TechSpot

Dllhost.exe accessing ad/malware sites

Solved
By William Clemens
Oct 8, 2013
  1. Up to 16 instances of dllhost.exe are started whenever an Internet connection is available. These all point to ad or other junk sites, example
    "http://blekko.com/ws/?=laptops bad credit financing..."
    If I disconnect network cable, dllhost.exe instances drop one by one until after 10-15 minutes they are gone. As soon as I plug the network cable back in they start right up again.
    I have scanned with McAfee (found nothing), eset (found 2 threats and removed, but cannot load current signature files), and MBAM (found and removed around 30 threats). Currently eset and MBAM both report system is clean but this rogue behavior continues.
     
  2. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Malwarebytes Anti-Malware (Trial) 1.75.0.1300
    www.malwarebytes.org

    Database version: v2013.10.08.07

    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 10.0.9200.16686
    rsinger :: RSINGER-PC [administrator]

    Protection: Disabled

    10/8/2013 5:23:53 PM
    mbam-log-2013-10-08 (17-23-53).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 206441
    Time elapsed: 3 minute(s), 2 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    (end)
     
  3. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 10.0.9200.16686 BrowserJavaVersion: 10.40.2
    Run by rsinger at 19:03:33 on 2013-10-08
    Microsoft Windows 7 Professional 6.1.7601.1.1252.1.1033.18.3895.2102 [GMT -7:00]
    .
    AV: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
    SP: ESET NOD32 Antivirus 6.0 *Enabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k RPCSS
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe
    C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
    C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Windows\system32\msiexec.exe
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    C:\Windows\system32\taskhost.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe
    C:\Windows\System32\WUDFHost.exe
    C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe
    C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\Windows\system32\SearchIndexer.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\Windows\System32\svchost.exe -k LocalServicePeerNet
    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe
    C:\Windows\SysWOW64\NOTEPAD.EXE
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Windows\System32\svchost.exe -k secsvcs
    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.yahoo.com/?ilc=1
    mStart Page = hxxp://www.google.com
    mWinlogon: Userinit = userinit.exe,
    BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll
    BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - <orphaned>
    BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
    BHO: Windows Live Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
    BHO: Bing Bar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -
    BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
    TB: Google Toolbar: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    TB: Bing Bar: {8dcb7100-df86-4384-8842-8fa844297b3f} -
    TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll
    TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll
    uRun: [swg] "C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
    mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    mRun: [Symantec Backup Exec System Recovery 2010] "C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe"
    mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe"
    mRunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"
    mPolicies-Explorer: NoActiveDesktop = dword:1
    mPolicies-Explorer: NoActiveDesktopChanges = dword:1
    mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
    mPolicies-System: ConsentPromptBehaviorUser = dword:3
    mPolicies-System: EnableUIADesktopToggle = dword:0
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MIF5BA~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~2\MIF5BA~1\Office14\ONBttnIE.dll/105
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    TCP: NameServer = 192.168.1.1
