1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Possible malware virus

Discussion in 'Malware and Virus Removal Archive' started by franbiaggi, 2014/04/27.

  1. 2014/04/27
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    [Solved] Possible malware virus

    Hi,

    I just bought a brand new Thinkpad. In the Levono Solution Center, I have a message that one of the drivers have a problem.

    Driver: qkfnd

    I have Norton Antivirus that came with the Thinkpad, and I bought Malwarebytes. I ran a Malwarebytes scan and here is the log:

    alwarebytes Anti-Malware (PRO) 1.75.0.1300
    www.malwarebytes.org

    Database version: v2014.04.27.03

    Thank you
    Fran

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 11.0.9600.17041
    Fran :: FRANCES [administrator]

    Protection: Enabled

    4/27/2014 8:05:33 AM
    mbam-log-2014-04-27 (08-05-33).txt

    Scan type: Full scan (C:\|Q:\|)
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 378041
    Time elapsed: 43 minute(s), 33 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 9
    HKCR\CLSID\{D40753C7-8A59-4C1F-BE88-C300F4624D5B} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.
    HKCR\TypeLib\{C292AD0A-C11F-479B-B8DB-743E72D283B0} (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.
    HKCR\esrv.mysearchdialESrvc.1 (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.
    HKCR\esrv.mysearchdialESrvc (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.
    HKCU\Software\mysearchdial.com (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.
    HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\QUIKNOWLEDGE (PUP.Optional.Quiknowledge.A) -> Quarantined and deleted successfully.
    HKLM\SYSTEM\CurrentControlSet\Services\Update BrowseMark (PUP.Optional.BrowseMark.A) -> Quarantined and deleted successfully.

    Registry Values Detected: 3
    HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: 0T1B1G1H1J1L1E1K1U1S -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Mozilla\Firefox\Extensions|quiknowledge@quiknowledge.com (PUP.Optional.Quiknowledge.A) -> Data: C:\Program Files (x86)\Mozilla Firefox\extensions\quiknowledge@quiknowledge.com -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Quiknowledge|ie-ver (PUP.Optional.Quiknowledge.A) -> Data: 11.0.9600.16659 -> Quarantined and deleted successfully.

    Registry Data Items Detected: 2
    HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.MySearchDial.A) -> Bad: (http://start.mysearchdial.com/?f=1&...GyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=) Good: (http://www.google.com) -> Quarantined and repaired successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Start Page (PUP.Optional.MySearchDial.A) -> Bad: (http://start.mysearchdial.com/?f=1&...GyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=) Good: (http://www.google.com) -> Quarantined and repaired successfully.

    Folders Detected: 2
    C:\Users\Fran\AppData\Roaming\mysearchdial (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.
    C:\Users\Fran\AppData\Roaming\mysearchdial\icons_2.20.1.0 (PUP.Optional.MySearchDial.A) -> Quarantined and deleted successfully.

    Files Detected: 2
    C:\Users\Fran\AppData\Local\Temp\ICReinstall_PhotoScape_Setup.exe (PUP.Optional.InstallCore) -> Quarantined and deleted successfully.
    C:\Users\Fran\Downloads\pdf_14395_stf_2.exe (PUP.Optional.InstallIQ) -> Quarantined and deleted successfully.

    (end)
     
  2. 2014/04/27
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,889
    Likes Received:
    386
    Welcome to WindowsBBS :)

    As you will see more than the Malwarebytes log is required.

    Please be aware of the following ......

     

  3. to hide this advert.

  4. 2014/04/28
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Hi sorry new to this. I ran the DDS which is below. Do you want me to run another malwarebyte scan? Thank you for your help.

    NLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 4/11/2014 12:46:11 AM
    System Uptime: 4/27/2014 8:56:58 AM (23 hours ago)
    .
    Motherboard: LENOVO | | 20ANCTO1WW
    Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz | CPU Socket - U3E1 | 2401/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 449 GiB total, 385.439 GiB free.
    D: is CDROM ()
    E: is FIXED (NTFS) - 931 GiB total, 918.598 GiB free.
    Q: is FIXED (NTFS) - 15 GiB total, 3.527 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: qknfd
    Device ID: ROOT\LEGACY_QKNFD\0000
    Manufacturer:
    Name: qknfd
    PNP Device ID: ROOT\LEGACY_QKNFD\0000
    Service: qknfd
    .
    ==== System Restore Points ===================
    .
    RP20: 4/26/2014 10:49:44 AM - WD SmartWare Installer
    RP21: 4/27/2014 9:01:06 AM - Windows Update
    .
    ==== Installed Programs ======================
    .
    PowerDVD Create 10
    64 Bit HP CIO Components Installer
    Adobe AIR
    Adobe Flash Player 13 Plugin
    Adobe Photoshop Elements 11
    Adobe Reader XI (11.0.06)
    Akamai NetSession Interface
    Create Recovery Media
    CyberLink Power2Go 7
    CyberLink PowerDVD 10
    CyberLink PowerProducer 5.5
    Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7/8
    Dolby Advanced Audio v2
    Elements 11 Organizer
    Google Update Helper
    HP LaserJet Professional CP1520 Series
    HP LaserJet Professional P1100-P1560-P1600 Series
    HP Update
    HPLaserJetHelp_LearnCenter
    HPLJUT
    hppCP1520LaserJetService
    hppLaserJetService
    hppP1100P1560P1600SeriesLaserJetService
    hppTLBXFXCP1520
    hppusgP1100P1560P1600Series
    HPSSupply
    hpzTLBXFX
    Inst5676
    Integrated Camera
    Intel(R) Management Engine Components
    Intel(R) PRO/Wireless Driver
    Intel(R) Processor Graphics
    Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1335.3)
    Intel(R) SDK for OpenCL - CPU Only Runtime Package
    Intel(R) Smart Connect Technology 4.1 x64
    Intel(R) Update Manager
    Intel(R) USB 3.0 eXtensible Host Controller Driver
    Intel(R) WiDi
    Intel® PROSet/Wireless Software
    Intel® PROSet/Wireless WiFi Software
    Intel® Trusted Connect Service Client
    Lenovo Auto Scroll Utility
    Lenovo Fingerprint Manager Pro
    Lenovo Patch Utility
    Lenovo Patch Utility 64 bit
    Lenovo Power Management Driver
    Lenovo QuickCast
    Lenovo QuickControl
    Lenovo Registration
    Lenovo Solution Center
    Lenovo System Update
    Lenovo User Guide
    Lenovo Warranty Information
    Lenovo Welcome
    Malwarebytes Anti-Malware version 1.75.0.1300
    MarketResearch
    Message Center Plus
    Microsoft .NET Framework 4.5.1
    Microsoft Office Home and Student 2013 - en-us
    Microsoft SkyDrive
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Mozilla Firefox 28.0 (x86 en-US)
    Mozilla Maintenance Service
    Multifactor Authentication Client
    Nitro Pro 8
    Norton Internet Security
    Office 15 Click-to-Run Extensibility Component
    Office 15 Click-to-Run Licensing Component
    Office 15 Click-to-Run Localization Component
    On Screen Display
    PhotoScape
    Power Manager
    PowerDVD Create
    PSE11 STI Installer
    RapidBoot HDD Accelerator
    Realtek Card Reader
    Realtek High Definition Audio Driver
    Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    SoapMaker3
    SugarSync Manager
    ThinkPad UltraNav Driver
    ThinkVantage Active Protection System
    ThinkVantage Communications Utility
    Validity WBF DDK 5011
    WaveEditor
    WD Drive Utilities
    WD Quick View
    WD Security
    WD SmartWare
    WD SmartWare Installer
    Windows Driver Package - Intel (e1dexpress) Net (05/06/2013 12.6.51.9427)
    Windows Driver Package - Intel Corporation (iaStorA) HDC (08/01/2013 12.8.0.1016)
    Windows Driver Package - Lenovo 1.67.00.02 (04/17/2013 1.67.00.02)
    Windows Driver Package - Synaptics (SmbDrv) System (12/17/2013 17.0.12.60)
    Windows Driver Package - Synaptics (SynTP) Mouse (12/17/2013 17.0.12.60)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    4/28/2014 6:55:26 AM, Error: Service Control Manager [7000] - The pcicsa.sys service failed to start due to the following error: The system cannot find the file specified.
    4/27/2014 8:57:25 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: qknfd
    4/27/2014 8:57:12 AM, Error: Service Control Manager [7000] - The Lenovo Fingerprint Manager Pro Cachedrv Service service failed to start due to the following error: The system cannot find the file specified.
    4/26/2014 11:44:01 AM, Error: Service Control Manager [7000] - The Update BrowseMark service failed to start due to the following error: The system cannot find the file specified.
    4/26/2014 10:43:22 AM, Error: volsnap [25] - The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
    4/21/2014 8:48:40 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR3.
    .
    ==== End Of File ===========================
     
  5. 2014/04/28
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,889
    Likes Received:
    386
    The Malwarebytes log should be fine, but we require both the DDS logs - DDS.txt & Attach.txt.
     
  6. 2014/04/28
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Is this it?

    NLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 4/11/2014 12:46:11 AM
    System Uptime: 4/27/2014 8:56:58 AM (33 hours ago)
    .
    Motherboard: LENOVO | | 20ANCTO1WW
    Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz | CPU Socket - U3E1 | 2401/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 449 GiB total, 386.028 GiB free.
    D: is CDROM ()
    E: is FIXED (NTFS) - 931 GiB total, 918.483 GiB free.
    Q: is FIXED (NTFS) - 15 GiB total, 3.527 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: qknfd
    Device ID: ROOT\LEGACY_QKNFD\0000
    Manufacturer:
    Name: qknfd
    PNP Device ID: ROOT\LEGACY_QKNFD\0000
    Service: qknfd
    .
    ==== System Restore Points ===================
    .
    RP20: 4/26/2014 10:49:44 AM - WD SmartWare Installer
    RP21: 4/27/2014 9:01:06 AM - Windows Update
    .
    ==== Installed Programs ======================
    .
    PowerDVD Create 10
    64 Bit HP CIO Components Installer
    Adobe AIR
    Adobe Flash Player 13 Plugin
    Adobe Photoshop Elements 11
    Adobe Reader XI (11.0.06)
    Akamai NetSession Interface
    Create Recovery Media
    CyberLink Power2Go 7
    CyberLink PowerDVD 10
    CyberLink PowerProducer 5.5
    Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7/8
    Dolby Advanced Audio v2
    Elements 11 Organizer
    Google Update Helper
    HP LaserJet Professional CP1520 Series
    HP LaserJet Professional P1100-P1560-P1600 Series
    HP Update
    HPLaserJetHelp_LearnCenter
    HPLJUT
    hppCP1520LaserJetService
    hppLaserJetService
    hppP1100P1560P1600SeriesLaserJetService
    hppTLBXFXCP1520
    hppusgP1100P1560P1600Series
    HPSSupply
    hpzTLBXFX
    Inst5676
    Integrated Camera
    Intel(R) Management Engine Components
    Intel(R) PRO/Wireless Driver
    Intel(R) Processor Graphics
    Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1335.3)
    Intel(R) SDK for OpenCL - CPU Only Runtime Package
    Intel(R) Smart Connect Technology 4.1 x64
    Intel(R) Update Manager
    Intel(R) USB 3.0 eXtensible Host Controller Driver
    Intel(R) WiDi
    Intel® PROSet/Wireless Software
    Intel® PROSet/Wireless WiFi Software
    Intel® Trusted Connect Service Client
    Lenovo Auto Scroll Utility
    Lenovo Fingerprint Manager Pro
    Lenovo Patch Utility
    Lenovo Patch Utility 64 bit
    Lenovo Power Management Driver
    Lenovo QuickCast
    Lenovo QuickControl
    Lenovo Registration
    Lenovo Solution Center
    Lenovo System Update
    Lenovo User Guide
    Lenovo Warranty Information
    Lenovo Welcome
    Malwarebytes Anti-Malware version 1.75.0.1300
    MarketResearch
    Message Center Plus
    Microsoft .NET Framework 4.5.1
    Microsoft Office Home and Student 2013 - en-us
    Microsoft SkyDrive
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Mozilla Firefox 28.0 (x86 en-US)
    Mozilla Maintenance Service
    Multifactor Authentication Client
    Nitro Pro 8
    Norton Internet Security
    Office 15 Click-to-Run Extensibility Component
    Office 15 Click-to-Run Licensing Component
    Office 15 Click-to-Run Localization Component
    On Screen Display
    PhotoScape
    Power Manager
    PowerDVD Create
    PSE11 STI Installer
    RapidBoot HDD Accelerator
    Realtek Card Reader
    Realtek High Definition Audio Driver
    Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    SoapMaker3
    SugarSync Manager
    ThinkPad UltraNav Driver
    ThinkVantage Active Protection System
    ThinkVantage Communications Utility
    Validity WBF DDK 5011
    WaveEditor
    WD Drive Utilities
    WD Quick View
    WD Security
    WD SmartWare
    WD SmartWare Installer
    Windows Driver Package - Intel (e1dexpress) Net (05/06/2013 12.6.51.9427)
    Windows Driver Package - Intel Corporation (iaStorA) HDC (08/01/2013 12.8.0.1016)
    Windows Driver Package - Lenovo 1.67.00.02 (04/17/2013 1.67.00.02)
    Windows Driver Package - Synaptics (SmbDrv) System (12/17/2013 17.0.12.60)
    Windows Driver Package - Synaptics (SynTP) Mouse (12/17/2013 17.0.12.60)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    4/28/2014 6:55:26 AM, Error: Service Control Manager [7000] - The pcicsa.sys service failed to start due to the following error: The system cannot find the file specified.
    4/28/2014 12:09:36 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
    4/27/2014 8:57:25 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: qknfd
    4/27/2014 8:57:12 AM, Error: Service Control Manager [7000] - The Lenovo Fingerprint Manager Pro Cachedrv Service service failed to start due to the following error: The system cannot find the file specified.
    4/26/2014 11:44:01 AM, Error: Service Control Manager [7000] - The Update BrowseMark service failed to start due to the following error: The system cannot find the file specified.
    4/26/2014 10:43:22 AM, Error: volsnap [25] - The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
    4/21/2014 8:48:40 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR3.
    .
    ==== End Of File ===========================
     
  7. 2014/04/28
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    NLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 4/11/2014 12:46:11 AM
    System Uptime: 4/27/2014 8:56:58 AM (33 hours ago)
    .
    Motherboard: LENOVO | | 20ANCTO1WW
    Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz | CPU Socket - U3E1 | 2401/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 449 GiB total, 386.028 GiB free.
    D: is CDROM ()
    E: is FIXED (NTFS) - 931 GiB total, 918.483 GiB free.
    Q: is FIXED (NTFS) - 15 GiB total, 3.527 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: qknfd
    Device ID: ROOT\LEGACY_QKNFD\0000
    Manufacturer:
    Name: qknfd
    PNP Device ID: ROOT\LEGACY_QKNFD\0000
    Service: qknfd
    .
    ==== System Restore Points ===================
    .
    RP20: 4/26/2014 10:49:44 AM - WD SmartWare Installer
    RP21: 4/27/2014 9:01:06 AM - Windows Update
    .
    ==== Installed Programs ======================
    .
    PowerDVD Create 10
    64 Bit HP CIO Components Installer
    Adobe AIR
    Adobe Flash Player 13 Plugin
    Adobe Photoshop Elements 11
    Adobe Reader XI (11.0.06)
    Akamai NetSession Interface
    Create Recovery Media
    CyberLink Power2Go 7
    CyberLink PowerDVD 10
    CyberLink PowerProducer 5.5
    Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7/8
    Dolby Advanced Audio v2
    Elements 11 Organizer
    Google Update Helper
    HP LaserJet Professional CP1520 Series
    HP LaserJet Professional P1100-P1560-P1600 Series
    HP Update
    HPLaserJetHelp_LearnCenter
    HPLJUT
    hppCP1520LaserJetService
    hppLaserJetService
    hppP1100P1560P1600SeriesLaserJetService
    hppTLBXFXCP1520
    hppusgP1100P1560P1600Series
    HPSSupply
    hpzTLBXFX
    Inst5676
    Integrated Camera
    Intel(R) Management Engine Components
    Intel(R) PRO/Wireless Driver
    Intel(R) Processor Graphics
    Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1335.3)
    Intel(R) SDK for OpenCL - CPU Only Runtime Package
    Intel(R) Smart Connect Technology 4.1 x64
    Intel(R) Update Manager
    Intel(R) USB 3.0 eXtensible Host Controller Driver
    Intel(R) WiDi
    Intel® PROSet/Wireless Software
    Intel® PROSet/Wireless WiFi Software
    Intel® Trusted Connect Service Client
    Lenovo Auto Scroll Utility
    Lenovo Fingerprint Manager Pro
    Lenovo Patch Utility
    Lenovo Patch Utility 64 bit
    Lenovo Power Management Driver
    Lenovo QuickCast
    Lenovo QuickControl
    Lenovo Registration
    Lenovo Solution Center
    Lenovo System Update
    Lenovo User Guide
    Lenovo Warranty Information
    Lenovo Welcome
    Malwarebytes Anti-Malware version 1.75.0.1300
    MarketResearch
    Message Center Plus
    Microsoft .NET Framework 4.5.1
    Microsoft Office Home and Student 2013 - en-us
    Microsoft SkyDrive
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Mozilla Firefox 28.0 (x86 en-US)
    Mozilla Maintenance Service
    Multifactor Authentication Client
    Nitro Pro 8
    Norton Internet Security
    Office 15 Click-to-Run Extensibility Component
    Office 15 Click-to-Run Licensing Component
    Office 15 Click-to-Run Localization Component
    On Screen Display
    PhotoScape
    Power Manager
    PowerDVD Create
    PSE11 STI Installer
    RapidBoot HDD Accelerator
    Realtek Card Reader
    Realtek High Definition Audio Driver
    Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    SoapMaker3
    SugarSync Manager
    ThinkPad UltraNav Driver
    ThinkVantage Active Protection System
    ThinkVantage Communications Utility
    Validity WBF DDK 5011
    WaveEditor
    WD Drive Utilities
    WD Quick View
    WD Security
    WD SmartWare
    WD SmartWare Installer
    Windows Driver Package - Intel (e1dexpress) Net (05/06/2013 12.6.51.9427)
    Windows Driver Package - Intel Corporation (iaStorA) HDC (08/01/2013 12.8.0.1016)
    Windows Driver Package - Lenovo 1.67.00.02 (04/17/2013 1.67.00.02)
    Windows Driver Package - Synaptics (SmbDrv) System (12/17/2013 17.0.12.60)
    Windows Driver Package - Synaptics (SynTP) Mouse (12/17/2013 17.0.12.60)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    4/28/2014 6:55:26 AM, Error: Service Control Manager [7000] - The pcicsa.sys service failed to start due to the following error: The system cannot find the file specified.
    4/28/2014 12:09:36 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
    4/27/2014 8:57:25 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: qknfd
    4/27/2014 8:57:12 AM, Error: Service Control Manager [7000] - The Lenovo Fingerprint Manager Pro Cachedrv Service service failed to start due to the following error: The system cannot find the file specified.
    4/26/2014 11:44:01 AM, Error: Service Control Manager [7000] - The Update BrowseMark service failed to start due to the following error: The system cannot find the file specified.
    4/26/2014 10:43:22 AM, Error: volsnap [25] - The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
    4/21/2014 8:48:40 AM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR3.
    .
    ==== End Of File ===========================
     
  8. 2014/04/29
    PeteC

    PeteC SuperGeek Staff

    Joined:
    2002/05/10
    Messages:
    28,889
    Likes Received:
    386
    You have posted the DDS.txt 3 times - you should also have an Attach.txt .....

