Solved Fprot and MBAM hang on Windows 7 PC

[Solved] Fprot and MBAM hang on Windows 7 PC

Hello,

It has been a while since I last posted in this forum. I hope everyone is doing well. I encountered a problem I have never seen before. I use Fprot as my AV software on my homemade Windows 7 PC. Two days ago I noticed that it had been almost three weeks since my last full system scan so I started a scan. My C drive passed with no problems detected. Then Fprot got stuck on a jpeg file on my D drive. I have never seen it hang up on a file before. I waited about 15 minutes and after no progress I stopped the scan (I needed to stop the service to get it to close). I tried scanning the folder on the D drive with the file (D:\100EOS7D\) and it hung up on the same file again. I then tried running Malwarebytes on the same folder and it hung up.

Initially I thought this was simply a corrupt jpeg file. My system would hang up when I tried to preview the picture . After confirming I had a backup in my camera, I deleted the file. The same thing happened with another picture in the same folder. I ended up deleting the whole folder. I ran Fprot again and it hung up on a picture in a completely different folder. This new glitch is with a file that is 5 years old, has never changed, and has passed hundreds of scans in the past. I wondered if I had a bad disk block, but chkdsk found no errors.

Now I am worried that my PC has some malware. Following is the information you request in your sticky note. There is one exception, when I try to run a full scan using Fprot it hangs up on my D drive. I would very much like to verify that my PC is clean. Any help in identifying the cause and solution to this problem would also be greatly appreciated.

Thank you!
Chip

 

Screenshots of Fprot and MBAM hanging

In case this is helpful, here are screenshots of the initial problem when Fprot and MBAM hanged on my jpeg folder.

 

D drive chkdsk report

In case it is relevant, here are the results of the chkdsk scan on my D drive:

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.

C:\Windows\system32>cd /d d:\

d:\>chkdsk
The type of the file system is NTFS.
Volume label is Photos.

WARNING! F parameter not specified.
Running CHKDSK in read-only mode.

CHKDSK is verifying files (stage 1 of 3)...
92160 file records processed.
File verification completed.
26 large file records processed.
0 bad file records processed.
0 EA records processed.
0 reparse records processed.
CHKDSK is verifying indexes (stage 2 of 3)...
100848 index entries processed.
Index verification completed.
0 unindexed files scanned.
0 unindexed files recovered.
CHKDSK is verifying security descriptors (stage 3 of 3)...
92160 file SDs/SIDs processed.
Security descriptor verification completed.
4345 data files processed.
CHKDSK is verifying Usn Journal...
15335944 USN bytes processed.
Usn Journal verification completed.
Windows has checked the file system and found no problems.

1465134079 KB total disk space.
1051199192 KB in 84848 files.
32188 KB in 4346 indexes.
0 KB in bad sectors.
218235 KB in use by the system.
65536 KB occupied by the log file.
413684464 KB available on disk.

4096 bytes in each allocation unit.
366283519 total allocation units on disk.
103421116 allocation units available on disk.

 

Fprot Scan

-----------------------------SCAN REPORT-----------------------------
F-PROT Antivirus for Windows

Antivirus Scanning Engine version number: 4.6.5
Virus signature file from: 5/22/2014, 9:04 PM

Scan name: [My Computer]
Path to scan: [My Computer]

Normal scan
Also scan: Inside subfolders, Compressed files, Streams

Scan started: 5/22/2014, 11:57:50 PM
---------------------------------------------------------------------

[Not scanning] <excluded> B:\
[Not scanning] <excluded> C:\Documents and Settings
[Error] <Scanning error> C:\Program Files (x86)\Common Files\Adobe\XMP\Custom File Info Panels\3.0\bin\FileInfoFoundation.swf
[Unscannable] <File is damaged> C:\Program Files (x86)\EVGA Precision\Redist\vcredist_x86.exe->(CAB)->vc_red.cab
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->PDR.ico
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->MsiZap.exe.manifest
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1028.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1031.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1033.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1034.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1036.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1040.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1041.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1042.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_1043.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_2052.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic_4100.TXT
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->MUI_Lang.ini
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->lic/RTF/lic_trk.rtf
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z->Compress.log
[Error] <Scanning error> C:\Program Files (x86)\InstallShield Installation Information\{9AA216FE-501D-4169-A239-709F67B5B060}\SupportFiles.7z
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->PDR.ico
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->MsiZap.exe.manifest
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1028.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1031.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1033.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1034.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1036.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1040.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1041.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1042.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_1043.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_2052.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->lic_4100.TXT
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->MUI_Lang.ini
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z->Compress.log
[Error] <Scanning error> C:\Program Files (x86)\InstallShield Installation Information\{AABB78C0-A435-486A-84E3-17E6684828C2}\SupportFiles.7z
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->Product.ico
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->MsiZap.exe.manifest
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->PostBuild.exe.manifest
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1028.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1030.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1031.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1033.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1034.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1036.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1040.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1041.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1042.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_1043.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_2052.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z->lic_4100.txt
[Error] <Scanning error> C:\Program Files (x86)\InstallShield Installation Information\{B0B4F6D2-F2AE-451A-9496-6F2F6A897B32}\SupportFiles.7z
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->Product.ico
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->MsiZap.exe.manifest
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->PostBuild.exe.manifest
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1028.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1030.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1031.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1033.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1034.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1036.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1040.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1041.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1042.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_1043.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_2052.txt
[Unscannable] <File is encrypted> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z->lic_4100.txt
[Error] <Scanning error> C:\Program Files (x86)\InstallShield Installation Information\{E8C64028-08E5-4BF0-B1C0-DBAAC6A77DF1}\SupportFiles.7z
[Error] <Scanning error> C:\ProgramData\Adobe\ARM\Acrobat_10.0.0\AdobeARM.bin
[Not scanning] <excluded> C:\ProgramData\Application Data
[Not scanning] <excluded> C:\ProgramData\Desktop
[Not scanning] <excluded> C:\ProgramData\Documents
[Not scanning] <excluded> C:\ProgramData\Favorites
[Warning] <Could not open file> C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\f686aace6942fb7f7ceb231212eef4a4_1ed0603d-c372-4121-b99f-e9bc49f42c90
[Warning] <Could not open file> C:\ProgramData\Microsoft\RAC\StateData\RacMetaData.dat
[Warning] <Could not open file> C:\ProgramData\Microsoft\RAC\StateData\RacWmiEventData.dat
[Warning] <Could not open file> C:\ProgramData\Microsoft\User Account Pictures\Chip2012.dat
[Warning] <Could not open file> C:\ProgramData\Microsoft\User Account Pictures\UpdatusUser.dat
[Warning] <Could not open file> C:\ProgramData\Microsoft\User Account Pictures\__sbs_netsetup__.dat
[Unscannable] <File is damaged> C:\ProgramData\NVIDIA Corporation\NetService\GeForce_Experience_Update_v2.0.0.0.exe->MS.NET/dotNetFx40_Full_setup.exe->(7Z)
[Not scanning] <excluded> C:\ProgramData\Start Menu
[Not scanning] <excluded> C:\ProgramData\Templates
[Not scanning] <excluded> C:\Users\All Users
[Not scanning] <excluded> C:\Users\chip\AppData\Local\Application Data
[Not scanning] <excluded> C:\Users\chip\AppData\Local\History
[Warning] <Could not open file> C:\Users\chip\AppData\Local\Microsoft\Windows\UsrClass.dat
[Warning] <Could not open file> C:\Users\chip\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG1
[Warning] <Could not open file> C:\Users\chip\AppData\Local\Microsoft\Windows\UsrClass.dat.LOG2
[Warning] <Could not open file> C:\Users\chip\AppData\Local\Microsoft\Windows\WebCache\V01.log
[Warning] <Could not open file> C:\Users\chip\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.dat
[Warning] <Could not open file> C:\Users\chip\AppData\Local\Microsoft\Windows\WebCache\WebCacheV01.tmp
[Error] <Scanning error> C:\Users\chip\AppData\Local\Mozilla\Firefox\Profiles\47ny3ey0.default-1399158311152\Cache\2\66\E808Dd01
[Error] <Scanning error> C:\Users\chip\AppData\Local\Mozilla\Firefox\Profiles\47ny3ey0.default-1399158311152\Cache\5\C1\208BAd01
[Warning] <Could not open file> C:\Users\chip\AppData\Local\Temp\BCGE38B.tmp
[Not scanning] <excluded> C:\Users\chip\AppData\Local\Temporary Internet Files
[Warning] <Could not open file> C:\Users\chip\AppData\Roaming\FRISK Software\F-PROT Antivirus for Windows\ReportFiles\2014-05-22T11-57-50 - [My Computer].txt
[Warning] <Could not open file> C:\Users\chip\AppData\Roaming\Mozilla\Firefox\Profiles\47ny3ey0.default-1399158311152\parent.lock
[Not scanning] <excluded> C:\Users\chip\Application Data
[Not scanning] <excluded> C:\Users\chip\Cookies
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\DU Catalog.pdf->OBJ001
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\DU Catalog.pdf->OBJ002
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\DU Catalog.pdf->OBJ003
*** Note to WindowsBBS - I deleted 600 entries about this one file, all the same except a different OBJ number.

