Solved Anti Virus Won't Start

[Resolved] Anti Virus Won't Start

Hey Broni,

RE: Sony Vaio Laptop Running Win 7 Home Premium

Just replaced fan on laptop then Trend Titanium Internet Security would not start. Uninstalled Trend although clean boot left. Installed Avast Free 2014 with same issue, says protected then not protected. Cannot download even first update. Ran Malware Bytes Pro complete scan which detected two IOBIT slick savings. Removed from Firefox 27 add-ons. Also, Yahoo tool bar mysteriously installed and now Yahoo is default browser although it shows google in Firefox.

Screenshots of Avast showing installed and active then not running. It won't update either. Getting an access denied error also. Check out the popup showing a program trying to start (attached).

Ran Malware Bytes Pro Quick Scan and DDS as instructed. My laptop has been down for two weeks and finally replaced the fan and now this so I also posted at
bleepingcomputer.com before I remembered how great you were at this. I did run:
TDDSKiller-Nothing found
ADW Cleaner
JRT
FSS

Let me know if you want those logs. I can close that thread if you want.

FYI...DDS show AMD when I am running an I3 Sandy Bridge chip. Also, says Avast started but it won't run or update so that is conflicting. Red Lettering below.

Malware Bytes Pro and DDS logs here. Thanks!
------------------------------------------------
Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.21.11

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
MY :: MY-VAIO [administrator]

Protection: Enabled

2/21/2014 8:53:37 PM
mbam-log-2014-02-21 (20-53-37).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 259188
Time elapsed: 3 minute(s), 50 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
---------------------------------------------

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.16518 BrowserJavaVersion: 10.51.2
Run by MY at 17:53:32 on 2014-02-21
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.5667 [GMT -5:00]
.
AV: avast! Antivirus *Enabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Enabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\WLANExt.exe
C:\Program Files\Avast Anti Virus 2-21-14\AvastSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Malware Bytes Pro 1-6-14\Malwarebytes' Anti-Malware\mbamscheduler.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Malware Bytes Pro 1-6-14\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\System32\svchost.exe -k HPZ12
c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files (x86)\Malware Bytes Pro 1-6-14\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files (x86)\Roboform 8-5-13\robotaskbaricon.exe
C:\Program Files\Ditto\Ditto.exe
C:\Users\MY\AppData\Local\FluxSoftware\Flux\flux.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
C:\Program Files (x86)\Glary Utilities 4\Integrator.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Sony\VAIO Care\esrv\esrv.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Avast Anti Virus 2-21-14\AvastUI.exe
C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
C:\Program Files\Sony\VAIO Update\VUAgent.exe
C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\DDNi\Oasis2Service\Oasis2Service.exe
C:\Program Files\Sony\VAIO Care\VCPerfService.exe
C:\Program Files\Sony\VAIO Care\listener.exe
C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineScannerApp.exe
C:\Program Files (x86)\ESET\ESET Online Scanner\OnlineCmdLineScanner.exe
C:\Program Files (x86)\Roboform 8-5-13\Safenotes.exe
C:\Program Files (x86)\Roboform 8-5-13\Passcards.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://www.google.com/
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.google.com
mWinlogon: Userinit = userinit.exe,
BHO: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} - <orphaned>
BHO: <No Name>: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll
BHO: {BA0C978D-D909-49B6-AFE2-8BDE245DC7E6} - <orphaned>
BHO: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - <orphaned>
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: &RoboForm: {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
uRun: [RoboForm] "C:\Program Files (x86)\Roboform 8-5-13\RoboTaskBarIcon.exe "
uRun: [Ditto] C:\Program Files\Ditto\Ditto.exe
uRun: [f.lux] "C:\Users\MY\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe "
mRun: [AvastUI.exe] "C:\Program Files\\Avast Anti Virus 2-21-14\AvastUI.exe" /nogui
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Customize Menu - C:\Program Files (x86)\Roboform 8-5-13\RoboFormComCustomizeIEMenu.html
IE: Fill Forms - C:\Program Files (x86)\Roboform 8-5-13\RoboFormComFillForms.html
IE: RoboForm Toolbar - C:\Program Files (x86)\Roboform 8-5-13\RoboFormComShowToolbar.html
IE: Save Forms - C:\Program Files (x86)\Roboform 8-5-13\RoboFormComSavePass.html
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1375703205421
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} - hxxp://content.systemrequirementslab.com/bin/srldetect_intel_4.5.15.0.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{B59C479D-3ED6-4C1B-8B7C-8DA86D5F3707} : DHCPNameServer = 192.168.1.1
TCP: Interfaces\{C2793EA2-70B1-4D96-8AC9-1B0CE25C2814} : DHCPNameServer = 75.75.75.75 75.75.76.76
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - <orphaned>
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - <orphaned>
SSODL: WebCheck - <orphaned>
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\System32\wpdshserviceobj.dll
SEH: {56F9679E-7826-4C84-81F3-532071A8BCC5} - <orphaned>
x64-BHO: ExplorerWnd Helper: {10921475-03CE-4E04-90CE-E2E7EF20C814} -
x64-BHO: Trend Micro NSC BHO: {1CA1377B-DC1D-4A52-9585-6E06050FAC53} -
x64-BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll
x64-BHO: {BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC} - <orphaned>
x64-BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - <orphaned>
x64-Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe "
x64-Run: [HotKeysCmds] "C:\Windows\System32\hkcmd.exe "
x64-Run: [Persistence] "C:\Windows\System32\igfxpers.exe "
x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - <orphaned>
x64-Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - <orphaned>
x64-Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} -
x64-Notify: igfxcui - igfxdev.dll
x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
x64-SSODL: WebCheck - <orphaned>
x64-IFEO: Your Image File Name Here without a path - ntsd -d
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo!
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=402027&p=
FF - prefs.js: network.proxy.socks - 98.206.68.221
FF - prefs.js: network.proxy.socks_port - 13475
FF - prefs.js: network.proxy.type - 4
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrlui.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1209149.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;avast! Revert;C:\Windows\System32\drivers\aswRvrt.sys [2014-2-21 65776]
R0 aswVmm;avast! VM Monitor;C:\Windows\System32\drivers\aswVmm.sys [2014-2-21 207904]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2014-2-21 1038072]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2014-2-21 421704]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2014-2-21 78648]
R2 SSPORT;SSPORT;C:\Windows\System32\drivers\SSPORT.sys [2013-4-10 11576]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\System32\drivers\ArcSoftKsUFilter.sys [2013-12-9 19968]
R3 aswStm;aswStm;C:\Windows\System32\drivers\aswStm.sys [2014-2-21 80184]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2011-3-28 317440]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2011-2-16 76912]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\System32\drivers\LEqdUsb.sys [2013-5-23 77592]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\System32\drivers\LHidEqd.sys [2013-5-23 13080]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-1-7 25928]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2013-12-9 340072]
R3 semav6thermal64ro;semav6thermal64ro;C:\Windows\System32\drivers\semav6thermal64ro.sys [2012-11-15 13792]
R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2010-6-1 12032]
R3 SmbDrvI;SmbDrvI;C:\Windows\System32\drivers\Smb_driver_Intel.sys [2013-12-31 32496]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;C:\Windows\System32\drivers\e1y60x64.sys [2009-6-10 281088]
S3 pwdspio;pwdspio;C:\Windows\System32\pwdspio.sys [2013-12-20 12504]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-12-17 19456]
S3 taphss6;Anchorfree HSS VPN Adapter;C:\Windows\System32\drivers\taphss6.sys [2013-11-13 42184]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-2-20 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-12-17 30208]
S3 UsbFltr;WayTech USB Filter Driver;C:\Windows\System32\drivers\UsbFltr.sys [2007-4-9 12288]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
.
=============== Created Last 30 ================
.
2014-02-21 22:17:34 -------- d-----w- C:\Program Files (x86)\ESET
2014-02-21 07:27:36 -------- d-----w- C:\Users\MY\AppData\Roaming\AVAST Software
2014-02-21 07:26:32 80184 ----a-w- C:\Windows\System32\drivers\aswStm.sys
2014-02-21 07:26:32 65776 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
2014-02-21 07:26:32 207904 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
2014-02-21 07:26:32 1038072 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2014-02-21 07:26:30 92544 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2014-02-21 07:26:30 78648 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2014-02-21 07:26:22 43152 ----a-w- C:\Windows\avastSS.scr
2014-02-21 07:26:05 -------- d-----w- C:\Program Files\Avast Anti Virus 2-21-14
2014-02-21 07:22:38 -------- d-----w- C:\ProgramData\AVAST Software
2014-02-21 05:31:23 -------- d-----w- C:\ProgramData\Oracle
2014-02-21 05:31:00 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-21 05:26:17 -------- d-----w- C:\Windows\SysWow64\Adobe
2014-02-21 04:23:08 -------- d-----w- C:\Intel
2014-02-21 04:15:04 548864 ----a-w- C:\Windows\System32\vbscript.dll
2014-02-21 04:15:04 454656 ----a-w- C:\Windows\SysWow64\vbscript.dll
2014-02-21 04:13:59 808152 ----a-w- C:\Program Files (x86)\Internet Explorer\iexplore.exe
2014-02-21 02:47:41 1882112 ----a-w- C:\Windows\System32\msxml3.dll
2014-02-21 02:47:40 2048 ----a-w- C:\Windows\SysWow64\msxml3r.dll
2014-02-21 02:47:40 2048 ----a-w- C:\Windows\System32\msxml3r.dll
2014-02-21 02:47:40 1237504 ----a-w- C:\Windows\SysWow64\msxml3.dll
2014-02-21 02:47:22 2565120 ----a-w- C:\Windows\System32\d3d10warp.dll
2014-02-21 02:47:22 1987584 ----a-w- C:\Windows\SysWow64\d3d10warp.dll
2014-02-21 02:47:21 3928064 ----a-w- C:\Windows\System32\d2d1.dll
2014-02-21 02:47:21 3419136 ----a-w- C:\Windows\SysWow64\d2d1.dll
2014-02-21 01:34:38 -------- d-sh--w- C:\found.002
2014-02-03 17:34:24 -------- d-----w- C:\Program Files\HWiNFO64
2014-02-03 17:30:50 -------- d-----w- C:\Program Files (x86)\SpeedFan
2014-02-03 17:23:42 -------- d-----w- C:\Program Files\Core Temp 2-3-14
2014-02-03 08:32:15 -------- d-----w- C:\Users\MY\AppData\Local\ElevatedDiagnostics
2014-01-24 04:40:14 -------- d-----w- C:\Program Files (x86)\SpyBHO 1-23-14
2014-01-24 03:34:11 -------- d-sh--w- C:\found.001
2014-01-23 15:49:50 -------- d-----w- C:\ProgramData\ProductData
2014-01-23 15:49:50 -------- d-----w- C:\ProgramData\{3C5CBD7B-3D1D-411E-96C2-513FFCA84D2D}
2014-01-23 15:48:35 -------- d-----w- C:\Program Files (x86)\Common Files\Spigot
2014-01-23 15:09:36 -------- d-sh--w- C:\found.000
2014-01-23 06:15:54 -------- d-----w- C:\tmrescue
.
==================== Find3M ====================
.
2014-02-21 04:33:16 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-21 04:33:16 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-02-21 04:07:09 18960 ----a-w- C:\Windows\System32\drivers\LNonPnP.sys
2014-02-06 11:30:46 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2014-02-06 11:30:12 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
2014-02-06 11:07:39 66048 ----a-w- C:\Windows\System32\iesetup.dll
2014-02-06 11:06:47 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
2014-02-06 10:49:03 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
2014-02-06 10:48:45 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
2014-02-06 10:48:11 708608 ----a-w- C:\Windows\System32\jscript9diag.dll
2014-02-06 10:20:26 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-02-06 10:11:37 5768704 ----a-w- C:\Windows\System32\jscript9.dll
2014-02-06 10:01:36 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll
2014-02-06 10:00:46 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
2014-02-06 09:50:32 2041856 ----a-w- C:\Windows\System32\inetcpl.cpl
2014-02-06 09:47:22 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
2014-02-06 09:46:27 553472 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
2014-02-06 09:25:36 4244480 ----a-w- C:\Windows\SysWow64\jscript9.dll
2014-02-06 09:24:52 2334208 ----a-w- C:\Windows\System32\wininet.dll
2014-02-06 09:09:30 1964032 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
2014-02-06 08:41:35 1820160 ----a-w- C:\Windows\SysWow64\wininet.dll
2014-01-21 17:05:18 0 ----a-w- C:\Windows\System32\OLEPRO32.DLL
2014-01-21 17:05:18 0 ----a-w- C:\Windows\System32\MSVBVM60.DLL
2014-01-21 17:05:18 0 ----a-w- C:\Windows\System32\igdumd32.dll
2014-01-07 05:32:57 10285040 ----a-w- C:\Users\MY\mbam-setup-1.75.0.1300.exe
2014-01-06 08:38:18 24352 ----a-w- C:\Windows\System32\RegBootDefrag.exe
2014-01-06 08:38:04 117024 ----a-w- C:\Windows\System32\BootDefrag.exe
2014-01-01 03:55:30 64624 ----a-w- C:\Windows\System32\drivers\HECIx64.sys
2014-01-01 03:54:07 32496 ----a-w- C:\Windows\System32\drivers\Smb_driver_Intel.sys
2013-12-18 11:13:56 270496 ------w- C:\Windows\System32\MpSigStub.exe
2013-12-11 03:02:29 878080 ----a-w- C:\Windows\System32\advapi32.dll
2013-12-10 04:26:40 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-10 04:23:48 1887232 ----a-w- C:\Windows\System32\d3d11.dll
2013-12-10 04:23:48 1505280 ----a-w- C:\Windows\SysWow64\d3d11.dll
2013-12-10 01:54:33 74703 ----a-w- C:\Windows\SysWow64\mfc45.dll
2013-12-09 05:57:53 521448 ----a-w- C:\Windows\System32\deployJava1.dll
2013-12-09 03:20:10 2560 ----a-w- C:\Windows\SysWow64\drivers\en-US\qwavedrv.sys.mui
2013-12-09 03:19:58 15360 ----a-w- C:\Windows\SysWow64\drivers\en-US\pacer.sys.mui
2013-12-09 03:19:56 25600 ----a-w- C:\Windows\SysWow64\drivers\en-US\bfe.dll.mui
2013-12-09 03:19:31 2560 ----a-w- C:\Windows\SysWow64\drivers\en-US\scfilter.sys.mui
2013-12-09 03:19:25 5632 ----a-w- C:\Windows\SysWow64\drivers\en-US\ndiscap.sys.mui
2013-12-09 03:19:20 44032 ----a-w- C:\Windows\SysWow64\drivers\en-US\tcpip.sys.mui
2013-12-04 02:27:33 485888 ----a-w- C:\Windows\System32\secproc_isv.dll
2013-12-04 02:27:33 123392 ----a-w- C:\Windows\System32\secproc_ssp_isv.dll
2013-12-04 02:27:33 123392 ----a-w- C:\Windows\System32\secproc_ssp.dll
2013-12-04 02:27:16 488448 ----a-w- C:\Windows\System32\secproc.dll
2013-12-04 02:26:32 528384 ----a-w- C:\Windows\System32\msdrm.dll
2013-12-04 02:16:51 658432 ----a-w- C:\Windows\System32\RMActivate_isv.exe
2013-12-04 02:16:51 626176 ----a-w- C:\Windows\System32\RMActivate.exe
2013-12-04 02:16:50 552960 ----a-w- C:\Windows\System32\RMActivate_ssp_isv.exe
2013-12-04 02:16:48 553984 ----a-w- C:\Windows\System32\RMActivate_ssp.exe
2013-12-04 02:03:20 87040 ----a-w- C:\Windows\SysWow64\secproc_ssp_isv.dll
2013-12-04 02:03:20 87040 ----a-w- C:\Windows\SysWow64\secproc_ssp.dll
2013-12-04 02:03:20 423936 ----a-w- C:\Windows\SysWow64\secproc_isv.dll
2013-12-04 02:03:08 428032 ----a-w- C:\Windows\SysWow64\secproc.dll
2013-12-04 02:02:06 390144 ----a-w- C:\Windows\SysWow64\msdrm.dll
2013-12-04 01:54:14 510976 ----a-w- C:\Windows\SysWow64\RMActivate_ssp.exe
2013-12-04 01:54:10 594944 ----a-w- C:\Windows\SysWow64\RMActivate_isv.exe
2013-12-04 01:54:09 572416 ----a-w- C:\Windows\SysWow64\RMActivate.exe
2013-12-04 01:54:06 508928 ----a-w- C:\Windows\SysWow64\RMActivate_ssp_isv.exe
2013-11-27 01:41:37 343040 ----a-w- C:\Windows\System32\drivers\usbhub.sys
2013-11-27 01:41:15 99840 ----a-w- C:\Windows\System32\drivers\usbccgp.sys
2013-11-27 01:41:11 53248 ----a-w- C:\Windows\System32\drivers\usbehci.sys
2013-11-27 01:41:11 325120 ----a-w- C:\Windows\System32\drivers\usbport.sys
2013-11-27 01:41:09 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys
2013-11-27 01:41:06 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys
2013-11-27 01:41:03 7808 ----a-w- C:\Windows\System32\drivers\usbd.sys
2013-11-26 11:40:00 376768 ----a-w- C:\Windows\System32\drivers\netio.sys
2013-11-26 10:32:56 3156480 ----a-w- C:\Windows\System32\win32k.sys
.
============= FINISH: 17:54:48.73 ===============
-------------------------------------------------