    Although I am not the Malware analyst on the forum looking at your DDS log your issue may well be .....

    Check out Device Manager.
     
  9. 2014/04/29
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Ok, here is the attach file. At least that's what is on my desktop. Ir looks to me like the DDS. Thank you.

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 4/11/2014 12:46:11 AM
    System Uptime: 4/27/2014 8:56:58 AM (57 hours ago)
    .
    Motherboard: LENOVO | | 20ANCTO1WW
    Processor: Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz | CPU Socket - U3E1 | 2401/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 449 GiB total, 383.724 GiB free.
    D: is CDROM ()
    E: is FIXED (NTFS) - 931 GiB total, 761.675 GiB free.
    Q: is FIXED (NTFS) - 15 GiB total, 3.527 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
    Description: qknfd
    Device ID: ROOT\LEGACY_QKNFD\0000
    Manufacturer:
    Name: qknfd
    PNP Device ID: ROOT\LEGACY_QKNFD\0000
    Service: qknfd
    .
    ==== System Restore Points ===================
    .
    RP20: 4/26/2014 10:49:44 AM - WD SmartWare Installer
    RP21: 4/27/2014 9:01:06 AM - Windows Update
    RP22: 4/29/2014 7:28:26 AM - Windows Backup
    .
    ==== Installed Programs ======================
    .
    PowerDVD Create 10
    64 Bit HP CIO Components Installer
    Adobe AIR
    Adobe Flash Player 13 Plugin
    Adobe Photoshop Elements 11
    Adobe Reader XI (11.0.06)
    Akamai NetSession Interface
    Create Recovery Media
    CyberLink Power2Go 7
    CyberLink PowerDVD 10
    CyberLink PowerProducer 5.5
    Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7/8
    Dolby Advanced Audio v2
    Elements 11 Organizer
    Google Update Helper
    HP LaserJet Professional CP1520 Series
    HP LaserJet Professional P1100-P1560-P1600 Series
    HP Update
    HPLaserJetHelp_LearnCenter
    HPLJUT
    hppCP1520LaserJetService
    hppLaserJetService
    hppP1100P1560P1600SeriesLaserJetService
    hppTLBXFXCP1520
    hppusgP1100P1560P1600Series
    HPSSupply
    hpzTLBXFX
    Inst5676
    Integrated Camera
    Intel(R) Management Engine Components
    Intel(R) PRO/Wireless Driver
    Intel(R) Processor Graphics
    Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology(patch version 3.0.1335.3)
    Intel(R) SDK for OpenCL - CPU Only Runtime Package
    Intel(R) Smart Connect Technology 4.1 x64
    Intel(R) Update Manager
    Intel(R) USB 3.0 eXtensible Host Controller Driver
    Intel(R) WiDi
    Intel® PROSet/Wireless Software
    Intel® PROSet/Wireless WiFi Software
    Intel® Trusted Connect Service Client
    Lenovo Auto Scroll Utility
    Lenovo Fingerprint Manager Pro
    Lenovo Patch Utility
    Lenovo Patch Utility 64 bit
    Lenovo Power Management Driver
    Lenovo QuickCast
    Lenovo QuickControl
    Lenovo Registration
    Lenovo Solution Center
    Lenovo System Update
    Lenovo User Guide
    Lenovo Warranty Information
    Lenovo Welcome
    Malwarebytes Anti-Malware version 1.75.0.1300
    MarketResearch
    Message Center Plus
    Microsoft .NET Framework 4.5.1
    Microsoft Office Home and Student 2013 - en-us
    Microsoft SkyDrive
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
    Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
    Mozilla Firefox 28.0 (x86 en-US)
    Mozilla Maintenance Service
    Multifactor Authentication Client
    Nitro Pro 8
    Norton Internet Security
    Office 15 Click-to-Run Extensibility Component
    Office 15 Click-to-Run Licensing Component
    Office 15 Click-to-Run Localization Component
    On Screen Display
    PhotoScape
    Power Manager
    PowerDVD Create
    PSE11 STI Installer
    RapidBoot HDD Accelerator
    Realtek Card Reader
    Realtek High Definition Audio Driver
    Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7
    Security Update for Microsoft .NET Framework 4.5.1 (KB2898869)
    Security Update for Microsoft .NET Framework 4.5.1 (KB2901126)
    SoapMaker3
    SugarSync Manager
    ThinkPad UltraNav Driver
    ThinkVantage Active Protection System
    ThinkVantage Communications Utility
    Validity WBF DDK 5011
    WaveEditor
    WD Drive Utilities
    WD Quick View
    WD Security
    WD SmartWare
    WD SmartWare Installer
    Windows Driver Package - Intel (e1dexpress) Net (05/06/2013 12.6.51.9427)
    Windows Driver Package - Intel Corporation (iaStorA) HDC (08/01/2013 12.8.0.1016)
    Windows Driver Package - Lenovo 1.67.00.02 (04/17/2013 1.67.00.02)
    Windows Driver Package - Synaptics (SmbDrv) System (12/17/2013 17.0.12.60)
    Windows Driver Package - Synaptics (SynTP) Mouse (12/17/2013 17.0.12.60)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    4/29/2014 8:15:47 AM, Error: Service Control Manager [7000] - The pcicsa.sys service failed to start due to the following error: The system cannot find the file specified.
    4/29/2014 6:57:07 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the LENOVO.CAMMUTE service.
    4/28/2014 5:43:55 PM, Error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\DR1.
    4/27/2014 8:57:25 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: qknfd
    4/27/2014 8:57:12 AM, Error: Service Control Manager [7000] - The Lenovo Fingerprint Manager Pro Cachedrv Service service failed to start due to the following error: The system cannot find the file specified.
    4/26/2014 11:44:01 AM, Error: Service Control Manager [7000] - The Update BrowseMark service failed to start due to the following error: The system cannot find the file specified.
    4/26/2014 10:43:22 AM, Error: volsnap [25] - The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.
    .
    ==== End Of File ===========================
     
  10. 2014/04/29
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    ==============================

    [​IMG] DDS produces two logs...DDS.txt and Attach.txt...you posted the latter one three times. I still need the first one.

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:

    Link 1
    Link 2

    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download Malwarebytes Anti-Rootkit (MBAR) from HERE
    • Unzip downloaded file.
    • Open the folder where the contents were unzipped and run mbar.exe
    • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
    • Wait while the system shuts down and the cleanup process is performed.
    • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
    • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
     
  11. 2014/04/30
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Sorry I was a bit confused. Here is the DDS file. Thank you in advance for your help, I will follow your instructions today.

