Classic Shell\ClassicShellService.exe
(ASUSTek Computer Inc.) [1324] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ASLDRSrv.exe
(ASUS) [1404] C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
(AVAST Software) [1428] C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) [1852] C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(ASUS) [1888] C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
(Qualcomm Atheros Commnucations) [2000] C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
(Apple Inc.) [2036] C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) [1448] C:\Windows\system32\dashost.exe
(Intel(R) Corporation) [1436] C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) [1020] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Atheros) [2088] C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
(Realsil Microelectronics Inc.) [3716] C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
(Intel Corporation) [3740] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
(Intel Corporation) [3788] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) [4068] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(ASUSTek Computer Inc.) [3056] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
(ASUS) [1460] C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
(IvoSoft) [3060] C:\Program Files\Classic Shell\ClassicStartMenu.exe
(ASUSTek Computer Inc.) [2628] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
(ASUSTek Computer Inc.) [3836] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
(ASUSTek Computer Inc.) [3832] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
(Microsoft Corporation) [1244] C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe\LiveComm.exe
(AsusTek) [2868] C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPLoader.exe
(ASUSTeK Computer Inc.) [2540] C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x64\QuickGesture64.exe
(ASUSTeK Computer Inc.) [2060] C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
(Intel Corporation) [3688] C:\Windows\System32\igfxtray.exe
(Intel Corporation) [3844] C:\Windows\System32\hkcmd.exe
(Microsoft Corporation) [3584] C:\Windows\System32\RuntimeBroker.exe
(Realtek Semiconductor) [2504] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Qualcomm Atheros) [2572] C:\Program Files (x86)\Bluetooth Suite\BtTray.exe
(Qualcomm Atheros Commnucations) [3852] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe
(Intel Corporation) [3964] C:\Windows\System32\igfxpers.exe
(CyberLink Corp.) [1376] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
(Apple Inc.) [1828] C:\Program Files (x86)\iTunes\iTunesHelper.exe
(AVAST Software) [3600] C:\Program Files\AVAST Software\Avast\AvastUI.exe
(Apple Inc.) [2244] C:\Program Files\iPod\bin\iPodService.exe
(AsusTek) [4304] C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPHelper.exe
(ASUSTeK Computer Inc.) [4856] C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
(Microsoft Corporation) [4520] C:\Windows\SysWOW64\ctfmon.exe
(AsusTek) [2688] C:\Program Files (x86)\ASUS\ASUS Smart Gesture\AsTPCenter\x64\AsusTPCenter.exe
(Farbar) [4888] C:\Users\Jennifer\Desktop\FRST64.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [12936848 2012-07-13] (Realtek Semiconductor)
HKLM\...\Run: [BtTray] "C:\Program Files (x86)\Bluetooth Suite\BtTray.exe" [764032 2012-08-10] (Qualcomm Atheros)
HKLM\...\Run: [BtvStack] "C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe" [127616 2012-08-10] (Qualcomm Atheros Commnucations)
HKLM-x32\...\RunOnce: [Z1] cmd /c "C:\Users\Jennifer\Downloads\mbar-1.05.0.1001\mbar\mbar.exe" /cleanup /s [1398856 2013-04-20] (Malwarebytes Corporation)
HKLM-x32\...\RunOnce: [Z1] cmd /c "C:\Users\Jennifer\Downloads\mbar-1.05.0.1001\mbar\mbar.exe" /cleanup /s [1398856 2013-04-20] (Malwarebytes Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [35736 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [932288 2010-11-15] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RemoteControl10] "C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe" [91432 2012-03-28] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.)
HKLM-x32\...\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui [4767304 2013-03-06] (AVAST Software)
Startup: C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\Jennifer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://asus13.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.com
HKCU SearchScopes: DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: CIESpeechBHO Class - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
BHO: LastPass Vault - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: LastPass Vault - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
Toolbar: HKLM - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
Toolbar: HKLM-x32 - avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
Toolbar: HKLM-x32 - LastPass Toolbar - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
Winsock: Catalog5 07 %SystemRoot%\system32\wshbth.dll [50688] (Microsoft Corporation)
Winsock: Catalog5 08 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog5-x64 07 %SystemRoot%\system32\wshbth.dll [64000] (Microsoft Corporation)
Winsock: Catalog5-x64 08 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Chrome:
=======
CHR HomePage: https://www.google.com/reader/view/?...es%2Findex.xml
CHR RestoreOnStartup: https://www.google.com/reader", "hxxp://www.google.com/", "hxxp://www.msn.com/?pc=U016&ocid=U016DHP&dt=041913", "hxxp://search.conduit.com/?ctid=CT3287822&SearchSource=48&CUI=UN17986453404438157&UM=2
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
CHR Plugin: (Intel\u00AE Identity Protection Technology) - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
CHR Plugin: (McAfee SecurityCenter) - c:\progra~2\mcafee\msc\npmcsn~1.dll No File
CHR Extension: (Google Docs) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
CHR Extension: (Google Drive) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
CHR Extension: (WOT) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.4.11_0
CHR Extension: (YouTube) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
CHR Extension: (Google Search) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (Ultimate Google Docs Viewer) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\edgbhipncfdgcekflcoelhmnkcfdfjcl\0.8.4.7_0
CHR Extension: (Springpad) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\fkmopoamfjnmppabeaphohombnjcjgla\6_0
CHR Extension: (AdBlock) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.61_0
CHR Extension: (Pinterest) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpdjojdkbbmdfjfahjcgigfpmkopogic\1.1_0
CHR Extension: (LastPass) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\2.0.25_0
CHR Extension: (avast! WebRep) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0
CHR Extension: (Super Full Feeds for Google Reader\u2122) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\khbjahpecnkenngkidhioicnfpakihgo\1.3.2_0
CHR Extension: (ZipList Recipe Clipper) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgnplfeogpkbplfamjbigeekindmicbe\1.1.3_0
CHR Extension: ( "name": "Feedly") - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\ndhinffkekpekljifjkkkkkhopnjodja\14.0.484_0
CHR Extension: (RSS Subscription Extension (by Google)) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlbjncdgjeocebhnmkbbbdekmmmcbfjd\2.2.2_0
CHR Extension: (Docs PDF/PowerPoint Viewer (by Google)) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\nnbmlagghjjcbdhgmkedmbmedengocbn\3.10_0
CHR Extension: (Checker Plus for Gmail\u2122) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\oeopbcgkkoapgobdbedcemjljbihmemj\13.2_0
CHR Extension: (The Tracktor - Amazon Price Tracker) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\onajjgekdldckfgodnmoallcmdmfcfom\3.1.2_0
CHR Extension: (Gmail) - C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
==================== Services (Whitelisted) =================
S2 0055481366430763mcinstcleanup; C:\Windows\TEMP\005548~1.EXE [833616 2013-01-30] (McAfee, Inc.)
R2 ASUS InstantOn; C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe [277120 2012-04-13] (ASUS)
R2 AtherosSvc; C:\Program Files (x86)\Bluetooth Suite\adminservice.exe [211584 2012-08-10] (Qualcomm Atheros Commnucations)
R2 ATKGFNEXSrv; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe [96896 2011-11-21] (ASUS)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [45248 2013-03-06] (AVAST Software)
R2 ClassicShellService; C:\Program Files\Classic Shell\ClassicShellService.exe [68608 2013-04-12] (IvoSoft)
R2 Intel(R) ME Service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [129856 2012-06-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [166720 2012-06-25] (Intel Corporation)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [15440 2012-07-25] (Microsoft Corporation)
R2 ZAtheros Bt&Wlan Coex Agent; C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe [323584 2012-08-10] (Atheros)
==================== Drivers (Whitelisted) ====================
R2 ASMMAP64; C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys [15416 2009-07-02] (ASUS)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [80816 2013-03-06] (AVAST Software)
R1 aswRdr; C:\Windows\System32\Drivers\aswrdr2.sys [70992 2013-03-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65336 2013-03-06] ()
R1 aswSnx; C:\Windows\System32\Drivers\aswSnx.sys [1025808 2013-03-06] (AVAST Software)
R1 aswSP; C:\Windows\System32\Drivers\aswSP.sys [377920 2013-03-06] (AVAST Software)
R1 aswTdi; C:\Windows\System32\Drivers\aswTdi.sys [68920 2013-03-06] (AVAST Software)
S3 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [178624 2013-03-06] ()
R3 AthBTPort; C:\Windows\system32\DRIVERS\btath_flt.sys [88728 2012-08-10] (Qualcomm Atheros)
R3 athr; C:\Windows\system32\DRIVERS\athw8x.sys [3624960 2012-08-16] (Qualcomm Atheros Communications, Inc.)
R1 ATKWMIACPIIO; C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys [17536 2011-09-07] (ASUS)
R3 ATP; C:\Windows\System32\drivers\AsusTP.sys [61824 2012-10-31] (ASUS Corporation)
R3 BTATH_A2DP; C:\Windows\system32\drivers\btath_a2dp.sys [344216 2012-08-10] (Qualcomm Atheros)
R3 btath_avdt; C:\Windows\system32\drivers\btath_avdt.sys [114840 2012-08-10] (Qualcomm Atheros)
R3 BTATH_BUS; C:\Windows\System32\drivers\btath_bus.sys [33944 2012-08-10] (Qualcomm Atheros)
R3 BTATH_HCRP; C:\Windows\System32\drivers\btath_hcrp.sys [178840 2012-08-10] (Qualcomm Atheros)
R3 BTATH_LWFLT; C:\Windows\system32\DRIVERS\btath_lwflt.sys [76952 2012-08-10] (Qualcomm Atheros)
R3 BTATH_RCP; C:\Windows\System32\drivers\btath_rcp.sys [135832 2012-08-10] (Qualcomm Atheros)
R3 BtFilter; C:\Windows\system32\DRIVERS\btfilter.sys [567808 2012-08-10] (Qualcomm Atheros)
R3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-25] (Microsoft Corporation)
R3 HIDSwitch; C:\Windows\System32\drivers\AsHIDSwitch64.sys [21152 2012-05-30] (ASUS)
R0 iaStorA; C:\Windows\System32\drivers\iaStorA.sys [645952 2012-07-23] (Intel Corporation)
R3 kbfiltr; C:\Windows\System32\drivers\kbfiltr.sys [14992 2012-08-01] ( )
R3 RSBASTOR; C:\Windows\system32\DRIVERS\RtsBaStor.sys [295056 2012-07-03] (Realtek Semiconductor Corp.)
