Solved Strangeness Abounds - including DDS not completing

DCHammer · 2014/03/24

[Solved] Strangeness Abounds - including DDS not completing

Not my first visit here to help a friend or family member clean up a mess. This is has me quite stumped as I can't even get through the 'DO THIS FIRST' steps.

Installed MSE because there was no anti-virus on this Vista machine at all.
MSE doesn't produce a log file that I can find but it did find and clean the following:
Rogue:Win32/FakeRean
Exploit:Java/CVE-2008-5353

Then installed MBAM which found nothing. The log will be at the end of this post.
Then ran DDS. It has yet to complete despite multiple attempts.

I'm stumped.

Got any advice?

Darren

MBAM Log:
Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.03.24.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Annette :: ANNETTE-PC [administrator]

Protection: Enabled

24/03/2014 11:01:46 AM
mbam-log-2014-03-24 (11-01-46).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 222040
Time elapsed: 20 minute(s), 12 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

broni · 2014/03/24

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

====================================

Download RogueKiller from one of the following links and save it to your Desktop:

Link 1

Link 2

Close all the running programs

Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator

Otherwise just double-click on RogueKiller.exe

Pre-scan will start. Let it finish.

Click on SCAN button.

Wait until the Status box shows Scan Finished

Click on Delete.

Wait until the Status box shows Deleting Finished.

Click on Report and copy/paste the content of the Notepad into your next reply.

RKreport.txt could also be found on your desktop.

If more than one log is produced post all logs.

If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Create new restore point before proceeding with the next step....
How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

Download Malwarebytes Anti-Rootkit (MBAR) from HERE

Unzip downloaded file.

Open the folder where the contents were unzipped and run mbar.exe

Follow the instructions in the wizard to update and allow the program to scan your computer for threats.

Click on the Cleanup button to remove any threats and reboot if prompted to do so.

Wait while the system shuts down and the cleanup process is performed.

Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.

When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

DCHammer · 2014/03/24

Here is the RK log(s). It generated three and it wasn't clear what to include so they are all here.
MBAR didn't find anything so there is no log.

RogueKiller V8.8.12 [Mar 20 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : Annette [Admin rights]
Mode : Scan -- Date : 03/24/2014 21:50:39
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 6 ¤¤¤
[RUN][SUSP PATH] HKLM\[...]\Run : Skytel (Skytel.exe [7]) -> FOUND
[DNS][PUM] HKLM\[...]\CCSet\[...]\{50683A21-C20A-4246-B65F-56AC3A5E3F8D} : NameServer (8.8.8.8,4.4.4.4 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[DNS][PUM] HKLM\[...]\CS001\[...]\{50683A21-C20A-4246-B65F-56AC3A5E3F8D} : NameServer (8.8.8.8,4.4.4.4 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[DNS][PUM] HKLM\[...]\CS002\[...]\{50683A21-C20A-4246-B65F-56AC3A5E3F8D} : NameServer (8.8.8.8,4.4.4.4 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) TOSHIBA MK1637GSX ATA Device +++++
--- User ---
[MBR] 55d53c19db2f5f879832917eb06ac59c
[BSP] 67021ac75d449c775adbb52abaf7cb20 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 7661 MB
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 15693824 | Size: 144964 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_03242014_215039.txt >>

RogueKiller V8.8.12 [Mar 20 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : Annette [Admin rights]
Mode : Scan -- Date : 03/24/2014 21:56:03
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 6 ¤¤¤
[RUN][SUSP PATH] HKLM\[...]\Run : Skytel (Skytel.exe [7]) -> FOUND
[DNS][PUM] HKLM\[...]\CCSet\[...]\{50683A21-C20A-4246-B65F-56AC3A5E3F8D} : NameServer (8.8.8.8,4.4.4.4 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[DNS][PUM] HKLM\[...]\CS001\[...]\{50683A21-C20A-4246-B65F-56AC3A5E3F8D} : NameServer (8.8.8.8,4.4.4.4 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[DNS][PUM] HKLM\[...]\CS002\[...]\{50683A21-C20A-4246-B65F-56AC3A5E3F8D} : NameServer (8.8.8.8,4.4.4.4 [UNITED STATES (US) - UNITED STATES (US)]) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) TOSHIBA MK1637GSX ATA Device +++++
--- User ---
[MBR] 55d53c19db2f5f879832917eb06ac59c
[BSP] 67021ac75d449c775adbb52abaf7cb20 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 7661 MB
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 15693824 | Size: 144964 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_S_03242014_215603.txt >>
RKreport[0]_S_03242014_215039.txt

RogueKiller V8.8.12 [Mar 20 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows Vista (6.0.6002 Service Pack 2) 32 bits version
Started in : Normal mode
User : Annette [Admin rights]
Mode : Remove -- Date : 03/24/2014 21:58:53
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 3 ¤¤¤
[RUN][SUSP PATH] HKLM\[...]\Run : Skytel (Skytel.exe [7]) -> DELETED
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

127.0.0.1 localhost
::1 localhost

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) TOSHIBA MK1637GSX ATA Device +++++
--- User ---
[MBR] 55d53c19db2f5f879832917eb06ac59c
[BSP] 67021ac75d449c775adbb52abaf7cb20 : Windows Vista MBR Code
Partition table:
0 - [XXXXXX] ACER (0x27) [VISIBLE] Offset (sectors): 2048 | Size: 7661 MB
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 15693824 | Size: 144964 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_03242014_215853.txt >>
RKreport[0]_S_03242014_215039.txt;RKreport[0]_S_03242014_215603.txt

broni · 2014/03/24

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.

Close any open browsers.

Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.

Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

DCHammer · 2014/03/25

Combofix started and created the Restore point but hung completely at the scan. No hard drive activity, nothing.
Should I try running it again or proceed with the rKill process?

broni · 2014/03/25

Yes, give it a shot from safe mode with rKill first.

DCHammer · 2014/03/25

Ok. I won't get to try that until Friday evening. I'll do it and get back to you.

broni · 2014/03/25

.....

DCHammer · 2014/03/28

Wow, this thing must be seriously messed up.
Getting truly stumped. I thought I've dealt with infected machines before.

Booted to safe mode, ran rkill elevated as Administrator. Log is below.
Immediately ran myname.exe which showed a warning about rights but it continued anyway. It eventually froze while scanning.

Assuming a rights problem, I rebooted to safe mode, reran rkill elevated and immediately ran myname.exe elevated as well.
It too froze.

Here is the second rkill log. It's exactly the same as the first one although the second execution did overwrite the first.

Rkill 2.6.5 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 03/28/2014 02:41:22 PM in x86 mode. (Safe Mode)
Windows Version: Windows Vista (TM) Home Premium Service Pack 2

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* No issues found.

Checking Windows Service Integrity:

* Base Filtering Engine (BFE) is not Running.
Startup Type set to: Automatic

* DHCP Client (Dhcp) is not Running.
Startup Type set to: Automatic

* DNS Client (Dnscache) is not Running.
Startup Type set to: Automatic

* COM+ Event System (EventSystem) is not Running.
Startup Type set to: Automatic

* Windows Firewall (MpsSvc) is not Running.
Startup Type set to: Automatic

* Network Connections (Netman) is not Running.
Startup Type set to: Manual

* Network Store Interface Service (nsi) is not Running.
Startup Type set to: Automatic

* Security Center (wscsvc) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Update (wuauserv) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Update (AFD) is not Running.
Startup Type set to: Automatic (Delayed Start)

* Windows Firewall Authorization Driver (mpsdrv) is not Running.
Startup Type set to: Manual

* NETBT (NetBT) is not Running.
Startup Type set to: System

* NSI proxy service (nsiproxy) is not Running.
Startup Type set to: System

* NetIO Legacy TDI Support Driver (tdx) is not Running.
Startup Type set to: System

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* HOSTS file entries found:

127.0.0.1 localhost
::1 localhost

Program finished at: 03/28/2014 02:45:47 PM
Execution time: 0 hours(s), 4 minute(s), and 25 seconds(s)

broni · 2014/03/28

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.

Double click on adwcleaner.exe to run the tool.

Click on Scan button.

When the scan has finished click on Clean button.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the contents of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator ".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

Please download Farbar Recovery Scan Tool and save it to your Desktop.

Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

Double-click to run it. When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.

DCHammer · 2014/03/29

ADW Cleaner Log:

# AdwCleaner v3.022 - Report created 29/03/2014 at 22:01:49
# Updated 13/03/2014 by Xplode
# Operating System : Windows Vista (TM) Home Premium Service Pack 2 (32 bits)
# Username : Annette - ANNETTE-PC
# Running from : C:\Users\Annette\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook
Key Deleted : HKLM\SOFTWARE\Classes\URLSearchHook.ToolbarURLSearchHook.1
Value Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [FBSSA]
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CA3EB689-8F09-4026-AA10-B9534C691CE0}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{4897BBA6-48D9-468C-8EFA-846275D7701B}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{4509D3CC-B642-4745-B030-645B79522C6D}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{AA2E16F2-387A-415F-BA95-B89BAF3AF109}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{91C18ED5-5E1C-4AE5-A148-A861DE8C8E16}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{91C18ED5-5E1C-4AE5-A148-A861DE8C8E16}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}
Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{19F2B849-4ADE-4D4B-85F9-C31C643DBDE9}

***** [ Browsers ] *****

-\\ Internet Explorer v9.0.8112.16540

-\\ Google Chrome v33.0.1750.154

[ File : C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\preferences ]

*************************

AdwCleaner[R0].txt - [2985 octets] - [29/03/2014 21:59:10]
AdwCleaner[S0].txt - [2950 octets] - [29/03/2014 22:01:49]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3010 octets] ##########

DCHammer · 2014/03/29

JRT Log:

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Annette on 29/03/2014 at 22:09:59.36
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{177AFC38-ED2A-466B-A2BA-BAFBEA49C1A9}
Successfully deleted: [Registry Key] HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\SearchScopes\{177AFC38-ED2A-466B-A2BA-BAFBEA49C1A9}

~~~ Files