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 12/9/2013 12:04:26 AM
System Uptime: 2/21/2014 4:51:23 PM (1 hours ago)
.
Motherboard: Sony Corporation | | VAIO
Processor: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz | N/A | 2100/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 247 GiB total, 91.919 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 208 GiB total, 95.715 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP129: 2/3/2014 5:01:13 AM - Scheduled Checkpoint
RP130: 2/3/2014 9:56:14 AM - B4 Bios Update
RP131: 2/20/2014 11:09:52 PM - B4 Windows ujpdates
RP132: 2/20/2014 11:13:18 PM - Windows Update
RP133: 2/20/2014 11:43:35 PM - Removed HP Update.
RP134: 2/20/2014 11:56:26 PM - Removed IObit Apps Toolbar v8.8.
RP135: 2/21/2014 12:05:10 AM - Removed PCmover.
RP136: 2/21/2014 12:29:46 AM - Installed Java 7 Update 51
RP137: 2/21/2014 12:33:32 AM - Installed Java 7 Update 51
RP138: 2/21/2014 2:23:30 AM - B4 Avast
RP139: 2/21/2014 2:25:55 AM - avast! antivirus system restore point
RP140: 2/21/2014 5:16:37 PM - B4 Eset Active X
.
==== Installed Programs ======================
.
64 Bit HP CIO Components Installer
7-Zip 9.22beta
Adobe AIR
Adobe Flash Player 12 ActiveX
Adobe Flash Player 12 Plugin
Adobe Reader XI (11.0.06)
Adobe Shockwave Player 12.0
AI RoboForm (All Users)
Application Manager for VAIO
Atheros WiFi Driver Installation
avast! Free Antivirus
BackupSF3 version 3.1.0
Batchmarker version 2.01
Belarc Advisor 8.4
Bulk Rename Utility 2.7.1.2
Camtasia Studio 8
CCleaner
Compatibility Pack for the 2007 Office system
Conexant HD Audio
DataNumen CAB Repair v2.0
DataNumen PSD Repair v2.0
DataNumen TAR Repair v2.0
Ditto
DriveImage XML (Private Edition)
eReg
ESET Online Scanner v3
f.lux
FileZilla Client 3.7.4.1
Folder Scout 1.3.2
Fotosizer 2.05
Free Alarm Clock 3.0.5
Glary Utilities PRO 4.6
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
IrfanView (remove only)
Java 7 Update 51
Java Auto Updater
Jihosoft Video Converter version 2.3
Logitech SetPoint 6.61
Logitech Unifying Software 2.10
Macro Recorder 5.6.5
Malwarebytes Anti-Malware version 1.75.0.1300
Media Gallery
Microsoft .NET Framework 4.5.1
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft SQL Server Compact 3.5 SP2 ENU
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
MiniTool Partition Wizard Home Edition 8.1.1
Mozilla Firefox 27.0.1 (x86 en-US)
Mozilla Maintenance Service
MPC-HC 1.7.0
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2758694)
NeatMP3 Pro version 1.2.0
Oasis2Service
PCmover
PL-2303 USB-to-Serial
PlayReady PC Runtime amd64
PMB
PMB VAIO Edition Guide
PMB VAIO Edition Plug-in
Quick Notes Plus 5.0
Quicken 2012
Realtek PCIE Card Reader
Remote Keyboard
Remote Play with PlayStation 3
Screencast-O-Matic
Sony Corporation
Speccy
SpeedFan (remove only)
SSLx64
SSLx86
swMSM
System Requirements Lab for Intel
Unlocker 1.9.2
VAIO - Media Gallery
VAIO - Media Gallery - VAIO Personalization Manager Update
VAIO - PMB VAIO Edition Guide
VAIO - PMB VAIO Edition Plug-in
VAIO - Remote Keyboard
VAIO - Remote Play with PlayStation®3
VAIO Care
VAIO Control Center
VAIO Data Restore Tool
VAIO Easy Connect
VAIO Event Service
VAIO Gate
VAIO Gate Default
VAIO Hardware Diagnostics
VAIO Health Report
VAIO Improvement
VAIO Manual
VAIO Quick Web Access
VAIO Sample Contents
VAIO Satisfaction Survey.
VAIO Smart Network
VAIO Transfer Support
VAIO Update
VCCx86
VESx64
VESx86
VGClientX64
VGClientX86
Video Watermark Pro
VIx64
VIx86
Vole Windows Expedition
Vole Word Reviewer
VSNx64
VU5x64
VU5x86
VWSTx86
Windows Live Mesh ActiveX Control for Remote Connections
WinX Mobile Video Converter 4.0.0
Zortam Mp3 Media Studio 17.15
.
==== Event Viewer Messages From Past Week ========
.
2/21/2014 4:52:04 PM, Error: Service Control Manager [7000] - The LiveUpdate service failed to start due to the following error: The system cannot find the file specified.
2/21/2014 4:47:22 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avast! Antivirus service.
2/21/2014 4:39:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
2/21/2014 4:39:48 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
2/21/2014 4:39:25 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
2/21/2014 2:41:27 AM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
2/21/2014 2:41:26 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
2/21/2014 2:41:26 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
2/21/2014 2:41:20 AM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Program Files (x86)\Atheros WiFi Driver Installation\AthIhvWlanExt.dll Error Code: 21
2/21/2014 2:41:15 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/21/2014 2:41:10 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
2/21/2014 2:41:00 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: aswRvrt aswSnx aswSP aswVmm discache spldr Wanarpv6
2/21/2014 2:40:55 AM, Error: Service Control Manager [7001] - The Application Identity service depends on the AppID Driver service which failed to start because of the following error: The dependency service or group failed to start.
2/21/2014 2:40:55 AM, Error: Service Control Manager [7001] - The AppID Driver service depends on the System Attribute Cache service which failed to start because of the following error: A device attached to the system is not functioning.
2/21/2014 2:32:26 AM, Error: Service Control Manager [7034] - The IconMan_R service terminated unexpectedly. It has done this 1 time(s).
2/21/2014 2:30:50 AM, Error: Service Control Manager [7034] - The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).
.
==== End Of File ===========================





Can you assist please? Thanks!