U0 msahci;
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-04-20 21:11 - 2013-04-20 21:11 - 01707098 ____A (Farbar) C:\Users\Jennifer\Desktop\FRST64.exe
2013-04-20 21:11 - 2013-04-20 21:11 - 00000000 ____D C:\FRST
2013-04-20 08:48 - 2013-04-20 08:48 - 00000000 ____D C:\Users\Jennifer\Downloads\mbar-1.05.0.1001
2013-04-20 08:46 - 2013-04-20 08:47 - 12917756 ____A C:\Users\Jennifer\Downloads\mbar-1.05.0.1001.zip
2013-04-20 08:43 - 2013-04-20 08:43 - 00001315 ____A C:\Users\Jennifer\Desktop\RKreport[2]_D_04202013_02d0843.txt
2013-04-20 08:41 - 2013-04-20 08:41 - 00001262 ____A C:\Users\Jennifer\Desktop\RKreport[1]_S_04202013_02d0841.txt
2013-04-20 08:40 - 2013-04-20 08:42 - 00000000 ____D C:\Users\Jennifer\Desktop\RK_Quarantine
2013-04-20 08:39 - 2013-04-20 08:39 - 00816128 ____A C:\Users\Jennifer\Desktop\RogueKiller.exe
2013-04-20 08:21 - 2013-04-20 08:22 - 03191888 ____A (McAfee, Inc.) C:\Users\Jennifer\Downloads\MCPR.exe
2013-04-19 23:15 - 2013-04-19 23:16 - 00019005 ____A C:\Users\Jennifer\Desktop\dds.txt
2013-04-19 23:15 - 2013-04-19 23:16 - 00003713 ____A C:\Users\Jennifer\Desktop\attach.txt
2013-04-19 23:14 - 2013-04-19 23:14 - 00688992 ____R (Swearware) C:\Users\Jennifer\Desktop\dds.com
2013-04-19 23:13 - 2013-04-19 23:13 - 00001558 ____A C:\Users\Jennifer\Desktop\aswMBR.txt
2013-04-19 23:13 - 2013-04-19 23:13 - 00000512 ____A C:\Users\Jennifer\Desktop\MBR.dat
2013-04-19 23:10 - 2013-04-19 23:11 - 04745728 ____A (AVAST Software) C:\Users\Jennifer\Desktop\aswMBR.exe
2013-04-19 22:49 - 2013-04-19 22:49 - 00000000 ____D C:\Users\Jennifer\AppData\Local\CrashDumps
2013-04-19 22:34 - 2013-04-19 22:34 - 00001192 ____A C:\Users\Public\Desktop\My LastPass Vault.lnk
2013-04-19 22:34 - 2013-04-19 22:34 - 00000000 ____D C:\Program Files (x86)\LastPass
2013-04-19 22:33 - 2013-04-19 22:33 - 14880256 ____A (LastPass) C:\Users\Jennifer\Downloads\lastpass_x64.exe
2013-04-19 22:27 - 2013-04-19 22:27 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Malwarebytes
2013-04-19 22:12 - 2013-04-19 22:12 - 00001924 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-04-19 22:12 - 2013-04-19 22:12 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2013-04-19 22:12 - 2013-03-06 17:33 - 01025808 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSnx.sys
2013-04-19 22:12 - 2013-03-06 17:33 - 00377920 ____A (AVAST Software) C:\Windows\System32\Drivers\aswSP.sys
2013-04-19 22:12 - 2013-03-06 17:33 - 00178624 ____A C:\Windows\System32\Drivers\aswVmm.sys
2013-04-19 22:12 - 2013-03-06 17:33 - 00080816 ____A (AVAST Software) C:\Windows\System32\Drivers\aswMonFlt.sys
2013-04-19 22:12 - 2013-03-06 17:33 - 00070992 ____A (AVAST Software) C:\Windows\System32\Drivers\aswRdr2.sys
2013-04-19 22:12 - 2013-03-06 17:33 - 00068920 ____A (AVAST Software) C:\Windows\System32\Drivers\aswTdi.sys
2013-04-19 22:12 - 2013-03-06 17:33 - 00065336 ____A C:\Windows\System32\Drivers\aswRvrt.sys
2013-04-19 22:12 - 2013-03-06 17:33 - 00033400 ____A (AVAST Software) C:\Windows\System32\Drivers\aswFsBlk.sys
2013-04-19 22:12 - 2013-03-06 17:32 - 00287840 ____A (AVAST Software) C:\Windows\System32\aswBoot.exe
2013-04-19 22:12 - 2013-03-06 17:32 - 00041664 ____A (AVAST Software) C:\Windows\avastSS.scr
2013-04-19 22:11 - 2013-04-20 08:36 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Apple Computer
2013-04-19 22:11 - 2013-04-19 22:11 - 00001785 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-04-19 22:11 - 2013-04-19 22:11 - 00001111 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-04-19 22:11 - 2013-04-19 22:11 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Apple Computer
2013-04-19 22:11 - 2013-04-19 22:11 - 00000000 ____D C:\Program Files\AVAST Software
2013-04-19 22:11 - 2013-04-19 22:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-04-19 22:11 - 2013-04-04 14:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-04-19 22:11 - 2012-08-21 13:01 - 00033240 ____A (GEAR Software Inc.) C:\Windows\System32\Drivers\GEARAspiWDM.sys
2013-04-19 22:10 - 2013-04-19 22:11 - 00000000 ____D C:\Program Files\iTunes
2013-04-19 22:10 - 2013-04-19 22:11 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Apple
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files\iPod
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files\Bonjour
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-04-19 22:08 - 2013-04-20 08:36 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Dropbox
2013-04-19 22:08 - 2013-04-19 22:08 - 00000982 ____A C:\Users\Jennifer\Desktop\Dropbox.lnk
2013-04-19 22:07 - 2013-04-19 22:07 - 00001082 ____A C:\Users\Public\Desktop\Google Drive.lnk
2013-04-19 22:07 - 2013-04-19 22:07 - 00000000 ____D C:\Users\Jennifer\AppData\LocalGoogle
2013-04-19 22:06 - 2013-04-19 22:06 - 00001209 ____A C:\Users\Public\Desktop\FileZilla.lnk
2013-04-19 22:06 - 2013-04-19 22:06 - 00001149 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-04-19 22:06 - 2013-04-19 22:06 - 00000000 ____D C:\Program Files\Classic Shell
2013-04-19 22:06 - 2013-04-19 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-04-19 22:06 - 2013-04-19 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-04-19 22:06 - 2013-04-19 22:06 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-04-19 22:05 - 2013-04-19 22:05 - 00254152 ____A (Secure By Design Inc.) C:\Users\Jennifer\Downloads\Ninite Avast Classic Start Dropbox FileZilla Installer.exe
2013-04-19 21:12 - 2013-04-19 21:12 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2013-04-19 20:52 - 2013-04-19 20:52 - 00002257 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-04-19 20:51 - 2013-04-20 19:56 - 00000910 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-04-19 20:51 - 2013-04-20 08:36 - 00000906 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-04-19 20:51 - 2013-04-19 22:07 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Google
2013-04-19 20:51 - 2013-04-19 22:07 - 00000000 ____D C:\Program Files (x86)\Google
2013-04-19 20:51 - 2013-04-19 20:51 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Macromedia
2013-04-19 20:34 - 2013-04-19 20:34 - 00000000 ____D C:\sources
2013-04-19 20:31 - 2013-04-19 20:51 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Deployment
2013-04-19 20:31 - 2013-04-19 20:31 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Apps\2.0
2013-04-19 15:12 - 2013-04-19 15:13 - 00281088 ____A C:\Windows\System32\FNTCACHE.DAT
2013-04-19 12:56 - 2013-04-19 12:56 - 00000027 ____A C:\Windows\Improvement.log
2013-04-19 12:41 - 2013-04-19 12:41 - 00000000 ____D C:\Users\Jennifer\Documents\Bluetooth Folder
2013-04-19 12:41 - 2013-04-19 12:41 - 00000000 ____D C:\Users\Jennifer\AppData\Local\BMExplorer
2013-04-19 12:40 - 2013-04-19 12:40 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Atheros
2013-04-19 12:40 - 2013-04-19 12:40 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\ASUS WebStorage
2013-04-19 12:39 - 2013-04-19 12:39 - 00000196 ____A C:\Windows\FixPatch.log
2013-04-19 12:39 - 2013-04-19 12:39 - 00000000 __RSD C:\Users\Public\Desktop\ASUS
2013-04-19 12:39 - 2013-04-19 12:39 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Adobe
2013-04-19 12:37 - 2013-04-19 20:45 - 00000000 ____D C:\users\Jennifer
2013-04-19 12:37 - 2013-04-19 12:39 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Packages
2013-04-19 12:37 - 2013-04-19 12:38 - 00000000 ____D C:\Users\Jennifer\AppData\Local\ASUS
2013-04-19 12:37 - 2013-04-19 12:37 - 00000020 ___SH C:\Users\Jennifer\ntuser.ini
2013-04-19 12:37 - 2013-04-19 12:37 - 00000000 ____D C:\Users\Jennifer\AppData\Local\VirtualStore
==================== One Month Modified Files and Folders =======
2013-04-20 21:11 - 2013-04-20 21:11 - 01707098 ____A (Farbar) C:\Users\Jennifer\Desktop\FRST64.exe
2013-04-20 21:11 - 2013-04-20 21:11 - 00000000 ____D C:\FRST
2013-04-20 21:09 - 2012-12-28 03:38 - 01667009 ____A C:\Windows\WindowsUpdate.log
2013-04-20 20:00 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\System32\sru
2013-04-20 19:56 - 2013-04-19 20:51 - 00000910 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-04-20 08:48 - 2013-04-20 08:48 - 00000000 ____D C:\Users\Jennifer\Downloads\mbar-1.05.0.1001
2013-04-20 08:47 - 2013-04-20 08:46 - 12917756 ____A C:\Users\Jennifer\Downloads\mbar-1.05.0.1001.zip
2013-04-20 08:43 - 2013-04-20 08:43 - 00001315 ____A C:\Users\Jennifer\Desktop\RKreport[2]_D_04202013_02d0843.txt
2013-04-20 08:42 - 2013-04-20 08:40 - 00000000 ____D C:\Users\Jennifer\Desktop\RK_Quarantine
2013-04-20 08:41 - 2013-04-20 08:41 - 00001262 ____A C:\Users\Jennifer\Desktop\RKreport[1]_S_04202013_02d0841.txt
2013-04-20 08:39 - 2013-04-20 08:39 - 00816128 ____A C:\Users\Jennifer\Desktop\RogueKiller.exe
2013-04-20 08:36 - 2013-04-19 22:11 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Apple Computer
2013-04-20 08:36 - 2013-04-19 22:08 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Dropbox
2013-04-20 08:36 - 2013-04-19 20:51 - 00000906 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-04-20 08:35 - 2012-07-26 02:28 - 00848230 ____A C:\Windows\System32\PerfStringBackup.INI
2013-04-20 08:34 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\rescache
2013-04-20 08:31 - 2012-07-26 02:22 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-04-20 08:30 - 2012-08-01 20:20 - 00056264 ____A C:\Windows\PFRO.log
2013-04-20 08:30 - 2012-07-26 00:26 - 00262144 __ASH C:\Windows\System32\config\BBI
2013-04-20 08:29 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\WinStore
2013-04-20 08:29 - 2012-07-26 03:12 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-04-20 08:29 - 2012-07-26 03:12 - 00000000 ____D C:\Program Files\Windows Defender
2013-04-20 08:29 - 2012-07-26 03:12 - 00000000 ____D C:\Program Files\Common Files\System
2013-04-20 08:29 - 2012-07-26 03:12 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-04-20 08:29 - 2012-07-26 03:12 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-04-20 08:29 - 2012-07-26 02:52 - 00000000 ____D C:\Program Files\Windows Journal
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ___RD C:\Windows\ImmersiveControlPanel
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\SysWOW64\MUI
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\SysWOW64\migwiz
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\SysWOW64\Com
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\System32\SystemResetPlatform
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\System32\MUI
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\System32\migwiz
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\System32\Com
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-04-20 08:28 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\IME
2013-04-20 08:28 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\SysWOW64\winrm
2013-04-20 08:28 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\SysWOW64\WCN
2013-04-20 08:28 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\SysWOW64\slmgr
2013-04-20 08:28 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts
2013-04-20 08:28 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\System32\winrm
2013-04-20 08:28 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\System32\WCN
2013-04-20 08:28 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\System32\slmgr
2013-04-20 08:28 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\System32\Printing_Admin_Scripts
2013-04-20 08:28 - 2012-07-26 00:38 - 00000000 ____D C:\Windows\SysWOW64\oobe
2013-04-20 08:28 - 2012-07-26 00:38 - 00000000 ____D C:\Windows\SysWOW64\Dism
2013-04-20 08:28 - 2012-07-26 00:38 - 00000000 ____D C:\Windows\System32\Sysprep
2013-04-20 08:28 - 2012-07-26 00:38 - 00000000 ____D C:\Windows\System32\oobe
2013-04-20 08:28 - 2012-07-26 00:38 - 00000000 ____D C:\Windows\System32\Dism
2013-04-20 08:26 - 2012-07-26 02:49 - 00000000 ____D C:\Windows\SysWOW64\sysprep
2013-04-20 08:26 - 2012-07-26 00:37 - 00000000 ____D C:\Windows\servicing