    DS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 11.0.9600.17041
    Run by Fran at 17:38:19 on 2014-04-29
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.7880.3059 [GMT -4:00]
    .
    AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\ibmpmsvc.exe
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Program Files\Lenovo\Fingerprint Manager Pro\OmniServ.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\windows\System32\WUDFHost.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\WLANExt.exe
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
    C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
    C:\Program Files\Intel\WiFi\bin\EvtEng.exe
    C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe
    C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe
    C:\Program Files\Lenovo\Fingerprint Manager Pro\opvapp.exe
    C:\Windows\system32\HPSIsvc.exe
    C:\Program Files\Intel\iCLS Client\HeciServer.exe
    C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe
    C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
    C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
    C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe
    C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe
    C:\Windows\SysWOW64\NLSSRV32.EXE
    C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe
    C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
    C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
    C:\Windows\system32\valWBFPolicyService.exe
    C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe
    C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
    C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
    C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
    C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\svchost.exe -k bthsvcs
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\taskhost.exe
    C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Windows\system32\Dwm.exe
    C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe
    C:\Program Files (x86)\Lenovo\QuickControl\QuickControl.exe
    C:\Program Files (x86)\Lenovo\QuickControl\QuickControlInput.exe
    C:\Program Files (x86)\Lenovo\QuickControl\QuickControlInput.exe
    C:\Windows\system32\rundll32.exe
    C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE
    C:\Windows\system32\taskeng.exe
    C:\PROGRA~1\Lenovo\HOTKEY\SHTCTKY.EXE
    C:\PROGRA~1\LENOVO\HOTKEY\tpnumlkd.exe
    C:\Windows\system32\igfxsrvc.exe
    C:\Windows\System32\TpShocks.exe
    C:\Windows\System32\igfxpers.exe
    C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
    C:\Windows\System32\hkcmd.exe
    C:\Windows\System32\rundll32.exe
    C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe
    C:\Users\Fran\AppData\Local\Akamai\netsession_win.exe
    C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
    C:\Users\Fran\AppData\Local\Akamai\netsession_win.exe
    C:\Windows\SysWOW64\rundll32.exe
    C:\Windows\system32\rundll32.exe
    C:\Program Files (x86)\Integrated Camera\Monitor.exe
    C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe
    C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe
    C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe
    C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe
    C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
    C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
    C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
    C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files (x86)\Intel\Bluetooth\BTPlayerCtrl.exe
    C:\Windows\system32\taskeng.exe
    C:\PROGRAM FILES (x86)\Cyberlink\PowerDVD10\PDVD10Serv.exe
    C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
    C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
    C:\Program Files (x86)\Lenovo\message center plus\mcplaunch.exe
    C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
    C:\Windows\system32\rundll32.exe
    C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_182.exe
    C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_182.exe
    C:\Program Files\Realtek\Audio\HDA\FMAPP.exe
    C:\Windows\explorer.exe
    C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
    C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
    C:\Program Files (x86)\Adobe\Photoshop Elements 11\PhotoshopElementsEditor.exe
    C:\Windows\splwow64.exe
    C:\Windows\system32\svchost.exe -k SDRSVC
    C:\Windows\system32\taskeng.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    uProxyOverride = <local>
    mWinlogon: Userinit = userinit.exe,
    BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coieplg.dll
    BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\ipsbho.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\office15\URLREDIR.DLL
    uRun: [Akamai NetSession Interface] "C:\Users\Fran\AppData\Local\Akamai\netsession_win.exe "
    mRun: [USB3MON] "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe "
    mRun: [PWMTRV] rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
    mRun: [Lenovo Registration] C:\Program Files (x86)\Lenovo Registration\LenovoReg.exe /boot
    mRun: [Integrated Camera_Monitor] "C:\Program Files (x86)\Integrated Camera\monitor.exe "
    mRun: [IMSS] "C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe "
    mRun: [Fastboot] "C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe" /analysis
    mRun: [Dolby Advanced Audio v2] "C:\Program Files (x86)\Dolby Advanced Audio v2\pcee4.exe" -autostart
    mRun: [WD Drive Unlocker] C:\Program Files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe
    mRun: [HPUsageTrackingLEDM] "C:\Program Files (x86)\HP\HP UT LEDM\bin\hppusg.exe" "C:\Program Files (x86)\HP\HP UT LEDM\ "
    mRun: [ToolboxFX] "C:\Program Files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe" /enum:eek:n /alerts:eek:n /notifications:eek:n /fl:eek:n /fr:eek:n /appData:eek:n /tmcp:eek:n
    mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    mRun: [WD Quick View] C:\Program Files (x86)\Western Digital\WD Quick View\WDDMStatus.exe
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
    IE: {22CC3EBD-C286-43aa-B8E6-06B115F74162} - C:\Program Files (x86)\Hewlett-Packard\SmartPrint\smartprintsetup.exe
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll
    TCP: NameServer = 192.168.1.1
    TCP: Interfaces\{6169C3F1-4983-4C51-BCD0-1679CAEA0B87} : DHCPNameServer = 192.168.1.1
    Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL
    SSODL: WebCheck - <orphaned>
    x64-mStart Page = hxxp://start.mysearchdial.com/?f=1&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=
    x64-BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL
    x64-BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
    x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe "
    x64-Run: [TpShocks] TpShocks.exe
    x64-Run: [Persistence] "C:\Windows\System32\igfxpers.exe "
    x64-Run: [LENOVO.TPKNRRES] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
    x64-Run: [IgfxTray] "C:\Windows\System32\igfxtray.exe "
    x64-Run: [HotKeysCmds] "C:\Windows\System32\hkcmd.exe "
    x64-Run: [BTMTrayAgent] rundll32.exe "C:\Program Files (x86)\Intel\Bluetooth\btmshellex.dll ",TrayApp
    x64-Run: [BLEServicesCtrl] C:\Program Files (x86)\Intel\Bluetooth\BleServicesCtrl.exe
    x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
    x64-Run: [MFACApp] "C:\Program Files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe "
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll
    x64-IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
    x64-Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - <orphaned>
    x64-Notify: igfxcui - igfxdev.dll
    x64-SSODL: WebCheck - <orphaned>
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\Fran\AppData\Roaming\Mozilla\Firefox\Profiles\RluKgP.default\
    FF - prefs.js: network.proxy.type - 1
    FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
    FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll
    FF - plugin: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll
    FF - plugin: C:\Program Files (x86)\Nitro\Pro 8\npdf.dll
    FF - plugin: C:\Program Files (x86)\Nitro\Pro 8\npnitroie.dll
    FF - plugin: C:\Program Files (x86)\Nitro\Pro 8\npnitromozilla.dll
    FF - plugin: C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\1.3.27.0\npGoogleUpdate3.dll
    FF - plugin: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL
    FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_182.dll
    .
    ---- FIREFOX POLICIES ----
    .
    .
    FF - user.js: extensions.irmysearch.aflt - suma_14_15_ff
    FF - user.js: extensions.irmysearch.instlRef - 140305_a
    FF - user.js: extensions.irmysearch.cr - 1327208569
    FF - user.js: extensions.irmysearch.cd - 2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q
    FF - user.js: extensions.mysearchdial.hmpg - true
    FF - user.js: extensions.mysearchdial.hmpgUrl - hxxp://start.mysearchdial.com/?f=1&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=
    FF - user.js: extensions.mysearchdial.dfltSrch - true
    FF - user.js: extensions.mysearchdial.srchPrvdr - Mysearchdial
    FF - user.js: extensions.mysearchdial.dnsErr - true
    FF - user.js: extensions.mysearchdial_i.newTab - false
    FF - user.js: extensions.mysearchdial.newTabUrl - hxxp://start.mysearchdial.com/?f=2&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=
    FF - user.js: extensions.mysearchdial.tlbrSrchUrl - hxxp://start.mysearchdial.com/?f=3&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=&q=
    FF - user.js: extensions.mysearchdial.id - 7E7A911E79059EB2
    FF - user.js: extensions.mysearchdial.instlDay - 16174
    FF - user.js: extensions.mysearchdial.vrsn - 1.8.29.0
    FF - user.js: extensions.mysearchdial.vrsni - 1.8.29.0
    FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.29.04:10:16
    FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial
    FF - user.js: extensions.mysearchdial.prdct - mysearchdial
    FF - user.js: extensions.mysearchdial.aflt - suma_14_15_ff
    FF - user.js: extensions.mysearchdial_i.smplGrp - none
    FF - user.js: extensions.mysearchdial.tlbrId - base
    FF - user.js: extensions.mysearchdial.instlRef - 140305_a
    FF - user.js: extensions.mysearchdial.dfltLng -
    FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
    FF - user.js: extensions.mysearchdial.excTlbr - false
    FF - user.js: extensions.mysearchdial.cr - 1327208569
    FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q
    FF - user.js: extensions.mysearchdial.AL - 2
    .
    .
    .
    .
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 DzHDD64;DzHDD64;C:\Windows\System32\drivers\DZHDD64.SYS [2014-4-2 29512]
    R0 iaStorA;iaStorA;C:\Windows\System32\drivers\iaStorA.sys [2014-4-1 644968]
    R0 iaStorF;iaStorF;C:\Windows\System32\drivers\iaStorF.sys [2014-4-1 28008]
    R0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;C:\Windows\System32\drivers\iusb3hcs.sys [2014-4-2 20464]
    R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2014-4-12 56336]
    R0 TPDIGIMN;TPDIGIMN;C:\Windows\System32\drivers\ApsHM64.sys [2013-6-20 25856]
    R1 OMNISMI;OMNISMI;C:\Windows\SysWOW64\drivers\omnismi.sys [2014-4-2 14776]
    R2 AdobeActiveFileMonitor11.0;Adobe Active File Monitor V11;C:\Program Files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [2012-9-23 171600]
    R2 Bluetooth Device Monitor;Bluetooth Device Monitor;C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe [2013-6-25 1132920]
    R2 Bluetooth Media Service;Bluetooth Media Service;C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe [2013-4-23 1366392]
    R2 Bluetooth OBEX Service;Bluetooth OBEX Service;C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe [2013-4-23 1153400]
    R2 ClickToRunSvc;Microsoft Office ClickToRun Service;C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe [2014-4-12 2211000]
    R2 FastbootService;FastbootService;C:\Program Files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [2014-4-2 140016]
    R2 HP LaserJet Service;HP LaserJet Service;C:\Program Files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [2010-10-25 145920]
    R2 HPSIService;HP SI Service;C:\Windows\System32\HPSIsvc.exe [2014-4-15 126880]
    R2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;C:\Program Files\Intel\iCLS Client\HeciServer.exe [2013-5-11 733696]
    R2 ISCTAgent;Intel(R) Smart Connect Technology Agent;C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [2013-4-15 182760]
    R2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe [2014-4-2 169432]
    R2 LENOVO.CAMMUTE;Lenovo Camera Mute;C:\Program Files\Lenovo\Communications Utility\CamMute.exe [2014-4-2 59896]
    R2 LENOVO.MICMUTE;Lenovo Microphone Mute;C:\Program Files\Lenovo\HOTKEY\micmute.exe [2014-4-1 127072]
    R2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe [2014-4-2 74232]
    R2 LENOVO.TVTVCAM;ThinkVantage Virtual Camera Controller;C:\Program Files\Lenovo\Communications Utility\vcamsvc.exe [2014-4-2 199160]
    R2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe [2014-4-2 136288]
    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2014-4-27 418376]
    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2014-4-27 701512]
    R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [2014-4-2 144368]
    R2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8;C:\Program Files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [2013-6-17 230408]
    R2 nlsX86cc;Nalpeiron Licensing Service;C:\Windows\SysWOW64\NLSSRV32.EXE [2013-6-17 69640]
    R2 QuickControlMasterSvc;Lenovo QuickControl Master Service;C:\Program Files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [2013-7-16 59384]
    R2 TPHKLOAD;Lenovo Hotkey Client Loader;C:\Program Files\Lenovo\HOTKEY\tphkload.exe [2014-4-1 125432]
    R2 TPHKSVC;On Screen Display;C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe [2014-4-1 125504]
    R2 valWBFPolicyService;Validity WBF Policy Service;C:\Windows\System32\valWBFPolicyService.exe [2013-7-17 40848]
    R2 WDBackup;WD Backup;C:\Program Files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [2014-2-28 1042808]
    R2 WDDriveService;WD Drive Manager;C:\Program Files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [2014-2-28 271728]
    R2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe [2013-10-11 3671792]
    R3 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\BASHDefs\20140409.001\BHDrvx64.sys [2014-4-16 1525976]
    R3 btmaux;Intel Bluetooth Auxiliary Service;C:\Windows\System32\drivers\btmaux.sys [2013-4-23 132920]
    R3 btmhsf;btmhsf;C:\Windows\System32\drivers\btmhsf.sys [2013-8-8 1385272]
    R3 ccSet_NIS;Norton Internet Security Settings Manager;C:\Windows\System32\drivers\NISx64\1404000.028\ccSetx64.sys [2014-4-2 169048]
    R3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D;C:\Windows\System32\drivers\e1d62x64.sys [2014-4-1 495888]
    R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2014-4-11 137648]
    R3 ibtusb;Intel(R) Wireless Bluetooth(R) 4.0 + HS Adapter;C:\Windows\System32\drivers\ibtusb.sys [2013-6-13 114632]
    R3 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\IPSDefs\20140428.001\IDSviA64.sys [2014-4-29 525016]
    R3 ikbevent;Intel Upper keyboard Class Filter Driver;C:\Windows\System32\drivers\ikbevent.sys [2013-4-15 21048]
    R3 imsevent;Intel Upper Mouse Class Filter Driver;C:\Windows\System32\drivers\imsevent.sys [2013-4-15 21048]
    R3 ISCT;Intel(R) Smart Connect Technology Device Driver;C:\Windows\System32\drivers\ISCTD64.sys [2013-4-15 46568]
    R3 iusb3hub;Intel(R) USB 3.0 Hub Driver;C:\Windows\System32\drivers\iusb3hub.sys [2014-4-2 368624]
    R3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;C:\Windows\System32\drivers\iusb3xhc.sys [2014-4-2 790000]
    R3 iwdbus;IWD Bus Enumerator;C:\Windows\System32\drivers\iwdbus.sys [2013-7-26 25528]
    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-4-27 25928]
    R3 Power Manager DBC Service;Power Manager Service;C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.exe [2014-4-2 1668904]
    R3 QuickControlService;Lenovo QuickControl Service;C:\Program Files (x86)\Lenovo\QuickControl\QuickControlService.exe [2013-7-16 138744]
    R3 RTSPER;Realtek PCIE Card Reader - PER;C:\Windows\System32\drivers\RtsPer.sys [2014-4-2 423128]
    R3 SmbDrvI;SmbDrvI;C:\Windows\System32\drivers\Smb_driver_Intel.sys [2014-4-11 31472]
    R3 SPUVCbv;SPUVCb Driver Service;C:\Windows\System32\drivers\SPUVCBv_x64.sys [2013-10-9 1515256]
    R3 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1404000.028\SymDS64.sys [2014-4-2 493656]
    R3 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1404000.028\SymEFA64.sys [2014-4-2 1139800]
    R3 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1404000.028\Ironx64.sys [2014-4-2 224416]
    R3 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NISx64\1404000.028\symnets.sys [2014-4-2 433752]
    R3 tvtvcamd;Camera Plus (VGA Resolution Maximum);C:\Windows\System32\drivers\tvtvcamd.sys [2014-4-2 27432]
    R3 usb3Hub;UoIP Hub;C:\Windows\System32\drivers\usb3Hub.sys [2013-6-20 206744]
    R3 WDC_SAM;WD SCSI Pass Thru driver;C:\Windows\System32\drivers\wdcsam64.sys [2008-5-6 14464]
    R3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);C:\Windows\System32\drivers\WPRO_41_2001.sys [2014-4-2 34752]
    S2 Cachedrv server; Lenovo Fingerprint Manager Pro Cachedrv Service; "C:\Program Files\Lenovo\Fingerprint Manager Pro\cachesrvr.exe" --> C:\Program Files\Lenovo\Fingerprint Manager Pro\cachesrvr.exe [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2013-9-11 105144]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2013-9-11 124088]
    S2 omaha;Nok Nok Labs Update Service (omaha);C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2014-4-2 148272]
    S3 dmvsc;dmvsc;C:\Windows\System32\drivers\dmvsc.sys [2010-11-20 71168]
    S3 DozeSvc;Lenovo Doze Mode Service;C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2014-4-2 320576]
    S3 Fastboot;Fastboot;C:\Windows\System32\drivers\Fastboot.sys [2014-4-2 56048]
    S3 IEEtwCollectorService;Internet Explorer ETW Collector Service;C:\Windows\System32\ieetwcollector.exe [2014-4-24 111616]
    S3 intaud_WaveExtensible;Intel WiDi Audio Device;C:\Windows\System32\drivers\intelaud.sys [2013-7-26 35256]
    S3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2014-4-2 452088]
    S3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [2013-5-11 822232]
    S3 iumsvc;Intel(R) Update Manager;C:\Program Files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [2014-2-28 174368]
    S3 LSCWinService;LSCWinService;C:\Program Files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [2014-2-19 1662424]
    S3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [2013-10-11 284912]
    S3 omaham;Nok Nok Labs Update Service (omaham);C:\Program Files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2014-4-2 148272]
    S3 PwmEWSvc;Cisco EnergyWise Enabler;C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe [2014-4-2 1664808]
    S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2014-4-26 19456]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2014-4-26 56832]
    S3 TsUsbGD;Remote Desktop Generic USB Device;C:\Windows\System32\drivers\TsUsbGD.sys [2014-4-26 30208]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2014-4-12 1255736]
    .
    =============== Created Last 30 ================
    .
    2014-04-29 11:27:28 -------- d-----w- C:\Users\Fran\AppData\Local\Apps
    2014-04-27 12:57:21 94656 ----a-w- C:\Windows\System32\WPRO_41_2001woem.tmp
    2014-04-27 12:04:02 6574592 ----a-w- C:\Windows\System32\mstscax.dll
    2014-04-27 12:04:02 5694464 ----a-w- C:\Windows\SysWow64\mstscax.dll
    2014-04-27 11:55:44 -------- d-----w- C:\Users\Fran\AppData\Roaming\Malwarebytes
    2014-04-27 11:55:17 -------- d-----w- C:\ProgramData\Malwarebytes
    2014-04-27 11:55:16 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
    2014-04-27 11:55:16 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2014-04-26 14:51:09 -------- d-----w- C:\Program Files\Western Digital
    2014-04-26 14:39:02 -------- d-s---w- C:\Windows\System32\CompatTel
    2014-04-26 14:37:46 15360 ----a-w- C:\Windows\System32\RdpGroupPolicyExtension.dll
    2014-04-26 14:37:45 30208 ----a-w- C:\Windows\System32\drivers\TsUsbGD.sys
    2014-04-26 14:37:45 19456 ----a-w- C:\Windows\System32\drivers\rdpvideominiport.sys
    2014-04-26 14:37:45 192000 ----a-w- C:\Windows\SysWow64\rdpendp_winip.dll
    2014-04-26 14:37:44 3174912 ----a-w- C:\Windows\System32\rdpcorets.dll
    2014-04-26 14:37:44 243200 ----a-w- C:\Windows\System32\rdpudd.dll
    2014-04-26 14:37:44 228864 ----a-w- C:\Windows\System32\rdpendp_winip.dll
    2014-04-26 14:37:03 792576 ----a-w- C:\Windows\SysWow64\TSWorkspace.dll
    2014-04-26 14:37:03 1030144 ----a-w- C:\Windows\System32\TSWorkspace.dll
    2014-04-26 14:36:55 514560 ----a-w- C:\Windows\SysWow64\qdvd.dll
    2014-04-26 14:36:55 366592 ----a-w- C:\Windows\System32\qdvd.dll
    2014-04-26 14:36:44 465408 ----a-w- C:\Windows\System32\aepdu.dll
    2014-04-26 14:36:44 424448 ----a-w- C:\Windows\System32\aeinv.dll
    2014-04-19 13:04:58 -------- d-----w- C:\Windows\System32\appmgmt
    2014-04-19 11:56:20 -------- d-sh--w- C:\Users\Fran\AppData\Roaming\.#
    2014-04-18 12:39:33 -------- d-----w- C:\Program Files\Nok Nok Labs
    2014-04-16 23:23:48 -------- d-----w- C:\Windows\Migration
    2014-04-16 02:26:34 -------- d-----w- C:\Users\Fran\AppData\Roaming\HpUpdate
    2014-04-16 02:26:33 -------- d-----w- C:\Users\Fran\AppData\Roaming\Hewlett-Packard Company
    2014-04-16 02:25:45 323584 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\hpcpp103.dll
    2014-04-16 02:25:45 323584 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\1_hpcpp103.dll
    2014-04-16 02:24:41 193592 ----a-w- C:\Windows\System32\hppdcompio.dll
    2014-04-16 02:24:41 167480 ----a-w- C:\Windows\SysWow64\hppccompio.dll
    2014-04-16 02:24:40 491008 ----a-w- C:\Windows\SysWow64\hpcdmc32.dll
    2014-04-16 02:24:40 305664 ----a-w- C:\Windows\SysWow64\hpcc3103.dll
    2014-04-16 02:24:40 176640 ----a-w- C:\Windows\System32\hpcpn103.dll
    2014-04-16 02:23:39 311296 ----a-w- C:\Windows\System32\hpbcoins64.dll
