Solved Multiple Windows Loading Among Other Oddities

malady · 2014/06/09

[Solved] Multiple Windows Loading Among Other Oddities

6-9-14

Laptop acting strange indicated possible infection

Possible Virus/Malware symptoms:

1. 100-150 copies of programs/browser windows "pop up" and try loading in rapid succession. This has occurred twice in the past 2 days with a text doc, CCleaner and Firefox. Only way to get out of the cycle is to log off user or power down.
2. Pop up usually after boot of unknown program trying to load. Screenshot
3. Office 2002 (Word) will not load a document through shortcuts but only through program. Screenshot
4. This reg key reloads after boot although it has been deleted by CCleaner
and manually through the registry. It appears to be associated with Malwarebytes Professional because uninstalling it gets rid of key .
HKEY_CURRENT_USER\Software\Trolltech
5. Trend Micro Titanium uninstalled months ago but could not get rid of Trend Safe Boot which comes up as a selection at every boot.

Scans Run in last 48 hours. All showing clean.
1. Full ESET online
2. MalwareBytes Full Scan
3. Avast Free AV Full Scan

DDS Log below. Can attach the attach log upon request.Thanks.
------------------------------

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17041 BrowserJavaVersion: 10.55.2
Run by MY at 23:57:05 on 2014-06-09
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.5422 [GMT -4:00]
.
AV: avast! Antivirus *Disabled/Outdated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Disabled/Outdated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Program Files (x86)\Browny02\BrYNSvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Goodsync 6-7-14\Gs-Server.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Windows\System32\igfxtray.exe
C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
C:\Users\MY\AppData\Local\FluxSoftware\Flux\flux.exe
C:\Program Files (x86)\Roboform 8-5-13\robotaskbaricon.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe
C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamservice.exe
C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbam.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\PSEXESVC.EXE
C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Easy Defrag Bits Du Jour 2-28-14\Live Defrag\supereasydefragservice.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe
C:\Program Files\Sony\VAIO Care\VCService.exe
C:\Program Files\Sony\VAIO Update\vuagent.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe
C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamscheduler.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files\Sony\VAIO Care\VCPerfService.exe
C:\Program Files\Sony\VAIO Care\listener.exe
C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Sony\VAIO Care\VCAgent.exe
C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
C:\Program Files (x86)\YCIII\YankClip.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://www.google.com/
uSearch Bar = hxxps://www.google.com/
mStart Page = hxxps://www.google.com/
mDefault_Search_URL = hxxps://www.google.com/
uSearchURL,(Default) = hxxps://www.google.com/
mSearchAssistant = hxxps://www.google.com/
mCustomizeSearch = hxxps://www.google.com/
BHO: Protect My Choices (Beta): {3DFCDCA1-AEAC-4302-A690-BFB683568BAA} - C:\Program Files (x86)\DigitalAdvertisingAlliance\Protect My Choices\pmc.dll
BHO: PlusIEEventHelper Class: {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll
BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: &RoboForm Toolbar: {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
uRun: [f.lux] "C:\Users\MY\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
uRun: [GUDelayStartup] "C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe" -delayrun
uRun: [RoboForm] "C:\Program Files (x86)\Roboform 8-5-13\RoboTaskBarIcon.exe "
mRun: [AvastUI.exe] "C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe" /nogui
mRun: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe "
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
StartupFolder: C:\Users\MY\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\YANKEE~1.LNK - C:\Program Files (x86)\YCIII\YankClip.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
mPolicies-System: EnableSecureUIAPath = dword:1
IE: Customize Menu - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office10\EXCEL.EXE/3000
IE: Fill Forms - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html
IE: Password Generator - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComPasswordGenerator.html
IE: RoboForm Editor - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComEditIdent.html
IE: Save Forms - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html
IE: Show RoboForm Toolbar - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{B59C479D-3ED6-4C1B-8B7C-8DA86D5F3707} : DHCPNameServer = 75.75.75.75 75.75.76.76
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - <orphaned>
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - <orphaned>
SSODL: WebCheck - <orphaned>
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\System32\wpdshserviceobj.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll
x64-TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe "
x64-Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
x64-IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - <orphaned>
x64-Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - <orphaned>
x64-Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrlui.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;avast! Revert;C:\Windows\System32\drivers\aswRvrt.sys [2014-2-22 65776]
R0 aswVmm;avast! VM Monitor;C:\Windows\System32\drivers\aswVmm.sys [2014-2-22 208416]
R0 GUBootStartup;GUBootStartup;C:\Windows\System32\drivers\GUBootStartup.sys [2014-5-15 20672]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswsnx.sys [2014-2-22 1039096]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswsp.sys [2014-2-22 423240]
R2 aswHwid;avast! HardwareID;C:\Windows\System32\drivers\aswHwid.sys [2014-4-26 29208]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2014-2-22 79184]
R2 aswStm;aswStm;C:\Windows\System32\drivers\aswstm.sys [2014-2-22 85328]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastSvc.exe [2014-4-1 50344]
R2 BrYNSvc;BrYNSvc;C:\Program Files (x86)\Browny02\BrYNSvc.exe [2014-2-24 266240]
R2 ESRV_SVC;Energy Server Service;C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe [2013-11-1 377768]
R2 GsServer;GoodSync Server;C:\Program Files (x86)\Goodsync 6-7-14\Gs-Server.exe [2014-6-6 8664208]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-12-9 13336]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2014-3-3 2429544]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamscheduler.exe [2014-6-7 1809720]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamservice.exe [2014-6-7 860472]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [2011-8-2 145256]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176]
R2 SampleCollector;Intel(R) System Behavior Tracker Collector Service;C:\Program Files\Sony\VAIO Care\VCPerfService.exe [2013-11-1 266168]
R2 SOHCImp;VAIO Content Importer;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2011-11-3 138392]
R2 SOHDs;VAIO Device Searcher;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2011-11-3 74904]
R2 SpfService;VAIO Entertainment Common Service;C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-9-23 289952]
R2 SSPORT;SSPORT;C:\Windows\System32\drivers\SSPORT.sys [2013-4-10 11576]
R2 SuperEasy Software Defrag Service;SuperEasy Software Defrag Service;C:\Program Files (x86)\Easy Defrag Bits Du Jour 2-28-14\Live Defrag\supereasydefragservice.exe [2014-2-28 1429976]
R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2013-12-9 105024]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-12-9 2656280]
R2 USER_ESRV_SVC;User Energy Server Service;C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe [2013-11-1 377768]
R2 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-10-24 958112]
R2 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-8-26 101600]
R2 VCService;VCService;C:\Program Files\Sony\VAIO Care\VCService.exe [2014-2-20 60504]
R2 VSNService;VSNService;C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [2013-12-9 852160]
R2 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update\VUAgent.exe [2014-5-22 1642544]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\System32\drivers\ArcSoftKsUFilter.sys [2013-12-9 19968]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2014-6-7 452088]
R3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2014-6-7 128200]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\System32\drivers\LEqdUsb.sys [2013-5-23 77592]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\System32\drivers\LHidEqd.sys [2013-5-23 13080]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-6-7 25816]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-6-7 122584]
R3 MBAMWebAccessControl;MBAMWebAccessControl;C:\Windows\System32\drivers\mwac.sys [2014-6-7 63704]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2014-6-7 359128]
R3 semav6thermal64ro;semav6thermal64ro;C:\Windows\System32\drivers\semav6thermal64ro.sys [2012-11-15 13792]
R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2010-6-1 12032]
R3 SmbDrvI;SmbDrvI;C:\Windows\System32\drivers\Smb_driver_Intel.sys [2013-12-31 32496]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-9-8 549408]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-4-22 111616]
S2 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-12-10 1255736]
S3 ampa;ampa;C:\Windows\System32\ampa.sys [2014-3-7 17008]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;C:\Windows\System32\drivers\e1y60x64.sys [2009-6-10 281088]
S3 MDA_NTDRV;MDA_NTDRV;C:\Windows\System32\MDA_NTDRV.sys [2013-2-25 21208]
S3 pwdspio;pwdspio;C:\Windows\System32\pwdspio.sys [2013-12-20 12504]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-12-17 19456]
S3 taphss6;Anchorfree HSS VPN Adapter;C:\Windows\System32\drivers\taphss6.sys [2013-11-13 42184]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-2-21 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-12-17 30208]
S3 UsbFltr;WayTech USB Filter Driver;C:\Windows\System32\drivers\UsbFltr.sys [2007-4-9 12288]
S3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2011-9-8 381488]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
.
=============== Created Last 30 ================
.
2014-06-09 23:38:21 -------- d-----w- C:\Windows\abylon EXIF-CLEANER (Private Version)
2014-06-09 23:36:05 -------- d-----w- C:\Program Files (x86)\Photo Exif Remover 6-9-14
2014-06-09 23:24:46 -------- d-----w- C:\Users\MY\AppData\Local\ElevatedDiagnostics
2014-06-09 20:34:17 -------- d-----w- C:\Windows\System32\CatRoot2
2014-06-09 02:39:10 -------- d-----w- C:\Program Files (x86)\Simple System Tweaker 6-8-14
2014-06-08 17:32:20 -------- d-----w- C:\Program Files (x86)\Tweaking.com
2014-06-08 11:40:49 -------- d-----w- C:\Program Files (x86)\Tweaking.com 6-8-14
2014-06-08 09:56:50 -------- d-----w- C:\Users\MY\AppData\Roaming\YoWindow
2014-06-08 09:56:47 -------- d-----w- C:\ProgramData\YoWindow
2014-06-08 09:55:52 -------- d-----w- C:\Program Files (x86)\YoWindow
2014-06-08 09:47:55 -------- d-----w- C:\Program Files (x86)\Weather Window-Bits Du Jour 6-8-14
2014-06-08 07:55:01 -------- d-----w- C:\Jihosoft Video Converter
2014-06-07 22:50:54 122584 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-06-07 22:50:36 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-06-07 22:50:36 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2014-06-07 22:50:36 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-06-07 22:50:36 -------- d-----w- C:\ProgramData\Malwarebytes
2014-06-07 22:50:36 -------- d-----w- C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14
2014-06-07 22:06:20 128200 ----a-w- C:\Windows\System32\drivers\L1C62x64.sys
2014-06-07 22:06:06 9889352 ----a-w- C:\Windows\SysWow64\RsCRIcon.dll
2014-06-07 22:06:06 359128 ----a-w- C:\Windows\System32\drivers\RtsPStor.sys
2014-06-07 22:05:13 452088 ----a-w- C:\Windows\System32\drivers\IntcDAud.sys
2014-06-07 22:04:59 1795952 ----a-w- C:\Windows\System32\WdfCoInstaller01011.dll
2014-06-07 22:04:59 100312 ----a-w- C:\Windows\System32\drivers\TeeDriverx64.sys
2014-06-07 22:00:11 -------- d-----w- C:\Users\MY\AppData\Roaming\IObit
2014-06-07 22:00:11 -------- d-----w- C:\ProgramData\IObit
2014-06-07 21:53:32 -------- d-----w- C:\Program Files (x86)\Driver Booster Pro Bits Du Jour 6-7-14
2014-06-07 13:00:08 -------- d-----w- C:\Program Files (x86)\SpeedyFox
2014-06-06 23:30:57 -------- d-----w- C:\Users\MY\AppData\Roaming\zubc
2014-06-06 20:26:14 -------- d-----w- C:\ProgramData\GoodSync
2014-06-06 20:26:13 -------- d-----w- C:\Users\MY\AppData\Roaming\GoodSync
2014-06-06 20:20:58 -------- d-----w- C:\Program Files (x86)\Goodsync 6-7-14
2014-06-06 08:45:14 10702536 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{491947FF-9297-40A5-A802-BF82991ED2EF}\mpengine.dll
2014-06-05 13:14:25 118048 ----a-w- C:\Windows\System32\BootDefrag.exe
2014-06-04 02:20:25 -------- d-----w- C:\Program Files (x86)\Sysinternals-Process Explorer 6-3-14
2014-06-02 04:05:44 -------- d-----w- C:\perflogs
2014-05-31 22:10:09 -------- d-----w- C:\Program Files (x86)\DriveImage XML
2014-05-31 21:31:24 -------- d-----w- C:\Windows\SysWow64\directx
2014-05-31 21:16:38 -------- d-----w- C:\Users\MY\AppData\Roaming\iolo
2014-05-31 21:16:38 -------- d-----w- C:\ProgramData\iolo
2014-05-31 20:37:47 -------- d-----w- C:\Program Files (x86)\Video Watermark Maker 5-31-14 Bits Du Jour
2014-05-29 21:55:16 -------- d-----w- C:\Program Files (x86)\Doppelganger Free Trial 5-29-14
2014-05-29 15:46:18 536576 ----a-w- C:\Windows\SysWow64\sqlite3.dll
2014-05-28 20:18:01 -------- d-----w- C:\Users\MY\AppData\Roaming\SpringPublisher
2014-05-28 20:14:23 -------- d-----w- C:\Program Files (x86)\Slim Publisher 5-28-14
2014-05-26 21:57:26 -------- d-----w- C:\Program Files (x86)\Fonts-Free 1000 5-26-14
2014-05-26 05:37:14 -------- d-sh--w- C:\Users\MY\AppData\Roaming\Common
2014-05-26 05:37:08 -------- d-----w- C:\Program Files (x86)\FileSeek
2014-05-26 05:28:44 -------- d-----w- C:\Users\MY\AppData\Roaming\JAM Software
2014-05-26 05:28:40 -------- d-----w- C:\Program Files\UltraSearch
2014-05-26 05:22:12 -------- d-----w- C:\Program Files (x86)\Quick Search
2014-05-22 16:24:31 -------- d-----w- C:\Program Files (x86)\Android Data Recovery 5-22-14
2014-05-21 22:21:37 -------- d-----w- C:\Recovered
2014-05-21 22:17:42 -------- d-----w- C:\Program Files (x86)\Picture Doctor 5-21-14
2014-05-20 13:14:00 -------- d-----w- C:\Program Files (x86)\Smart Diary
2014-05-19 10:13:08 -------- d-----w- C:\Program Files (x86)\Backup SF Basic 5-18-14
2014-05-18 23:45:58 -------- d-----w- C:\Program Files (x86)\Watermark Picture Software 5-18-14
2014-05-15 10:05:14 20672 ----a-w- C:\Windows\System32\drivers\GUBootStartup.sys
2014-05-15 10:05:03 -------- d-----w- C:\Program Files (x86)\Glary Utilities 5
2014-05-14 04:53:01 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-05-14 04:53:01 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2014-05-14 04:53:00 -------- d-----w- C:\Program Files (x86)\HD Video Converter By Fox-Bits 5-14-14
2014-05-14 04:47:11 477184 ----a-w- C:\Windows\System32\aepdu.dll
2014-05-14 04:47:10 424448 ----a-w- C:\Windows\System32\aeinv.dll
2014-05-14 01:11:59 29184 ----a-w- C:\Windows\System32\sspisrv.dll
2014-05-14 01:11:59 28160 ----a-w- C:\Windows\System32\secur32.dll
2014-05-14 01:11:59 22016 ----a-w- C:\Windows\System32\credssp.dll
2014-05-14 01:11:59 17408 ----a-w- C:\Windows\SysWow64\credssp.dll
2014-05-14 01:11:58 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2014-05-14 01:11:58 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2014-05-12 15:13:54 -------- d-----w- C:\Users\MY\AppData\Local\TriSun_Software_Inc
2014-05-12 15:11:07 -------- d-----w- C:\Program Files (x86)\Duplicate File Finder Bits Du Jour 5-12-14
.
==================== Find3M ====================
.
2014-06-08 07:48:43 1024 ----a-w- C:\AMTAG.BIN
2014-05-15 10:07:26 85328 ----a-w- C:\Windows\System32\drivers\aswstm.sys
2014-05-15 10:07:26 1039096 ----a-w- C:\Windows\System32\drivers\aswsnx.sys
2014-05-14 13:33:14 70832 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-14 13:33:14 692400 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-05-14 08:39:30 24352 ----a-w- C:\Windows\System32\RegBootDefrag.exe
2014-04-26 07:16:45 93568 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2014-04-26 07:16:45 79184 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2014-04-26 07:16:45 65776 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
2014-04-26 07:16:45 29208 ----a-w- C:\Windows\System32\drivers\aswHwid.sys
2014-04-26 07:16:45 208416 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
2014-04-26 07:16:43 43152 ----a-w- C:\Windows\avastSS.scr
2014-04-15 00:13:43 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-12 02:22:05 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2014-04-12 02:22:05 155072 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2014-04-12 02:19:38 136192 ----a-w- C:\Windows\System32\sspicli.dll
2014-04-12 02:19:32 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
2014-04-12 02:19:05 31232 ----a-w- C:\Windows\System32\lsass.exe
2014-04-08 09:24:17 13792 ----a-w- C:\Windows\System32\drivers\semav6thermal64ro.sys
2014-04-01 11:55:42 859456 ----a-w- C:\Windows\yowindow.scr
2014-03-31 13:35:08 270496 ------w- C:\Windows\System32\MpSigStub.exe
.
============= FINISH: 23:57:55.55 ===============
-----------------------

PeteC · 2014/06/10

Please read this post in detail and then post ALL the requested logs as noted in Step 3

malady · 2014/06/10

Logs

"PeteC said: ↑

Please read this post in detail and then post ALL the requested logs as noted in Step 3
Click to expand...

Sorry but don't see the option to attach the logs so here they are pasted. Thanks.

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 6/10/2014
Scan Time: 3:52:21 AM
Logfile: MalwareBytesPro Scan 6-10-14.txt
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.06.10.02
Rootkit Database: v2014.06.02.01
License: Premium
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 7 Service Pack 1
CPU: x64
File System: NTFS
User: MY