2013-04-20 08:22 - 2013-04-20 08:21 - 03191888 ____A (McAfee, Inc.) C:\Users\Jennifer\Downloads\MCPR.exe
2013-04-20 08:19 - 2012-07-26 03:12 - 00000000 ___HD C:\Windows\ELAMBKUP
2013-04-19 23:16 - 2013-04-19 23:15 - 00019005 ____A C:\Users\Jennifer\Desktop\dds.txt
2013-04-19 23:16 - 2013-04-19 23:15 - 00003713 ____A C:\Users\Jennifer\Desktop\attach.txt
2013-04-19 23:14 - 2013-04-19 23:14 - 00688992 ____R (Swearware) C:\Users\Jennifer\Desktop\dds.com
2013-04-19 23:13 - 2013-04-19 23:13 - 00001558 ____A C:\Users\Jennifer\Desktop\aswMBR.txt
2013-04-19 23:13 - 2013-04-19 23:13 - 00000512 ____A C:\Users\Jennifer\Desktop\MBR.dat
2013-04-19 23:11 - 2013-04-19 23:10 - 04745728 ____A (AVAST Software) C:\Users\Jennifer\Desktop\aswMBR.exe
2013-04-19 22:49 - 2013-04-19 22:49 - 00000000 ____D C:\Users\Jennifer\AppData\Local\CrashDumps
2013-04-19 22:34 - 2013-04-19 22:34 - 00001192 ____A C:\Users\Public\Desktop\My LastPass Vault.lnk
2013-04-19 22:34 - 2013-04-19 22:34 - 00000000 ____D C:\Program Files (x86)\LastPass
2013-04-19 22:33 - 2013-04-19 22:33 - 14880256 ____A (LastPass) C:\Users\Jennifer\Downloads\lastpass_x64.exe
2013-04-19 22:27 - 2013-04-19 22:27 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Malwarebytes
2013-04-19 22:12 - 2013-04-19 22:12 - 00001924 ____A C:\Users\Public\Desktop\avast! Free Antivirus.lnk
2013-04-19 22:12 - 2013-04-19 22:12 - 00000000 ____A C:\Windows\SysWOW64\config.nt
2013-04-19 22:11 - 2013-04-19 22:11 - 00001785 ____A C:\Users\Public\Desktop\iTunes.lnk
2013-04-19 22:11 - 2013-04-19 22:11 - 00001111 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-04-19 22:11 - 2013-04-19 22:11 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Apple Computer
2013-04-19 22:11 - 2013-04-19 22:11 - 00000000 ____D C:\Program Files\AVAST Software
2013-04-19 22:11 - 2013-04-19 22:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-04-19 22:11 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files\iTunes
2013-04-19 22:11 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Apple
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files\iPod
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files\Bonjour
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files (x86)\Bonjour
2013-04-19 22:10 - 2013-04-19 22:10 - 00000000 ____D C:\Program Files (x86)\Apple Software Update
2013-04-19 22:08 - 2013-04-19 22:08 - 00000982 ____A C:\Users\Jennifer\Desktop\Dropbox.lnk
2013-04-19 22:07 - 2013-04-19 22:07 - 00001082 ____A C:\Users\Public\Desktop\Google Drive.lnk
2013-04-19 22:07 - 2013-04-19 22:07 - 00000000 ____D C:\Users\Jennifer\AppData\LocalGoogle
2013-04-19 22:07 - 2013-04-19 20:51 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Google
2013-04-19 22:07 - 2013-04-19 20:51 - 00000000 ____D C:\Program Files (x86)\Google
2013-04-19 22:06 - 2013-04-19 22:06 - 00001209 ____A C:\Users\Public\Desktop\FileZilla.lnk
2013-04-19 22:06 - 2013-04-19 22:06 - 00001149 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk
2013-04-19 22:06 - 2013-04-19 22:06 - 00000000 ____D C:\Program Files\Classic Shell
2013-04-19 22:06 - 2013-04-19 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-04-19 22:06 - 2013-04-19 22:06 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-04-19 22:06 - 2013-04-19 22:06 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-04-19 22:05 - 2013-04-19 22:05 - 00254152 ____A (Secure By Design Inc.) C:\Users\Jennifer\Downloads\Ninite Avast Classic Start Dropbox FileZilla Installer.exe
2013-04-19 21:30 - 2012-08-04 20:42 - 00000000 ____D C:\Program Files (x86)\ASUS
2013-04-19 21:12 - 2013-04-19 21:12 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdFs_01_11_00.Wdf
2013-04-19 21:12 - 2012-07-26 02:21 - 00032832 ____A C:\Windows\setupact.log
2013-04-19 20:52 - 2013-04-19 20:52 - 00002257 ____A C:\Users\Public\Desktop\Google Chrome.lnk
2013-04-19 20:51 - 2013-04-19 20:51 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Macromedia
2013-04-19 20:51 - 2013-04-19 20:31 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Deployment
2013-04-19 20:45 - 2013-04-19 12:37 - 00000000 ____D C:\users\Jennifer
2013-04-19 20:40 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-04-19 20:39 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\System32\zh-HK
2013-04-19 20:34 - 2013-04-19 20:34 - 00000000 ____D C:\sources
2013-04-19 20:33 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\Globalization
2013-04-19 20:31 - 2013-04-19 20:31 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Apps\2.0
2013-04-19 16:33 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\AUInstallAgent
2013-04-19 15:34 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\System32\restore
2013-04-19 15:13 - 2013-04-19 15:12 - 00281088 ____A C:\Windows\System32\FNTCACHE.DAT
2013-04-19 15:12 - 2012-07-26 03:13 - 00262144 ____A C:\Windows\System32\config\BCD-Template
2013-04-19 15:12 - 2012-07-26 03:12 - 00000000 ____D C:\Windows\System32\Recovery
2013-04-19 12:56 - 2013-04-19 12:56 - 00000027 ____A C:\Windows\Improvement.log
2013-04-19 12:41 - 2013-04-19 12:41 - 00000000 ____D C:\Users\Jennifer\Documents\Bluetooth Folder
2013-04-19 12:41 - 2013-04-19 12:41 - 00000000 ____D C:\Users\Jennifer\AppData\Local\BMExplorer
2013-04-19 12:40 - 2013-04-19 12:40 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Atheros
2013-04-19 12:40 - 2013-04-19 12:40 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\ASUS WebStorage
2013-04-19 12:39 - 2013-04-19 12:39 - 00000196 ____A C:\Windows\FixPatch.log
2013-04-19 12:39 - 2013-04-19 12:39 - 00000000 __RSD C:\Users\Public\Desktop\ASUS
2013-04-19 12:39 - 2013-04-19 12:39 - 00000000 ____D C:\Users\Jennifer\AppData\Roaming\Adobe
2013-04-19 12:39 - 2013-04-19 12:37 - 00000000 ____D C:\Users\Jennifer\AppData\Local\Packages
2013-04-19 12:39 - 2012-08-04 20:42 - 05181376 ____A C:\Windows\AsDebug.log
2013-04-19 12:39 - 2012-08-04 20:42 - 00739018 ____A C:\Windows\AsCDProc.log
2013-04-19 12:39 - 2012-08-04 20:37 - 00002232 ____A C:\Windows\PQArecord.log
2013-04-19 12:39 - 2012-08-01 20:36 - 00000000 ____D C:\Windows\Log
2013-04-19 12:39 - 2012-07-26 00:26 - 00262144 __ASH C:\Windows\System32\config\ELAM
2013-04-19 12:38 - 2013-04-19 12:37 - 00000000 ____D C:\Users\Jennifer\AppData\Local\ASUS
2013-04-19 12:37 - 2013-04-19 12:37 - 00000020 ___SH C:\Users\Jennifer\ntuser.ini
2013-04-19 12:37 - 2013-04-19 12:37 - 00000000 ____D C:\Users\Jennifer\AppData\Local\VirtualStore
2013-04-04 14:50 - 2013-04-19 22:11 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe
[2012-12-28 03:38] - [2012-09-20 01:33] - 0516608 ____A (Microsoft Corporation) 1F84B5F8DBDFFD36DF143C61CE25F12A
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\explorer.exe
[2012-07-25 18:14] - [2012-07-25 23:49] - 2380440 ____A (Microsoft Corporation) 928791755FDDEA721B053535EF84FA17
C:\Windows\SysWOW64\explorer.exe
[2012-07-25 18:11] - [2012-07-25 22:50] - 2114936 ____A (Microsoft Corporation) 5B6ED1B57DBFF18D405A0260559B571E
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
Last Boot: 2012-08-01 20:20
==================== End Of Log ============================
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 21-04-2013 01
Ran by Jennifer at 2013-04-20 21:12:14 Run:
Running from C:\Users\Jennifer\Desktop
Boot Mode: Normal
==========================================================
==================== Installed Programs =======================
Adobe Reader X MUI (Version: 10.0.0)
Apple Application Support (Version: 2.3.3)
Apple Mobile Device Support (Version: 6.1.0.13)
Apple Software Update (Version: 2.1.3.127)
ASUS Instant Connect (Version: 1.2.8)
ASUS InstantOn (Version: 3.0.4)
ASUS Live Update (Version: 3.1.9)
ASUS Smart Gesture (Version: 1.0.35)
ASUSDVD (Version: 10.0.4126.52)
ATK Package (Version: 1.0.0025)
avast! Free Antivirus (Version: 8.0.1483.0)
Bonjour (Version: 3.0.0.10)
Classic Shell (Version: 3.6.7)
Dropbox (Version: 2.0.7)
FileZilla Client 3.6.0.2 (Version: 3.6.0.2)
Google Chrome (Version: 26.0.1410.64)
Google Drive (Version: 1.8.4357.4863)
Google Update Helper (Version: 1.3.21.135)
Intel(R) Management Engine Components (Version: 8.1.0.1252)
Intel(R) Processor Graphics (Version: 9.17.10.2828)
Intel(R) SDK for OpenCL - CPU Only Runtime Package (Version: 2.0.0.37149)
Intel® Trusted Connect Service Client (Version: 1.24.388.1)
iTunes (Version: 11.0.2.26)
LastPass(uninstall only)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300)
Microsoft Office (Version: 14.0.6120.5004)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.59193)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 (Version: 10.0.40219)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (Version: 10.0.40219)
Mozilla Firefox 20.0.1 (x86 en-US) (Version: 20.0.1)
Mozilla Maintenance Service (Version: 20.0.1)
Qualcomm Atheros Bluetooth Suite (64) (Version: 8.0.0.206)
Qualcomm Atheros Client Installation Program (Version: 10.0)
Realtek Ethernet Controller Driver (Version: 8.2.612.2012)
Realtek High Definition Audio Driver (Version: 6.0.1.6685)
Realtek PCIE Card Reader (Version: 6.2.8400.27024)
Shared C Run-time for x64 (Version: 10.0.0)
Windows Driver Package - ASUS (ATP) Mouse (10/29/2012 1.0.0.148) (Version: 10/29/2012 1.0.0.148)
WinFlash (Version: 2.41.1)
==================== Restore Points =========================
19-04-2013 20:34:00 Language Pack Removal
20-04-2013 02:42:03 Initial Backup
21-04-2013 00:46:52 Per Dr. Virus
==================== Faulty Device Manager Devices =============
==================== Event log errors: =========================
Application errors:
==================
Error: (04/20/2013 08:31:37 AM) (Source: Application Error) (User: )
Description: Faulting application name: 005548~1.EXE, version: 7.1.107.0, time stamp: 0x51098160
Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
Exception code: 0xc0000005
Fault offset: 0x6f72505c
Faulting process id: 0x700
Faulting application start time: 0x005548~1.EXE0
Faulting application path: 005548~1.EXE1
Faulting module path: 005548~1.EXE2
Report Id: 005548~1.EXE3
Faulting package full name: 005548~1.EXE4
Faulting package-relative application ID: 005548~1.EXE5
Error: (04/20/2013 08:31:30 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 Jen.local. AAAA FE80:0000:0000:0000:1D38:2A5D:E457:6540
Error: (04/20/2013 08:31:30 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.15:5353 4 JEN.local. Addr 192.168.0.15
Error: (04/20/2013 08:31:30 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 4 Jen.local. Addr 192.168.0.17
Error: (04/20/2013 08:31:30 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.15:5353 4 JEN.local. Addr 192.168.0.15
Error: (04/20/2013 08:15:31 AM) (Source: Bonjour Service) (User: )
Description: Local Hostname Jen.local already in use; will try Jen-2.local instead
Error: (04/20/2013 08:15:31 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreReceiveResponse: ProbeCount 1; will deregister 4 Jen.local. Addr 192.168.0.17
Error: (04/20/2013 08:15:31 AM) (Source: Bonjour Service) (User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.15:5353 4 JEN.local. Addr 192.168.0.15
Error: (04/19/2013 10:49:47 PM) (Source: Application Error) (User: )
Description: Faulting application name: notepad.exe, version: 6.2.9200.16384, time stamp: 0x501099bc
Faulting module name: ntdll.dll, version: 6.2.9200.16420, time stamp: 0x505ab405
Exception code: 0xc0000374
Fault offset: 0x00000000000ea485
Faulting process id: 0x17f0
Faulting application start time: 0xnotepad.exe0
Faulting application path: notepad.exe1
Faulting module path: notepad.exe2
Report Id: notepad.exe3
Faulting package full name: notepad.exe4
Faulting package-relative application ID: notepad.exe5
System errors:
=============
Error: (04/20/2013 08:31:40 AM) (Source: Service Control Manager) (User: )
Description: The McAfee Application Installer Cleanup (0055481366430763) service terminated unexpectedly. It has done this 1 time(s).