[Unscannable] <File is encrypted> C:\Users\chip\Desktop\DU Catalog.pdf->OBJ608
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\DU Catalog.pdf->OBJ609
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\DU Catalog.pdf->OBJ610
[Unscannable] <File is damaged> C:\Users\chip\Desktop\ipscan23.exe->(CAB)
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <Unknown format or compression method> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\Phaser_6180_Win7_PS_x64_English.exe
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\******VMS-Upgrade.pdf->OBJ002
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\******VMS-Upgrade.pdf->OBJ003
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\******VMS-Upgrade.pdf->OBJ004
*** Note to WindowsBBS - there were 110 additional entries on this file I deleted, all the same, just a different OBJ number

[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\******VMS-Upgrade.pdf->OBJ120
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\00 Expand\Check to FIle\******VMS-Upgrade.pdf->OBJ121
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\JR******Upgrade.pdf->OBJ002
*** Note to WindowsBBS - there were 110 additional entries on this file I deleted, all the same, just a different OBJ number

[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\JR******Upgrade.pdf->OBJ114
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\JR******Upgrade.pdf->OBJ115
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\JR******Upgrade.pdf->OBJ116
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ002
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ003
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ004
*** Note to WindowsBBS - there were 110 additional entries on this file I deleted, all the same, just a different OBJ number

[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ110
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ111
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ112
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ113
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ114
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ115
[Unscannable] <File is encrypted> C:\Users\chip\Desktop\To Clean Up\******Upgrade.pdf->OBJ116
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->Product.ico
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->MsiZap.exe.manifest
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->PostBuild.exe.manifest
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1028.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1030.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1031.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1033.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1034.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1036.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1040.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1041.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1042.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_1043.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_2052.txt
[Unscannable] <File is encrypted> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->lic_4100.txt
[Error] <Scanning error> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->(RAR)->SupportFiles.7z
[Error] <Scanning error> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe->(RAR)
[Error] <Scanning error> C:\Users\chip\Documents\CL.2231_GM7_Patch_VDE121029-09.exe
[Not scanning] <excluded> C:\Users\chip\Documents\My Music
[Not scanning] <excluded> C:\Users\chip\Documents\My Pictures
[Not scanning] <excluded> C:\Users\chip\Documents\My Videos
[Not scanning] <excluded> C:\Users\chip\Local Settings
[Not scanning] <excluded> C:\Users\chip\My Documents
[Not scanning] <excluded> C:\Users\chip\NetHood
[Warning] <Could not open file> C:\Users\chip\NTUSER.DAT
[Warning] <Could not open file> C:\Users\chip\ntuser.dat.LOG1
[Warning] <Could not open file> C:\Users\chip\ntuser.dat.LOG2
[Not scanning] <excluded> C:\Users\chip\PrintHood
[Not scanning] <excluded> C:\Users\chip\Recent
[Not scanning] <excluded> C:\Users\chip\SendTo
[Not scanning] <excluded> C:\Users\chip\Start Menu
[Not scanning] <excluded> C:\Users\chip\Templates
[Not scanning] <excluded> C:\Users\Chip2012\AppData\Local\Application Data
[Not scanning] <excluded> C:\Users\Chip2012\AppData\Local\History
[Warning] <Could not open file> C:\Users\Chip2012\AppData\Local\Temp\inf5C81.html
[Not scanning] <excluded> C:\Users\Chip2012\AppData\Local\Temporary Internet Files
[Not scanning] <excluded> C:\Users\Chip2012\Application Data
[Not scanning] <excluded> C:\Users\Chip2012\Cookies
[Not scanning] <excluded> C:\Users\Chip2012\Documents\My Music
[Not scanning] <excluded> C:\Users\Chip2012\Documents\My Pictures
[Not scanning] <excluded> C:\Users\Chip2012\Documents\My Videos
[Not scanning] <excluded> C:\Users\Chip2012\Local Settings
[Not scanning] <excluded> C:\Users\Chip2012\My Documents
[Not scanning] <excluded> C:\Users\Chip2012\NetHood
[Not scanning] <excluded> C:\Users\Chip2012\PrintHood
[Not scanning] <excluded> C:\Users\Chip2012\Recent
[Not scanning] <excluded> C:\Users\Chip2012\SendTo
[Not scanning] <excluded> C:\Users\Chip2012\Start Menu
[Not scanning] <excluded> C:\Users\Chip2012\Templates
[Not scanning] <excluded> C:\Users\Default\AppData\Local\Application Data
[Not scanning] <excluded> C:\Users\Default\AppData\Local\History
[Not scanning] <excluded> C:\Users\Default\AppData\Local\Temporary Internet Files
[Not scanning] <excluded> C:\Users\Default\Application Data
[Not scanning] <excluded> C:\Users\Default\Cookies
[Not scanning] <excluded> C:\Users\Default\Documents\My Music
[Not scanning] <excluded> C:\Users\Default\Documents\My Pictures
[Not scanning] <excluded> C:\Users\Default\Documents\My Videos
[Not scanning] <excluded> C:\Users\Default\Local Settings
[Not scanning] <excluded> C:\Users\Default\My Documents
[Not scanning] <excluded> C:\Users\Default\NetHood
[Not scanning] <excluded> C:\Users\Default\PrintHood
[Not scanning] <excluded> C:\Users\Default\Recent
[Not scanning] <excluded> C:\Users\Default\SendTo
[Not scanning] <excluded> C:\Users\Default\Start Menu
[Not scanning] <excluded> C:\Users\Default\Templates
[Not scanning] <excluded> C:\Users\Default User
[Not scanning] <excluded> C:\Users\Public\Documents\My Music
[Not scanning] <excluded> C:\Users\Public\Documents\My Pictures
[Not scanning] <excluded> C:\Users\Public\Documents\My Videos
[Unscannable] <File is damaged> C:\Windows\Chipset\netfx\dotnetfx35\dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFX35\x86\netfx35_x86.exe->(CAB)->vs_setup.cab
[Unscannable] <File is damaged> C:\Windows\Chipset\netfx\dotnetfx35\dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFX35\x64\netfx35_x64.exe->(CAB)->vs_setup.cab
[Unscannable] <File is damaged> C:\Windows\Chipset\netfx\dotnetfx35\dotnetfx35.exe->(CAB)->wcu\.\.\.\.\.\dotNetFramework\dotNetFX35\ia64\netfx35_ia64.exe->(CAB)->vs_setup.cab
[Unscannable] <File is damaged> C:\Windows\Intuit\{06A9E630-DBA6-4D92-9DE7-A235AA6496C7}\Data1.cab.{36E49E6E-09F3-46A3-8C29-C99665586D0B}
[Unscannable] <File is damaged> C:\Windows\Intuit\{06A9E630-DBA6-4D92-9DE7-A235AA6496C7}\Data1.cab.{A6D0F6C4-F5AD-4B94-839C-B8CF5BED2290}
[Warning] <Could not open file> C:\Windows\Logs\CBS\CBS.log
[Warning] <Could not open file> C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe.config
[Warning] <Could not open file> C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe.config
[Unscannable] <File is damaged> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.5.50938\NetFx_Full_GDR.mzz
[Unscannable] <File is damaged> C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.5.50938\NetFx_Full_LDR.mzz
[Warning] <Could not open file> C:\Windows\Panther\UnattendGC\diagerr.xml
[Warning] <Could not open file> C:\Windows\Panther\UnattendGC\diagwrn.xml
[Warning] <Could not open file> C:\Windows\PLA\System\System Diagnostics.xml
[Warning] <Could not open file> C:\Windows\PLA\System\System Performance.xml
[Warning] <Could not open file> C:\Windows\security\database\secedit.sdb
[Unscannable] <File is damaged> C:\Windows\SoftwareDistribution\Download\d31c1d741290e739e80935dded951d5114a57834->(7Z)
[Warning] <Could not open file> C:\Windows\System32\catroot2\edb.log
[Warning] <Could not open file> C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\catdb
[Warning] <Could not open file> C:\Windows\System32\catroot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb
[Warning] <Could not open file> C:\Windows\System32\log.txt
[Warning] <Could not open file> C:\Windows\SysWOW64\log.txt
[Warning] <Could not open file> C:\Windows\Tasks\Adobe Flash Player Updater.job
[Warning] <Could not open file> C:\Windows\Tasks\FoxTab.job
[Warning] <Could not open file> C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[Warning] <Could not open file> C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[Warning] <Could not open file> C:\Windows\winsxs\amd64_microsoft-windows-n..n_service_datastore_31bf3856ad364e35_6.1.7601.17514_none_2f54961b4c9f4194\dnary.xsd
[Error] <Scanning error> D:\M-Copy\Photos\2008 Archive\2008_Giants_Season\Final Giant Photos Poster\FinalGiantsStore\Giants_174.JPG
[Error] <Scanning error> D:\M-Copy\Photos\2008 Archive\2008_Giants_Season\Final Giant Photos Poster\FinalGiantsStore\Giants_175.JPG
[Error] <Scanning error> D:\M-Copy\Photos\2008 Archive\2008_Giants_Season\Final Giant Photos Poster\FinalGiantsStore\Giants_176.JPG
[Error] <Scanning error> D:\M-Copy\Photos\2008 Archive\2008_Giants_Season\Final Giant Photos Poster\FinalGiantsStore\Giants_177.JPG
[Not scanning] <excluded> K:\
[Not scanning] <excluded> T:\
[Not scanning] <excluded> U:\
[Not scanning] <excluded> W:\
[Not scanning] <excluded> Y:\

---------------------------------------------------------------------
Scan ended: 5/23/2014, 1:04:13 AM
Duration: 1:06:23

Scan result:

Scanned files: 284696
Infected objects: 0
Disinfected objects: 0
Quarantined files: 0
---------------------------------------------------------------------

 

MBAM log

Malwarebytes Anti-Malware (PRO) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.05.22.12

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16899
chip :: CHIPPC3 [administrator]

Protection: Enabled

5/22/2014 3:54:32 PM
mbam-log-2014-05-22 (15-54-32).txt

Scan type: Full scan (D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 377893
Time elapsed: 53 minute(s), 7 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

 