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 401643
Time Elapsed: 14 min, 12 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)
------------------------
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 11.0.9600.17041 BrowserJavaVersion: 10.55.2
Run by MY at 23:57:05 on 2014-06-09
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.5422 [GMT -4:00]
.
AV: avast! Antivirus *Disabled/Outdated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: avast! Antivirus *Disabled/Outdated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastSvc.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Program Files (x86)\Browny02\BrYNSvc.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\Goodsync 6-7-14\Gs-Server.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Windows\System32\igfxtray.exe
C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe
C:\Users\MY\AppData\Local\FluxSoftware\Flux\flux.exe
C:\Program Files (x86)\Roboform 8-5-13\robotaskbaricon.exe
C:\Windows\SysWOW64\svchost.exe -k hpdevmgmt
C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe
C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamservice.exe
C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbam.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\PSEXESVC.EXE
C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files (x86)\Easy Defrag Bits Du Jour 2-28-14\Live Defrag\supereasydefragservice.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe
C:\Program Files\Sony\VAIO Care\VCService.exe
C:\Program Files\Sony\VAIO Update\vuagent.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Sony\VAIO Update\VAIOUpdt.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Windows\System32\wbem\WmiPrvSE.exe
C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe
C:\Program Files\Sony\VAIO Care\VCSystemTray.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Sony\VAIO Smart Network\VSNService.exe
C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
C:\Program Files\Sony\VAIO Smart Network\VSNClient.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamscheduler.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe
C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
C:\Program Files\Sony\VAIO Care\VCPerfService.exe
C:\Program Files\Sony\VAIO Care\listener.exe
C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Sony\VAIO Care\VCAgent.exe
C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe
C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
C:\Program Files (x86)\Glary Utilities 5\Integrator.exe
C:\Program Files (x86)\YCIII\YankClip.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxps://www.google.com/
uSearch Bar = hxxps://www.google.com/
mStart Page = hxxps://www.google.com/
mDefault_Search_URL = hxxps://www.google.com/
uSearchURL,(Default) = hxxps://www.google.com/
mSearchAssistant = hxxps://www.google.com/
mCustomizeSearch = hxxps://www.google.com/
BHO: Protect My Choices (Beta): {3DFCDCA1-AEAC-4302-A690-BFB683568BAA} - C:\Program Files (x86)\DigitalAdvertisingAlliance\Protect My Choices\pmc.dll
BHO: PlusIEEventHelper Class: {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll
BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: &RoboForm Toolbar: {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
uRun: [f.lux] "C:\Users\MY\AppData\Local\FluxSoftware\Flux\flux.exe" /noshow
uRun: [GUDelayStartup] "C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe" -delayrun
uRun: [RoboForm] "C:\Program Files (x86)\Roboform 8-5-13\RoboTaskBarIcon.exe "
mRun: [AvastUI.exe] "C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe" /nogui
mRun: [ISBMgr.exe] "C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe "
mRun: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
StartupFolder: C:\Users\MY\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\YANKEE~1.LNK - C:\Program Files (x86)\YCIII\YankClip.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\MICROS~1.LNK - C:\Program Files (x86)\Microsoft Office\Office10\OSA.EXE
uPolicies-Explorer: NoDriveAutoRun = dword:67108863
uPolicies-Explorer: NoDrives = dword:0
uPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-Explorer: NoDriveAutoRun = dword:67108863
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:323
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: PromptOnSecureDesktop = dword:0
mPolicies-System: EnableSecureUIAPath = dword:1
IE: Customize Menu - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office10\EXCEL.EXE/3000
IE: Fill Forms - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html
IE: Password Generator - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComPasswordGenerator.html
IE: RoboForm Editor - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComEditIdent.html
IE: Save Forms - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html
IE: Show RoboForm Toolbar - C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{B59C479D-3ED6-4C1B-8B7C-8DA86D5F3707} : DHCPNameServer = 75.75.75.75 75.75.76.76
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll
Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - <orphaned>
Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - <orphaned>
SSODL: WebCheck - <orphaned>
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\Windows\System32\wpdshserviceobj.dll
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
x64-BHO: RoboForm Toolbar Helper: {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll
x64-TB: &RoboForm Toolbar: {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe "
x64-Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe
x64-IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-IE: {724d43aa-0d85-11d4-9908-00400523e39a} - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\RoboForm-x64.dll
x64-Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - <orphaned>
x64-Handler: tmbp - {1A77E7DC-C9A0-4110-8A37-2F36BAE71ECF} - <orphaned>
x64-Handler: tmpx - {0E526CB5-7446-41D1-A403-19BFE95E8C23} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrlui.dll
FF - plugin: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_206.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;avast! Revert;C:\Windows\System32\drivers\aswRvrt.sys [2014-2-22 65776]
R0 aswVmm;avast! VM Monitor;C:\Windows\System32\drivers\aswVmm.sys [2014-2-22 208416]
R0 GUBootStartup;GUBootStartup;C:\Windows\System32\drivers\GUBootStartup.sys [2014-5-15 20672]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswsnx.sys [2014-2-22 1039096]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswsp.sys [2014-2-22 423240]
R2 aswHwid;avast! HardwareID;C:\Windows\System32\drivers\aswHwid.sys [2014-4-26 29208]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2014-2-22 79184]
R2 aswStm;aswStm;C:\Windows\System32\drivers\aswstm.sys [2014-2-22 85328]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastSvc.exe [2014-4-1 50344]
R2 BrYNSvc;BrYNSvc;C:\Program Files (x86)\Browny02\BrYNSvc.exe [2014-2-24 266240]
R2 ESRV_SVC;Energy Server Service;C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe [2013-11-1 377768]
R2 GsServer;GoodSync Server;C:\Program Files (x86)\Goodsync 6-7-14\Gs-Server.exe [2014-6-6 8664208]
R2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2013-12-9 13336]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [2014-3-3 2429544]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamscheduler.exe [2014-6-7 1809720]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamservice.exe [2014-6-7 860472]
R2 PDFProFiltSrvPP;PDFProFiltSrvPP;C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [2011-8-2 145256]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;C:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [2010-11-27 398176]
R2 SampleCollector;Intel(R) System Behavior Tracker Collector Service;C:\Program Files\Sony\VAIO Care\VCPerfService.exe [2013-11-1 266168]
R2 SOHCImp;VAIO Content Importer;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [2011-11-3 138392]
R2 SOHDs;VAIO Device Searcher;C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [2011-11-3 74904]
R2 SpfService;VAIO Entertainment Common Service;C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [2011-9-23 289952]
R2 SSPORT;SSPORT;C:\Windows\System32\drivers\SSPORT.sys [2013-4-10 11576]
R2 SuperEasy Software Defrag Service;SuperEasy Software Defrag Service;C:\Program Files (x86)\Easy Defrag Bits Du Jour 2-28-14\Live Defrag\supereasydefragservice.exe [2014-2-28 1429976]
R2 uCamMonitor;CamMonitor;C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [2013-12-9 105024]
R2 UNS;Intel(R) Management and Security Application User Notification Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2013-12-9 2656280]
R2 USER_ESRV_SVC;User Energy Server Service;C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe [2013-11-1 377768]
R2 VCFw;VAIO Content Folder Watcher;C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [2011-10-24 958112]
R2 VcmXmlIfHelper;VAIO Content Metadata XML Interface;C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [2011-8-26 101600]
R2 VCService;VCService;C:\Program Files\Sony\VAIO Care\VCService.exe [2014-2-20 60504]
R2 VSNService;VSNService;C:\Program Files\Sony\VAIO Smart Network\VSNService.exe [2013-12-9 852160]
R2 VUAgent;VUAgent;C:\Program Files\Sony\VAIO Update\VUAgent.exe [2014-5-22 1642544]
R3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;C:\Windows\System32\drivers\ArcSoftKsUFilter.sys [2013-12-9 19968]
R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2014-6-7 452088]
R3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;C:\Windows\System32\drivers\L1C62x64.sys [2014-6-7 128200]
R3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;C:\Windows\System32\drivers\LEqdUsb.sys [2013-5-23 77592]
R3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;C:\Windows\System32\drivers\LHidEqd.sys [2013-5-23 13080]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-6-7 25816]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\System32\drivers\MBAMSwissArmy.sys [2014-6-7 122584]
R3 MBAMWebAccessControl;MBAMWebAccessControl;C:\Windows\System32\drivers\mwac.sys [2014-6-7 63704]
R3 RSPCIESTOR;Realtek PCIE CardReader Driver;C:\Windows\System32\drivers\RtsPStor.sys [2014-6-7 359128]
R3 semav6thermal64ro;semav6thermal64ro;C:\Windows\System32\drivers\semav6thermal64ro.sys [2012-11-15 13792]
R3 SFEP;Sony Firmware Extension Parser;C:\Windows\System32\drivers\SFEP.sys [2010-6-1 12032]
R3 SmbDrvI;SmbDrvI;C:\Windows\System32\drivers\Smb_driver_Intel.sys [2013-12-31 32496]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [2011-9-8 549408]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
S2 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-4-22 111616]
S2 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2013-12-10 1255736]
S3 ampa;ampa;C:\Windows\System32\ampa.sys [2014-3-7 17008]
S3 e1yexpress;Intel(R) Gigabit Network Connections Driver;C:\Windows\System32\drivers\e1y60x64.sys [2009-6-10 281088]
S3 MDA_NTDRV;MDA_NTDRV;C:\Windows\System32\MDA_NTDRV.sys [2013-2-25 21208]
S3 pwdspio;pwdspio;C:\Windows\System32\pwdspio.sys [2013-12-20 12504]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-12-17 19456]
S3 taphss6;Anchorfree HSS VPN Adapter;C:\Windows\System32\drivers\taphss6.sys [2013-11-13 42184]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-2-21 56832]
S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2013-12-17 30208]
S3 UsbFltr;WayTech USB Filter Driver;C:\Windows\System32\drivers\UsbFltr.sys [2007-4-9 12288]
S3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [2011-9-8 381488]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
.
=============== Created Last 30 ================
.
2014-06-09 23:38:21 -------- d-----w- C:\Windows\abylon EXIF-CLEANER (Private Version)
2014-06-09 23:36:05 -------- d-----w- C:\Program Files (x86)\Photo Exif Remover 6-9-14
2014-06-09 23:24:46 -------- d-----w- C:\Users\MY\AppData\Local\ElevatedDiagnostics
2014-06-09 20:34:17 -------- d-----w- C:\Windows\System32\CatRoot2
2014-06-09 02:39:10 -------- d-----w- C:\Program Files (x86)\Simple System Tweaker 6-8-14
2014-06-08 17:32:20 -------- d-----w- C:\Program Files (x86)\Tweaking.com
2014-06-08 11:40:49 -------- d-----w- C:\Program Files (x86)\Tweaking.com 6-8-14
2014-06-08 09:56:50 -------- d-----w- C:\Users\MY\AppData\Roaming\YoWindow
2014-06-08 09:56:47 -------- d-----w- C:\ProgramData\YoWindow
2014-06-08 09:55:52 -------- d-----w- C:\Program Files (x86)\YoWindow
2014-06-08 09:47:55 -------- d-----w- C:\Program Files (x86)\Weather Window-Bits Du Jour 6-8-14
2014-06-08 07:55:01 -------- d-----w- C:\Jihosoft Video Converter
2014-06-07 22:50:54 122584 ----a-w- C:\Windows\System32\drivers\MBAMSwissArmy.sys
2014-06-07 22:50:36 91352 ----a-w- C:\Windows\System32\drivers\mbamchameleon.sys
2014-06-07 22:50:36 63704 ----a-w- C:\Windows\System32\drivers\mwac.sys
2014-06-07 22:50:36 25816 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-06-07 22:50:36 -------- d-----w- C:\ProgramData\Malwarebytes
2014-06-07 22:50:36 -------- d-----w- C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14
2014-06-07 22:06:20 128200 ----a-w- C:\Windows\System32\drivers\L1C62x64.sys
2014-06-07 22:06:06 9889352 ----a-w- C:\Windows\SysWow64\RsCRIcon.dll
2014-06-07 22:06:06 359128 ----a-w- C:\Windows\System32\drivers\RtsPStor.sys
2014-06-07 22:05:13 452088 ----a-w- C:\Windows\System32\drivers\IntcDAud.sys
2014-06-07 22:04:59 1795952 ----a-w- C:\Windows\System32\WdfCoInstaller01011.dll
2014-06-07 22:04:59 100312 ----a-w- C:\Windows\System32\drivers\TeeDriverx64.sys
2014-06-07 22:00:11 -------- d-----w- C:\Users\MY\AppData\Roaming\IObit
2014-06-07 22:00:11 -------- d-----w- C:\ProgramData\IObit
2014-06-07 21:53:32 -------- d-----w- C:\Program Files (x86)\Driver Booster Pro Bits Du Jour 6-7-14
2014-06-07 13:00:08 -------- d-----w- C:\Program Files (x86)\SpeedyFox
2014-06-06 23:30:57 -------- d-----w- C:\Users\MY\AppData\Roaming\zubc
2014-06-06 20:26:14 -------- d-----w- C:\ProgramData\GoodSync
2014-06-06 20:26:13 -------- d-----w- C:\Users\MY\AppData\Roaming\GoodSync
2014-06-06 20:20:58 -------- d-----w- C:\Program Files (x86)\Goodsync 6-7-14
2014-06-06 08:45:14 10702536 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{491947FF-9297-40A5-A802-BF82991ED2EF}\mpengine.dll
2014-06-05 13:14:25 118048 ----a-w- C:\Windows\System32\BootDefrag.exe
2014-06-04 02:20:25 -------- d-----w- C:\Program Files (x86)\Sysinternals-Process Explorer 6-3-14
2014-06-02 04:05:44 -------- d-----w- C:\perflogs
2014-05-31 22:10:09 -------- d-----w- C:\Program Files (x86)\DriveImage XML
2014-05-31 21:31:24 -------- d-----w- C:\Windows\SysWow64\directx
2014-05-31 21:16:38 -------- d-----w- C:\Users\MY\AppData\Roaming\iolo
2014-05-31 21:16:38 -------- d-----w- C:\ProgramData\iolo
2014-05-31 20:37:47 -------- d-----w- C:\Program Files (x86)\Video Watermark Maker 5-31-14 Bits Du Jour
2014-05-29 21:55:16 -------- d-----w- C:\Program Files (x86)\Doppelganger Free Trial 5-29-14
2014-05-29 15:46:18 536576 ----a-w- C:\Windows\SysWow64\sqlite3.dll
2014-05-28 20:18:01 -------- d-----w- C:\Users\MY\AppData\Roaming\SpringPublisher
2014-05-28 20:14:23 -------- d-----w- C:\Program Files (x86)\Slim Publisher 5-28-14
2014-05-26 21:57:26 -------- d-----w- C:\Program Files (x86)\Fonts-Free 1000 5-26-14
2014-05-26 05:37:14 -------- d-sh--w- C:\Users\MY\AppData\Roaming\Common
2014-05-26 05:37:08 -------- d-----w- C:\Program Files (x86)\FileSeek
2014-05-26 05:28:44 -------- d-----w- C:\Users\MY\AppData\Roaming\JAM Software
2014-05-26 05:28:40 -------- d-----w- C:\Program Files\UltraSearch
2014-05-26 05:22:12 -------- d-----w- C:\Program Files (x86)\Quick Search
2014-05-22 16:24:31 -------- d-----w- C:\Program Files (x86)\Android Data Recovery 5-22-14
2014-05-21 22:21:37 -------- d-----w- C:\Recovered
2014-05-21 22:17:42 -------- d-----w- C:\Program Files (x86)\Picture Doctor 5-21-14
2014-05-20 13:14:00 -------- d-----w- C:\Program Files (x86)\Smart Diary
2014-05-19 10:13:08 -------- d-----w- C:\Program Files (x86)\Backup SF Basic 5-18-14
2014-05-18 23:45:58 -------- d-----w- C:\Program Files (x86)\Watermark Picture Software 5-18-14
2014-05-15 10:05:14 20672 ----a-w- C:\Windows\System32\drivers\GUBootStartup.sys
2014-05-15 10:05:03 -------- d-----w- C:\Program Files (x86)\Glary Utilities 5
2014-05-14 04:53:01 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2014-05-14 04:53:01 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
2014-05-14 04:53:00 -------- d-----w- C:\Program Files (x86)\HD Video Converter By Fox-Bits 5-14-14
2014-05-14 04:47:11 477184 ----a-w- C:\Windows\System32\aepdu.dll
2014-05-14 04:47:10 424448 ----a-w- C:\Windows\System32\aeinv.dll
2014-05-14 01:11:59 29184 ----a-w- C:\Windows\System32\sspisrv.dll
2014-05-14 01:11:59 28160 ----a-w- C:\Windows\System32\secur32.dll
2014-05-14 01:11:59 22016 ----a-w- C:\Windows\System32\credssp.dll
2014-05-14 01:11:59 17408 ----a-w- C:\Windows\SysWow64\credssp.dll
2014-05-14 01:11:58 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
2014-05-14 01:11:58 22016 ----a-w- C:\Windows\SysWow64\secur32.dll
2014-05-12 15:13:54 -------- d-----w- C:\Users\MY\AppData\Local\TriSun_Software_Inc
2014-05-12 15:11:07 -------- d-----w- C:\Program Files (x86)\Duplicate File Finder Bits Du Jour 5-12-14
.
==================== Find3M ====================
.
2014-06-08 07:48:43 1024 ----a-w- C:\AMTAG.BIN
2014-05-15 10:07:26 85328 ----a-w- C:\Windows\System32\drivers\aswstm.sys
2014-05-15 10:07:26 1039096 ----a-w- C:\Windows\System32\drivers\aswsnx.sys
2014-05-14 13:33:14 70832 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-14 13:33:14 692400 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2014-05-14 08:39:30 24352 ----a-w- C:\Windows\System32\RegBootDefrag.exe
2014-04-26 07:16:45 93568 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2014-04-26 07:16:45 79184 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2014-04-26 07:16:45 65776 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
2014-04-26 07:16:45 29208 ----a-w- C:\Windows\System32\drivers\aswHwid.sys
2014-04-26 07:16:45 208416 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
2014-04-26 07:16:43 43152 ----a-w- C:\Windows\avastSS.scr
2014-04-15 00:13:43 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-12 02:22:05 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
2014-04-12 02:22:05 155072 ----a-w- C:\Windows\System32\drivers\ksecpkg.sys
2014-04-12 02:19:38 136192 ----a-w- C:\Windows\System32\sspicli.dll
2014-04-12 02:19:32 1460736 ----a-w- C:\Windows\System32\lsasrv.dll
2014-04-12 02:19:05 31232 ----a-w- C:\Windows\System32\lsass.exe
2014-04-08 09:24:17 13792 ----a-w- C:\Windows\System32\drivers\semav6thermal64ro.sys
2014-04-01 11:55:42 859456 ----a-w- C:\Windows\yowindow.scr
2014-03-31 13:35:08 270496 ------w- C:\Windows\System32\MpSigStub.exe
.
============= FINISH: 23:57:55.55 ===============

----------------------
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 12/9/2013 12:04:26 AM
System Uptime: 6/9/2014 4:33:26 PM (7 hours ago)
.
Motherboard: Sony Corporation | | VAIO
Processor: Intel(R) Core(TM) i3-2310M CPU @ 2.10GHz | N/A | 2100/1333mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 247 GiB total, 13.841 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 208 GiB total, 144.789 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP287: 6/6/2014 4:22:54 PM - Br Goodsync Install
RP288: 6/7/2014 5:57:34 PM - B4 Driver Boster Pro
RP289: 6/7/2014 6:02:44 PM - Driver Booster : Intel(R) Display Audio
RP290: 6/7/2014 6:47:58 PM - B4 Malwarebytes Pro
RP291: 6/8/2014 1:49:57 AM - B4 Goodsync on Justin
RP292: 6/8/2014 5:49:13 AM - B4 Yoweather
RP293: 6/8/2014 7:43:26 AM - Tweaking.com - Windows Repair
RP294: 6/8/2014 7:51:11 AM - Tweaking.com - Windows Repair
RP295: 6/8/2014 4:53:06 PM - Tweaking.com - Windows Repair
RP296: 6/9/2014 7:43:18 AM - Tweaking.com - Windows Repair
.
==== Installed Programs ======================
.
1400
1400_Help
1400Trb
64 Bit HP CIO Components Installer
7-Zip 9.22beta
abylon EXIF-CLEANER 2014.2 (Privatversion)
Adobe AIR
Adobe Flash Player 13 ActiveX
Adobe Flash Player 13 Plugin
Adobe Reader XI (11.0.07)
Adobe Shockwave Player 12.1
AIO_CDB_ProductContext
AIO_CDB_Software
AIO_Scan
Android Data Recovery
AOMEI Partition Assistant Pro Edition 5.5
Application Manager for VAIO
Atheros WiFi Driver Installation
Audio Record Wizard
avast! Free Antivirus
Batch Picture Protector 4.1
Batch Picture Resizer 5.2
Batchmarker version 2.01
Belarc Advisor 8.4
Boilsoft Screen Recorder 1.05
Boilsoft Video Splitter 6.34
Brother MFL-Pro Suite DCP-7065DN
BufferChm
Bulk Rename Utility 2.7.1.2
Camtasia Studio 8
CCleaner
CollageIt 1.9.3
Compatibility Pack for the 2007 Office system
Conexant HD Audio
Copy
DataNumen CAB Repair v2.0
DataNumen PSD Repair v2.0
DataNumen TAR Repair v2.0
Defraggler
Destinations
DeviceDiscovery
Digital Advertising Alliance Protect My Choices (Beta)
DriveImage XML (Private Edition)
Driver Booster
eReg
ERUNT 1.1j
ESET Online Scanner v3
f.lux
Fax
FileSeek 3.1.4
FileZilla Client 3.7.4.1
Folder Scout 1.3.2
Fotosizer 2.05
Glary Utilities PRO 5.1
GoodSync
Google Chrome
Google Update Helper
GPBaseService2
Hard Disk Sentinel
HD Video Converter Factory Pro
HP Imaging Device Functions 13.0
HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B
HP Solution Center 13.0
HP Update
HPPhotoGadget
HPProductAssistant
i-Studio 6
Intel(R) Control Center
Intel(R) Management Engine Components
Intel(R) Processor Graphics
Intel(R) Rapid Storage Technology
IrfanView (remove only)
Java 7 Update 55
Java Auto Updater
Jihosoft Video Converter version 2.3
Kingsoft Office 2013 (9.1.0.4560)
Logitech SetPoint 6.61
Logitech Unifying Software 2.10
Macro Recorder 5.6.5
Malwarebytes Anti-Malware version 2.0.2.1012
Media Gallery
Microsoft .NET Framework 4.5.1
Microsoft Office XP Professional with FrontPage
Microsoft Silverlight
Microsoft SQL Server Compact 3.5 SP2 ENU
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable (x64)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
MiniTool Partition Wizard Home Edition 8.1.1
Mozilla Firefox 29.0.1 (x86 en-US)
Mozilla Maintenance Service
MPC-HC 1.7.0
MSXML 4.0 SP3 Parser
MSXML 4.0 SP3 Parser (KB2758694)
MyLanViewer version 4.17.4
NeatMP3 Pro version 1.2.0
Network64
Nuance PaperPort 12
Nuance PDF Viewer Plus
Oasis2Service
PaperPort Image Printer 64-bit
PCmover
Picture Doctor 2.0
PL-2303 USB-to-Serial
PlayReady PC Runtime amd64
PMB
PMB VAIO Edition Guide
PMB VAIO Edition Plug-in
Quick Notes Plus 5.0
Quick Search 1.1.0.189
Quicken 2012
Realtek PCIE Card Reader
Remote Keyboard
Remote Play with PlayStation 3
Remove Logo Now! 1.5
RoboForm 7-9-7-5 (All Users)
Scan
Scansoft PDF Professional
Screencast-O-Matic
Sketch Drawer 1.3
SlimPublisher
Smart Diary Suite 4.8.0.0
SoftOrbits Photo Retoucher 1.4
SoftSkin Photo Makeup 1.2
SolutionCenter
Sony Corporation
Speccy
SpeedFan (remove only)
SSLx64
SSLx86
Status
SuperEasy Live Defrag v.1.0.5
swMSM
System Requirements Lab for Intel
Toolbox
TrayApp
Tweaking.com - Windows Repair (All in One)
UltraSearch V1.8.1 (64 bit)
UnloadSupport
Unlocker 1.9.2
uRex DVD Ripper Platinum
uRex Watermark Platinum
VAIO - Media Gallery
VAIO - Media Gallery - VAIO Personalization Manager Update
VAIO - PMB VAIO Edition Guide
VAIO - PMB VAIO Edition Plug-in
VAIO - Remote Keyboard
VAIO - Remote Play with PlayStation®3
VAIO Care
VAIO Care Recovery
VAIO Control Center
VAIO Data Restore Tool
VAIO Easy Connect
VAIO Event Service
VAIO Gate
VAIO Gate Default
VAIO Hardware Diagnostics
VAIO Health Report
VAIO Improvement
VAIO Manual
VAIO Quick Web Access
VAIO Sample Contents
VAIO Satisfaction Survey.
VAIO Smart Network
VAIO Transfer Support
VAIO Update
VBA (2627.01)
VCCx86
VESx64
VESx86
VGClientX64
VGClientX86
Video Watermark Maker 1.1
VIx64
VIx86
Vole Media CHM
Vole Windows Expedition
Vole Word Reviewer
VSNx64
VU5x64
VU5x86
VWSTx86
Watermark Software
WebReg
Windows Live Mesh ActiveX Control for Remote Connections
WinX HD Video Converter Deluxe 5.0.4
WinX Mobile Video Converter 4.0.0
Yankee Clipper III
YoWindow
Zortam Mp3 Media Studio 17.15
.
==== Event Viewer Messages From Past Week ========
.
6/9/2014 9:47:02 PM, Error: Service Control Manager [7023] - The HP Network Devices Support service terminated with the following error: The specified module could not be found.
6/9/2014 8:43:45 AM, Error: Service Control Manager [7030] - The Tweaking Run As System Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
6/9/2014 8:43:45 AM, Error: Service Control Manager [7006] - The ScRegSetValueExW call failed for Start with the following error: Access is denied.
6/9/2014 7:39:15 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
6/9/2014 7:39:15 AM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473536.
6/9/2014 7:38:42 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
6/9/2014 7:33:39 AM, Error: Service Control Manager [7034] - The SuperEasy Software Defrag Service service terminated unexpectedly. It has done this 1 time(s).
6/9/2014 4:38:07 PM, Error: Service Control Manager [7022] - The Windows Search service hung on starting.
6/9/2014 4:36:01 PM, Error: Service Control Manager [7023] -
6/9/2014 4:35:17 PM, Error: Service Control Manager [7003] - The Net.Pipe Listener Adapter service depends the following service: was. This service might not be installed.
6/9/2014 4:35:17 PM, Error: Service Control Manager [7003] - The Net.Msmq Listener Adapter service depends the following service: msmq. This service might not be installed.
6/9/2014 4:35:17 PM, Error: Service Control Manager [7001] - The Net.Tcp Listener Adapter service depends on the Net.Tcp Port Sharing Service service which failed to start because of the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
6/9/2014 4:34:47 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the MBAMScheduler service to connect.
6/9/2014 4:34:47 PM, Error: Service Control Manager [7000] - The MBAMScheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/9/2014 4:34:07 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Center Scheduler Service service to connect.
6/9/2014 4:34:07 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Center Receiver Service service to connect.
6/8/2014 4:17:14 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
6/8/2014 4:17:14 AM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2014 4:16:44 AM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error %%-1073473535.
6/8/2014 4:16:41 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: An instance of the service is already running.
6/8/2014 4:10:10 PM, Error: Service Control Manager [7000] - The Oasis2Service service failed to start due to the following error: The system cannot find the file specified.
6/8/2014 4:06:10 PM, Error: Service Control Manager [7003] - The Net.Tcp Listener Adapter service depends the following service: was. This service might not be installed.
6/8/2014 4:05:46 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Presentation Foundation Font Cache 3.0.0.0 service to connect.
6/8/2014 4:05:46 PM, Error: Service Control Manager [7000] - The Windows Presentation Foundation Font Cache 3.0.0.0 service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/8/2014 4:05:01 PM, Error: NETLOGON [3095] - This computer is configured as a member of a workgroup, not as a member of a domain. The Netlogon service does not need to run in this configuration.
6/8/2014 10:37:09 PM, Error: Microsoft-Windows-WMPNSS-Service [14332] - Service 'WMPNetworkSvc' did not start correctly because CoCreateInstance(CLSID_UPnPDeviceFinder) encountered error '0x80004005'. Verify that the UPnPHost service is running and that the UPnPHost component of Windows is installed properly.
6/8/2014 1:35:05 AM, Error: Service Control Manager [7022] - The Diagnostic Service Host service hung on starting.
6/7/2014 9:02:15 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 18 time(s).
6/7/2014 6:50:51 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 6:24:52 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 2 time(s).
6/7/2014 6:22:11 PM, Error: Service Control Manager [7034] - The Windows Search service terminated unexpectedly. It has done this 3 time(s).
6/7/2014 6:17:13 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 17 time(s).
6/7/2014 6:17:13 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 16 time(s).
6/7/2014 6:17:09 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 15 time(s).
6/7/2014 6:16:23 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The application-specific permission settings do not grant Local Activation permission for the COM Server application with CLSID {0C0A3666-30C9-11D0-8F20-00805F2CD064} and APPID {9209B1A6-964A-11D0-9372-00A0C9034910} to the user MY-VAIO\MY SID (S-1-5-21-679210397-2375353738-1777670786-1005) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
6/7/2014 6:07:19 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 14 time(s).
6/7/2014 6:07:18 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 13 time(s).
6/7/2014 6:07:13 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 12 time(s).
6/7/2014 6:07:13 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 11 time(s).
6/7/2014 6:07:10 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 10 time(s).
6/7/2014 6:03:25 AM, Error: Service Control Manager [7031] - The VAIO Event Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 3000 milliseconds: Restart the service.
6/7/2014 6:03:14 AM, Error: Service Control Manager [7034] - The PMBDeviceInfoProvider service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 6:03:08 AM, Error: Service Control Manager [7034] - The VAIO Content Metadata Intelligent Analyzing Manager service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 6:02:54 AM, Error: Service Control Manager [7034] - The VAIO Content Importer service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 6:02:50 AM, Error: Service Control Manager [7034] - The VAIO Content Folder Watcher service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 6:02:46 AM, Error: Service Control Manager [7034] - The VAIO Device Searcher service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 6:02:41 AM, Error: Service Control Manager [7034] - The VCService service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 6:01:56 AM, Error: Service Control Manager [7034] - The Oasis2Service service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 5:57:36 AM, Error: Service Control Manager [7034] - The Adobe Acrobat Update Service service terminated unexpectedly. It has done this 1 time(s).
6/7/2014 5:55:00 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 9 time(s).
6/7/2014 5:54:03 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 8 time(s).
6/7/2014 5:50:31 PM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 19 time(s).
6/7/2014 5:47:35 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 7 time(s).
6/7/2014 5:46:57 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 6 time(s).
6/7/2014 5:46:53 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 5 time(s).
6/7/2014 5:45:50 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 4 time(s).
6/7/2014 5:45:28 AM, Error: Service Control Manager [7034] - The MBAMService service terminated unexpectedly. It has done this 3 time(s).
6/7/2014 5:38:21 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the VSNService service.
6/7/2014 5:01:16 AM, Error: Service Control Manager [7034] - The Windows Search service terminated unexpectedly. It has done this 4 time(s).
6/5/2014 9:45:59 AM, Error: Service Control Manager [7034] - The Windows Search service terminated unexpectedly. It has done this 6 time(s).
6/5/2014 9:35:14 AM, Error: Service Control Manager [7034] - The Windows Search service terminated unexpectedly. It has done this 5 time(s).
6/5/2014 8:18:54 PM, Error: Microsoft-Windows-DistributedCOM [10000] - Unable to start a DCOM Server: {00020906-0000-0000-C000-000000000046}. The error: "740" Happened while starting this command: "C:\Program Files (x86)\Microsoft Office\Office10\WINWORD.EXE" -Embedding
6/4/2014 8:55:59 AM, Error: Service Control Manager [7034] - The PsExec service terminated unexpectedly. It has done this 1 time(s).
6/2/2014 2:58:32 AM, Error: Service Control Manager [7034] - The Windows Search service terminated unexpectedly. It has done this 7 time(s).
.
==== End Of File ===========================