    2014-04-16 02:23:17 -------- d-----w- C:\CP1520_Series_Full_Solution
    2014-04-16 02:18:29 49664 ----a-r- C:\Windows\System32\HP1100SMs.dll
    2014-04-16 02:18:29 350720 ----a-w- C:\Windows\System32\mvhlewsi.DLL
    2014-04-16 02:18:29 1696256 ----a-w- C:\Windows\System32\HP1100SM.EXE
    2014-04-16 02:18:28 74240 ----a-w- C:\Windows\System32\Spool\prtprocs\x64\HP1100PP.dll
    2014-04-16 02:18:28 288768 ----a-w- C:\Windows\System32\HP1100LM.DLL
    2014-04-16 02:15:42 126880 ----a-w- C:\Windows\System32\HPSIsvc.exe
    2014-04-16 02:15:18 -------- d-----w- C:\Program Files (x86)\HP
    2014-04-16 02:14:27 -------- d-----w- C:\Program Files\HP
    2014-04-16 02:13:45 -------- d-----w- C:\Program Files (x86)\Common Files\SWF Studio
    2014-04-16 02:13:21 -------- d-----w- C:\LJP1100_P1560_P1600_Full_Solution
    2014-04-15 00:52:43 -------- d-----w- C:\Users\Fran\AppData\Roaming\Nitro
    2014-04-15 00:52:43 -------- d-----w- C:\Users\Fran\AppData\Roaming\FileOpen
    2014-04-15 00:52:43 -------- d-----w- C:\ProgramData\FileOpen
    2014-04-14 09:04:24 -------- d-----w- C:\Program Files (x86)\PhotoScape
    2014-04-14 08:10:48 -------- d-----w- C:\Users\Fran\AppData\Local\IsolatedStorage
    2014-04-14 08:10:32 -------- dc-h--w- C:\ProgramData\{0D840360-FAC8-45E3-8244-E235EB1E30AA}
    2014-04-14 08:10:16 -------- d-----w- C:\Program Files (x86)\Optimizer Pro
    2014-04-14 00:35:16 -------- d-----w- C:\Windows\System32\MRT
    2014-04-12 09:51:14 -------- d-----w- C:\Users\Fran\AppData\Local\Western Digital
    2014-04-12 09:51:10 -------- d-----w- C:\Users\Fran\AppData\Local\Western_Digital_Technolog
    2014-04-12 09:50:49 -------- d-----w- C:\Program Files\Common Files\Western Digital
    2014-04-12 09:50:31 -------- d-----w- C:\Program Files (x86)\Western Digital
    2014-04-12 09:50:31 -------- d-----w- C:\Program Files (x86)\Common Files\Western Digital
    2014-04-12 09:50:03 -------- d-----w- C:\ProgramData\Western Digital
    2014-04-12 09:25:41 -------- d-----w- C:\Users\Fran\AppData\Roaming\LSC
    2014-04-12 08:57:04 -------- d-----w- C:\drivers
    2014-04-12 08:36:01 -------- d-----w- C:\ProgramData\regid.1986-12.com.adobe
    2014-04-12 08:29:02 56336 ------w- C:\Windows\System32\drivers\PxHlpa64.sys
    2014-04-12 08:29:02 11376 ------w- C:\Windows\System32\drivers\cdralw2k.sys
    2014-04-12 08:29:02 10864 ------w- C:\Windows\System32\drivers\cdr4_xp.sys
    2014-04-12 08:28:50 -------- d-----w- C:\Program Files (x86)\Common Files\Sonic Shared
    2014-04-12 08:28:50 -------- d-----w- C:\Program Files (x86)\Common Files\PX Storage Engine
    2014-04-12 08:18:28 -------- d-----w- C:\Windows\SysWow64\Wat
    2014-04-12 08:18:28 -------- d-----w- C:\Windows\System32\Wat
    2014-04-12 08:02:04 1270024 ----a-w- C:\Users\Fran\PhotoshopElements_11_LS15.exe
    2014-04-12 07:58:48 -------- d-----w- C:\Users\Fran\AppData\Local\Akamai
    2014-04-12 07:19:00 -------- d-----w- C:\Users\Fran\AppData\Local\CrashDumps
    2014-04-12 01:47:24 -------- d-----w- C:\Users\Fran\AppData\Local\Macromedia
    2014-04-12 01:01:47 70832 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-04-12 01:01:47 692400 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
    2014-04-12 00:53:03 -------- d-----w- C:\Users\Fran\AppData\Roaming\SoapMakerData
    2014-04-12 00:52:24 -------- d-----w- C:\Program Files (x86)\SoapMaker3
    2014-04-12 00:51:50 -------- d-----w- C:\Users\Fran\AppData\Local\Downloaded Installations
    2014-04-12 00:43:08 -------- d-----w- C:\Program Files (x86)\Microsoft SkyDrive
    2014-04-12 00:43:07 -------- d-----r- C:\Users\Fran\SkyDrive
    2014-04-12 00:43:03 -------- d-----w- C:\ProgramData\Microsoft SkyDrive
    2014-04-12 00:39:48 3156480 ----a-w- C:\Windows\System32\win32k.sys
    2014-04-11 05:08:50 -------- d-----w- C:\Users\Fran\AppData\Roaming\PwrMgr
    2014-04-11 05:00:28 -------- d-----w- C:\Users\Fran\AppData\Local\Adobe
    2014-04-11 05:00:13 -------- d-----w- C:\Users\Fran\AppData\Local\LSC
    2014-04-11 04:59:25 -------- d-----w- C:\Program Files\Validity Sensors
    2014-04-11 04:57:21 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared
    2014-04-11 04:57:10 553200 ----a-w- C:\Windows\System32\drivers\SynTP.sys
    2014-04-11 04:57:10 254192 ----a-w- C:\Windows\System32\SynTPAPI.dll
    2014-04-11 04:57:10 208112 ----a-w- C:\Windows\System32\SynTPCo20.dll
    2014-04-11 04:57:03 404720 ----a-w- C:\Windows\SysWow64\SynCom.dll
    2014-04-11 04:57:01 31472 ----a-w- C:\Windows\System32\drivers\Smb_driver_Intel.sys
    2014-04-11 04:56:56 826880 ----a-w- C:\Windows\SysWow64\rdpcore.dll
    2014-04-11 04:56:56 23552 ----a-w- C:\Windows\System32\drivers\tdtcp.sys
    2014-04-11 04:56:56 1031680 ----a-w- C:\Windows\System32\rdpcore.dll
    2014-04-11 04:52:40 2622464 ----a-w- C:\Windows\System32\wucltux.dll
    2014-04-11 04:52:35 99840 ----a-w- C:\Windows\System32\wudriver.dll
    2014-04-11 04:52:24 36864 ----a-w- C:\Windows\System32\wuapp.exe
    2014-04-11 04:52:24 186752 ----a-w- C:\Windows\System32\wuwebv.dll
    2014-04-11 04:50:18 -------- d-----w- C:\Users\Fran\AppData\Local\Lenovo
    2014-04-11 04:50:12 -------- d-----w- C:\Users\Fran\AppData\Local\Nok Nok Labs
    2014-04-11 04:50:11 -------- d-----w- C:\Users\Fran\AppData\Roaming\Lenovo
    2014-04-11 04:49:41 -------- d-----w- C:\Users\Fran\AppData\Local\VirtualStore
    2014-04-11 04:47:20 -------- d-----w- C:\Users\Fran\AppData\Local\Power2Go
    2014-04-11 04:47:09 -------- d-----w- C:\Users\Fran\AppData\Local\Packages
    2014-04-02 04:42:08 -------- d-----w- C:\Windows\util
    2014-04-02 04:42:02 -------- d-----w- C:\ProgramData\Intel(R) Update Manager
    2014-04-02 04:41:11 -------- d-----w- C:\Program Files\Intel Corporation
    2014-04-02 04:39:44 -------- d-----w- C:\ProgramData\regid.1991-06.com.microsoft
    2014-04-02 04:38:13 -------- d-----w- C:\Program Files (x86)\SymSilent
    2014-04-02 04:38:05 177312 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
    2014-04-02 04:38:05 -------- d-----w- C:\Program Files\Common Files\Symantec Shared
    2014-04-02 04:36:59 29704 ----a-w- C:\Windows\System32\nitrolocalmon2.dll
    2014-04-02 04:36:59 17928 ----a-w- C:\Windows\System32\nitrolocalui2.dll
    2014-04-02 04:36:47 -------- d-----w- C:\Program Files\Common Files\Nitro
    2014-04-02 04:36:46 -------- d-----w- C:\ProgramData\Nitro
    2014-04-02 04:36:46 -------- d-----w- C:\Program Files (x86)\Nitro
    2014-04-02 04:36:46 -------- d-----w- C:\Program Files (x86)\Common Files\Nitro
    2014-04-02 04:36:29 -------- d-----w- C:\Program Files (x86)\SugarSync
    2014-04-02 04:36:22 -------- d-----w- C:\Program Files (x86)\Nok Nok Labs
    2014-04-02 04:36:18 -------- d-----w- C:\ProgramData\Nok Nok Labs
    2014-04-02 04:36:18 -------- d-----w- C:\ProgramData\Installer
    2014-04-02 04:35:23 499712 ----a-w- C:\Windows\SysWow64\msvcp71.dll
    2014-04-02 04:35:23 348160 ----a-w- C:\Windows\SysWow64\msvcr71.dll
    2014-04-02 04:35:23 29480 ----a-w- C:\Windows\SysWow64\msxml3a.dll
    2014-04-02 04:34:31 -------- d-----w- C:\ProgramData\install_clap
    2014-04-02 04:33:00 -------- d-----w- C:\ProgramData\CLSK
    2014-04-02 04:32:26 -------- d-----w- C:\ProgramData\Validity
    2014-04-02 04:32:04 14776 ----a-w- C:\Windows\SysWow64\drivers\omnismi.sys
    2014-04-02 04:31:13 -------- d-----w- C:\swshare
    2014-04-02 04:31:05 56048 ------w- C:\Windows\System32\drivers\Fastboot.sys
    2014-04-02 04:31:00 -------- d-----w- C:\Program Files (x86)\Lenovo Registration
    2014-04-02 04:29:43 27432 ----a-w- C:\Windows\System32\drivers\tvtvcamd.sys
    2014-04-02 04:29:21 -------- d-----w- C:\Windows\Downloaded Installations
    2014-04-02 04:29:17 -------- d-----w- C:\Program Files\Common Files\Lenovo
    2014-04-02 04:29:09 -------- d-----w- C:\Program Files (x86)\Common Files\Lenovo
    2014-04-02 04:28:12 2692904 ------w- C:\Windows\PWMBTHLV.EXE
    2014-04-02 04:28:09 -------- d-----w- C:\Program Files (x86)\ThinkPad
    2014-04-02 04:28:08 29512 ----a-w- C:\Windows\System32\drivers\DZHDD64.SYS
    2014-04-02 04:28:08 2852136 ----a-w- C:\Windows\System32\PWMCP64V.cpl
    2014-04-02 04:28:08 20736 ----a-w- C:\Windows\System32\drivers\TPPWR64V.SYS
    2014-04-02 04:28:06 77824 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\ctor.dll
    2014-04-02 04:28:06 32768 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\objectps.dll
    2014-04-02 04:28:06 225280 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\IScript\iscript.dll
    2014-04-02 04:28:06 176128 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\iuser.dll
    2014-04-02 04:28:05 614532 ----a-w- C:\Program Files (x86)\Common Files\InstallShield\Engine\6\Intel 32\IKernel.exe
    2014-04-02 04:28:00 -------- d-----w- C:\Program Files\ThinkPad
    2014-04-02 04:27:14 34752 ----a-w- C:\Windows\System32\drivers\WPRO_41_2001.sys
    2014-04-02 04:24:58 188872 ----a-w- C:\Windows\System32\drivers\Win64\ibtrmgmt.dll
    2014-04-02 04:24:58 114632 ----a-w- C:\Windows\System32\drivers\Win64\ibtusb.sys
    2014-04-02 04:24:58 -------- d-----w- C:\Windows\System32\drivers\Win64
    2014-04-02 04:24:11 -------- d-----w- C:\Program Files (x86)\Dolby Advanced Audio v2
    2014-04-02 04:22:48 41984 ----a-w- C:\Windows\System32\drivers\USB3Ver.dll
    2014-04-02 04:22:47 790000 ----a-w- C:\Windows\System32\drivers\iusb3xhc.sys
    2014-04-02 04:22:47 368624 ----a-w- C:\Windows\System32\drivers\iusb3hub.sys
    2014-04-02 04:22:47 20464 ----a-w- C:\Windows\System32\drivers\iusb3hcs.sys
    2014-04-02 04:22:43 -------- d--h--w- C:\Windows\System32\WLANProfiles
    2014-04-02 04:22:25 -------- d-----w- C:\ProgramData\Roaming
    2014-04-02 04:22:14 -------- d-----w- C:\Program Files\Common Files\Intel
    2014-04-02 04:22:13 -------- d-----w- C:\Program Files (x86)\Cisco
    2014-04-02 04:22:12 -------- d-----w- C:\ProgramData\Intel.sav
    2014-04-02 04:18:56 -------- d-----w- C:\ProgramData\Package Cache
    2014-04-02 04:18:33 8192 ----a-w- C:\Windows\System32\drivers\IntelMEFWVer.dll
    2014-04-02 04:17:28 -------- d-----w- C:\Program Files (x86)\Common Files\postureAgent
    2014-04-02 04:17:24 64624 ----a-w- C:\Windows\System32\drivers\HECIx64.sys
    2014-04-02 04:16:36 -------- d-----w- C:\Program Files (x86)\Lenovo
    2014-04-02 04:13:35 53248 ----a-w- C:\Windows\SysWow64\CSVer.dll
    2014-04-02 04:13:32 -------- d-----w- C:\Intel
    2014-04-02 04:13:31 -------- d-----w- C:\Program Files\Lenovo
    2014-04-02 04:09:13 -------- d-----w- C:\Program Files\Synaptics
    2014-04-02 04:01:22 2048 ----a-w- C:\Windows\SysWow64\tzres.dll
    2014-04-02 04:01:22 2048 ----a-w- C:\Windows\System32\tzres.dll
    2014-04-02 03:59:23 878080 ----a-w- C:\Windows\System32\advapi32.dll
    2014-04-02 03:59:23 859648 ----a-w- C:\Windows\System32\tdh.dll
    2014-04-02 03:59:23 640512 ----a-w- C:\Windows\SysWow64\advapi32.dll
    2014-04-02 03:59:23 619520 ----a-w- C:\Windows\SysWow64\tdh.dll
    2014-04-02 03:59:23 5549504 ----a-w- C:\Windows\System32\ntoskrnl.exe
    2014-04-02 03:59:23 3969472 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
    2014-04-02 03:59:23 3914176 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
    2014-04-02 03:59:23 1732032 ----a-w- C:\Windows\System32\ntdll.dll
    2014-04-02 03:59:23 1292192 ----a-w- C:\Windows\SysWow64\ntdll.dll
    2014-04-02 03:59:10 404480 ----a-w- C:\Windows\System32\gdi32.dll
    2014-04-02 03:59:10 311808 ----a-w- C:\Windows\SysWow64\gdi32.dll
    2014-04-02 03:57:58 96768 ----a-w- C:\Windows\SysWow64\sspicli.dll
    2014-04-02 03:56:58 185344 ----a-w- C:\Windows\System32\drivers\usbvideo.sys
    2014-04-02 03:56:58 100864 ----a-w- C:\Windows\System32\drivers\usbcir.sys
    2014-04-02 03:56:49 785624 ----a-w- C:\Windows\System32\drivers\Wdf01000.sys
    2014-04-02 03:56:39 633856 ----a-w- C:\Windows\System32\comctl32.dll
    2014-04-02 03:56:39 530432 ----a-w- C:\Windows\SysWow64\comctl32.dll
    2014-04-02 03:56:08 224256 ----a-w- C:\Windows\System32\wintrust.dll
    2014-04-02 03:56:08 184320 ----a-w- C:\Windows\System32\cryptsvc.dll
    2014-04-02 03:56:08 175104 ----a-w- C:\Windows\SysWow64\wintrust.dll
    2014-04-02 03:56:08 140288 ----a-w- C:\Windows\SysWow64\cryptsvc.dll
    2014-04-02 03:56:08 139776 ----a-w- C:\Windows\System32\cryptnet.dll
    2014-04-02 03:56:08 103936 ----a-w- C:\Windows\SysWow64\cryptnet.dll
    2014-04-02 03:55:53 76800 ----a-w- C:\Windows\System32\drivers\hidclass.sys
    2014-04-02 03:55:53 42496 ----a-w- C:\Windows\System32\drivers\usbscan.sys
    2014-04-02 03:55:53 32896 ----a-w- C:\Windows\System32\drivers\hidparse.sys
    2014-04-02 03:55:42 30720 ----a-w- C:\Windows\System32\drivers\usbuhci.sys
    2014-04-02 03:55:42 25600 ----a-w- C:\Windows\System32\drivers\usbohci.sys
    2014-04-02 03:55:33 859648 ----a-w- C:\Windows\System32\IKEEXT.DLL
    2014-04-02 03:55:33 830464 ----a-w- C:\Windows\System32\nshwfp.dll
    2014-04-02 03:55:33 656896 ----a-w- C:\Windows\SysWow64\nshwfp.dll
    2014-04-02 03:55:33 324096 ----a-w- C:\Windows\System32\FWPUCLNT.DLL
    2014-04-02 03:55:33 216576 ----a-w- C:\Windows\SysWow64\FWPUCLNT.DLL
    2014-04-02 03:55:24 39936 ----a-w- C:\Windows\System32\drivers\tssecsrv.sys
    2014-04-02 03:54:36 155584 ----a-w- C:\Windows\System32\drivers\ataport.sys
    2014-04-02 03:54:20 461312 ----a-w- C:\Windows\System32\scavengeui.dll
    2014-04-02 03:54:11 663552 ----a-w- C:\Windows\SysWow64\rpcrt4.dll
    2014-04-02 03:54:11 1217024 ----a-w- C:\Windows\System32\rpcrt4.dll
    2014-04-02 03:54:01 9216 ----a-w- C:\Program Files (x86)\Windows Defender\MpAsDesc.dll
    2014-04-02 03:54:01 571904 ----a-w- C:\Program Files\Windows Defender\MpClient.dll
    2014-04-02 03:54:01 54784 ----a-w- C:\Program Files (x86)\Windows Defender\MpOAV.dll
    2014-04-02 03:54:01 4608 ----a-w- C:\Program Files (x86)\Windows Defender\MsMpLics.dll
    2014-04-02 03:54:01 392704 ----a-w- C:\Program Files (x86)\Windows Defender\MpClient.dll
    2014-04-02 03:54:01 314880 ----a-w- C:\Program Files\Windows Defender\MpCommu.dll
    2014-04-02 03:54:01 1011712 ----a-w- C:\Program Files\Windows Defender\MpSvc.dll
    2014-04-02 03:52:43 751104 ----a-w- C:\Windows\System32\win32spl.dll
    2014-04-02 03:52:43 492544 ----a-w- C:\Windows\SysWow64\win32spl.dll
    2014-04-02 03:52:03 936448 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\ink\journal.dll
    2014-04-02 03:52:03 1732608 ----a-w- C:\Program Files\Windows Journal\NBDoc.DLL
    2014-04-02 03:52:03 1402880 ----a-w- C:\Program Files\Windows Journal\JNWDRV.dll
    2014-04-02 03:52:03 1393152 ----a-w- C:\Program Files\Windows Journal\JNTFiltr.dll
    2014-04-02 03:52:03 1367040 ----a-w- C:\Program Files\Common Files\Microsoft Shared\ink\journal.dll
    2014-04-02 03:51:51 1643520 ----a-w- C:\Windows\System32\DWrite.dll
    2014-04-02 03:51:51 1247744 ----a-w- C:\Windows\SysWow64\DWrite.dll
    2014-04-02 03:51:23 1887232 ----a-w- C:\Windows\System32\d3d11.dll
    2014-04-02 03:51:23 1505280 ----a-w- C:\Windows\SysWow64\d3d11.dll
    2014-04-02 03:51:13 265064 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys
    2014-04-02 03:51:13 144384 ----a-w- C:\Windows\System32\cdd.dll
    2014-04-02 03:50:55 48640 ----a-w- C:\Windows\System32\wwanprotdim.dll
    2014-04-02 03:50:40 903168 ----a-w- C:\Windows\SysWow64\certutil.exe
    2014-04-02 03:50:40 52224 ----a-w- C:\Windows\System32\certenc.dll
    2014-04-02 03:50:40 43008 ----a-w- C:\Windows\SysWow64\certenc.dll
    2014-04-02 03:50:40 1192448 ----a-w- C:\Windows\System32\certutil.exe
    2014-04-02 03:49:16 30720 ----a-w- C:\Windows\System32\cryptdlg.dll
    2014-04-02 03:49:16 24576 ----a-w- C:\Windows\SysWow64\cryptdlg.dll
    2014-04-02 03:49:02 19968 ----a-w- C:\Windows\System32\drivers\usb8023.sys
    2014-04-02 03:48:46 1888768 ----a-w- C:\Windows\System32\WMVDECOD.DLL
    2014-04-02 03:48:46 1620992 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
    2014-04-02 03:48:38 223752 ----a-w- C:\Windows\System32\drivers\fvevol.sys
    2014-04-02 03:48:05 70144 ----a-w- C:\Windows\System32\appinfo.dll
    2014-04-02 03:48:05 111448 ----a-w- C:\Windows\System32\consent.exe
    2014-04-02 03:47:00 288088 ----a-w- C:\Windows\System32\drivers\FWPKCLNT.SYS
    2014-04-02 03:45:59 2746368 ----a-w- C:\Windows\System32\gameux.dll
    2014-04-02 03:45:59 2576384 ----a-w- C:\Windows\SysWow64\gameux.dll
    2014-04-02 03:45:30 2002432 ----a-w- C:\Windows\System32\msxml6.dll
    2014-04-02 03:45:30 1389568 ----a-w- C:\Windows\SysWow64\msxml6.dll
    2014-04-02 03:43:29 163840 ----a-w- C:\Windows\System32\umpo.dll
    2014-04-02 03:43:14 167424 ----a-w- C:\Program Files\Windows Media Player\wmplayer.exe
    2014-04-02 03:43:14 164864 ----a-w- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
    2014-04-02 03:43:14 12625920 ----a-w- C:\Windows\System32\wmploc.DLL
    2014-04-02 03:43:14 12625408 ----a-w- C:\Windows\SysWow64\wmploc.DLL
    2014-04-02 03:43:02 68608 ----a-w- C:\Windows\System32\taskhost.exe
    2014-04-02 03:38:54 644968 ----a-w- C:\Windows\System32\drivers\iaStorA.sys
    2014-04-02 03:38:54 28008 ----a-w- C:\Windows\System32\drivers\iaStorF.sys
    2014-04-02 03:38:46 1795952 ----a-w- C:\Windows\System32\WdfCoInstaller01011.dll
    2014-04-02 03:38:45 745200 ----a-w- C:\Windows\System32\SynCOM.dll
    2014-04-02 03:38:45 422640 ----a-w- C:\Windows\System32\SynTPCo19.dll
    2014-04-02 03:38:30 36472 ----a-w- C:\Windows\System32\NicCo36.dll
    2014-04-02 03:38:30 101224 ----a-w- C:\Windows\System32\NicInstD.dll
    2014-04-02 03:38:29 73032 ----a-w- C:\Windows\System32\e1dmsg.dll
    2014-04-02 03:38:29 495888 ----a-w- C:\Windows\System32\drivers\e1d62x64.sys
    2014-04-02 03:38:15 1271 ----a-w- C:\Windows\MFGCLEAN.CMD
    2014-04-02 03:28:46 -------- d-----w- C:\mfg
    2014-04-02 03:25:19 -------- d-----w- C:\ProgramData\Lenovo
    .
    ==================== Find3M ====================
    .
    2014-04-02 04:00:46 197120 ----a-w- C:\Windows\System32\credui.dll
    2014-04-02 03:58:50 983488 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
    2014-04-02 03:57:58 95680 ----a-w- C:\Windows\System32\drivers\ksecdd.sys
    2014-04-02 03:53:50 70656 ----a-w- C:\Windows\SysWow64\fontsub.dll
    2014-04-02 03:51:04 474624 ----a-w- C:\Windows\apppatch\AcSpecfc.dll
    2014-04-02 03:51:04 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
    2014-04-02 03:51:04 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll
    2014-04-02 03:51:04 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll
    2014-04-02 03:51:04 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
    2014-04-02 03:51:04 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll
    2014-04-02 03:44:37 68864 ----a-w- C:\Windows\System32\drivers\stream.sys
    2014-04-02 03:40:53 87040 ----a-w- C:\Windows\System32\drivers\WUDFPf.sys
    2014-03-06 09:32:16 2724864 ----a-w- C:\Windows\System32\mshtml.tlb
    2014-03-06 09:31:33 4096 ----a-w- C:\Windows\System32\ieetwcollectorres.dll
    2014-03-06 08:59:04 66048 ----a-w- C:\Windows\System32\iesetup.dll
    2014-03-06 08:57:34 548352 ----a-w- C:\Windows\System32\vbscript.dll
    2014-03-06 08:57:20 48640 ----a-w- C:\Windows\System32\ieetwproxystub.dll
    2014-03-06 08:32:07 2724864 ----a-w- C:\Windows\SysWow64\mshtml.tlb
    2014-03-06 08:29:40 139264 ----a-w- C:\Windows\System32\ieUnatt.exe
    2014-03-06 08:29:14 111616 ----a-w- C:\Windows\System32\ieetwcollector.exe
    2014-03-06 08:28:15 752640 ----a-w- C:\Windows\System32\jscript9diag.dll
    2014-03-06 08:15:54 940032 ----a-w- C:\Windows\System32\MsSpellCheckingFacility.exe
    2014-03-06 08:11:41 5784064 ----a-w- C:\Windows\System32\jscript9.dll
    2014-03-06 08:02:34 61952 ----a-w- C:\Windows\SysWow64\iesetup.dll
    2014-03-06 08:02:33 455168 ----a-w- C:\Windows\SysWow64\vbscript.dll
    2014-03-06 08:01:01 51200 ----a-w- C:\Windows\SysWow64\ieetwproxystub.dll
    2014-03-06 07:56:43 38400 ----a-w- C:\Windows\System32\JavaScriptCollectionAgent.dll
    2014-03-06 07:46:36 4254720 ----a-w- C:\Windows\SysWow64\jscript9.dll
    2014-03-06 07:38:13 112128 ----a-w- C:\Windows\SysWow64\ieUnatt.exe
    2014-03-06 07:36:40 592896 ----a-w- C:\Windows\SysWow64\jscript9diag.dll
    2014-03-06 07:13:43 32256 ----a-w- C:\Windows\SysWow64\JavaScriptCollectionAgent.dll
    2014-03-06 07:11:15 2043904 ----a-w- C:\Windows\System32\inetcpl.cpl
    2014-03-06 06:40:39 1967104 ----a-w- C:\Windows\SysWow64\inetcpl.cpl
    2014-03-06 06:22:40 2260480 ----a-w- C:\Windows\System32\wininet.dll
    2014-03-06 05:41:49 1789440 ----a-w- C:\Windows\SysWow64\wininet.dll
    2014-03-04 09:44:21 362496 ----a-w- C:\Windows\System32\wow64win.dll
    2014-03-04 09:44:21 243712 ----a-w- C:\Windows\System32\wow64.dll
    2014-03-04 09:44:21 13312 ----a-w- C:\Windows\System32\wow64cpu.dll
    2014-03-04 09:44:03 16384 ----a-w- C:\Windows\System32\ntvdm64.dll
    2014-03-04 09:17:19 14336 ----a-w- C:\Windows\SysWow64\ntvdm64.dll
    2014-03-04 09:17:05 44032 ----a-w- C:\Windows\apppatch\acwow64.dll
    2014-03-04 09:16:54 25600 ----a-w- C:\Windows\SysWow64\setup16.exe
    2014-03-04 09:16:18 5120 ----a-w- C:\Windows\SysWow64\wow32.dll
    2014-03-04 08:09:30 7680 ----a-w- C:\Windows\SysWow64\instnm.exe
    2014-03-04 08:09:29 2048 ----a-w- C:\Windows\SysWow64\user.exe
    2014-02-27 06:52:14 40280 ----a-w- C:\Windows\System32\tpinspm.dll
    2014-02-27 06:52:12 68440 ----a-w- C:\Windows\System32\ibmpmsvc.exe
    2014-02-27 06:52:12 60760 ----a-w- C:\Windows\System32\ibmpmctl.exe
    2014-02-27 06:52:12 57144 ----a-w- C:\Windows\System32\drivers\ibmpmdrv.sys
    2014-02-04 02:35:56 190912 ----a-w- C:\Windows\System32\drivers\storport.sys
    2014-02-04 02:35:49 274880 ----a-w- C:\Windows\System32\drivers\msiscsi.sys
    2014-02-04 02:35:35 27584 ----a-w- C:\Windows\System32\drivers\Diskdump.sys
    2014-02-04 02:32:22 1424384 ----a-w- C:\Windows\System32\WindowsCodecs.dll
    2014-02-04 02:32:12 624128 ----a-w- C:\Windows\System32\qedit.dll
    2014-02-04 02:28:36 2048 ----a-w- C:\Windows\System32\iologmsg.dll
    2014-02-04 02:04:22 1230336 ----a-w- C:\Windows\SysWow64\WindowsCodecs.dll
    2014-02-04 02:04:11 509440 ----a-w- C:\Windows\SysWow64\qedit.dll
    2014-02-04 02:00:39 2048 ----a-w- C:\Windows\SysWow64\iologmsg.dll
    .
    ============= FINISH: 17:38:47.09 ===============
     