DDS Log

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16866 BrowserJavaVersion: 10.51.2
Run by chip at 7:08:00 on 2014-05-23
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.16340.13166 [GMT -7:00]
.
AV: F-PROT Antivirus for Windows *Enabled/Updated* {31B7FFC6-2716-5A4E-528D-32786E690ED2}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe
C:\Program Files\Intel\iCLS Client\HeciServer.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
C:\Windows\SysWOW64\nlssrv32.exe
C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\Program Files\CyberLink\Shared files\RichVideo64.exe
C:\Program Files (x86)\Photodex\ProShow Gold\ScsiAccess.exe
C:\Program Files (x86)\Contour Shuttle\ShuttleEngine.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\StrongVPN\StrongService.exe
C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe
C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\SysWOW64\HsMgr.exe
C:\Windows\system\HsMgr64.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files (x86)\Citrix\GoToMeeting\1082\g2mstart.exe
C:\Windows\SysWOW64\StrongDial.exe
C:\Program Files\ASUS Xonar DG Audio\Customapp\ASUSAUDIOCENTER.EXE
C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files (x86)\TechSmith\SnagIt 9\SnagIt32.exe
C:\Users\chip\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Users\chip\AppData\Local\Autobahn\nexdef.exe
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe
C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
C:\Program Files (x86)\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe
C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
C:\Program Files (x86)\Citrix\GoToMeeting\1082\g2mcomm.exe
C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\acrotray.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
C:\Program Files (x86)\Virtual Account Numbers\CitiVAN.exe
C:\Program Files (x86)\TechSmith\SnagIt 9\TSCHelp.exe
C:\Program Files (x86)\iTunes\iTunesHelper.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files (x86)\TechSmith\SnagIt 9\SnagPriv.exe
C:\Windows\SysWOW64\OBroker.exe
C:\Program Files (x86)\Citrix\GoToMeeting\1082\g2mlauncher.exe
C:\Program Files (x86)\TechSmith\SnagIt 9\snagiteditor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\explorer.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
mWinlogon: Userinit = userinit.exe,
BHO: SnagIt Toolbar Loader: {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\SnagIt 9\SnagItBHO.dll
BHO: Virtual Account Numbers Helper: {17424104-1444-4810-85D7-B4DA413C5A9A} - C:\Program Files (x86)\Virtual Account Numbers\CitiVANHelper.dll
BHO: Spybot-S&D IE Protection: {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: SnagIt: {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\SnagIt 9\SnagItIEAddin.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Virtual Account Numbers: {7A21A046-B886-4A62-9D69-EF2059B0A27B} - C:\Program Files (x86)\Virtual Account Numbers\CitiVANToolbar.dll
uRun: [AdobeBridge] <no file>
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe "
mRun: [RUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe "
mRun: [NUSB3MON] "C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe "
mRun: [F-PROT Antivirus Tray application] C:\Program Files (x86)\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe
mRun: [SAOB Monitor] C:\Program Files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe
mRun: [TrueImageMonitor.exe] "C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe "
mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
mRun: [Adobe Acrobat Speed Launcher] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe "
mRun: [Acrobat Assistant 8.0] "C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe "
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe "
mRun: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup
mRun: [DivXMediaServer] C:\Program Files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
mRun: [Contour Shuttle Device Helper] C:\Program Files (x86)\Contour Shuttle\ShuttleHelper.exe
mRun: [Virtual Account Numbers] C:\PROGRA~2\VIRTUA~1\CitiVAN.exe /lang=en_RG /dontopenmycards
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe "
StartupFolder: C:\Users\chip\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\chip\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\chip\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mozenda.lnk - C:\Users\chip\AppData\Roaming\Mozenda\Programs\Mozenda.ClientConnector.exe
StartupFolder: C:\Users\chip\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\NEXDEF~1.LNK - C:\Users\chip\AppData\Local\Autobahn\nexdef.exe
StartupFolder: C:\Users\chip\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\ONENOT~1.LNK - C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\QUICKB~1.LNK - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SNAGIT~1.LNK - C:\Program Files (x86)\TechSmith\SnagIt 9\SnagIt32.exe
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-Explorer: NoWelcomeScreen = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll
.
INFO: HKCU has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
.
INFO: HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
TCP: Interfaces\{BBC69382-9665-4723-B32B-C162BF7489FF} : NameServer = 192.168.1.33,209.18.47.61
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll
Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - C:\Program Files (x86)\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} -
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\34.0.1847.137\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: SnagIt Toolbar Loader: {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\SnagIt 9\DLLx64\SnagItBHO64.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RtkNGUI64.exe -s
x64-Run: [Acronis Scheduler2 Service] "C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe "
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe "
x64-Run: [Logitech Download Assistant] C:\Windows\System32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
x64-Run: [Cmaudio8788] C:\Windows\syswow64\RunDll32.exe C:\Windows\Syswow64\cmicnfgp.dll,CMICtrlWnd
x64-Run: [Cmaudio8788GX] C:\Windows\syswow64\HsMgr.exe Envoke
x64-Run: [Cmaudio8788GX64] C:\Windows\system\HsMgr64.exe Envoke
x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe "
x64-Run: [ShadowPlay] C:\Windows\System32\rundll32.exe C:\Windows\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
.
INFO: x64-HKLM has more than 50 listed domains.
If you wish to scan all of them, select the 'Force scan all domains' option.
.
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - <orphaned>
x64-Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - <orphaned>
x64-Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - <orphaned>
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\chip\AppData\Roaming\Mozilla\Firefox\Profiles\47ny3ey0.default-1399158311152\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll
FF - plugin: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll
FF - plugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll
FF - plugin: C:\Program Files (x86)\Hewlett-Packard\HP Virtual Room Client Launcher Plugin\nphpvrl.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\Photodex Presenter\npPxPlay.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Users\chip\AppData\Local\Citrix\Plugins\94\npappdetector.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll
.
============= SERVICES / DRIVERS ===============
.
R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2012-7-15 16152]
R0 mv91cons;Marvell 91xx Config Device Driver;C:\Windows\System32\drivers\mv91cons.sys [2012-5-29 25904]
R0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);C:\Windows\System32\drivers\tdrpm273.sys [2012-7-18 1263200]
R1 FPAV_RTP;FPAV_RTP;C:\Windows\System32\drivers\FPAV_RTP.sys [2012-7-18 842144]
R2 afcdpsrv;Acronis Nonstop Backup Service;C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [2012-7-21 3246040]
R2 FPAVServer;F-PROT Antivirus for Windows system;C:\Program Files (x86)\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [2011-10-6 84136]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2012-7-15 13592]
R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2012-2-2 628448]
R2 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-8-23 13672]
R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2012-7-15 161560]
R2 Motorola Device Manager;Motorola Device Manager Service;C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [2013-11-15 137528]
R2 nlsX86cc;Nalpeiron Licensing Service;C:\Windows\SysWOW64\nlssrv32.exe [2013-6-27 71280]
R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-4-18 1593632]
R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-4-18 16941856]