~~~ Folders

Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{00CC3CFF-31ED-4B02-A0C6-ADB2C0A5894D}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{00ECFB9B-9824-4411-8BD7-C124880479C7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{04694855-E937-4BE7-8AFD-452C1BF8DBCB}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{04DB356B-6789-43EC-8346-300181545B1C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{0605C1E5-C9D6-46AC-AD76-1629B97036BF}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{066BF3CE-FB96-4118-B668-D166566DA25C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{0761380B-8E06-4B6F-A3C0-74D5F4514BF2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{07704982-48AA-4A63-A77F-6F3CAE051F63}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{07C3740F-30C3-4FD8-88B9-5CF30EF327ED}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{08FC10D4-5436-4B66-95AB-24A5A0ACBC38}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{0A5C58F7-1AA4-4F94-9AF3-5469247FF394}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{0CB5642D-CA1B-4343-9B85-B7F7C82ABD3B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{0CB8A3D7-964E-4AFE-850C-E89A0F903D93}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{0D30778C-C42A-4753-9447-8B8DAA6BC4D2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{0E2F3257-1A3A-4D25-9FBD-0F52C30DA3D9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{0F904A00-BB96-4D86-938C-48C6C287286F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{111EB974-B3AB-4185-9DA8-91656E373670}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{113E3813-5A53-40E6-9BC1-9BE7230084C4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{115AF724-9064-40B7-9309-09F55F069043}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{12A3DCB7-C856-40EA-BA54-4BB84E048D47}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{14562B6F-DBD1-437E-B9A2-421B2CFBD55B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{14E2B1C6-B2AE-43B4-94F3-12355896F8A3}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{152EAD35-9064-4669-AE97-009CA6AE5AFE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{167D19DD-D2BB-48AC-893D-5C9960849BB2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{17F4220E-1335-41FC-ABA9-CBB542F02757}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{18CCDCFF-4CE2-4C94-831C-72627B966F34}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{1A2DB3D4-BF75-4132-B695-FD0EE5EF29C7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{1B1248FE-F727-4C76-AE75-9CD5A78F6DEB}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{1B145FD6-A664-4C0A-BD94-F70163164564}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{1B7EF075-511B-445C-96C9-1BC7EF954F14}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{1CD57569-C185-472E-A0F1-1F2EC4417EB9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{1F372645-71D0-4D3F-A3DE-0B0D4E8A4DF4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{1F5D18D1-3EBD-4217-BB86-EF644FE14F5C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{1F8F7357-471B-4307-9919-13959E4F5E16}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{238A8589-5BB3-4762-8D87-F246001355B3}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{23A0AB78-C60D-4119-BBCD-2AB2AE952AD7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2400931A-06E9-4F6D-A157-891B2C6CCEC9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2442D5C9-EBA1-47C8-BFB5-A19E7F7F88A4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2541EA32-CB67-4837-8B5D-37EA60F42411}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2614A357-D4D6-4708-8A2F-157C2CA33056}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{264F5B9B-673E-4239-A87E-188FEF1215BF}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{266DE47D-0DBD-46CA-976E-A5CF21ADF216}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2700E3C4-D2C8-49F9-A2A4-7D731E325C87}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{29C64533-88DB-4EFC-9B23-F9045A897DD9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{29DF76D6-7DC3-497D-B707-B871A0720F28}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2A40896D-2852-4FB5-A6F1-B5661B905450}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2B55974A-2F8D-4567-88DF-B252F03185FF}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2C88D2CC-BDD7-4362-A169-9E523AC10C31}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2C9AD8DB-1A60-4E8E-9966-EE308F591748}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2D8D09E8-10AC-464F-8CDA-D6B5C9560B39}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2DFD0F9B-D022-44B5-ADD3-866314CAFF7C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2E0D41A7-8581-4EEB-9A51-1AB9FBB8A81A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2E12C0EE-E768-4501-8A85-1AB7E822AD70}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{2FC956FD-43EC-4487-8FD3-125F1A439AB8}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{35D9B7B7-4F67-4175-B936-9A8381985581}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{37001FA6-E584-4E3E-B37E-20176C73E4A4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{38FAF91B-33A1-4A0D-ADE0-F6207AAA56FF}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{3BAA3545-F4C7-4B16-9C50-AD4592D5DDC7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{3CA8E2E2-6C39-49AE-943F-BAE8AB5B67A5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{3EBCC8CD-BD14-4C17-9BB2-DDD9DAD03D9C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{3EC07FF3-7A09-4B40-8D3E-54B97E30FDE5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{3EC32A79-882D-487C-9107-B4BFB93302F0}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{3ED38351-3E74-477B-8298-F93A5C35A0A6}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{3EECC33E-9D14-4C59-8730-A6841E403E23}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{41422B47-193A-4844-BFDC-679829BD8A7B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{4283CC8C-8D6A-48C9-A363-D1988B66D49D}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{42DDED91-BB51-4C44-ADE3-5574320E3F62}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{430984F8-3F09-4470-9F51-C02D3F3C6AA5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{435B4D2B-36B5-4494-8EC7-3981F361F42B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{451C9F80-EF11-4934-A0E5-64D054AD6E78}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{452FDD59-73D7-44BB-9ECA-F88CF9496E2A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{4A75945A-A3FB-4EA2-AE22-1D17761D9653}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{4B4FE57B-BE3E-4FF0-A7A9-F18A7152FAEA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{517A8A7C-E135-4A15-B751-258E6A980F7F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{53C12FC9-A4C8-4BAF-82C7-A5D793194CAD}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{540D8BAC-5B92-44D1-B571-A5AA3A0146A0}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{568CFAE7-6699-4F92-A510-2BAB6F0CBE05}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{577A832D-7ADD-4F3E-8872-D367258BD3C1}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{578C56FA-A073-4336-8694-C92713F5E5B2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{57CD8FA2-4E5C-460D-A08B-A324B0BBE250}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{58419CC6-958B-4DEA-8226-C23260AB3171}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5AEA3F04-FBF7-46C8-9658-00DB5CB52F2A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5C0E4377-AF47-4FB5-9462-3FEEC8E780FF}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5C337880-B8C4-4CA4-BB4E-D2606268A0E5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5C9B6FE0-473F-4A20-A92F-3E7384DAA77D}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5CC7EA39-5501-476A-8A67-D8DEC63F88FD}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5CE895BF-3420-4BFC-8DDF-BFBD5B991F31}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5E3E9AE0-9AE7-4604-94CE-8FF1B87EAE0F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5F46E4D2-B011-489E-896A-286A0D9B40BD}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{5F7D1E20-9D20-4987-A9BE-DC57EABDABCD}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{6166BB0D-2BA4-4A29-AE67-E6922B1BC6AA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{62309E9F-0BA7-4398-93D5-E34CF9AF4FB9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{63094B23-4B6F-4D8E-A9AD-0BDAA422ACE5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{634B92DA-8282-449E-816A-8915AA6D9CBD}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{63C65917-468D-44E3-96E8-84272A95CE20}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{65033B9C-C300-464F-A818-BC0D5DE70CF3}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{6544B0EA-E54C-463A-ACD8-BD1A765487E5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{665D0C10-DF9A-4ABA-8927-B362AC0FEB72}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{66F7F2C4-5AA6-4B8D-86A5-AF35945BE389}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{69C49626-47A1-457A-9BCF-05EBDDC2FDEE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{6A3D6B31-F537-4E45-8964-925256A5A93F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{6AFF83C9-3A97-46A6-82D8-0EAEE7C5BEEA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{6D9ABA84-3C5E-4B7E-9629-809098373B7B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{6EF3197B-9B60-472C-BF7F-89C73FB7BC13}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{6F1219A9-AA55-4312-9083-535D43DE133C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{6FFEC1EA-A193-4793-AB55-F28621949510}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{70751CD0-ACD2-44FA-86E9-0E9BE99C198A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{714D3B7F-19D8-4D4D-95F7-684B784DB76E}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{717DFFCF-11A7-488D-8ADE-CDA015F4AD0A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{722BA253-613A-42CB-9DAB-F2523C61A0F2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{722D3481-881C-4735-A16E-C664C81090E7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7265A2A1-6881-4EBB-923A-24EEFD72D54B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7387AA81-E3BE-49E6-B06D-8A22FDF99CC0}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7406EDBF-3DF7-4E30-9810-6B57F7CF34CA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{74337034-9547-4335-B5B5-CD766AA05FD9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{759C37EE-127C-4FE6-82FA-789E7F3197C2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{765596E4-3C08-49FD-9AA9-32B7408D4943}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{765BB08A-F4BA-4596-9AC6-F176A265943C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{766281BB-C318-4B5C-AEA8-CACE41716941}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{769B680E-12A2-4F5D-9666-6843C1A1C39F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7834D94E-BDD8-4E7E-AA99-E48FE489EACD}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{783D873D-DB5C-4303-8444-42243FDF2AFA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{78AF2446-E121-449E-B66F-CE8C3C6AE95C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7A2944EC-E62F-417D-9CA0-32E43BE97DA3}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7A6F5BA1-F383-4917-9605-9E80518A0EE5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7B87674C-A6A9-441E-882D-0E0A133D5372}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7BF49AB1-C62B-477B-B21B-DF77CB3543D4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7CA563E0-1439-4B14-B968-3684AF556560}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7CB90099-5136-4464-BF36-0D3A99781E49}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7CC88154-0D9C-47D3-9D72-1788A23055CA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7D58BD5E-2100-4BCF-9A30-2515399EF342}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{7FAEFE87-C5AA-438E-96E8-79D58C5D91C1}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{80DC08D4-98DA-4084-A62A-BBCA995408AC}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{81CE7209-E455-4BC5-99F9-9597D56E78F6}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