  12. 2014/04/30
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Here is the Rogue Killer Report:


    RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : Fran [Admin rights]
    Mode : Remove -- Date : 04/30/2014 07:05:37
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 3 ¤¤¤
    [HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

    ¤¤¤ Scheduled tasks : 0 ¤¤¤

    ¤¤¤ Startup Entries : 0 ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ Browser Addons : 1 ¤¤¤
    [FF][PUP] RluKgP.default : MySearchDial

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

    ¤¤¤ External Hives: ¤¤¤

    ¤¤¤ Infection : PUP ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts




    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) HGST HTS725050A7E630 SCSI Disk Device +++++
    --- User ---
    [MBR] 96fdcae03afa04656a781b9e08bb1344
    [BSP] d1fe90661bf468acedb17341a37461b4 : Lenovo MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 460169 MB
    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 945500160 | Size: 15269 MB
    User = LL1 ... OK!
    Error reading LL2 MBR! ([0x18] The program issued a command but the command length is incorrect. )

    +++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) WD My Passport 0820 USB Device +++++
    --- User ---
    [MBR] 7bbfee50f4dc439c8e732d793783fd71
    [BSP] 832b4dcacdf5df3852b4a9f7debf28ab : Windows XP MBR Code
    Partition table:
    0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953836 MB
    User = LL1 ... OK!
    Error reading LL2 MBR! ([0x32] The request is not supported. )

    Finished : << RKreport[0]_D_04302014_070537.txt >>
    RKreport[0]_S_04302014_070502.txt
     
  13. 2014/04/30
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Rouge Killer Report.


    RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version
    Started in : Normal mode
    User : Fran [Admin rights]
    Mode : Remove -- Date : 04/30/2014 07:05:37
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 3 ¤¤¤
    [HJ SMENU][PUM] HKCU\[...]\Advanced : Start_ShowMyGames (0) -> REPLACED (1)
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
    [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

    ¤¤¤ Scheduled tasks : 0 ¤¤¤

    ¤¤¤ Startup Entries : 0 ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ Browser Addons : 1 ¤¤¤
    [FF][PUP] RluKgP.default : MySearchDial

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

    ¤¤¤ External Hives: ¤¤¤

    ¤¤¤ Infection : PUP ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts




    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) HGST HTS725050A7E630 SCSI Disk Device +++++
    --- User ---
    [MBR] 96fdcae03afa04656a781b9e08bb1344
    [BSP] d1fe90661bf468acedb17341a37461b4 : Lenovo MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 1500 MB
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 3074048 | Size: 460169 MB
    2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 945500160 | Size: 15269 MB
    User = LL1 ... OK!
    Error reading LL2 MBR! ([0x18] The program issued a command but the command length is incorrect. )

    +++++ PhysicalDrive1: (\\.\PHYSICALDRIVE1 @ USB) WD My Passport 0820 USB Device +++++
    --- User ---
    [MBR] 7bbfee50f4dc439c8e732d793783fd71
    [BSP] 832b4dcacdf5df3852b4a9f7debf28ab : Windows XP MBR Code
    Partition table:
    0 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 953836 MB
    User = LL1 ... OK!
    Error reading LL2 MBR! ([0x32] The request is not supported. )

    Finished : << RKreport[0]_D_04302014_070537.txt >>
    RKreport[0]_S_04302014_070502.txt
     
  14. 2014/04/30
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Malwarebytes Anit-Rootkit Report 1

    Malwarebytes Anti-Rootkit BETA 1.07.0.1009
    www.malwarebytes.org

    Database version: v2014.04.30.04

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 11.0.9600.17041
    Fran :: FRANCES [administrator]

    4/30/2014 7:13:24 AM
    mbar-log-2014-04-30 (07-13-24).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 255901
    Time elapsed: 9 minute(s), 8 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)
     
  15. 2014/04/30
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Malwarebytes Anti-rootkit Report 2:


    Malwarebytes Anti-Rootkit BETA 1.07.0.1009
    www.malwarebytes.org

    Database version: v2014.04.30.04

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 11.0.9600.17041
    Fran :: FRANCES [administrator]

    4/30/2014 7:24:11 AM
    mbar-log-2014-04-30 (07-24-11).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 255895
    Time elapsed: 8 minute(s), 35 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)
     