    TCP: Interfaces\{5FA282E3-55BA-4CA6-9D35-FF96E5AE347F} : DHCPNameServer = 192.168.0.1 64.119.5.72
    TCP: Interfaces\{CCBF9E61-3B52-4C69-AE7B-2D83B07E3977} : DHCPNameServer = 192.168.1.1
    TCP: Interfaces\{E7E069DA-523F-489C-B931-0AE4A9225778} : DHCPNameServer = 192.168.0.1 64.119.5.72
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    SSODL: WebCheck - <orphaned>
    mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
    x64-mStart Page = hxxp://start.mysearchdial.com/?f=1&a=irmsd84&cd=2XzuyEtN2Y1L1QzuzzyEtB0BtB0B0BtDtByB0C0CyB0D0AyCtN0D0Tzu0SyCtCzztN1L2XzutBtFtBtFyDtFtCtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    x64-BHO: Google Toolbar Helper: {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
    x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} -
    x64-TB: Google Toolbar: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll
    x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
    x64-Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - <orphaned>
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Notify: GoToAssist - C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll
    x64-Notify: igfxcui - igfxdev.dll
    x64-SSODL: WebCheck - <orphaned>
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 PxHlpa64;PxHlpa64;C:\Windows\System32\drivers\PxHlpa64.sys [2011-10-12 55280]
    R1 eamonm;eamonm;C:\Windows\System32\drivers\eamonm.sys [2013-2-20 213416]
    R2 Backup Exec System Recovery;Backup Exec System Recovery;C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe [2010-3-3 4596064]
    R2 BBSvc;Bing Bar Update Service;C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
    R2 BBUpdate;BBUpdate;C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
    R2 ekrn;ESET Service;C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [2013-3-21 1341664]
    R2 epfwwfpr;epfwwfpr;C:\Windows\System32\drivers\epfwwfpr.sys [2013-1-10 139768]
    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2013-10-8 418376]
    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2013-10-8 701512]
    R3 GenericMount;Generic Mount Driver;C:\Windows\System32\drivers\GenericMount.sys [2010-2-12 66608]
    R3 HECIx64;Intel(R) Management Engine Interface;C:\Windows\System32\drivers\HECIx64.sys [2010-11-12 56344]
    R3 IntcDAud;Intel(R) Display Audio;C:\Windows\System32\drivers\IntcDAud.sys [2010-11-12 271872]
    R3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;C:\Windows\System32\drivers\k57nd60a.sys [2010-11-12 321064]
    R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2013-10-8 25928]
    R3 SymSnapService;SymSnapService;C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe [2010-2-11 2965496]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
    S3 AE1000;Linksys AE1000 Driver;C:\Windows\System32\drivers\ae1000w7.sys [2010-12-1 1101600]
    S3 efavdrv;efavdrv;C:\Windows\System32\drivers\efavdrv.sys [2013-10-8 139704]
    S3 GenericMount Helper Service;GenericMount Helper Service;C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\GenericMountHelperx64.exe [2010-2-12 2227216]
    S3 Impcd;Impcd;C:\Windows\System32\drivers\Impcd.sys [2010-11-12 158976]
    S3 StorSvc;Storage Service;C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 27136]
    S3 Symantec SymSnap VSS Provider;Symantec SymSnap VSS Provider;C:\Windows\System32\dllhost.exe [2009-7-13 9728]
    S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2011-5-23 59392]
    S3 vpcuxd;USB Virtualization Stub Service;C:\Windows\System32\drivers\vpcuxd.sys [2011-5-23 16384]
    S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2010-12-2 1255736]
    S4 DockLoginService;Dock Login Service;C:\Program Files\Dell\DellDock\DockLogin.exe [2009-6-9 155648]
    S4 IntuitUpdateServiceV4;Intuit Update Service v4;C:\Program Files (x86)\Common Files\Intuit\Update Service v4\IntuitUpdateService.exe [2012-8-23 13672]
    S4 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944]
    .
    =============== Created Last 30 ================
    .
    2013-10-09 00:41:13--------d-----w-C:\Users\rsinger\AppData\Local\FileTypeAssistant
    2013-10-08 23:16:36--------d-----w-C:\Program Files (x86)\ESET