R2 PST Service;PST Service;C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [2013-7-27 65657]
R2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);C:\Program Files\CyberLink\Shared files\RichVideo64.exe [2012-7-21 390632]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2014-5-23 1153368]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-4-18 411936]
R2 StrongVPN Service;StrongVPN Service;C:\Program Files (x86)\StrongVPN\StrongService.exe [2013-6-17 96240]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-7-15 363800]
R2 UsbClientService;UsbClientService;C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [2011-2-17 245760]
R3 afcdp;afcdp;C:\Windows\System32\drivers\afcdp.sys [2012-7-21 285280]
R3 asmthub3;ASMedia USB3 Hub Service;C:\Windows\System32\drivers\asmthub3.sys [2011-11-3 130536]
R3 asmtxhci;ASMEDIA XHCI Service;C:\Windows\System32\drivers\asmtxhci.sys [2011-11-3 395752]
R3 busenum;Synology Virtual USB Hub;C:\Windows\System32\drivers\busenum.sys [2011-2-17 56160]
R3 cmudaxp;ASUS Xonar DG Audio Interface;C:\Windows\System32\drivers\cmudaxp.sys [2013-3-9 2725376]
R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2012-7-15 356120]
R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2012-7-15 787736]
R3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;C:\Windows\System32\drivers\nusb3hub.sys [2011-9-13 95744]
R3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;C:\Windows\System32\drivers\nusb3xhc.sys [2011-9-13 212992]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\Windows\System32\drivers\nvvad64v.sys [2014-4-18 39200]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2012-7-15 677480]
R3 tapstrong;StrongVPN Adapter;C:\Windows\System32\drivers\tapstrong.sys [2013-6-17 35520]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-9-11 418376]
S2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-9-11 701512]
S3 DIRECTIO;DIRECTIO;C:\Program Files\PerformanceTest\DirectIo64.sys [2012-10-17 25704]
S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2011-4-12 71168]
S3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2012-7-18 25928]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-10-30 19456]
S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-2-21 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-10-30 30208]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-12-13 54784]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-7-15 1255736]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
.
=============== File Associations ===============
.
FileExt: .txt: Applications\editplus.exe= "C:\Program Files (x86)\EditPlus 3\editplus.exe" "%1" [UserChoice]
.
=============== Created Last 30 ================
.
2014-05-23 08:08:45 -------- d-----w- C:\ProgramData\Spybot - Search & Destroy
2014-05-23 08:08:45 -------- d-----w- C:\Program Files (x86)\Spybot - Search & Destroy
2014-05-14 14:13:27 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2014-05-14 14:13:26 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-05-11 21:08:49 -------- d-----w- C:\Program Files (x86)\MathMagic Personal Edition
2014-05-09 18:36:42 -------- d-----w- C:\Program Files (x86)\Belarc
2014-05-08 13:48:42 227704 ----a-w- C:\Program Files (x86)\Mozilla Firefox\plugins\nppdf32.dll
2014-05-08 03:25:32 -------- d-----w- C:\Users\chip\AppData\Roaming\Mozenda
2014-05-04 19:02:47 -------- d-----w- C:\ProgramData\HitmanPro
2014-05-04 15:39:09 536576 ----a-w- C:\Windows\SysWow64\sqlite3.dll
2014-05-04 15:38:49 -------- d-----w- C:\AdwCleaner
2014-05-02 22:50:49 -------- d-----w- C:\Users\chip\AppData\Roaming\DropboxMaster
2014-05-01 16:04:01 -------- d-----w- C:\Grad Poster Board
2014-05-01 02:46:32 -------- d-----w- C:\Program Files\MediaInfo
2014-04-30 23:19:44 -------- d-----w- C:\Users\chip\AppData\Roaming\mkvtoolnix
2014-04-30 23:18:10 -------- d-----w- C:\Program Files\MKVToolNix
2014-04-27 00:31:35 -------- d-----w- C:\2014-02-14 Basketball
2014-04-25 17:41:27 10651704 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E935DE76-E8EB-473F-B69F-17219FEEB33B}\mpengine.dll
2014-04-25 14:55:32 -------- d-s---w- C:\Windows\System32\CompatTel
2014-04-25 07:09:07 228864 ----a-w- C:\Windows\System32\wwansvc.dll
2014-04-25 07:07:00 1684928 ----a-w- C:\Windows\System32\drivers\ntfs.sys
2014-04-25 07:06:59 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll
2014-04-25 07:06:59 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll
.
==================== Find3M ====================
.
2014-05-14 07:57:14 70832 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-14 07:57:14 692400 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-04-14 02:24:46 465408 ----a-w- C:\Windows\System32\aepdu.dll
2014-04-14 02:19:37 424448 ----a-w- C:\Windows\System32\aeinv.dll
2014-04-12 02:22:05 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2014-04-12 02:22:05 155072 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2014-04-12 02:19:38 29184 ----a-w- C:\Windows\System32\sspisrv.dll
2014-04-12 02:19:38 136192 ----a-w- C:\Windows\System32\sspicli.dll
2014-04-12 02:19:37 28160 ----a-w- C:\Windows\System32\secur32.dll
2014-04-12 02:19:32 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
2014-04-12 02:19:05 31232 ----a-w- C:\Windows\System32\lsass.exe
2014-04-12 02:12:06 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2014-04-12 02:10:56 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2014-04-01 05:46:48 130712 ----a-w- C:\Windows\SysWow64\MSSTDFMT.DLL
2014-04-01 05:46:48 1070232 ----a-w- C:\Windows\SysWow64\MSCOMCTL.OCX
2014-03-31 16:35:08 270496 ------w- C:\Windows\System32\MpSigStub.exe
2014-03-13 06:33:30 2238976 ----a-w- C:\Windows\System32\wininet.dll
2014-03-13 06:32:03 3959808 ----a-w- C:\Windows\System32\jscript9.dll
2014-03-13 06:31:55 67072 ----a-w- C:\Windows\System32\iesetup.dll
2014-03-13 06:31:55 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2014-03-13 05:10:47 1766400 ----a-w- C:\Windows\SysWow64\wininet.dll
2014-03-13 05:09:43 2877952 ----a-w- C:\Windows\SysWow64\jscript9.dll
2014-03-13 05:09:39 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2014-03-13 05:09:39 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2014-03-13 03:59:47 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2014-03-13 03:51:45 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2014-03-04 13:06:00 6714312 ----a-w- C:\Windows\System32\nvcpl.dll
2014-03-04 13:06:00 3497816 ----a-w- C:\Windows\System32\nvsvc64.dll
2014-03-04 13:05:58 922968 ----a-w- C:\Windows\System32\nvvsvc.exe
2014-03-04 13:05:58 64968 ----a-w- C:\Windows\System32\nvshext.dll
2014-03-04 13:05:57 386336 ----a-w- C:\Windows\System32\nvmctray.dll
2014-03-04 13:05:53 3649185 ----a-w- C:\Windows\System32\nvcoproc.bin
2014-03-04 11:32:59 599840 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
2014-03-04 09:47:01 5550016 ----a-w- C:\Windows\System32\ntoskrnl.exe
2014-03-04 09:44:21 362496 ----a-w- C:\Windows\System32\wow64win.dll
2014-03-04 09:44:21 243712 ----a-w- C:\Windows\System32\wow64.dll
2014-03-04 09:44:21 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
2014-03-04 09:44:20 39936 ----a-w- C:\Windows\System32\wincredprovider.dll
2014-03-04 09:44:10 210944 ----a-w- C:\Windows\System32\wdigest.dll
2014-03-04 09:44:08 86528 ----a-w- C:\Windows\System32\TSpkg.dll
2014-03-04 09:44:06 340992 ----a-w- C:\Windows\System32\schannel.dll
2014-03-04 09:44:03 722944 ----a-w- C:\Windows\System32\objsel.dll
2014-03-04 09:44:03 314880 ----a-w- C:\Windows\System32\msv1_0.dll
2014-03-04 09:44:03 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
2014-03-04 09:44:00 728064 ----a-w- C:\Windows\System32\kerberos.dll
2014-03-04 09:44:00 424960 ----a-w- C:\Windows\System32\KernelBase.dll
2014-03-04 09:43:56 57344 ----a-w- C:\Windows\System32\cngprovider.dll
2014-03-04 09:43:56 52736 ----a-w- C:\Windows\System32\dpapiprovider.dll
2014-03-04 09:43:56 44544 ----a-w- C:\Windows\System32\dimsroam.dll
2014-03-04 09:43:56 22016 ----a-w- C:\Windows\System32\credssp.dll
2014-03-04 09:43:55 56832 ----a-w- C:\Windows\System32\adprovider.dll
2014-03-04 09:43:55 53760 ----a-w- C:\Windows\System32\capiprovider.dll
2014-03-04 09:43:50 455168 ----a-w- C:\Windows\System32\winlogon.exe
2014-03-04 09:20:11 3969984 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2014-03-04 09:20:11 3914176 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2014-03-04 09:16:54 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
2014-03-04 09:16:18 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
2014-03-04 09:16:18 274944 ----a-w- C:\Windows\SysWow64\KernelBase.dll
2014-03-04 08:09:30 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
2014-03-04 08:09:29 2048 ----a-w- C:\Windows\SysWow64\user.exe
.
============= FINISH: 7:08:18.29 ===============