Error: (04/20/2013 08:31:32 AM) (Source: Server) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{DC47B852-3008-47DB-BB4E-5AD914CAF089} because another computer on the network has the same name. The server could not start.
Error: (04/20/2013 08:31:32 AM) (Source: NetBT) (User: )
Description: The name "JEN :20" could not be registered on the interface with IP address 192.168.0.17.
The computer with the IP address 192.168.0.15 did not allow the name to be claimed by
this computer.
Error: (04/20/2013 08:30:27 AM) (Source: Microsoft-Windows-Kernel-General) (User: NT AUTHORITY)
Description: 0xc000014d0
Error: (04/20/2013 08:15:29 AM) (Source: NetBT) (User: )
Description: The name "JEN :20" could not be registered on the interface with IP address 192.168.0.17.
The computer with the IP address 192.168.0.15 did not allow the name to be claimed by
this computer.
Error: (04/20/2013 08:15:29 AM) (Source: Server) (User: )
Description: The server could not bind to the transport \Device\NetBT_Tcpip_{DC47B852-3008-47DB-BB4E-5AD914CAF089} because another computer on the network has the same name. The server could not start.
Error: (04/19/2013 11:05:59 PM) (Source: Service Control Manager) (User: )
Description: The Interactive Services Detection service terminated with the following error:
%%1
Error: (04/19/2013 08:48:14 PM) (Source: DCOM) (User: NT AUTHORITY)
Description: {3A185DDE-E020-4985-A8F2-E27CDC4A0F3A}
Error: (04/19/2013 08:46:07 PM) (Source: Service Control Manager) (User: )
Description: The McAfee Network Agent service depends on the following service: MfeFire. This service might not be installed.
Error: (04/19/2013 08:43:50 PM) (Source: NetBT) (User: )
Description: The name "JEN :20" could not be registered on the interface with IP address 192.168.0.17.
The computer with the IP address 192.168.0.15 did not allow the name to be claimed by
this computer.
Microsoft Office Sessions:
=========================
Error: (04/20/2013 08:31:37 AM) (Source: Application Error)(User: )
Description: 005548~1.EXE7.1.107.051098160unknown0.0.0.000000000c00000056f72505c70001ce3dcb5928a012C:\Windows\TEMP\005548~1.EXEunknown9fae6b33-a9be-11e2-be75-6c71d9239404
Error: (04/20/2013 08:31:30 AM) (Source: Bonjour Service)(User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 16 Jen.local. AAAA FE80:0000:0000:0000:1D38:2A5D:E457:6540
Error: (04/20/2013 08:31:30 AM) (Source: Bonjour Service)(User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.15:5353 4 JEN.local. Addr 192.168.0.15
Error: (04/20/2013 08:31:30 AM) (Source: Bonjour Service)(User: )
Description: mDNSCoreReceiveResponse: Resetting to Probing: 4 Jen.local. Addr 192.168.0.17
Error: (04/20/2013 08:31:30 AM) (Source: Bonjour Service)(User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.15:5353 4 JEN.local. Addr 192.168.0.15
Error: (04/20/2013 08:15:31 AM) (Source: Bonjour Service)(User: )
Description: Local Hostname Jen.local already in use; will try Jen-2.local instead
Error: (04/20/2013 08:15:31 AM) (Source: Bonjour Service)(User: )
Description: mDNSCoreReceiveResponse: ProbeCount 1; will deregister 4 Jen.local. Addr 192.168.0.17
Error: (04/20/2013 08:15:31 AM) (Source: Bonjour Service)(User: )
Description: mDNSCoreReceiveResponse: Received from 192.168.0.15:5353 4 JEN.local. Addr 192.168.0.15
Error: (04/19/2013 10:49:47 PM) (Source: Application Error)(User: )
Description: notepad.exe6.2.9200.16384501099bcntdll.dll6.2.9200.16420505ab405c000037400000000000ea48517f001ce3d7a113efe5eC:\Windows\system32\notepad.exeC:\Windows\SYSTEM32\ntdll.dll57fdb26a-a96d-11e2-be74-6c71d9239404
==================== Memory info ===========================
Percentage of memory in use: 16%
Total physical RAM: 8077.54 MB
Available physical RAM: 6709.8 MB
Total Pagefile: 12685.54 MB
Available Pagefile: 11210.09 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB
==================== Drives ================================
Drive c: (OS) (Fixed) (Total:279.45 GB) (Free:238.11 GB) NTFS (Disk=0 Partition=4) ==>[System with boot components (obtained from reading drive)]
Drive d: (DATA) (Fixed) (Total:397.87 GB) (Free:397.23 GB) NTFS
Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 698 GB 0 B *
Partitions of Disk 0:
===============
Disk ID: {DC9EB263-3B9E-41D0-B370-BAB1E79722C6}
Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 System (partition with boot components) 300 MB 1024 KB
Partition 2 Recovery 900 MB 301 MB
Partition 3 Reserved 128 MB 1201 MB
Partition 4 Primary 279 GB 1329 MB
Partition 5 Primary 397 GB 280 GB
Partition 6 Recovery 20 GB 678 GB
==================================================================================
Disk: 0
Partition 1
Type : c12a7328-f81f-11d2-ba4b-00a0c93ec93b
Hidden : Yes
Required: No
Attrib : 0X8000000000000000
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 3 SYSTEM FAT32 Partition 300 MB Healthy System (partition with boot components)
=========================================================
Disk: 0
Partition 2
Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden : Yes
Required: Yes
Attrib : 0X8000000000000001
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 Recovery NTFS Partition 900 MB Healthy Hidden
=========================================================
Disk: 0
Partition 3
Type : e3c9e316-0b5c-4db8-817d-f92df00215ae
Hidden : Yes
Required: No
Attrib : 0X8000000000000000
There is no volume associated with this partition.
=========================================================
Disk: 0
Partition 4
Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Hidden : No
Required: No
Attrib : 0000000000000000
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C OS NTFS Partition 279 GB Healthy Boot
=========================================================
Disk: 0
Partition 5
Type : ebd0a0a2-b9e5-4433-87c0-68b6b72699c7
Hidden : No
Required: No
Attrib : 0000000000000000
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D DATA NTFS Partition 397 GB Healthy
=========================================================
Disk: 0
Partition 6
Type : de94bba4-06d1-4d40-a16a-bfd50179d6ac
Hidden : Yes
Required: Yes
Attrib : 0X8000000000000001
Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 5 Restore NTFS Partition 20 GB Healthy Hidden
=========================================================
============================== MBR & Partition Table ==================
====================================================================
Disk: 0 (Size: 699 GB) (Disk ID: C2B20764)
Partition 1: GPT Partition Type
That looks clean.
http://dev.discussions.virtualdr.forums.relay.cool/ Please download AdwCleaner by Xplode onto your desktop.
- Close all open programs and internet browsers.
- Double click on adwcleaner.exe to run the tool.
- Click on Delete.
- Confirm each time with Ok.
- Your computer will be rebooted automatically. A text file will open after the restart.
- Please post the contents of that logfile with your next reply.
- You can find the logfile at C:\AdwCleaner[S1].txt as well.
http://dev.discussions.virtualdr.forums.relay.cool/ Please download Junkware Removal Tool to your desktop.
- Shut down your protection software now to avoid potential conflicts.
- Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
- The tool will open and start scanning your system.
- Please be patient as this can take a while to complete depending on your system's specifications.
- On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
- Post the contents of JRT.txt into your next message.
http://dev.discussions.virtualdr.forums.relay.cool/ Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Click the Scan All Users checkbox.
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
# AdwCleaner v2.200 - Logfile created 04/20/2013 at 21:36:59
# Updated 02/04/2013 by Xplode
# Operating system : Windows 8 (64 bits)
# User : Jennifer - JEN
# Boot Mode : Normal
# Running from : C:\Users\Jennifer\Desktop\adwcleaner.exe
# Option [Delete]
***** [Services] *****
***** [Files / Folders] *****
***** [Registry] *****
***** [Internet Browsers] *****
-\\ Internet Explorer v10.0.9200.16384
[OK] Registry is clean.
-\\ Google Chrome v26.0.1410.64
File : C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Preferences
Deleted [l.3508] : urls_to_restore_on_startup = [ "hxxps://www.google.com/reader", "hxxp://www.google.com/", "ht[...]