    2013-10-08 22:03:12139704----a-w-C:\Windows\System32\drivers\efavdrv.sys
    2013-10-08 21:57:039694160----a-w-C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{9D5F854A-4BCE-434E-A245-12EE4FC5AF40}\mpengine.dll
    2013-10-08 21:57:01278800------w-C:\Windows\System32\MpSigStub.exe
    2013-10-08 19:11:59--------d-----w-C:\Users\rsinger\AppData\Roaming\Malwarebytes
    2013-10-08 19:11:28--------d-----w-C:\ProgramData\Malwarebytes
    2013-10-08 19:11:2725928----a-w-C:\Windows\System32\drivers\mbam.sys
    2013-10-08 19:11:27--------d-----w-C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-10-08 19:11:03--------d-----w-C:\Users\rsinger\AppData\Local\Programs
    2013-10-08 08:26:28--------d-----w-C:\Users\rsinger\AppData\Local\ESET
    2013-10-08 06:49:35--------d-----w-C:\Program Files\ESET
    2013-10-08 02:28:57--------d-----w-C:\Windows\pss
    2013-09-24 23:14:05--------d-----w-C:\ProgramData\Oracle
    2013-09-24 23:13:31868264----a-w-C:\Windows\SysWow64\npDeployJava1.dll
    2013-09-24 23:13:2396168----a-w-C:\Windows\SysWow64\WindowsAccessBridge-32.dll
    2013-09-12 05:53:00155584----a-w-C:\Windows\System32\drivers\ataport.sys
    .
    ==================== Find3M ====================
    .
    2013-09-24 23:13:15790440----a-w-C:\Windows\SysWow64\deployJava1.dll
    2013-08-10 05:22:182241024----a-w-C:\Windows\System32\wininet.dll
    2013-08-10 05:20:593959296----a-w-C:\Windows\System32\jscript9.dll
    2013-08-10 05:20:5567072----a-w-C:\Windows\System32\iesetup.dll
    2013-08-10 05:20:55136704----a-w-C:\Windows\System32\iesysprep.dll
    2013-08-10 03:59:101767936----a-w-C:\Windows\SysWow64\wininet.dll
    2013-08-10 03:58:092876928----a-w-C:\Windows\SysWow64\jscript9.dll
    2013-08-10 03:58:0661440----a-w-C:\Windows\SysWow64\iesetup.dll
    2013-08-10 03:58:06109056----a-w-C:\Windows\SysWow64\iesysprep.dll
    2013-08-10 03:17:382706432----a-w-C:\Windows\System32\mshtml.tlb
    2013-08-10 03:07:502706432----a-w-C:\Windows\SysWow64\mshtml.tlb
    2013-08-10 02:27:5989600----a-w-C:\Windows\System32\RegisterIEPKEYs.exe
    2013-08-10 02:17:1971680----a-w-C:\Windows\SysWow64\RegisterIEPKEYs.exe
    2013-08-08 01:20:433155456----a-w-C:\Windows\System32\win32k.sys
    2013-08-02 02:23:535550528----a-w-C:\Windows\System32\ntoskrnl.exe
    2013-08-02 02:15:441732032----a-w-C:\Windows\System32\ntdll.dll
    2013-08-02 02:15:03362496----a-w-C:\Windows\System32\wow64win.dll
    2013-08-02 02:15:03243712----a-w-C:\Windows\System32\wow64.dll
    2013-08-02 02:15:0313312----a-w-C:\Windows\System32\wow64cpu.dll
    2013-08-02 02:14:57215040----a-w-C:\Windows\System32\winsrv.dll
    2013-08-02 02:14:1116384----a-w-C:\Windows\System32\ntvdm64.dll
    2013-08-02 02:13:34424448----a-w-C:\Windows\System32\KernelBase.dll
    2013-08-02 01:59:303968960----a-w-C:\Windows\SysWow64\ntkrnlpa.exe
    2013-08-02 01:59:303913664----a-w-C:\Windows\SysWow64\ntoskrnl.exe
    2013-08-02 01:51:231292192----a-w-C:\Windows\SysWow64\ntdll.dll
    2013-08-02 01:50:425120----a-w-C:\Windows\SysWow64\wow32.dll
    2013-08-02 01:50:42274944----a-w-C:\Windows\SysWow64\KernelBase.dll
    2013-08-02 01:09:17338432----a-w-C:\Windows\System32\conhost.exe
    2013-08-02 00:59:09112640----a-w-C:\Windows\System32\smss.exe
    2013-08-02 00:45:3725600----a-w-C:\Windows\SysWow64\setup16.exe
    2013-08-02 00:45:3614336----a-w-C:\Windows\SysWow64\ntvdm64.dll
    2013-08-02 00:45:357680----a-w-C:\Windows\SysWow64\instnm.exe
    2013-08-02 00:45:342048----a-w-C:\Windows\SysWow64\user.exe
    2013-08-02 00:43:056144---ha-w-C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
    2013-08-02 00:43:054608---ha-w-C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
    2013-08-02 00:43:053584---ha-w-C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
    2013-08-02 00:43:053072---ha-w-C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
    2013-07-25 09:25:541888768----a-w-C:\Windows\System32\WMVDECOD.DLL
    2013-07-25 08:57:271620992----a-w-C:\Windows\SysWow64\WMVDECOD.DLL
    2013-07-19 01:58:422048----a-w-C:\Windows\System32\tzres.dll
    2013-07-19 01:41:012048----a-w-C:\Windows\SysWow64\tzres.dll
    .
    ============= FINISH: 19:04:16.54 ===============
     