 

Attach.txt

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 7/14/2012 10:45:35 PM
System Uptime: 5/23/2014 6:57:32 AM (1 hours ago)
.
Motherboard: ASUSTeK COMPUTER INC. | | P8Z77-V LK
Processor: Intel(R) Core(TM) i7-3770K CPU @ 3.50GHz | LGA1155 | 3501/100mhz
.
==== Disk Partitions =========================
.
B: is CDROM ()
C: is FIXED (NTFS) - 119 GiB total, 11.039 GiB free.
D: is FIXED (NTFS) - 1397 GiB total, 397.422 GiB free.
E: is FIXED (NTFS) - 1397 GiB total, 154.784 GiB free.
F: is FIXED (NTFS) - 119 GiB total, 16.799 GiB free.
G: is NetworkDisk (NTFS) - 35 GiB total, 16.235 GiB free.
J: is FIXED (NTFS) - 1863 GiB total, 605.595 GiB free.
K: is Removable
M: is NetworkDisk (NTFS) - 518 GiB total, 38.241 GiB free.
O: is NetworkDisk (NTFS) - 70 GiB total, 21.586 GiB free.
P: is NetworkDisk (NTFS) - 3659 GiB total, 2175.046 GiB free.
S: is NetworkDisk (NTFS) - 3659 GiB total, 2175.046 GiB free.
T: is Removable
U: is Removable
V: is NetworkDisk (NTFS) - 3659 GiB total, 2175.046 GiB free.
W: is Removable
X: is NetworkDisk (NTFS) - 3659 GiB total, 2175.046 GiB free.
Y: is Removable
Z: is FIXED (NTFS) - 932 GiB total, 363.043 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP193: 5/18/2014 4:19:32 PM - Scheduled Checkpoint
.
==== Installed Programs ======================
.
Acronis*True*Image*Home 2011
Adobe Acrobat X Pro - English, Français, Deutsch
Adobe AIR
Adobe Community Help
Adobe Flash Player 13 ActiveX
Adobe Flash Player 13 Plugin
Adobe Photoshop CS5.1
Adobe Photoshop Lightroom 3.6 64-bit
Adobe Reader XI (11.0.07)
Agent Ransack 2010 (64-bit)
Amazon Kindle
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Art Effects for PDR10
Asmedia ASM104x USB 3.0 Host Controller Driver
ASUS Xonar DG Audio Driver
Belarc Advisor 8.4
Blender
Bonjour
CamStudio OSS Desktop Recorder
CanoScan Toolbox Ver4.9
CCleaner
Contour Shuttle
ConvertHelper 2.2
CopyRite XP For Windows
CyberLink PowerDirector 10
CyberLink PowerDirector 10 Content Pack I
CyberLink PowerDirector 10 Content Pack II
CyberLink WaveEditor
D3DX10
Data Lifeguard Diagnostic for Windows 1.24
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dropbox
DVD Architect Studio 5.0
EditPlus 3
EVGA Precision 2.0.4
F-PROT Antivirus for Windows x64
ffdshow v1.2.4486 [2012-08-25]
File Identifier version 1.0.3
File Viewer version 1.0.1
FileZilla Client 3.7.4.1
Foxtab
GeForce Experience NvStream Client Components
Google Chrome
Google Earth Plug-in
Google Update Helper
GoToMeeting 5.4.0.1082
HandBrake 0.9.9.1
HP BladeSystem Power Sizing Tool
HP Power Advisor
HP Sizing Tool Update Components
HP Virtual Room Client Launcher Plugin
iCloud
IcyScreen 4.14
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Rapid Storage Technology
Intel(R) USB 3.0 eXtensible Host Controller Driver
Intel® Trusted Connect Service Client
iTunes
iWisoft Free Video Converter 1.2
iZotope Audio Enhancer
Java 7 Update 51
Java Auto Updater
Java SE Development Kit 7 Update 13 (64-bit)
MakeMKV v1.8.9
Malwarebytes Anti-Malware version 1.75.0.1300
MediaInfo 0.7.69
Microsoft .NET Framework 4.5.1
Microsoft Application Error Reporting
Microsoft Mathematics Add-in (32-bit)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2007
Microsoft Office Excel MUI (English) 2010
Microsoft Office File Validation Add-In
Microsoft Office Home and Business 2010
Microsoft Office Office 64-bit Components 2007
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2007
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2007
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing (English) 2010
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared 64-bit MUI (English) 2007
Microsoft Office Shared 64-bit MUI (English) 2010
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Single Image 2010
Microsoft Office Word MUI (English) 2007
Microsoft Office Word MUI (English) 2010
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft_VC80_ATL_x86
Microsoft_VC80_ATL_x86_x64
Microsoft_VC80_CRT_x86
Microsoft_VC80_CRT_x86_x64
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFC_x86_x64
Microsoft_VC80_MFCLOC_x86
Microsoft_VC80_MFCLOC_x86_x64
Microsoft_VC90_ATL_x86
Microsoft_VC90_ATL_x86_x64
Microsoft_VC90_CRT_x86
Microsoft_VC90_CRT_x86_x64
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFC_x86_x64
Microsoft_VC90_MFCLOC_x86
Microsoft_VC90_MFCLOC_x86_x64
MKVToolNix 6.9.1 (64bit)
Motorola Device Manager
Motorola Device Software Update
Motorola Mobile Drivers Installation 6.3.0
Movie Maker
Movie Studio Platinum 12.0 (64-bit)
Mozenda
Mozilla Firefox 29.0.1 (x86 en-US)
Mozilla Maintenance Service
Mp3tag v2.53
MSVCRT
MSVCRT Redists
MSVCRT110
MSVCRT110_amd64
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2758694)
Network Recording Player
NVIDIA 3D Vision Controller Driver 335.21
NVIDIA 3D Vision Driver 335.23
NVIDIA Control Panel 335.23
NVIDIA GeForce Experience 1.8.2.1
NVIDIA Graphics Driver 335.23
NVIDIA HD Audio Driver 1.3.30.1
NVIDIA Install Application
NVIDIA LED Visualizer 1.0
NVIDIA Network Service
NVIDIA PhysX
NVIDIA PhysX System Software 9.13.1220
NVIDIA ShadowPlay 11.10.13
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 11.10.13
NVIDIA Update Core
NVIDIA Virtual Audio 1.2.20
OpenAL
PDF Settings CS5
Perfect Photo Suite 7.5
PerformanceTest v8.0
Photo Common
Photo Gallery
Photo Mechanic 4.6
Photo Mechanic 4.6.9
Photodex Presenter
PowerDirector
ProShow Gold
QuickBooks
QuickBooks Pro 2010
QuickTime
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
Renesas Electronics USB 3.0 Host Controller Driver
Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
Security Update for Microsoft .NET Framework 4.5.1 (KB2931368)
Security Update for Microsoft Excel 2010 (KB2826033) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596754) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596825) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597973) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760411) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760415) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760585) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2760591) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2817330) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2817641) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2827326) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2850022) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2878236) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2880507) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2880508) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2553284) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2810073) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2826023) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2826035) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2850016) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2878284) 32-Bit Edition
Security Update for Microsoft Office 2010 (KB2880971) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2827324) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2687440) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2817565) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2878237) 32-Bit Edition
Security Update for Microsoft Word 2010 (KB2863926) 32-Bit Edition
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition
SHIELD Streaming
ShredXP
SmartSound Quicktracks 5
SnagIt 9
Sound Forge Audio Studio 10.0
SPSS 14.0 for Windows
Spybot - Search & Destroy
StrongVPN Client version 1.2
Synology Assistant (remove only)
TreeSize Personal V6.0.2
TurboTax 2012
TurboTax 2012 WinPerFedFormset
TurboTax 2012 WinPerReleaseEngine
TurboTax 2012 WinPerTaxSupport
TurboTax 2012 wmiiper
TurboTax 2012 wrapper
TurboTax 2012 wvaiper
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2880505) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition
VC80CRTRedist - 8.0.50727.6195
Virtual Account Numbers
VLC media player 2.1.3
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Photo Common
Windows Live PIMT Platform
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
WinZip 16.5
.
==== Event Viewer Messages From Past Week ========
.
5/23/2014 1:02:53 AM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
5/22/2014 12:46:49 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
5/22/2014 12:46:49 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
5/22/2014 12:46:49 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
5/22/2014 12:46:27 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
5/22/2014 12:46:27 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
5/22/2014 12:46:27 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
5/22/2014 12:46:27 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
5/22/2014 12:46:26 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
5/22/2014 12:46:20 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
5/22/2014 12:45:13 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC discache FPAV_RTP NetBIOS NetBT nsiproxy Psched rdbss spldr tdx Wanarpv6 WfpLwf
5/22/2014 12:45:13 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service TermService with arguments " " in order to run the server: {F9A874B6-F8A8-4D73-B5A8-AB610816828B}
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The PST Service service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service driver. service which failed to start because of the following error: A device attached to the system is not functioning.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The Netlogon service depends on the Workstation service which failed to start because of the following error: The dependency service or group failed to start.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
5/22/2014 12:45:12 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
5/22/2014 11:44:32 PM, Error: NETLOGON [5719] - This computer was not able to set up a secure session with a domain controller in domain TECHWISELAN due to the following: There are currently no logon servers available to service the logon request. This may lead to authentication problems. Make sure that this computer is connected to the network. If the problem persists, please contact your domain administrator. ADDITIONAL INFO If this computer is a domain controller for the specified domain, it sets up the secure session to the primary domain controller emulator in the specified domain. Otherwise, this computer sets up the secure session to any domain controller in the specified domain.
5/22/2014 11:31:36 AM, Error: Microsoft-Windows-GroupPolicy [1129] - The processing of Group Policy failed because of lack of network connectivity to a domain controller. This may be a transient condition. A success message would be generated once the machine gets connected to the domain controller and Group Policy has succesfully processed. If you do not see a success message for several hours, then contact your administrator.
5/22/2014 1:24:35 PM, Error: Microsoft-Windows-GroupPolicy [1055] - The processing of Group Policy failed. Windows could not resolve the computer name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).
5/16/2014 8:03:48 AM, Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
.
==== End Of File ===========================

 

RogueKiller Report #1

Hi Broni,
Hope you are doing well. I'm thrilled you are helping me again. Here are the logs from RogueKiller:

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : chip [Admin rights]
Mode : Scan [Aborted] -- Date : 05/23/2014 21:45:10
| ARK || FAK || MBR |

¤¤¤ Bad processes : 2 ¤¤¤
[SUSP PATH] Mozenda.ClientConnector.exe -- C:\Users\chip\AppData\Roaming\Mozenda\Programs\Mozenda.ClientConnector.exe [-] -> KILLED [TermProc]
[SUSP PATH] nexdef.exe -- C:\Users\chip\AppData\Local\Autobahn\nexdef.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

Finished : << RKreport[0]_S_05232014_214510.txt >>

 

RogueKiller Log 2

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : chip [Admin rights]
Mode : Remove [Aborted] -- Date : 05/23/2014 21:46:04
| ARK || FAK || MBR |

¤¤¤ Bad processes : 2 ¤¤¤
[SUSP PATH] Mozenda.ClientConnector.exe -- C:\Users\chip\AppData\Roaming\Mozenda\Programs\Mozenda.ClientConnector.exe [-] -> KILLED [TermProc]
[SUSP PATH] nexdef.exe -- C:\Users\chip\AppData\Local\Autobahn\nexdef.exe [-] -> KILLED [TermProc]

¤¤¤ Registry Entries : 0 ¤¤¤

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts




¤¤¤ MBR Check: ¤¤¤

Finished : << RKreport[0]_D_05232014_214604.txt >>
RKreport[0]_S_05232014_214510.txt

 

MBAR System-log.txt

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 10.0.9200.16899

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED, E:\ DRIVE_FIXED, F:\ DRIVE_FIXED, J:\ DRIVE_FIXED, Z:\ DRIVE_FIXED
CPU speed: 3.510000 GHz
Memory total: 17133289472, free: 13271052288