broni · 2014/06/10

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

===================================

Download RogueKiller from one of the following links and save it to your Desktop:

Link 1
Link 2

Close all the running programs

Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator

Otherwise just double-click on RogueKiller.exe

Pre-scan will start. Let it finish.

Click on SCAN button.

Wait until the Status box shows Scan Finished

Click on Delete.

Wait until the Status box shows Deleting Finished.

Click on Report and copy/paste the content of the Notepad into your next reply.

RKreport.txt could also be found on your desktop.

If more than one log is produced post all logs.

If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Create new restore point before proceeding with the next step....
How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

Download Malwarebytes Anti-Rootkit (MBAR) from HERE

Unzip downloaded file.

Open the folder where the contents were unzipped and run mbar.exe

Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

Click on the Cleanup button to remove any threats and reboot if prompted to do so.

Wait while the system shuts down and the cleanup process is performed.

Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

PeteC · 2014/06/10

Sorry but don't see the option to attach the logs so here they are pasted
Click to expand...

There is no option to attach the logs - from Stage 2 ....

include the contents of both logs in your new topic. The scan will instruct you to post Attach.txt as an attachment. No need for that though... just post it's contents as you would any other log.
Click to expand...

malady · 2014/06/10

Logs

â€¢ When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

No infection. Only system-log.txt in MBAR folder, no mbar-log.
RogueKiller V9.0.2.0 [Jun 3 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : MY [Admin rights]
Mode : Scan -- Date : 06/10/2014 13:04:36

¤¤¤ Bad processes : 1 ¤¤¤
[Suspicious.Path] (SVC) PSEXESVC -- C:\Windows\PSEXESVC.EXE[7] -> STOPPED

¤¤¤ Registry Entries : 5 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PSEXESVC -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PSEXESVC -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PSEXESVC -> FOUND
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> FOUND

¤¤¤ Scheduled tasks : 4 ¤¤¤
[Suspicious.Path] \\{97492154-792D-40CA-A6CF-DD84C811051D} -- C:\Windows\system32\pcalua.exe (-a C:\Users\MY\Downloads\SOAOTH-00264236-1040.EXE -d C:\Users\MY\Downloads) -> FOUND
[Suspicious.Path] \\{B52331FE-4A87-4D10-B762-579F68A3CF71} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\MY\Downloads\SOAOTH-00264236-1040 (1).EXE" -d C:\Users\MY\Downloads) -> FOUND
[Suspicious.Path] \\{B71C2F18-FB83-4045-AC48-6B09DF633EF1} -- C:\Windows\system32\pcalua.exe (-a C:\Users\MY\Desktop\HIFOPD-00264794-1040.EXE -d C:\Users\MY\Desktop) -> FOUND
[Suspicious.Path] \\{F0B93439-32B9-466E-926C-FB89A81A6CD1} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\MY\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UBUFEWKH\SOAOTH-00264236-1040.EXE" -d C:\Users\MY\Desktop) -> FOUND

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS547550A9E384 +++++
--- User ---
[MBR] c6e9a76d4dd562eaf9dd35a221eca3c9
[BSP] c77f2a0e566c78dcf6fe8d62a329f093 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 10602 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 21714944 | Size: 99 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 21919744 | Size: 252737 MB
3 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 539525120 | Size: 213499 MB
User = LL1 ... OK
User = LL2 ... OK

---------------------------
---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1012

(c) Malwarebytes Corporation 2011-2012

OS version: 6.1.7601 Windows 7 Service Pack 1 x64

Account is Administrative

Internet Explorer version: 11.0.9600.17107

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, E:\ DRIVE_FIXED
CPU speed: 2.095000 GHz
Memory total: 8535261184, free: 5275807744

Downloaded database version: v2014.06.10.06
Downloaded database version: v2014.06.02.01
=======================================
Initializing...
------------ Kernel report ------------
06/10/2014 13:08:09
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\ACPI.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\system32\drivers\vdrvroot.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\DRIVERS\compbatt.sys
\SystemRoot\system32\DRIVERS\BATTC.SYS
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\iaStor.sys
\SystemRoot\system32\drivers\amdxata.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\msrpc.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\drivers\wd.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\SysWOW64\speedfan.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\hwpolicy.sys
\SystemRoot\System32\drivers\GUBootStartup.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\System32\Drivers\aswVmm.sys
\SystemRoot\System32\Drivers\aswRvrt.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\drivers\aswSnx.sys
\SystemRoot\system32\drivers\aswSP.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\system32\drivers\rdprefmp.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\drivers\aswRdr2.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\ws2ifsl.sys
\SystemRoot\system32\DRIVERS\wfplwf.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\System32\drivers\discache.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\blbdrive.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\igdkmd64.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\system32\DRIVERS\TeeDriverx64.sys
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\athrx.sys
\SystemRoot\system32\DRIVERS\vwifibus.sys
\SystemRoot\system32\DRIVERS\RtsPStor.sys
\SystemRoot\system32\DRIVERS\L1C62x64.sys
\SystemRoot\system32\DRIVERS\CmBatt.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\SynTP.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\SFEP.sys
\SystemRoot\system32\DRIVERS\Smb_driver_Intel.sys
\SystemRoot\system32\DRIVERS\intelppm.sys
\SystemRoot\system32\DRIVERS\wmiacpi.sys
\SystemRoot\system32\DRIVERS\CompositeBus.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\CHDRT64.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\ksthunk.sys
\SystemRoot\system32\DRIVERS\IntcDAud.sys
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\System32\Drivers\usbvideo.sys
\SystemRoot\system32\DRIVERS\ArcSoftKsUFilter.sys
\SystemRoot\system32\DRIVERS\hidusb.sys
\SystemRoot\system32\DRIVERS\HIDCLASS.SYS
\SystemRoot\system32\DRIVERS\HIDPARSE.SYS
\SystemRoot\system32\DRIVERS\LEqdUsb.Sys
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\system32\DRIVERS\kbdhid.sys
\SystemRoot\system32\DRIVERS\mouhid.sys
\SystemRoot\system32\DRIVERS\LHidEqd.Sys
\SystemRoot\system32\DRIVERS\LHidFilt.Sys
\SystemRoot\system32\DRIVERS\LMouFilt.Sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_iaStor.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\aswMonFlt.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\system32\drivers\aswHwid.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\SystemRoot\System32\DRIVERS\srvnet.sys
\??\C:\Windows\system32\Drivers\SSPORT.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\??\C:\Windows\system32\drivers\semav6thermal64ro.sys
\SystemRoot\System32\Drivers\fastfat.SYS
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\drivers\aswStm.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\MBAMSwissArmy.sys
\Windows\System32\ntdll.dll
\Windows\System32\smss.exe
\Windows\System32\apisetschema.dll
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa800967b060
Upper Device Driver Name: \Driver\Disk\
Lower Device Name: \Device\Ide\IAAStorageDevice-1\
Lower Device Object: 0xfffffa8007777050
Lower Device Driver Name: \Driver\iaStor\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa800967b060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa800967bb90, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa800967b060, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
DevicePointer: 0xfffffa8007777050, DeviceName: \Device\Ide\IAAStorageDevice-1\, DriverName: \Driver\iaStor\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\Disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
Done!
Drive 0
This is a System drive
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 32CCBF2E

Partition information:

Partition 0 type is Other (0x27)
Partition is NOT ACTIVE.
Partition starts at LBA: 2048 Numsec = 21712896

Partition 1 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 21714944 Numsec = 202752
Partition file system is NTFS
Partition is bootable

Partition 2 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 21919744 Numsec = 517605376

Partition 3 type is Extended with LBA (0xf)
Partition is NOT ACTIVE.
Partition starts at LBA: 539525120 Numsec = 437245952

Disk Size: 500107862016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-976753168-976773168)...
Done!
Scan finished

malady · 2014/06/10

MBAR Log

Sorry...here is the MBAR log. I had left the result window open so the log was not generated. Thx.

Malwarebytes Anti-Rootkit BETA 1.07.0.1012
www.malwarebytes.org

Database version: v2014.06.10.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17107
MY :: MY-VAIO [administrator]

6/10/2014 1:08:21 PM
mbar-log-2014-06-10 (13-08-21).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 406500
Time elapsed: 18 minute(s), 9 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

broni · 2014/06/10

RK produces two logs, before and after fixes.
I still need to see the latter one.

malady · 2014/06/11

Logs

"broni said: ↑

RK produces two logs, before and after fixes.
I still need to see the latter one.
Click to expand...

Sorry....Ran it again....here you go.
------------------------------------
RogueKiller V9.0.2.0 [Jun 3 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : MY [Admin rights]
Mode : Remove -- Date : 06/11/2014 01:38:09

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PSEXESVC -> NOT SELECTED
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PSEXESVC -> NOT SELECTED
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PSEXESVC -> NOT SELECTED
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> NOT SELECTED
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> NOT SELECTED

¤¤¤ Scheduled tasks : 4 ¤¤¤
[Suspicious.Path] \\{97492154-792D-40CA-A6CF-DD84C811051D} -- C:\Windows\system32\pcalua.exe (-a C:\Users\MY\Downloads\SOAOTH-00264236-1040.EXE -d C:\Users\MY\Downloads) -> DELETED
[Suspicious.Path] \\{B52331FE-4A87-4D10-B762-579F68A3CF71} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\MY\Downloads\SOAOTH-00264236-1040 (1).EXE" -d C:\Users\MY\Downloads) -> DELETED
[Suspicious.Path] \\{B71C2F18-FB83-4045-AC48-6B09DF633EF1} -- C:\Windows\system32\pcalua.exe (-a C:\Users\MY\Desktop\HIFOPD-00264794-1040.EXE -d C:\Users\MY\Desktop) -> DELETED
[Suspicious.Path] \\{F0B93439-32B9-466E-926C-FB89A81A6CD1} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\MY\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UBUFEWKH\SOAOTH-00264236-1040.EXE" -d C:\Users\MY\Desktop) -> DELETED

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS547550A9E384 +++++
--- User ---
[MBR] c6e9a76d4dd562eaf9dd35a221eca3c9
[BSP] c77f2a0e566c78dcf6fe8d62a329f093 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 10602 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 21714944 | Size: 99 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 21919744 | Size: 252737 MB
3 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 539525120 | Size: 213499 MB
User = LL1 ... OK
User = LL2 ... OK

============================================
RKreport_SCN_06102014_130436.log - RKreport_SCN_06112014_011506.log - RKreport_SCN_06112014_013748.log

----------------------------------
RogueKiller V9.0.2.0 [Jun 3 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
Started in : Normal mode
User : MY [Admin rights]
Mode : Scan -- Date : 06/11/2014 01:15:06

¤¤¤ Bad processes : 1 ¤¤¤
[Suspicious.Path] (SVC) PSEXESVC -- C:\Windows\PSEXESVC.EXE[7] -> STOPPED

¤¤¤ Registry Entries : 5 ¤¤¤
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\PSEXESVC -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PSEXESVC -> FOUND
[Suspicious.Path] (X64) HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PSEXESVC -> FOUND
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {20D04FE0-3AEA-1069-A2D8-08002B30309D} : 1 -> FOUND
[PUM.DesktopIcons] (X86) HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel | {59031a47-3f72-44a7-89c5-5595fe6b30ee} : 1 -> FOUND

¤¤¤ Scheduled tasks : 4 ¤¤¤
[Suspicious.Path] \\{97492154-792D-40CA-A6CF-DD84C811051D} -- C:\Windows\system32\pcalua.exe (-a C:\Users\MY\Downloads\SOAOTH-00264236-1040.EXE -d C:\Users\MY\Downloads) -> FOUND
[Suspicious.Path] \\{B52331FE-4A87-4D10-B762-579F68A3CF71} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\MY\Downloads\SOAOTH-00264236-1040 (1).EXE" -d C:\Users\MY\Downloads) -> FOUND
[Suspicious.Path] \\{B71C2F18-FB83-4045-AC48-6B09DF633EF1} -- C:\Windows\system32\pcalua.exe (-a C:\Users\MY\Desktop\HIFOPD-00264794-1040.EXE -d C:\Users\MY\Desktop) -> FOUND
[Suspicious.Path] \\{F0B93439-32B9-466E-926C-FB89A81A6CD1} -- C:\Windows\system32\pcalua.exe (-a "C:\Users\MY\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UBUFEWKH\SOAOTH-00264236-1040.EXE" -d C:\Users\MY\Desktop) -> FOUND

¤¤¤ Files : 0 ¤¤¤

¤¤¤ HOSTS File : 1 ¤¤¤
[C:\Windows\System32\drivers\etc\hosts] 127.0.0.1 localhost

¤¤¤ Antirootkit : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ MBR Check : ¤¤¤
+++++ PhysicalDrive0: Hitachi HTS547550A9E384 +++++
--- User ---
[MBR] c6e9a76d4dd562eaf9dd35a221eca3c9
[BSP] c77f2a0e566c78dcf6fe8d62a329f093 : Windows Vista/7/8 MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 10602 MB
1 - [ACTIVE] NTFS (0x7) [VISIBLE] Offset (sectors): 21714944 | Size: 99 MB
2 - [XXXXXX] NTFS (0x7) [VISIBLE] Offset (sectors): 21919744 | Size: 252737 MB
3 - [XXXXXX] EXTEN-LBA (0xf) [VISIBLE] Offset (sectors): 539525120 | Size: 213499 MB
User = LL1 ... OK
User = LL2 ... OK

============================================
RKreport_SCN_06102014_130436.log

broni · 2014/06/11

Good

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.

Close any open browsers.

Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.

Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

malady · 2014/06/12

ComboFix

ComboFix 14-06-12.01 - MY 06/12/2014 0:49.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.8140.5909 [GMT -4:00]
Running from: c:\users\MY\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {17AD7D40-BA12-9C46-7131-94903A54AD8B}
FW: avast! Antivirus *Disabled* {2F96FC65-F07D-9D1E-5A6E-3DA5C487EAF0}
SP: avast! Antivirus *Disabled/Updated* {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\MY\AppData\Roaming\zubc
c:\users\MY\AppData\Roaming\zubc\STat.iat
.
.
((((((((((((((((((((((((( Files Created from 2014-05-12 to 2014-06-12 )))))))))))))))))))))))))))))))
.
.
2014-06-12 04:59 . 2014-06-12 04:59 -------- d-----w- c:\users\Public\AppData\Local\temp
2014-06-12 04:59 . 2014-06-12 04:59 -------- d-----w- c:\users\NetworkService\AppData\Local\temp
2014-06-11 10:07 . 2014-06-11 10:07 -------- d-----w- c:\program files (x86)\Wise Care 365 Pro 6-11-14
2014-06-10 21:36 . 2014-04-30 23:20 10702536 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{838315BF-9F3C-4B4D-992F-4DBF7591EE45}\mpengine.dll
2014-06-10 21:34 . 2014-06-02 04:43 235224 ----a-w- c:\program files (x86)\Internet Explorer\sqmapi.dll
2014-06-10 16:58 . 2014-06-10 16:58 -------- d-----w- c:\programdata\RogueKiller
2014-06-10 11:10 . 2014-06-10 11:10 -------- d-----w- c:\users\MY\AppData\Roaming\ArcticLine
2014-06-10 11:10 . 2014-06-10 11:10 -------- d-----w- c:\program files (x86)\Folder Marker
2014-06-10 11:05 . 2014-06-10 11:08 -------- d-----w- c:\program files (x86)\Folder Marker Home
2014-06-09 23:38 . 2014-06-09 23:38 -------- d-----w- c:\windows\abylon EXIF-CLEANER (Private Version)
2014-06-09 23:36 . 2014-06-09 23:38 -------- d-----w- c:\program files (x86)\Photo Exif Remover 6-9-14
2014-06-09 20:34 . 2014-06-12 04:46 -------- d-----w- c:\windows\system32\CatRoot2
2014-06-09 02:39 . 2014-06-09 02:39 -------- d-----w- c:\program files (x86)\Simple System Tweaker 6-8-14
2014-06-08 17:32 . 2014-06-08 17:34 -------- d-----w- c:\program files (x86)\Tweaking.com
2014-06-08 11:40 . 2014-06-08 17:34 -------- d-----w- c:\program files (x86)\Tweaking.com 6-8-14
2014-06-08 09:56 . 2014-06-08 10:55 -------- d-----w- c:\users\MY\AppData\Roaming\YoWindow
2014-06-08 09:56 . 2014-06-08 09:56 -------- d-----w- c:\programdata\YoWindow
2014-06-08 09:55 . 2014-06-08 09:55 -------- d-----w- c:\program files (x86)\YoWindow
2014-06-08 09:47 . 2014-06-08 09:56 -------- d-----w- c:\program files (x86)\Weather Window-Bits Du Jour 6-8-14
2014-06-08 07:55 . 2014-06-08 07:55 -------- d-----w- C:\Jihosoft Video Converter
2014-06-08 07:50 . 2014-06-08 07:50 -------- d-----w- c:\users\Justin\AppData\Roaming\TechSmith
2014-06-08 07:50 . 2014-06-08 07:50 -------- d-----w- c:\programdata\TechSmith
2014-06-08 05:27 . 2014-06-08 05:27 -------- d-----w- c:\users\Justin\AppData\Roaming\SpringPublisher
2014-06-08 05:27 . 2014-06-08 05:27 -------- d-----w- c:\users\Justin\AppData\Roaming\Spearit
2014-06-08 05:27 . 2014-06-08 05:27 -------- d-----w- c:\users\Justin\AppData\Roaming\qualys
2014-06-08 05:27 . 2014-06-08 05:27 -------- d-----w- c:\users\Justin\AppData\Roaming\PhotoImp
2014-06-08 05:27 . 2014-06-08 05:27 -------- d-----w- c:\users\Justin\AppData\Roaming\Photoactions
2014-06-08 05:27 . 2014-06-08 05:27 -------- d-----w- c:\users\Justin\AppData\Roaming\PearlMountain
2014-06-08 05:27 . 2014-06-08 05:27 -------- d-----w- c:\users\Justin\AppData\Roaming\Oracle
2014-06-08 05:27 . 2014-06-08 05:27 -------- d-----w- c:\users\Justin\AppData\Roaming\Notepad++
2014-06-08 05:26 . 2014-01-16 10:39 53248 ----a-r- c:\users\Justin\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2014-06-08 05:26 . 2014-04-26 03:23 -------- d-----w- c:\users\Justin\AppData\Roaming\Media Player Classic
2014-06-08 05:24 . 2014-06-08 05:24 -------- d-----w- c:\users\Justin\AppData\Local\Macromedia
2014-06-07 22:50 . 2014-06-12 02:02 122584 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-06-07 22:50 . 2014-06-10 17:07 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-06-07 22:50 . 2014-06-07 22:50 -------- d-----w- c:\program files (x86)\Malwarebytes Pro Anti-Malware 6-7-14
2014-06-07 22:50 . 2014-06-07 22:50 -------- d-----w- c:\programdata\Malwarebytes
2014-06-07 22:50 . 2014-05-12 11:26 63704 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-06-07 22:50 . 2014-05-12 11:25 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-06-07 22:06 . 2014-06-07 22:06 128200 ----a-w- c:\windows\system32\drivers\L1C62x64.sys
2014-06-07 22:06 . 2014-06-07 22:06 9889352 ----a-w- c:\windows\SysWow64\RsCRIcon.dll
2014-06-07 22:06 . 2014-06-07 22:06 359128 ----a-w- c:\windows\system32\drivers\RtsPStor.sys
2014-06-07 22:05 . 2014-06-07 22:05 452088 ----a-w- c:\windows\system32\drivers\IntcDAud.sys
2014-06-07 22:04 . 2014-06-07 22:04 1795952 ----a-w- c:\windows\system32\WdfCoInstaller01011.dll
2014-06-07 22:04 . 2014-06-07 22:04 100312 ----a-w- c:\windows\system32\drivers\TeeDriverx64.sys
2014-06-07 22:00 . 2014-06-07 22:00 -------- d-----w- c:\users\MY\AppData\Roaming\IObit
2014-06-07 22:00 . 2014-06-07 22:00 -------- d-----w- c:\programdata\IObit
2014-06-07 21:53 . 2014-06-07 22:00 -------- d-----w- c:\program files (x86)\Driver Booster Pro Bits Du Jour 6-7-14
2014-06-07 13:00 . 2014-06-07 13:00 -------- d-----w- c:\program files (x86)\SpeedyFox
2014-06-06 20:26 . 2014-06-08 05:55 -------- d-----w- c:\programdata\GoodSync
2014-06-06 20:26 . 2014-06-07 09:51 -------- d-----w- c:\users\MY\AppData\Roaming\GoodSync
2014-06-06 20:20 . 2014-06-08 05:55 -------- d-----w- c:\program files (x86)\Goodsync 6-7-14
2014-06-05 13:14 . 2014-06-03 01:26 118048 ----a-w- c:\windows\system32\BootDefrag.exe
2014-06-04 02:20 . 2014-06-04 03:10 -------- d-----w- c:\program files (x86)\Sysinternals-Process Explorer 6-3-14
2014-06-02 04:05 . 2014-06-02 04:05 -------- d-----w- C:\perflogs
2014-05-31 22:10 . 2014-06-08 08:17 -------- d-----w- c:\program files (x86)\DriveImage XML
2014-05-31 21:16 . 2014-05-31 21:24 -------- d-----w- c:\users\MY\AppData\Roaming\iolo
2014-05-31 21:16 . 2014-05-31 21:16 -------- d-----w- c:\programdata\iolo
2014-05-31 20:37 . 2014-05-31 20:42 -------- d-----w- c:\program files (x86)\Video Watermark Maker 5-31-14 Bits Du Jour
2014-05-29 21:55 . 2014-05-29 21:55 -------- d-----w- c:\program files (x86)\Doppelganger Free Trial 5-29-14
2014-05-29 15:46 . 2010-08-30 12:34 536576 ----a-w- c:\windows\SysWow64\sqlite3.dll
2014-05-28 20:18 . 2014-05-29 21:35 -------- d-----w- c:\users\MY\AppData\Roaming\SpringPublisher
2014-05-28 20:14 . 2014-05-29 21:35 -------- d-----w- c:\program files (x86)\Slim Publisher 5-28-14
2014-05-26 21:57 . 2014-05-26 21:57 -------- d-----w- c:\program files (x86)\Fonts-Free 1000 5-26-14
2014-05-26 05:37 . 2014-05-26 05:37 -------- d-sh--w- c:\users\MY\AppData\Roaming\Common
2014-05-26 05:37 . 2014-05-26 05:37 -------- d-----w- c:\program files (x86)\FileSeek
2014-05-26 05:28 . 2014-05-26 05:28 -------- d-----w- c:\users\MY\AppData\Roaming\JAM Software
2014-05-26 05:28 . 2014-05-26 05:28 -------- d-----w- c:\program files\UltraSearch
2014-05-26 05:22 . 2014-05-26 05:22 -------- d-----w- c:\program files (x86)\Quick Search
2014-05-22 16:24 . 2014-05-22 16:24 -------- d-----w- c:\program files (x86)\Android Data Recovery 5-22-14
2014-05-21 22:21 . 2014-05-21 22:21 -------- d-----w- C:\Recovered
2014-05-21 22:17 . 2014-05-21 22:21 -------- d-----w- c:\program files (x86)\Picture Doctor 5-21-14
2014-05-20 13:14 . 2014-05-20 13:15 -------- d-----w- c:\program files (x86)\Smart Diary
2014-05-19 10:13 . 2014-05-19 10:51 -------- d-----w- c:\program files (x86)\Backup SF Basic 5-18-14
2014-05-18 23:45 . 2014-05-18 23:50 -------- d-----w- c:\program files (x86)\Watermark Picture Software 5-18-14
2014-05-16 12:56 . 2014-05-16 12:56 1619632 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\OFFICE12\OGL.DLL
2014-05-15 10:05 . 2014-05-15 10:05 20672 ----a-w- c:\windows\system32\drivers\GUBootStartup.sys
2014-05-15 10:05 . 2014-06-12 04:42 -------- d-----w- c:\program files (x86)\Glary Utilities 5
2014-05-15 06:57 . 2014-06-08 05:24 -------- d-----w- c:\users\Justin\AppData\Local\Google
2014-05-14 04:53 . 2014-05-14 05:16 -------- d-----w- c:\program files (x86)\HD Video Converter By Fox-Bits 5-14-14
2014-05-14 04:47 . 2014-05-09 06:14 477184 ----a-w- c:\windows\system32\aepdu.dll
2014-05-14 04:47 . 2014-05-09 06:11 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-05-14 01:11 . 2014-04-12 02:19 29184 ----a-w- c:\windows\system32\sspisrv.dll
2014-05-14 01:11 . 2014-04-12 02:19 28160 ----a-w- c:\windows\system32\secur32.dll
2014-05-14 01:11 . 2014-03-04 09:43 22016 ----a-w- c:\windows\system32\credssp.dll
2014-05-14 01:11 . 2014-03-04 09:17 17408 ----a-w- c:\windows\SysWow64\credssp.dll
2014-05-14 01:11 . 2014-04-12 02:12 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-05-14 01:11 . 2014-04-12 02:10 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-06-10 23:55 . 2013-12-10 02:38 95414520 ----a-w- c:\windows\system32\MRT.exe
2014-05-15 10:07 . 2014-02-22 22:48 85328 ----a-w- c:\windows\system32\drivers\aswstm.sys
2014-05-15 10:07 . 2014-02-22 22:48 1039096 ----a-w- c:\windows\system32\drivers\aswsnx.sys
2014-05-15 10:07 . 2014-02-22 22:48 423240 ----a-w- c:\windows\system32\drivers\aswsp.sys
2014-05-14 13:33 . 2013-12-17 01:00 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-05-14 13:33 . 2013-12-17 01:00 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-05-14 08:39 . 2014-01-21 15:45 24352 ----a-w- c:\windows\system32\RegBootDefrag.exe
2014-04-26 07:16 . 2014-04-26 07:16 29208 ----a-w- c:\windows\system32\drivers\aswHwid.sys
2014-04-26 07:16 . 2014-02-22 22:48 65776 ----a-w- c:\windows\system32\drivers\aswRvrt.sys
2014-04-26 07:16 . 2014-02-22 22:48 208416 ----a-w- c:\windows\system32\drivers\aswVmm.sys
2014-04-26 07:16 . 2014-02-22 22:48 79184 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2014-04-26 07:16 . 2014-02-22 22:48 93568 ----a-w- c:\windows\system32\drivers\aswRdr2.sys
2014-04-26 07:16 . 2014-02-22 22:48 334648 ----a-w- c:\windows\system32\aswBoot.exe
2014-04-26 07:16 . 2014-04-26 07:16 43152 ----a-w- c:\windows\avastSS.scr
2014-04-15 00:13 . 2014-04-26 00:49 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-04-08 09:24 . 2012-11-15 23:49 13792 ----a-w- c:\windows\system32\drivers\semav6thermal64ro.sys
2014-04-01 11:55 . 2014-04-01 11:55 859456 ----a-w- c:\windows\yowindow.scr
2014-03-31 13:35 . 2010-11-21 03:27 270496 ------w- c:\windows\system32\MpSigStub.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{3DFCDCA1-AEAC-4302-A690-BFB683568BAA}]
2013-10-29 20:40 334208 ----a-w- c:\program files (x86)\DigitalAdvertisingAlliance\Protect My Choices\pmc.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"f.lux "= "c:\users\MY\AppData\Local\FluxSoftware\Flux\flux.exe" [2013-10-23 1017224]
"GUDelayStartup "= "c:\program files (x86)\Glary Utilities 5\StartupManager.exe" [2014-06-03 37152]
"RoboForm "= "c:\program files (x86)\Roboform 8-5-13\RoboTaskBarIcon.exe" [2014-06-06 109784]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"AvastUI.exe "= "c:\program files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe" [2014-04-02 3854640]
"ISBMgr.exe "= "c:\program files (x86)\Sony\ISB Utility\ISBMgr.exe" [2011-02-15 2757312]
"IAStorIcon "= "c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2010-11-06 283160]
.
c:\users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Yankee Clipper III.lnk - c:\program files (x86)\YCIII\YankClip.exe [2014-2-24 1368064]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files (x86)\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin "= 5 (0x5)
"ConsentPromptBehaviorUser "= 3 (0x3)
"EnableUIADesktopToggle "= 0 (0x0)
"PromptOnSecureDesktop "= 0 (0x0)
"EnableSecureUIAPath "= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk * \0BootDefrag.exe
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\run-disabled]
"SunJavaUpdateSched "= "c:\program files (x86)\Common Files\Java\Java Update\jusched.exe "
"PDF5 Registry Controller "= "c:\program files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe "
"PDFHook "= "c:\program files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe "
"PaperPort PTD "= "c:\program files (x86)\Nuance\PaperPort\pptd40nt.exe "
"IndexSearch "= "c:\program files (x86)\Nuance\PaperPort\IndexSearch.exe "
"Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
.
R0 BootDefragDriver;BootDefragDriver;c:\windows\System32\drivers\BootDefragDriver.sys;c:\windows\SYSNATIVE\drivers\BootDefragDriver.sys [x]
R2 aswStm;aswStm;c:\windows\system32\drivers\aswStm.sys;c:\windows\SYSNATIVE\drivers\aswStm.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamservice.exe;c:\program files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamservice.exe [x]
R2 VCService;VCService;c:\program files\Sony\VAIO Care\VCService.exe;c:\program files\Sony\VAIO Care\VCService.exe [x]
R2 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
R3 ampa;ampa;c:\windows\system32\ampa.sys;c:\windows\SYSNATIVE\ampa.sys [x]
R3 e1yexpress;Intel(R) Gigabit Network Connections Driver;c:\windows\system32\DRIVERS\e1y60x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1y60x64.sys [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 MDA_NTDRV;MDA_NTDRV;c:\windows\system32\MDA_NTDRV.sys;c:\windows\SYSNATIVE\MDA_NTDRV.sys [x]
R3 pwdspio;pwdspio;c:\windows\system32\pwdspio.sys;c:\windows\SYSNATIVE\pwdspio.sys [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\DRIVERS\taphss6.sys;c:\windows\SYSNATIVE\DRIVERS\taphss6.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 UsbFltr;WayTech USB Filter Driver;c:\windows\system32\Drivers\UsbFltr.sys;c:\windows\SYSNATIVE\Drivers\UsbFltr.sys [x]
R3 VcmIAlzMgr;VAIO Content Metadata Intelligent Analyzing Manager;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe;c:\program files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [x]
R3 VcmINSMgr;VAIO Content Metadata Intelligent Network Service Manager;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe;c:\program files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe [x]
R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
S0 aswRvrt;avast! Revert; [x]
S0 aswVmm;avast! VM Monitor; [x]
S0 GUBootStartup;GUBootStartup;c:\windows\System32\drivers\GUBootStartup.sys;c:\windows\SYSNATIVE\drivers\GUBootStartup.sys [x]
S1 aswSnx;aswSnx;c:\windows\system32\drivers\aswSnx.sys;c:\windows\SYSNATIVE\drivers\aswSnx.sys [x]
S1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys;c:\windows\SYSNATIVE\drivers\aswSP.sys [x]
S2 aswHwid;avast! HardwareID;c:\windows\system32\drivers\aswHwid.sys;c:\windows\SYSNATIVE\drivers\aswHwid.sys [x]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\drivers\aswMonFlt.sys;c:\windows\SYSNATIVE\drivers\aswMonFlt.sys [x]
S2 BrYNSvc;BrYNSvc;c:\program files (x86)\Browny02\BrYNSvc.exe;c:\program files (x86)\Browny02\BrYNSvc.exe [x]
S2 ESRV_SVC;Energy Server Service;c:\program files\Sony\VAIO Care\esrv\esrv_svc.exe --AUTO_START --start --address 127.0.0.1;c:\program files\Sony\VAIO Care\esrv\esrv_svc.exe --AUTO_START --start --address 127.0.0.1 [x]
S2 GsServer;GoodSync Server;c:\program files (x86)\Goodsync 6-7-14\Gs-Server.exe;c:\program files (x86)\Goodsync 6-7-14\Gs-Server.exe [x]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [x]
S2 IconMan_R;IconMan_R;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe;c:\program files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe [x]
S2 PDFProFiltSrvPP;PDFProFiltSrvPP;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe;c:\program files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [x]
S2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe;c:\program files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe [x]
S2 PSEXESVC;PsExec;c:\windows\PSEXESVC.EXE;c:\windows\PSEXESVC.EXE [x]
S2 SampleCollector;Intel(R) System Behavior Tracker Collector Service;c:\program files\Sony\VAIO Care\VCPerfService.exe;c:\program files\Sony\VAIO Care\VCPerfService.exe [x]
S2 SOHCImp;VAIO Content Importer;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe [x]
S2 SOHDs;VAIO Device Searcher;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe;c:\program files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe [x]
S2 SpfService;VAIO Entertainment Common Service;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe;c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe [x]
S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys;c:\windows\SYSNATIVE\Drivers\SSPORT.sys [x]
S2 SuperEasy Software Defrag Service;SuperEasy Software Defrag Service;c:\program files (x86)\Easy Defrag Bits Du Jour 2-28-14\Live Defrag\supereasydefragservice.exe;c:\program files (x86)\Easy Defrag Bits Du Jour 2-28-14\Live Defrag\supereasydefragservice.exe [x]
S2 uCamMonitor;CamMonitor;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe;c:\program files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 USER_ESRV_SVC;User Energy Server Service;c:\program files\Sony\VAIO Care\esrv\esrv_svc.exe;c:\program files\Sony\VAIO Care\esrv\esrv_svc.exe [x]
S2 VCFw;VAIO Content Folder Watcher;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe;c:\program files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe [x]
S2 VcmXmlIfHelper;VAIO Content Metadata XML Interface;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe;c:\program files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe [x]
S2 VSNService;VSNService;c:\program files\Sony\VAIO Smart Network\VSNService.exe;c:\program files\Sony\VAIO Smart Network\VSNService.exe [x]
S2 VUAgent;VUAgent;c:\program files\Sony\VAIO Update\vuagent.exe;c:\program files\Sony\VAIO Update\vuagent.exe [x]
S3 ArcSoftKsUFilter;ArcSoft Magic-I Visual Effect;c:\windows\system32\DRIVERS\ArcSoftKsUFilter.sys;c:\windows\SYSNATIVE\DRIVERS\ArcSoftKsUFilter.sys [x]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
S3 L1C;NDIS Miniport Driver for Qualcomm Atheros AR81xx PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys;c:\windows\SYSNATIVE\DRIVERS\L1C62x64.sys [x]
S3 LEqdUsb;Logitech SetPoint Unifying KMDF USB Filter;c:\windows\system32\DRIVERS\LEqdUsb.Sys;c:\windows\SYSNATIVE\DRIVERS\LEqdUsb.Sys [x]
S3 LHidEqd;Logitech SetPoint Unifying KMDF HID Filter;c:\windows\system32\DRIVERS\LHidEqd.Sys;c:\windows\SYSNATIVE\DRIVERS\LHidEqd.Sys [x]
S3 RSPCIESTOR;Realtek PCIE CardReader Driver;c:\windows\system32\DRIVERS\RtsPStor.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPStor.sys [x]
S3 semav6thermal64ro;semav6thermal64ro;c:\windows\system32\drivers\semav6thermal64ro.sys;c:\windows\SYSNATIVE\drivers\semav6thermal64ro.sys [x]
S3 SFEP;Sony Firmware Extension Parser;c:\windows\system32\DRIVERS\SFEP.sys;c:\windows\SYSNATIVE\DRIVERS\SFEP.sys [x]
S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2014-06-11 19:11 1091912 ----a-w- c:\program files (x86)\Google\Chrome\Application\35.0.1916.153\Installer\chrmstp.exe
.
Contents of the 'Scheduled Tasks' folder
.
2014-06-12 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-17 13:33]
.
2014-06-11 c:\windows\Tasks\GlaryInitialize 5.job
- c:\program files (x86)\Glary Utilities 5\Initialize.exe [2014-06-03 01:25]
.
2014-06-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-03-26 22:52]
.
2014-06-12 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2014-03-26 22:52]
.
2014-06-12 c:\windows\Tasks\WpsNotifyTask_MY.job
- c:\program files (x86)\Kingsoft Office Suite Professional 2013 Bits Du Jour 4-21-14\Kingsoft Office\wtoolex\wpsnotify.exe [2014-03-30 16:00]
.
2014-06-12 c:\windows\Tasks\WpsUpdateTask_MY.job
- c:\program files (x86)\Kingsoft Office Suite Professional 2013 Bits Du Jour 4-21-14\Kingsoft Office\wtoolex\wpsupdate.exe [2014-03-30 16:00]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@= "{472083B0-C522-11CF-8763-00608CC02F24} "
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2014-04-02 02:20 290888 ----a-w- c:\program files (x86)\Avast Free 2014 Reinstall 2-22-14\ashShA64.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6 "= "c:\program files\Logitech\SetPointP\SetPoint.exe" [2013-07-31 3091224]
"IgfxTray "= "c:\windows\system32\igfxtray.exe" [2013-11-07 171992]
"cAudioFilterAgent "= "c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2011-03-09 518784]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://www.google.com/
mDefault_Search_URL = https://www.google.com/
mStart Page = https://www.google.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchURL,(Default) = https://www.google.com/
mCustomizeSearch = https://www.google.com/
mSearchAssistant = https://www.google.com/
IE: Customize Menu - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~2\MIF5BA~1\Office10\EXCEL.EXE/3000
IE: Fill Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html
IE: Password Generator - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComPasswordGenerator.html
IE: RoboForm Editor - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComEditIdent.html
IE: Save Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html
IE: Show RoboForm Toolbar - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\SampleCollector]
"ImagePath "= "\ "c:\program files\Sony\VAIO Care\VCPerfService.exe\" \ "/service\" \ "/sstates\" \ "/sampleinterval=10000\" \ "/procinterval=5\" \ "/dllinterval=120\" \ "/counter=\Processor(_Total)\% Processor Time:1\" \ "/counter=\PhysicalDisk(_Total)\Disk Bytes/sec:1\" \ "/counter=\Network Interface(*)\Bytes Total/sec:1\" \ "/expandcounter=\Processor Information(*)\Processor Frequency:1\" \ "\" \ "/expandcounter=\Processor(*)\% Idle Time:1\" \ "/expandcounter=\Processor(*)\% C1 Time:1\" \ "/expandcounter=\Processor(*)\% C2 Time:1\" \ "/expandcounter=\Processor(*)\%C3 Time:1\" \ "/expandcounter=\Processor(*)\% Processor Time:1\" \ "/directory=c:\programdata\Sony Corporation\VAIO Care\inteldata\" "
.
Completion time: 2014-06-12 01:03:21
ComboFix-quarantined-files.txt 2014-06-12 05:03
.
Pre-Run: 16,842,362,880 bytes free
Post-Run: 16,509,485,056 bytes free
.
- - End Of File - - FD6A09704790BBE9909157282EC9F38C

broni · 2014/06/12

Looks good.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.