  4. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2012-11-20.01)
    .
    Microsoft Windows 7 Professional
    Boot Device: \Device\HarddiskVolume2
    Install Date: 12/1/2010 2:54:58 PM
    System Uptime: 10/8/2013 6:55:02 PM (1 hours ago)
    .
    Motherboard: Dell Inc. | | 0C2KJT
    Processor: Intel(R) Core(TM) i3 CPU 550 @ 3.20GHz | CPU 1 | 3200/133mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 687 GiB total, 596.838 GiB free.
    D: is CDROM ()
    E: is Removable
    F: is Removable
    G: is Removable
    H: is Removable
    I: is Removable
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP195: 9/24/2013 12:36:01 AM - Scheduled Checkpoint
    RP196: 9/24/2013 4:11:36 PM - Removed Java(TM) 6 Update 30
    RP197: 9/24/2013 4:12:52 PM - Installed Java 7 Update 40
    RP198: 10/2/2013 12:00:03 AM - Scheduled Checkpoint
    RP199: 10/7/2013 8:17:04 PM - Windows Update
    RP200: 10/7/2013 9:13:17 PM - Removed Java(TM) 6 Update 20 (64-bit)
    RP201: 10/7/2013 11:47:14 PM - Installed ESET NOD32 Antivirus
    .
    ==== Installed Programs ======================
    .
    Adobe AIR
    Adobe Flash Player 10 Plugin
    Adobe Flash Player 11 ActiveX 64-bit
    Adobe Reader X (10.0.1)
    Adobe Shockwave Player 11.5
    AnswerWorks 5.0 English Runtime
    Bing Bar
    Canon CanoScan LiDE 110 User Registration
    Canon iP4600 series Printer Driver
    Canon iP4700 series Printer Driver
    Canon MP Navigator EX 4.0
    Canon Solution Menu EX
    Canon Utilities Easy-PhotoPrint EX
    Canon Utilities My Printer
    Canon Utilities Solution Menu
    CanoScan LiDE 110 Scanner Driver
    Clip Art Collection
    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
    Dell Dock
    Dell Edoc Viewer
    Dell Getting Started Guide
    Driver Manager
    ESET NOD32 Antivirus
    ESET Online Scanner v3
    Eudora OSE (1.0)
    File Type Assistant
    Google Chrome
    Google Toolbar for Internet Explorer
    Google Update Helper
    GoToAssist 8.0.0.514
    Intel(R) Graphics Media Accelerator Driver
    Internet Explorer
    Java 7 Update 40
    Java Auto Updater
    Junk Mail filter update
    LiveUpdate 3.2 (Symantec Corporation)
    Malwarebytes Anti-Malware version 1.75.0.1300
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Office 2010 Service Pack 1 (SP1)
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Home and Student 2010
    Microsoft Office Office 64-bit Components 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared 64-bit MUI (English) 2010
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Single Image 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Silverlight
    Microsoft SQL Server 2005 Compact Edition [ENU]
    Microsoft Sync Framework Runtime Native v1.0 (x86)
    Microsoft Sync Framework Services Native v1.0 (x86)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    MSVCRT
    Multimedia Card Reader
    My Dell
    Quicken 2008
    Realtek High Definition Audio Driver
    Roxio Burn
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
    Security Update for Microsoft Excel 2010 (KB2760597) 32-Bit Edition
    Security Update for Microsoft InfoPath 2010 (KB2760406) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2553371) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2589320) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2598243) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687276) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687423) 32-Bit Edition
    Security Update for Microsoft Office 2010 (KB2687510) 32-Bit Edition
    Security Update for Microsoft Outlook 2010 (KB2794707) 32-Bit Edition
    Security Update for Microsoft Publisher 2010 (KB2553147) 32-Bit Edition
    Security Update for Microsoft Visio 2010 (KB2810068) 32-Bit Edition
    Security Update for Microsoft Word 2010 (KB2760769) 32-Bit Edition
    Shared C Run-time for x64
    Skype Click to Call
    Skype™ 5.10
    Symantec Backup Exec System Recovery 2010
    TurboTax 2010
    TurboTax 2010 WinPerFedFormset
    TurboTax 2010 WinPerReleaseEngine
    TurboTax 2010 WinPerTaxSupport
    TurboTax 2010 wrapper
    TurboTax 2011
    TurboTax 2011 WinPerFedFormset
    TurboTax 2011 WinPerReleaseEngine
    TurboTax 2011 WinPerTaxSupport
    TurboTax 2011 wrapper
    TurboTax 2012
    TurboTax 2012 WinPerFedFormset
    TurboTax 2012 WinPerReleaseEngine
    TurboTax 2012 WinPerTaxSupport
    TurboTax 2012 wrapper
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
    Update for Microsoft .NET Framework 4 Client Profile (KB2836939)
    Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition
    Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2494150)
    Update for Microsoft Office 2010 (KB2553065)
    Update for Microsoft Office 2010 (KB2553157) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2566458)
    Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589370) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2760758) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition
    Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition
    Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition
    Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition
    Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition
    Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition
    Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition
    WildTangent Games
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Mail
    Windows Live Messenger
    Windows Live Movie Maker
    Windows Live Photo Gallery
    Windows Live Sign-in Assistant
    Windows Live Sync
    Windows Live Upload Tool
    Windows Live Writer
    Windows XP Mode
    Yahoo! Detect
    Yahoo! Software Update
    Yahoo! Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    10/8/2013 12:10:38 PM, Error: VDS Basic Provider [1] - Unexpected failure. Error code: D@01010004
    10/7/2013 9:43:01 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the ShellHWDetection service.
    10/7/2013 9:42:31 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wuauserv service.
    10/7/2013 9:36:01 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AeLookupSvc service.
    10/7/2013 9:36:01 PM, Error: Service Control Manager [7000] - The Application Experience service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    10/7/2013 9:25:15 PM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the eventlog service.
    10/7/2013 11:50:36 PM, Error: Service Control Manager [7030] - The ESET Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    10/7/2013 10:29:43 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    10/7/2013 10:28:59 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    10/7/2013 10:28:54 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    10/7/2013 10:12:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    10/7/2013 10:12:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    10/7/2013 10:12:05 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    10/7/2013 10:12:00 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    10/7/2013 10:11:53 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: discache spldr vpcvmm Wanarpv6
    .
    ==== End Of File ===========================
     