{84207168-7BDF-4906-9606-97DDA0BDA13E}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8458B63B-C5E0-4F2E-809A-8F5C7C13698C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{853BCE56-8C34-4E3E-9E65-DA713E59156A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{854BAE59-CC9F-4DDA-83BD-BC3FDFC25128}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{85A4530C-48AF-41D1-9DF3-CB000A4C155A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8697F24A-D965-4474-9556-C1D91ABACBAE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{871C7F15-BC57-4BB3-8A0B-279329E3EFD6}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8893BC03-6D60-4F18-A012-EE458871FA9C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{89BBC9B0-AD66-450F-8003-DAC5F8B26A67}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{89FDA16E-771C-4547-825A-CFE3334E22C7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8A0E412A-3B49-44EF-8140-EEC4643D570A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8AD0D1CC-20BD-4A39-9870-B7E5A6FB97B8}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8B8EC5D3-AFE3-4DB0-987B-C8B03B6A673B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8BAC8F67-8393-4508-8A1F-A55910B6B9C7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8D1145E3-BC8C-44E9-B067-8945A8EA8A8D}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8D91D5AA-60A1-4A04-889E-DA69B5FAC79E}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{8E82B524-97D4-434C-8836-F9F839EC7E8C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9092CF13-5BBA-4A16-8976-98C0F46786E0}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{92648616-925D-47FE-9230-DC046B7FEFEA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9464747F-C49A-4F67-ABC4-5365AB3E51B5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{94A76422-3C0E-4F59-8894-4AB9CEDC19FE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{971F6C30-335D-4A75-96E4-6053133F6199}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{98EE1F98-2BAE-4A77-881A-89E302914747}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9B29E656-7FD8-4F00-A6AA-56A71BBBAE84}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9BB5447A-2D49-4B7A-AA8C-0DB62E9AA26F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9CEAC177-C3E6-410E-A640-25C888FA0DB1}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9D1C60A5-CB2F-46E1-A78D-BA8DB61668B0}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9E48C96B-EA5F-4A16-9F7F-9C57A0D34158}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9EF3E630-E82E-4F27-AB0E-1E5C71A1EB23}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{9F56A817-E3F0-4F32-A76B-7E20BAAE96CB}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{A07CFFB3-51C7-4B0D-A377-4F6DA8B81293}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{A1D86131-B7FE-4F6F-A69E-8BA4236B953D}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{A23F6883-A489-4539-B1B7-29E04688A8FC}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{A2BAE6EA-34E5-45AC-B14A-991241665D0F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{A570BC9A-B5E0-4EA5-8386-99BBF6085974}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{A5A3DF3C-9892-4C7A-B02A-D09B113D2561}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{A8AACD21-B22C-4C7B-87B9-2424D9449A86}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{AB9F308B-B0D7-45DC-99F1-2D26018C4F34}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{ABD6CEDA-6CD4-46CE-BD58-4CEC14F31970}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{ACDD2BB8-57D3-49C1-96B6-166F3A8DEE3A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{AD748EE9-E3D8-415E-A885-932674547964}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{ADC86E90-3A87-4D83-A070-51E101DEA5D8}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{AEC66A86-3AE8-43DF-A9D4-3BC330F43CEC}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{B3600342-6708-46EB-96A5-B9FE8594DF6B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{B3E0355E-5581-4694-AE7B-39823BC8EC76}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{B589DE54-7DE7-49DA-8194-C02003196CCF}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{B6FABB16-6F99-4CA8-8ECB-AF9AA78453E5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{B84EC9CA-C107-4FA6-A0C7-C135DFA9DDB0}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{B99567C4-5D6B-4D29-9EA3-44D01CCC08F4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{B9E30AD8-FC51-4023-AB4B-F24419ED8AEF}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{BA6F5A7E-45B2-4B72-837F-8C8BED94EC83}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{BE6514E9-7CDA-4EBF-A7AA-4FCEE47467CB}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{BF209F53-2898-4B04-83D0-C7DCAE678176}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C0152AE0-20C5-4868-95B9-5898641DE98D}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C0347730-8CDE-40B6-B7CB-933293F3D6EB}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C0B4F03C-3615-4300-9452-A41F1C898D34}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C0C670C8-D533-4882-8C8E-5155A6DBA4C4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C1DA1BA9-43D0-4D10-B446-E808CA9A8946}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C216498E-93AC-42E1-8232-FAC94EB203D6}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C237F3FD-CCB6-43C4-919B-60FA0B1729D1}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C28CF31D-4E7B-41C8-816A-E7D8AC314C84}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C2930D70-0B4A-4900-AFA1-B1BB16AA2BAE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C36EA099-0E30-43D4-94DA-3FF75E1E628F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C4F80E72-5227-4251-9E51-14EB2FE55A0A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C5C4504F-48A0-4612-86D9-0228E5CCE8BF}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C6D098A0-BD4D-417F-83E3-824DD652B3D7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C80A135F-657B-4CF6-B73F-26BF114DF17F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{C854E337-A040-458A-A769-738D29143A5B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CAEC301E-32DA-4EBA-A636-D320B7529A11}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CB4A82DF-C632-411D-B927-5D99CA6BEE0D}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CB7FEC34-B1B1-49BC-8034-F391321F4B9F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CC698CF0-6E29-4E41-9318-B1D1C04418A5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CDE606A5-C120-480E-88B8-ECF2DF4B508B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CE618B8F-EB59-4328-8F53-C4D8BC9E6CB3}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CE906C07-A1EF-49FB-9C59-BCF2753413B7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CEA84AAA-82A3-4D6E-B3FF-CE7FAC1A206F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{CED9F000-7B3B-4B49-AB3A-F7DF558310B9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D0209EB7-F6F9-4709-8D74-DF66D6CC02A1}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D1222354-6BEA-407C-ABD4-43CCFB6123CE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D1453895-5E93-4F45-A462-E34914485C23}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D260C759-EDFA-42C4-A28A-E672BC303AF2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D28D1176-9A8C-4FCC-9445-2F516A4933D7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D44088EF-11D4-41DB-9558-4D0C72D191F8}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D535D4E1-9FA8-4A65-9BF0-104DB91D7CB1}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D5F46728-C75B-4C81-B03F-8A18E196C4DE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D702257C-23CF-4D6D-A500-F8D7E1345DE5}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D72C4895-79AD-4EEA-99D4-E65D1D8590B9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D8947BFF-D2AD-4EEA-A68C-1D505972D5CA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{D9381E11-A333-4862-AA32-94783DCD1E39}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DA659F4D-03AA-4901-B614-9BEBC79A01BC}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DABDF551-9A25-4BDE-8158-BB5DC59FCA28}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DB6979F2-D26E-4039-81E1-6BB96E2B3880}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DCF9F107-4CF7-4A60-A392-42E53C1BEA5C}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DD1DD24A-0CFF-4FE5-BEB0-5116CF06770A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DD4AD51A-5C60-4B5D-96F3-29DEDE334F12}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DE1A3ACC-E18E-4A3B-BC11-2AD0DB5D83DA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DEA77DA4-E0F7-49BE-A5EE-BBE6C8E5585E}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DEE7C389-40EC-4D87-BA94-3F31917D14EA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{DFCFDA75-693F-4ADB-BC70-4761FB3DAEF4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E396B7DE-E558-4B80-8BFE-29821FC4902B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E49B1B3E-1B90-4AC9-8E51-418159999C07}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E4B5C2BA-9F21-439B-87A8-58E67224BF11}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E500056F-8A8A-4AFC-847A-AE1CC263AE30}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E5CFCFFE-B060-4A72-B898-3ED7DA2C3657}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E6668BAE-E350-4F72-BB36-0D1C833657AB}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E6DB9865-0156-48D8-B84A-A7C454FC25B2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E7AA65EE-0C6E-4E8F-AB66-DCDEE96EC17B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{E9E5B2C1-17FA-449E-BD15-CB572DEEF09F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{EA30441C-69D7-4F4A-9FFD-83BD892FBDE9}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{EC2B66D2-6C45-4440-BCC7-D9F12D9E2F7D}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{ECA927F1-3236-4C98-A141-1E5B3D8B15D2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{ECC6F4B1-92A5-48D9-BD8D-DD1F32016536}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{EE6E689F-66A3-40AB-9CFF-9B0C9C699942}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{EF2E9826-B1A5-499C-A5D7-0DD9B8FFCD00}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{EFDFBA9D-A96D-4B0E-B565-C5E65C8827EE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F1422655-F727-4AF7-82AC-464A802E8847}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F46DB5C2-CFFC-4BF3-A0D1-F9007F23A022}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F4CBE913-3471-41E0-886B-CD09471D6085}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F4D020E0-1318-44D4-BFD8-87911460FD18}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F4D50604-7345-48B7-9058-A3AD8A5B3A28}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F54F39D8-3167-4631-86F1-BBA8D9A0DCB2}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F563E8EE-CFA5-49A6-9C31-6679E9AE06D8}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F5B648B8-E632-4846-8D26-A83F0D07D34F}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F7ABDFBA-F3AA-4CB3-AF1B-ECFEB1CD6BC7}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F7B38925-4295-41BF-8383-703B60C3FCE4}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F86484C5-9B6F-4D2E-9511-ACBBC2D8EFFA}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F8B4C9AA-23A3-4528-A876-F03E31E6903B}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{F9DB49F3-4A9D-4A4A-853C-E0A34E4240C3}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{FA26EDFF-1CB2-4C7D-92F2-8A1DD863658E}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{FBA44DB2-C300-4901-994E-BB67B59C7A41}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{FC175672-5192-443D-888B-EC3C31D894CE}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{FC3E1366-E412-4AF3-9618-E0B5035A7C36}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{FC6C18C7-2213-4CF1-A861-432A11248D9A}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{FF1C5B5F-0A83-4A05-AF8E-6261E5D28800}
Successfully deleted: [Empty Folder] C:\Users\Annette\appdata\local\{FF9AEB77-7492-47F3-A027-6BD97776453D}