Double click on adwcleaner.exe to run the tool.

Click on Scan button.

When the scan has finished click on Clean button.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the contents of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator ".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.

Click the Scan All Users checkbox.

Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.

Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

malady · 2014/06/13

Logs-Adw-JRT

# AdwCleaner v3.212 - Report created 13/06/2014 at 04:35:39
# Updated 05/06/2014 by Xplode
# Operating System : Windows 7 Home Premium Service Pack 1 (64 bits)
# Username : MY - MY-VAIO
# Running from : C:\Users\MY\Desktop\adwcleaner_3.212.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

File Deleted : C:\Windows\System32\Tasks\Driver Booster Update

***** [ Shortcuts ] *****

***** [ Registry ] *****

***** [ Browsers ] *****

-\\ Internet Explorer v11.0.9600.17126

-\\ Mozilla Firefox v30.0 (en-US)

[ File : C:\Users\Justin\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\prefs.js ]

[ File : C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\prefs.js ]

-\\ Google Chrome v35.0.1916.153

[ File : C:\Users\Justin\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

[ File : C:\Users\MY\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

*************************

AdwCleaner[R1].txt - [1462 octets] - [13/06/2014 04:34:38]
AdwCleaner[S1].txt - [1393 octets] - [13/06/2014 04:35:39]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1453 octets] ##########
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Home Premium x64
Ran by MY on Fri 06/13/2014 at 4:48:08.71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 06/13/2014 at 4:57:40.16
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

malady · 2014/06/13

Log-OTL Pt.1

OTL logfile created on: 6/13/2014 5:02:43 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\MY\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17126)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.95 Gb Total Physical Memory | 5.93 Gb Available Physical Memory | 74.54% Memory free
15.90 Gb Paging File | 13.77 Gb Available in Paging File | 86.62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 246.81 Gb Total Space | 14.49 Gb Free Space | 5.87% Space Free | Partition Type: NTFS
Drive E: | 208.49 Gb Total Space | 144.18 Gb Free Space | 69.15% Space Free | Partition Type: NTFS

Computer Name: MY-VAIO | User Name: MY | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2014/06/13 04:25:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MY\Desktop\OTL.exe
PRC - [2014/06/06 16:14:21 | 000,109,784 | ---- | M] (Siber Systems) -- C:\Program Files (x86)\Roboform 8-5-13\robotaskbaricon.exe
PRC - [2014/04/01 22:20:36 | 003,854,640 | ---- | M] (AVAST Software) -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe
PRC - [2014/04/01 22:20:36 | 000,050,344 | ---- | M] (AVAST Software) -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastSvc.exe
PRC - [2014/02/22 15:03:28 | 000,181,064 | ---- | M] (Sysinternals) -- C:\Windows\PSEXESVC.EXE
PRC - [2014/02/20 15:35:26 | 000,060,504 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VAIO Care\VCService.exe
PRC - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013/11/01 14:59:56 | 000,062,464 | ---- | M] () -- C:\Program Files\Sony\VAIO Care\listener.exe
PRC - [2012/06/05 16:56:28 | 000,266,240 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files (x86)\Browny02\BrYNSvc.exe
PRC - [2012/03/13 12:52:20 | 001,429,976 | ---- | M] (SuperEasy Software) -- C:\Program Files (x86)\Easy Defrag Bits Du Jour 2-28-14\Live Defrag\supereasydefragservice.exe
PRC - [2011/11/03 21:30:26 | 000,138,392 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe
PRC - [2011/11/03 21:30:26 | 000,074,904 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe
PRC - [2011/10/24 15:49:14 | 000,958,112 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe
PRC - [2011/09/08 17:44:00 | 000,549,408 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe
PRC - [2011/08/02 15:47:26 | 000,145,256 | ---- | M] (Nuance Communications, Inc.) -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
PRC - [2011/03/05 20:42:36 | 000,180,928 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe
PRC - [2011/03/05 20:42:36 | 000,064,704 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe
PRC - [2011/02/23 18:05:04 | 000,105,024 | ---- | M] (ArcSoft, Inc.) -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe
PRC - [2011/02/15 15:47:02 | 002,757,312 | ---- | M] (Sony Corporation) -- C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe
PRC - [2011/02/14 02:15:46 | 002,656,280 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2011/02/14 02:15:14 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2010/11/27 04:55:42 | 000,398,176 | ---- | M] (Sony Corporation) -- c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe
PRC - [2010/11/06 03:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010/11/06 03:54:20 | 000,283,160 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
PRC - [2010/03/18 15:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
PRC - [2005/03/10 20:58:06 | 001,368,064 | ---- | M] (inteleXual.com) -- C:\Program Files (x86)\YCIII\YankClip.exe

========== Modules (No Company Name) ==========

MOD - [2014/05/14 18:15:38 | 000,475,648 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorUtil\0eef5f1e5c15e0171152ee8f1cfc6924\IAStorUtil.ni.dll
MOD - [2014/05/14 01:11:17 | 011,922,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\70dbdd46969daf2bea2443c75b7629d4\System.Web.ni.dll
MOD - [2014/05/14 01:11:08 | 000,774,144 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\98c91b8d3f1d54c41ada5f37e0935303\System.Runtime.Remoting.ni.dll
MOD - [2014/02/22 18:47:49 | 019,336,120 | ---- | M] () -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\libcef.dll
MOD - [2014/02/21 02:26:46 | 000,014,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\IAStorCommon\b1f7b4e15aef3faf382db6ba14c81371\IAStorCommon.ni.dll
MOD - [2014/02/21 00:37:42 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\8bc548587e91ecf0552a40e47bbf99cc\System.Windows.Forms.ni.dll
MOD - [2014/02/21 00:37:35 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5c24d3b0041ebf4f48a93615b9fa3de9\System.Drawing.ni.dll
MOD - [2014/02/21 00:37:28 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\217ece46920546d718414291d463bb1c\System.Xml.ni.dll
MOD - [2014/02/21 00:37:24 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\5b6ddf934128d538cd5cd77bf4209b93\System.Configuration.ni.dll
MOD - [2014/02/21 00:37:10 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1d696b2d3de530f7ee971070263667ff\WindowsBase.ni.dll
MOD - [2014/02/21 00:37:07 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\b3a78269847005365001c33870cd121f\System.ni.dll
MOD - [2014/02/21 00:37:01 | 011,499,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\ede2c6c842840e009f01bcc74fa4c457\mscorlib.ni.dll
MOD - [2013/11/01 14:59:56 | 000,062,464 | ---- | M] () -- C:\Program Files\Sony\VAIO Care\listener.exe

========== Services (SafeList) ==========

SRV:64bit: - [2014/05/30 05:21:05 | 000,111,616 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService)
SRV:64bit: - [2014/02/27 22:03:12 | 001,642,544 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Update\VUAgent.exe -- (VUAgent)
SRV:64bit: - [2014/02/20 15:35:26 | 000,060,504 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\VCService.exe -- (VCService)
SRV:64bit: - [2013/11/01 14:59:56 | 000,377,768 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe -- (USER_ESRV_SVC)
SRV:64bit: - [2013/11/01 14:59:56 | 000,377,768 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\esrv\esrv_svc.exe -- (ESRV_SVC)
SRV:64bit: - [2013/11/01 14:59:56 | 000,266,168 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Care\VCPerfService.exe -- (SampleCollector)
SRV:64bit: - [2013/06/13 15:31:10 | 000,357,144 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV:64bit: - [2013/05/27 01:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:64bit: - [2011/09/23 20:18:38 | 000,289,952 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\SPF\SpfService64.exe -- (SpfService)
SRV:64bit: - [2011/09/08 17:44:00 | 000,549,408 | ---- | M] (Sony Corporation) [On_Demand | Running] -- C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe -- (VcmIAlzMgr)
SRV:64bit: - [2011/09/08 16:29:16 | 000,381,488 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Sony\VCM Intelligent Network Service Manager\VcmINSMgr.exe -- (VcmINSMgr)
SRV:64bit: - [2011/08/26 19:47:26 | 000,101,600 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Common Files\Sony Shared\VcmXml\VcmXmlIfHelper64.exe -- (VcmXmlIfHelper)
SRV:64bit: - [2011/02/28 14:29:18 | 000,852,160 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files\Sony\VAIO Smart Network\VSNService.exe -- (VSNService)
SRV - [2014/06/06 12:11:10 | 008,664,208 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Goodsync 6-7-14\Gs-Server.exe -- (GsServer)
SRV - [2014/05/14 09:33:14 | 000,257,712 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/05/12 07:24:42 | 000,860,472 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamservice.exe -- (MBAMService)
SRV - [2014/05/12 07:24:40 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2014/04/01 22:20:36 | 000,050,344 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastSvc.exe -- (avast! Antivirus)
SRV - [2014/02/22 15:03:28 | 000,181,064 | ---- | M] (Sysinternals) [Auto | Running] -- C:\Windows\PSEXESVC.EXE -- (PSEXESVC)
SRV - [2014/02/21 01:39:20 | 000,118,896 | ---- | M] (Mozilla Foundation) [Auto | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/12/21 02:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013/11/07 02:52:56 | 000,279,000 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2013/09/11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2012/06/05 16:56:28 | 000,266,240 | ---- | M] (Brother Industries, Ltd.) [Auto | Running] -- C:\Program Files (x86)\Browny02\BrYNSvc.exe -- (BrYNSvc)
SRV - [2012/03/13 12:52:20 | 001,429,976 | ---- | M] (SuperEasy Software) [Auto | Running] -- C:\Program Files (x86)\Easy Defrag Bits Du Jour 2-28-14\Live Defrag\supereasydefragservice.exe -- (SuperEasy Software Defrag Service)
SRV - [2012/03/12 00:07:58 | 002,429,544 | ---- | M] (Realsil Microelectronics Inc.) [Auto | Running] -- C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe -- (IconMan_R)
SRV - [2011/11/03 21:30:26 | 000,138,392 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHCImp.exe -- (SOHCImp)
SRV - [2011/11/03 21:30:26 | 000,074,904 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\SOHLib\SOHDs.exe -- (SOHDs)
SRV - [2011/10/24 15:49:14 | 000,958,112 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe -- (VCFw)
SRV - [2011/08/02 15:47:26 | 000,145,256 | ---- | M] (Nuance Communications, Inc.) [Auto | Running] -- C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe -- (PDFProFiltSrvPP)
SRV - [2011/03/05 20:42:36 | 000,064,704 | ---- | M] (Sony Corporation) [Auto | Running] -- C:\Program Files (x86)\Sony\VAIO Event Service\VESMgr.exe -- (VAIO Event Service)
SRV - [2011/02/23 18:05:04 | 000,105,024 | ---- | M] (ArcSoft, Inc.) [Auto | Running] -- C:\Program Files (x86)\ArcSoft\Magic-i Visual Effects 2\uCamMonitor.exe -- (uCamMonitor)
SRV - [2011/02/14 02:15:46 | 002,656,280 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS)
SRV - [2011/02/14 02:15:14 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS)
SRV - [2010/11/27 04:55:42 | 000,398,176 | ---- | M] (Sony Corporation) [Auto | Running] -- c:\Program Files (x86)\Sony\PMB\PMBDeviceInfoProvider.exe -- (PMBDeviceInfoProvider)
SRV - [2010/11/06 03:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc)
SRV - [2010/03/18 15:19:26 | 000,113,152 | ---- | M] (ArcSoft Inc.) [Auto | Running] -- C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe -- (ACDaemon)
SRV - [2009/09/20 13:36:12 | 000,249,344 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP PSC 1401 3-2-14\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08)
SRV - [2009/09/20 13:24:02 | 000,133,120 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files (x86)\HP PSC 1401 3-2-14\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2014/06/07 18:06:20 | 000,128,200 | ---- | M] (Qualcomm Atheros Co., Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C)
DRV:64bit: - [2014/06/07 18:06:06 | 000,359,128 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\RtsPStor.sys -- (RSPCIESTOR)
DRV:64bit: - [2014/06/07 18:05:13 | 000,452,088 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud)
DRV:64bit: - [2014/06/07 18:04:59 | 000,100,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\TeeDriverx64.sys -- (MEIx64)
DRV:64bit: - [2014/05/15 06:07:26 | 001,039,096 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsnx.sys -- (aswSnx)
DRV:64bit: - [2014/05/15 06:07:26 | 000,423,240 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\SysNative\drivers\aswsp.sys -- (aswSP)
DRV:64bit: - [2014/05/15 06:07:26 | 000,085,328 | ---- | M] (AVAST Software) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\aswstm.sys -- (aswStm)
DRV:64bit: - [2014/05/15 06:05:14 | 000,020,672 | ---- | M] (Glarysoft Ltd) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\GUBootStartup.sys -- (GUBootStartup)
DRV:64bit: - [2014/05/12 07:26:10 | 000,063,704 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mwac.sys -- (MBAMWebAccessControl)
DRV:64bit: - [2014/05/12 07:25:56 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2014/04/26 03:16:45 | 000,208,416 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswVmm.sys -- (aswVmm)
DRV:64bit: - [2014/04/26 03:16:45 | 000,093,568 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)
DRV:64bit: - [2014/04/26 03:16:45 | 000,079,184 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV:64bit: - [2014/04/26 03:16:45 | 000,065,776 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\aswRvrt.sys -- (aswRvrt)
DRV:64bit: - [2014/04/26 03:16:45 | 000,029,208 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\aswHwid.sys -- (aswHwid)
DRV:64bit: - [2014/04/08 05:24:17 | 000,013,792 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\semav6thermal64ro.sys -- (semav6thermal64ro)
DRV:64bit: - [2013/12/31 23:54:07 | 000,032,496 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Smb_driver_Intel.sys -- (SmbDrvI)
DRV:64bit: - [2013/11/29 11:31:28 | 000,017,008 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\ampa.sys -- (ampa)
DRV:64bit: - [2013/11/13 06:51:44 | 000,042,184 | ---- | M] (Anchorfree Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\taphss6.sys -- (taphss6)
DRV:64bit: - [2013/11/07 02:52:44 | 005,363,200 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2013/10/01 22:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2013/09/30 17:26:48 | 000,012,504 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\pwdspio.sys -- (pwdspio)
DRV:64bit: - [2013/05/23 02:12:52 | 000,059,160 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)
DRV:64bit: - [2013/05/23 02:12:50 | 000,076,568 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)
DRV:64bit: - [2013/05/23 02:12:48 | 000,077,592 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LEqdUsb.sys -- (LEqdUsb)
DRV:64bit: - [2013/05/23 02:12:48 | 000,013,080 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidEqd.sys -- (LHidEqd)
DRV:64bit: - [2013/04/10 05:38:18 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.sys -- (SSPORT)
DRV:64bit: - [2013/02/25 05:10:02 | 000,021,208 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\MDA_NTDRV.sys -- (MDA_NTDRV)
DRV:64bit: - [2012/08/23 10:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/08/23 10:08:26 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/03/01 02:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011/06/21 02:03:42 | 002,753,536 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\athrx.sys -- (athr)
DRV:64bit: - [2011/03/11 02:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011/03/11 02:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2011/03/08 23:28:52 | 001,581,184 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\CHDRT64.sys -- (CnxtHdAudService)
DRV:64bit: - [2011/02/21 13:43:52 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:64bit: - [2011/02/15 03:42:50 | 001,388,592 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP)
DRV:64bit: - [2010/11/20 23:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010/11/20 23:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010/04/26 16:20:29 | 000,012,032 | ---- | M] (Sony Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SFEP.sys -- (SFEP)
DRV:64bit: - [2009/07/13 21:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009/07/13 21:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009/07/13 21:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009/06/10 16:35:02 | 000,281,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\e1y60x64.sys -- (e1yexpress)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009/06/10 16:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009/05/26 18:32:04 | 000,019,968 | ---- | M] (ArcSoft, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ArcSoftKsUFilter.sys -- (ArcSoftKsUFilter)
DRV:64bit: - [2008/05/06 17:06:00 | 000,014,464 | ---- | M] (Western Digital Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wdcsam64.sys -- (WDC_SAM)
DRV:64bit: - [2007/04/09 11:09:46 | 000,012,288 | ---- | M] (Waytech Development, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\UsbFltr.sys -- (UsbFltr)
DRV - [2013/11/29 11:31:28 | 000,017,008 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\ampa.sys -- (ampa)
DRV - [2009/07/13 21:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=SNYVDF&pc=MASA&src=IE-SearchBox
IE:64bit: - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.google.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = https://www.google.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.google.com/
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.com/
IE - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
IE - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 94 EE 29 90 0C 0D CF 01 [binary data]
IE - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\..\SearchScopes\{0D7A2A4C-6167-42DF-AA10-E109199D9CB1}: "URL" = https://www.google.com/search?q={searchTerms}
IE - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.google.com/ "
FF - prefs.js..extensions.enabledAddons: idme%40abine.com:1.40.349
FF - prefs.js..extensions.enabledAddons: antmark%40ant.com:0.7.6
FF - prefs.js..extensions.enabledAddons: %7Bdc501fe1-520b-41f2-9421-ecbb2e7f0255%7D:1.1.2
FF - prefs.js..extensions.enabledAddons: %7Bbee6eb20-01e0-ebd1-da83-080329fb9a3a%7D:1.56
FF - prefs.js..extensions.enabledAddons: %7B0b457cAA-602d-484a-8fe7-c1d894a011ba%7D:0.98.56
FF - prefs.js..extensions.enabledAddons: %7BF003DA68-8256-4b37-A6C4-350FA04494DF%7D:6.5
FF - prefs.js..extensions.enabledAddons: donottrackplus%40abine.com:3.2.1113
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:30.0
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw_1210150.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.55.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}: C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2014/01/16 06:38:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Roboform 8-5-13\Firefox [2014/06/06 16:18:25 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 30.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 30.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{22119944-ED35-4ab1-910B-E619EA06A115}: C:\Program Files (x86)\Roboform 8-5-13\Firefox [2014/06/06 16:18:25 | 000,000,000 | ---D | M]

[2013/12/21 11:53:44 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Extensions
[2014/06/11 22:55:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions
[2014/06/03 17:06:29 | 000,000,000 | ---D | M] (FireShot) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2014/05/26 05:58:59 | 000,000,000 | ---D | M] (Flash and Video Download) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2014/06/11 22:55:40 | 000,000,000 | ---D | M] (DoNotTrackMe: Online Privacy Protection) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions\donottrackplus@abine.com
[2014/03/28 05:32:27 | 000,000,000 | ---D | M] (MaskMe) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions\idme@abine.com
[2014/03/28 04:49:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions
[2014/03/28 04:49:27 | 000,000,000 | ---D | M] (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\ww415is6.default\extensions\{bee6eb20-01e0-ebd1-da83-080329fb9a3a}
[2014/03/28 05:37:54 | 000,144,360 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions\antmark@ant.com.xpi
[2014/05/02 07:00:09 | 000,126,171 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions\elemhidehelper@adblockplus.org.xpi
[2014/06/04 17:09:26 | 000,967,387 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2014/03/30 02:56:55 | 000,017,653 | ---- | M] () (No name found) -- C:\Users\MY\AppData\Roaming\Mozilla\Firefox\Profiles\i18ib50v.default-1395996555282\extensions\{dc501fe1-520b-41f2-9421-ecbb2e7f0255}.xpi
[2014/06/10 21:15:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/06/10 21:15:39 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
File not found (No name found) -- C:\PROGRAM FILES (X86)\IOBIT APPS TOOLBAR\FF
[2014/01/16 06:38:44 | 000,000,000 | ---D | M] (Logitech SetPoint) -- C:\PROGRAM FILES\LOGITECH\SETPOINTP\LOGISMOOTHFIREFOXEXT

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{googleriginalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{googlemniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{googleageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage:
CHR - plugin: Error reading preferences file
CHR - Extension: Google Voice Search Hotword (Beta) = C:\Users\MY\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn\0.1.1.5019_0\
CHR - Extension: Webpage Screenshot = C:\Users\MY\AppData\Local\Google\Chrome\User Data\Default\Extensions\ckibcdccnfeookdmbahgiakhnjcddpki\13.11_0\
CHR - Extension: Google Wallet = C:\Users\MY\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\
CHR - Extension: RoboForm = C:\Users\MY\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnlccmojcmeohlpggmfnbbiapkmbliob\7.9.4.4_0\