*************************
AdwCleaner[S1].txt - [732 octets] - [20/04/2013 21:36:59]
########## EOF - C:\AdwCleaner[S1].txt - [791 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 4.8.6 (04.19.2013:1)
OS: Windows 8 x64
Ran by Jennifer on Sat 04/20/2013 at 21:42:21.00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Sat 04/20/2013 at 21:48:25.08
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
OTL logfile created on: 4/20/2013 9:50:51 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jennifer\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16420)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
7.89 Gb Total Physical Memory | 6.80 Gb Available Physical Memory | 86.26% Memory free
12.39 Gb Paging File | 11.22 Gb Available in Paging File | 90.54% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279.45 Gb Total Space | 237.94 Gb Free Space | 85.15% Space Free | Partition Type: NTFS
Drive D: | 397.87 Gb Total Space | 397.23 Gb Free Space | 99.84% Space Free | Partition Type: NTFS
Computer Name: JEN | User Name: Jennifer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013/04/20 21:36:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jennifer\Desktop\OTL.exe
PRC - [2013/04/12 23:27:48 | 000,068,608 | ---- | M] (IvoSoft) -- C:\Program Files\Classic Shell\ClassicShellService.exe
PRC - [2013/03/06 17:32:44 | 004,767,304 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exe
PRC - [2013/03/06 17:32:44 | 000,045,248 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe
PRC - [2012/10/31 15:09:50 | 000,020,352 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\ASUS Smart Gesture\QuickGesture\x86\QuickGesture.exe
PRC - [2012/10/26 17:35:44 | 000,184,704 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2012/10/17 22:08:40 | 000,205,184 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
PRC - [2012/10/05 18:55:50 | 000,110,976 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
PRC - [2012/09/14 16:14:16 | 000,328,064 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
PRC - [2012/08/31 22:27:20 | 000,590,208 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnWMI.exe
PRC - [2012/08/22 12:24:28 | 001,559,936 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
PRC - [2012/08/10 20:37:48 | 000,323,584 | R--- | M] (Atheros) -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe
PRC - [2012/07/17 17:57:22 | 000,365,376 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2012/07/17 17:57:20 | 000,277,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2012/06/27 15:47:02 | 000,129,856 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe
PRC - [2012/06/25 13:57:14 | 000,166,720 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
PRC - [2012/05/28 13:04:48 | 000,113,312 | ---- | M] (ASUSTek Computer Inc.) -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe
PRC - [2012/04/13 13:14:00 | 000,277,120 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe
PRC - [2012/03/28 21:34:30 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe
PRC - [2011/11/21 17:19:50 | 000,096,896 | ---- | M] (ASUS) -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
========== Modules (No Company Name) ==========
MOD - [2013/01/28 13:08:56 | 000,087,952 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2013/01/28 13:08:28 | 001,242,512 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
========== Services (SafeList) ==========
SRV:64bit: - [2013/04/12 23:27:48 | 000,068,608 | ---- | M] (IvoSoft) [Auto | Running] -- C:\Program Files\Classic Shell\ClassicShellService.exe -- (ClassicShellService)
SRV:64bit: - [2013/03/06 17:32:44 | 000,045,248 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV:64bit: - [2012/09/20 04:10:47 | 002,367,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)
SRV:64bit: - [2012/09/20 03:18:03 | 002,675,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)
SRV:64bit: - [2012/09/20 01:32:59 | 000,169,984 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)
SRV:64bit: - [2012/09/20 01:32:58 | 000,178,176 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)
SRV:64bit: - [2012/09/20 01:31:18 | 000,116,736 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)
SRV:64bit: - [2012/09/20 01:30:41 | 000,179,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)
SRV:64bit: - [2012/09/20 01:30:38 | 000,169,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)
SRV:64bit: - [2012/07/25 22:17:59 | 000,015,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV:64bit: - [2012/07/25 22:08:04 | 001,968,128 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)
SRV:64bit: - [2012/07/25 22:07:47 | 000,065,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)
SRV:64bit: - [2012/07/25 22:07:42 | 000,263,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)
SRV:64bit: - [2012/07/25 22:07:40 | 000,283,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)
SRV:64bit: - [2012/07/25 22:07:25 | 000,012,800 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)
SRV:64bit: - [2012/07/25 22:06:36 | 000,463,872 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)
SRV:64bit: - [2012/07/25 22:06:34 | 000,743,936 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)
SRV:64bit: - [2012/07/25 22:06:33 | 000,161,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)
SRV:64bit: - [2012/07/25 22:06:33 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)
SRV:64bit: - [2012/07/25 22:06:00 | 000,438,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)
SRV:64bit: - [2012/07/25 22:05:55 | 000,059,904 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)
SRV:64bit: - [2012/07/25 22:05:34 | 000,037,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)
SRV:64bit: - [2012/07/25 22:05:28 | 000,207,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)
SRV:64bit: - [2012/07/25 22:05:24 | 000,342,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)
SRV:64bit: - [2012/07/25 22:05:08 | 000,122,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AUInstallAgent.dll -- (AllUserInstallAgent)
SRV:64bit: - [2012/07/25 19:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)
SRV:64bit: - [2012/07/25 19:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)
SRV:64bit: - [2012/07/25 19:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)
SRV:64bit: - [2012/07/25 19:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)
SRV:64bit: - [2012/07/25 19:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)
SRV:64bit: - [2012/07/25 19:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)
SRV:64bit: - [2012/04/20 17:16:12 | 000,635,104 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R)
SRV - [2013/04/10 01:58:17 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/01/30 15:26:50 | 000,833,616 | ---- | M] (McAfee, Inc.) [Auto | Stopped] -- C:\Windows\Temp\0055481366430763mcinst.exe -- (0055481366430763mcinstcleanup)
SRV - [2012/10/05 18:55:50 | 000,110,976 | ---- | M] (ASUSTek Computer Inc.) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe -- (ASLDRService)
SRV - [2012/09/20 03:18:03 | 002,675,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll -- (PrintNotify)
SRV - [2012/08/16 01:40:12 | 000,276,288 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2012/08/10 21:28:14 | 000,211,584 | ---- | M] (Qualcomm Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\AdminService.exe -- (AtherosSvc)
SRV - [2012/08/10 20:37:48 | 000,323,584 | R--- | M] (Atheros) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\Ath_CoexAgent.exe -- (ZAtheros Bt&Wlan Coex Agent)
SRV - [2012/07/25 22:20:04 | 000,018,432 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)
SRV - [2012/07/17 17:57:22 | 000,365,376 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2012/07/17 17:57:20 | 000,277,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2012/07/13 04:02:16 | 002,451,456 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2012/06/27 15:47:02 | 000,129,856 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe -- (Intel(R)
SRV - [2012/06/25 13:57:14 | 000,166,720 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe -- (jhi_service)
SRV - [2012/04/13 13:14:00 | 000,277,120 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ASUS InstantOn\InsOnSrv.exe -- (ASUS InstantOn)
SRV - [2011/11/21 17:19:50 | 000,096,896 | ---- | M] (ASUS) [Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2013/03/06 17:33:21 | 001,025,808 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2013/03/06 17:33:21 | 000,377,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2013/03/06 17:33:21 | 000,178,624 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2013/03/06 17:33:21 | 000,070,992 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2013/03/06 17:33:21 | 000,068,920 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)
DRV:64bit: - [2013/03/06 17:33:21 | 000,065,336 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2013/03/06 17:33:20 | 000,080,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\Drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2013/03/06 17:33:20 | 000,033,400 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV:64bit: - [2012/10/31 15:10:00 | 000,061,824 | ---- | M] (ASUS Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\AsusTP.sys -- (ATP)
DRV:64bit: - [2012/09/20 03:31:29 | 000,068,840 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\pdc.sys -- (pdc)
DRV:64bit: - [2012/09/20 02:55:33 | 000,445,160 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\USBHUB3.SYS -- (USBHUB3)
DRV:64bit: - [2012/09/20 02:55:33 | 000,337,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\USBXHCI.SYS -- (USBXHCI)
DRV:64bit: - [2012/09/20 02:55:33 | 000,212,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\UCX01000.SYS -- (UCX01000)
DRV:64bit: - [2012/09/20 02:55:30 | 000,120,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpioclx.sys -- (GPIOClx0101)
DRV:64bit: - [2012/09/20 02:55:30 | 000,056,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdstor.sys -- (sdstor)
DRV:64bit: - [2012/09/20 02:55:29 | 000,028,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpiowin32.sys -- (msgpiowin32)
DRV:64bit: - [2012/09/20 02:55:27 | 003,265,256 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2012/09/20 02:55:24 | 000,533,224 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2012/09/20 02:03:08 | 000,148,712 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\tpm.sys -- (TPM)
DRV:64bit: - [2012/09/20 02:03:06 | 000,194,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2012/09/20 02:03:03 | 000,055,528 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\Drivers\dam.sys -- (dam)
DRV:64bit: - [2012/09/20 01:09:11 | 000,031,104 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthAvrcpTg.sys -- (BthAvrcpTg)
DRV:64bit: - [2012/09/20 01:08:27 | 000,029,952 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthhfHid.sys -- (bthhfhid)
DRV:64bit: - [2012/08/21 13:01:20 | 000,033,240 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2012/08/16 03:01:20 | 003,624,960 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\athw8x.sys -- (athr)
DRV:64bit: - [2012/08/15 12:53:06 | 008,987,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2012/08/10 21:09:46 | 000,567,808 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2012/08/10 21:09:44 | 000,135,832 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2012/08/10 21:09:42 | 000,178,840 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2012/08/10 21:09:42 | 000,088,728 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2012/08/10 21:09:42 | 000,076,952 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2012/08/10 21:09:40 | 000,344,216 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2012/08/10 21:09:40 | 000,114,840 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btath_avdt.sys -- (btath_avdt)
DRV:64bit: - [2012/08/10 21:09:40 | 000,033,944 | ---- | M] (Qualcomm Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2012/08/01 22:22:48 | 000,014,992 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\kbfiltr.sys -- (kbfiltr)
DRV:64bit: - [2012/07/26 00:26:46 | 000,025,328 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/07/26 00:26:45 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\condrv.sys -- (condrv)
DRV:64bit: - [2012/07/26 00:00:58 | 000,322,800 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\VSTXRAID.SYS -- (VSTXRAID)
DRV:64bit: - [2012/07/26 00:00:58 | 000,106,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\VerifierExt.sys -- (VerifierExt)
DRV:64bit: - [2012/07/26 00:00:58 | 000,097,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\uaspstor.sys -- (UASPStor)
DRV:64bit: - [2012/07/26 00:00:57 | 000,077,040 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\acpiex.sys -- (acpiex)
DRV:64bit: - [2012/07/26 00:00:55 | 000,283,888 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\spaceport.sys -- (spaceport)
DRV:64bit: - [2012/07/26 00:00:55 | 000,077,552 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\storahci.sys -- (storahci)
DRV:64bit: - [2012/07/26 00:00:55 | 000,064,240 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\mvumis.sys -- (mvumis)
DRV:64bit: - [2012/07/26 00:00:55 | 000,030,960 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2012/07/26 00:00:52 | 000,092,400 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2012/07/26 00:00:52 | 000,081,136 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sss.sys -- (LSI_SSS)
DRV:64bit: - [2012/07/26 00:00:52 | 000,064,752 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2012/07/26 00:00:51 | 000,113,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)
DRV:64bit: - [2012/07/26 00:00:51 | 000,081,136 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\EhStorClass.sys -- (EhStorClass)
DRV:64bit: - [2012/07/26 00:00:49 | 000,258,288 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2012/07/26 00:00:49 | 000,106,736 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\3ware.sys -- (3ware)
DRV:64bit: - [2012/07/26 00:00:49 | 000,076,016 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2012/07/26 00:00:48 | 000,026,352 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2012/07/25 23:57:54 | 000,361,200 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\clfs.sys -- (CLFS)
DRV:64bit: - [2012/07/25 23:54:34 | 000,096,496 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\wfplwfs.sys -- (WFPLWFS)