Downloaded database version: v2014.05.24.01
Downloaded database version: v2014.05.21.01
=======================================
Initializing...
------------ Kernel report ------------
05/23/2014 22:01:27
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\system32\DRIVERS\iusb3hcs.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\system32\DRIVERS\mv91cons.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\DRIVERS\iaStor.sys
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\drivers\msahci.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\timntr.sys
\SystemRoot\system32\drivers\vmstorfl.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\system32\DRIVERS\tdrpm273.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\system32\DRIVERS\snapman.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\FPAV_RTP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\serial.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\system32\drivers\csc.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\iusb3xhc.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\HECIx64.sys
\SystemRoot\system32\drivers\usbehci.sys
\SystemRoot\system32\drivers\USBPORT.SYS
\SystemRoot\system32\DRIVERS\nusb3xhc.sys
\SystemRoot\system32\DRIVERS\Rt64win7.sys
\SystemRoot\system32\drivers\cmudaxp.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ks.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\1394ohci.sys
\SystemRoot\system32\DRIVERS\asmtxhci.sys
\SystemRoot\system32\DRIVERS\serenum.sys
\SystemRoot\system32\DRIVERS\GEARAspiWDM.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\tapstrong.sys
\SystemRoot\system32\DRIVERS\rdpbus.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\busenum.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\drivers\nvvad64v.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\nvhda64v.sys
\SystemRoot\system32\DRIVERS\iusb3hub.sys
\SystemRoot\system32\drivers\RTKVHD64.sys
\SystemRoot\system32\DRIVERS\nusb3hub.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\USBSTOR.SYS
\SystemRoot\system32\DRIVERS\asmthub3.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\ATMFD.DLL
\SystemRoot\system32\drivers\luafv.sys
\??\C:\Windows\system32\drivers\mbam.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\afcdp.sys
\SystemRoot\System32\drivers\rdpdr.sys
\SystemRoot\system32\drivers\tdtcp.sys
\SystemRoot\System32\DRIVERS\tssecsrv.sys
\SystemRoot\System32\Drivers\RDPWD.SYS
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\DRIVERS\WUDFRd.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\system32\drivers\spsys.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
\Windows\System32\autochk.exe
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk10\DR10
Upper Device Object: 0xfffffa8010de5060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000009e\
Lower Device Object: 0xfffffa80106d3350
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk9\DR9
Upper Device Object: 0xfffffa8010dde060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000009d\
Lower Device Object: 0xfffffa80106d2350
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk8\DR8
Upper Device Object: 0xfffffa8010ddd060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000009c\
Lower Device Object: 0xfffffa80106d0350
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk7\DR7
Upper Device Object: 0xfffffa8010de0060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000009b\
Lower Device Object: 0xfffffa80106cd350
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk6\DR6
Upper Device Object: 0xfffffa8010ddf060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\0000009a\
Lower Device Object: 0xfffffa80106c6350
Lower Device Driver Name: \Driver\USBSTOR\
<<<1>>>
Upper Device Name: \Device\Harddisk5\DR5
Upper Device Object: 0xfffffa800f3b5060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IdeDeviceP2T0L0-4\
Lower Device Object: 0xfffffa800ce2f060
Lower Device Driver Name: \Driver\atapi\
<<<1>>>
Upper Device Name: \Device\Harddisk4\DR4
Upper Device Object: 0xfffffa800f3b4060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-5\
Lower Device Object: 0xfffffa800ce2a050
Lower Device Driver Name: \Driver\iaStor\
<<<1>>>
Upper Device Name: \Device\Harddisk3\DR3
Upper Device Object: 0xfffffa800f3b3060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-4\
Lower Device Object: 0xfffffa800ce26050
Lower Device Driver Name: \Driver\iaStor\
<<<1>>>
Upper Device Name: \Device\Harddisk2\DR2
Upper Device Object: 0xfffffa800f3b2060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-3\
Lower Device Object: 0xfffffa800ce22050
Lower Device Driver Name: \Driver\iaStor\
<<<1>>>
Upper Device Name: \Device\Harddisk1\DR1
Upper Device Object: 0xfffffa800f3ae060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-2\
Lower Device Object: 0xfffffa800ce1e050
Lower Device Driver Name: \Driver\iaStor\
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa800f383790
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa800ce1a050
Lower Device Driver Name: \Driver\iaStor\
<<<2>>>
Physical Sector Size: 512
Drive: 1, DevicePointer: 0xfffffa800f3ae060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800f2aa890, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f2a3940, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa800f2a7b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800f3aecf0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f3ae060, DeviceName: \Device\Harddisk1\DR1\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800ce1bb50, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800ce1e050, DeviceName: \Device\Ide\IAAStorageDevice-2\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\snapman\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800f383790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800f2a0e30, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f29c900, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa800f29cb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800f383110, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f383790, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800ce11480, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800ce1a050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\snapman\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 1BDF6405

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 204800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 206848 Numsec = 2930065408

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1500301910016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-2930257168-2930277168)...
Done!
Drive 1
Scanning MBR on drive 1...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 1BDF647D

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 250064896

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 128035676160 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 2, DevicePointer: 0xfffffa800f3b2060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800f2b2940, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f2b1980, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa800f2b1b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800f3b2ba0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f3b2060, DeviceName: \Device\Harddisk2\DR2\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800ce1b950, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800ce22050, DeviceName: \Device\Ide\IAAStorageDevice-3\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\snapman\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 2
Scanning MBR on drive 2...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 7F5E05B

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 3907024896

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 2000398934016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 3, DevicePointer: 0xfffffa800f3b3060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800f2bb980, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f2b78d0, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa800f2bbb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800f2b7ae0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f3b3060, DeviceName: \Device\Harddisk3\DR3\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800ce1b750, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800ce26050, DeviceName: \Device\Ide\IAAStorageDevice-4\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\snapman\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 3
Scanning MBR on drive 3...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 14FCB05B

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 63 Numsec = 1953520002

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 4, DevicePointer: 0xfffffa800f3b4060, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800f2c9e30, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f2c5980, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa800f2c5b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800f3b49c0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f3b4060, DeviceName: \Device\Harddisk4\DR4\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800ce1b550, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa800ce2a050, DeviceName: \Device\Ide\IAAStorageDevice-5\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\snapman\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 4
Scanning MBR on drive 4...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: DDE3615

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 2930268160

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1500301910016 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 512
Drive: 5, DevicePointer: 0xfffffa800f3b5060, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800f2d09c0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f2ce940, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa800f2cfb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800f2c9ae0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa800f3b5060, DeviceName: \Device\Harddisk5\DR5\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa800ce2f060, DeviceName: \Device\Ide\IdeDeviceP2T0L0-4\, DriverName: \Driver\atapi\
------------ End ----------
Alternate DeviceName: Unknown, DriverName: \Driver\snapman\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
Drive 5
Scanning MBR on drive 5...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: EFFFC1E8

Partition information:

Partition 0 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 250064896

Partition 1 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 128035676160 bytes
Sector size: 512 bytes

Done!
Physical Sector Size: 0
Drive: 6, DevicePointer: 0xfffffa8010ddf060, DeviceName: \Device\Harddisk6\DR6\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8010684ae0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa80109e6300, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa800f588980, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa80109e6620, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa8010ddf060, DeviceName: \Device\Harddisk6\DR6\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80106c6350, DeviceName: \Device\0000009a\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 7, DevicePointer: 0xfffffa8010de0060, DeviceName: \Device\Harddisk7\DR7\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800f5e88c0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa8010bc0860, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa8010bc0a70, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800f5e8ad0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa8010de0060, DeviceName: \Device\Harddisk7\DR7\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80106cd350, DeviceName: \Device\0000009b\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 8, DevicePointer: 0xfffffa8010ddd060, DeviceName: \Device\Harddisk8\DR8\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800c759620, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa80106bc560, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa80106bc770, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8010ddfa20, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa8010ddd060, DeviceName: \Device\Harddisk8\DR8\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80106d0350, DeviceName: \Device\0000009c\, DriverName: \Driver\USBSTOR\
------------ End ----------
Physical Sector Size: 0
Drive: 9, DevicePointer: 0xfffffa8010dde060, DeviceName: \Device\Harddisk9\DR9\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa80108218a0, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa8010696980, DeviceName: Unknown, DriverName: \Driver\snapman\
DevicePointer: 0xfffffa8010696b90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8010ddee30, DeviceName: Unknown, DriverName: \Driver\tdrpman273\
DevicePointer: 0xfffffa8010dde060, DeviceName: \Device\Harddisk9\DR9\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa80106d2350, DeviceName: \Device\0000009d\, DriverName: \Driver\USBSTOR\
------------ End ----------
Scan finished
=======================================


Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-1-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-2-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-3-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-3-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-4-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-4-r.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-5-i.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-5-r.mbam...
Removal finished

 

mbar-log-2014-05-23 (22-01-30)

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.05.24.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16899
chip :: CHIPPC3 [administrator]

5/23/2014 10:01:30 PM
mbar-log-2014-05-23 (22-01-30).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 338731
Time elapsed: 7 minute(s), 27 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

 

Will h

Hi Broni,

I wanted to send you a quick thank you for the help and let you know I will follow these instructions very carefully. I should have the reports up pretty soon.

 

Windows Firewall Domain Network Won't Turn off

Hi Broni,

I am in the process of disabling all AV software getting ready to run ComboFix. I went to disable WIndows Firewall but one of the three options was grayed out. Here is a screen shot of what I did.

Is it OK to leave "Domain network Locations Settings" on with ComboFix? If not, how do I disable it?

 

Sorry I must have misunderstood the instructions. I just turned it back on. The only site I was connected to was WindowsBBS. I also have a Juniper Networks hardware firewall protecting my network.

I will run ComboFix now and post the report shortly.