 

RogueKiller V8.8.8 [Feb 19 2014] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : MY [Admin rights]
Mode : Remove -- Date : 02/22/2014 01:16:00
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 6 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> DELETED
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> [0x2] The system cannot find the file specified.
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS547550A9E384 +++++
--- User ---
[MBR] c6e9a76d4dd562eaf9dd35a221eca3c9
[BSP] c77f2a0e566c78dcf6fe8d62a329f093 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 10602 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 21714944 | Size: 99 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 21919744 | Size: 252737 Mo
3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 539525120 | Size: 213499 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) SanDisk Cruzer Glide USB Device +++++
--- User ---
[MBR] 7e0f154def80755eae9920fb6086ef0a
[BSP] 4e307f58d6cb390a4075b60e376d9255 : Empty MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 15266 Mo
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_D_02222014_011600.txt >>
RKreport[0]_S_02222014_010159.txt

------------------------
RogueKiller V8.8.8 [Feb 19 2014] by Tigzy
mail : tigzyRK<at>gmail<dot>com
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : MY [Admin rights]
Mode : Remove -- Date : 02/22/2014 01:16:00
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 6 ¤¤¤
[HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> DELETED
[HJ POL][PUM] HKCU\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> DELETED
[HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> [0x2] The system cannot find the file specified.
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) Hitachi HTS547550A9E384 +++++
--- User ---
[MBR] c6e9a76d4dd562eaf9dd35a221eca3c9
[BSP] c77f2a0e566c78dcf6fe8d62a329f093 : Windows 7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 10602 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 21714944 | Size: 99 Mo
2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 21919744 | Size: 252737 Mo
3 - [XXXXXX] EXTEN-LBA (0x0f) [VISIBLE] Offset (sectors): 539525120 | Size: 213499 Mo
User = LL1 ... OK!
User = LL2 ... OK!

+++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) SanDisk Cruzer Glide USB Device +++++
--- User ---
[MBR] 7e0f154def80755eae9920fb6086ef0a
[BSP] 4e307f58d6cb390a4075b60e376d9255 : Empty MBR Code
Partition table:
0 - [XXXXXX] FAT32-LBA (0x0c) [VISIBLE] Offset (sectors): 32 | Size: 15266 Mo
User = LL1 ... OK!
Error reading LL2 MBR! ([0x32] The request is not supported. )

Finished : << RKreport[0]_D_02222014_011600.txt >>
RKreport[0]_S_02222014_010159.txt
----------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.02.22.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.16518
MY :: MY-VAIO [administrator]

2/22/2014 1:19:07 AM
mbar-log-2014-02-22 (01-19-07).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 50694
Time elapsed: 37 minute(s), 6 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
-------------------

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16518

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED
CPU speed: 2.095000 GHz
Memory total: 8535261184, free: 6381531136

Downloaded database version: v2014.02.22.01
Downloaded database version: v2014.02.20.01
=======================================
Initializing...
------------ Kernel report ------------
02/22/2014 01:19:02
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\iaStor.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\wd.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\??\C:\Windows\system32\drivers\aswSnx.sys
\??\C:\Windows\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\??\C:\Windows\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athrx.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\RtsPStor.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\SFEP.sys
\SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\CHDRT64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\ArcSoftKsUFilter.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\LEqdUsb.Sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\LHidEqd.Sys
\SystemRoot\system32\DRIVERS\LHidFilt.Sys
\SystemRoot\system32\DRIVERS\LMouFilt.Sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\appid.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\??\C:\Windows\system32\Drivers\SSPORT.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\Windows\system32\drivers\aswStm.sys
\??\C:\Windows\system32\drivers\semav6thermal64ro.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\System32\Drivers\fastfat.SYS
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800cd22790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000008f\
Lower Device Object: 0xfffffa800cd22060
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa800965a060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa800776f050
Lower Device Driver Name: \Driver\iaStor\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800965a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800965aab0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800965a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800776f050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 32CCBF2E

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 21712896

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 21714944 Numsec = 202752
Partition is not bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 21919744 Numsec = 517605376

Partition 3 type is Extended with LBA (0xf)
Partition is NOT ACTIVE.
Partition starts at LBA: 539525120 Numsec = 437245952

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa800cd22790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800cd21040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800cd22790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800cd22060, DeviceName: \Device\0000008f\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: B52721E7

Partition information:

Partition 0 type is Other (0xc)
Partition is NOT ACTIVE.
Partition starts at LBA: 32 Numsec = 31266784

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 16008609792 bytes
Sector size: 512 bytes

Done!
Scan Interrupted
Scan was aborted.
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-1-21714944-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removal finished
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.16518

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED
CPU speed: 2.095000 GHz
Memory total: 8535261184, free: 6291226624

Downloaded database version: v2014.02.22.02
Downloaded database version: v2014.02.20.01
=======================================
Initializing...
------------ Kernel report ------------
02/22/2014 03:12:12
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\iaStor.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\wd.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\??\C:\Windows\system32\drivers\aswSnx.sys
\??\C:\Windows\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\??\C:\Windows\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athrx.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\RtsPStor.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\SFEP.sys
\SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\CHDRT64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\ArcSoftKsUFilter.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\LEqdUsb.Sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\LHidEqd.Sys
\SystemRoot\system32\DRIVERS\LHidFilt.Sys
\SystemRoot\system32\DRIVERS\LMouFilt.Sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\aswMonFlt.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\drivers\appid.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\??\C:\Windows\system32\Drivers\SSPORT.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\Windows\system32\drivers\aswStm.sys
\??\C:\Windows\system32\drivers\semav6thermal64ro.sys
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\System32\Drivers\fastfat.SYS
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800cd22790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000008f\
Lower Device Object: 0xfffffa800cd22060
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa800965a060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa800776f050
Lower Device Driver Name: \Driver\iaStor\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800965a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800965aab0, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800965a060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800776f050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 32CCBF2E

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 21712896

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 21714944 Numsec = 202752
Partition is not bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 21919744 Numsec = 517605376

Partition 3 type is Extended with LBA (0xf)
Partition is NOT ACTIVE.
Partition starts at LBA: 539525120 Numsec = 437245952

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
Done!
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa800cd22790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800cd21040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800cd22790, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800cd22060, DeviceName: \Device\0000008f\, DriverName: \Driver\USBSTOR\
------------ End ----------
Alternate DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: B52721E7

Partition information:

Partition 0 type is Other (0xc)
Partition is NOT ACTIVE.
Partition starts at LBA: 32 Numsec = 31266784

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 16008609792 bytes
Sector size: 512 bytes

Done!

 

I uninstalled Avast and Malwarebytes Pro and reinstalled them and both are working normally. I also ran the Avastclear uninstaller and edited out all the Trend Micro I could find in the registry. Still on boot, I get the Trend Micro Clean Boot option. Don't know how to get rid of it.

Think I should proceed with your next steps? Thx.

 