DRV:64bit: - [2012/07/25 23:53:16 | 000,067,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vpci.sys -- (vpci)
DRV:64bit: - [2012/07/25 23:44:30 | 000,258,288 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WdFilter.sys -- (WdFilter)
DRV:64bit: - [2012/07/25 23:36:15 | 000,034,216 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WdBoot.sys -- (WdBoot)
DRV:64bit: - [2012/07/25 22:17:38 | 000,036,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\terminpt.sys -- (terminpt)
DRV:64bit: - [2012/07/25 22:17:38 | 000,027,888 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/07/25 21:29:14 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mshidumdf.sys -- (mshidumdf)
DRV:64bit: - [2012/07/25 21:29:08 | 000,048,640 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicDisplay.sys -- (BasicDisplay)
DRV:64bit: - [2012/07/25 21:29:03 | 000,024,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\HyperVideo.sys -- (HyperVideo)
DRV:64bit: - [2012/07/25 21:28:52 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicRender.sys -- (BasicRender)
DRV:64bit: - [2012/07/25 21:27:58 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\fxppm.sys -- (FxPPM)
DRV:64bit: - [2012/07/25 21:27:58 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vmgencounter.sys -- (gencounter)
DRV:64bit: - [2012/07/25 21:27:41 | 000,018,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\kdnic.sys -- (kdnic)
DRV:64bit: - [2012/07/25 21:27:37 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpitime.sys -- (acpitime)
DRV:64bit: - [2012/07/25 21:27:33 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\npsvctrig.sys -- (npsvctrig)
DRV:64bit: - [2012/07/25 21:27:29 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WpdUpFltr.sys -- (WpdUpFltr)
DRV:64bit: - [2012/07/25 21:27:16 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpipagr.sys -- (acpipagr)
DRV:64bit: - [2012/07/25 21:27:01 | 000,011,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hyperkbd.sys -- (hyperkbd)
DRV:64bit: - [2012/07/25 21:26:46 | 000,062,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SerCx.sys -- (SerCx)
DRV:64bit: - [2012/07/25 21:26:43 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SpbCx.sys -- (SpbCx)
DRV:64bit: - [2012/07/25 21:26:34 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/07/25 21:26:13 | 000,051,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\bthhfenum.sys -- (BthHFEnum)
DRV:64bit: - [2012/07/25 21:25:57 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2012/07/25 21:25:56 | 000,057,344 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012/07/25 21:25:54 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hidi2c.sys -- (hidi2c)
DRV:64bit: - [2012/07/25 21:25:13 | 000,045,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\wpcfltr.sys -- (wpcfltr)
DRV:64bit: - [2012/07/25 21:25:02 | 000,202,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\BthLEEnum.sys -- (BthLEEnum)
DRV:64bit: - [2012/07/25 21:25:01 | 000,126,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\NdisImPlatform.sys -- (NdisImPlatform)
DRV:64bit: - [2012/07/25 21:23:53 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mslldp.sys -- (MsLldp)
DRV:64bit: - [2012/07/25 21:23:42 | 000,097,792 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\Drivers\Ndu.sys -- (Ndu)
DRV:64bit: - [2012/07/23 22:16:28 | 000,645,952 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\iaStorA.sys -- (iaStorA)
DRV:64bit: - [2012/07/03 01:09:08 | 000,295,056 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\RtsBaStor.sys -- (RSBASTOR)
DRV:64bit: - [2012/07/02 18:16:02 | 000,062,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2012/06/18 18:40:50 | 000,342,528 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2012/06/12 08:41:22 | 000,683,664 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\Rt630x64.sys -- (RTL8168)
DRV:64bit: - [2012/06/02 09:34:37 | 001,146,880 | ---- | M] (LSI Corp) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\agrsm64.sys -- (AgereSoftModem)
DRV:64bit: - [2012/06/02 09:31:50 | 008,604,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\NETwNs64.sys -- (NETwNs64)
DRV:64bit: - [2012/06/02 09:31:38 | 000,333,824 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\e1i63x64.sys -- (e1iexpress)
DRV:64bit: - [2012/05/30 22:47:44 | 000,021,152 | ---- | M] (ASUS) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\AsHIDSwitch64.sys -- (HIDSwitch)
DRV:64bit: - [2011/05/18 10:08:32 | 000,047,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\dc3d.sys -- (dc3d)
DRV - [2011/09/07 12:55:04 | 000,017,536 | ---- | M] (ASUS) [Kernel | System | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys -- (ATKWMIACPIIO)
DRV - [2009/07/02 20:36:14 | 000,015,416 | ---- | M] (ASUS) [Kernel | Auto | Running] -- C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys -- (ASMMAP64)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=ASU2JS
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-246020111-3510042927-2518832696-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://asus13.msn.com
IE - HKU\S-1-5-21-246020111-3510042927-2518832696-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://asus13.msn.com
IE - HKU\S-1-5-21-246020111-3510042927-2518832696-1001\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-246020111-3510042927-2518832696-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-246020111-3510042927-2518832696-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
second half of the OTL Log
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.1.42: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[email protected]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013/04/19 22:12:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013/04/19 22:06:35 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2013/04/19 22:06:35 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013/04/10 01:58:33 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013/04/10 01:57:54 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013/04/10 01:57:54 | 000,002,086 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\twitter.xml
========== Chrome ==========
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\26.0.1410.64\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - Extension: LastPass = C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\hdokiejnpimakedhajhdlcegeplioahd\2.0.25_0\
CHR - Extension: avast! WebRep = C:\Users\Jennifer\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\8.0.1483_0\
O1 HOSTS File: ([2012/07/26 00:26:49 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
O2:64bit: - BHO: (LastPass Vault) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (LastPass Vault) - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (LastPass Toolbar) - {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4:64bit: - HKLM..\Run: [BtTray] C:\Program Files (x86)\Bluetooth Suite\BtTray.exe (Qualcomm Atheros)
O4:64bit: - HKLM..\Run: [BtvStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Qualcomm Atheros Commnucations)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [RemoteControl10] C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe (CyberLink Corp.)
O4 - Startup: C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Jennifer\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O8:64bit: - Extra context menu item: LastPass - file://C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=lastpass File not found
O8:64bit: - Extra context menu item: LastPass Fill Forms - file://C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=fillforms File not found
O8 - Extra context menu item: LastPass - file://C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=fillforms File not found
O9:64bit: - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
O9:64bit: - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar_x64.dll (LastPass)
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Qualcomm Atheros Commnucations)
O9 - Extra Button: LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
O9 - Extra 'Tools' menuitem : LastPass - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\Program Files (x86)\LastPass\LPToolbar.dll (LastPass)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{DC47B852-3008-47DB-BB4E-5AD914CAF089}: DhcpNameServer = 192.168.0.1
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013/04/20 21:42:19 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2013/04/20 21:42:11 | 000,000,000 | ---D | C] -- C:\JRT
[2013/04/20 21:36:27 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Jennifer\Desktop\OTL.exe
[2013/04/20 21:36:21 | 000,552,158 | ---- | C] (Oleg N. Scherbakov) -- C:\Users\Jennifer\Desktop\JRT.exe
[2013/04/20 21:11:47 | 000,000,000 | ---D | C] -- C:\FRST
[2013/04/20 21:11:30 | 001,707,098 | ---- | C] (Farbar) -- C:\Users\Jennifer\Desktop\FRST64.exe
[2013/04/20 08:40:01 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\Desktop\RK_Quarantine
[2013/04/19 23:14:31 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Jennifer\Desktop\dds.com
[2013/04/19 23:10:21 | 004,745,728 | ---- | C] (AVAST Software) -- C:\Users\Jennifer\Desktop\aswMBR.exe
[2013/04/19 22:49:52 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\CrashDumps
[2013/04/19 22:34:25 | 014,880,256 | ---- | C] (LastPass) -- C:\Program Files (x86)\Common Files\lpuninstall.exe
[2013/04/19 22:34:22 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\LastPass
[2013/04/19 22:34:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LastPass
[2013/04/19 22:34:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LastPass
[2013/04/19 22:27:54 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Malwarebytes
[2013/04/19 22:12:47 | 000,377,920 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2013/04/19 22:12:47 | 000,070,992 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2013/04/19 22:12:47 | 000,068,920 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswTdi.sys
[2013/04/19 22:12:47 | 000,033,400 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswFsBlk.sys
[2013/04/19 22:12:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\avast! Free Antivirus
[2013/04/19 22:12:42 | 001,025,808 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2013/04/19 22:12:41 | 000,080,816 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2013/04/19 22:12:40 | 000,287,840 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2013/04/19 22:12:07 | 000,041,664 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2013/04/19 22:11:59 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2013/04/19 22:11:59 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013/04/19 22:11:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/04/19 22:11:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/04/19 22:11:41 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013/04/19 22:11:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013/04/19 22:11:40 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Programs
[2013/04/19 22:11:36 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Apple Computer
[2013/04/19 22:11:36 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Apple Computer
[2013/04/19 22:11:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2013/04/19 22:11:21 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\DRVSTORE
[2013/04/19 22:10:58 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2013/04/19 22:10:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2013/04/19 22:10:58 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2013/04/19 22:10:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2013/04/19 22:10:58 | 000,000,000 | ---D | C] -- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
[2013/04/19 22:10:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2013/04/19 22:10:35 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Apple
[2013/04/19 22:10:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2013/04/19 22:10:31 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2013/04/19 22:10:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Bonjour
[2013/04/19 22:10:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2013/04/19 22:10:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2013/04/19 22:08:45 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
[2013/04/19 22:08:02 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Dropbox
[2013/04/19 22:07:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Drive
[2013/04/19 22:06:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Classic Shell
[2013/04/19 22:06:54 | 000,000,000 | ---D | C] -- C:\Program Files\Classic Shell
[2013/04/19 22:06:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileZilla FTP Client
[2013/04/19 22:06:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileZilla FTP Client
[2013/04/19 22:06:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2013/04/19 22:06:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2013/04/19 22:06:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013/04/19 21:31:10 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013/04/19 20:52:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
[2013/04/19 20:51:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google
[2013/04/19 20:51:15 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Google
[2013/04/19 20:51:06 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Macromedia
[2013/04/19 20:34:49 | 000,000,000 | ---D | C] -- C:\sources
[2013/04/19 20:31:13 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Deployment
[2013/04/19 20:31:13 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Apps
[2013/04/19 15:12:50 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2013/04/19 12:41:13 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\BMExplorer
[2013/04/19 12:41:13 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\Documents\Bluetooth Folder
[2013/04/19 12:40:52 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\ASUS WebStorage
[2013/04/19 12:40:45 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Atheros
[2013/04/19 12:40:18 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2013/04/19 12:40:18 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Searches
[2013/04/19 12:40:18 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2013/04/19 12:40:18 | 000,000,000 | -H-D | C] -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2013/04/19 12:39:34 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Adobe