  5. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Neglected to mention in original post that this behavior at times virtually saturates the available Internet connection bandwidth (1.5 MBPS DSL), which prevents other computers sharing the connection from Internet access, as well as preventing the infected computer from desirable Internet access.
     
  6. Broni

    Broni Malware Annihilator Posts: 46,868   +254

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =====================================

    [​IMG] Download RogueKiller for 32bit or Roguekiller for 64bit to your Desktop.
    • Close all the running programs
    • Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download Malwarebytes Anti-Rootkit (MBAR) from HERE
    • Unzip downloaded file.
    • Open the folder where the contents were unzipped and run mbar.exe
    • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
    • Wait while the system shuts down and the cleanup process is performed.
    • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
    • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
     
  7. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    I cannot download directly to the affected computer. I downloaded RogueKillerX64.exe onto another computer and saved it to a USB drive, then moved that USB drive and copied RogueKillerX64.exe to the desktop of the affected computer. I will scan the USB drive with eset NOD32 Antivirus before using it again on the clean computer.

    I ran RogueKillerX64 as instructed (Windows 7, Run As Administrator). It appeared to hang after a few minutes, displaying "Searching for Policy Hijacks -> (HJ INPROC)." It did this once before and after about 20 minutes I quit RogueKiller. I ried to restart it but it said it was already running. I shut down and restarted Windows. Prior to starting RogueKiller, I exited MBAM and disabled eset NOD32 Antivirus until next reboot, in case either of those may have been interfering with RogueKiller. It has been in this state (searching for policy hijacks...) for nearly an hour now. I will continue to let it run until I hear otherwise or until tomorrow morning.