  16. 2014/04/30
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  17. 2014/05/02
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    ComboFix 14-04-30.01 - Fran 05/02/2014 16:42:30.1.8 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.7880.4471 [GMT -4:00]
    Running from: c:\users\Fran\Downloads\ComboFix.exe
    AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
    SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ADS - Windows: deleted 192 bytes in 1 streams.
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files\Lenovo\Lenovo Solution Center\Microsoft Fix it\FixitUi\_desktop.ini
    c:\programdata\Roaming
    c:\users\Fran\AppData\Roaming\.#
    c:\users\Fran\PhotoshopElements_11_LS15.exe
    E:\Setup.exe
    Q:\Autorun.inf
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-04-02 to 2014-05-02 )))))))))))))))))))))))))))))))
    .
    .
    2014-05-02 20:50 . 2014-05-02 20:50 -------- d-----w- c:\users\Default\AppData\Local\temp
    2014-05-02 13:17 . 2014-05-02 13:17 94656 ----a-w- c:\windows\system32\WPRO_41_2001woem.tmp
    2014-05-02 13:00 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll
    2014-05-02 13:00 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb
    2014-05-02 13:00 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
    2014-05-01 22:10 . 2014-05-01 22:10 -------- d-----w- c:\windows\system32\drivers\NISx64\1405000.01C
    2014-04-30 14:52 . 2012-08-21 17:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2014-04-30 14:52 . 2014-04-30 14:52 -------- dc----w- c:\windows\system32\DRVSTORE
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\program files\iTunes
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\program files (x86)\iTunes
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\programdata\Apple Computer
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\program files\iPod
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\program files (x86)\Apple Software Update
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\program files\Common Files\Apple
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\program files\Bonjour
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\program files (x86)\Bonjour
    2014-04-30 14:05 . 2014-04-30 14:52 -------- d-----w- c:\program files (x86)\Common Files\Apple
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\programdata\Apple
    2014-04-30 11:13 . 2014-04-30 11:32 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
    2014-04-30 11:13 . 2014-04-30 11:13 119000 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-04-30 11:12 . 2014-04-30 11:12 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-04-27 12:04 . 2014-01-09 02:22 5694464 ----a-w- c:\windows\SysWow64\mstscax.dll
    2014-04-27 12:04 . 2014-01-03 22:44 6574592 ----a-w- c:\windows\system32\mstscax.dll
    2014-04-27 11:55 . 2014-04-27 11:55 -------- d-----w- c:\programdata\Malwarebytes
    2014-04-27 11:55 . 2014-04-27 11:55 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2014-04-27 11:55 . 2013-04-04 18:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-04-26 14:51 . 2014-04-26 14:51 -------- d-----w- c:\program files\Western Digital
    2014-04-26 14:39 . 2014-04-26 14:39 -------- d-s---w- c:\windows\system32\CompatTel
    2014-04-26 14:37 . 2012-08-23 13:24 15360 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
    2014-04-26 14:37 . 2012-08-23 14:10 19456 ----a-w- c:\windows\system32\drivers\rdpvideominiport.sys
    2014-04-26 14:37 . 2012-08-23 14:08 30208 ----a-w- c:\windows\system32\drivers\TsUsbGD.sys
    2014-04-26 14:37 . 2012-08-23 11:12 192000 ----a-w- c:\windows\SysWow64\rdpendp_winip.dll
    2014-04-26 14:37 . 2012-08-23 14:13 243200 ----a-w- c:\windows\system32\rdpudd.dll
    2014-04-26 14:37 . 2012-08-23 10:51 228864 ----a-w- c:\windows\system32\rdpendp_winip.dll
    2014-04-26 14:37 . 2012-08-23 09:51 3174912 ----a-w- c:\windows\system32\rdpcorets.dll
    2014-04-26 14:37 . 2013-09-25 02:23 1030144 ----a-w- c:\windows\system32\TSWorkspace.dll
    2014-04-26 14:37 . 2013-09-25 01:57 792576 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
    2014-04-26 14:36 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
    2014-04-26 14:36 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
    2014-04-26 14:36 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll
    2014-04-26 14:36 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll
    2014-04-19 13:04 . 2014-04-19 13:04 -------- d-----w- c:\windows\system32\appmgmt
    2014-04-18 12:39 . 2014-04-18 12:39 -------- d-----w- c:\program files\Nok Nok Labs
    2014-04-16 23:23 . 2014-04-16 23:23 -------- d-----w- c:\windows\Migration
    2014-04-16 02:25 . 2014-04-16 02:26 -------- d-----w- c:\programdata\Hewlett-Packard
    2014-04-16 02:25 . 2014-04-16 02:26 -------- d-----w- c:\programdata\HP
    2014-04-16 02:25 . 2010-10-13 16:02 323584 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpcpp103.dll
    2014-04-16 02:24 . 2010-09-19 19:51 193592 ----a-w- c:\windows\system32\hppdcompio.dll
    2014-04-16 02:24 . 2010-09-19 19:51 167480 ----a-w- c:\windows\SysWow64\hppccompio.dll
    2014-04-16 02:24 . 2010-10-13 16:02 176640 ----a-w- c:\windows\system32\hpcpn103.dll
    2014-04-16 02:24 . 2010-10-13 15:57 305664 ----a-w- c:\windows\SysWow64\hpcc3103.dll
    2014-04-16 02:24 . 2010-02-11 14:19 491008 ----a-w- c:\windows\SysWow64\hpcdmc32.dll
    2014-04-16 02:23 . 2010-12-14 19:26 311296 ----a-w- c:\windows\system32\hpbcoins64.dll
    2014-04-16 02:23 . 2014-04-16 02:23 -------- d-----w- C:\CP1520_Series_Full_Solution
    2014-04-16 02:20 . 2014-04-16 02:20 -------- d-----w- c:\program files (x86)\Hewlett-Packard
    2014-04-16 02:18 . 2012-09-26 05:45 49664 ----a-r- c:\windows\system32\HP1100SMs.dll
    2014-04-16 02:18 . 2012-08-31 19:10 350720 ----a-w- c:\windows\system32\mvhlewsi.DLL
    2014-04-16 02:18 . 2012-08-31 19:03 1696256 ----a-w- c:\windows\system32\HP1100SM.EXE
    2014-04-16 02:18 . 2012-08-31 19:03 288768 ----a-w- c:\windows\system32\HP1100LM.DLL
    2014-04-16 02:18 . 2012-08-31 19:02 74240 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HP1100PP.dll
    2014-04-16 02:15 . 2012-09-27 00:27 126880 ----a-w- c:\windows\system32\HPSIsvc.exe
    2014-04-16 02:15 . 2014-04-16 02:26 -------- d-----w- c:\program files (x86)\HP
    2014-04-16 02:14 . 2014-04-16 02:14 -------- d-----w- c:\program files\HP
    2014-04-16 02:13 . 2014-04-16 02:13 -------- d-----w- c:\program files (x86)\Common Files\SWF Studio
    2014-04-16 02:13 . 2014-04-16 02:13 -------- d-----w- C:\LJP1100_P1560_P1600_Full_Solution
    2014-04-16 01:39 . 2014-04-16 01:39 -------- d-----r- C:\MSOCache
    2014-04-15 00:52 . 2014-04-15 00:52 -------- d-----w- c:\programdata\FileOpen
    2014-04-14 09:04 . 2014-04-14 23:57 -------- d-----w- c:\program files (x86)\PhotoScape
    2014-04-14 08:10 . 2014-04-14 09:00 -------- dc-h--w- c:\programdata\{0D840360-FAC8-45E3-8244-E235EB1E30AA}
    2014-04-14 08:10 . 2014-04-14 09:01 -------- d-----w- c:\program files (x86)\Optimizer Pro
    2014-04-14 00:35 . 2014-04-14 00:36 -------- d-----w- c:\windows\system32\MRT
    2014-04-12 09:50 . 2014-04-26 14:51 -------- d-----w- c:\program files\Common Files\Western Digital
    2014-04-12 09:50 . 2014-04-26 14:51 -------- d-----w- c:\program files (x86)\Western Digital
    2014-04-12 09:50 . 2014-04-26 14:51 -------- d-----w- c:\program files (x86)\Common Files\Western Digital
    2014-04-12 09:50 . 2014-04-26 14:51 -------- d-----w- c:\programdata\Western Digital
    2014-04-12 08:57 . 2014-04-12 08:57 -------- d-----w- C:\drivers
    2014-04-12 08:36 . 2014-04-12 08:36 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
    2014-04-12 08:30 . 2014-04-12 08:30 -------- d-----w- c:\program files\Common Files\Adobe
    2014-04-12 08:29 . 2012-08-10 07:01 56336 ------w- c:\windows\system32\drivers\PxHlpa64.sys
    2014-04-12 08:29 . 2012-04-24 07:01 11376 ------w- c:\windows\system32\drivers\cdralw2k.sys
    2014-04-12 08:29 . 2012-04-24 07:01 10864 ------w- c:\windows\system32\drivers\cdr4_xp.sys
    2014-04-12 08:28 . 2014-04-12 08:28 -------- d-----w- c:\program files (x86)\Common Files\Sonic Shared
    2014-04-12 08:28 . 2014-04-12 08:28 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine
    2014-04-12 08:18 . 2014-04-12 08:18 -------- d-----w- c:\windows\SysWow64\Wat
    2014-04-12 08:18 . 2014-04-12 08:18 -------- d-----w- c:\windows\system32\Wat
    2014-04-12 07:16 . 2013-10-14 22:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
    2014-04-12 01:01 . 2014-04-29 16:36 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-04-12 01:01 . 2014-04-29 16:36 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-04-12 01:01 . 2014-04-12 01:01 -------- d-----w- c:\windows\SysWow64\Macromed
    2014-04-12 01:01 . 2014-04-12 01:01 -------- d-----w- c:\windows\system32\Macromed
    2014-04-12 00:52 . 2014-04-12 00:52 -------- d-----w- c:\program files (x86)\SoapMaker3
    2014-04-12 00:43 . 2014-04-12 00:43 -------- d-----w- c:\program files (x86)\Microsoft SkyDrive
    2014-04-12 00:43 . 2014-04-12 00:43 -------- d-----w- c:\programdata\Microsoft SkyDrive
    2014-04-12 00:39 . 2014-02-07 01:23 3156480 ----a-w- c:\windows\system32\win32k.sys
    2014-04-11 04:59 . 2014-04-11 04:59 -------- d-----w- c:\program files\Validity Sensors
    2014-04-11 04:57 . 2014-04-11 04:57 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
    2014-04-11 04:57 . 2014-03-17 02:41 553200 ----a-w- c:\windows\system32\drivers\SynTP.sys
    2014-04-11 04:57 . 2014-03-17 02:41 208112 ----a-w- c:\windows\system32\SynTPCo20.dll
    2014-04-11 04:57 . 2014-03-17 02:41 254192 ----a-w- c:\windows\system32\SynTPAPI.dll
    2014-04-11 04:57 . 2014-03-17 02:41 404720 ----a-w- c:\windows\SysWow64\SynCom.dll
    2014-04-11 04:57 . 2014-03-17 02:41 31472 ----a-w- c:\windows\system32\drivers\Smb_driver_Intel.sys
    2014-04-11 04:56 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
    2014-04-11 04:56 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
    2014-04-11 04:56 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
    2014-04-11 04:55 . 2014-04-11 04:55 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
    2014-04-11 04:52 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
    2014-04-11 04:52 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
    2014-04-11 04:52 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
    2014-04-11 04:52 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
    2014-04-11 04:52 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
    2014-04-11 04:52 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
    2014-04-11 04:52 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
    2014-04-11 04:52 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
    2014-04-11 04:52 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe
    2014-04-11 04:46 . 2014-05-02 20:50 -------- d-----w- c:\users\Fran
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-05-02 13:17 . 2014-04-02 04:27 34752 ----a-w- c:\windows\system32\drivers\WPRO_41_2001.sys
    2014-04-02 04:38 . 2014-04-02 04:38 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
    2014-04-02 04:35 . 2014-04-02 04:35 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll
    2014-04-02 04:35 . 2014-04-02 04:35 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
    2014-04-02 04:35 . 2014-04-02 04:35 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
    2014-04-02 04:01 . 2014-04-02 04:01 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2014-04-02 04:01 . 2014-04-02 04:01 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-04-02 04:00 . 2014-04-02 04:00 197120 ----a-w- c:\windows\system32\credui.dll
    2014-04-02 04:00 . 2014-04-02 04:00 1930752 ----a-w- c:\windows\system32\authui.dll
    2014-04-02 04:00 . 2014-04-02 04:00 190464 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
    2014-04-02 04:00 . 2014-04-02 04:00 1796096 ----a-w- c:\windows\SysWow64\authui.dll
    2014-04-02 04:00 . 2014-04-02 04:00 168960 ----a-w- c:\windows\SysWow64\credui.dll
    2014-04-02 04:00 . 2014-04-02 04:00 152576 ----a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll
    2014-04-02 04:00 . 2014-04-02 04:00 81408 ----a-w- c:\windows\system32\imagehlp.dll
    2014-04-02 04:00 . 2014-04-02 04:00 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
    2014-04-02 04:00 . 2014-04-02 04:00 202752 ----a-w- c:\windows\system32\scrrun.dll
    2014-04-02 04:00 . 2014-04-02 04:00 168960 ----a-w- c:\windows\system32\wscript.exe
    2014-04-02 04:00 . 2014-04-02 04:00 163840 ----a-w- c:\windows\SysWow64\scrrun.dll
    2014-04-02 04:00 . 2014-04-02 04:00 156160 ----a-w- c:\windows\system32\cscript.exe
    2014-04-02 04:00 . 2014-04-02 04:00 150016 ----a-w- c:\windows\system32\wshom.ocx
    2014-04-02 04:00 . 2014-04-02 04:00 141824 ----a-w- c:\windows\SysWow64\wscript.exe
    2014-04-02 04:00 . 2014-04-02 04:00 126976 ----a-w- c:\windows\SysWow64\cscript.exe
    2014-04-02 04:00 . 2014-04-02 04:00 121856 ----a-w- c:\windows\SysWow64\wshom.ocx
    2014-04-02 04:00 . 2014-04-02 04:00 335360 ----a-w- c:\windows\system32\msieftp.dll
    2014-04-02 04:00 . 2014-04-02 04:00 301568 ----a-w- c:\windows\SysWow64\msieftp.dll
    2014-04-02 04:00 . 2014-04-02 04:00 230400 ----a-w- c:\windows\system32\drivers\portcls.sys
    2014-04-02 04:00 . 2014-04-02 04:00 116736 ----a-w- c:\windows\system32\drivers\drmk.sys
    2014-04-02 03:59 . 2014-04-02 03:59 878080 ----a-w- c:\windows\system32\advapi32.dll
    2014-04-02 03:59 . 2014-04-02 03:59 859648 ----a-w- c:\windows\system32\tdh.dll
    2014-04-02 03:59 . 2014-04-02 03:59 640512 ----a-w- c:\windows\SysWow64\advapi32.dll
    2014-04-02 03:59 . 2014-04-02 03:59 619520 ----a-w- c:\windows\SysWow64\tdh.dll
    2014-04-02 03:59 . 2014-04-02 03:59 5549504 ----a-w- c:\windows\system32\ntoskrnl.exe
    2014-04-02 03:59 . 2014-04-02 03:59 3969472 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2014-04-02 03:59 . 2014-04-02 03:59 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2014-04-02 03:59 . 2014-04-02 03:59 1732032 ----a-w- c:\windows\system32\ntdll.dll
    2014-04-02 03:59 . 2014-04-02 03:59 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
    2014-04-02 03:59 . 2014-04-02 03:59 404480 ----a-w- c:\windows\system32\gdi32.dll
    2014-04-02 03:59 . 2014-04-02 03:59 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
    2014-04-02 03:58 . 2014-04-02 03:58 983488 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
    2014-04-02 03:58 . 2014-04-02 03:58 497152 ----a-w- c:\windows\system32\drivers\afd.sys
    2014-04-02 03:58 . 2014-04-02 03:58 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
    2014-04-02 03:58 . 2014-04-02 03:58 6656 ----a-w- c:\windows\system32\apisetschema.dll
    2014-04-02 03:58 . 2014-04-02 03:58 6144 ---ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 43520 ----a-w- c:\windows\system32\csrsrv.dll
    2014-04-02 03:58 . 2014-04-02 03:58 424448 ----a-w- c:\windows\system32\KernelBase.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 338432 ----a-w- c:\windows\system32\conhost.exe
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
    @= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
    [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
    2014-04-12 00:43 220632 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\SkyDriveShell.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
    @= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
    [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
    2014-04-12 00:43 220632 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\SkyDriveShell.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
    @= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
    [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
    2014-04-12 00:43 220632 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\SkyDriveShell.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Akamai NetSession Interface "= "c:\users\Fran\AppData\Local\Akamai\netsession_win.exe" [2014-04-18 4672920]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "USB3MON "= "c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2013-08-15 292848]
    "PWMTRV "= "c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2013-07-17 6618920]
    "Lenovo Registration "= "c:\program files (x86)\Lenovo Registration\LenovoReg.exe" [2011-06-01 4315872]
    "Integrated Camera_Monitor "= "c:\program files (x86)\Integrated Camera\monitor.exe" [2013-09-27 1720696]
    "IMSS "= "c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2013-06-18 134616]
    "Fastboot "= "c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe" [2013-07-02 733936]
    "Dolby Advanced Audio v2 "= "c:\program files (x86)\Dolby Advanced Audio v2\pcee4.exe" [2012-09-01 508656]
    "WD Drive Unlocker "= "c:\program files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe" [2013-07-10 1694080]
    "HPUsageTrackingLEDM "= "c:\program files (x86)\HP\HP UT LEDM\bin\hppusg.exe" [2009-08-04 30264]
    "ToolboxFX "= "c:\program files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe" [2010-10-25 58936]
    "HP Software Update "= "c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
    "Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
    "WD Quick View "= "c:\program files (x86)\Western Digital\WD Quick View\WDDMStatus.exe" [2014-02-28 5545328]
    "iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin "= 5 (0x5)
    "ConsentPromptBehaviorUser "= 3 (0x3)
    "EnableUIADesktopToggle "= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs "=1 (0x1)
    .
    R1 qknfd;qknfd;c:\windows\system32\drivers\qknfd.sys;c:\windows\SYSNATIVE\drivers\qknfd.sys [x]
    R2 Cachedrv server; Lenovo Fingerprint Manager Pro Cachedrv Service;c:\program files\Lenovo\Fingerprint Manager Pro\cachesrvr.exe;c:\program files\Lenovo\Fingerprint Manager Pro\cachesrvr.exe [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
    R2 omaha;Nok Nok Labs Update Service (omaha);c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe;c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [x]
    R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
    R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [x]
    R3 Fastboot;Fastboot;c:\windows\system32\DRIVERS\fastboot.sys;c:\windows\SYSNATIVE\DRIVERS\fastboot.sys [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
    R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
    R3 iumsvc;Intel(R) Update Manager;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [x]
    R3 LSCWinService;LSCWinService;c:\program files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe;c:\program files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [x]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
    R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
    R3 omaham;Nok Nok Labs Update Service (omaham);c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe;c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [x]
    R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys;c:\windows\SYSNATIVE\DRIVERS\DzHDD64.sys [x]
    S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
    S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
    S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
    S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x]
    S1 OMNISMI;OMNISMI;c:\windows\SysWOW64\drivers\omnismi.sys;c:\windows\SysWOW64\drivers\omnismi.sys [x]
    S2 AdobeActiveFileMonitor11.0;Adobe Active File Monitor V11;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [x]
    S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
    S2 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
    S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
    S2 ClickToRunSvc;Microsoft Office ClickToRun Service;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
    S2 FastbootService;FastbootService;c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe;c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [x]
    S2 HP LaserJet Service;HP LaserJet Service;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [x]
    S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe;c:\windows\SYSNATIVE\HPSIsvc.exe [x]
    S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
    S2 ISCTAgent;Intel(R) Smart Connect Technology Agent;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe ;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [x]
    S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
    S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x]
    S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]
    S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x]
    S2 LENOVO.TVTVCAM;ThinkVantage Virtual Camera Controller;c:\program files\Lenovo\Communications Utility\vcamsvc.exe;c:\program files\Lenovo\Communications Utility\vcamsvc.exe [x]
    S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]
    S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [x]
    S2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8;c:\program files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe;c:\program files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [x]
    S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE;c:\windows\SysWOW64\NLSSRV32.EXE [x]
    S2 QuickControlMasterSvc;Lenovo QuickControl Master Service;c:\program files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe;c:\program files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [x]
    S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
    S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
    S2 valWBFPolicyService;Validity WBF Policy Service;c:\windows\system32\valWBFPolicyService.exe;c:\windows\SYSNATIVE\valWBFPolicyService.exe [x]
    S2 WDBackup;WD Backup;c:\program files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe;c:\program files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [x]
    S2 WDDriveService;WD Drive Manager;c:\program files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe;c:\program files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [x]
    S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
    S3 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\BASHDefs\20140409.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\BASHDefs\20140409.001\BHDrvx64.sys [x]
    S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
    S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
    S3 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
    S3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D;c:\windows\system32\DRIVERS\e1d62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1d62x64.sys [x]
    S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
    S3 ibtusb;Intel(R) Wireless Bluetooth(R) 4.0 + HS Adapter;c:\windows\system32\DRIVERS\ibtusb.sys;c:\windows\SYSNATIVE\DRIVERS\ibtusb.sys [x]
    S3 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\IPSDefs\20140430.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\IPSDefs\20140430.001\IDSvia64.sys [x]
    S3 ikbevent;Intel Upper keyboard Class Filter Driver;c:\windows\system32\DRIVERS\ikbevent.sys;c:\windows\SYSNATIVE\DRIVERS\ikbevent.sys [x]
    S3 imsevent;Intel Upper Mouse Class Filter Driver;c:\windows\system32\DRIVERS\imsevent.sys;c:\windows\SYSNATIVE\DRIVERS\imsevent.sys [x]
    S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys;c:\windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
    S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
    S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
    S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x]
    S3 Power Manager DBC Service;Power Manager Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x]
    S3 QuickControlService;Lenovo QuickControl Service;c:\program files (x86)\Lenovo\QuickControl\QuickControlService.exe;c:\program files (x86)\Lenovo\QuickControl\QuickControlService.exe [x]
    S3 RTSPER;Realtek PCIE Card Reader - PER;c:\windows\system32\DRIVERS\RtsPer.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPer.sys [x]
    S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
    S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\SPUVCbv_x64.sys;c:\windows\SYSNATIVE\Drivers\SPUVCbv_x64.sys [x]
    S3 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
    S3 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
    S3 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
    S3 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMNETS.SYS [x]
    S3 tvtvcamd;Camera Plus (VGA Resolution Maximum);c:\windows\system32\DRIVERS\tvtvcamd.sys;c:\windows\SYSNATIVE\DRIVERS\tvtvcamd.sys [x]
    S3 usb3Hub;UoIP Hub;c:\windows\system32\DRIVERS\usb3Hub.sys;c:\windows\SYSNATIVE\DRIVERS\usb3Hub.sys [x]
    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
    S3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);c:\windows\system32\drivers\WPRO_41_2001.sys;c:\windows\SYSNATIVE\drivers\WPRO_41_2001.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-05-02 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-12 16:36]
    .
    2014-05-02 c:\windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineCore.job
    - c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2014-04-02 12:39]
    .
    2014-05-02 c:\windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineUA.job
    - c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2014-04-02 12:39]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
    @= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
    [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
    2014-04-12 00:43 244696 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
    @= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
    [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
    2014-04-12 00:43 244696 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
    @= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
    [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
    2014-04-12 00:43 244696 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @= "{8BA85C75-763B-4103-94EB-9470F12FE0F7} "
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2014-04-13 07:32 2333400 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @= "{CD55129A-B1A1-438E-A425-CEBC7DC684EE} "
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2014-04-13 07:32 2333400 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @= "{E768CD3B-BDDC-436D-9C13-E1B39CA257B1} "
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2014-04-13 07:32 2333400 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
    @= "{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} "
    [HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]
    2012-09-19 05:36 480888 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
    @= "{62CCD8E3-9C21-41E1-B55E-1E26DFC68511} "
    [HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]
    2012-09-19 05:36 480888 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
    @= "{A759AFF6-5851-457D-A540-F4ECED148351} "
    [HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}]
    2012-09-19 05:36 480888 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
    @= "{1574C9EF-7D58-488F-B358-8B78C1538F51} "
    [HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]
    2012-09-19 05:36 480888 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AdobeAAMUpdater-1.0 "= "c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-06-16 499608]
    "TpShocks "= "TpShocks.exe" [2013-06-21 382248]
    "Persistence "= "c:\windows\system32\igfxpers.exe" [2013-08-18 444400]
    "LENOVO.TPKNRRES "= "c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2013-07-18 296952]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2013-08-18 165872]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2013-08-18 407536]
    "BTMTrayAgent "= "c:\program files (x86)\Intel\Bluetooth\btmshellex.dll" [2013-05-21 7830328]
    "BLEServicesCtrl "= "c:\program files (x86)\Intel\Bluetooth\BleServicesCtrl.exe" [2012-09-17 184112]
    "MFACApp "= "c:\program files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe" [2014-04-15 5447544]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = <local>;*.local
    IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Fran\AppData\Roaming\Mozilla\Firefox\Profiles\RluKgP.default\
    FF - prefs.js: network.proxy.type - 1
    FF - user.js: extensions.irmysearch.aflt - suma_14_15_ff
    FF - user.js: extensions.irmysearch.instlRef - 140305_a
    FF - user.js: extensions.irmysearch.cr - 1327208569
    FF - user.js: extensions.irmysearch.cd - 2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q
    FF - user.js: extensions.mysearchdial.hmpg - true
    FF - user.js: extensions.mysearchdial.hmpgUrl - hxxp://start.mysearchdial.com/?f=1&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=
    FF - user.js: extensions.mysearchdial.dfltSrch - true
    FF - user.js: extensions.mysearchdial.srchPrvdr - Mysearchdial
    FF - user.js: extensions.mysearchdial.dnsErr - true
    FF - user.js: extensions.mysearchdial_i.newTab - false
    FF - user.js: extensions.mysearchdial.newTabUrl - hxxp://start.mysearchdial.com/?f=2&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=
    FF - user.js: extensions.mysearchdial.tlbrSrchUrl - hxxp://start.mysearchdial.com/?f=3&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=&q=
    FF - user.js: extensions.mysearchdial.id - 7E7A911E79059EB2
    FF - user.js: extensions.mysearchdial.instlDay - 16174
    FF - user.js: extensions.mysearchdial.vrsn - 1.8.29.0
    FF - user.js: extensions.mysearchdial.vrsni - 1.8.29.0
    FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.29.04:10
    FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial
    FF - user.js: extensions.mysearchdial.prdct - mysearchdial
    FF - user.js: extensions.mysearchdial.aflt - suma_14_15_ff
    FF - user.js: extensions.mysearchdial_i.smplGrp - none
    FF - user.js: extensions.mysearchdial.tlbrId - base
    FF - user.js: extensions.mysearchdial.instlRef - 140305_a
    FF - user.js: extensions.mysearchdial.dfltLng -
    FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
    FF - user.js: extensions.mysearchdial.excTlbr - false
    FF - user.js: extensions.mysearchdial.cr - 1327208569
    FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q
    FF - user.js: extensions.mysearchdial.AL - 2
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    Wow6432Node-HKLM-Run-<NO NAME> - (no file)
    HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
    Toolbar-Locked - (no file)
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
    "ImagePath "= "\ "c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe\" /s \ "NIS\" /m \ "c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll\" /prefetch:1 "
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2014-05-02 16:52:00
    ComboFix-quarantined-files.txt 2014-05-02 20:51
    .
    Pre-Run: 412,113,481,728 bytes free
    Post-Run: 412,405,051,392 bytes free
    .
    - - End Of File - - E6D439428753FE5A1EF4514A5F2CF9A4
    0D1AF02D8F5566031F5EAA815F5A5B1E
     
  18. 2014/05/02
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Looks good.