O1 HOSTS File: ([2014/06/12 00:59:09 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O2:64bit: - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
O2 - BHO: (Protect My Choices (Beta)) - {3DFCDCA1-AEAC-4302-A690-BFB683568BAA} - C:\Program Files (x86)\DigitalAdvertisingAlliance\Protect My Choices\pmc.dll (Digital Advertising Alliance)
O2 - BHO: (PlusIEEventHelper Class) - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\bin\PlusIEContextMenu.dll (Zeon Corporation)
O2 - BHO: (RoboForm Toolbar Helper) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O3 - HKLM\..\Toolbar: (&RoboForm Toolbar) - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O3:64bit: - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\..\Toolbar\WebBrowser: (&RoboForm Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O3 - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\..\Toolbar\WebBrowser: (&RoboForm Toolbar) - {724D43A0-0D85-11D4-9908-00400523E39A} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O4:64bit: - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent64.exe (Conexant Systems, Inc.)
O4:64bit: - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files (x86)\Avast Free 2014 Reinstall 2-22-14\AvastUI.exe (AVAST Software)
O4 - HKLM..\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [ISBMgr.exe] C:\Program Files (x86)\Sony\ISB Utility\ISBMgr.exe (Sony Corporation)
O4 - HKU\S-1-5-21-679210397-2375353738-1777670786-1005..\Run: [f.lux] C:\Users\MY\AppData\Local\FluxSoftware\Flux\flux.exe (Flux Software LLC)
O4 - HKU\S-1-5-21-679210397-2375353738-1777670786-1005..\Run: [GUDelayStartup] C:\Program Files (x86)\Glary Utilities 5\StartupManager.exe (Glarysoft Ltd)
O4 - HKU\S-1-5-21-679210397-2375353738-1777670786-1005..\Run: [RoboForm] C:\Program Files (x86)\Roboform 8-5-13\RoboTaskBarIcon.exe (Siber Systems)
O4 - Startup: C:\Users\Justin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yankee Clipper III.lnk = C:\Program Files (x86)\YCIII\YankClip.exe (inteleXual.com)
O4 - Startup: C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Yankee Clipper III.lnk = C:\Program Files (x86)\YCIII\YankClip.exe (inteleXual.com)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPath = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-679210397-2375353738-1777670786-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O8:64bit: - Extra context menu item: Customize Menu - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html File not found
O8:64bit: - Extra context menu item: Fill Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html File not found
O8:64bit: - Extra context menu item: Password Generator - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComPasswordGenerator.html File not found
O8:64bit: - Extra context menu item: RoboForm Editor - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComEditIdent.html File not found
O8:64bit: - Extra context menu item: Save Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html File not found
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html File not found
O8 - Extra context menu item: Customize Menu - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html File not found
O8 - Extra context menu item: Fill Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html File not found
O8 - Extra context menu item: Password Generator - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComPasswordGenerator.html File not found
O8 - Extra context menu item: RoboForm Editor - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComEditIdent.html File not found
O8 - Extra context menu item: Save Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html File not found
O8 - Extra context menu item: Show RoboForm Toolbar - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html File not found
O9:64bit: - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9:64bit: - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform-x64.dll (Siber Systems Inc.)
O9 - Extra Button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra Button: Show Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O9 - Extra 'Tools' menuitem : Show RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files (x86)\Roboform 8-5-13\roboform.dll (Siber Systems Inc.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab (Java Plug-in 10.55.2)
O16 - DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab (Java Plug-in 1.7.0_45)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab (Java Plug-in 10.55.2)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B59C479D-3ED6-4C1B-8B7C-8DA86D5F3707}: DhcpNameServer = 75.75.75.75 75.75.76.76
O18:64bit: - Protocol\Handler\belarc - No CLSID value found
O18:64bit: - Protocol\Handler\ipp - No CLSID value found
O18:64bit: - Protocol\Handler\ipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\mso-offdap - No CLSID value found
O18:64bit: - Protocol\Handler\tmbp - No CLSID value found
O18:64bit: - Protocol\Handler\tmpx - No CLSID value found
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files (x86)\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\tmbp - No CLSID value found
O18 - Protocol\Handler\tmpx - No CLSID value found
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\Windows\SysWOW64\ExplorerFrame.dll (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\MY\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Users\MY\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (BootDefrag.exe)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2014/06/13 04:37:39 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Logishrd
[2014/06/13 04:34:28 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/06/13 04:25:44 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\MY\Desktop\OTL.exe
[2014/06/13 04:25:32 | 001,016,261 | ---- | C] (Thisisu) -- C:\Users\MY\Desktop\JRT.exe
[2014/06/12 21:44:35 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Moto G Cell Phone 6-12-14
[2014/06/12 01:03:28 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014/06/12 01:03:23 | 000,000,000 | ---D | C] -- C:\Users\NetworkService\AppData\Local\temp
[2014/06/12 01:03:23 | 000,000,000 | ---D | C] -- C:\Users\LocalService\AppData\Local\temp
[2014/06/12 00:45:04 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2014/06/12 00:45:04 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2014/06/12 00:45:04 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2014/06/12 00:44:55 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/06/11 22:40:42 | 005,205,897 | R--- | C] (Swearware) -- C:\Users\MY\Desktop\ComboFix.exe
[2014/06/11 06:07:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Wise Care 365 Pro 6-11-14
[2014/06/10 21:15:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2014/06/10 17:10:06 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Thyroid Summit 6-10-14
[2014/06/10 12:58:31 | 000,000,000 | ---D | C] -- C:\ProgramData\RogueKiller
[2014/06/10 07:10:59 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\ArcticLine
[2014/06/10 07:10:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Folder Marker
[2014/06/10 07:10:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Folder Marker
[2014/06/10 07:05:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Folder Marker Home
[2014/06/09 22:55:05 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Aldi 6-9-14
[2014/06/09 19:38:21 | 000,000,000 | ---D | C] -- C:\Windows\abylon EXIF-CLEANER (Private Version)
[2014/06/09 19:38:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Photo EXIF-CLEANER
[2014/06/09 19:36:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Photo Exif Remover 6-9-14
[2014/06/09 18:58:35 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Thyroid Info 6-9-14
[2014/06/09 16:42:29 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution
[2014/06/09 16:34:17 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\CatRoot2
[2014/06/08 22:39:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Simple System Tweaker 6-8-14
[2014/06/08 17:03:25 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Thyroid Disorders 6-8-14
[2014/06/08 14:06:50 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\WindowsBBS 6-8-14
[2014/06/08 13:34:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Tweaking.com
[2014/06/08 13:32:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tweaking.com
[2014/06/08 07:40:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Tweaking.com 6-8-14
[2014/06/08 07:35:11 | 000,000,000 | ---D | C] -- C:\Users\MY\Desktop\CCE
[2014/06/08 05:56:50 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\YoWindow
[2014/06/08 05:56:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\YoWindow
[2014/06/08 05:56:47 | 000,000,000 | ---D | C] -- C:\ProgramData\YoWindow
[2014/06/08 05:55:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\YoWindow
[2014/06/08 05:47:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Weather Window-Bits Du Jour 6-8-14
[2014/06/08 03:55:01 | 000,000,000 | ---D | C] -- C:\Jihosoft Video Converter
[2014/06/08 03:50:28 | 000,000,000 | ---D | C] -- C:\ProgramData\TechSmith
[2014/06/08 01:55:00 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GoodSync
[2014/06/07 18:50:54 | 000,122,584 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014/06/07 18:50:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware Pro 6-7-14
[2014/06/07 18:50:36 | 000,092,888 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014/06/07 18:50:36 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
[2014/06/07 18:50:36 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2014/06/07 18:50:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Pro Anti-Malware 6-7-14
[2014/06/07 18:50:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014/06/07 18:06:20 | 000,128,200 | ---- | C] (Qualcomm Atheros Co., Ltd.) -- C:\Windows\SysNative\drivers\L1C62x64.sys
[2014/06/07 18:00:11 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\IObit
[2014/06/07 18:00:11 | 000,000,000 | ---D | C] -- C:\ProgramData\IObit
[2014/06/07 18:00:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Driver Booster
[2014/06/07 17:53:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Driver Booster Pro Bits Du Jour 6-7-14
[2014/06/07 09:00:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SpeedyFox
[2014/06/07 05:01:02 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Lowes 6-7-14
[2014/06/06 19:47:52 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\MMPI 6-6-14
[2014/06/06 18:22:43 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Kevin Myers 6-7-14
[2014/06/06 16:26:14 | 000,000,000 | ---D | C] -- C:\ProgramData\GoodSync
[2014/06/06 16:26:13 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\GoodSync
[2014/06/06 16:20:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Goodsync 6-7-14
[2014/06/05 18:58:06 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Dog Food 6-5-14
[2014/06/05 11:27:15 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\T Shirts 6-5-14
[2014/06/05 09:14:25 | 000,118,048 | ---- | C] (Glarysoft Ltd) -- C:\Windows\SysNative\BootDefrag.exe
[2014/06/03 23:23:04 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Systinternals 6-3-14
[2014/06/03 22:20:25 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sysinternals-Process Explorer 6-3-14
[2014/06/02 00:05:44 | 000,000,000 | ---D | C] -- C:\perflogs
[2014/05/31 18:10:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Drive Image XML 5-31-14
[2014/05/31 18:10:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DriveImage XML
[2014/05/31 17:31:24 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\directx
[2014/05/31 17:16:38 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\iolo

malady · 2014/06/13

Log-OTL Pt. 2

[2014/05/31 17:16:38 | 000,000,000 | ---D | C] -- C:\ProgramData\iolo
[2014/05/31 16:37:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Video Watermark Maker 5-31-14 Bits Du Jour
[2014/05/29 17:55:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Doppelganger Free Trial 5-29-14
[2014/05/29 11:46:18 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\Windows\SysWow64\sqlite3.dll
[2014/05/28 18:05:38 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Adorama VIP 5-27-14
[2014/05/28 16:18:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SlimPublisher
[2014/05/28 16:18:01 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\SpringPublisher
[2014/05/28 16:14:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Slim Publisher 5-28-14
[2014/05/27 04:13:42 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Nasal Rinses 5-26-14
[2014/05/26 17:57:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Fonts-Free 1000 5-26-14
[2014/05/26 06:10:32 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Trolltech 5-26-14
[2014/05/26 01:37:14 | 000,000,000 | -HSD | C] -- C:\Users\MY\AppData\Roaming\Common
[2014/05/26 01:37:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FileSeek
[2014/05/26 01:37:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\FileSeek
[2014/05/26 01:36:41 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\FileSeek Backups
[2014/05/26 01:28:44 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\JAM Software
[2014/05/26 01:28:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UltraSearch
[2014/05/26 01:28:40 | 000,000,000 | ---D | C] -- C:\Program Files\UltraSearch
[2014/05/26 01:22:13 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Glarysoft
[2014/05/26 01:22:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Quick Search
[2014/05/22 16:49:11 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Remote Controls-Etek 5-22-14
[2014/05/22 12:28:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Android Recovery 7 Data
[2014/05/22 12:24:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Android Data Recovery 5-22-14
[2014/05/21 19:12:25 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Bankruptcy 1997
[2014/05/21 18:39:57 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\Smart Diary 5-21-14
[2014/05/21 18:21:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picture Doctor
[2014/05/21 18:17:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Picture Doctor 5-21-14
[2014/05/20 09:15:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Smart Diary Suite 4
[2014/05/20 09:14:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Smart Diary
[2014/05/19 06:13:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Backup SF Basic 5-18-14
[2014/05/18 19:50:36 | 000,000,000 | ---D | C] -- C:\Users\MY\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Watermark Software
[2014/05/18 19:45:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Watermark Picture Software 5-18-14
[2014/05/15 06:05:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5
[2014/05/15 06:05:14 | 000,020,672 | ---- | C] (Glarysoft Ltd) -- C:\Windows\SysNative\drivers\GUBootStartup.sys
[2014/05/15 06:05:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Glary Utilities 5
[2014/05/15 04:45:57 | 000,000,000 | ---D | C] -- C:\Users\MY\Documents\ExcellToPDF.org 5-15-14

========== Files - Modified Within 30 Days ==========

[2014/06/13 04:57:00 | 000,000,472 | ---- | M] () -- C:\Windows\tasks\WpsNotifyTask_MY.job
[2014/06/13 04:47:00 | 000,000,472 | ---- | M] () -- C:\Windows\tasks\WpsUpdateTask_MY.job
[2014/06/13 04:42:43 | 000,028,848 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014/06/13 04:42:43 | 000,028,848 | ---- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014/06/13 04:40:19 | 000,122,584 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014/06/13 04:38:23 | 000,000,306 | ---- | M] () -- C:\BackupLoader.ini
[2014/06/13 04:38:17 | 000,000,326 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize 5.job
[2014/06/13 04:37:23 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014/06/13 04:37:21 | 2106,478,591 | -HS- | M] () -- C:\hiberfil.sys
[2014/06/13 04:33:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014/06/13 04:25:45 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\MY\Desktop\OTL.exe
[2014/06/13 04:25:32 | 001,016,261 | ---- | M] (Thisisu) -- C:\Users\MY\Desktop\JRT.exe
[2014/06/13 04:25:21 | 001,333,465 | ---- | M] () -- C:\Users\MY\Desktop\adwcleaner_3.212.exe
[2014/06/13 04:10:00 | 000,000,890 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2014/06/12 00:59:09 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2014/06/12 00:44:27 | 005,205,897 | R--- | M] (Swearware) -- C:\Users\MY\Desktop\ComboFix.exe
[2014/06/11 00:58:47 | 004,686,336 | ---- | M] () -- C:\Users\MY\Desktop\RogueKiller.exe
[2014/06/10 13:07:45 | 000,092,888 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014/06/10 07:10:48 | 000,001,918 | ---- | M] () -- C:\Users\MY\Desktop\Folder Marker.lnk
[2014/06/10 00:25:25 | 000,000,951 | ---- | M] () -- C:\Users\Public\Desktop\Speccy.lnk
[2014/06/09 21:34:54 | 000,782,662 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2014/06/09 21:34:54 | 000,650,892 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2014/06/09 21:34:54 | 000,118,628 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2014/06/09 19:39:19 | 000,000,221 | ---- | M] () -- C:\Windows\LSExifCleaner.ini
[2014/06/09 19:38:16 | 000,001,380 | ---- | M] () -- C:\Users\Public\Desktop\Photo EXIF-CLEANER (x64).lnk
[2014/06/09 08:33:59 | 000,782,662 | ---- | M] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2014/06/08 22:22:07 | 000,000,855 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts_bak_594
[2014/06/08 13:34:11 | 000,001,904 | ---- | M] () -- C:\Users\MY\Desktop\Tweaking.com - Windows Repair (All in One).lnk
[2014/06/08 05:56:50 | 000,001,194 | ---- | M] () -- C:\Users\Public\Desktop\YoWindow.lnk
[2014/06/08 03:48:43 | 000,001,024 | ---- | M] () -- C:\AMTAG.BIN
[2014/06/08 01:55:00 | 000,001,922 | ---- | M] () -- C:\Users\Public\Desktop\GoodSync Explorer.lnk
[2014/06/08 01:55:00 | 000,001,908 | ---- | M] () -- C:\Users\Public\Desktop\GoodSync.lnk
[2014/06/07 18:50:40 | 000,001,139 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/06/07 18:06:20 | 000,128,200 | ---- | M] (Qualcomm Atheros Co., Ltd.) -- C:\Windows\SysNative\drivers\L1C62x64.sys
[2014/06/07 18:05:02 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
[2014/06/07 18:00:10 | 000,001,365 | ---- | M] () -- C:\Users\Public\Desktop\Driver Booster.lnk
[2014/06/07 04:19:00 | 000,000,006 | ---- | M] () -- C:\Users\MY\AppData\Roaming\SmartDiarySuite.dic-sds
[2014/06/05 11:09:19 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2014/06/05 09:14:37 | 000,001,064 | ---- | M] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\Glary Utilities 5.lnk
[2014/06/05 09:14:37 | 000,001,040 | ---- | M] () -- C:\Users\Public\Desktop\Glary Utilities 5.lnk
[2014/06/05 01:10:41 | 000,264,747 | ---- | M] () -- C:\Users\MY\Desktop\Inspector General Brochure 4-14-14.pdf
[2014/06/02 21:26:48 | 000,118,048 | ---- | M] (Glarysoft Ltd) -- C:\Windows\SysNative\BootDefrag.exe
[2014/06/02 18:04:59 | 000,006,567 | ---- | M] () -- C:\Users\MY\Desktop\Bleeping Computer 5-29-14 - Shortcut.lnk
[2014/05/31 18:10:11 | 000,000,938 | ---- | M] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2014/05/31 18:10:11 | 000,000,914 | ---- | M] () -- C:\Users\Public\Desktop\DriveImage XML.lnk
[2014/05/26 06:00:40 | 000,000,977 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2014/05/24 12:03:31 | 000,001,093 | ---- | M] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Outlook.lnk
[2014/05/23 00:27:11 | 000,034,159 | ---- | M] () -- C:\Users\MY\Desktop\VaioNotUpdated 5-22-14.jpg
[2014/05/23 00:09:19 | 000,327,158 | ---- | M] () -- C:\Users\MY\Desktop\Vaio Update sucessful 5-23-14.jpg
[2014/05/21 18:21:34 | 000,001,141 | ---- | M] () -- C:\Users\MY\Desktop\Picture Doctor.lnk
[2014/05/20 09:15:36 | 000,000,964 | ---- | M] () -- C:\Users\Public\Desktop\Smart Diary Suite.lnk
[2014/05/19 06:26:30 | 000,001,239 | ---- | M] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\BackupSF3.lnk
[2014/05/15 06:07:26 | 001,039,096 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswsnx.sys
[2014/05/15 06:07:26 | 000,423,240 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswsp.sys
[2014/05/15 06:07:26 | 000,085,328 | ---- | M] (AVAST Software) -- C:\Windows\SysNative\drivers\aswstm.sys
[2014/05/15 06:05:14 | 000,020,672 | ---- | M] (Glarysoft Ltd) -- C:\Windows\SysNative\drivers\GUBootStartup.sys

========== Files Created - No Company Name ==========

[2014/06/13 04:25:21 | 001,333,465 | ---- | C] () -- C:\Users\MY\Desktop\adwcleaner_3.212.exe
[2014/06/12 00:45:04 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014/06/12 00:45:04 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014/06/12 00:45:04 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014/06/12 00:45:04 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014/06/12 00:45:04 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2014/06/11 00:58:47 | 004,686,336 | ---- | C] () -- C:\Users\MY\Desktop\RogueKiller.exe
[2014/06/10 07:10:48 | 000,001,918 | ---- | C] () -- C:\Users\MY\Desktop\Folder Marker.lnk
[2014/06/09 19:38:19 | 000,000,221 | ---- | C] () -- C:\Windows\LSExifCleaner.ini
[2014/06/09 19:38:16 | 000,001,380 | ---- | C] () -- C:\Users\Public\Desktop\Photo EXIF-CLEANER (x64).lnk
[2014/06/09 19:26:06 | 000,001,326 | ---- | C] () -- C:\Users\MY\Desktop\Boilsoft Screen Recorder.lnk
[2014/06/08 13:34:11 | 000,001,904 | ---- | C] () -- C:\Users\MY\Desktop\Tweaking.com - Windows Repair (All in One).lnk
[2014/06/08 05:56:50 | 000,001,194 | ---- | C] () -- C:\Users\Public\Desktop\YoWindow.lnk
[2014/06/08 01:55:00 | 000,001,922 | ---- | C] () -- C:\Users\Public\Desktop\GoodSync Explorer.lnk
[2014/06/08 01:55:00 | 000,001,908 | ---- | C] () -- C:\Users\Public\Desktop\GoodSync.lnk
[2014/06/07 18:50:40 | 000,001,139 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014/06/07 18:05:02 | 000,000,000 | ---- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_TeeDriverx64_01011.Wdf
[2014/06/07 18:00:10 | 000,001,365 | ---- | C] () -- C:\Users\Public\Desktop\Driver Booster.lnk
[2014/06/05 09:14:26 | 000,000,306 | ---- | C] () -- C:\BackupLoader.ini
[2014/06/05 01:10:41 | 000,264,747 | ---- | C] () -- C:\Users\MY\Desktop\Inspector General Brochure 4-14-14.pdf
[2014/06/03 23:57:32 | 2106,478,591 | -HS- | C] () -- C:\hiberfil.sys
[2014/06/02 18:04:59 | 000,006,567 | ---- | C] () -- C:\Users\MY\Desktop\Bleeping Computer 5-29-14 - Shortcut.lnk
[2014/05/31 18:10:11 | 000,000,938 | ---- | C] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\DriveImage XML.lnk
[2014/05/31 18:10:11 | 000,000,914 | ---- | C] () -- C:\Users\Public\Desktop\DriveImage XML.lnk
[2014/05/24 12:03:31 | 000,001,093 | ---- | C] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Outlook.lnk
[2014/05/23 00:27:11 | 000,034,159 | ---- | C] () -- C:\Users\MY\Desktop\VaioNotUpdated 5-22-14.jpg
[2014/05/23 00:09:19 | 000,327,158 | ---- | C] () -- C:\Users\MY\Desktop\Vaio Update sucessful 5-23-14.jpg
[2014/05/22 23:11:34 | 000,001,141 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VAIO Update.lnk
[2014/05/21 18:21:34 | 000,001,141 | ---- | C] () -- C:\Users\MY\Desktop\Picture Doctor.lnk
[2014/05/20 09:15:41 | 000,000,006 | ---- | C] () -- C:\Users\MY\AppData\Roaming\SmartDiarySuite.dic-sds
[2014/05/20 09:15:36 | 000,000,964 | ---- | C] () -- C:\Users\Public\Desktop\Smart Diary Suite.lnk
[2014/05/19 06:26:30 | 000,001,239 | ---- | C] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\BackupSF3.lnk
[2014/05/17 01:35:20 | 000,646,796 | ---- | C] () -- C:\Users\MY\Desktop\Prescrip-Dr. Morales-Colon Pulmonary Function Prescrip 12-20-13.pdf
[2014/05/17 01:33:21 | 000,232,871 | ---- | C] () -- C:\Users\MY\Desktop\FL ER Physicians June-Dec 2012 Statement Printouts 03202014.pdf
[2014/05/15 06:05:22 | 000,001,064 | ---- | C] () -- C:\Users\MY\Application Data\Microsoft\Internet Explorer\Quick Launch\Glary Utilities 5.lnk
[2014/05/15 06:05:22 | 000,001,052 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Glary Utilities 5.lnk
[2014/05/15 06:05:22 | 000,001,040 | ---- | C] () -- C:\Users\Public\Desktop\Glary Utilities 5.lnk
[2014/05/15 06:05:19 | 000,000,326 | ---- | C] () -- C:\Windows\tasks\GlaryInitialize 5.job
[2014/04/22 00:31:59 | 000,000,376 | ---- | C] () -- C:\Windows\ODBC.INI
[2014/03/07 13:52:53 | 001,806,960 | ---- | C] () -- C:\Windows\ampa.exe
[2014/03/07 13:52:53 | 000,017,008 | ---- | C] () -- C:\Windows\SysWow64\ampa.sys
[2014/03/03 01:02:04 | 000,221,238 | ---- | C] () -- C:\Windows\hpoins19.dat
[2014/03/03 01:02:04 | 000,013,898 | ---- | C] () -- C:\Windows\hpomdl19.dat
[2014/02/22 05:24:16 | 000,000,207 | ---- | C] () -- C:\Windows\tweaking.com-regbackup-MY-VAIO-Microsoft-Windows-7-Home-Premium-(64-bit).dat
[2013/12/21 07:22:42 | 000,007,663 | ---- | C] () -- C:\Users\MY\AppData\Local\resmon.resmoncfg
[2013/12/20 22:49:27 | 036,521,397 | ---- | C] () -- C:\Program Files (x86)\volewordreviewerportable31218.zip
[2013/12/15 02:30:40 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2013/12/15 02:22:04 | 000,000,036 | ---- | C] () -- C:\Users\MY\AppData\Local\housecall.guid.cache
[2013/12/09 21:54:33 | 000,074,703 | ---- | C] () -- C:\Windows\SysWow64\mfc45.dll
[2013/12/09 01:28:55 | 000,000,226 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2013/12/09 01:04:35 | 003,407,872 | ---- | C] () -- C:\Users\MY\NTUSER.bak
[2013/11/23 11:08:57 | 000,128,512 | ---- | C] () -- C:\Windows\SysWow64\FSContxt.dll
[2013/11/07 02:52:54 | 000,272,928 | ---- | C] () -- C:\Windows\SysWow64\igvpkrng600.bin
[2013/11/07 02:52:42 | 000,077,312 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll
[2013/11/07 02:52:40 | 000,963,452 | ---- | C] () -- C:\Windows\SysWow64\igcodeckrng600.bin
[2013/10/27 03:07:57 | 000,000,600 | ---- | C] () -- C:\Users\MY\AppData\Local\PUTTY.RND
[2013/08/25 21:59:10 | 000,017,408 | ---- | C] () -- C:\Users\MY\AppData\Local\WebpageIcons.db
[2013/06/28 07:08:46 | 000,094,208 | ---- | C] () -- C:\Windows\SysWow64\ssdevm.dll
[2013/05/22 13:32:42 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\BRTCPCON.DLL
[2013/05/22 13:32:42 | 000,000,114 | ---- | C] () -- C:\Windows\SysWow64\BRLMW03A.INI
[2013/04/01 02:13:30 | 000,074,752 | ---- | C] () -- C:\Windows\vssMgr.exe