    In the morning unless I hear otherwise, if it has not completed I will shut down and restart and attempt to run MBAR as instructed.

    Thanks for your help!
     
  8. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    In the morning I found the computer had gone to sleep. I have subsequently changed the power plan to Put Computer to Sleep = Never so that should not happen again.

    When I woke it up, RogueKiller was still in the same place. I restarted and tried again in safe mode. Network cable is disconnected, but this does not seem to matter, I've tried it both ways.

    Before the hang, here is what shows in the RogueKiller window:
    [Registry Tab]
    Status Type Key Type Global User Key Value Data
    FOUND PUM HJ SMENU HKEY_CURRENT_USER [blank] Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ShowMyGames 0
    FOUND PUM HJ DESK HKEY_CURRENT_USER [blank] Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu {20D04FE0-3AEA-1069-A2D8-08002B30309D} 1
    FOUND PUM HJ DESK HKEY_CURRENT_USER [blank] Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\ClassicStartMenu {645FF040-5081-101B-9F08-00AA002F954E} 1
    FOUND PUM HJ DESK HKEY_CURRENT_USER [blank] Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel {20D04FE0-3AEA-1069-A2D8-08002B30309D} 1
    FOUND PUM HJ DESK HKEY_CURRENT_USER [blank] Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel {645FF040-5081-101B-9F08-00AA002F954E} 1
    FOUND PUM HJ DESK HKEY_CURRENT_USER [blank] Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel {59031a47-3f72-44a7-89c5-5595fe6b30ee} 1
    FOUND PUM HJ DESK HKEY_CURRENT_USER [blank] Software\Microsoft\Windows\CurrentVersion\Explorer\HideDesktopIcons\NewStartPanel {20D04FE0-3AEA-1069-A2D8-08002B30309D} 1
    Now will move on to creating a restore point and running MBAR.
     
  9. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Updated MBAR database to 2013.10.08.02. Scan complete, found one item and says it cleaned it. No prompt for shutdown but "circular hourglass" cursor present for 30 minutes before I shut down. In the meantime Windows Updates had downloaded 26 updates and installed them on shutdown.

    After restart, running MBAR again. The high Internet traffic still seems to be present (based on flashing led on network switch).

    I must leave now. I am leaving MBAR running and will update and post logs in a few hours.
     
  10. Broni

    Broni Malware Annihilator Posts: 46,868   +254

    Let me know.
     
  11. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    MBAR completed. Results similar to the first time. Here are the logs:

    ----- #1 -----
    Malwarebytes Anti-Rootkit BETA 1.07.0.1005
    www.malwarebytes.org
    Database version: v2013.10.10.05
    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 10.0.9200.16686
    rsinger :: RSINGER-PC [administrator]
    10/10/2013 7:32:04 AM
    mbar-log-2013-10-10 (07-32-04).txt
    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 230586
    Time elapsed: 11 minute(s), 33 second(s)
    Memory Processes Detected: 0
    (No malicious items detected)
    Memory Modules Detected: 0
    (No malicious items detected)
    Registry Keys Detected: 0
    (No malicious items detected)
    Registry Values Detected: 0
    (No malicious items detected)
    Registry Data Items Detected: 1
    HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32| (Hijack.SHELL32) -> Bad: (\\?\globalroot\Device\HarddiskVolume3\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll) Good: (SHELL32.dll) -> Replace on reboot.
    Folders Detected: 0
    (No malicious items detected)
    Files Detected: 0
    (No malicious items detected)
    Physical Sectors Detected: 0
    (No malicious items detected)
    (end)
    ----- #2 -----
    Malwarebytes Anti-Rootkit BETA 1.07.0.1005
    www.malwarebytes.org
    Database version: v2013.10.10.05
    Windows 7 Service Pack 1 x64 NTFS
    Internet Explorer 10.0.9200.16721
    rsinger :: RSINGER-PC [administrator]
    10/10/2013 8:49:23 AM
    mbar-log-2013-10-10 (08-49-23).txt
    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 231124
    Time elapsed: 12 minute(s), 57 second(s)
    Memory Processes Detected: 0
    (No malicious items detected)
    Memory Modules Detected: 0
    (No malicious items detected)
    Registry Keys Detected: 0
    (No malicious items detected)
    Registry Values Detected: 0
    (No malicious items detected)
    Registry Data Items Detected: 1
    HKCU\SOFTWARE\CLASSES\CLSID\{FBEB8A05-BEEE-4442-804E-409D6C4515E9}\INPROCSERVER32| (Hijack.SHELL32) -> Bad: (\\?\globalroot\Device\HarddiskVolume3\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll) Good: (SHELL32.dll) -> Replace on reboot.
    Folders Detected: 0
    (No malicious items detected)
    Files Detected: 0
    (No malicious items detected)
    Physical Sectors Detected: 0
    (No malicious items detected)
    (end)
    For what it's worth, although MBAR never asked me to, I shut down the affected computer and restarted it. As it booted up, I watched carefully. There was very little Internet traffic until sometime after the desktop appeared, then a command window opened for a couple seconds, and once the command window closed the high Internet traffic started immediately and did not stop until I once again shut down. It appears the hijack was recreated after reboot.
     