 

ComboFix Log

Hi Broni,
I was away from the computer when ComboFix finished. This is the only log I saw displayed:

ComboFix 14-05-19.01 - chip 05/24/2014 13:12:00.1.8 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.16340.13738 [GMT -7:00]
Running from: c:\users\chip\Desktop\ComboFix.exe
AV: F-PROT Antivirus for Windows *Disabled/Updated* {31B7FFC6-2716-5A4E-528D-32786E690ED2}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
ADS - Windows: deleted 192 bytes in 1 streams.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\chip\Documents\~WRL3986.tmp
.
.
((((((((((((((((((((((((( Files Created from 2014-04-24 to 2014-05-24 )))))))))))))))))))))))))))))))
.
.
2014-05-24 05:01 . 2014-05-24 05:15 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-05-24 05:01 . 2014-05-24 05:01 119000 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-24 04:58 . 2014-05-24 05:00 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-05-24 04:57 . 2014-05-24 04:58 -------- d-----w- c:\users\chip\MB Anti-Rootkit
2014-05-23 08:08 . 2014-05-23 09:19 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2014-05-23 08:08 . 2014-05-23 08:20 -------- d-----w- c:\program files (x86)\Spybot - Search & Destroy
2014-05-14 14:13 . 2014-03-25 02:43 14175744 ----a-w- c:\windows\system32\shell32.dll
2014-05-14 14:13 . 2014-05-06 05:14 97280 ----a-w- c:\windows\system32\mshtmled.dll
2014-05-14 14:13 . 2014-05-06 05:14 19274752 ----a-w- c:\windows\system32\mshtml.dll
2014-05-14 14:13 . 2014-05-06 03:37 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2014-05-14 14:13 . 2014-05-06 03:26 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb
2014-05-11 21:08 . 2014-05-11 21:08 -------- d-----w- c:\program files (x86)\MathMagic Personal Edition
2014-05-09 18:36 . 2014-05-09 18:36 -------- d-----w- c:\program files (x86)\Belarc
2014-05-08 03:25 . 2014-05-10 00:01 -------- d-----w- c:\users\chip\AppData\Roaming\Mozenda
2014-05-04 19:02 . 2014-05-04 19:07 -------- d-----w- c:\programdata\HitmanPro
2014-05-04 15:39 . 2010-08-30 15:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll
2014-05-04 15:38 . 2014-05-04 19:00 -------- d-----w- C:\AdwCleaner
2014-05-02 22:50 . 2014-05-02 22:50 -------- d-----w- c:\users\chip\AppData\Roaming\DropboxMaster
2014-05-01 16:04 . 2014-05-21 06:52 -------- d-----w- C:\Grad Poster Board
2014-05-01 02:46 . 2014-05-01 02:46 -------- d-----w- c:\program files\MediaInfo
2014-04-30 23:19 . 2014-04-30 23:19 -------- d-----w- c:\users\chip\AppData\Roaming\mkvtoolnix
2014-04-30 23:18 . 2014-04-30 23:18 -------- d-----w- c:\program files\MKVToolNix
2014-04-27 00:31 . 2014-04-27 00:31 -------- d-----w- C:\2014-02-14 Basketball
2014-04-25 17:41 . 2014-04-17 12:31 10651704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{E935DE76-E8EB-473F-B69F-17219FEEB33B}\mpengine.dll
2014-04-25 14:55 . 2014-04-25 14:55 -------- d-s---w- c:\windows\system32\CompatTel
2014-04-25 07:09 . 2014-01-28 02:32 228864 ----a-w- c:\windows\system32\wwansvc.dll
2014-04-25 07:07 . 2014-01-24 02:37 1684928 ----a-w- c:\windows\system32\drivers\ntfs.sys
2014-04-25 07:06 . 2014-02-04 02:32 1424384 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-04-25 07:06 . 2014-02-04 02:04 1230336 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-05-14 07:57 . 2012-07-21 18:41 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-14 07:57 . 2012-07-21 18:41 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-04-01 05:46 . 2014-04-01 05:46 130712 ----a-w- c:\windows\SysWow64\MSSTDFMT.DLL
2014-04-01 05:46 . 2014-04-01 05:46 1070232 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX
2014-03-31 16:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-31 10:51 . 2012-07-15 08:47 90655440 ----a-w- c:\windows\system32\MRT.exe
2014-03-04 14:35 . 2014-04-18 15:55 9728064 ----a-w- c:\windows\SysWow64\nvcuda.dll
2014-03-04 14:35 . 2014-04-18 15:55 9690424 ----a-w- c:\windows\SysWow64\nvopencl.dll
2014-03-04 14:35 . 2014-04-18 15:55 892704 ----a-w- c:\windows\system32\NvIFR64.dll
2014-03-04 14:35 . 2014-04-18 15:55 877856 ----a-w- c:\windows\system32\NvFBC64.dll
2014-03-04 14:35 . 2014-04-18 15:55 863064 ----a-w- c:\windows\SysWow64\NvIFR.dll
2014-03-04 14:35 . 2014-04-18 15:55 846168 ----a-w- c:\windows\SysWow64\NvFBC.dll
2014-03-04 14:35 . 2014-04-18 15:55 832936 ----a-w- c:\windows\SysWow64\nvumdshim.dll
2014-03-04 14:35 . 2014-04-18 15:55 353504 ----a-w- c:\windows\system32\nvoglshim64.dll
2014-03-04 14:35 . 2014-04-18 15:55 31474976 ----a-w- c:\windows\system32\nvoglv64.dll
2014-03-04 14:35 . 2014-04-18 15:55 3143456 ----a-w- c:\windows\system32\nvcuvid.dll
2014-03-04 14:35 . 2014-04-18 15:55 305600 ----a-w- c:\windows\SysWow64\nvoglshim32.dll
2014-03-04 14:35 . 2014-04-18 15:55 2958792 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2014-03-04 14:35 . 2014-04-18 15:55 2783008 ----a-w- c:\windows\system32\nvcuvenc.dll
2014-03-04 14:35 . 2014-04-18 15:55 2715264 ----a-w- c:\windows\SysWow64\nvapi.dll
2014-03-04 14:35 . 2014-04-18 15:55 25255256 ----a-w- c:\windows\system32\nvcompiler.dll
2014-03-04 14:35 . 2014-04-18 15:55 2411976 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2014-03-04 14:35 . 2014-04-18 15:55 23716640 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2014-03-04 14:35 . 2014-04-18 15:55 1885472 ----a-w- c:\windows\system32\nvdispco6433523.dll
2014-03-04 14:35 . 2014-04-18 15:55 17755424 ----a-w- c:\windows\system32\nvd3dumx.dll
2014-03-04 14:35 . 2014-04-18 15:55 17561544 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2014-03-04 14:35 . 2014-04-18 15:55 174296 ----a-w- c:\windows\system32\nvinitx.dll
2014-03-04 14:35 . 2014-04-18 15:55 15783992 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2014-03-04 14:35 . 2014-04-18 15:55 1516488 ----a-w- c:\windows\system32\nvdispgenco6433523.dll
2014-03-04 14:35 . 2014-04-18 15:55 148016 ----a-w- c:\windows\SysWow64\nvinit.dll
2014-03-04 14:35 . 2014-04-18 15:55 12708128 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2014-03-04 14:35 . 2014-04-18 15:55 11636176 ----a-w- c:\windows\system32\nvcuda.dll
2014-03-04 14:35 . 2014-04-18 15:55 11589272 ----a-w- c:\windows\system32\nvopencl.dll
2014-03-04 14:35 . 2013-02-26 07:32 14709720 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2014-03-04 14:35 . 2013-02-26 07:32 18302384 ----a-w- c:\windows\system32\nvwgf2umx.dll
2014-03-04 14:35 . 2012-09-20 18:03 947808 ----a-w- c:\windows\system32\nvumdshimx.dll
2014-03-04 14:35 . 2012-07-15 07:53 3093280 ----a-w- c:\windows\system32\nvapi64.dll
2014-03-04 13:06 . 2012-07-15 07:55 6714312 ----a-w- c:\windows\system32\nvcpl.dll
2014-03-04 13:06 . 2012-07-15 07:55 3497816 ----a-w- c:\windows\system32\nvsvc64.dll
2014-03-04 13:05 . 2012-07-15 07:55 922968 ----a-w- c:\windows\system32\nvvsvc.exe
2014-03-04 13:05 . 2012-07-15 07:55 64968 ----a-w- c:\windows\system32\nvshext.dll
2014-03-04 13:05 . 2012-07-15 07:55 386336 ----a-w- c:\windows\system32\nvmctray.dll
2014-03-04 13:05 . 2012-09-20 18:03 3649185 ----a-w- c:\windows\system32\nvcoproc.bin
2014-03-04 11:32 . 2014-04-18 15:56 599840 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2014-03-04 09:44 . 2014-04-09 22:48 362496 ----a-w- c:\windows\system32\wow64win.dll
2014-03-04 09:44 . 2014-04-09 22:48 243712 ----a-w- c:\windows\system32\wow64.dll
2014-03-04 09:44 . 2014-04-09 22:48 13312 ----a-w- c:\windows\system32\wow64cpu.dll
2014-03-04 09:44 . 2014-04-09 22:48 16384 ----a-w- c:\windows\system32\ntvdm64.dll
2014-03-04 09:44 . 2014-04-09 22:48 1163264 ----a-w- c:\windows\system32\kernel32.dll
2014-03-04 09:17 . 2014-04-09 22:48 14336 ----a-w- c:\windows\SysWow64\ntvdm64.dll
2014-03-04 09:17 . 2014-04-09 22:48 44032 ----a-w- c:\windows\apppatch\acwow64.dll
2014-03-04 09:16 . 2014-04-09 22:48 25600 ----a-w- c:\windows\SysWow64\setup16.exe
2014-03-04 09:16 . 2014-04-09 22:48 5120 ----a-w- c:\windows\SysWow64\wow32.dll
2014-03-04 08:09 . 2014-04-09 22:48 7680 ----a-w- c:\windows\SysWow64\instnm.exe
2014-03-04 08:09 . 2014-04-09 22:48 2048 ----a-w- c:\windows\SysWow64\user.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\chip\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\chip\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\users\chip\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GoToMeeting "= "c:\program files (x86)\Citrix\GoToMeeting\1082\g2mstart.exe" [2013-01-31 40376]
"ApplePhotoStreams "= "c:\program files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe" [2013-11-20 59720]
"StrongVPN Client "= "c:\windows\SysWOW64\StrongDial.exe" [2013-12-26 1581552]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IAStorIcon "= "c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-30 284440]
"USB3MON "= "c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-26 291608]
"RUSB3MON "= "c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\rusb3mon.exe" [2011-09-20 115048]
"NUSB3MON "= "c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-09-16 115048]
"F-PROT Antivirus Tray application "= "c:\program files (x86)\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2010-11-03 1674016]
"SAOB Monitor "= "c:\program files (x86)\Acronis\TrueImageHome\OnlineBackupStandalone\TrueImageMonitor.exe" [2011-09-22 2536760]
"TrueImageMonitor.exe "= "c:\program files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe" [2011-09-23 5550984]
"SwitchBoard "= "c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"AdobeCS5.5ServiceManager "= "c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360]
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"Adobe Acrobat Speed Launcher "= "c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2014-05-08 41336]
"Acrobat Assistant 8.0 "= "c:\program files (x86)\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2014-05-08 840568]
"APSDaemon "= "c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-04-22 59720]