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 29/03/2014 at 22:26:17.03
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

DCHammer · 2014/03/29

FRST Log:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 13-03-2014 01
Ran by Annette (administrator) on ANNETTE-PC on 29-03-2014 22:40:19
Running from C:\Users\Annette\Desktop
Microsoft® Windows Vistaâ„¢ Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) c:\Program Files\Microsoft Security Client\MsMpEng.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe
(Intel Corporation) C:\Windows\system32\igfxext.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
(Sony Corporation) C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
(Sony Corporation) C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Sony Corporation) C:\Program Files\Sony\ISB Utility\ISBMgr.exe
(Sony Electronics, Inc.) C:\Program Files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Research In Motion Limited) C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Sony Corporation) C:\Program Files\Sony\VAIO Service Utility\VAIO-SUTOOL.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\System32\wsqmcons.exe
(Microsoft Corporation) C:\Windows\System32\wsqmcons.exe
(Microsoft Corporation) C:\Windows\system32\RacAgent.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [RtHDVCpl] - C:\Windows\RtHDVCpl.exe [4423680 2007-04-06] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [835584 2007-03-07] (Synaptics, Inc.)
HKLM\...\Run: [ISBMgr.exe] - C:\Program Files\Sony\ISB Utility\ISBMgr.exe [317560 2007-06-11] (Sony Corporation)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Java\jre1.6.0\bin\jusched.exe [77824 2007-08-24] (Sun Microsystems, Inc.)
HKLM\...\Run: [VAIO Center Access Bar] - c:\program files\sony\VAIO Center Access Bar\VCAB.exe [53248 2007-06-21] (Sony Electronics, Inc.)
HKLM\...\Run: [VWLASU] - C:\Program Files\Sony\VAIO PC Wireless LAN Wizard\AutoLaunchWLASU.exe [45056 2007-07-12] (Sony Electronics, Inc.)
HKLM\...\Run: [VAIOSurvey] - C:\Program Files\Sony\VAIO Survey\Vista VAIO Survey.exe [577536 2007-07-20] ()
HKLM\...\Run: [NeroFilterCheck] - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [155648 2006-01-12] (Nero AG)
HKLM\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [35760 2010-09-23] (Adobe Systems Incorporated)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-09-20] (Adobe Systems Incorporated)
HKLM\...\Run: [QuickTime Task] - C:\Program Files\QuickTime\QTTask.exe [421888 2010-11-29] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421160 2011-06-07] (Apple Inc.)
HKLM\...\Run: [RIMBBLaunchAgent.exe] - C:\Program Files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-11-02] (Research In Motion Limited)
HKLM\...\Run: [MSC] - c:\Program Files\Microsoft Security Client\msseces.exe [948440 2013-10-23] (Microsoft Corporation)
Winlogon\Notify\VESWinlogon: C:\Windows\system32\VESWinlogon.dll (Sony Corporation)
HKU\.DEFAULT\...\Run: [msnmsgr] - C:\Program Files\Windows Live\Messenger\msnmsgr.exe [4280184 2012-03-08] (Microsoft Corporation)
HKU\S-1-5-21-918684209-1862192803-2726415506-1002\...\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-918684209-1862192803-2726415506-1002\...\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [18680424 2013-05-08] (Skype Technologies S.A.)
HKU\S-1-5-21-918684209-1862192803-2726415506-1002\...\MountPoints2: G - G:\Autorun\Autorun.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ca/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?ocid=EIE9HP&PC=UP50
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - {A6CD20DE-0C8F-4EE5-AAF7-EBEC50BD9007} URL = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
SearchScopes: HKCU - {D769C1F6-49F0-4756-B5B0-D56ACEFAF214} URL = https://www.google.com/search?q={searchTerms}
BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
BHO: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKCU - No Name - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll No File
Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll No File
Handler: intu-tt2010 - {97A0575E-2309-4e75-8509-B1F9390C4DE7} - C:\Program Files\TurboTax 2010\ic2010pp.dll (Intuit Canada, a general partnership/une sociÃ©tÃ© en nom collectif.)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [152864] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.1
Tcpip\..\Interfaces\{50683A21-C20A-4246-B65F-56AC3A5E3F8D}: [NameServer]8.8.8.8,4.4.4.4

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\33.0.1750.154\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.6.9) - C:\Program Files\QuickTime\plugins\npqtplugin7.dll (Apple Inc.)
CHR Plugin: (RIM Handheld Application Loader) - C:\Program Files\Common Files\Research In Motion\BBWebSLLauncher\NPWebSLLauncher.dll ()
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Google Docs) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-07-08]
CHR Extension: (Google Drive) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-07-08]
CHR Extension: (YouTube) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-08]
CHR Extension: (Google Search) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-08]
CHR Extension: (Google Wallet) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-06]
CHR Extension: (Gmail) - C:\Users\Annette\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-08]

========================== Services (Whitelisted) =================

R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22208 2013-10-23] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [280288 2013-10-23] (Microsoft Corporation)
S3 PACSPTISVR; C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe [57344 2006-12-14] ()
S2 PEVSystemStart; C:\Darren\SWREG.3XE [518144 2000-08-30] (SteelWerX)
S3 SPTISRV; C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe [69632 2006-12-14] (Sony Corporation)
S3 VAIO Entertainment TV Device Arbitration Service; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe [73728 2007-06-28] (Sony Corporation)
R2 VAIO Event Service; C:\Program Files\Sony\VAIO Event Service\VESMgr.exe [182392 2007-07-24] (Sony Corporation)
S3 VAIOMediaPlatform-IntegratedServer-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe [2523136 2007-06-20] (Sony Corporation)
S3 VAIOMediaPlatform-IntegratedServer-HTTP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [397312 2007-06-20] (Sony Corporation)
S3 VAIOMediaPlatform-IntegratedServer-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-06-20] (Sony Corporation)
S3 VAIOMediaPlatform-Mobile-Gateway; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe [499712 2007-06-20] (Sony Corporation)
S3 VAIOMediaPlatform-UCLS-AppServer; C:\Program Files\Sony\VAIO Media Integrated Server\UCLS.exe [745472 2007-01-10] (Sony Corporation)
S3 VAIOMediaPlatform-UCLS-HTTP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe [397312 2007-06-20] (Sony Corporation)
S3 VAIOMediaPlatform-UCLS-UPnP; C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe [1089536 2007-06-20] (Sony Corporation)
S3 VcmIAlzMgr; C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe [292152 2007-07-13] (Sony Corporation)
R3 Vcsw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe [274432 2007-06-28] (Sony Corporation)
R2 VzCdbSvc; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe [188416 2007-06-28] (Sony Corporation)
R2 VzFw; C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe [184320 2007-06-28] (Sony Corporation)
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [X]