ComboFix 14-02-24.02 - MY 02/25/2014 15:20:10.4.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.6035 [GMT -5:00]
Running from: c:\users\MY\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\MY\mbam-setup-1.75.0.1300.exe
.
.
((((((((((((((((((((((((( Files Created from 2014-01-25 to 2014-02-25 )))))))))))))))))))))))))))))))
.
.
2014-02-25 16:03 . 2014-02-06 09:01 10536864 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{57EB7EB6-5422-41FF-A28B-3A62BA10F37A}\mpengine.dll
2014-02-25 01:24 . 2014-02-25 01:27 -------- d-----w- c:\program files (x86)\YCIII
2014-02-24 23:33 . 2014-02-24 23:33 -------- d-----w- c:\users\MY\AppData\Roaming\ControlCenter4
2014-02-24 23:32 . 2014-02-24 23:32 -------- d-----w- c:\users\MY\AppData\Roaming\FLEXnet
2014-02-24 22:36 . 2014-02-24 22:36 -------- d-----w- C:\Brother
2014-02-24 22:36 . 2014-02-24 22:36 -------- d-----w- c:\program files (x86)\Browny02
2014-02-24 22:36 . 2014-02-24 22:36 -------- d-----w- c:\programdata\ControlCenter4
2014-02-24 22:36 . 2014-02-24 22:36 -------- d-----w- c:\program files (x86)\ControlCenter4
2014-02-24 22:36 . 2012-07-31 07:39 1439744 ----a-w- c:\windows\system32\BrWi209d.dll
2014-02-24 22:36 . 2010-06-07 11:18 50688 ----a-w- c:\windows\system32\BrUsi09d.dll
2014-02-24 22:36 . 2010-04-01 10:27 278528 ----a-w- c:\windows\system32\BrJDec.dll
2014-02-24 22:36 . 2014-02-24 22:36 -------- d-----w- c:\program files (x86)\Brother
2014-02-24 22:36 . 2012-09-10 21:31 245760 ------w- c:\windows\SysWow64\NSSearch.dll
2014-02-24 22:36 . 2012-07-09 22:19 5120 ------w- c:\windows\SysWow64\BrDctF2S.dll
2014-02-24 22:36 . 2010-03-16 00:45 73728 ------w- c:\windows\SysWow64\BrDctF2.dll
2014-02-24 22:36 . 2007-12-14 03:16 5120 ------w- c:\windows\SysWow64\BrDctF2L.dll
2014-02-24 22:28 . 2014-02-24 22:28 -------- d-----w- c:\users\MY\AppData\Roaming\InstallShield
2014-02-24 22:28 . 2014-02-24 22:28 -------- d-----w- c:\program files\Nuance
2014-02-24 22:27 . 2014-02-24 22:27 -------- d-----w- c:\programdata\zeon
2014-02-24 22:26 . 2014-02-24 22:26 -------- d-----w- c:\users\MY\AppData\Roaming\Nuance
2014-02-24 22:26 . 2014-02-24 22:26 -------- d-----w- c:\programdata\ScanSoft
2014-02-24 22:25 . 2014-02-24 22:25 -------- d-----w- c:\program files (x86)\Common Files\ScanSoft Shared
2014-02-24 22:25 . 2014-02-24 22:25 -------- d-----w- c:\programdata\FLEXnet
2014-02-24 22:25 . 2014-02-24 23:03 -------- d-----w- c:\programdata\Nuance
2014-02-24 22:25 . 2014-02-24 22:27 -------- d-----w- c:\program files (x86)\Nuance
2014-02-24 22:23 . 2014-02-24 22:47 -------- d-----w- c:\programdata\Brother
2014-02-22 22:58 . 2014-02-22 22:58 -------- d-----w- c:\users\MY\AppData\Roaming\Malwarebytes
2014-02-22 22:58 . 2014-02-22 22:58 -------- d-----w- c:\programdata\Malwarebytes
2014-02-22 22:58 . 2013-04-04 19:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-02-22 22:54 . 2014-02-22 22:58 -------- d-----w- c:\program files (x86)\MalwareBytes Pro Reinstalll 2-22-14
2014-02-22 22:49 . 2014-02-22 22:49 -------- d-----w- c:\users\MY\AppData\Roaming\AVAST Software
2014-02-22 22:48 . 2014-02-22 22:47 80184 ----a-w- c:\windows\system32\drivers\aswStm.sys
2014-02-22 22:48 . 2014-02-22 22:47 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-02-22 22:48 . 2014-02-22 22:47 207904 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-02-22 22:48 . 2014-02-22 22:47 1038072 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2014-02-22 22:48 . 2014-02-22 22:47 421704 ----a-w- c:\windows\system32\drivers\aswSP.sys
2014-02-22 22:48 . 2014-02-22 22:47 78648 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-02-22 22:48 . 2014-02-22 22:47 92544 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-02-22 22:48 . 2014-02-22 22:47 334136 ----a-w- c:\windows\system32\aswBoot.exe
2014-02-22 22:47 . 2014-02-22 22:47 43152 ----a-w- c:\windows\avastSS.scr
2014-02-22 19:06 . 2014-02-22 22:48 -------- d-----w- c:\program files (x86)\Avast Free 2014 Reinstall 2-22-14
2014-02-22 18:39 . 2014-02-22 18:40 -------- d-----w- c:\program files (x86)\ERUNT Reg Backup 2-22-14
2014-02-22 14:41 . 2014-02-25 20:15 -------- d-----w- c:\windows\system32\catroot2
2014-02-22 09:50 . 2014-02-24 23:32 -------- d-----w- c:\windows\system32\wbem\repository
2014-02-22 09:50 . 2014-02-22 09:50 -------- d-----w- c:\windows\SysWow64\wbem\Performance
2014-02-22 09:25 . 2014-02-22 19:03 181064 ----a-w- c:\windows\PSEXESVC.EXE
2014-02-22 09:23 . 2014-02-22 09:23 -------- d-----w- C:\RegBackup
2014-02-22 06:19 . 2014-02-22 22:06 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-02-21 23:49 . 2013-11-26 23:29 5693440 ----a-w- c:\windows\SysWow64\mstscax.dll
2014-02-21 23:49 . 2013-11-26 22:49 6573056 ----a-w- c:\windows\system32\mstscax.dll
2014-02-21 23:48 . 2014-02-21 23:48 -------- d-----w- c:\windows\ERUNT
2014-02-21 23:39 . 2014-02-22 05:57 -------- d-----w- C:\AdwCleaner
2014-02-21 07:22 . 2014-02-22 22:45 -------- d-----w- c:\programdata\AVAST Software
2014-02-21 05:31 . 2014-02-21 05:35 -------- d-----w- c:\programdata\Oracle
2014-02-21 05:31 . 2014-02-21 05:34 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-02-21 05:26 . 2014-02-21 05:26 -------- d-----w- c:\windows\SysWow64\Adobe
2014-02-21 04:53 . 2014-02-22 18:57 -------- d-----w- c:\users\boinc_master
2014-02-21 04:53 . 2014-02-21 04:54 -------- d-----w- c:\users\Administrator.WORKGROUP\AppData\Roaming\Samsung
2014-02-21 04:23 . 2014-02-21 04:23 -------- d-----w- C:\Intel
2014-02-21 04:15 . 2013-12-21 09:53 548864 ----a-w- c:\windows\system32\vbscript.dll
2014-02-21 04:15 . 2013-12-21 08:56 454656 ----a-w- c:\windows\SysWow64\vbscript.dll
2014-02-21 04:13 . 2014-02-06 22:55 806104 ----a-w- c:\program files\Internet Explorer\iexplore.exe
2014-02-21 02:47 . 2013-12-06 02:30 1882112 ----a-w- c:\windows\system32\msxml3.dll
2014-02-21 02:47 . 2013-12-06 02:30 2048 ----a-w- c:\windows\system32\msxml3r.dll
2014-02-21 02:47 . 2013-12-06 02:02 2048 ----a-w- c:\windows\SysWow64\msxml3r.dll
2014-02-21 02:47 . 2013-12-06 02:02 1237504 ----a-w- c:\windows\SysWow64\msxml3.dll
2014-02-21 02:47 . 2013-12-24 23:09 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2014-02-21 02:47 . 2013-12-24 22:48 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2014-02-21 02:47 . 2013-11-26 08:16 3419136 ----a-w- c:\windows\SysWow64\d2d1.dll
2014-02-21 02:47 . 2013-11-22 22:48 3928064 ----a-w- c:\windows\system32\d2d1.dll
2014-02-21 01:34 . 2014-02-21 01:34 -------- d-----w- C:\found.002
2014-02-03 17:34 . 2014-02-21 05:04 -------- d-----w- c:\program files\HWiNFO64
2014-02-03 17:30 . 2014-02-22 14:48 -------- d-----w- c:\program files (x86)\SpeedFan
2014-02-03 17:23 . 2014-02-03 17:26 -------- d-----w- c:\program files\Core Temp 2-3-14
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-02-21 04:33 . 2013-12-17 01:00 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-02-21 04:33 . 2013-12-17 01:00 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-02-21 04:23 . 2013-12-10 02:38 88567024 ----a-w- c:\windows\system32\MRT.exe
2014-02-21 04:07 . 2014-01-02 09:35 18960 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
2014-01-21 17:05 . 2014-01-21 17:05 0 ----a-w- c:\windows\system32\OLEPRO32.DLL
2014-01-21 17:05 . 2014-01-21 17:05 0 ----a-w- c:\windows\system32\MSVBVM60.DLL
2014-01-21 17:05 . 2014-01-21 17:05 0 ----a-w- c:\windows\system32\igdumd32.dll
2014-01-16 10:39 . 2014-01-16 10:39 53248 ----a-r- c:\users\MY\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2014-01-06 08:38 . 2014-01-21 15:45 24352 ----a-w- c:\windows\system32\RegBootDefrag.exe
2014-01-06 08:38 . 2013-12-26 13:52 117024 ----a-w- c:\windows\system32\BootDefrag.exe
2014-01-01 03:55 . 2014-01-01 03:55 64624 ----a-w- c:\windows\system32\drivers\HECIx64.sys
2014-01-01 03:54 . 2014-01-01 03:54 32496 ----a-w- c:\windows\system32\drivers\Smb_driver_Intel.sys
2013-12-18 11:13 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2013-12-11 03:03 . 2013-12-11 03:03 940032 ----a-w- c:\windows\system32\MsSpellCheckingFacility.exe
2013-12-11 03:03 . 2013-12-11 03:03 194048 ----a-w- c:\windows\SysWow64\elshyph.dll
2013-12-11 03:03 . 2013-12-11 03:03 942592 ----a-w- c:\windows\system32\jsIntl.dll
2013-12-11 03:03 . 2013-12-11 03:03 90112 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2013-12-11 03:03 . 2013-12-11 03:03 86016 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-12-11 03:03 . 2013-12-11 03:03 86016 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-12-11 03:03 . 2013-12-11 03:03 84992 ----a-w- c:\windows\system32\mshtmled.dll
2013-12-11 03:03 . 2013-12-11 03:03 83968 ----a-w- c:\windows\system32\MshtmlDac.dll
2013-12-11 03:03 . 2013-12-11 03:03 81408 ----a-w- c:\windows\system32\icardie.dll
2013-12-11 03:03 . 2013-12-11 03:03 774144 ----a-w- c:\windows\system32\jscript.dll
2013-12-11 03:03 . 2013-12-11 03:03 77312 ----a-w- c:\windows\system32\tdc.ocx
2013-12-11 03:03 . 2013-12-11 03:03 74240 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2013-12-11 03:03 . 2013-12-11 03:03 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-12-11 03:03 . 2013-12-11 03:03 645120 ----a-w- c:\windows\SysWow64\jsIntl.dll
2013-12-11 03:03 . 2013-12-11 03:03 62464 ----a-w- c:\windows\SysWow64\tdc.ocx
2013-12-11 03:03 . 2013-12-11 03:03 62464 ----a-w- c:\windows\system32\pngfilt.dll
2013-12-11 03:03 . 2013-12-11 03:03 61952 ----a-w- c:\windows\SysWow64\MshtmlDac.dll
2013-12-11 03:03 . 2013-12-11 03:03 616104 ----a-w- c:\windows\system32\ieapfltr.dat
2013-12-11 03:03 . 2013-12-11 03:03 52224 ----a-w- c:\windows\system32\msfeedsbs.dll
2013-12-11 03:03 . 2013-12-11 03:03 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2013-12-11 03:03 . 2013-12-11 03:03 48640 ----a-w- c:\windows\system32\mshtmler.dll
2013-12-11 03:03 . 2013-12-11 03:03 48128 ----a-w- c:\windows\system32\imgutil.dll
2013-12-11 03:03 . 2013-12-11 03:03 453120 ----a-w- c:\windows\system32\dxtmsft.dll
2013-12-11 03:03 . 2013-12-11 03:03 413696 ----a-w- c:\windows\system32\html.iec
2013-12-11 03:03 . 2013-12-11 03:03 40448 ----a-w- c:\windows\system32\JavaScriptCollectionAgent.dll
2013-12-11 03:03 . 2013-12-11 03:03 36352 ----a-w- c:\windows\SysWow64\imgutil.dll
2013-12-11 03:03 . 2013-12-11 03:03 34816 ----a-w- c:\windows\SysWow64\JavaScriptCollectionAgent.dll
2013-12-11 03:03 . 2013-12-11 03:03 337408 ----a-w- c:\windows\SysWow64\html.iec
2013-12-11 03:03 . 2013-12-11 03:03 30208 ----a-w- c:\windows\system32\licmgr10.dll
2013-12-11 03:03 . 2013-12-11 03:03 296960 ----a-w- c:\windows\system32\dxtrans.dll
2013-12-11 03:03 . 2013-12-11 03:03 263376 ----a-w- c:\windows\system32\iedkcs32.dll
2013-12-11 03:03 . 2013-12-11 03:03 247808 ----a-w- c:\windows\system32\msls31.dll
2013-12-11 03:03 . 2013-12-11 03:03 24576 ----a-w- c:\windows\SysWow64\licmgr10.dll
2013-12-11 03:03 . 2013-12-11 03:03 243200 ----a-w- c:\windows\system32\webcheck.dll
2013-12-11 03:03 . 2013-12-11 03:03 235520 ----a-w- c:\windows\system32\url.dll
2013-12-11 03:03 . 2013-12-11 03:03 235008 ----a-w- c:\windows\system32\elshyph.dll
2013-12-11 03:03 . 2013-12-11 03:03 182272 ----a-w- c:\windows\SysWow64\msls31.dll
2013-12-11 03:03 . 2013-12-11 03:03 167424 ----a-w- c:\windows\system32\iexpress.exe
2013-12-11 03:03 . 2013-12-11 03:03 151552 ----a-w- c:\windows\SysWow64\iexpress.exe
2013-12-11 03:03 . 2013-12-11 03:03 147968 ----a-w- c:\windows\system32\occache.dll
2013-12-11 03:03 . 2013-12-11 03:03 143872 ----a-w- c:\windows\system32\wextract.exe
2013-12-11 03:03 . 2013-12-11 03:03 139264 ----a-w- c:\windows\SysWow64\wextract.exe
2013-12-11 03:03 . 2013-12-11 03:03 13824 ----a-w- c:\windows\system32\mshta.exe
2013-12-11 03:03 . 2013-12-11 03:03 135680 ----a-w- c:\windows\system32\iepeers.dll
2013-12-11 03:03 . 2013-12-11 03:03 13312 ----a-w- c:\windows\SysWow64\mshta.exe
2013-12-11 03:03 . 2013-12-11 03:03 13312 ----a-w- c:\windows\system32\msfeedssync.exe
2013-12-11 03:03 . 2013-12-11 03:03 131072 ----a-w- c:\windows\system32\IEAdvpack.dll
2013-12-11 03:03 . 2013-12-11 03:03 1228800 ----a-w- c:\windows\system32\mshtmlmedia.dll
2013-12-11 03:03 . 2013-12-11 03:03 111616 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2013-12-11 03:03 . 2013-12-11 03:03 105984 ----a-w- c:\windows\system32\iesysprep.dll
2013-12-11 03:03 . 2013-12-11 03:03 1051136 ----a-w- c:\windows\SysWow64\mshtmlmedia.dll
2013-12-11 03:03 . 2013-12-11 03:03 101376 ----a-w- c:\windows\system32\inseng.dll
2013-12-11 03:02 . 2013-12-11 03:02 878080 ----a-w- c:\windows\system32\advapi32.dll
2013-12-11 03:02 . 2013-12-11 03:02 859648 ----a-w- c:\windows\system32\tdh.dll
2013-12-11 03:02 . 2013-12-11 03:02 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2013-12-11 03:02 . 2013-12-11 03:02 640512 ----a-w- c:\windows\SysWow64\advapi32.dll
2013-12-11 03:02 . 2013-12-11 03:02 619520 ----a-w- c:\windows\SysWow64\tdh.dll
2013-12-11 03:02 . 2013-12-11 03:02 5549504 ----a-w- c:\windows\system32\ntoskrnl.exe
2013-12-11 03:02 . 2013-12-11 03:02 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2013-12-11 03:02 . 2013-12-11 03:02 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2013-12-11 03:02 . 2013-12-11 03:02 3969472 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
2013-12-11 03:02 . 2013-12-11 03:02 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
2013-12-11 03:02 . 2013-12-11 03:02 362496 ----a-w- c:\windows\system32\wow64win.dll
2013-12-11 03:02 . 2013-12-11 03:02 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2013-12-11 03:02 . 2013-12-11 03:02 243712 ----a-w- c:\windows\system32\wow64.dll
2013-12-11 03:02 . 2013-12-11 03:02 2048 ----a-w- c:\windows\SysWow64\user.exe
2013-12-11 03:02 . 2013-12-11 03:02 1732032 ----a-w- c:\windows\system32\ntdll.dll
2013-12-11 03:02 . 2013-12-11 03:02 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2013-12-11 03:02 . 2013-12-11 03:02 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2013-12-11 03:02 . 2013-12-11 03:02 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2013-12-11 03:02 . 2013-12-11 03:02 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
2013-12-11 03:02 . 2013-12-11 03:02 327168 ----a-w- c:\windows\system32\mswsock.dll
2013-12-11 03:02 . 2013-12-11 03:02 231424 ----a-w- c:\windows\SysWow64\mswsock.dll
2013-12-11 03:02 . 2013-12-11 03:02 1903552 ----a-w- c:\windows\system32\drivers\tcpip.sys
2013-12-10 04:26 . 2013-12-10 04:26 9728 ----a-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-10 04:26 . 2013-12-10 04:26 9728 ----a-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-12-10 04:26 . 2013-12-10 04:26 648192 ----a-w- c:\windows\system32\d3d10level9.dll
2013-12-10 04:26 . 2013-12-10 04:26 604160 ----a-w- c:\windows\SysWow64\d3d10level9.dll
2013-12-10 04:26 . 2013-12-10 04:26 5632 ----a-w- c:\windows\SysWow64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-10 04:26 . 2013-12-10 04:26 5632 ----a-w- c:\windows\SysWow64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-10 04:26 . 2013-12-10 04:26 5632 ----a-w- c:\windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-12-10 04:26 . 2013-12-10 04:26 5632 ----a-w- c:\windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-12-10 04:26 . 2013-12-10 04:26 522752 ----a-w- c:\windows\system32\XpsGdiConverter.dll
2013-12-10 04:26 . 2013-12-10 04:26 4096 ----a-w- c:\windows\SysWow64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-10 04:26 . 2013-12-10 04:26 4096 ----a-w- c:\windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-12-10 04:26 . 2013-12-10 04:26 364544 ----a-w- c:\windows\SysWow64\XpsGdiConverter.dll
2013-12-10 04:26 . 2013-12-10 04:26 363008 ----a-w- c:\windows\system32\dxgi.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"f.lux "= "c:\users\MY\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-23 1017224]
"RoboForm "= "c:\program files (x86)\Roboform 8-5-13\RoboTaskBarIcon.exe" [2014-02-22 109784]
"ISUSPM "= "c:\programdata\FLEXnet\Connect\11\ISUSPM.exe" [2009-05-05 222496]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon "= "c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]
"ISBMgr.exe "= "c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-02-15 2757312]
"AvastUI.exe "= "c:\program files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe" [2014-02-22 3767096]
"IndexSearch "= "c:\program files (x86)\Nuance\PaperPort\IndexSearch.exe" [2010-03-09 46368]
"PaperPort PTD "= "c:\program files (x86)\Nuance\PaperPort\pptd40nt.exe" [2010-03-09 29984]
"PPort12reminder "= "c:\program files (x86)\Nuance\PaperPort\Ereg\Ereg.exe" [2010-02-09 328992]
"PDFHook "= "c:\program files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe" [2010-03-06 636192]
"PDF5 Registry Controller "= "c:\program files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe" [2010-03-06 62752]
"ControlCenter4 "= "c:\program files (x86)\ControlCenter4\BrCcBoot.exe" [2012-09-07 143360]
"BrStsMon00 "= "c:\program files (x86)\Browny02\Brother\BrStMonW.exe" [2012-06-06 3076096]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"20131224 "= "c:\program files (x86)\Avast Free 2014 Reinstall 2-22-14\setup\emupdate\a4b97e36-ee44-4268-911f-e169e4caf1cf.exe" [2014-02-25 181136]
.
c:\users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files (x86)\ERUNT Reg Backup 2-22-14\ERUNT\AUTOBACK.EXE %SystemRoot%\ERDNT\AutoBackup\#Date# /noconfirmdelete /noprogresswindow [2005-10-20 38912]
Yankee Clipper III.lnk - c:\program files (x86)\YCIII\YankClip.exe [2014-2-24 1368064]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 0 (0x0)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableLUA "= 0 (0x0)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk * \0BootDefrag.exe
.
R0 BootDefragDriver;BootDefragDriver;c:\windows\System32\drivers\BootDefragDriver.sys;c:\windows\SYSNATIVE\drivers\BootDefragDriver.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\MalwareBytes Pro Reinstalll 2-22-14\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\MalwareBytes Pro Reinstalll 2-22-14\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\MalwareBytes Pro Reinstalll 2-22-14\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\MalwareBytes Pro Reinstalll 2-22-14\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R3 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x]
R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 McComponentHostServiceSony;McAfee Security Scan Component Host Service for Sony;c:\program files (x86)\Sony\MSS\3.0.271\McCHSvc.exe;c:\program files (x86)\Sony\MSS\3.0.271\McCHSvc.exe [x]
R3 PSEXESVC;PsExec;c:\windows\PSEXESVC.EXE;c:\windows\PSEXESVC.EXE [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys;c:\windows\SYSNATIVE\pwdspio.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
R3 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
R3 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 UsbFltr;WayTech USB Filter Driver;c:\windows\system32\Drivers\UsbFltr.sys;c:\windows\SYSNATIVE\Drivers\UsbFltr.sys [x]
R3 USER_ESRV_SVC;User Energy Server Service;c:\program files\Sony\VAIO Care\esrv\esrv_svc.exe;c:\program files\Sony\VAIO Care\esrv\esrv_svc.exe [x]
R3 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 ESRV_SVC;Energy Server Service;c:\program files\Sony\VAIO Care\esrv\esrv_svc.exe --AUTO_START --start --address 127.0.0.1;c:\program files\Sony\VAIO Care\esrv\esrv_svc.exe --AUTO_START --start --address 127.0.0.1 [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 Oasis2Service;Oasis2Service;c:\program files (x86)\DDNi\Oasis2Service\Oasis2Service.exe;c:\program files (x86)\DDNi\Oasis2Service\Oasis2Service.exe [x]
S2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
S2 SampleCollector;VAIO Care Performance Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 semav6thermal64ro;semav6thermal64ro;c:\windows\system32\drivers\semav6thermal64ro.sys;c:\windows\SYSNATIVE\drivers\semav6thermal64ro.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys;c:\windows\SYSNATIVE\DRIVERS\SFEP.sys [x]
S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
S3 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x]
S3 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\VUAgent.exe;c:\program files\Sony\VAIO Update\VUAgent.exe [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-02-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-17 04:33]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-02-22 22:47 287280 ----a-w- c:\program files (x86)\Avast Free 2014 Reinstall 2-22-14\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cAudioFilterAgent "= "c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2011-03-09 518784]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2013-11-07 171992]
"HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2013-11-07 399832]
"Persistence "= "c:\windows\system32\igfxpers.exe" [2013-11-07 442328]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\SysWOW64\blank.htm
uStart Page = https://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Customize Menu - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html
IE: Fill Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html
IE: Save Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html
IE: Show RoboForm Toolbar - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html
Trusted Zone: com\*.Wondershare
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo!
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=402027&p=
FF - prefs.js: network.proxy.socks - 98.206.68.221
FF - prefs.js: network.proxy.socks_port - 13475
FF - prefs.js: network.proxy.type - 4
.
- - - - ORPHANS REMOVED - - - -
.
ShellExecuteHooks-{56F9679E-7826-4C84-81F3-532071A8BCC5} - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath "= "\ "c:\program files\Sony\VAIO Care\VCPerfService.exe\" \ "/service\" \ "/sstates\" \ "/sampleinterval=10000\" \ "/procinterval=5\" \ "/dllinterval=120\" \ "/counter=\Processor(_Total)\% Processor Time:1\" \ "/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \ "/counter=\Network Interface(*)\Bytes Total/sec:1\" \ "/expandcounter=\Processor Information(*)\Processor Frequency:1\" \ "&\" \ "/expandcounter=\Processor(*)\% Idle Time:1\" \ "/expandcounter=\Processor(*)\% C1 Time:1\" \ "/expandcounter=\Processor(*)\% C2 Time:1\" \ "/expandcounter=\Processor(*)\%C3 & Time:1\" \ "/expandcounter=\Processor(*)\% Processor Time:1\" \ "/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\" "
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
Completion time: 2014-02-25 15:29:38
ComboFix-quarantined-files.txt 2014-02-25 20:29
.
Pre-Run: 96,862,998,528 bytes free
Post-Run: 97,160,622,080 bytes free
.
- - End Of File - - 73AE59E529EAA64967776CA805414DD3