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator ".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  19. 2014/05/03
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    Here is Combo:

    ComboFix 14-04-30.01 - Fran 05/02/2014 16:42:30.1.8 - x64
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.7880.4471 [GMT -4:00]
    Running from: c:\users\Fran\Downloads\ComboFix.exe
    AV: Norton Internet Security *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
    FW: Norton Internet Security *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
    SP: Norton Internet Security *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ADS - Windows: deleted 192 bytes in 1 streams.
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\program files\Lenovo\Lenovo Solution Center\Microsoft Fix it\FixitUi\_desktop.ini
    c:\programdata\Roaming
    c:\users\Fran\AppData\Roaming\.#
    c:\users\Fran\PhotoshopElements_11_LS15.exe
    E:\Setup.exe
    Q:\Autorun.inf
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-04-02 to 2014-05-02 )))))))))))))))))))))))))))))))
    .
    .
    2014-05-02 20:50 . 2014-05-02 20:50 -------- d-----w- c:\users\Default\AppData\Local\temp
    2014-05-02 13:17 . 2014-05-02 13:17 94656 ----a-w- c:\windows\system32\WPRO_41_2001woem.tmp
    2014-05-02 13:00 . 2014-04-29 14:01 23547904 ----a-w- c:\windows\system32\mshtml.dll
    2014-05-02 13:00 . 2014-04-29 13:40 2724864 ----a-w- c:\windows\system32\mshtml.tlb
    2014-05-02 13:00 . 2014-04-29 12:34 2724864 ----a-w- c:\windows\SysWow64\mshtml.tlb
    2014-05-01 22:10 . 2014-05-01 22:10 -------- d-----w- c:\windows\system32\drivers\NISx64\1405000.01C
    2014-04-30 14:52 . 2012-08-21 17:01 33240 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2014-04-30 14:52 . 2014-04-30 14:52 -------- dc----w- c:\windows\system32\DRVSTORE
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\program files\iTunes
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\program files (x86)\iTunes
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\programdata\Apple Computer
    2014-04-30 14:52 . 2014-04-30 14:52 -------- d-----w- c:\program files\iPod
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\program files (x86)\Apple Software Update
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\program files\Common Files\Apple
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\program files\Bonjour
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\program files (x86)\Bonjour
    2014-04-30 14:05 . 2014-04-30 14:52 -------- d-----w- c:\program files (x86)\Common Files\Apple
    2014-04-30 14:05 . 2014-04-30 14:05 -------- d-----w- c:\programdata\Apple
    2014-04-30 11:13 . 2014-04-30 11:32 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
    2014-04-30 11:13 . 2014-04-30 11:13 119000 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-04-30 11:12 . 2014-04-30 11:12 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-04-27 12:04 . 2014-01-09 02:22 5694464 ----a-w- c:\windows\SysWow64\mstscax.dll
    2014-04-27 12:04 . 2014-01-03 22:44 6574592 ----a-w- c:\windows\system32\mstscax.dll
    2014-04-27 11:55 . 2014-04-27 11:55 -------- d-----w- c:\programdata\Malwarebytes
    2014-04-27 11:55 . 2014-04-27 11:55 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
    2014-04-27 11:55 . 2013-04-04 18:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-04-26 14:51 . 2014-04-26 14:51 -------- d-----w- c:\program files\Western Digital
    2014-04-26 14:39 . 2014-04-26 14:39 -------- d-s---w- c:\windows\system32\CompatTel
    2014-04-26 14:37 . 2012-08-23 13:24 15360 ----a-w- c:\windows\system32\RdpGroupPolicyExtension.dll
    2014-04-26 14:37 . 2012-08-23 14:10 19456 ----a-w- c:\windows\system32\drivers\rdpvideominiport.sys
    2014-04-26 14:37 . 2012-08-23 14:08 30208 ----a-w- c:\windows\system32\drivers\TsUsbGD.sys
    2014-04-26 14:37 . 2012-08-23 11:12 192000 ----a-w- c:\windows\SysWow64\rdpendp_winip.dll
    2014-04-26 14:37 . 2012-08-23 14:13 243200 ----a-w- c:\windows\system32\rdpudd.dll
    2014-04-26 14:37 . 2012-08-23 10:51 228864 ----a-w- c:\windows\system32\rdpendp_winip.dll
    2014-04-26 14:37 . 2012-08-23 09:51 3174912 ----a-w- c:\windows\system32\rdpcorets.dll
    2014-04-26 14:37 . 2013-09-25 02:23 1030144 ----a-w- c:\windows\system32\TSWorkspace.dll
    2014-04-26 14:37 . 2013-09-25 01:57 792576 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
    2014-04-26 14:36 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll
    2014-04-26 14:36 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll
    2014-04-26 14:36 . 2014-04-14 02:24 465408 ----a-w- c:\windows\system32\aepdu.dll
    2014-04-26 14:36 . 2014-04-14 02:19 424448 ----a-w- c:\windows\system32\aeinv.dll
    2014-04-19 13:04 . 2014-04-19 13:04 -------- d-----w- c:\windows\system32\appmgmt
    2014-04-18 12:39 . 2014-04-18 12:39 -------- d-----w- c:\program files\Nok Nok Labs
    2014-04-16 23:23 . 2014-04-16 23:23 -------- d-----w- c:\windows\Migration
    2014-04-16 02:25 . 2014-04-16 02:26 -------- d-----w- c:\programdata\Hewlett-Packard
    2014-04-16 02:25 . 2014-04-16 02:26 -------- d-----w- c:\programdata\HP
    2014-04-16 02:25 . 2010-10-13 16:02 323584 ----a-w- c:\windows\system32\Spool\prtprocs\x64\hpcpp103.dll
    2014-04-16 02:24 . 2010-09-19 19:51 193592 ----a-w- c:\windows\system32\hppdcompio.dll
    2014-04-16 02:24 . 2010-09-19 19:51 167480 ----a-w- c:\windows\SysWow64\hppccompio.dll
    2014-04-16 02:24 . 2010-10-13 16:02 176640 ----a-w- c:\windows\system32\hpcpn103.dll
    2014-04-16 02:24 . 2010-10-13 15:57 305664 ----a-w- c:\windows\SysWow64\hpcc3103.dll
    2014-04-16 02:24 . 2010-02-11 14:19 491008 ----a-w- c:\windows\SysWow64\hpcdmc32.dll
    2014-04-16 02:23 . 2010-12-14 19:26 311296 ----a-w- c:\windows\system32\hpbcoins64.dll
    2014-04-16 02:23 . 2014-04-16 02:23 -------- d-----w- C:\CP1520_Series_Full_Solution
    2014-04-16 02:20 . 2014-04-16 02:20 -------- d-----w- c:\program files (x86)\Hewlett-Packard
    2014-04-16 02:18 . 2012-09-26 05:45 49664 ----a-r- c:\windows\system32\HP1100SMs.dll
    2014-04-16 02:18 . 2012-08-31 19:10 350720 ----a-w- c:\windows\system32\mvhlewsi.DLL
    2014-04-16 02:18 . 2012-08-31 19:03 1696256 ----a-w- c:\windows\system32\HP1100SM.EXE
    2014-04-16 02:18 . 2012-08-31 19:03 288768 ----a-w- c:\windows\system32\HP1100LM.DLL
    2014-04-16 02:18 . 2012-08-31 19:02 74240 ----a-w- c:\windows\system32\Spool\prtprocs\x64\HP1100PP.dll
    2014-04-16 02:15 . 2012-09-27 00:27 126880 ----a-w- c:\windows\system32\HPSIsvc.exe
    2014-04-16 02:15 . 2014-04-16 02:26 -------- d-----w- c:\program files (x86)\HP
    2014-04-16 02:14 . 2014-04-16 02:14 -------- d-----w- c:\program files\HP
    2014-04-16 02:13 . 2014-04-16 02:13 -------- d-----w- c:\program files (x86)\Common Files\SWF Studio
    2014-04-16 02:13 . 2014-04-16 02:13 -------- d-----w- C:\LJP1100_P1560_P1600_Full_Solution
    2014-04-16 01:39 . 2014-04-16 01:39 -------- d-----r- C:\MSOCache
    2014-04-15 00:52 . 2014-04-15 00:52 -------- d-----w- c:\programdata\FileOpen
    2014-04-14 09:04 . 2014-04-14 23:57 -------- d-----w- c:\program files (x86)\PhotoScape
    2014-04-14 08:10 . 2014-04-14 09:00 -------- dc-h--w- c:\programdata\{0D840360-FAC8-45E3-8244-E235EB1E30AA}
    2014-04-14 08:10 . 2014-04-14 09:01 -------- d-----w- c:\program files (x86)\Optimizer Pro
    2014-04-14 00:35 . 2014-04-14 00:36 -------- d-----w- c:\windows\system32\MRT
    2014-04-12 09:50 . 2014-04-26 14:51 -------- d-----w- c:\program files\Common Files\Western Digital
    2014-04-12 09:50 . 2014-04-26 14:51 -------- d-----w- c:\program files (x86)\Western Digital
    2014-04-12 09:50 . 2014-04-26 14:51 -------- d-----w- c:\program files (x86)\Common Files\Western Digital
    2014-04-12 09:50 . 2014-04-26 14:51 -------- d-----w- c:\programdata\Western Digital
    2014-04-12 08:57 . 2014-04-12 08:57 -------- d-----w- C:\drivers
    2014-04-12 08:36 . 2014-04-12 08:36 -------- d-----w- c:\programdata\regid.1986-12.com.adobe
    2014-04-12 08:30 . 2014-04-12 08:30 -------- d-----w- c:\program files\Common Files\Adobe
    2014-04-12 08:29 . 2012-08-10 07:01 56336 ------w- c:\windows\system32\drivers\PxHlpa64.sys
    2014-04-12 08:29 . 2012-04-24 07:01 11376 ------w- c:\windows\system32\drivers\cdralw2k.sys
    2014-04-12 08:29 . 2012-04-24 07:01 10864 ------w- c:\windows\system32\drivers\cdr4_xp.sys
    2014-04-12 08:28 . 2014-04-12 08:28 -------- d-----w- c:\program files (x86)\Common Files\Sonic Shared
    2014-04-12 08:28 . 2014-04-12 08:28 -------- d-----w- c:\program files (x86)\Common Files\PX Storage Engine
    2014-04-12 08:18 . 2014-04-12 08:18 -------- d-----w- c:\windows\SysWow64\Wat
    2014-04-12 08:18 . 2014-04-12 08:18 -------- d-----w- c:\windows\system32\Wat
    2014-04-12 07:16 . 2013-10-14 22:00 28368 ----a-w- c:\windows\system32\IEUDINIT.EXE
    2014-04-12 01:01 . 2014-04-29 16:36 70832 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-04-12 01:01 . 2014-04-29 16:36 692400 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-04-12 01:01 . 2014-04-12 01:01 -------- d-----w- c:\windows\SysWow64\Macromed
    2014-04-12 01:01 . 2014-04-12 01:01 -------- d-----w- c:\windows\system32\Macromed
    2014-04-12 00:52 . 2014-04-12 00:52 -------- d-----w- c:\program files (x86)\SoapMaker3
    2014-04-12 00:43 . 2014-04-12 00:43 -------- d-----w- c:\program files (x86)\Microsoft SkyDrive
    2014-04-12 00:43 . 2014-04-12 00:43 -------- d-----w- c:\programdata\Microsoft SkyDrive
    2014-04-12 00:39 . 2014-02-07 01:23 3156480 ----a-w- c:\windows\system32\win32k.sys
    2014-04-11 04:59 . 2014-04-11 04:59 -------- d-----w- c:\program files\Validity Sensors
    2014-04-11 04:57 . 2014-04-11 04:57 -------- d-----w- c:\program files (x86)\Common Files\Symantec Shared
    2014-04-11 04:57 . 2014-03-17 02:41 553200 ----a-w- c:\windows\system32\drivers\SynTP.sys
    2014-04-11 04:57 . 2014-03-17 02:41 208112 ----a-w- c:\windows\system32\SynTPCo20.dll
    2014-04-11 04:57 . 2014-03-17 02:41 254192 ----a-w- c:\windows\system32\SynTPAPI.dll
    2014-04-11 04:57 . 2014-03-17 02:41 404720 ----a-w- c:\windows\SysWow64\SynCom.dll
    2014-04-11 04:57 . 2014-03-17 02:41 31472 ----a-w- c:\windows\system32\drivers\Smb_driver_Intel.sys
    2014-04-11 04:56 . 2012-02-17 06:38 1031680 ----a-w- c:\windows\system32\rdpcore.dll
    2014-04-11 04:56 . 2012-02-17 05:34 826880 ----a-w- c:\windows\SysWow64\rdpcore.dll
    2014-04-11 04:56 . 2012-02-17 04:57 23552 ----a-w- c:\windows\system32\drivers\tdtcp.sys
    2014-04-11 04:55 . 2014-04-11 04:55 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service
    2014-04-11 04:52 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll
    2014-04-11 04:52 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe
    2014-04-11 04:52 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll
    2014-04-11 04:52 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll
    2014-04-11 04:52 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll
    2014-04-11 04:52 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll
    2014-04-11 04:52 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll
    2014-04-11 04:52 . 2012-06-02 19:19 186752 ----a-w- c:\windows\system32\wuwebv.dll
    2014-04-11 04:52 . 2012-06-02 19:15 36864 ----a-w- c:\windows\system32\wuapp.exe
    2014-04-11 04:46 . 2014-05-02 20:50 -------- d-----w- c:\users\Fran
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-05-02 13:17 . 2014-04-02 04:27 34752 ----a-w- c:\windows\system32\drivers\WPRO_41_2001.sys
    2014-04-02 04:38 . 2014-04-02 04:38 177312 ----a-w- c:\windows\system32\drivers\SYMEVENT64x86.SYS
    2014-04-02 04:35 . 2014-04-02 04:35 29480 ----a-w- c:\windows\SysWow64\msxml3a.dll
    2014-04-02 04:35 . 2014-04-02 04:35 499712 ----a-w- c:\windows\SysWow64\msvcp71.dll
    2014-04-02 04:35 . 2014-04-02 04:35 348160 ----a-w- c:\windows\SysWow64\msvcr71.dll
    2014-04-02 04:01 . 2014-04-02 04:01 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2014-04-02 04:01 . 2014-04-02 04:01 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-04-02 04:00 . 2014-04-02 04:00 197120 ----a-w- c:\windows\system32\credui.dll
    2014-04-02 04:00 . 2014-04-02 04:00 1930752 ----a-w- c:\windows\system32\authui.dll
    2014-04-02 04:00 . 2014-04-02 04:00 190464 ----a-w- c:\windows\system32\SmartcardCredentialProvider.dll
    2014-04-02 04:00 . 2014-04-02 04:00 1796096 ----a-w- c:\windows\SysWow64\authui.dll
    2014-04-02 04:00 . 2014-04-02 04:00 168960 ----a-w- c:\windows\SysWow64\credui.dll
    2014-04-02 04:00 . 2014-04-02 04:00 152576 ----a-w- c:\windows\SysWow64\SmartcardCredentialProvider.dll
    2014-04-02 04:00 . 2014-04-02 04:00 81408 ----a-w- c:\windows\system32\imagehlp.dll
    2014-04-02 04:00 . 2014-04-02 04:00 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll
    2014-04-02 04:00 . 2014-04-02 04:00 202752 ----a-w- c:\windows\system32\scrrun.dll
    2014-04-02 04:00 . 2014-04-02 04:00 168960 ----a-w- c:\windows\system32\wscript.exe
    2014-04-02 04:00 . 2014-04-02 04:00 163840 ----a-w- c:\windows\SysWow64\scrrun.dll
    2014-04-02 04:00 . 2014-04-02 04:00 156160 ----a-w- c:\windows\system32\cscript.exe
    2014-04-02 04:00 . 2014-04-02 04:00 150016 ----a-w- c:\windows\system32\wshom.ocx
    2014-04-02 04:00 . 2014-04-02 04:00 141824 ----a-w- c:\windows\SysWow64\wscript.exe
    2014-04-02 04:00 . 2014-04-02 04:00 126976 ----a-w- c:\windows\SysWow64\cscript.exe
    2014-04-02 04:00 . 2014-04-02 04:00 121856 ----a-w- c:\windows\SysWow64\wshom.ocx
    2014-04-02 04:00 . 2014-04-02 04:00 335360 ----a-w- c:\windows\system32\msieftp.dll
    2014-04-02 04:00 . 2014-04-02 04:00 301568 ----a-w- c:\windows\SysWow64\msieftp.dll
    2014-04-02 04:00 . 2014-04-02 04:00 230400 ----a-w- c:\windows\system32\drivers\portcls.sys
    2014-04-02 04:00 . 2014-04-02 04:00 116736 ----a-w- c:\windows\system32\drivers\drmk.sys
    2014-04-02 03:59 . 2014-04-02 03:59 878080 ----a-w- c:\windows\system32\advapi32.dll
    2014-04-02 03:59 . 2014-04-02 03:59 859648 ----a-w- c:\windows\system32\tdh.dll
    2014-04-02 03:59 . 2014-04-02 03:59 640512 ----a-w- c:\windows\SysWow64\advapi32.dll
    2014-04-02 03:59 . 2014-04-02 03:59 619520 ----a-w- c:\windows\SysWow64\tdh.dll
    2014-04-02 03:59 . 2014-04-02 03:59 5549504 ----a-w- c:\windows\system32\ntoskrnl.exe
    2014-04-02 03:59 . 2014-04-02 03:59 3969472 ----a-w- c:\windows\SysWow64\ntkrnlpa.exe
    2014-04-02 03:59 . 2014-04-02 03:59 3914176 ----a-w- c:\windows\SysWow64\ntoskrnl.exe
    2014-04-02 03:59 . 2014-04-02 03:59 1732032 ----a-w- c:\windows\system32\ntdll.dll
    2014-04-02 03:59 . 2014-04-02 03:59 1292192 ----a-w- c:\windows\SysWow64\ntdll.dll
    2014-04-02 03:59 . 2014-04-02 03:59 404480 ----a-w- c:\windows\system32\gdi32.dll
    2014-04-02 03:59 . 2014-04-02 03:59 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
    2014-04-02 03:58 . 2014-04-02 03:58 983488 ----a-w- c:\windows\system32\drivers\dxgkrnl.sys
    2014-04-02 03:58 . 2014-04-02 03:58 497152 ----a-w- c:\windows\system32\drivers\afd.sys
    2014-04-02 03:58 . 2014-04-02 03:58 6656 ----a-w- c:\windows\SysWow64\apisetschema.dll
    2014-04-02 03:58 . 2014-04-02 03:58 6656 ----a-w- c:\windows\system32\apisetschema.dll
    2014-04-02 03:58 . 2014-04-02 03:58 6144 ---ha-w- c:\windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 6144 ---ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 5120 ---ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 5120 ---ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4608 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4608 ---ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4608 ---ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 43520 ----a-w- c:\windows\system32\csrsrv.dll
    2014-04-02 03:58 . 2014-04-02 03:58 424448 ----a-w- c:\windows\system32\KernelBase.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 4096 ---ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3584 ---ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 338432 ----a-w- c:\windows\system32\conhost.exe
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2014-04-02 03:58 . 2014-04-02 03:58 3072 ---ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
    @= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
    [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
    2014-04-12 00:43 220632 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\SkyDriveShell.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
    @= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
    [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
    2014-04-12 00:43 220632 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\SkyDriveShell.dll
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
    @= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
    [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
    2014-04-12 00:43 220632 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\SkyDriveShell.dll
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Akamai NetSession Interface "= "c:\users\Fran\AppData\Local\Akamai\netsession_win.exe" [2014-04-18 4672920]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "USB3MON "= "c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2013-08-15 292848]
    "PWMTRV "= "c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2013-07-17 6618920]
    "Lenovo Registration "= "c:\program files (x86)\Lenovo Registration\LenovoReg.exe" [2011-06-01 4315872]
    "Integrated Camera_Monitor "= "c:\program files (x86)\Integrated Camera\monitor.exe" [2013-09-27 1720696]
    "IMSS "= "c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2013-06-18 134616]
    "Fastboot "= "c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBConsole.exe" [2013-07-02 733936]
    "Dolby Advanced Audio v2 "= "c:\program files (x86)\Dolby Advanced Audio v2\pcee4.exe" [2012-09-01 508656]
    "WD Drive Unlocker "= "c:\program files (x86)\Western Digital\WD Security\WDDriveAutoUnlock.exe" [2013-07-10 1694080]
    "HPUsageTrackingLEDM "= "c:\program files (x86)\HP\HP UT LEDM\bin\hppusg.exe" [2009-08-04 30264]
    "ToolboxFX "= "c:\program files (x86)\HP\ToolboxFX\bin\HPTLBXFX.exe" [2010-10-25 58936]
    "HP Software Update "= "c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2010-06-10 49208]
    "Adobe ARM "= "c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-12-21 959904]