"Intuit SyncManager "= "c:\program files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2012-12-07 2771832]
"Contour Shuttle Device Helper "= "c:\program files (x86)\Contour Shuttle\ShuttleHelper.exe" [2011-02-14 118784]
"Virtual Account Numbers "= "c:\progra~2\VIRTUA~1\CitiVAN.exe" [2013-10-09 435712]
"QuickTime Task "= "c:\program files (x86)\QuickTime\QTTask.exe" [2013-05-01 421888]
"iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-11-02 152392]
.
c:\users\Chip2012\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
c:\users\chip\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\chip\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-5-7 32668056]
Mozenda.lnk - c:\users\chip\AppData\Roaming\Mozenda\Programs\Mozenda.ClientConnector.exe /Client [2014-5-9 552960]
NexDef Plug-in.lnk - c:\users\chip\AppData\Local\Autobahn\nexdef.exe [2011-8-11 15490560]
OneNote 2010 Screen Clipper and Launcher.lnk - c:\program files (x86)\Microsoft Office\Office14\ONENOTEM.EXE /tsr [2013-6-25 228552]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
QuickBooks Update Agent.lnk - c:\program files (x86)\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2013-2-1 1155912]
SnagIt 9.lnk - c:\program files (x86)\TechSmith\SnagIt 9\SnagIt32.exe [2008-9-16 6825288]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
"EnableLinkedConnections "= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen "= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs "=1 (0x1)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]
@= "Service "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37]
@=" "
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\hitmanpro37.sys]
@=" "
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
R3 DIRECTIO;DIRECTIO;c:\program files\PerformanceTest\DirectIo64.sys;c:\program files\PerformanceTest\DirectIo64.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 motandroidusb;Mot ADB Interface Driver;c:\windows\system32\Drivers\motoandroid.sys;c:\windows\SYSNATIVE\Drivers\motoandroid.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys;c:\windows\SYSNATIVE\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
R4 FPAVServer;F-PROT Antivirus for Windows system;c:\program files (x86)\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe;c:\program files (x86)\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [x]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
S0 mv91cons;Marvell 91xx Config Device Driver;c:\windows\system32\DRIVERS\mv91cons.sys;c:\windows\SYSNATIVE\DRIVERS\mv91cons.sys [x]
S0 tdrpman273;Acronis Try&Decide and Restore Points filter (build 273);c:\windows\system32\DRIVERS\tdrpm273.sys;c:\windows\SYSNATIVE\DRIVERS\tdrpm273.sys [x]
S1 FPAV_RTP;FPAV_RTP;c:\windows\system32\DRIVERS\FPAV_RTP.sys;c:\windows\SYSNATIVE\DRIVERS\FPAV_RTP.sys [x]
S2 afcdpsrv;Acronis Nonstop Backup Service;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe;c:\program files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
S2 IntuitUpdateServiceV4;Intuit Update Service v4;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe;c:\program files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [x]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
S2 Motorola Device Manager;Motorola Device Manager Service;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe;c:\program files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [x]
S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\nlssrv32.exe;c:\windows\SysWOW64\nlssrv32.exe [x]
S2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
S2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
S2 PST Service;PST Service;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe;c:\program files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [x]
S2 RichVideo64;Cyberlink RichVideo64 Service(CRVS);c:\program files\CyberLink\Shared files\RichVideo64.exe;c:\program files\CyberLink\Shared files\RichVideo64.exe [x]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 StrongVPN Service;StrongVPN Service;c:\program files (x86)\StrongVPN\StrongService.exe;c:\program files (x86)\StrongVPN\StrongService.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 UsbClientService;UsbClientService;c:\program files (x86)\Synology\Assistant\UsbClientService.exe;c:\program files (x86)\Synology\Assistant\UsbClientService.exe [x]
S3 afcdp;afcdp;c:\windows\system32\DRIVERS\afcdp.sys;c:\windows\SYSNATIVE\DRIVERS\afcdp.sys [x]
S3 asmthub3;ASMedia USB3 Hub Service;c:\windows\system32\DRIVERS\asmthub3.sys;c:\windows\SYSNATIVE\DRIVERS\asmthub3.sys [x]
S3 asmtxhci;ASMEDIA XHCI Service;c:\windows\system32\DRIVERS\asmtxhci.sys;c:\windows\SYSNATIVE\DRIVERS\asmtxhci.sys [x]
S3 busenum;Synology Virtual USB Hub;c:\windows\system32\DRIVERS\busenum.sys;c:\windows\SYSNATIVE\DRIVERS\busenum.sys [x]
S3 cmudaxp;ASUS Xonar DG Audio Interface;c:\windows\system32\drivers\cmudaxp.sys;c:\windows\SYSNATIVE\drivers\cmudaxp.sys [x]
S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 tapstrong;StrongVPN Adapter;c:\windows\system32\DRIVERS\tapstrong.sys;c:\windows\SYSNATIVE\DRIVERS\tapstrong.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-05-24 16:47 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-05-24 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-21 07:57]
.
2014-05-24 c:\windows\Tasks\F-PROT Antivirus - Chips Desktop.job
- c:\program files (x86)\FRISK Software\F-PROT Antivirus for Windows\FPWin.exe [2010-11-03 23:40]
.
2014-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-16 07:54]
.
2014-05-24 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-10-16 07:54]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@= "{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\chip\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@= "{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\chip\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@= "{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\chip\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@= "{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 164016 ----a-w- c:\users\chip\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL "= "c:\program files\Realtek\Audio\HDA\RtkNGUI64.exe" [2011-12-12 7560296]
"Acronis Scheduler2 Service "= "c:\program files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe" [2011-02-02 390720]
"AdobeAAMUpdater-1.0 "= "c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2012-09-20 444904]
"Logitech Download Assistant "= "c:\windows\System32\LogiLDA.dll" [2012-09-20 1832760]
"Cmaudio8788 "= "c:\windows\Syswow64\cmicnfgp.dll" [2011-05-12 8769536]
"Cmaudio8788GX "= "c:\windows\syswow64\HsMgr.exe" [2008-07-11 200704]
"Cmaudio8788GX64 "= "c:\windows\system\HsMgr64.exe" [2008-07-11 282112]
"NvBackend "= "c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-02-05 2234144]
"ShadowPlay "= "c:\windows\system32\nvspcap64.dll" [2014-02-05 1179576]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;192.168.*.*
TCP: Interfaces\{BBC69382-9665-4723-B32B-C162BF7489FF}: NameServer = 192.168.1.33,209.18.47.61
FF - ProfilePath - c:\users\chip\AppData\Roaming\Mozilla\Firefox\Profiles\47ny3ey0.default-1399158311152\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/|http://www.drudgereport.com/|http:/...GN,AMP,AXP,CSCO,HPQ,ORCL,QCOM,SLV,GLD/view/v1
.
- - - - ORPHANS REMOVED - - - -
.
Wow6432Node-HKCU-Run-AdobeBridge - (no file)
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
Wow6432Node-HKLM-Run-DivXMediaServer - c:\program files (x86)\DivX\DivX Media Server\DivXMediaServer.exe
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
.
.
"ImagePath "= "\ "c:\program files\CyberLink\Shared files\RichVideo64.exe\ "\00Z
[\]^_‘\00\00‘\00\00\00\00HIJKLMNO\00\00\00\00\00\00\00\00\03\00\00\00|}~‘\00\00‘\00\00\00\00‘\00\00\00\00\00\00\00\00‘’“ "
.
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_13_0_0_214_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "FlashBroker "
"LocalizedString "= "@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe,-101 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled "=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_13_0_0_214_ActiveX.exe "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Shockwave Flash Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@= "0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@= "ShockwaveFlash.ShockwaveFlash.13 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "ShockwaveFlash.ShockwaveFlash "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@= "Macromedia Flash Factory Object "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx "
"ThreadingModel "= "Apartment "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@= "FlashFactory.FlashFactory.1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@= "c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_13_0_0_214.ocx, 1 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@= "{D27CDB6B-AE6D-11cf-96B8-444553540000} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@= "FlashFactory.FlashFactory "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@= "IFlashBroker5 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@= "{00020424-0000-0000-C000-000000000046} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
"Version "= "1.0 "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution "= "{15727DE6-F92D-4E46-ACB4-0E2C58B31A18} "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key "= "ActionsPane3 "
"Location "= "c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd "
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Nico Mak Computing\WinZip]
"SymbolicLinkValue "=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2014-05-24 13:17:21
ComboFix-quarantined-files.txt 2014-05-24 20:17
.
Pre-Run: 11,304,919,040 bytes free
Post-Run: 11,227,123,712 bytes free
.
- - End Of File - - AE5C864E32974FDDDB1203F87AF67508