 

Cool

See next post for last report...too many characters.

# AdwCleaner v3.019 - Report created 25/02/2014 at 22:35:46
# Updated 17/02/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : MY - MY-VAIO
# Running from : C:\Users\MY\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****


***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKCU\Software\FLEXnet

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.16518


-\\ Mozilla Firefox v27.0.1 (en-US)

[ File : C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\prefs.js ]


*************************

AdwCleaner[R2].txt - [839 octets] - [25/02/2014 22:29:05]
AdwCleaner[S1].txt - [722 octets] - [25/02/2014 22:35:46]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [781 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.2 (02.20.2014:1)
OS: Windows 7 Home Premium x64
Ran by MY on Tue 02/25/2014 at 23:09:54.34
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\MY\AppData\Roaming\mozilla\firefox\profiles\ww415is6.default\minidumps [1 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Tue 02/25/2014 at 23:17:58.41
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

 

Otl Part 1

Part 1...wouldn't fit

OTL logfile created on: 2/25/2014 11:48:09 PM - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\MY\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.16518)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.95 Gb Total Physical Memory | 6.20 Gb Available Physical Memory | 77.97% Memory free
15.90 Gb Paging File | 14.07 Gb Available in Paging File | 88.51% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 246.81 Gb Total Space | 89.96 Gb Free Space | 36.45% Space Free | Partition Type: NTFS
Drive E: | 208.49 Gb Total Space | 103.42 Gb Free Space | 49.60% Space Free | Partition Type: NTFS

Computer Name: MY-VAIO | User Name: MY | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/02/25 22:25:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MY\Desktop\OTL.exe
PRC - [2014/02/22 17:47:49 | 003,767,096 | ---- | M] (AVAST Software) -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe
PRC - [2014/02/22 17:47:49 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastSvc.exe
PRC - [2013/12/21 01:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/07/02 23:06:06 | 000,061,440 | ---- | M] (Digital Delivery Networks, Inc.) -- C:\Program Files (x86)\DDNi\Oasis2Service\Oasis2Service.exe
PRC - [2012/10/12 14:02:44 | 000,054,760 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Care\VCService.exe
PRC - [2012/08/06 13:27:08 | 000,062,464 | ---- | M] () -- C:\Program Files\Sony\VAIO Care\listener.exe
PRC - [2012/06/05 15:56:28 | 000,266,240 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Browny02\BrYNSvc.exe
PRC - [2011/03/05 19:42:36 | 000,180,928 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2011/03/05 19:42:36 | 000,064,704 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
PRC - [2011/02/23 17:05:04 | 000,105,024 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
PRC - [2011/02/15 14:47:02 | 002,757,312 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
PRC - [2011/02/14 01:15:46 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011/02/14 01:15:14 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010/11/27 03:55:42 | 000,398,176 | ---- | M] (Sony Corporation) -- c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
PRC - [2010/11/06 02:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010/11/06 02:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010/03/09 00:42:02 | 000,029,984 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
PRC - [2010/03/09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
PRC - [2010/03/09 00:39:44 | 000,026,912 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Nuance\PaperPort\NuanceWDS.exe
PRC - [2010/03/05 20:11:30 | 000,636,192 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
PRC - [2009/05/05 16:06:06 | 000,222,496 | ---- | M] (Acresso Corporation) -- C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe


========== Modules (No Company Name) ==========

MOD - [2014/02/22 17:47:49 | 019,336,120 | ---- | M] () -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\libcef.dll
MOD - [2014/02/21 01:26:46 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\22e28be773484a1432b513983661dbc0\IAStorUtil.ni.dll
MOD - [2014/02/21 01:26:46 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\b1f7b4e15aef3faf382db6ba14c81371\IAStorCommon.ni.dll
MOD - [2014/02/20 23:38:12 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\59312674865dc2a19c27f9f460b1673b\System.Runtime.Remoting.ni.dll
MOD - [2014/02/20 23:37:42 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\8bc548587e91ecf0552a40e47bbf99cc\System.Windows.Forms.ni.dll
MOD - [2014/02/20 23:37:35 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5c24d3b0041ebf4f48a93615b9fa3de9\System.Drawing.ni.dll
MOD - [2014/02/20 23:37:28 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\217ece46920546d718414291d463bb1c\System.Xml.ni.dll
MOD - [2014/02/20 23:37:24 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\5b6ddf934128d538cd5cd77bf4209b93\System.Configuration.ni.dll
MOD - [2014/02/20 23:37:10 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1d696b2d3de530f7ee971070263667ff\WindowsBase.ni.dll
MOD - [2014/02/20 23:37:07 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b3a78269847005365001c33870cd121f\System.ni.dll
MOD - [2014/02/20 23:37:01 | 011,499,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ede2c6c842840e009f01bcc74fa4c457\mscorlib.ni.dll
MOD - [2012/08/06 13:27:08 | 000,062,464 | ---- | M] () -- C:\Program Files\Sony\VAIO Care\listener.exe


========== Services (SafeList) ==========

SRV:64bit: - [2014/02/06 05:48:45 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2013/09/25 01:35:56 | 001,369,136 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Sony\VAIO Update\VUAgent.exe -- (VUAgent)
SRV:64bit: - [2013/06/13 14:31:10 | 000,357,144 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:64bit: - [2013/05/27 00:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2013/03/04 17:06:26 | 000,258,048 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe -- (SampleCollector)
SRV:64bit: - [2013/02/22 15:02:06 | 000,427,432 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe -- (USER_ESRV_SVC)
SRV:64bit: - [2013/02/22 15:02:06 | 000,427,432 | ---- | M] () [Auto | Running] -- C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe -- (ESRV_SVC)
SRV:64bit: - [2012/10/12 14:02:44 | 000,054,760 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Sony\VAIO Care\VCService.exe -- (VCService)
SRV:64bit: - [2011/09/23 19:18:38 | 000,289,952 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe -- (SpfService)
SRV:64bit: - [2011/09/08 16:44:00 | 000,549,408 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr)
SRV:64bit: - [2011/09/08 15:29:16 | 000,381,488 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe -- (VcmINSMgr)
SRV:64bit: - [2011/08/26 18:47:26 | 000,101,600 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe -- (VcmXmlIfHelper)
SRV:64bit: - [2011/02/28 13:29:18 | 000,852,160 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Smart Network\VSNService.exe -- (VSNService)
SRV - [2014/02/22 17:47:49 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastSvc.exe -- (avast! Antivirus)
SRV - [2014/02/22 14:03:28 | 000,181,064 | ---- | M] (Sysinternals) [On_Demand | Stopped] -- C:\Windows\PSEXESVC.EXE -- (PSEXESVC)
SRV - [2014/02/21 00:39:20 | 000,118,896 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/02/20 23:33:17 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/12/21 01:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/11/07 01:52:56 | 000,279,000 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2013/09/11 21:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2013/07/02 23:06:06 | 000,061,440 | ---- | M] (Digital Delivery Networks, Inc.) [Auto | Running] -- C:\Program Files (x86)\DDNi\Oasis2Service\Oasis2Service.exe -- (Oasis2Service)
SRV - [2013/04/04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\MalwareBytes Pro Reinstalll 2-22-14\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013/04/04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\MalwareBytes Pro Reinstalll 2-22-14\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012/06/05 15:56:28 | 000,266,240 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Running] -- C:\Program Files (x86)\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2012/03/30 06:26:52 | 000,237,328 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\MSS\3.0.271\McCHSvc.exe -- (McComponentHostServiceSony)
SRV - [2012/03/11 23:07:58 | 002,429,544 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2011/11/03 20:30:26 | 000,138,392 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe -- (SOHCImp)
SRV - [2011/11/03 20:30:26 | 000,074,904 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe -- (SOHDs)
SRV - [2011/10/24 14:49:14 | 000,958,112 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe -- (VCFw)
SRV - [2011/03/05 19:42:36 | 000,064,704 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2011/02/23 17:05:04 | 000,105,024 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor)
SRV - [2011/02/14 01:15:46 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/02/14 01:15:14 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/11/27 03:55:42 | 000,398,176 | ---- | M] (Sony Corporation) [Auto | Running] -- c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2010/11/06 02:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010/03/18 14:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2010/03/09 00:40:36 | 000,144,672 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe -- (PDFProFiltSrvPP)
SRV - [2009/06/10 16:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - [2014/02/22 17:47:53 | 001,038,072 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)
DRV:64bit: - [2014/02/22 17:47:53 | 000,421,704 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)
DRV:64bit: - [2014/02/22 17:47:53 | 000,207,904 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2014/02/22 17:47:53 | 000,080,184 | ---- | M] (AVAST Software) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\aswStm.sys -- (aswStm)
DRV:64bit: - [2014/02/22 17:47:53 | 000,078,648 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2014/02/22 17:47:53 | 000,065,776 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2014/02/22 17:47:52 | 000,092,544 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2013/12/31 22:55:30 | 000,064,624 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2013/12/31 22:54:07 | 000,032,496 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys -- (SmbDrvI)
DRV:64bit: - [2013/11/13 05:51:44 | 000,042,184 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss6.sys -- (taphss6)
DRV:64bit: - [2013/11/07 01:52:44 | 005,363,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2013/10/01 21:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2013/09/30 16:26:48 | 000,012,504 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)
DRV:64bit: - [2013/05/23 01:12:52 | 000,059,160 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2013/05/23 01:12:50 | 000,076,568 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2013/05/23 01:12:48 | 000,077,592 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2013/05/23 01:12:48 | 000,013,080 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2013/04/10 04:38:18 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT)
DRV:64bit: - [2013/04/04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012/11/06 18:28:46 | 000,013,792 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\semav6thermal64ro.sys -- (semav6thermal64ro)
DRV:64bit: - [2012/08/23 09:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 09:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/03/11 23:08:08 | 000,340,072 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR)
DRV:64bit: - [2012/03/01 01:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/06/21 01:03:42 | 002,753,536 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011/03/27 23:12:44 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2011/03/11 01:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 01:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/08 22:28:52 | 001,581,184 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2011/02/21 12:43:52 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011/02/15 02:42:50 | 001,388,592 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2011/02/11 03:48:34 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2010/11/20 22:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010/11/20 22:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/04/26 15:20:29 | 000,012,032 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV:64bit: - [2009/07/13 20:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 20:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 20:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 15:35:02 | 000,281,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1y60x64.sys -- (e1yexpress)
DRV:64bit: - [2009/06/10 15:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 15:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 15:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 15:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/26 17:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)
DRV:64bit: - [2008/05/06 16:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007/04/09 10:09:46 | 000,012,288 | ---- | M] (Waytech Development, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\UsbFltr.sys -- (UsbFltr)
DRV - [2009/07/13 20:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=SNYVDF&pc=MASA&src=IE-SearchBox
IE:64bit: - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 94 EE 29 90 0C 0D CF 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search
IE - HKCU\..\SearchScopes\{0D7A2A4C-6167-42DF-AA10-E109199D9CB1}: "URL" = https://www.google.com/search?q={searchTerms}
IE - HKCU\..\SearchScopes\{92AEDAB4-053A-4C37-9DFF-4B94B85C65FC}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=402027&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! "
FF - prefs.js..browser.search.selectedEngine: "Yahoo! "
FF - prefs.js..browser.startup.homepage: "https://www.google.com/ "
FF - prefs.js..extensions.enabledAddons: imagedownload%40Merci.chao:6.0.5
FF - prefs.js..extensions.enabledAddons: donottrackplus%40abine.com:3.1.1038
FF - prefs.js..extensions.enabledAddons: idme%40abine.com:1.40.348
FF - prefs.js..extensions.enabledAddons: %7B81BF1D23-5F17-408D-AC6B-BD6DF7CAF670%7D:8.8.1
FF - prefs.js..extensions.enabledAddons: antmark%40ant.com:0.7.6
FF - prefs.js..extensions.enabledAddons: %7Bbee6eb20-01e0-ebd1-da83-080329fb9a3a%7D:1.49
FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.5.97
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:27.0.1
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=402027&p= "
FF - prefs.js..network.proxy.socks: "98.206.68.221 "
FF - prefs.js..network.proxy.socks_port: 13475
FF - prefs.js..network.proxy.type: 4
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_70.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_70.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1209149.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.165\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}: C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014/01/16 05:38:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Roboform 8-5-13\Firefox [2014/02/22 00:37:45 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 27.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2013/12/21 10:53:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Extensions
[2014/02/22 00:50:12 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions
[2014/02/21 00:04:10 | 000,000,000 | ---D | M] (iMacros for Firefox) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}
[2014/02/21 00:04:10 | 000,000,000 | ---D | M] (Flash and Video Download) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2014/01/03 06:26:22 | 000,000,000 | ---D | M] (DoNotTrackMe: Online Privacy Protection) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\donottrackplus@abine.com
[2014/01/16 02:40:46 | 000,000,000 | ---D | M] (MaskMe) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\idme@abine.com
[2014/02/21 00:04:10 | 000,144,360 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\antmark@ant.com.xpi
[2013/12/17 00:30:07 | 000,052,187 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\imagedownload@Merci.chao.xpi
[2014/02/21 00:03:16 | 000,384,004 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\jid0-GXjLLfbCoAx0LcltEdFrEkQdQPI@jetpack.xpi
[2014/02/21 00:04:10 | 000,384,428 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
[2014/01/17 06:46:17 | 000,940,775 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014/02/21 00:02:16 | 000,008,061 | ---- | M] () -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\searchplugins\yahoo_ff.xml
[2014/02/21 00:39:16 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/02/21 00:39:21 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