     
  12. Broni

    Broni Malware Annihilator Posts: 46,868   +254

    Please download Farbar Recovery Scan Tool and save it to your Desktop.

    Note: You need to run the version compatibale with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
    • Double-click to run it. When the tool opens click Yes to disclaimer.
    • Press Scan button.
    • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
    • The first time the tool is run, it makes also another log (Addition.txt). Please copy and paste it to your reply.
     
  13. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Bleepingcomputer.com seems to be down. Do you have another trusted download link for FRST?
     
  14. Broni

    Broni Malware Annihilator Posts: 46,868   +254

    Yeah...unfortunately I only have some older version so we'll have to wait.
     
  15. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    I have FRST64 v 3.3.8.1 from July 2012. Would there be any point in running that?
     
  16. Broni

    Broni Malware Annihilator Posts: 46,868   +254

    No. We have to run the newest version.
     
  17. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
    Ran by rsinger (administrator) on RSINGER-PC on 10-10-2013 20:27:11
    Running from C:\Users\rsinger\Desktop
    Windows 7 Professional Service Pack 1 (X64) OS Language: English(US)
    Internet Explorer Version 10
    Boot Mode: Normal
    ==================== Processes (Whitelisted) =================
    (Symantec Corporation) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe
    (Microsoft Corporation.) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    (Microsoft Corporation) C:\Windows\system32\msiexec.exe
    (Symantec) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    (Symantec Corporation) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe
    () C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
    ==================== Registry (Whitelisted) ==================
    HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060832 2010-02-08] (Realtek Semiconductor)
    HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [6330568 2013-03-21] (ESET)
    HKLM-x32\...\Runonce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [x]
    Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKLM\...\Policies\Explorer: [NoControlPanel] 0
    HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-08] (Google Inc.)
    HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll ATTENTION! ====> ZeroAccess?
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2011-01-30] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-10] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Symantec Backup Exec System Recovery 2010] - C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe [2599784 2010-09-14] (Symantec Corporation)
    HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-12-15] ()
    Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    ==================== Internet (Whitelisted) ====================
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=1
    HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM-x32 - DefaultScope {575721B7-914D-44DC-9300-00022BE8B753} URL =
    SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 - {575721B7-914D-44DC-9300-00022BE8B753 URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM-x32 - {751C5749-E1BE-333C-9EFD-165567F7F20C} URL =
    SearchScopes: HKCU - DefaultScope {575721B7-914D-44DC-9300-00022BE8B753} URL = http://search.conduit.com/ResultsEx...4&ctid=CT3299872&CUI=UN42554263349168884&UM=2
    SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searc...SP_ss&mntrId=4e217da6000000000000842b2bb027cc
    SearchScopes: HKCU - {5482F9A9-F44B-45F2-9852-F37719DFBA8A} URL =
    SearchScopes: HKCU - {575721B7-914D-44DC-9300-00022BE8B753 URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKCU - {575721B7-914D-44DC-9300-00022BE8B753} URL = http://search.conduit.com/ResultsEx...4&ctid=CT3299872&CUI=UN42554263349168884&UM=2
    SearchScopes: HKCU - {68893FA0-A909-33C3-7C51-6656545E3C51} URL =
    SearchScopes: HKCU - {E58E0C07-470F-4C08-8079-3382D927C525} URL = http://search.yahoo.com/search?p={s...e=W3i_DS,136,0_0,Search,20120417,17118,0,18,0
    BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
    BHO-x32: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
    BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
    BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
    Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
    Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
    Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
    Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{CCBF9E61-3B52-4C69-AE7B-2D83B07E3977}: [NameServer]64.119.0.4,8.8.8.8
    Chrome:
    =======