========== ZeroAccess Check ==========

[2009/07/14 00:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
" " = C:\Windows\SysNative\shell32.dll -- [2014/03/24 22:43:12 | 014,175,744 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
" " = %SystemRoot%\system32\shell32.dll -- [2014/03/24 22:09:54 | 012,874,240 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
" " = C:\Windows\SysNative\wbem\fastprox.dll -- [2009/07/13 21:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
" " = %systemroot%\SysWow64\wbem\fastprox.dll -- [2010/11/20 23:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
" " = C:\Windows\SysNative\wbem\wbemess.dll -- [2009/07/13 21:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== LOP Check ==========

[2014/02/21 00:54:00 | 000,000,000 | ---D | M] -- C:\Users\Administrator.WORKGROUP\AppData\Roaming\Samsung
[2014/05/07 04:02:04 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\AVAST Software
[2014/06/08 01:25:33 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Boilsoft
[2014/06/08 01:25:33 | 000,000,000 | -HSD | M] -- C:\Users\Justin\AppData\Roaming\Common
[2014/06/08 01:25:33 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\ControlCenter4
[2014/06/08 01:25:34 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Digiarty
[2014/06/08 01:25:34 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\DiskDefrag
[2014/06/08 01:25:34 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Dropbox
[2014/06/08 01:25:34 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Engelmann Media
[2014/06/08 01:25:34 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\FileOpen
[2014/06/08 03:53:16 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\FileZilla
[2014/06/08 01:25:35 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\FireShot
[2014/06/08 01:25:35 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Folder Scout Labs
[2014/06/08 01:25:35 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\GlarySoft
[2014/06/08 01:25:46 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Glarysoft Giveaway
[2014/06/08 05:13:27 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\GoodSync
[2014/06/08 01:25:47 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Hard Disk Sentinel
[2014/06/08 01:25:51 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\IObit
[2014/06/08 01:25:51 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\iolo
[2014/06/08 01:25:51 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\IrfanView
[2014/06/08 01:25:51 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\JAM Software
[2014/06/08 01:25:52 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Jihosoft Video Converter
[2014/06/08 01:25:52 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Kingsoft
[2014/06/08 01:25:59 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Leadertech
[2014/06/08 01:27:28 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Notepad++
[2014/05/07 04:03:06 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Nuance
[2014/06/08 01:27:28 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Oracle
[2014/06/08 01:27:28 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\PearlMountain
[2014/06/08 01:27:28 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Photoactions
[2014/06/08 01:27:30 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\PhotoImp
[2014/06/08 01:27:30 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\qualys
[2014/06/08 01:27:36 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Spearit
[2014/06/08 01:27:37 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\SpringPublisher
[2014/06/08 03:50:47 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\TechSmith
[2014/05/07 04:03:13 | 000,000,000 | ---D | M] -- C:\Users\Justin\AppData\Roaming\Zeon
[2014/06/10 07:10:59 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\ArcticLine
[2014/02/22 18:49:07 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\AVAST Software
[2014/04/17 05:58:00 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Boilsoft
[2014/05/26 01:37:14 | 000,000,000 | -HSD | M] -- C:\Users\MY\AppData\Roaming\Common
[2014/04/19 21:36:22 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\ControlCenter4
[2014/04/10 04:34:49 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Digiarty
[2013/12/19 05:35:46 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\DiskDefrag
[2014/04/26 05:17:56 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Dropbox
[2014/05/05 06:07:50 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Engelmann Media
[2013/12/19 05:35:48 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\FileOpen
[2014/06/10 00:24:27 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\FileZilla
[2014/03/29 22:10:57 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\FireShot
[2013/12/19 05:35:49 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Folder Scout Labs
[2014/05/15 06:05:51 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\GlarySoft
[2013/12/20 03:23:23 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Glarysoft Giveaway
[2014/06/07 05:51:33 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\GoodSync
[2014/03/25 07:18:50 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Hard Disk Sentinel
[2014/06/07 18:00:11 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\IObit
[2014/05/31 17:24:25 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\iolo
[2013/12/24 15:57:16 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\IrfanView
[2014/05/26 01:28:44 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\JAM Software
[2014/04/22 18:36:10 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Jihosoft Video Converter
[2014/04/21 06:17:16 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Kingsoft
[2014/01/02 05:35:56 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Leadertech
[2013/12/19 05:36:51 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Notepad++
[2014/04/21 11:27:25 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Nuance
[2014/01/03 07:27:52 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Oracle
[2014/04/02 05:48:29 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\PearlMountain
[2013/12/19 05:36:51 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Photoactions
[2014/01/13 03:53:24 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\PhotoImp
[2014/02/28 00:13:55 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\qualys
[2013/12/19 06:00:18 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Spearit
[2014/05/29 17:35:54 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\SpringPublisher
[2014/06/08 06:55:12 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\YoWindow
[2014/04/21 11:34:14 | 000,000,000 | ---D | M] -- C:\Users\MY\AppData\Roaming\Zeon
========== Purity Check ==========
< End of report >

malady · 2014/06/13

Log-Extras

OTL Extras logfile created on: 6/13/2014 5:02:43 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\MY\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17126)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

7.95 Gb Total Physical Memory | 5.93 Gb Available Physical Memory | 74.54% Memory free
15.90 Gb Paging File | 13.77 Gb Available in Paging File | 86.62% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 246.81 Gb Total Space | 14.49 Gb Free Space | 5.87% Space Free | Partition Type: NTFS
Drive E: | 208.49 Gb Total Space | 144.18 Gb Free Space | 69.15% Space Free | Partition Type: NTFS

Computer Name: MY-VAIO | User Name: MY | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-679210397-2375353738-1777670786-1005\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll ",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Zip Compress Folder] -- Reg Error: Key error.
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "%programfiles%\internet explorer\iexplore.exe" (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1 ",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Zip Compress Folder] -- Reg Error: Key error.
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.

========== Security Center Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0286FE17-D4A6-46C2-B0C9-2F98C34E1BFE}" = lport=9998 | protocol=6 | dir=in | app=c:\program files\sony\vaio care\vcadmin.exe |
"{05D35859-E4C0-4395-BEAC-7414E4C567C4}" = rport=137 | protocol=17 | dir=out | app=system |
"{1CCD16EE-A1B1-4541-B1D2-A069760FDBC6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{1E7124C9-5162-4EFE-9A51-FECE06877673}" = lport=9996 | protocol=6 | dir=in | app=c:\program files\sony\vaio care\vcsystemtray.exe |
"{2750BCB9-A072-40D5-A23D-9652A15DE944}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2A062D93-AF30-456D-AB02-FDD0F088F39E}" = rport=138 | protocol=17 | dir=out | app=system |
"{2DB37A34-149E-4FD2-BE11-9D6368546942}" = lport=137 | protocol=17 | dir=in | app=system |
"{2EEAAE20-0887-4E3E-9ECB-4F6CFCDBD55D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{30B00B84-14C4-40FD-9117-D35C860E5A98}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{38B54E30-017A-4283-A99E-A7A458F4E04B}" = rport=139 | protocol=6 | dir=out | app=system |
"{4F9D0E70-094D-4676-B937-7F91687A5CB6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5826FF40-B9F5-4E0E-9E6C-996CB95141E8}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5E47F422-6010-4B70-B072-6B1CC43BFBFA}" = lport=9997 | protocol=6 | dir=in | app=c:\program files\sony\vaio care\vaioshell.exe |
"{66D418C1-2DBE-449F-91D2-E44374A10F28}" = lport=9999 | protocol=6 | dir=in | app=c:\program files\sony\vaio care\vcagent.exe |
"{6F04A563-DCB3-44BC-ADEA-B1D13720F97A}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7C11506C-5EFE-49E8-90A9-62584E23C18B}" = rport=10243 | protocol=6 | dir=out | app=system |
"{7D544D73-9882-4943-8D89-54E10461F276}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8165BF1F-7BEB-4698-B9F3-06F50EDFD6BB}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8969FE55-188D-494F-A4E4-393D479FBB24}" = lport=138 | protocol=17 | dir=in | app=system |
"{8DFA1014-4643-49AE-8F85-9572E37EAF4F}" = lport=33333 | protocol=6 | dir=in | name=goodsync server incoming connections |
"{980A768C-0D77-480C-85D3-BFB86EADF8AD}" = lport=139 | protocol=6 | dir=in | app=system |
"{9E32D658-AEAC-4BFC-9455-8F4DCB153587}" = lport=10243 | protocol=6 | dir=in | app=system |
"{AAE16B8B-C7EA-4AB4-98DE-F8FC08723159}" = lport=445 | protocol=6 | dir=in | app=system |
"{B66AC914-38AE-40A3-BF6D-738ADF2A74FF}" = rport=445 | protocol=6 | dir=out | app=system |
"{B99ADA06-7F1B-45E0-97CF-111F9757A78F}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{CB0FC4CC-3C25-4AA1-B9BB-2CD32EE78905}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CED2AAE5-FD2A-4C70-98FE-7F60272519AD}" = lport=33338 | protocol=17 | dir=in | name=goodsync server lan discovery |
"{D1D23F0A-CBB8-4277-B909-1DC15B27BB78}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D35FCAD1-99C5-4214-8E47-A2D7ACB638EB}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E73CDADA-7B9E-4798-BC93-18F717E871AB}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{F32671F8-78A9-4D8D-B556-624A459E718A}" = lport=8317 | protocol=6 | dir=in | name=techsmith camtasia studio |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{078C19AB-03A6-4313-B3F5-A96329C02857}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{0F780F3D-63D5-4B0D-AC42-1CC87FBDCE35}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{14390030-A4E7-4EDA-90E1-C955B3632178}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{18DEBC86-219E-4DAA-A0BD-AA504AE6DD65}" = protocol=6 | dir=out | app=system |
"{203D839D-995C-4CDC-B13B-231C5FD5DA45}" = dir=out | app=c:\program files (x86)\camtasia |
"{2A590912-F1C6-4BB9-8D13-6F2EA0C6D47F}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hposfx08.exe |
"{2AE702E2-01BA-4CA4-ACDB-1F147CC819DC}" = protocol=6 | dir=in | app=c:\program files (x86)\goodsync 6-7-14\gs-server.exe |
"{31E510C4-7CDA-4262-9AD6-FF1FD077CF04}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3A9414AE-4450-4FAD-A479-0CB1E8AD63AD}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpofxm08.exe |
"{439684B7-6946-4B0D-B91F-456AFFDA6230}" = protocol=17 | dir=in | app=c:\program files (x86)\goodsync 6-7-14\gsexplorer.exe |
"{442B171B-1501-4D32-B1A6-801829876F72}" = protocol=6 | dir=in | app=c:\program files (x86)\sony\vaio transfer support\vaiotransfer.exe |
"{470C54AA-6B4F-49F2-B75C-4385F173650A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{4B820003-3613-41F0-A740-6A438DB1D773}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{4E96F679-6BC5-411F-80F5-74A6ACD92ECF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5412F8A9-3516-4295-9813-2BB8153DFB0C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{55D2DBE9-E410-4149-9FAE-17139866C108}" = dir=in | app=c:\program files (x86)\camtasia |
"{5E3C4831-2843-4820-9A50-CBFEEB757593}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpqfxt08.exe |
"{5FACB987-54F7-44D9-8E1A-4C549F7CFF64}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{6388338F-B09B-49B2-95E3-E10394E6CB17}" = protocol=6 | dir=in | app=c:\program files (x86)\goodsync 6-7-14\goodsync.exe |
"{664D5F04-6F3F-4504-9C2D-221CA9B31802}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6EAD94B6-968D-44FA-A99C-EF69D136D468}" = protocol=17 | dir=in | app=c:\program files (x86)\goodsync 6-7-14\goodsync.exe |
"{735847C0-30B3-4159-B939-95B500FE685E}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpzwiz01.exe |
"{74715C92-4991-497E-8DC0-E6ADB5770DE7}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{95019223-3983-4F63-832B-A0CCC54A9326}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpqkygrp.exe |
"{9577B0F8-73D1-4934-8E69-B929D4CED383}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpqgplgtupl.exe |
"{95C87508-B236-4B33-801E-E6C5A495F240}" = protocol=6 | dir=in | app=c:\program files (x86)\goodsync 6-7-14\gsexplorer.exe |
"{9877F2A5-ADFF-498D-875A-BA799D4F814B}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpofxs08.exe |
"{99808C0B-6888-4BFA-83EF-F83135E53D23}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{ADFA001D-49FC-4B8A-9907-D01E57D020E9}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hposid01.exe |
"{B656C935-F794-429E-81B9-58EF17695F64}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpfccopy.exe |
"{BA0B7681-54A8-41A4-BE91-5C1A4A55C8CB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BC98E8C1-44D4-4CB6-A7A6-23BA9E806792}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{C066115E-FB0B-4632-A7A7-84DFF5C33227}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpqcopy2.exe |
"{C2491DCF-A301-4FDC-9B94-AD32FDB8AC27}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpiscnapp.exe |
"{CC4B395D-734D-4765-BB80-65819053C1B2}" = protocol=17 | dir=in | app=c:\program files (x86)\goodsync 6-7-14\gs-server.exe |
"{D4738A90-865C-4F36-B442-D0391DD04B63}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpqgpc01.exe |
"{D616F6A0-A65E-4F77-A513-41A423B2B0B3}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpoews01.exe |
"{D69EA6EE-25C4-4CBF-9451-003B319CB02A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DA0C3273-B437-4F06-8E13-7B0914A57DC2}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpqtra08.exe |
"{DD89000E-AEA4-4163-B6D7-936E26887275}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E13A49E6-9E3E-47D2-A578-2C20D3BA170F}" = protocol=17 | dir=in | app=c:\program files (x86)\sony\vaio transfer support\vaiotransfer.exe |
"{E1606B82-2F51-41A0-8F16-BA21BDCF0045}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpqnrs08.exe |
"{F5095564-7D8F-4434-9C49-0F646D4CE3A7}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\digital imaging\bin\hpqste08.exe |
"{FA702E25-B70D-4678-83E0-6474B25712C7}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FB19406D-7BC6-4829-9EC1-0FF8DB9C9C84}" = dir=in | app=c:\program files (x86)\hp psc 1401 3-2-14\hp software update\hpwucli.exe |
"{FCCD440C-5C1E-45C9-8587-66385E72EB12}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{38C6BC39-11C9-40B8-87EB-7910E7ABBD4B}C:\program files (x86)\notes plus v. 5.0 1-15-14\qnplus\qnplus.exe" = protocol=6 | dir=in | app=c:\program files (x86)\notes plus v. 5.0 1-15-14\qnplus\qnplus.exe |
"TCP Query User{B0290DCB-BF67-4B92-8D8A-64895FAD3232}C:\program files (x86)\lan viewer 4-29-14 bits du jour\mylanviewer.exe" = protocol=6 | dir=in | app=c:\program files (x86)\lan viewer 4-29-14 bits du jour\mylanviewer.exe |
"UDP Query User{AE329B98-8ED4-42CD-B320-B3A28F929773}C:\program files (x86)\lan viewer 4-29-14 bits du jour\mylanviewer.exe" = protocol=17 | dir=in | app=c:\program files (x86)\lan viewer 4-29-14 bits du jour\mylanviewer.exe |
"UDP Query User{BC7EC3B7-59DB-4D8B-B9A9-095B13632BA5}C:\program files (x86)\notes plus v. 5.0 1-15-14\qnplus\qnplus.exe" = protocol=17 | dir=in | app=c:\program files (x86)\notes plus v. 5.0 1-15-14\qnplus\qnplus.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{05EFBF37-0E52-4579-875C-7EEF0DFB4FCB}" = Network64
"{115B60D5-BBDB-490E-AF2E-064D37A3CE01}" = Media Gallery
"{133D3F07-D558-46CE-80E8-F4D75DBBAD63}" = PMB VAIO Edition Plug-in
"{312395BC-7CC2-434C-A660-30250276A926}" = SSLx64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4F31AC31-0A28-4F5A-8416-513972DA1F79}" = Sony Corporation
"{50A7190B-5DA6-4A51-B275-3D413E617BA6}" = VAIO - Media Gallery - VAIO Personalization Manager Update
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6B7DE186-374B-4873-AEC1-7464DA337DD6}" = VU5x64
"{6ED1750E-F44F-4635-8F0D-B76B9262B7FB}" = VAIO Care Recovery
"{715CAACC-579B-4831-A5F4-A83A8DE3EFE2}" = PaperPort Image Printer 64-bit
"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{99E6C2F3-59B2-4308-B1CD-4928B55B7E30}" = VGClientX64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B26B00DA-2E5D-4CF2-83C5-911198C0F009}" = GoodSync
"{B61ED343-0B14-4241-999C-490CB1A20DA4}" = HP Photosmart Officejet and Deskjet All-In-One Driver Software 13.0 Rel. B
"{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}" = PlayReady PC Runtime amd64
"{D55EAC07-7207-44BD-B524-0F063F327743}" = VIx64
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F1DC5C16-9B1F-467B-85E3-CB48C27AC50D}" = VESx64
"{F2611404-06BF-4E67-A5B7-8DB2FFC1CBF6}" = VSNx64
"{FDCC09EA-A33E-4639-B1CD-FC1702815FA7}" = VAIO Care
"{FF21C3E6-97FD-474F-9518-8DCBE94C2854}" = 64 Bit HP CIO Components Installer
"CCleaner" = CCleaner
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Defraggler" = Defraggler
"Folder Marker Home (Giveaway Edition)_is1" = Folder Marker Home (Giveaway Edition)
"HP Imaging Device Functions" = HP Imaging Device Functions 13.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"Logitech Unifying" = Logitech Unifying Software 2.10
"sp6" = Logitech SetPoint 6.61
"Speccy" = Speccy
"UltraSearch_is1" = UltraSearch V1.8.1 (64 bit)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01C41C3F-EA8F-4F84-9C21-9564ED195131}" = PCmover
"{02F850ED-FD0E-4ED1-BE0B-5498165BF300}_is1" = AOMEI Partition Assistant Pro Edition 5.5
"{039BC111-AAD6-2271-877C-FB2AC8E21BC2}_is1" = SuperEasy Live Defrag v.1.0.5
"{05D996FA-ADCB-4D23-BA3C-A7C184A8FAC6}_is1" = MiniTool Partition Wizard Home Edition 8.1.1
"{068724F8-D8BE-4B43-8DDD-B9FE9E49FD76}" = Scansoft PDF Professional
"{07441A52-E208-478A-92B7-5C337CA8C131}" = VAIO - Remote Play with PlayStation®3
"{0899D75A-C2FC-42EA-A702-5B9A5F24EAD5}" = VAIO Smart Network
"{0A1E0BDA-5E8F-436d-8BE5-7E97C5CB899D}" = Quicken 2012
"{0A3925EA-5B0E-401B-A189-7419149747B2}" = Adobe AIR
"{0EF5BEA9-B9D3-46d7-8958-FB69A0BAEACC}" = Status
"{0F367CA3-3B2F-43F9-A44A-25A8EE69E45D}" = Scan
"{104066F4-5897-4067-85D3-4C88B67CCF75}" = AIO_Scan
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1EC71BFB-01A3-4239-B6AF-B1AE656B15C0}" = TrayApp
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{22DD005D-0EF1-4E3E-92F8-49D89E31479A}" = 1400
"{22EB6DF6-2694-47A2-0001-FA13C943A66C}" = i-Studio 6
"{24549038-9956-4EE5-976D-4419AAEA7DD5}_is1" = Boilsoft Video Splitter 6.34
"{25AF1025-095C-4AA9-A3FD-29710D3C3AE5}" = Remote Keyboard
"{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = MPC-HC 1.7.0
"{26A24AE4-039D-4CA4-87B4-2F83217051FF}" = Java 7 Update 55
"{270380EB-8812-42E1-8289-53700DB840D2}" = PMB VAIO Edition Plug-in
"{28656860-4728-433C-8AD4-D1A930437BC8}" = Nuance PDF Viewer Plus
"{2902F983-B4C1-44BA-B85D-5C6D52E2C441}" = Windows Live Mesh ActiveX Control for Remote Connections
"{2D933C82-63E9-4640-A1EF-08E38F0CF4C2}_is1" = MyLanViewer version 4.17.4
"{2E4543DD-1526-408D-8B58-D3A2BFE322D0}" = Digital Advertising Alliance Protect My Choices (Beta)
"{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
"{2FF8C687-DB7D-4adc-A5DC-57983EC25046}" = DeviceDiscovery
"{339F9B4D-00CB-4C1C-BED8-EC86A9AB602A}" = PMB VAIO Edition Guide
"{3A26D9BD-0F73-432D-B522-2BA18138F7EF}" = VAIO Improvement
"{3A94F54D-A8A4-4B82-B346-92B4D56A2708}" = VESx86
"{3A9FC03D-C685-4831-94CF-4EDFD3749497}" = Microsoft SQL Server Compact 3.5 SP2 ENU
"{3ACCCFB3-7B17-4E9F-ACB0-46868FCD4487}" = Brother MFL-Pro Suite DCP-7065DN
"{3C92B2E6-380D-4fef-B4DF-4A3B4B669771}" = Copy
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}" = eReg
"{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
"{440B915A-0C85-45DB-92AE-75AE14704A64}" = Fax
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4B48D7E3-DAB1-4FDD-8A2B-E39D7F97C9F3}_is1" = Boilsoft Screen Recorder 1.05
"{4E0B21EE-F414-412A-B916-19CBDEA5EF64}_is1" = Smart Diary Suite 4.8.0.0
"{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
"{53C63F43-B827-42D9-8886-4698D91EA33B}" = System Requirements Lab for Intel
"{547C9EB4-4CA6-402F-9D1B-8BD30DC71E44}" = VAIO Sample Contents
"{5545EEE1-FA36-4F76-B6BE-5696E7F4E2D6}" = VBA (2627.01)
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{5A92468F-3ED8-4F96-A9E1-4F176C80EC29}" = VAIO Quick Web Access
"{5DDAFB4B-C52E-468A-9E23-3B0CEEB671BF}" = VAIO Transfer Support
"{5FA51AAF-23FE-42F4-A724-D79F85F41D4B}" = Remote Play with PlayStation 3
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{63C43435-F428-42BA-8E7B-5848749D9262}" = SSLx86
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6A3C2391-BCE2-4D28-A336-73B953B4502F}" = 1400Trb
"{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
"{6FBE200D-1F00-40B7-BF48-FEB265AADE94}" = 1400_Help
"{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
"{70991E0A-1108-437E-BA7D-085702C670C0}" =
"{70EED410-697B-4193-A2CB-2F790F82B420}" = VAIO Data Restore Tool
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{7396FB15-9AB4-4B78-BDD8-24A9C15D2C65}" = VAIO - Remote Keyboard
"{73D8886A-D416-4687-B609-0D3836BA410C}" = VAIO Event Service
"{7B232E64-379C-4D6F-B9C0-B730AA4FF764}" = Vole Word Reviewer
"{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}" = VAIO Easy Connect
"{7CF78179-D8AB-4639-AC92-85E24A85C970}" = SlimPublisher
"{7D916FA5-DAE9-4A25-B089-655C70EAF607}" = Atheros WiFi Driver Installation
"{82F09B1C-F602-4552-9C40-5BD5F8EAF750}" =
"{8356CB97-A48F-44CB-837A-A12838DC4669}" = PMB VAIO Edition Plug-in
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{855DDD3C-131E-42A8-BCBD-F9581F80CACB}" =
"{869FCC6C-5669-4B0B-827E-2BBAACD88A87}" = Nuance PaperPort 12
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B583EF5-FA7B-4AE2-9008-51B7FD505886}" = VGClientX86
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B088046-8A01-4355-99DD-8530C022F682}" = VCCx86
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D12A8B5-9D41-4465-BF11-70719EB0CD02}" = VU5x86
"{9F6B13E2-B93F-4203-9BD4-5DC18C9F9DEB}" = AIO_CDB_Software
"{9FF95DA2-7DA1-4228-93B7-DED7EC02B6B2}" = VAIO Update
"{A4C5A61B-A61F-40F4-A3A2-029ECD2A14AA}_is1" = Batchmarker version 2.01
"{A7727F03-5311-4A12-9A63-2ACD20BA0497}" = Camtasia Studio 8
"{A7C30414-2382-4086-B0D6-01A88ABA21C3}" = VAIO Gate
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC1EB83A-25B4-487F-8162-050133F7A764}_is1" = NeatMP3 Pro version 1.2.0
"{AC76BA86-7AD7-1033-7B44-AB0000000001}" = Adobe Reader XI (11.0.07)
"{B6A98E5F-D6A7-46FB-9E9D-1F7BF443491C}" = PMB
"{B7546697-2A80-4256-A24B-1C33163F535B}" = VAIO Gate Default
"{B8991D99-88FD-41F2-8C32-DB70278D5C30}" = VWSTx86
"{BD7204BA-DD64-499E-9B55-6A282CDF4FA4}" = Destinations
"{C1594429-8296-4652-BF54-9DBE4932A44C}" = Realtek PCIE Card Reader
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C6E893E7-E5EA-4CD5-917C-5443E753FCBD}" = VAIO Manual
"{C72E35E5-C5C6-4328-AD9A-BBCCC816A2E6}" = VAIO Hardware Diagnostics
"{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
"{D17C2A58-E0EA-4DD7-A2D6-C448FD25B6F6}" = VIx86
"{D7974DCB-8F2F-45C6-93D4-8E3557173724}" = Vole Windows Expedition
"{D9757258-30B2-496E-86F2-84920C5858E1}_is1" = CollageIt 1.9.3
"{DD696AF7-8A89-41D5-976A-2053E41A69BE}" = VAIO - Media Gallery
"{E50FC5DB-7CBD-407D-A46E-0C13E45BC386}" = Oasis2Service
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E82C4598-4C96-4117-B32D-296E1EAF4763}" = Vole Media CHM
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F23B83A2-175A-4C7F-BC81-542DBA41837E}_is1" = Jihosoft Video Converter version 2.3
"{F7E1CA14-B39D-452A-960B-39423DDDD933}" = DriveImage XML (Private Edition)
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"44953928-E730-4e8c-A2B2-3A85BC96A3D0_is1" = FileSeek 3.1.4
"7-Zip" = 7-Zip 9.22beta
"abylonprotectionmanager-exif-cleaner_is1" = abylon EXIF-CLEANER 2014.2 (Privatversion)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 13 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 13 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 12.1
"AI RoboForm" = RoboForm 7-9-7-5 (All Users)
"Android Data Recovery" = Android Data Recovery
"Application Manager for VAIO" = Application Manager for VAIO
"Audio Record Wizard" = Audio Record Wizard
"Avast" = avast! Free Antivirus
"Batch Picture Protector_is1" = Batch Picture Protector 4.1
"Batch Picture Resizer_is1" = Batch Picture Resizer 5.2
"Belarc Advisor" = Belarc Advisor 8.4
"Bulk Rename Utility_is1" = Bulk Rename Utility 2.7.1.2
"DataNumen CAB Repair v2.0" = DataNumen CAB Repair v2.0
"DataNumen PSD Repair v2.0" = DataNumen PSD Repair v2.0
"DataNumen TAR Repair v2.0" = DataNumen TAR Repair v2.0
"Driver Booster_is1" = Driver Booster
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"FileZilla Client" = FileZilla Client 3.8.1
"Folder Scout 1.3.2_is1" = Folder Scout 1.3.2
"Fotosizer" = Fotosizer 2.05
"Glary Utilities 5" = Glary Utilities PRO 5.1
"Google Chrome" = Google Chrome
"Hard Disk Sentinel_is1" = Hard Disk Sentinel
"InstallShield_{270380EB-8812-42E1-8289-53700DB840D2}" = VAIO - PMB VAIO Edition Plug-in
"InstallShield_{339F9B4D-00CB-4C1C-BED8-EC86A9AB602A}" = VAIO - PMB VAIO Edition Guide
"InstallShield_{7C80D30A-AC02-4E3F-B95D-29F0E4FF937B}" = VAIO Easy Connect
"IrfanView" = IrfanView (remove only)
"Kingsoft Office" = Kingsoft Office 2013 (9.1.0.4560)
"Macro Recorder_is1" = Macro Recorder 5.6.5
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.0.2.1012
"Mozilla Firefox 30.0 (x86 en-US)" = Mozilla Firefox 30.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Picture Doctor_is1" = Picture Doctor 2.0
"Quick Notes Plus_is1" = Quick Notes Plus 5.0
"Quick Search" = Quick Search 1.1.0.189
"Remove Logo Now!_is1" = Remove Logo Now! 1.5
"Sketch Drawer_is1" = Sketch Drawer 1.3
"SoftOrbits Photo Retoucher_is1" = SoftOrbits Photo Retoucher 1.4
"SoftSkin Photo Makeup_is1" = SoftSkin Photo Makeup 1.2
"SpeedFan" = SpeedFan (remove only)
"splashtop" = VAIO Quick Web Access
"Tweaking.com - Windows Repair (All in One)" = Tweaking.com - Windows Repair (All in One)
"Unlocker" = Unlocker 1.9.2
"VAIO Health Report1.0" = VAIO Health Report
"VAIO Satisfaction Survey.3.0" = VAIO Satisfaction Survey.
"Video Watermark Maker_is1" = Video Watermark Maker 1.1
"WinX HD Video Converter Deluxe_is1" = WinX HD Video Converter Deluxe 5.0.4
"WinX Mobile Video Converter_is1" = WinX Mobile Video Converter 4.0.0
"Yankee Clipper III" = Yankee Clipper III
"yowindow" = YoWindow
"Zortam Mp3 Media Studio_is1" = Zortam Mp3 Media Studio 17.15