==================== Drivers (Whitelisted) ====================

S3 catchme; C:\Users\Annette\AppData\Local\Temp\catchme.sys [31744 2014-03-28] ()
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [214696 2013-09-27] (Microsoft Corporation)
S3 netr28u; C:\Windows\System32\DRIVERS\Dnetr28u.sys [849248 2010-04-29] (Ralink Technology Corp.)
S3 RTL8192cu; C:\Windows\System32\DRIVERS\RTL8192cu.sys [693760 2011-05-13] (Realtek Semiconductor Corporation )
R3 ti21sony; C:\Windows\System32\drivers\ti21sony.sys [812544 2007-06-05] (Texas Instruments)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-19] (Microsoft Corporation)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 HSXHWAZL; system32\DRIVERS\HSXHWAZL.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S2 mdmxsdk; system32\DRIVERS\mdmxsdk.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-03-29 22:40 - 2014-03-29 22:42 - 00016134 _____ () C:\Users\Annette\Desktop\FRST.txt
2014-03-29 22:37 - 2014-03-29 22:40 - 00000000 ____D () C:\FRST
2014-03-29 22:26 - 2014-03-29 22:26 - 00029983 _____ () C:\Users\Annette\Desktop\JRT.txt
2014-03-29 22:09 - 2014-03-29 22:09 - 00000000 ____D () C:\Windows\ERUNT
2014-03-29 22:08 - 2014-03-29 22:08 - 00003090 _____ () C:\Users\Annette\Desktop\AdwCleaner[S0].txt
2014-03-29 21:58 - 2014-03-29 22:02 - 00000000 ____D () C:\AdwCleaner
2014-03-29 21:55 - 2014-03-29 21:54 - 01950720 _____ () C:\Users\Annette\Desktop\adwcleaner.exe
2014-03-29 21:55 - 2014-03-29 21:54 - 01145856 _____ (Farbar) C:\Users\Annette\Desktop\FRST.exe
2014-03-29 21:55 - 2014-03-29 21:54 - 01038974 _____ (Thisisu) C:\Users\Annette\Desktop\JRT.exe
2014-03-28 14:46 - 2014-03-28 14:48 - 00000000 ___SD () C:\Darren19746D
2014-03-28 14:46 - 2014-03-28 14:46 - 00000000 ___SD () C:\32788R22FWJFW
2014-03-25 10:39 - 2011-06-26 02:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-03-25 10:39 - 2010-11-07 13:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-03-25 10:39 - 2009-04-20 00:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-03-25 10:39 - 2000-08-30 20:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-03-25 10:39 - 2000-08-30 20:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-03-25 10:39 - 2000-08-30 20:00 - 00098816 _____ () C:\Windows\sed.exe
2014-03-25 10:39 - 2000-08-30 20:00 - 00080412 _____ () C:\Windows\grep.exe
2014-03-25 10:39 - 2000-08-30 20:00 - 00068096 _____ () C:\Windows\zip.exe
2014-03-25 10:38 - 2014-03-25 10:38 - 00000000 ____D () C:\Qoobox
2014-03-25 10:37 - 2014-03-25 10:37 - 00000000 ____D () C:\Windows\erdnt
2014-03-24 22:35 - 2014-03-28 14:59 - 00000000 ____D () C:\Users\Annette\Desktop\Cleanup
2014-03-24 22:02 - 2014-03-24 22:30 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-24 22:02 - 2014-03-24 22:02 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-24 22:01 - 2014-03-24 22:01 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-24 10:57 - 2014-03-24 10:57 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\Malwarebytes
2014-03-24 10:56 - 2014-03-24 10:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-23 15:45 - 2014-02-23 01:47 - 01806848 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-03-23 15:45 - 2014-02-23 01:43 - 09739264 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-03-23 15:45 - 2014-02-23 01:41 - 01105408 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-03-23 15:45 - 2014-02-23 01:40 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-03-23 15:45 - 2014-02-23 01:39 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-03-23 15:45 - 2014-02-23 01:38 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-03-23 15:45 - 2014-02-23 01:38 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-03-23 15:45 - 2014-02-23 01:38 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-03-23 15:45 - 2014-02-23 01:37 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-03-23 15:45 - 2014-02-23 01:37 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-03-23 15:45 - 2014-02-23 01:37 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-03-23 15:45 - 2014-02-23 01:37 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-03-23 15:45 - 2014-02-23 01:36 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-03-23 15:45 - 2014-02-23 01:36 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-03-23 15:45 - 2014-02-23 01:35 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-03-23 15:44 - 2014-02-23 01:50 - 12347904 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-03-23 15:36 - 2014-03-23 15:42 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-23 15:32 - 2012-07-25 23:39 - 00047720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys
2014-03-23 15:32 - 2012-07-25 23:21 - 00196608 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe
2014-03-23 15:32 - 2012-07-25 23:20 - 00613888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll
2014-03-23 15:32 - 2012-07-25 23:20 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll
2014-03-23 15:32 - 2012-07-25 23:20 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll
2014-03-23 15:32 - 2012-07-25 23:20 - 00038912 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll
2014-03-23 15:32 - 2012-07-25 22:46 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll
2014-03-23 15:32 - 2012-07-25 22:33 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys
2014-03-23 15:32 - 2012-07-25 22:32 - 00155136 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys
2014-03-23 15:32 - 2012-06-02 10:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
2014-03-23 15:32 - 2009-07-14 08:12 - 00016896 _____ (Microsoft Corporation) C:\Windows\system32\winusb.dll
2014-03-23 08:55 - 2014-02-07 06:38 - 02050560 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-03-23 08:55 - 2013-08-26 22:47 - 01029120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll
2014-03-23 08:55 - 2013-08-26 22:47 - 00219648 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll
2014-03-23 08:55 - 2013-08-26 22:47 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll
2014-03-23 08:55 - 2013-08-26 22:47 - 00160768 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll
2014-03-23 08:55 - 2013-08-26 21:52 - 01172480 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-03-23 08:55 - 2013-08-26 21:50 - 00486400 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll
2014-03-23 08:55 - 2013-08-26 21:32 - 00683008 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll
2014-03-23 08:55 - 2013-08-26 21:28 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2014-03-23 08:55 - 2013-08-26 21:28 - 00798208 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2014-03-23 08:55 - 2013-07-31 23:16 - 00638400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-03-23 08:55 - 2013-07-31 22:49 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-03-23 08:55 - 2013-07-20 06:44 - 00102608 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2014-03-23 08:55 - 2013-06-15 09:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2014-03-23 08:55 - 2013-06-15 07:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-03-23 08:55 - 2012-11-02 06:18 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll
2014-03-23 08:55 - 2012-11-02 04:26 - 00023040 _____ (Microsoft Corporation) C:\Windows\system32\dpnsvr.exe
2014-03-23 08:55 - 2011-07-29 12:01 - 00293376 _____ (Microsoft Corporation) C:\Windows\system32\psisdecd.dll
2014-03-23 08:55 - 2011-07-29 12:01 - 00217088 _____ (Microsoft Corporation) C:\Windows\system32\psisrndr.ax
2014-03-23 08:55 - 2011-07-29 12:00 - 00069632 _____ (Microsoft Corporation) C:\Windows\system32\Mpeg2Data.ax
2014-03-23 08:55 - 2011-07-29 12:00 - 00057856 _____ (Microsoft Corporation) C:\Windows\system32\MSDvbNP.ax
2014-03-23 08:54 - 2013-10-29 22:12 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\SysFxUI.dll
2014-03-23 08:54 - 2013-10-29 21:43 - 00130048 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys
2014-03-23 08:54 - 2013-10-29 20:43 - 00167936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys
2014-03-23 08:54 - 2013-07-10 05:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-03-23 08:54 - 2013-07-04 23:20 - 00914880 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-03-23 08:54 - 2013-07-04 21:43 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys
2014-03-23 08:54 - 2012-09-25 12:19 - 00075776 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll
2014-03-23 08:54 - 2012-08-21 07:47 - 00224640 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\volsnap.sys
2014-03-23 08:54 - 2012-06-29 12:01 - 00467968 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll
2014-03-23 08:54 - 2011-10-14 12:03 - 00189952 _____ (Microsoft Corporation) C:\Windows\system32\winmm.dll
2014-03-23 08:54 - 2011-10-14 12:00 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\mciseq.dll
2014-03-23 08:53 - 2014-02-03 06:37 - 00505344 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll
2014-03-23 08:53 - 2013-12-04 22:12 - 01248768 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-03-23 08:53 - 2012-06-08 13:47 - 11586048 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-03-23 08:53 - 2012-05-11 11:57 - 00623616 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll
2014-03-23 08:53 - 2012-03-20 19:28 - 00053120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\partmgr.sys
2014-03-23 08:53 - 2011-11-18 13:47 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-03-23 08:53 - 2011-10-14 12:02 - 00429056 _____ (Microsoft Corporation) C:\Windows\system32\EncDec.dll
2014-03-23 08:52 - 2013-07-04 00:21 - 00532480 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
2014-03-23 08:52 - 2013-06-28 22:07 - 00226304 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
2014-03-23 08:52 - 2013-06-28 22:07 - 00197632 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
2014-03-23 08:52 - 2013-06-28 22:07 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
2014-03-23 08:52 - 2013-06-28 22:06 - 00006016 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
2014-03-23 08:52 - 2012-11-20 00:22 - 00204288 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2014-03-23 08:52 - 2011-05-05 09:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
2014-03-23 08:52 - 2011-05-05 09:54 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
2014-03-23 08:51 - 2013-10-03 08:45 - 00297984 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-03-23 08:51 - 2013-07-12 05:04 - 00134272 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
2014-03-23 08:51 - 2013-07-02 22:10 - 00025472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
2014-03-23 08:51 - 2013-06-26 19:01 - 00527064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
2014-03-23 08:51 - 2013-02-11 21:57 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys
2014-03-23 08:51 - 2012-11-07 23:48 - 01314816 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2014-03-23 08:51 - 2012-09-28 12:11 - 00892928 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
2014-03-23 08:50 - 2013-10-22 03:19 - 00158208 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll
2014-03-23 08:50 - 2013-10-10 22:08 - 00172032 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll
2014-03-23 08:50 - 2013-10-10 22:08 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx
2014-03-23 08:50 - 2013-10-10 22:08 - 00036864 _____ (Microsoft Corporation) C:\Windows\system32\wshcon.dll
2014-03-23 08:50 - 2013-10-10 20:35 - 00155648 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe
2014-03-23 08:50 - 2013-10-10 20:35 - 00135168 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe
2014-03-23 08:50 - 2013-10-03 08:45 - 00993792 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2014-03-23 08:50 - 2013-07-16 00:35 - 00615936 _____ (Microsoft Corporation) C:\Windows\system32\themeui.dll
2014-03-23 08:50 - 2013-06-04 00:16 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2014-03-23 08:50 - 2013-06-03 21:49 - 00293376 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2014-03-23 08:50 - 2013-04-17 08:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll
2014-03-23 08:50 - 2013-03-07 23:52 - 02067968 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-03-23 08:50 - 2012-11-21 23:54 - 00353280 _____ (Microsoft Corporation) C:\Windows\system32\shlwapi.dll
2014-03-23 08:50 - 2012-02-29 11:11 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\wmi.dll
2014-03-23 08:50 - 2012-02-29 09:32 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fs_rec.sys
2014-03-23 08:49 - 2013-08-02 00:09 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2014-03-23 08:49 - 2013-07-09 08:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2014-03-23 08:49 - 2013-07-08 00:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2014-03-23 08:49 - 2013-07-08 00:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-03-23 08:49 - 2013-05-02 00:04 - 00443904 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll
2014-03-23 08:49 - 2013-05-02 00:03 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\printcom.dll
2014-03-23 08:49 - 2013-04-24 00:00 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll
2014-03-23 08:49 - 2013-04-23 21:46 - 00812544 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe
2014-03-23 08:49 - 2013-03-08 23:45 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2014-03-23 08:49 - 2013-03-08 21:28 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2014-03-23 08:49 - 2013-03-07 23:53 - 00376320 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
2014-03-23 08:49 - 2012-11-02 06:19 - 01400832 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-03-23 08:48 - 2013-10-10 22:08 - 00444928 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL
2014-03-23 08:48 - 2013-10-10 22:07 - 00596480 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL
2014-03-23 08:48 - 2013-10-10 20:39 - 00218228 _____ () C:\Windows\system32\WFP.TMF
2014-03-23 08:48 - 2013-03-03 15:07 - 01082232 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys
2014-03-23 08:48 - 2011-12-14 12:17 - 00680448 _____ (Microsoft Corporation) C:\Windows\system32\msvcrt.dll
2014-03-23 08:48 - 2011-11-16 12:23 - 00377344 _____ (Microsoft Corporation) C:\Windows\system32\winhttp.dll
2014-03-23 08:48 - 2011-10-25 11:58 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-03-23 08:48 - 2011-08-25 12:15 - 00555520 _____ (Microsoft Corporation) C:\Windows\system32\UIAutomationCore.dll
2014-03-23 08:48 - 2011-08-25 12:14 - 00563712 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2014-03-23 08:48 - 2011-08-25 12:14 - 00238080 _____ (Microsoft Corporation) C:\Windows\system32\oleacc.dll
2014-03-23 08:48 - 2011-08-25 09:31 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\oleaccrc.dll
2014-03-23 08:47 - 2012-06-04 11:26 - 00440704 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-03-23 08:47 - 2012-06-01 20:04 - 00278528 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-03-23 08:47 - 2012-05-01 10:03 - 00180736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-03-23 08:47 - 2011-11-16 12:23 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-03-23 08:47 - 2011-11-16 12:21 - 01259008 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-03-23 08:47 - 2011-11-16 10:12 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-03-23 08:36 - 2014-01-30 03:46 - 00876032 _____ (Microsoft Corporation) C:\Windows\system32\wer.dll
2014-03-23 08:20 - 2013-11-12 20:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-03-23 08:15 - 2012-01-09 11:54 - 00613376 _____ (Microsoft Corporation) C:\Windows\system32\rdpencom.dll
2014-03-23 08:14 - 2013-07-08 00:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2014-03-23 08:14 - 2013-07-08 00:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2014-03-23 08:14 - 2013-07-08 00:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2014-03-23 06:33 - 2011-03-03 11:40 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\Apphlpdm.dll
2014-03-23 06:33 - 2011-03-03 09:35 - 04240384 _____ (Microsoft) C:\Windows\system32\GameUXLegacyGDFs.dll
2014-03-23 05:45 - 2012-06-02 18:19 - 01933848 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-03-23 05:45 - 2012-06-02 18:19 - 00053784 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-03-23 05:45 - 2012-06-02 18:19 - 00045080 _____ (Microsoft Corporation) C:\Windows\system32\wups2.dll
2014-03-23 05:45 - 2012-06-02 18:12 - 02422272 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-03-23 05:44 - 2014-03-23 05:44 - 00002154 _____ () C:\Windows\epplauncher.mif
2014-03-23 05:44 - 2012-06-02 18:19 - 00577048 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-03-23 05:44 - 2012-06-02 18:19 - 00035864 _____ (Microsoft Corporation) C:\Windows\system32\wups.dll
2014-03-23 05:44 - 2012-06-02 18:12 - 00088576 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-03-23 05:44 - 2012-06-02 15:19 - 00171904 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-03-23 05:44 - 2012-06-02 15:12 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-03-23 05:41 - 2014-03-23 05:43 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-03-23 05:40 - 2010-04-05 16:00 - 00221568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys

==================== One Month Modified Files and Folders =======

2014-03-29 22:42 - 2014-03-29 22:40 - 00016134 _____ () C:\Users\Annette\Desktop\FRST.txt
2014-03-29 22:40 - 2014-03-29 22:37 - 00000000 ____D () C:\FRST
2014-03-29 22:40 - 2007-12-25 14:43 - 01531574 _____ () C:\Windows\WindowsUpdate.log
2014-03-29 22:37 - 2013-05-13 20:16 - 00000888 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-29 22:26 - 2014-03-29 22:26 - 00029983 _____ () C:\Users\Annette\Desktop\JRT.txt
2014-03-29 22:09 - 2014-03-29 22:09 - 00000000 ____D () C:\Windows\ERUNT
2014-03-29 22:08 - 2014-03-29 22:08 - 00003090 _____ () C:\Users\Annette\Desktop\AdwCleaner[S0].txt
2014-03-29 22:07 - 2013-05-13 20:16 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-29 22:06 - 2006-11-02 09:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-29 22:06 - 2006-11-02 08:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-29 22:06 - 2006-11-02 08:47 - 00003168 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-29 22:04 - 2006-11-02 09:01 - 00032544 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-03-29 22:02 - 2014-03-29 21:58 - 00000000 ____D () C:\AdwCleaner
2014-03-29 21:54 - 2014-03-29 21:55 - 01950720 _____ () C:\Users\Annette\Desktop\adwcleaner.exe
2014-03-29 21:54 - 2014-03-29 21:55 - 01145856 _____ (Farbar) C:\Users\Annette\Desktop\FRST.exe
2014-03-29 21:54 - 2014-03-29 21:55 - 01038974 _____ (Thisisu) C:\Users\Annette\Desktop\JRT.exe
2014-03-29 03:01 - 2012-06-21 22:03 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-28 14:59 - 2014-03-24 22:35 - 00000000 ____D () C:\Users\Annette\Desktop\Cleanup
2014-03-28 14:48 - 2014-03-28 14:46 - 00000000 ___SD () C:\Darren19746D
2014-03-28 14:46 - 2014-03-28 14:46 - 00000000 ___SD () C:\32788R22FWJFW
2014-03-28 14:40 - 2007-09-01 00:56 - 00118684 _____ () C:\Windows\PFRO.log
2014-03-25 10:38 - 2014-03-25 10:38 - 00000000 ____D () C:\Qoobox
2014-03-25 10:37 - 2014-03-25 10:37 - 00000000 ____D () C:\Windows\erdnt
2014-03-25 10:35 - 2006-11-02 06:33 - 00770858 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-24 22:30 - 2014-03-24 22:02 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-24 22:02 - 2014-03-24 22:02 - 00107224 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-03-24 22:01 - 2014-03-24 22:01 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-03-24 17:24 - 2006-11-02 07:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-03-24 15:22 - 2011-01-16 17:57 - 00008197 _____ () C:\Windows\setupact.log
2014-03-24 15:07 - 2013-05-13 20:16 - 00000000 ____D () C:\Program Files\Google
2014-03-24 14:16 - 2013-05-13 20:18 - 00000000 ____D () C:\ProgramData\Google
2014-03-24 14:16 - 2013-05-13 20:16 - 00000000 ____D () C:\Users\Annette\AppData\Local\Google
2014-03-24 10:57 - 2014-03-24 10:57 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\Malwarebytes
2014-03-24 10:56 - 2014-03-24 10:56 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-03-24 01:18 - 2006-11-02 07:18 - 00000000 ____D () C:\Windows\rescache
2014-03-23 21:42 - 2006-11-02 08:47 - 00322888 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-03-23 21:41 - 2009-03-24 21:04 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2014-03-23 21:37 - 2007-08-24 20:04 - 00000000 ____D () C:\Windows\system32\RTCOM
2014-03-23 21:37 - 2006-11-02 08:37 - 00000000 ____D () C:\Windows\system32\XPSViewer
2014-03-23 21:37 - 2006-11-02 07:18 - 00000000 ____D () C:\Program Files\Common Files\System
2014-03-23 15:42 - 2014-03-23 15:36 - 00000000 ____D () C:\Windows\system32\MRT
2014-03-23 05:44 - 2014-03-23 05:44 - 00002154 _____ () C:\Windows\epplauncher.mif
2014-03-23 05:43 - 2014-03-23 05:41 - 00000000 ____D () C:\Program Files\Microsoft Security Client
2014-03-23 05:28 - 2009-12-22 22:53 - 00000000 ____D () C:\Users\Annette\AppData\Roaming\Skype
2014-03-20 22:16 - 2013-05-13 20:17 - 00001927 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-03-20 21:50 - 2012-06-21 22:03 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-03-20 21:50 - 2011-06-24 21:30 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-03-02 14:03 - 2006-11-02 06:24 - 87350280 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Files to move or delete:
====================
C:\ProgramData\pswi_preloaded.exe

Some content of TEMP:
====================
C:\Users\Annette\AppData\Local\Temp\catchme.dll
C:\Users\Annette\AppData\Local\Temp\KUIU.EXE
C:\Users\Annette\AppData\Local\Temp\ntdll_dump.dll
C:\Users\Annette\AppData\Local\Temp\Quarantine.exe
C:\Users\Annette\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Annette\AppData\Local\Temp\_isBBA8.exe

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-03-29 22:13

==================== End Of Log ============================

DCHammer · 2014/03/29

Addition Log:
Additional scan result of Farbar Recovery Scan Tool (x86) Version: 13-03-2014 01
Ran by Annette at 2014-03-29 22:43:05
Running from C:\Users\Annette\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Microsoft Security Essentials (Disabled - Up to date) {641105E6-77ED-3F35-A304-765193BCB75F}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Microsoft Security Essentials (Disabled - Up to date) {DF70E402-51D7-30BB-99B4-4D23E83BFDE2}