[2013/04/19 12:39:28 | 000,000,000 | R-SD | C] -- C:\Users\Public\Desktop\ASUS
[2013/04/19 12:39:28 | 000,000,000 | ---D | C] -- C:\ProgramData\FolderView
[2013/04/19 12:38:38 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Contacts
[2013/04/19 12:37:53 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\VirtualStore
[2013/04/19 12:37:43 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Packages
[2013/04/19 12:37:41 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\ASUS
[2013/04/19 12:37:24 | 000,000,000 | --SD | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Videos
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Saved Games
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Pictures
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Music
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Links
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Favorites
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Downloads
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Documents
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\Desktop
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2013/04/19 12:37:24 | 000,000,000 | R--D | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\AppData\Local\Temporary Internet Files
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Templates
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Start Menu
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\SendTo
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Recent
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\PrintHood
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\NetHood
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Documents\My Videos
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Documents\My Pictures
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Documents\My Music
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\My Documents
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Local Settings
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\AppData\Local\History
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Cookies
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\Application Data
[2013/04/19 12:37:24 | 000,000,000 | -HSD | C] -- C:\Users\Jennifer\AppData\Local\Application Data
[2013/04/19 12:37:24 | 000,000,000 | -H-D | C] -- C:\Users\Jennifer\AppData
[2013/04/19 12:37:24 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Temp
[2013/04/19 12:37:24 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Local\Microsoft
[2013/04/19 12:37:24 | 000,000,000 | ---D | C] -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
========== Files - Modified Within 30 Days ==========
[2013/04/20 21:43:52 | 000,848,230 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013/04/20 21:43:52 | 000,719,418 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013/04/20 21:43:52 | 000,132,748 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013/04/20 21:39:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013/04/20 21:39:18 | 000,000,906 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/04/20 21:37:48 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys
[2013/04/20 21:37:46 | 2480,959,487 | -HS- | M] () -- C:\hiberfil.sys
[2013/04/20 21:36:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Jennifer\Desktop\OTL.exe
[2013/04/20 21:36:21 | 000,552,158 | ---- | M] (Oleg N. Scherbakov) -- C:\Users\Jennifer\Desktop\JRT.exe
[2013/04/20 21:36:01 | 000,613,083 | ---- | M] () -- C:\Users\Jennifer\Desktop\adwcleaner.exe
[2013/04/20 21:11:30 | 001,707,098 | ---- | M] (Farbar) -- C:\Users\Jennifer\Desktop\FRST64.exe
[2013/04/20 19:56:00 | 000,000,910 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/04/20 08:39:20 | 000,816,128 | ---- | M] () -- C:\Users\Jennifer\Desktop\RogueKiller.exe
[2013/04/19 23:14:32 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Jennifer\Desktop\dds.com
[2013/04/19 23:13:08 | 000,000,512 | ---- | M] () -- C:\Users\Jennifer\Desktop\MBR.dat
[2013/04/19 23:11:48 | 004,745,728 | ---- | M] (AVAST Software) -- C:\Users\Jennifer\Desktop\aswMBR.exe
[2013/04/19 22:34:29 | 014,880,256 | ---- | M] (LastPass) -- C:\Program Files (x86)\Common Files\lpuninstall.exe
[2013/04/19 22:34:29 | 000,002,112 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk
[2013/04/19 22:34:27 | 000,002,112 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk
[2013/04/19 22:34:27 | 000,001,192 | ---- | M] () -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\My LastPass Vault.lnk
[2013/04/19 22:34:22 | 000,001,192 | ---- | M] () -- C:\Users\Public\Desktop\My LastPass Vault.lnk
[2013/04/19 22:12:47 | 000,001,924 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/04/19 22:12:41 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2013/04/19 22:11:43 | 000,001,111 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/19 22:11:35 | 000,001,785 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013/04/19 22:08:53 | 000,001,016 | ---- | M] () -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013/04/19 22:08:45 | 000,000,982 | ---- | M] () -- C:\Users\Jennifer\Desktop\Dropbox.lnk
[2013/04/19 22:07:18 | 000,001,082 | ---- | M] () -- C:\Users\Public\Desktop\Google Drive.lnk
[2013/04/19 22:06:41 | 000,001,209 | ---- | M] () -- C:\Users\Public\Desktop\FileZilla.lnk
[2013/04/19 22:06:37 | 000,001,149 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/04/19 21:29:57 | 000,002,281 | ---- | M] () -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/04/19 21:12:54 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_11_00.Wdf
[2013/04/19 20:52:01 | 000,002,257 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/04/19 15:13:03 | 000,281,088 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/19 12:52:11 | 000,001,426 | ---- | M] () -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
========== Files Created - No Company Name ==========
[2013/04/20 21:36:01 | 000,613,083 | ---- | C] () -- C:\Users\Jennifer\Desktop\adwcleaner.exe
[2013/04/20 08:39:19 | 000,816,128 | ---- | C] () -- C:\Users\Jennifer\Desktop\RogueKiller.exe
[2013/04/19 23:13:08 | 000,000,512 | ---- | C] () -- C:\Users\Jennifer\Desktop\MBR.dat
[2013/04/19 22:34:29 | 000,002,112 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass FF RunOnce.lnk
[2013/04/19 22:34:27 | 000,002,112 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Install LastPass IE RunOnce.lnk
[2013/04/19 22:34:25 | 000,001,192 | ---- | C] () -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\My LastPass Vault.lnk
[2013/04/19 22:34:22 | 000,001,192 | ---- | C] () -- C:\Users\Public\Desktop\My LastPass Vault.lnk
[2013/04/19 22:12:47 | 000,001,924 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2013/04/19 22:12:42 | 000,178,624 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2013/04/19 22:12:42 | 000,065,336 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2013/04/19 22:12:40 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2013/04/19 22:11:43 | 000,001,111 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013/04/19 22:11:35 | 000,001,785 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2013/04/19 22:10:34 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2013/04/19 22:08:54 | 000,000,982 | ---- | C] () -- C:\Users\Jennifer\Desktop\Dropbox.lnk
[2013/04/19 22:08:53 | 000,001,016 | ---- | C] () -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2013/04/19 22:07:24 | 000,001,082 | ---- | C] () -- C:\Users\Public\Desktop\Google Drive.lnk
[2013/04/19 22:06:42 | 000,001,209 | ---- | C] () -- C:\Users\Public\Desktop\FileZilla.lnk
[2013/04/19 22:06:37 | 000,001,161 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013/04/19 22:06:37 | 000,001,149 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/04/19 21:12:54 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_WpdFs_01_11_00.Wdf
[2013/04/19 20:52:01 | 000,002,281 | ---- | C] () -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/04/19 20:52:01 | 000,002,257 | ---- | C] () -- C:\Users\Public\Desktop\Google Chrome.lnk
[2013/04/19 20:51:20 | 000,000,910 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013/04/19 20:51:18 | 000,000,906 | ---- | C] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013/04/19 15:12:54 | 000,281,088 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013/04/19 15:12:51 | 268,435,456 | -HS- | C] () -- C:\swapfile.sys
[2013/04/19 15:12:48 | 2480,959,487 | -HS- | C] () -- C:\hiberfil.sys
[2013/04/19 12:52:11 | 000,001,426 | ---- | C] () -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/04/19 12:39:34 | 000,001,432 | ---- | C] () -- C:\Users\Jennifer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2013/04/19 12:37:24 | 000,000,352 | ---- | C] () -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2013/04/19 12:37:24 | 000,000,334 | ---- | C] () -- C:\Users\Jennifer\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/12/28 03:39:26 | 000,083,968 | ---- | C] () -- C:\Windows\SysWow64\OEMLicense.dll
[2012/11/09 02:31:22 | 000,598,780 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng700.bin
[2012/11/09 02:31:19 | 000,064,512 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2012/11/09 02:31:18 | 000,755,048 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng700.bin
[2012/08/04 20:42:20 | 000,024,576 | ---- | C] () -- C:\ProgramData\SetStretch.exe
[2012/08/04 20:42:20 | 000,000,217 | ---- | C] () -- C:\ProgramData\SetStretch.cmd
[2012/07/26 03:13:10 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2012/07/26 03:13:09 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2012/07/26 02:21:26 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2012/07/25 20:17:42 | 000,043,520 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2012/07/25 15:37:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2012/07/25 15:28:31 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2012/07/25 15:22:56 | 000,267,284 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2012/07/25 15:22:54 | 000,963,376 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2012/06/02 09:31:19 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat
[2012/04/20 16:59:44 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll
========== ZeroAccess Check ==========
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012/09/20 01:32:51 | 019,775,488 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/09/20 00:54:47 | 017,559,552 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012/07/25 22:05:38 | 001,004,544 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2012/07/25 22:18:27 | 000,784,896 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012/07/25 22:07:41 | 000,455,680 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2013/04/19 12:40:52 | 000,000,000 | ---D | M] -- C:\Users\Jennifer\AppData\Roaming\ASUS WebStorage
[2013/04/20 21:39:17 | 000,000,000 | ---D | M] -- C:\Users\Jennifer\AppData\Roaming\Dropbox
========== Purity Check ==========
< End of report >
OTL Extras logfile created on: 4/20/2013 9:50:51 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Jennifer\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16420)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
7.89 Gb Total Physical Memory | 6.80 Gb Available Physical Memory | 86.26% Memory free
12.39 Gb Paging File | 11.22 Gb Available in Paging File | 90.54% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279.45 Gb Total Space | 237.94 Gb Free Space | 85.15% Space Free | Partition Type: NTFS
Drive D: | 397.87 Gb Total Space | 397.23 Gb Free Space | 99.84% Space Free | Partition Type: NTFS
Computer Name: JEN | User Name: Jennifer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-246020111-3510042927-2518832696-1001\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0252DEDA-4382-4DF5-8E9D-1BA2BC136A7E}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"{126126D0-5259-42AD-BC30-0C2B02F858DC}" = dir=out | name=@{microsoft.bingmaps_1.2.0.136_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
"{19C628EC-D591-4433-AEE3-5CA469C96CC3}" = dir=out | name=windows_ie_ac_001 |
"{1D3CED9F-B6B8-497F-BCBF-8A35C53F3A59}" = dir=out | name=microsoft solitaire collection |
"{2114EA7E-23B6-498D-98C7-A0CE9E09C971}" = dir=out | name=adera |
"{22C1CE0D-2CBA-4047-BE15-0D1CD750E3DA}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{2FD5F402-A442-410A-8B81-24B796587993}" = dir=out | name=skype |
"{3A4332C2-6ABB-4079-B845-7E13B6C03633}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{4C2A4FB8-4D2F-4FAC-9584-4E425B42B4F0}" = dir=out | name=@{microsoft.bingweather_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
"{5875BCD6-015D-49BA-8D2B-89B085CAF067}" = dir=in | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{6306345D-5BF0-4FA4-8CE2-CF095E86ED1D}" = dir=out | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{6AC43D8A-31B4-4B9C-BA8A-178A8E9BD121}" = protocol=6 | dir=in | app=c:\users\jennifer\appdata\roaming\dropbox\bin\dropbox.exe |
"{6C72E359-A4FB-4FD3-8C15-3EB4D9F16800}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{7527C647-9A2D-466C-9FA4-6F07185EB591}" = dir=out | name=taptiles |
"{78349EB0-9FC9-416E-BDB8-D44D683E3ACE}" = dir=in | name=skype |
"{7FF57ECA-5E43-47F6-AF3A-7AAC90F5E7A1}" = dir=in | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{810629C4-9310-49E8-9F16-669A57EAE33B}" = dir=out | name=fresh paint |
"{83D19661-6BB7-4EDD-AF06-52D300D8A8C8}" = dir=out | name=@{microsoft.bing_1.2.0.137_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{8CA3B0C3-D473-4C14-B25F-839E22D60A16}" = dir=in | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{96ACC351-046B-45ED-9AA0-07BE9E6D840D}" = dir=out | name=wordament |
"{97A2AF2B-EE9E-47B8-A84D-C570A2718D92}" = dir=out | name=@{microsoft.bingtravel_1.2.0.145_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
"{9AE1D03F-2E51-4704-A328-C24B21F21DCF}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9B34830E-98CA-414C-8E7F-6846D1498858}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd10.exe |
"{A3CDC8AE-28E8-4078-81ED-9643E20505D6}" = protocol=17 | dir=in | app=c:\users\jennifer\appdata\roaming\dropbox\bin\dropbox.exe |
"{A6D14581-8684-48D7-9597-20D032E29AED}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
"{AB04BC84-34A6-442C-BDF7-9F00BC7656FE}" = dir=out | name=@{microsoft.xboxlivegames_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