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-679210397-2375353738-1777670786-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Flux" = f.lux
"HDVideoConverterFactoryPro" = HD Video Converter Factory Pro
"Screencast-O-Matic" = Screencast-O-Matic
"uRexDVDRipperPlatinum" = uRex DVD Ripper Platinum
"uRexWatermarkPlatinum" = uRex Watermark Platinum
"WatermarkSoftware" = Watermark Software

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 6/13/2014 5:06:53 AM | Computer Name = MY-VAIO | Source = Windows Search Service | ID = 7040
Description = The search service has detected corrupted data files in the index
{id=3800}. The service will attempt to automatically correct this problem by rebuilding
the index. Context: Windows Application, SystemIndex Catalog Details: The content
index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

Error - 6/13/2014 5:06:53 AM | Computer Name = MY-VAIO | Source = Windows Search Service | ID = 7042
Description = The Windows Search Service is being stopped because there is a problem
with the indexer: The catalog is corrupt. Context: Windows Application, SystemIndex
Catalog Details: The content index catalog is corrupt. (HRESULT : 0xc0041801) (0xc0041801)

[ ESRV_SVC Events ]
Error - 6/8/2014 4:06:38 PM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/8/2014 10:29:08 PM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/9/2014 4:36:01 PM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/10/2014 5:19:18 PM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/10/2014 8:04:51 PM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/10/2014 8:08:30 PM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/11/2014 1:50:01 AM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/11/2014 2:47:41 PM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/12/2014 6:01:03 AM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

Error - 6/13/2014 4:37:57 AM | Computer Name = MY-VAIO | Source = ESRV_SVC | ID = 2
Description =

[ USER_ESRV_SVC Events ]
Error - 4/8/2014 5:27:19 AM | Computer Name = MY-VAIO | Source = USER_ESRV_SVC | ID = 2
Description =

< End of report >

broni · 2014/06/13

Run OTL

Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll File not found
O8:64bit: - Extra context menu item: Customize Menu - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html File not found
O8:64bit: - Extra context menu item: Fill Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html File not found
O8:64bit: - Extra context menu item: Password Generator - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComPasswordGenerator.html File not found
O8:64bit: - Extra context menu item: RoboForm Editor - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComEditIdent.html File not found
O8:64bit: - Extra context menu item: Save Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html File not found
O8:64bit: - Extra context menu item: Show RoboForm Toolbar - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html File not found
O8 - Extra context menu item: Customize Menu - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComCustomizeIEMenu.html File not found
O8 - Extra context menu item: Fill Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComFillForms.html File not found
O8 - Extra context menu item: Password Generator - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComPasswordGenerator.html File not found
O8 - Extra context menu item: RoboForm Editor - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComEditIdent.html File not found
O8 - Extra context menu item: Save Forms - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComSavePass.html File not found
O8 - Extra context menu item: Show RoboForm Toolbar - file://C:/Program Files (x86)/Roboform 8-5-13/RoboFormComShowToolbar.html File not found


:Services

:Reg

:Files
C:\FRST

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.

NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

Last scans...

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services

Windows Firewall

System Restore

Security Center

Windows Update

Windows Defender

Other Services

Press "Scan ".

It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Click on "Run ESET Online Scanner" button.

Tick the box next to YES, I accept the Terms of Use

Click Start

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, click on List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

malady · 2014/06/13

Eset

This was my kid's computer and had some software hacks on it. I ran a full ESET twice. The first time it showed these threats and then a weeks ago a full scan showed it was clean.

Think it has a lot of false positives as it even showed CCleaner as a trojan and a variant of Themida which is software protection that gets falsely flagged as I researched it and wrote the company who trademarked "Themida ".

Thought you should know that another guy there was no way to guarantee this PC would ever be clean without a full reinstall. Its this the case? I'll work on the other scans. Thx.
---------------------------------

C:\$RECYCLE.BIN\S-1-5-21-679210397-2375353738-1777670786-1005\$RWPXKME\SpyBHORemover\Setup_SpyBHORemover.exe a variant of Win32/SecurityXploded.A potentially unsafe application deleted - quarantined
C:\Program Files (x86)\CCleaner\ccsetup406.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Program Files (x86)\CCleaner\ccsetup407.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Program Files (x86)\CCleaner\ccsetup408.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Program Files (x86)\Defraggler\dfsetup215.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Program Files (x86)\Defraggler\dfsetup216.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Program Files (x86)\Merge PDF 4-12-14\cbsidlm-cbsi188-TR_MergePDFs-SEO-76054637.exe a variant of Win32/CNETInstaller.B potentially unwanted application deleted - quarantined
C:\Program Files (x86)\Speccy\spsetup123.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Users\MY\Documents\BHO Spy Remover\Setup_SpyBHORemover.exe a variant of Win32/SecurityXploded.A potentially unsafe application deleted - quarantined
C:\Users\MY\Documents\BHO Spy Remover\Portable Version\SpyBHORemover.exe a variant of Win32/SecurityXploded.A potentially unsafe application deleted - quarantined
C:\Users\MY\Documents\Firefox\Firefox Downloads 4-29-13\KR-LiteAndPro.zip PHP/Obfuscated.B potentially unwanted application deleted - quarantined
C:\Users\MY\Documents\Samsung Printer 2165W 11-22-12\reset firmware downloads 8-3-13\Samsung-chip-ML-2165W_V3.00.01.06-reset.rar a variant of Win32/OpenInstall potentially unwanted application deleted - quarantined
C:\Users\MY\Documents\Samsung Printer 2165W 11-22-12\reset firmware downloads 8-3-13\SamsungUniversalPrinterDriver203090041.rar a variant of Win32/OpenInstall potentially unwanted application deleted - quarantined
C:\Users\MY\Downloads\CCleaner_v4.12.4657.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Users\MY\Downloads\ccsetup413.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Users\MY\Downloads\ccsetup414.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Users\MY\Downloads\dfsetup218.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Users\MY\Downloads\spsetup125.exe Win32/Bundled.Toolbar.Google.D potentially unsafe application deleted - quarantined
C:\Windows\Installer\6caa47.msi a variant of Win32/Bundled.Toolbar.Ask potentially unsafe application deleted - quarantined
E:\Best Of Cracks-Programs 10-13-13\Best of Freebies-Best Blackhat Forum 10-13-13\Tube Raider\TubeRaider1.8.zip a variant of Win32/Packed.Themida.AAL trojan deleted - quarantined
E:\Best Of Cracks-Programs 10-13-13\Best of Freebies-Best Blackhat Forum 10-13-13\Tube Raider\TubeRaider1.8\SlideshowVideoMaker.exe a variant of Win32/Packed.Themida.AAL trojan cleaned by deleting - quarantined
E:\Best Of Cracks-Programs 10-13-13\Best of Freebies-Best Blackhat Forum 10-13-13\Tube Raider 4-15-13\TubeRaider1.8.zip a variant of Win32/Packed.Themida.AAL trojan deleted - quarantined
E:\Best Of Cracks-Programs 10-13-13\Best of Freebies-Best Blackhat Forum 10-13-13\Tube Raider 4-15-13\TubeRaider1.8\SlideshowVideoMaker.exe a variant of Win32/Packed.Themida.AAL trojan cleaned by deleting - quarantined
E:\Best Of Cracks-Programs 10-13-13\Best of Freebies-Best Blackhat Forum 10-13-13\WebHarvy 9-14-13\WebHarvy.exe a variant of Win32/Packed.Themida.AAG trojan cleaned by deleting - quarantined
E:\Best Of Cracks-Programs 10-13-13\Best of Freebies-Best Blackhat Forum 10-13-13\WebHarvy 9-14-13\WebHarvy.rar a variant of Win32/Packed.Themida.AAG trojan deleted - quarantined
E:\Best Of Cracks-Programs 10-13-13\Ebay Download 1000 Websites 11-7-13\1000 Websites.7z PHP/Obfuscated.F potentially unwanted application deleted - quarantined
E:\Best Of Cracks-Programs 10-13-13\Ebay Download 1000 Websites 11-7-13\1000 Websites\Turnkey_Package_Part_6.zip PHP/Obfuscated.F potentially unwanted application deleted - quarantined
E:\Best Of Cracks-Programs 10-13-13\Ebay Download 1000 Websites 11-7-13\Turnkey_Package_Part_6\Turnkey_Package_Part_6\Turnkey_part6\E-Gold_Money_Games.zip PHP/Obfuscated.F potentially unwanted application deleted - quarantined
E:\Best Of Cracks-Programs 10-13-13\Ebooks 10-7-13\Amazon Niche Finder- 4-14-13\Amazon Niche Finder-1.1c.rar a variant of Win32/Packed.Themida.AAG trojan deleted - quarantined

malady · 2014/06/13

OTL Fix

All processes killed
Error: Unable to interpret <Code:> in the current context!
========== OTL ==========
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Customize Menu\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Fill Forms\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Password Generator\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\RoboForm Editor\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save Forms\ deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Show RoboForm Toolbar\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Customize Menu\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Fill Forms\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Password Generator\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\RoboForm Editor\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Save Forms\ not found.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Show RoboForm Toolbar\ not found.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\FRST not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator.WORKGROUP
->Temp folder emptied: 0 bytes

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 57311 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Justin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 170635 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 23545566 bytes
->Google Chrome cache emptied: 9845343 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes

User: MY
->Temp folder emptied: 7598 bytes
->Temporary Internet Files folder emptied: 83069 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 7726910 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 506 bytes

User: NetworkService
->Temp folder emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 3174 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 128 bytes
%systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 0 bytes
RecycleBin emptied: 104580 bytes

Total Files Cleaned = 40.00 mb

[EMPTYJAVA]

User: Administrator.WORKGROUP

User: All Users

User: Default

User: Default User

User: Justin
->Java cache emptied: 0 bytes

User: LocalService

User: MY
->Java cache emptied: 0 bytes

User: NetworkService

User: Public

Total Java Files Cleaned = 0.00 mb

[EMPTYFLASH]

User: Administrator.WORKGROUP

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Justin
->Flash cache emptied: 0 bytes

User: LocalService

User: MY
->Flash cache emptied: 0 bytes

User: NetworkService

User: Public

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.69.0 log created on 06132014_211144

Files\Folders moved on Reboot...
File\Folder C:\Users\MY\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File move failed. C:\Users\MY\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat scheduled to be moved on reboot.
File move failed. C:\Windows\temp\_avast_\AvastLock.txt scheduled to be moved on reboot.
C:\Windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

malady · 2014/06/14

Sec Check-Farbar

Results of screen317's Security Check version 0.99.84
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 11
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
avast! Antivirus
Antivirus out of date!
`````````Anti-malware/Other Utilities Check:`````````
abylon EXIF-CLEANER 2014.2 (Privatversion)
Java 7 Update 55
Java version out of Date!
Adobe Flash Player 13.0.0.214
Adobe Reader XI
Mozilla Firefox (30.0)
Google Chrome 35.0.1916.114
Google Chrome 35.0.1916.153
````````Process Check: objlist.exe by Laurent````````
Avast Free 2014 Reinstall 2-22-14 AvastSvc.exe
Avast Free 2014 Reinstall 2-22-14 AvastUI.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: 0%
````````````````````End of Log``````````````````````

Farbar Service Scanner Version: 10-06-2014
Ran by MY (administrator) on 14-06-2014 at 06:21:29
Running from "C:\Users\MY\Desktop "
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => File is digitally signed
C:\Windows\System32\drivers\nsiproxy.sys => File is digitally signed
C:\Windows\System32\dhcpcore.dll => File is digitally signed
C:\Windows\System32\drivers\afd.sys => File is digitally signed
C:\Windows\System32\drivers\tdx.sys => File is digitally signed
C:\Windows\System32\Drivers\tcpip.sys => File is digitally signed
C:\Windows\System32\dnsrslvr.dll => File is digitally signed
C:\Windows\System32\mpssvc.dll => File is digitally signed
C:\Windows\System32\bfe.dll => File is digitally signed
C:\Windows\System32\drivers\mpsdrv.sys => File is digitally signed
C:\Windows\System32\SDRSVC.dll => File is digitally signed
C:\Windows\System32\vssvc.exe => File is digitally signed
C:\Windows\System32\wscsvc.dll => File is digitally signed
C:\Windows\System32\wbem\WMIsvc.dll => File is digitally signed
C:\Windows\System32\wuaueng.dll => File is digitally signed
C:\Windows\System32\qmgr.dll => File is digitally signed
C:\Windows\System32\es.dll => File is digitally signed
C:\Windows\System32\cryptsvc.dll => File is digitally signed
C:\Program Files\Windows Defender\MpSvc.dll => File is digitally signed
C:\Windows\System32\ipnathlp.dll => File is digitally signed
C:\Windows\System32\iphlpsvc.dll => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed

**** End of log ****

TFC Found 10MB of files

Log in or Sign up

Solved Multiple Windows Loading Among Other Oddities

malady Inactive Thread Starter

PeteC SuperGeek Staff

malady Inactive Thread Starter

broni Moderator Malware Analyst

PeteC SuperGeek Staff

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

Share This Page

Log in or Sign up

Solved Multiple Windows Loading Among Other Oddities

malady Inactive Thread Starter

PeteC SuperGeek Staff

malady Inactive Thread Starter

broni Moderator Malware Analyst

PeteC SuperGeek Staff

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

broni Moderator Malware Analyst

malady Inactive Thread Starter

malady Inactive Thread Starter

malady Inactive Thread Starter

Share This Page

Useful Searches