==================== Installed Programs ======================

Adobe Flash Player 12 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Reader 9.4.0 (HKLM\...\{AC76BA86-7AD7-1033-7B44-A94000000001}) (Version: 9.4.0 - Adobe Systems Incorporated)
Amazon Kindle For PC v1.1 (HKCU\...\Amazon Kindle For PC) (Version: - Amazon)
Apple Application Support (HKLM\...\{B3575D00-27EF-49C2-B9E0-14B3D954E992}) (Version: 1.5.2 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{C23CD6DA-1958-43A5-ADD0-59396572E02E}) (Version: 3.4.1.2 - Apple Inc.)
Apple Software Update (HKLM\...\{C6579A65-9CAE-4B31-8B6B-3306E0630A66}) (Version: 2.1.3.127 - Apple Inc.)
ArcSoft Magic-i Visual Effects Installer (HKLM\...\{9AB83A3C-604D-4B4F-AA25-A23A3FC39844}) (Version: - ArcSoft)
Bing Bar (HKLM\...\{5B96BF29-1CC0-42FB-AB2C-1E12E3226E7A}) (Version: 7.0.858.0 - Microsoft Corporation)
BlackBerry Desktop Software 7.1 (HKLM\...\BlackBerry_Desktop) (Version: 7.1.0.32 - Research In Motion Ltd.)
BlackBerry Desktop Software 7.1 (Version: 7.1.0.32 - Research In Motion Ltd.) Hidden
Bonjour (HKLM\...\{C2E4B5BD-32DB-4817-A060-341AB17C3F90}) (Version: 2.0.5.0 - Apple Inc.)
Click to DVD 2.0.05 Menu Data (HKLM\...\{9E407618-D9CD-4F39-9490-9ED45294073D}) (Version: 2.0.05 - Sony Corporation)
Click to DVD 2.6.00 (HKLM\...\{E809063C-51A3-4269-8984-D1EB742F2151}) (Version: 2.6.00 - Sony Corporation)
Corel Paint Shop Pro Photo XI (HKLM\...\{93A1B09E-BAFA-4628-A5B6-921CB026955A}) (Version: 11.10.0000 - Corel Corporation)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
GearDrvs (Version: 1 - Symantec Corporation) Hidden
Google Chrome (HKLM\...\Google Chrome) (Version: 33.0.1750.154 - Google Inc.)
Google Update Helper (Version: 1.3.23.9 - Google Inc.) Hidden
iTunes (HKLM\...\{C897FCB3-2F8B-4185-8035-79E2AF3A92A4}) (Version: 10.3.1.55 - Apple Inc.)
Java(TM) SE Runtime Environment 6 (HKLM\...\{3248F0A8-6813-11D6-A77B-00B0D0160000}) (Version: 1.6.0.0 - Sun Microsystems, Inc.)
LocationFree Player (HKLM\...\{D937DD80-3928-4617-876F-538A25AECB17}) (Version: 3.02.0000 - Sony Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (HKLM\...\{95120000-00AF-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Word Viewer 2003 (HKLM\...\{90850409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.8173.0 - Microsoft Corporation)
Microsoft Security Client (Version: 4.4.0304.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.4.304.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{A49F249F-0C91-497F-86DF-B2585E8E76B7}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM\...\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
MSVCRT (Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP2 Parser and SDK (HKLM\...\{716E0306-8318-4364-8B8F-0CC4E9376BAC}) (Version: 4.20.9818.0 - Microsoft Corporation)
Nero 7 Ultra Edition (HKLM\...\{235BBFC6-D863-4066-A01A-3BD504C31033}) (Version: 7.02.2620 - Nero AG)
Norton 360 (Version: 1.2.0.10 - Symantec Corporation) Hidden
OpenMG Secure Module 4.7.00 (HKLM\...\InstallShield_{CCD663AE-610D-4BDF-AAB0-E914B044527D}) (Version: 4.7.00.12140 - Sony Corporation)
OpenMG Secure Module 4.7.00 (Version: 4.7.00.12140 - Sony Corporation) Hidden
QuickBooks Product Listing Service (HKLM\...\{91208A47-5D08-4C79-986F-1931940F51BB}) (Version: 2.0.148 - Intuit)
QuickTime (HKLM\...\{57752979-A1C9-4C02-856B-FBB27AC4E02C}) (Version: 7.69.80.9 - Apple Inc.)
Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 1.00.0000 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5391 - Realtek Semiconductor Corp.)
Segoe UI (Version: 15.4.2271.0615 - Microsoft Corp) Hidden
Setting Utility Series (HKLM\...\{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}) (Version: 3.0.00.07240 - Sony Corporation)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 5.9.9216 - Skype Technologies S.A.)
Skype™ 6.3 (HKLM\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.3.107 - Skype Technologies S.A.)
SonicStage Mastering Studio (HKLM\...\{6332AFF1-9D9A-429C-AA03-F82749FA4F49}) (Version: 2.3.01 - Sony Corporation)
SonicStage Mastering Studio (Version: 2.3.01 - Sony Corporation) Hidden
SonicStage Mastering Studio Audio Filter (HKLM\...\{DF7DB916-90E5-40F2-9010-B8125EB5FD6F}) (Version: 2.3.01 - Sony Corporation)
SonicStage Mastering Studio Plugins (HKLM\...\{9C1C8A04-F8CA-4472-A92D-4288CE32DE86}) (Version: 2.4 - Sony Corporation)
Sony Video Shared Library (HKLM\...\{01FDC9FC-4D4F-4DB0-ACD1-D3E8E1D52902}) (Version: 3.2.00 - Sony Corporation)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 9.1.13.0 - Synaptics)
TurboTax 2010 (HKLM\...\{24AE6B5B-3D5A-488C-9224-1BEE11F75DD9}) (Version: 1.00.0000 - Intuit Canada)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
VAIO Azure Float Wallpaper (HKLM\...\{0312BD0D-A1FE-4E1A-9208-D436F566D867}) (Version: 1.0.00.10100 - Sony Corporation)
VAIO Camera Capture Utility (HKLM\...\{6D2576EC-A0E9-418A-A09A-409933A3B6F4}) (Version: 2.7.00.07050 - Sony Corporation)
VAIO Center Access Bar (HKLM\...\{C299F969-AE3D-4679-ADF5-682A186CE62E}) (Version: 1.00.0622 - Sony)
VAIO Content Folder Setting (HKLM\...\{23825B69-36DF-4DAD-9CFD-118D11D80F16}) (Version: 1.0.00.07170 - Sony Corporation)
VAIO Content Importer VAIO Content Exporter (Version: 1.2.00.06270 - Sony Corporation) Hidden
VAIO Content Importer / VAIO Content Exporter (HKLM\...\{68A69CFF-130D-4CDE-AB0E-7374ECB144C8}) (Version: 1.2.00.06270 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (HKLM\...\{FAA6B94E-78A7-489C-B2DB-050D9FEBFADA}) (Version: 2.0.02.07130 - Sony Corporation)
VAIO Content Metadata Intelligent Analyzing Manager (Version: 2.0.02.07130 - Sony Corporation) Hidden
VAIO Content Metadata Manager Setting (HKLM\...\{69351E9E-23ED-41D5-B146-EDBF83C63B66}) (Version: 2.0.01.07041 - Sony Corporation)
VAIO Content Metadata Manager Setting (Version: 2.0.01.07041 - Sony Corporation) Hidden
VAIO Content Metadata XML Interface Library (HKLM\...\{5F5DE5D5-D130-4110-A3A4-69FFB0B14BD9}) (Version: 2.0.01.07050 - Sony Corporation)
VAIO Content Metadata XML Interface Library (Version: 2.0.01.07050 - Sony Corporation) Hidden
VAIO Control Center (HKLM\...\{72042FA6-5609-489F-A8EA-3C2DD650F667}) (Version: 2.1.00.07110 - Sony Corporation)
VAIO Entertainment Center (HKLM\...\{E74F7423-77CB-4F6A-A44D-604E1010FE50}) (Version: 2.00.0711 - Sony)
VAIO Entertainment Platform (HKLM\...\{6B1F20F2-6321-4669-A58C-33DF8E7517FF}) (Version: 3.0.00.06280 - Sony Corporation)
VAIO Event Service (HKLM\...\{F0D85ADD-DD61-4B43-87A0-6DA52A211A8B}) (Version: 3.2.00.07240 - Sony Corporation)
VAIO Floral Dusk Wallpaper (HKLM\...\{B59B3DA8-06F8-4B4C-AE94-5180753EF108}) (Version: 1.0.00.10100 - Sony Corporation)
VAIO Help And Support (HKLM\...\{7D716354-2C08-48DC-9AC5-957348048817}) (Version: 3.10.0814.CRVP - Sony Corporation)
VAIO Launcher (HKLM\...\{15D5C238-4C2E-4AEA-A66D-D6989A4C586B}) (Version: 1.0.00.07090 - Sony Corporation)
VAIO Media (Version: 6.0.10 - Sony Corporation) Hidden
VAIO Media 6.0 (HKLM\...\{560F6B2E-F0DF-44E5-8190-A4A161F0E205}) (Version: 6.0.10 - Sony Corporation)
VAIO Media AC3 Decoder 1.0 (HKLM\...\{2063C2E8-3812-4BBD-9998-6610F80C1DD4}) (Version: - )
VAIO Media Content Collection 6.0 (HKLM\...\{500162A0-4DD5-460A-BAFD-895AAE48C532}) (Version: - Sony Corporation)
VAIO Media Integrated Server 6.1 (HKLM\...\{785EB1D4-ECEC-4195-99B4-73C47E187721}) (Version: - Sony Corporation)
VAIO Media Redistribution 6.0 (HKLM\...\{5855C127-1F20-404D-B7FB-1FD84D7EAB5E}) (Version: 6.0.10 - Sony Corporation)
VAIO Media Registration Tool (Version: 6.0.10 - Sony Corporation) Hidden
VAIO Media Registration Tool 6.0 (HKLM\...\{AF9A04EB-7D8E-41DE-9EDE-4AB9BB2B71B6}) (Version: 6.0.10 - Sony Corporation)
VAIO Movie Story (HKLM\...\{B25563A0-41F4-4A81-A6C1-6DBC0911B1F3}) (Version: 1.0.00.18280 - Sony Corporation)
VAIO Movie Story (Version: 1.0.00.18280 - Sony Corporation) Hidden
VAIO Movie Story Template Data (HKLM\...\{6FA8BA2C-052B-4072-B8E2-2302C268BE9E}) (Version: 1.0.00.18280 - Sony Corporation)
VAIO MusicBox (HKLM\...\{4EA55D20-27FB-45D7-8726-147E8A5F6C62}) (Version: 1.0.00.07090 - Sony Corporation)
VAIO MusicBox Sample Music (HKLM\...\{98FC7A64-774B-49B5-B046-4B4EBC053FA9}) (Version: 1.0.00.07030 - Sony Corporation)
VAIO OOBE (HKLM\...\{1B500D37-E7CF-480B-8054-8A563594EC4E}) (Version: 3.00.0730 - Sony Corporation)
VAIO Original Function Setting (HKLM\...\{A63E7492-A0BC-4BB9-89A7-352965222380}) (Version: 1.1.00.07130 - Sony Corporation)
VAIO PC Wireless LAN Wizard (HKLM\...\{BCED773C-99EE-48DD-8915-25733F69F0A8}) (Version: 1.00.0716 - Sony)
VAIO Power Management (HKLM\...\{802889F8-6AF5-45A5-9764-CA5B999E50FC}) (Version: 2.2.00.06130 - Sony Corporation)
VAIO Productivity Center (HKLM\...\{BABC878D-BB64-4688-9A88-1D9E88F339A9}) (Version: 2.00.0702 - Sony)
VAIO Security Center (HKLM\...\{CFED0AE3-6D93-4745-B8A0-F3410B493CC4}) (Version: 5.00.0716 - Sony Corporation)
VAIO Service Utility (HKLM\...\VAIO Service Utility) (Version: 1.1.1.3 - Sony)
VAIO Survey (HKLM\...\{34B37A74-125E-4406-87BA-E4BD3D097AE5}) (Version: 5.00.7207 - Sony)
VAIO Teal Whisper Wallpaper (HKLM\...\{235915A8-1C0D-4920-95EA-FE8B773E5F57}) (Version: 1.0.00.10100 - Sony Corporation)
VAIO Update 3 (HKLM\...\{48820099-ED7D-424B-890C-9A82EF00656D}) (Version: 3.0.02.05090 - Sony Corporation)
Windows Live Communications Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3555.0308 - Microsoft Corporation)
Windows Live Essentials (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Photo Common (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live SOXE (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Wireless Switch Setting Utility (HKLM\...\{2A0F3EF9-68EE-49E9-A05B-ED5B82DF63E5}) (Version: 3.6.00.18210 - Sony Corporation)

==================== Restore Points =========================

19-02-2014 02:44:51 Windows Update
20-02-2014 05:00:02 Scheduled Checkpoint
25-02-2014 02:08:50 Windows Update
25-02-2014 02:09:00 Scheduled Checkpoint
21-03-2014 01:50:19 Windows Update
21-03-2014 21:42:50 Scheduled Checkpoint
21-03-2014 21:43:25 Windows Update
23-03-2014 09:39:05 Windows Update
23-03-2014 09:43:52 Windows Update
23-03-2014 10:05:05 Windows Update
23-03-2014 19:15:16 Windows Update
24-03-2014 02:18:57 Windows Update
24-03-2014 03:07:42 Installed Microsoft Fix it 50630
24-03-2014 03:16:55 Installed Microsoft Fix it 50630
24-03-2014 03:39:13 Restore Point before Corrupt Patch Registry keys
24-03-2014 18:26:42 Windows Update
24-03-2014 20:44:45 Windows Update
24-03-2014 21:01:00 Windows Update
25-03-2014 01:24:54 Windows Update
25-03-2014 07:01:02 Windows Update
26-03-2014 07:00:32 Windows Update
27-03-2014 04:00:05 Scheduled Checkpoint
27-03-2014 07:00:17 Windows Update
28-03-2014 07:01:28 Windows Update
29-03-2014 07:00:35 Windows Update