    "WD Quick View "= "c:\program files (x86)\Western Digital\WD Quick View\WDDMStatus.exe" [2014-02-28 5545328]
    "iTunesHelper "= "c:\program files (x86)\iTunes\iTunesHelper.exe" [2014-02-21 152392]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin "= 5 (0x5)
    "ConsentPromptBehaviorUser "= 3 (0x3)
    "EnableUIADesktopToggle "= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs "=1 (0x1)
    .
    R1 qknfd;qknfd;c:\windows\system32\drivers\qknfd.sys;c:\windows\SYSNATIVE\drivers\qknfd.sys [x]
    R2 Cachedrv server; Lenovo Fingerprint Manager Pro Cachedrv Service;c:\program files\Lenovo\Fingerprint Manager Pro\cachesrvr.exe;c:\program files\Lenovo\Fingerprint Manager Pro\cachesrvr.exe [x]
    R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
    R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x]
    R2 omaha;Nok Nok Labs Update Service (omaha);c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe;c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [x]
    R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
    R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [x]
    R3 Fastboot;Fastboot;c:\windows\system32\DRIVERS\fastboot.sys;c:\windows\SYSNATIVE\DRIVERS\fastboot.sys [x]
    R3 IEEtwCollectorService;Internet Explorer ETW Collector Service;c:\windows\system32\IEEtwCollector.exe;c:\windows\SYSNATIVE\IEEtwCollector.exe [x]
    R3 intaud_WaveExtensible;Intel WiDi Audio Device;c:\windows\system32\drivers\intelaud.sys;c:\windows\SYSNATIVE\drivers\intelaud.sys [x]
    R3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys;c:\windows\SYSNATIVE\DRIVERS\IntcDAud.sys [x]
    R3 Intel(R) Capability Licensing Service TCP IP Interface;Intel(R) Capability Licensing Service TCP IP Interface;c:\program files\Intel\iCLS Client\SocketHeciServer.exe;c:\program files\Intel\iCLS Client\SocketHeciServer.exe [x]
    R3 iumsvc;Intel(R) Update Manager;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe;c:\program files (x86)\Intel\Intel(R) Update Manager\bin\iumsvc.exe [x]
    R3 LSCWinService;LSCWinService;c:\program files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe;c:\program files\Lenovo\Lenovo Solution Center\App\LSCWinService.exe [x]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
    R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
    R3 omaham;Nok Nok Labs Update Service (omaham);c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe;c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [x]
    R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x]
    R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
    R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
    R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
    R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x]
    S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys;c:\windows\SYSNATIVE\DRIVERS\DzHDD64.sys [x]
    S0 iaStorA;iaStorA;c:\windows\system32\DRIVERS\iaStorA.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorA.sys [x]
    S0 iaStorF;iaStorF;c:\windows\system32\DRIVERS\iaStorF.sys;c:\windows\SYSNATIVE\DRIVERS\iaStorF.sys [x]
    S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\DRIVERS\iusb3hcs.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hcs.sys [x]
    S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys;c:\windows\SYSNATIVE\Drivers\PxHlpa64.sys [x]
    S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x]
    S1 OMNISMI;OMNISMI;c:\windows\SysWOW64\drivers\omnismi.sys;c:\windows\SysWOW64\drivers\omnismi.sys [x]
    S2 AdobeActiveFileMonitor11.0;Adobe Active File Monitor V11;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe;c:\program files (x86)\Adobe\Elements 11 Organizer\PhotoshopElementsFileAgent.exe [x]
    S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [x]
    S2 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [x]
    S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [x]
    S2 ClickToRunSvc;Microsoft Office ClickToRun Service;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe;c:\program files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [x]
    S2 FastbootService;FastbootService;c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe;c:\program files (x86)\Lenovo\RapidBoot HDD Accelerator\FBService.exe [x]
    S2 HP LaserJet Service;HP LaserJet Service;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe;c:\program files (x86)\HP\HPLaserJetService\HPLaserJetService.exe [x]
    S2 HPSIService;HP SI Service;c:\windows\system32\HPSIsvc.exe;c:\windows\SYSNATIVE\HPSIsvc.exe [x]
    S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe;c:\program files\Intel\iCLS Client\HeciServer.exe [x]
    S2 ISCTAgent;Intel(R) Smart Connect Technology Agent;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe ;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [x]
    S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [x]
    S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x]
    S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]
    S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x]
    S2 LENOVO.TVTVCAM;ThinkVantage Virtual Camera Controller;c:\program files\Lenovo\Communications Utility\vcamsvc.exe;c:\program files\Lenovo\Communications Utility\vcamsvc.exe [x]
    S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]
    S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe;c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [x]
    S2 NitroDriverReadSpool8;NitroPDFDriverCreatorReadSpool8;c:\program files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe;c:\program files\Common Files\Nitro\Pro\8.0\NitroPDFDriverService8x64.exe [x]
    S2 nlsX86cc;Nalpeiron Licensing Service;c:\windows\SysWOW64\NLSSRV32.EXE;c:\windows\SysWOW64\NLSSRV32.EXE [x]
    S2 QuickControlMasterSvc;Lenovo QuickControl Master Service;c:\program files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe;c:\program files (x86)\Lenovo\QuickControl\QuickControlMasterSvc.exe [x]
    S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
    S2 TPHKSVC;On Screen Display;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
    S2 valWBFPolicyService;Validity WBF Policy Service;c:\windows\system32\valWBFPolicyService.exe;c:\windows\SYSNATIVE\valWBFPolicyService.exe [x]
    S2 WDBackup;WD Backup;c:\program files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe;c:\program files (x86)\Western Digital\WD SmartWare\WDBackupEngine.exe [x]
    S2 WDDriveService;WD Drive Manager;c:\program files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe;c:\program files (x86)\Western Digital\WD Drive Manager\WDDriveService.exe [x]
    S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [x]
    S3 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\BASHDefs\20140409.001\BHDrvx64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\BASHDefs\20140409.001\BHDrvx64.sys [x]
    S3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys;c:\windows\SYSNATIVE\DRIVERS\btmaux.sys [x]
    S3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys;c:\windows\SYSNATIVE\DRIVERS\btmhsf.sys [x]
    S3 ccSet_NIS;Norton Internet Security Settings Manager;c:\windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\ccSetx64.sys [x]
    S3 e1dexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver D;c:\windows\system32\DRIVERS\e1d62x64.sys;c:\windows\SYSNATIVE\DRIVERS\e1d62x64.sys [x]
    S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [x]
    S3 ibtusb;Intel(R) Wireless Bluetooth(R) 4.0 + HS Adapter;c:\windows\system32\DRIVERS\ibtusb.sys;c:\windows\SYSNATIVE\DRIVERS\ibtusb.sys [x]
    S3 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\IPSDefs\20140430.001\IDSvia64.sys;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.4.0.40\Definitions\IPSDefs\20140430.001\IDSvia64.sys [x]
    S3 ikbevent;Intel Upper keyboard Class Filter Driver;c:\windows\system32\DRIVERS\ikbevent.sys;c:\windows\SYSNATIVE\DRIVERS\ikbevent.sys [x]
    S3 imsevent;Intel Upper Mouse Class Filter Driver;c:\windows\system32\DRIVERS\imsevent.sys;c:\windows\SYSNATIVE\DRIVERS\imsevent.sys [x]
    S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys;c:\windows\SYSNATIVE\DRIVERS\ISCTD64.sys [x]
    S3 iusb3hub;Intel(R) USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\iusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3hub.sys [x]
    S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\DRIVERS\iusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\iusb3xhc.sys [x]
    S3 iwdbus;IWD Bus Enumerator;c:\windows\system32\DRIVERS\iwdbus.sys;c:\windows\SYSNATIVE\DRIVERS\iwdbus.sys [x]
    S3 Power Manager DBC Service;Power Manager Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x]
    S3 QuickControlService;Lenovo QuickControl Service;c:\program files (x86)\Lenovo\QuickControl\QuickControlService.exe;c:\program files (x86)\Lenovo\QuickControl\QuickControlService.exe [x]
    S3 RTSPER;Realtek PCIE Card Reader - PER;c:\windows\system32\DRIVERS\RtsPer.sys;c:\windows\SYSNATIVE\DRIVERS\RtsPer.sys [x]
    S3 SmbDrvI;SmbDrvI;c:\windows\system32\DRIVERS\Smb_driver_Intel.sys;c:\windows\SYSNATIVE\DRIVERS\Smb_driver_Intel.sys [x]
    S3 SPUVCbv;SPUVCb Driver Service;c:\windows\system32\Drivers\SPUVCbv_x64.sys;c:\windows\SYSNATIVE\Drivers\SPUVCbv_x64.sys [x]
    S3 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1404000.028\SYMDS64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMDS64.SYS [x]
    S3 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1404000.028\SYMEFA64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMEFA64.SYS [x]
    S3 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\Ironx64.SYS [x]
    S3 SymNetS;Symantec Network Security WFP Driver;c:\windows\system32\drivers\NISx64\1404000.028\SYMNETS.SYS;c:\windows\SYSNATIVE\drivers\NISx64\1404000.028\SYMNETS.SYS [x]
    S3 tvtvcamd;Camera Plus (VGA Resolution Maximum);c:\windows\system32\DRIVERS\tvtvcamd.sys;c:\windows\SYSNATIVE\DRIVERS\tvtvcamd.sys [x]
    S3 usb3Hub;UoIP Hub;c:\windows\system32\DRIVERS\usb3Hub.sys;c:\windows\SYSNATIVE\DRIVERS\usb3Hub.sys [x]
    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\DRIVERS\wdcsam64.sys;c:\windows\SYSNATIVE\DRIVERS\wdcsam64.sys [x]
    S3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);c:\windows\system32\drivers\WPRO_41_2001.sys;c:\windows\SYSNATIVE\drivers\WPRO_41_2001.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-05-02 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-04-12 16:36]
    .
    2014-05-02 c:\windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineCore.job
    - c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2014-04-02 12:39]
    .
    2014-05-02 c:\windows\Tasks\Nok Nok LabsMFACUpdaterTaskMachineUA.job
    - c:\program files (x86)\Nok Nok Labs\MFACUpdater\MFACUpdate.exe [2014-04-02 12:39]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive1]
    @= "{F241C880-6982-4CE5-8CF7-7085BA96DA5A} "
    [HKEY_CLASSES_ROOT\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}]
    2014-04-12 00:43 244696 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive2]
    @= "{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} "
    [HKEY_CLASSES_ROOT\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}]
    2014-04-12 00:43 244696 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrive3]
    @= "{BBACC218-34EA-4666-9D7A-C78F2274A524} "
    [HKEY_CLASSES_ROOT\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}]
    2014-04-12 00:43 244696 ----a-w- c:\users\Fran\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828\amd64\SkyDriveShell64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro1 (ErrorConflict)]
    @= "{8BA85C75-763B-4103-94EB-9470F12FE0F7} "
    [HKEY_CLASSES_ROOT\CLSID\{8BA85C75-763B-4103-94EB-9470F12FE0F7}]
    2014-04-13 07:32 2333400 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro2 (SyncInProgress)]
    @= "{CD55129A-B1A1-438E-A425-CEBC7DC684EE} "
    [HKEY_CLASSES_ROOT\CLSID\{CD55129A-B1A1-438E-A425-CEBC7DC684EE}]
    2014-04-13 07:32 2333400 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\ SkyDrivePro3 (InSync)]
    @= "{E768CD3B-BDDC-436D-9C13-E1B39CA257B1} "
    [HKEY_CLASSES_ROOT\CLSID\{E768CD3B-BDDC-436D-9C13-E1B39CA257B1}]
    2014-04-13 07:32 2333400 ----a-w- c:\program files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
    @= "{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472} "
    [HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]
    2012-09-19 05:36 480888 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
    @= "{62CCD8E3-9C21-41E1-B55E-1E26DFC68511} "
    [HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]
    2012-09-19 05:36 480888 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
    @= "{A759AFF6-5851-457D-A540-F4ECED148351} "
    [HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}]
    2012-09-19 05:36 480888 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
    @= "{1574C9EF-7D58-488F-B358-8B78C1538F51} "
    [HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]
    2012-09-19 05:36 480888 ----a-w- c:\program files (x86)\SugarSync\SugarSyncShellExt_x64.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AdobeAAMUpdater-1.0 "= "c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-06-16 499608]
    "TpShocks "= "TpShocks.exe" [2013-06-21 382248]
    "Persistence "= "c:\windows\system32\igfxpers.exe" [2013-08-18 444400]
    "LENOVO.TPKNRRES "= "c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2013-07-18 296952]
    "IgfxTray "= "c:\windows\system32\igfxtray.exe" [2013-08-18 165872]
    "HotKeysCmds "= "c:\windows\system32\hkcmd.exe" [2013-08-18 407536]
    "BTMTrayAgent "= "c:\program files (x86)\Intel\Bluetooth\btmshellex.dll" [2013-05-21 7830328]
    "BLEServicesCtrl "= "c:\program files (x86)\Intel\Bluetooth\BleServicesCtrl.exe" [2012-09-17 184112]
    "MFACApp "= "c:\program files\Nok Nok Labs\Multifactor Authentication Client\bin\mfac.exe" [2014-04-15 5447544]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    mLocal Page = c:\windows\SysWOW64\blank.htm
    uInternet Settings,ProxyOverride = <local>;*.local
    IE: E&xport to Microsoft Excel - c:\program files\Microsoft Office 15\Root\Office15\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\program files\Microsoft Office 15\Root\Office15\ONBttnIE.dll/105
    TCP: DhcpNameServer = 192.168.1.1
    FF - ProfilePath - c:\users\Fran\AppData\Roaming\Mozilla\Firefox\Profiles\RluKgP.default\
    FF - prefs.js: network.proxy.type - 1
    FF - user.js: extensions.irmysearch.aflt - suma_14_15_ff
    FF - user.js: extensions.irmysearch.instlRef - 140305_a
    FF - user.js: extensions.irmysearch.cr - 1327208569
    FF - user.js: extensions.irmysearch.cd - 2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q
    FF - user.js: extensions.mysearchdial.hmpg - true
    FF - user.js: extensions.mysearchdial.hmpgUrl - hxxp://start.mysearchdial.com/?f=1&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=
    FF - user.js: extensions.mysearchdial.dfltSrch - true
    FF - user.js: extensions.mysearchdial.srchPrvdr - Mysearchdial
    FF - user.js: extensions.mysearchdial.dnsErr - true
    FF - user.js: extensions.mysearchdial_i.newTab - false
    FF - user.js: extensions.mysearchdial.newTabUrl - hxxp://start.mysearchdial.com/?f=2&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=
    FF - user.js: extensions.mysearchdial.tlbrSrchUrl - hxxp://start.mysearchdial.com/?f=3&a=suma_14_15_ff&cd=2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q&cr=1327208569&ir=&q=
    FF - user.js: extensions.mysearchdial.id - 7E7A911E79059EB2
    FF - user.js: extensions.mysearchdial.instlDay - 16174
    FF - user.js: extensions.mysearchdial.vrsn - 1.8.29.0
    FF - user.js: extensions.mysearchdial.vrsni - 1.8.29.0
    FF - user.js: extensions.mysearchdial_i.vrsnTs - 1.8.29.04:10
    FF - user.js: extensions.mysearchdial.prtnrId - mysearchdial
    FF - user.js: extensions.mysearchdial.prdct - mysearchdial
    FF - user.js: extensions.mysearchdial.aflt - suma_14_15_ff
    FF - user.js: extensions.mysearchdial_i.smplGrp - none
    FF - user.js: extensions.mysearchdial.tlbrId - base
    FF - user.js: extensions.mysearchdial.instlRef - 140305_a
    FF - user.js: extensions.mysearchdial.dfltLng -
    FF - user.js: extensions.mysearchdial.appId - {CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}
    FF - user.js: extensions.mysearchdial.excTlbr - false
    FF - user.js: extensions.mysearchdial.cr - 1327208569
    FF - user.js: extensions.mysearchdial.cd - 2XzuyEtN2Y1L1QzuyB0EyB0AzytCtC0EyBzytDyDzy0E0BtBtN0D0Tzu0SzztAyEtN1L2XzutBtFtBtDtFtCtFtDtN1L1CzutCyEtDtAtDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StByE0A0DtCzyyCzztGtCyBzzyBtGtA0E0AtBtGyB0B0DzytGyEyEzyyBzzyD0AyC0B0AtB0E2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyC0AzyyDyCyByDtCtG0DtCzztCtG0EtDtAtAtGtA0B0AtBtGyD0F0FyEtD0ByB0FtBtAyCyE2Q
    FF - user.js: extensions.mysearchdial.AL - 2
    .
    - - - - ORPHANS REMOVED - - - -
    .
    Toolbar-Locked - (no file)
    Wow6432Node-HKLM-Run-<NO NAME> - (no file)
    HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
    Toolbar-Locked - (no file)
    HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
    .
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NIS]
    "ImagePath "= "\ "c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe\" /s \ "NIS\" /m \ "c:\program files (x86)\Norton Internet Security\Engine\20.4.0.40\diMaster.dll\" /prefetch:1 "
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    .
    Completion time: 2014-05-02 16:52:00
    ComboFix-quarantined-files.txt 2014-05-02 20:51
    .
    Pre-Run: 412,113,481,728 bytes free
    Post-Run: 412,405,051,392 bytes free
    .
    - - End Of File - - E6D439428753FE5A1EF4514A5F2CF9A4
    0D1AF02D8F5566031F5EAA815F5A5B1E
     
  20. 2014/05/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please read my previous reply.
     
  21. 2014/05/04
    franbiaggi

    franbiaggi Inactive Thread Starter

    Joined:
    2014/04/26
    Messages:
    48
    Likes Received:
    0
    I am a bit worried. I followed the directions of the adwcleaner and my laptop does not load. I scanned and cleaned and it prompt me that I needed to shut down. Pressed ok and when it rebooted the mouse is spinning and there are no icons on my desktop. I cannot do anything with the mouse. I can only shut it by pressing the off button. Rebooting it does the same thing. Please help.
     

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.