O1 HOSTS File: ([2014/02/25 15:26:37 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O2:64bit: - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
O2:64bit: - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (&RoboForm Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&RoboForm Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [BrStsMon00] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [ControlCenter4] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [IndexSearch] C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKLM..\Run: [PaperPort PTD] C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDF5 Registry Controller] C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PDFHook] C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [PPort12reminder] C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKCU..\Run: [f.lux] C:\Users\MY\AppData\Local\FluxSoftware\Flux\flux.exe (Flux Software LLC)
O4 - HKCU..\Run: [ISUSPM] C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe (Acresso Corporation)
O4 - HKCU..\Run: [RoboForm] C:\Program Files (x86)\Roboform 8-5-13\RoboTaskBarIcon.exe (Siber Systems)
O4 - Startup: C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files (x86)\ERUNT Reg Backup 2-22-14\ERUNT\AUTOBACK.EXE ()
O4 - Startup: C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yankee Clipper III.lnk = C:\Program Files (x86)\YCIII\YankClip.exe (inteleXual.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O8:64bit: - Extra context menu item: Customize Menu - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html File not found
O8:64bit: - Extra context menu item: Fill Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html File not found
O8:64bit: - Extra context menu item: Save Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html File not found
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html File not found
O8 - Extra context menu item: Customize Menu - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html File not found
O8 - Extra context menu item: Fill Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html File not found
O8 - Extra context menu item: Save Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html File not found
O8 - Extra context menu item: Show RoboForm Toolbar - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html File not found
O9:64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O15 - HKCU\..Trusted Domains: com ([*.Wondershare] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1375703205421 (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab (Java Plug-in 10.51.2)
O16 - DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab (Java Plug-in 1.7.0_45)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab (Java Plug-in 10.51.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B59C479D-3ED6-4C1B-8B7C-8DA86D5F3707}: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C2793EA2-70B1-4D96-8AC9-1B0CE25C2814}: DhcpNameServer = 75.75.75.75 75.75.76.76
O18:64bit: - Protocol\Handler\belarc - No CLSID value found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\ms-itss - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\tmbp - No CLSID value found
O18:64bit: - Protocol\Handler\tmpx - No CLSID value found
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\tmbp - No CLSID value found
O18 - Protocol\Handler\tmpx - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - No CLSID value found.
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\SysWOW64\ExplorerFrame.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\MY\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Users\MY\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (BootDefrag.exe)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/02/25 22:25:21 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\MY\Desktop\OTL.exe
[2014/02/25 22:25:05 | 001,037,734 | ---- | C] (Thisisu) -- C:\Users\MY\Desktop\JRT.exe
[2014/02/25 19:50:37 | 000,000,000 | R--D | C] -- C:\Users\MY\AppData\Roaming\Brother
[2014/02/25 15:29:43 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014/02/25 15:29:40 | 000,000,000 | ---D | C] -- C:\Users\NetworkService\AppData\Local\temp
[2014/02/25 15:29:40 | 000,000,000 | ---D | C] -- C:\Users\LocalService\AppData\Local\temp
[2014/02/25 15:18:04 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2014/02/25 15:18:04 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2014/02/25 15:18:04 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2014/02/25 15:17:58 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/02/24 20:24:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\YCIII
[2014/02/24 18:33:11 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\ControlCenter4
[2014/02/24 18:32:58 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\FLEXnet
[2014/02/24 18:01:33 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\New folder (2)
[2014/02/24 17:48:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Brother
[2014/02/24 17:36:43 | 000,000,000 | ---D | C] -- C:\Brother
[2014/02/24 17:36:34 | 000,000,000 | ---D | C] -- C:\ProgramData\ControlCenter4
[2014/02/24 17:36:34 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Browny02
[2014/02/24 17:36:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ControlCenter4
[2014/02/24 17:36:24 | 001,439,744 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\SysNative\BrWi209d.dll
[2014/02/24 17:36:24 | 000,278,528 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\SysNative\BrJDec.dll
[2014/02/24 17:36:24 | 000,050,688 | ---- | C] (Brother Industries, Ltd.) -- C:\Windows\SysNative\BrUsi09d.dll
[2014/02/24 17:36:11 | 000,245,760 | ---- | C] (brother) -- C:\Windows\SysWow64\NSSearch.dll
[2014/02/24 17:36:11 | 000,073,728 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysWow64\BrDctF2.dll
[2014/02/24 17:36:11 | 000,005,120 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysWow64\BrDctF2S.dll
[2014/02/24 17:36:11 | 000,005,120 | ---- | C] (Brother Industries Ltd.) -- C:\Windows\SysWow64\BrDctF2L.dll
[2014/02/24 17:36:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Brother
[2014/02/24 17:28:31 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\InstallShield
[2014/02/24 17:28:00 | 000,000,000 | ---D | C] -- C:\Program Files\Nuance
[2014/02/24 17:27:08 | 000,000,000 | ---D | C] -- C:\ProgramData\zeon
[2014/02/24 17:26:18 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\Nuance
[2014/02/24 17:26:01 | 000,000,000 | ---D | C] -- C:\ProgramData\ScanSoft
[2014/02/24 17:25:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Nuance PaperPort 12
[2014/02/24 17:25:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\ScanSoft Shared
[2014/02/24 17:25:20 | 000,000,000 | ---D | C] -- C:\ProgramData\FLEXnet
[2014/02/24 17:25:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Nuance
[2014/02/24 17:25:19 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Nuance
[2014/02/24 17:25:19 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\MyWebPages
[2014/02/24 17:23:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother
[2014/02/24 04:55:49 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\MaskMe Emails 10-14-13
[2014/02/24 04:48:31 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Windows All In One Portable From Bleeping Computer 2-21-14
[2014/02/22 17:58:25 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\Malwarebytes
[2014/02/22 17:58:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2014/02/22 17:58:06 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2014/02/22 17:58:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014/02/22 17:54:07 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MalwareBytes Pro Reinstalll 2-22-14
[2014/02/22 17:49:07 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\AVAST Software
[2014/02/22 17:49:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avast
[2014/02/22 17:48:15 | 000,080,184 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswStm.sys
[2014/02/22 17:48:13 | 001,038,072 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2014/02/22 17:48:12 | 000,421,704 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2014/02/22 17:48:11 | 000,078,648 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2014/02/22 17:48:09 | 000,092,544 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2014/02/22 17:48:01 | 000,334,136 | ---- | C] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2014/02/22 17:47:51 | 000,043,152 | ---- | C] (AVAST Software) -- C:\Windows\avastSS.scr
[2014/02/22 14:06:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14
[2014/02/22 13:42:16 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2014/02/22 13:40:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ERUNT
[2014/02/22 13:39:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ERUNT Reg Backup 2-22-14
[2014/02/22 09:41:42 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\catroot2
[2014/02/22 05:01:54 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2014/02/22 04:25:37 | 000,181,064 | ---- | C] (Sysinternals) -- C:\Windows\PSEXESVC.EXE
[2014/02/22 04:23:38 | 000,000,000 | ---D | C] -- C:\RegBackup
[2014/02/22 01:19:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2014/02/22 00:37:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RoboForm
[2014/02/21 18:48:11 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2014/02/21 18:39:33 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/02/21 18:14:50 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Brother DCP 7065N Ptr 2-24-14
[2014/02/21 17:56:02 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Windows BBS 2-21-14
[2014/02/21 16:58:16 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Avast AV ERrors 2-21-14
[2014/02/21 02:22:38 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2014/02/21 00:39:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2014/02/21 00:39:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2014/02/21 00:34:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2014/02/21 00:31:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle
[2014/02/21 00:26:17 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Adobe
[2014/02/21 00:10:10 | 000,000,000 | ---D | C] -- C:\Users\MY\Desktop\Desktop Icons
[2014/02/20 23:23:08 | 000,000,000 | ---D | C] -- C:\Intel
[2014/02/20 22:11:32 | 000,000,000 | ---D | C] -- C:\Users\MY\Desktop\San Cruzer Drive
[2014/02/20 20:34:38 | 000,000,000 | ---D | C] -- C:\found.002
[2014/02/03 12:34:24 | 000,000,000 | ---D | C] -- C:\Program Files\HWiNFO64
[2014/02/03 12:30:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2014/02/03 12:30:50 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpeedFan
[2014/02/03 12:30:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpeedFan
[2014/02/03 12:23:42 | 000,000,000 | ---D | C] -- C:\Program Files\Core Temp 2-3-14
[3 C:\*.tmp files -> C:\*.tmp -> ]

 

OTL Part 2

========== Files - Modified Within 30 Days ==========

[2014/02/25 23:33:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/02/25 22:43:22 | 000,028,848 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/02/25 22:43:22 | 000,028,848 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/02/25 22:42:37 | 000,782,662 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014/02/25 22:42:37 | 000,650,892 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014/02/25 22:42:37 | 000,118,628 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014/02/25 22:37:58 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/02/25 22:37:46 | 2106,478,591 | -HS- | M] () -- C:\hiberfil.sys
[2014/02/25 22:25:21 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MY\Desktop\OTL.exe
[2014/02/25 22:25:05 | 001,037,734 | ---- | M] (Thisisu) -- C:\Users\MY\Desktop\JRT.exe
[2014/02/25 22:16:17 | 001,241,834 | ---- | M] () -- C:\Users\MY\Desktop\adwcleaner.exe
[2014/02/25 21:15:19 | 000,513,871 | ---- | M] () -- C:\Users\MY\Desktop\Kissimmee, FL 34743 - Google Maps 2014-02-25 21-15-14.png
[2014/02/25 15:39:18 | 000,338,400 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014/02/25 15:26:37 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2014/02/25 00:45:51 | 000,227,954 | ---- | M] () -- C:\Users\MY\Desktop\Girl long hair.JPG
[2014/02/24 23:45:54 | 000,065,436 | ---- | M] () -- C:\Users\MY\Desktop\Logan lookalike.jpg
[2014/02/24 23:19:17 | 000,041,850 | ---- | M] () -- C:\Users\MY\Desktop\850 Female GSD.jpg
[2014/02/24 23:16:54 | 000,080,596 | ---- | M] () -- C:\Users\MY\Desktop\500 Buck GSD Pups.jpg
[2014/02/24 23:13:03 | 000,055,525 | ---- | M] () -- C:\Users\MY\Desktop\Long Hair GSD.jpg
[2014/02/24 23:10:42 | 000,038,083 | ---- | M] () -- C:\Users\MY\Desktop\pup.jpg
[2014/02/24 20:24:46 | 000,000,920 | ---- | M] () -- C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yankee Clipper III.lnk
[2014/02/24 17:48:12 | 000,002,100 | ---- | M] () -- C:\Users\Public\Desktop\Brother Creative Center.lnk
[2014/02/22 17:58:07 | 000,001,389 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/02/22 17:49:01 | 000,002,186 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2014/02/22 17:47:53 | 001,038,072 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSnx.sys
[2014/02/22 17:47:53 | 000,421,704 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswSP.sys
[2014/02/22 17:47:53 | 000,334,136 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\aswBoot.exe
[2014/02/22 17:47:53 | 000,207,904 | ---- | M] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2014/02/22 17:47:53 | 000,080,184 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswStm.sys
[2014/02/22 17:47:53 | 000,078,648 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswMonFlt.sys
[2014/02/22 17:47:53 | 000,065,776 | ---- | M] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2014/02/22 17:47:52 | 000,092,544 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswRdr2.sys
[2014/02/22 17:47:51 | 000,043,152 | ---- | M] (AVAST Software) -- C:\Windows\avastSS.scr
[2014/02/22 17:37:24 | 003,407,872 | ---- | M] () -- C:\Users\MY\NTUSER.bak
[2014/02/22 14:03:52 | 000,406,147 | ---- | M] () -- C:\Users\MY\Desktop\AdvancedFileRemover.zip
[2014/02/22 14:03:28 | 000,181,064 | ---- | M] (Sysinternals) -- C:\Windows\PSEXESVC.EXE
[2014/02/22 13:57:45 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2014/02/22 13:46:51 | 001,114,589 | ---- | M] () -- C:\Users\MY\Desktop\YC3Setup.EXE
[2014/02/22 13:41:32 | 000,001,257 | ---- | M] () -- C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2014/02/22 13:40:36 | 000,001,077 | ---- | M] () -- C:\Users\MY\Desktop\NTREGOPT.lnk
[2014/02/22 13:40:36 | 000,001,058 | ---- | M] () -- C:\Users\MY\Desktop\ERUNT.lnk
[2014/02/22 04:50:32 | 000,782,662 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2014/02/22 04:24:16 | 000,000,207 | ---- | M] () -- C:\Windows\tweaking.com-regbackup-MY-VAIO-Microsoft-Windows-7-Home-Premium-(64-bit).dat
[2014/02/21 01:18:51 | 000,000,258 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2014/02/21 00:49:17 | 000,000,977 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2014/02/21 00:44:19 | 000,001,064 | ---- | M] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\Glary Utilities 4.lnk
[2014/02/21 00:44:19 | 000,001,040 | ---- | M] () -- C:\Users\Public\Desktop\Glary Utilities 4.lnk
[2014/02/03 12:30:51 | 000,000,967 | ---- | M] () -- C:\Users\MY\Desktop\SpeedFan.lnk
[2014/02/03 12:30:50 | 000,000,045 | ---- | M] () -- C:\Windows\SysWow64\initdebug.nfo
[2014/02/03 10:26:50 | 000,004,038 | ---- | M] () -- C:\Users\MY\Desktop\Social Security Response 1-12-14.lnk
[2014/02/03 10:09:50 | 000,007,663 | ---- | M] () -- C:\Users\MY\AppData\Local\resmon.resmoncfg
[3 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2014/02/25 22:16:13 | 001,241,834 | ---- | C] () -- C:\Users\MY\Desktop\adwcleaner.exe
[2014/02/25 21:15:19 | 000,513,871 | ---- | C] () -- C:\Users\MY\Desktop\Kissimmee, FL 34743 - Google Maps 2014-02-25 21-15-14.png
[2014/02/25 15:38:35 | 000,338,400 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2014/02/25 15:18:04 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014/02/25 15:18:04 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014/02/25 15:18:04 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014/02/25 15:18:04 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014/02/25 15:18:04 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2014/02/25 00:45:51 | 000,227,954 | ---- | C] () -- C:\Users\MY\Desktop\Girl long hair.JPG
[2014/02/24 23:45:54 | 000,065,436 | ---- | C] () -- C:\Users\MY\Desktop\Logan lookalike.jpg
[2014/02/24 23:19:17 | 000,041,850 | ---- | C] () -- C:\Users\MY\Desktop\850 Female GSD.jpg
[2014/02/24 23:16:54 | 000,080,596 | ---- | C] () -- C:\Users\MY\Desktop\500 Buck GSD Pups.jpg
[2014/02/24 23:13:03 | 000,055,525 | ---- | C] () -- C:\Users\MY\Desktop\Long Hair GSD.jpg
[2014/02/24 23:10:42 | 000,038,083 | ---- | C] () -- C:\Users\MY\Desktop\pup.jpg
[2014/02/24 20:24:46 | 000,000,920 | ---- | C] () -- C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yankee Clipper III.lnk
[2014/02/24 20:24:46 | 000,000,896 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Yankee Clipper III.lnk
[2014/02/24 17:48:12 | 000,002,100 | ---- | C] () -- C:\Users\Public\Desktop\Brother Creative Center.lnk
[2014/02/22 17:58:07 | 000,001,389 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/02/22 17:49:01 | 000,002,186 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2014/02/22 17:48:13 | 000,207,904 | ---- | C] () -- C:\Windows\SysNative\drivers\aswVmm.sys
[2014/02/22 17:48:13 | 000,065,776 | ---- | C] () -- C:\Windows\SysNative\drivers\aswRvrt.sys
[2014/02/22 14:04:01 | 000,406,147 | ---- | C] () -- C:\Users\MY\Desktop\AdvancedFileRemover.zip
[2014/02/22 13:57:45 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\config.nt
[2014/02/22 13:46:51 | 001,114,589 | ---- | C] () -- C:\Users\MY\Desktop\YC3Setup.EXE
[2014/02/22 13:41:32 | 000,001,257 | ---- | C] () -- C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2014/02/22 13:40:36 | 000,001,077 | ---- | C] () -- C:\Users\MY\Desktop\NTREGOPT.lnk
[2014/02/22 13:40:36 | 000,001,058 | ---- | C] () -- C:\Users\MY\Desktop\ERUNT.lnk
[2014/02/22 04:24:16 | 000,000,207 | ---- | C] () -- C:\Windows\tweaking.com-regbackup-MY-VAIO-Microsoft-Windows-7-Home-Premium-(64-bit).dat
[2014/02/03 12:30:51 | 000,000,967 | ---- | C] () -- C:\Users\MY\Desktop\SpeedFan.lnk
[2014/02/03 12:30:50 | 000,000,045 | ---- | C] () -- C:\Windows\SysWow64\initdebug.nfo
[2014/02/03 10:26:50 | 000,004,038 | ---- | C] () -- C:\Users\MY\Desktop\Social Security Response 1-12-14.lnk
[2013/12/21 06:22:42 | 000,007,663 | ---- | C] () -- C:\Users\MY\AppData\Local\resmon.resmoncfg
[2013/12/20 21:49:27 | 036,521,397 | ---- | C] () -- C:\Program Files (x86)\volewordreviewerportable31218.zip
[2013/12/15 01:30:40 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2013/12/15 01:22:04 | 000,000,036 | ---- | C] () -- C:\Users\MY\AppData\Local\housecall.guid.cache
[2013/12/09 20:54:33 | 000,074,703 | ---- | C] () -- C:\Windows\SysWow64\mfc45.dll
[2013/12/09 00:28:55 | 000,000,226 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2013/12/09 00:04:35 | 003,407,872 | ---- | C] () -- C:\Users\MY\NTUSER.bak
[2013/11/23 10:08:57 | 000,128,512 | ---- | C] () -- C:\Windows\SysWow64\FSContxt.dll
[2013/11/07 01:52:54 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2013/11/07 01:52:42 | 000,077,312 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2013/11/07 01:52:40 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2013/10/27 02:07:57 | 000,000,600 | ---- | C] () -- C:\Users\MY\AppData\Local\PUTTY.RND
[2013/08/25 20:59:10 | 000,017,408 | ---- | C] () -- C:\Users\MY\AppData\Local\WebpageIcons.db
[2013/06/28 06:08:46 | 000,094,208 | ---- | C] () -- C:\Windows\SysWow64\ssdevm.dll
[2013/05/22 12:32:42 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL
[2013/05/22 12:32:42 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI

========== ZeroAccess Check ==========

[2009/07/13 23:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
" " = C:\Windows\SysNative\shell32.dll -- [2013/07/25 21:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shell32.dll -- [2013/07/25 20:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
" " = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 20:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\SysWow64\wbem\fastprox.dll -- [2010/11/20 22:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
" " = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 20:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2014/02/22 17:49:07 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\AVAST Software
[2014/02/24 18:33:19 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\ControlCenter4
[2013/12/24 08:07:08 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Digiarty
[2013/12/19 04:35:46 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\DiskDefrag
[2013/12/19 04:35:48 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\FileOpen
[2013/12/19 04:35:49 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\FileZilla
[2013/12/19 04:35:49 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Folder Scout Labs
[2013/12/21 11:25:24 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\GlarySoft
[2013/12/20 02:23:23 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Glarysoft Giveaway
[2013/12/30 04:50:12 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\iolo
[2013/12/24 14:57:16 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\IrfanView
[2013/12/21 07:31:59 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Jihosoft Video Converter
[2014/01/02 04:35:56 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Leadertech
[2013/12/19 04:36:51 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Notepad++
[2014/02/24 17:26:18 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Nuance
[2014/01/03 06:27:52 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Oracle
[2013/12/19 04:36:51 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Photoactions
[2014/01/13 02:53:24 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\PhotoImp
[2013/12/19 05:00:18 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Spearit

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:C0E2810A

< End of report >

 

OTL/Trend Micro Issue

Ran OTL with your script and got a BSOD crash screen with a system error. Rebooted to safe mode and ran it then it asked to reboot. Upon reboot I am still getting the option for Windows 7 and Trend Micro Boot which I thought was uninstalled.
How do I get rid of Trend Micro Boot? Also, didn't get a log file for OTL. Thx.

 

OTL Done.Trend Micro Still An Issue

Not there...only OS..I would attach the screenshot but no longer see that option. Also, I am not receiving instant message notifications for this thread.

Here are the others (in parts due to character limitations on here) Will have to run Eset later as it is lengthy. Thx.
----------------------------------------------------
All processes killed
Error: Unable to interpret <Code:> in the current context!
========== OTL ==========
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DBC80044-A445-435b-BC74-9C25C1C588A9}\ not found.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Customize Menu\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Fill Forms\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save Forms\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Show RoboForm Toolbar\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Customize Menu\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Fill Forms\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save Forms\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Show RoboForm Toolbar\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\com\*.Wondershare\ deleted successfully.
Invalid CLSID key: *.Wondershare
Starting removal of ActiveX control {6414512B-B978-451D-A0D8-FCFDF33E833C}
C:\Windows\Downloaded Program Files\wuweb.inf not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{6414512B-B978-451D-A0D8-FCFDF33E833C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6414512B-B978-451D-A0D8-FCFDF33E833C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6414512B-B978-451D-A0D8-FCFDF33E833C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6414512B-B978-451D-A0D8-FCFDF33E833C}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\\{438755C2-A8BA-11D1-B96B-00A0C90312E1} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{56F9679E-7826-4C84-81F3-532071A8BCC5} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56F9679E-7826-4C84-81F3-532071A8BCC5}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
ADS C:\ProgramData\TEMP:C0E2810A deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\FRST not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator.WORKGROUP
->Temp folder emptied: 0 bytes

User: All Users

User: boinc_master
->Temp folder emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 57472 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes

User: MY
->Temp folder emptied: 944 bytes
->Temporary Internet Files folder emptied: 451 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 2599838 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 48457478 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 43260813 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 743 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 90.00 mb


[EMPTYJAVA]

User: Administrator.WORKGROUP

User: All Users

User: boinc_master

User: Default

User: Default User

User: LocalService

User: MY
->Java cache emptied: 0 bytes

User: NetworkService

User: Public

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: Administrator.WORKGROUP

User: All Users

User: boinc_master

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: LocalService

User: MY
->Flash cache emptied: 0 bytes

User: NetworkService

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 02262014_233133

Files\Folders moved on Reboot...
File move failed. C:\Users\MY\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.
File move failed. C:\Users\MY\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

 

Security Check

Results of screen317's Security Check version 0.99.79
Windows 7 Service Pack 1 x64 (UAC is disabled!)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Enabled!
avast! Antivirus
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 51
Adobe Flash Player 12.0.0.70 Flash Player out of Date!
Adobe Reader XI
Mozilla Firefox (27.0.1)
````````Process Check: objlist.exe by Laurent````````
Avast Free 2014 Reinstall 2-22-14 AvastSvc.exe
Avast Free 2014 Reinstall 2-22-14 AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 1%
````````````````````End of Log``````````````````````

 

Fss

Farbar Service Scanner Version: 25-02-2014
Ran by MY (administrator) on 27-02-2014 at 00:55:58
Running from "C:\Users\MY\Desktop "
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Attempt to access Google IP returned error. Google IP is unreachable
Attempt to access Google.com returned error: Google.com is unreachable
Attempt to access Yahoo.com returned error: Yahoo.com is unreachable


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Action Center:
============


Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============

Other Services:
==============


File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit


**** End of log ****

 

Tfc

No log file issued. I took this off the screen.
---------------------------

Getting user folders.

Stopping running processes.

Emptying Temp folders.


User: Administrator.WORKGROUP
->Temp folder emptied: 0 bytes

User: All Users

User: boinc_master
->Temp folder emptied: 0 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes

User: MY
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 451 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 18547948 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 5822352 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33298 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes

Emptying RecycleBin. Do not interrupt.

RecycleBin emptied: 0 bytes
Process complete!

Total Files Cleaned = 23.00 mb

 

Eset Results

Threats found. Clicked uninstall Eset and delete quarantined files.

C:\Users\MY\Documents\Best Blackhat Forum Freebies 3-24-13\Firefox Downloads 4-29-13\FollowLikeBot-setup.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Best Blackhat Forum Freebies 3-24-13\Firefox Downloads 4-29-13\ProxyScraperRobot(1).zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Best Blackhat Forum Freebies 3-24-13\Firefox Downloads 4-29-13\ProxyScraperRobot.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Best Blackhat Forum Freebies 3-24-13\Firefox Downloads 4-29-13\socialclerkbot-SetupFiles.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Best Blackhat Forum Freebies 3-24-13\Firefox Downloads 4-29-13\socialmediaexplode.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Best Blackhat Forum Freebies 3-24-13\Firefox Downloads 4-29-13\TraffupROBOT-setup.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Best Blackhat Forum Freebies 3-24-13\Firefox Downloads 4-29-13\TwiendsROBOT-setup.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Best Blackhat Forum Freebies 3-24-13\Firefox Downloads 4-29-13\YouLikeHitsROBOT-setup.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Bitshacking.com 10-16-13\10-18-13\Hacker's Toolkit 10-18-13\HTKit.rar multiple threats deleted - quarantined
C:\Users\MY\Documents\Firefox\Firefox Downloads 4-29-13\FollowLikeBot-setup.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Firefox\Firefox Downloads 4-29-13\ProxyScraperRobot(1).zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Firefox\Firefox Downloads 4-29-13\ProxyScraperRobot.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Firefox\Firefox Downloads 4-29-13\socialclerkbot-SetupFiles.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Firefox\Firefox Downloads 4-29-13\socialmediaexplode.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Firefox\Firefox Downloads 4-29-13\TraffupROBOT-setup.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined
C:\Users\MY\Documents\Firefox\Firefox Downloads 4-29-13\TwiendsROBOT-setup.zip Win32/Hoax.ArchSMS.AEO application deleted - quarantined