==================== Hosts content: ==========================

2006-11-02 06:23 - 2006-09-18 17:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {002DBCF1-CE5F-4AD5-9855-0FD178613034} - System32\Tasks\{D87B954D-9103-4D46-B4AA-5117172970AD} => C:\Program Files\Skype\Phone\Skype.exe [2013-05-08] (Skype Technologies S.A.)
Task: {03F832E0-ECF2-492D-88C6-9802A2447ED6} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {2B808C03-E90B-4833-AE7C-31C135916052} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-20] (Adobe Systems Incorporated)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44931C59-AD25-455A-B76E-98451DD9AC6C} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {455A1DF5-8F8C-4977-AEA9-F27A962108A0} - System32\Tasks\SONY\VAIO Update\VAIO Update => C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe [2007-05-31] (Sony Corporation)
Task: {5805D863-C516-4D07-9C7A-B01E5F2D4C88} - System32\Tasks\SONY\WSSU\WSSU => C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe [2007-06-15] (Sony Corporation)
Task: {98DB8DBF-D0CA-4C9B-89DA-BF166B163227} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {B328CA98-F36F-4CA0-B7A5-E6023B011277} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-13] (Google Inc.)
Task: {BEC93A3F-8178-45C5-B2D6-04B55D4613A6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-05-13] (Google Inc.)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: {EC9E0D00-0045-415E-9D72-0A35FB464218} - System32\Tasks\VAIO Service Utility => C:\Program Files\Sony\VAIO Service Utility\VAIO-SU.exe [2007-02-16] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2007-08-24 20:16 - 2007-07-24 22:26 - 00010752 _____ () C:\Program Files\Sony\VAIO Event Service\VESBasePS.dll
2007-08-24 20:16 - 2007-07-24 22:26 - 00009728 _____ () C:\Program Files\Sony\VAIO Event Service\VESMgrSubPS.dll
2007-08-24 20:36 - 2007-06-29 09:47 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll
2011-05-26 13:42 - 2011-05-26 13:42 - 00067872 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2014-03-29 22:08 - 2014-03-29 22:08 - 00155648 _____ () C:\Users\Annette\AppData\Local\Temp\737741fb1fd54ea38089544e66f80b2e\filesys.dll
2014-03-29 22:08 - 2014-03-29 22:08 - 00130560 _____ () C:\Users\Annette\AppData\Local\Temp\737741fb1fd54ea38089544e66f80b2e\http.dll

==================== Alternate Data Streams (whitelisted) =========

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PEVSystemStart => " "= "Service "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys => " "= "Driver "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PEVSystemStart => " "= "Service "
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\procexp90.Sys => " "= "Driver "

==================== Disabled items from MSCONFIG ==============

==================== Faulty Device Manager Devices =============

Name: Intel(R) Wireless WiFi Link 4965AGN
Description: Intel(R) Wireless WiFi Link 4965AGN
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Intel Corporation
Service: NETw4v32
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action ", and then click "Enable Device ". This starts the Enable Device wizard. Follow the instructions.

==================== Event log errors: =========================

Application errors:
==================

System errors:
=============

Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
Date: 2014-03-29 22:42:47.594
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-29 22:42:47.017
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-29 22:42:46.346
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-29 22:42:45.722
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-29 22:42:45.161
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-29 22:42:44.552
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-29 22:42:43.913
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-29 22:42:43.320
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-24 22:05:52.331
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-03-24 22:05:51.703
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\mbamchameleon.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Percentage of memory in use: 72%
Total physical RAM: 1013.69 MB
Available physical RAM: 279.13 MB
Total Pagefile: 2295.71 MB
Available Pagefile: 1103.12 MB
Total Virtual: 2047.88 MB
Available Virtual: 1903.53 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:141.57 GB) (Free:76.55 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 149 GB) (Disk ID: 5DBA4753)
Partition 1: (Not Active) - (Size=7 GB) - (Type=27)
Partition 2: (Active) - (Size=142 GB) - (Type=07 NTFS)

==================== End Of Log ============================

broni · 2014/03/29

Download attached fixlist.txt file and save it to the Desktop.
NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST(FRST64) and press the Fix button just once and wait.
The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

DCHammer · 2014/03/29

Fixlog:

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 13-03-2014 01
Ran by Annette at 2014-03-29 23:13:31 Run:1
Running from C:\Users\Annette\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKU\S-1-5-21-918684209-1862192803-2726415506-1002\...\MountPoints2: G - G:\Autorun\Autorun.exe
Toolbar: HKCU - No Name - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File
Toolbar: HKCU - No Name - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
Handler: intu-qt2007 - {026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} - C:\Program Files\QuickTax 2007\ic2007pp.dll No File
Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} - C:\Program Files\QuickTax 2009\ic2009pp.dll No File
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.dll No File
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll No File
S2 CLTNetCnService; "C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [X]
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 HSXHWAZL; system32\DRIVERS\HSXHWAZL.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S2 mdmxsdk; system32\DRIVERS\mdmxsdk.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S4 UIUSys; system32\DRIVERS\UIUSYS.SYS [X]
C:\Program Files\Common Files\Symantec Shared
C:\ProgramData\pswi_preloaded.exe
C:\Users\Annette\AppData\Local\Temp\catchme.dll
C:\Users\Annette\AppData\Local\Temp\KUIU.EXE
C:\Users\Annette\AppData\Local\Temp\ntdll_dump.dll
C:\Users\Annette\AppData\Local\Temp\Quarantine.exe
C:\Users\Annette\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Annette\AppData\Local\Temp\_isBBA8.exe

*****************

HKU\S-1-5-21-918684209-1862192803-2726415506-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\S-1-5-21-918684209-1862192803-2726415506-1002 => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Value deleted successfully.
HKCR\CLSID\{47833539-D0C5-4125-9FA8-0819E2EAAC93} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} => Value deleted successfully.
HKCR\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Value deleted successfully.
HKCR\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068} => Key not found.
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Value deleted successfully.
HKCR\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F} => Key not found.
HKCR\PROTOCOLS\Handler\intu-qt2007 => Key deleted successfully.
HKCR\CLSID\{026BF40D-BA05-467b-9F1F-AD0D7A3F5F11} => Key deleted successfully.
HKCR\PROTOCOLS\Handler\intu-qt2009 => Key deleted successfully.
HKCR\CLSID\{03947252-2355-4e9b-B446-8CCC75C43370} => Key deleted successfully.
HKCR\PROTOCOLS\Handler\livecall => Key deleted successfully.
HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => Key deleted successfully.
HKCR\PROTOCOLS\Handler\msnim => Key deleted successfully.
HKCR\CLSID\{828030A1-22C1-4009-854F-8E305202313F} => Key not found.
C:\Program Files\Google\Update\1.3.21.149\npGoogleUpdate3.dll not found.
c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll not found.
CLTNetCnService => Service deleted successfully.
blbdrive => Service deleted successfully.
HSXHWAZL => Service deleted successfully.
IpInIp => Service deleted successfully.
mdmxsdk => Service deleted successfully.
NwlnkFlt => Service deleted successfully.
NwlnkFwd => Service deleted successfully.
UIUSys => Service deleted successfully.
C:\Program Files\Common Files\Symantec Shared => Moved successfully.
C:\ProgramData\pswi_preloaded.exe => Moved successfully.
C:\Users\Annette\AppData\Local\Temp\catchme.dll => Moved successfully.
C:\Users\Annette\AppData\Local\Temp\KUIU.EXE => Moved successfully.
C:\Users\Annette\AppData\Local\Temp\ntdll_dump.dll => Moved successfully.
C:\Users\Annette\AppData\Local\Temp\Quarantine.exe => Moved successfully.
C:\Users\Annette\AppData\Local\Temp\SkypeSetup.exe => Moved successfully.
C:\Users\Annette\AppData\Local\Temp\_isBBA8.exe => Moved successfully.

==== End of Fixlog ====

broni · 2014/03/29

Very good

Last scans...

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:

Internet Services

Windows Firewall

System Restore

Security Center

Windows Update

Windows Defender

Other Services

Press "Scan ".

It will create a log (FSS.txt) in the same directory the tool is run.

Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Click on "Run ESET Online Scanner" button.

Tick the box next to YES, I accept the Terms of Use

Click Start

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, click on List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

DCHammer · 2014/03/29

Security Check said the OS isn't supported.

FSS Log:
Farbar Service Scanner Version: 25-02-2014
Ran by Annette (administrator) on 29-03-2014 at 23:56:28
Running from "C:\Users\Annette\Desktop "
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.

Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware "=DWORD:1

Other Services:
==============

File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys
[2014-03-23 08:54] - [2013-07-04 23:20] - 0914880 ____A (Microsoft Corporation) 6D0D344F643E28B31262AC2682109A3C

C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\ipnathlp.dll => MD5 is legit
C:\Windows\system32\iphlpsvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit

**** End of log ****

broni · 2014/03/30

Eset?

DCHammer · 2014/03/30

Late and tired. Running it right now. Will post log when complete.

Log in or Sign up

Solved Strangeness Abounds - including DDS not completing

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

DCHammer Well-Known Member Thread Starter

DCHammer Well-Known Member Thread Starter

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

Attached Files:

fixlist.txt

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

Share This Page

Log in or Sign up

Solved Strangeness Abounds - including DDS not completing

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

DCHammer Well-Known Member Thread Starter

DCHammer Well-Known Member Thread Starter

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

Attached Files:

fixlist.txt

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

broni Moderator Malware Analyst

DCHammer Well-Known Member Thread Starter

Share This Page

Useful Searches