"{ABE374CF-3049-4030-8D68-32489F54BC9B}" = dir=out | name=@{microsoft.zunemusic_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/33273} |
"{B89B1A32-7355-4F1F-A6E6-D38EFF65CC16}" = dir=out | name=@{microsoft.windowscommunicationsapps_16.4.4206.722_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{BFB9D42D-F288-47C0-952F-607656151B6D}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd10\powerdvd cinema\powerdvdcinema10.exe |
"{C7F2547C-A837-4A1E-A9AE-CCB68A1542EB}" = dir=out | name=@{microsoft.zunevideo_1.0.927.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/33270} |
"{CF81F313-01E8-4E29-82C1-3A9C26223CB4}" = dir=out | name=@{microsoft.bingfinance_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} |
"{D42FCDAC-CD18-4D37-93D4-DDDEACDC2BE2}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{E10200B7-A3B0-4246-8C57-C64B6810BE5D}" = dir=in | name=@{microsoft.windowsphotos_16.4.4204.712_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{E2EE2DB3-9B12-4C60-9060-1B0EF8E38AF4}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{EAE837F0-EAF7-44BD-A17F-D067D55ED3CE}" = dir=out | name=@{microsoft.bingnews_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
"{EF5E1F7C-86E5-4597-849D-BC3849D3943A}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mcsvchost\mcsvhost.exe |
"{F129A4A2-E288-45B2-878D-6B50E3C51D03}" = dir=out | name=@{microsoft.bingsports_1.2.0.135_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} |
"{F303E899-9FBE-4206-A1AE-E6A9391C3089}" = dir=out | name=@{microsoft.reader_6.2.8516.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0225AD21-F3E2-4916-BFF3-65D3F9052582}" = iTunes
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{2F72F540-1F60-4266-9506-952B21D6640D}" = Apple Mobile Device Support
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{7F34ADBE-77C0-47A0-BBC6-B3DA16CE8E68}" = Classic Shell
"{A84A4FB1-D703-48DB-89E0-68B6499D2801}" = Qualcomm Atheros Bluetooth Suite (64)
"{EF79C448-6946-4D71-8134-03407888C054}" = Shared C Run-time for x64
"{F4404AFD-2EF3-40C1-8C09-29E5F3B6972B}" = Intel® Trusted Connect Service Client
"C01F56FBD9B141017E63E2A1A141E59934D4DC67" = Windows Driver Package - ASUS (ATP) Mouse (10/29/2012 1.0.0.148)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0ABBF310-94E4-4AE8-A6BD-10345A3F6439}" = Google Drive
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{28006915-2739-4EBE-B5E8-49B25D32EB33}" = Qualcomm Atheros Client Installation Program
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4D3286A6-F6AB-498A-82A4-E4F040529F3D}" = ASUS Smart Gesture
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{749F674B-2674-47E8-879C-5626A06B2A91}" = ASUS InstantOn
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89ECB85A-D933-4CEA-9116-5CBC9C2ED95B}" = ASUS Instant Connect
"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB5C933E-5C7D-4D30-B314-9C83A49B94BE}" = ATK Package
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X MUI
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = ASUSDVD
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FA540E67-095C-4A1B-97BA-4D547DEC9AF4}" = ASUS Live Update
"{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) SDK for OpenCL - CPU Only Runtime Package
"avast" = avast! Free Antivirus
"FileZilla Client" = FileZilla Client 3.6.0.2
"Google Chrome" = Google Chrome
"InstallShield_{DEC235ED-58A4-4517-A278-C41E8DAEAB3B}" = ASUSDVD
"LastPass" = LastPass(uninstall only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-246020111-3510042927-2518832696-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
< End of report >
http://dev.discussions.virtualdr.forums.relay.cool/ Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following
Code::OTL
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O8:64bit: - Extra context menu item: LastPass - file://C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=lastpass File not found
O8:64bit: - Extra context menu item: LastPass Fill Forms - file://C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=fillforms File not found
O8 - Extra context menu item: LastPass - file://C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=lastpass File not found
O8 - Extra context menu item: LastPass Fill Forms - file://C:\Users\Jennifer\AppData\LocalLow\LastPass\context.html?cmd=fillforms File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- You will get a log that shows the results of the fix. Please post it.
NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.
Last scans...
http://dev.discussions.virtualdr.forums.relay.cool/ Download Security Check from here or here and save it to your Desktop.
- Double-click SecurityCheck.exe
- Follow the onscreen instructions inside of the black box.
- A Notepad document should open automatically called checkup.txt; please post the contents of that document.
NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.
http://dev.discussions.virtualdr.forums.relay.cool/ Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.
- Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
- Press "Scan".
- It will create a log (FSS.txt) in the same directory the tool is run.
- Please copy and paste the log to your reply.
http://dev.discussions.virtualdr.forums.relay.cool/ Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
- Double click on TFC.exe to run the program.
- Click on Start button to begin cleaning process.
- TFC will close all running programs, and it may ask you to restart computer.
http://dev.discussions.virtualdr.forums.relay.cool/ Please run a free online scan with the ESET Online Scanner
- Disable your antivirus program
- Tick the box next to YES, I accept the Terms of Use
- Click Start
- Accept any security warnings from your browser.
- Check Scan archives
- Click Start
- ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
- When the scan completes, click on List of found threats
- Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
- NOTE. If Eset won't find any threats, it won't produce any log.
All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\LastPass\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\LastPass Fill Forms\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\LastPass\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\LastPass Fill Forms\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Jennifer
->Temp folder emptied: 31804053 bytes
->Temporary Internet Files folder emptied: 4219635 bytes
->Google Chrome cache emptied: 65671067 bytes
->Flash cache emptied: 574 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 107565297 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 197242 bytes
RecycleBin emptied: 6204363 bytes
Total Files Cleaned = 206.00 mb
[EMPTYJAVA]
User: All Users
User: Default
User: Default User
User: Jennifer
User: Public
Total Java Files Cleaned = 0.00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Jennifer
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 04202013_221438
Files\Folders moved on Reboot...
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Results of screen317's Security Check version 0.99.62
x64 (UAC is enabled)
Internet Explorer 9
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Windows Defender
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Mozilla Firefox (20.0.1)
Google Chrome 26.0.1410.64
````````Process Check: objlist.exe by Laurent````````
AVAST Software Avast AvastSvc.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````
Farbar Service Scanner Version: 14-04-2013
Ran by Jennifer (administrator) on 20-04-2013 at 22:25:22
Running from "C:\Users\Jennifer\Desktop"
Windows 8 (X64)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Attempt to access Yahoo IP returned error. Yahoo IP is offline
Yahoo.com is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Action Center:
============
Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is set to Demand. The default start type is Auto.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.
Windows Autoupdate Disabled Policy:
============================
Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware"=DWORD:1
Other Services:
==============
File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll
[2012-12-28 03:39] - [2012-09-20 01:31] - 0331776 ____A (Microsoft Corporation) CFB72DF4B2364AF6D4D685DCD310E942
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll
[2012-07-25 18:40] - [2012-07-25 22:06] - 0904704 ____A (Microsoft Corporation) 411EA973A1961C287927DF13891EB41E
C:\Windows\System32\bfe.dll
[2012-07-25 19:00] - [2012-07-25 22:05] - 0718848 ____A (Microsoft Corporation) 407F85D5387EDBB665A7969DF4D4712B
C:\Windows\System32\drivers\mpsdrv.sys
[2012-07-25 21:23] - [2012-07-25 21:23] - 0074752 ____A (Microsoft Corporation) 36BF4D86F166ACBC14F0B8B8F90CBCEA
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll
[2012-12-28 03:38] - [2012-09-20 01:33] - 3340800 ____A (Microsoft Corporation) 69DDDAF7BB4D39A4CC928EA434A3E258
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MsMpEng.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
**** End of log ****
Getting user folders.
Stopping running processes.
Emptying Temp folders.
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Jennifer
->Temp folder emptied: 18 bytes
->Temporary Internet Files folder emptied: 128 bytes
->Google Chrome cache emptied: 8832405 bytes
->Flash cache emptied: 0 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3874024 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
Emptying RecycleBin. Do not interrupt.
RecycleBin emptied: 0 bytes
Process complete!
Total Files Cleaned = 12.00 mb
I ran Eset and it didn't produce a log.
Your computer is clean http://dev.discussions.virtualdr.forums.relay.cool/
1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:
Run OTL
- Under the Custom Scans/Fixes box at the bottom, paste in the following:
Code::OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]
- Then click the Run Fix button at the top
- Let the program run unhindered, reboot the PC when it is done
- Post resulting log.
2. Now, we'll remove all tools, we used during our cleaning process
Clean up with OTL:
- Double-click OTL.exe to start the program.
- Close all other programs apart from OTL as this step will require a reboot
- On the OTL main screen, press the CLEANUP button
- Say Yes to the prompt and then allow the program to reboot your computer.
If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.
3. Make sure Windows Updates are current.
4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!
5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)
6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.
7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.
8. Run Temporary File Cleaner (TFC) weekly.
9. Download and install Secunia Personal Software Inspector (PSI): http://secunia.com/vulnerability_scanning/personal/. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.
10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.
11. (Windows XP only) Run defrag at your convenience.
12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.
13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tuto...r-safe-online/
14. Please, let me know, how your computer is doing.
All processes killed
========== OTL ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
User: Jennifer
->Temp folder emptied: 76888 bytes
->Temporary Internet Files folder emptied: 18735593 bytes
->Google Chrome cache emptied: 9539113 bytes
->Flash cache emptied: 456 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 27.00 mb
[EMPTYFLASH]
User: All Users
User: Default
User: Default User
User: Jennifer
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0.00 mb
[EMPTYJAVA]
User: All Users
User: Default
User: Default User
User: Jennifer
User: Public
Total Java Files Cleaned = 0.00 mb
Restore point Set: OTL Restore Point
OTL by OldTimer - Version 3.2.69.0 log created on 04202013_232444
Files\Folders moved on Reboot...
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y3P3SJBW\hovercard[1].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\Y3P3SJBW\recentposts[1].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LF4XNLH6\0[1].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LF4XNLH6\canvas[1].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CD7QFRRS\0[1].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CD7QFRRS\0[2].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CD7QFRRS\d=1[1].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CD7QFRRS\frame[1].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CD7QFRRS\showthread[1].htm moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\7A7E08C8-3FF5-45F2-873D-A84D669DC82F.dat moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
C:\Users\Jennifer\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Okay I thought it was gone but its back! When I logged into Chrome and all of my extensions came back, the MIXDJ window popped open as well as a tab for MSN. Why is that?
Uninstall Chrome...
- Close all Chrome windows and tabs.
- Go to the Start menu > Control Panel. (Windows 8 users: Learn how to access the Control Panel)
- Click Programs and Features.
- Double-click Google Chrome.
- Click Uninstall from the confirmation dialog. Delete your user profile information, like your browser preferences, bookmarks, and history, by selecting the "Also delete your browsing data" checkbox.
Install fresh copy.
Okay I did that and reinstalled a new copy. The second I signed into Chrome again and all my extensions loaded it came back. This is a nightmare!
Most likely you didn't...
Delete your user profile information, like your browser preferences, bookmarks, and history, by selecting the "Also delete your browsing data" checkbox.
If you did there should be no extensions.
I think I see what happened. In Chrome, I did not change my personal settings and on startup it was still pulling up the mixidj search page. I got rid of that and it seems to be working. While this was happening I went to my other laptop that I have and the Mixidj search pulled up in the Google tabs. How do I know if the virus has been completely removed from both computers?
This computer is clean.
If you want to check another computer you need to create new topic.
Good luck and stay safe :)
I just wanted to say a big thank you for all of your help! I can't thank you enough for helping me out of this mess!!!
You're very welcome http://dev.discussions.virtualdr.forums.relay.cool/