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll ()
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\pdf.dll ()
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
    CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
    CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
    CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
    CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
    CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File
    CHR Extension: (Google Docs) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
    CHR Extension: (Google Drive) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
    CHR Extension: (YouTube) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
    CHR Extension: (Google Search) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
    CHR Extension: (Chrome In-App Payments service) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
    CHR Extension: (Gmail) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
    ==================== Services (Whitelisted) =================
    R2 Backup Exec System Recovery; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe [4596064 2010-09-14] (Symantec Corporation)
    R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1341664 2013-03-21] (ESET)
    S3 GenericMount Helper Service; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-12] (Symantec)
    S3 LiveUpdate; C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE [2999664 2007-09-12] (Symantec Corporation)
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
    S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)
    R3 SymSnapService; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe [2965496 2010-09-06] (Symantec)
    ==================== Drivers (Whitelisted) ====================
    S3 AE1000; C:\Windows\System32\DRIVERS\ae1000w7.sys [1101600 2010-03-22] (Ralink Technology Corp.)
    R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-20] (ESET)
    S3 efavdrv; C:\Windows\system32\drivers\efavdrv.sys [139704 2013-10-08] (ESET)
    R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
    R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [139768 2013-01-10] (ESET)
    R3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
    S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
    R0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170544 2010-09-06] (StorageCraft)
    S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
    S3 esihdrv; \??\C:\Users\rsinger\AppData\Local\Temp\esihdrv.sys [x]
    U2 V2iMount;
    ==================== NetSvcs (Whitelisted) ===================

    ==================== One Month Created Files and Folders ========
    2013-10-10 20:26 - 2013-10-10 20:26 - 00000000 ____D C:\FRST
    2013-10-10 20:25 - 2013-10-10 20:20 - 01954124 _____ (Farbar) C:\Users\rsinger\Desktop\FRST64.exe
    2013-10-10 08:32 - 2013-09-22 16:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2013-10-10 08:32 - 2013-09-22 16:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2013-10-10 08:32 - 2013-09-22 15:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2013-10-10 08:32 - 2013-09-20 20:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2013-10-10 08:32 - 2013-09-20 20:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2013-10-10 08:32 - 2013-09-20 19:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
    2013-10-10 08:32 - 2013-09-20 19:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2013-10-10 08:08 - 2013-07-12 03:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
    2013-10-10 08:08 - 2013-07-12 03:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
    2013-10-10 08:08 - 2013-07-02 21:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
    2013-10-10 08:08 - 2013-07-02 21:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
    2013-10-10 08:08 - 2013-07-02 21:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
    2013-10-10 08:08 - 2013-06-25 15:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
    2013-10-10 08:07 - 2013-09-13 18:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
    2013-10-10 08:07 - 2013-09-07 19:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
    2013-10-10 08:07 - 2013-09-07 19:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
    2013-10-10 08:07 - 2013-09-07 19:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
    2013-10-10 08:07 - 2013-07-04 05:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
    2013-10-10 08:07 - 2013-07-04 05:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
    2013-10-10 08:07 - 2013-07-04 04:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
    2013-10-10 08:07 - 2013-07-04 04:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
    2013-10-10 08:07 - 2013-07-04 03:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
    2013-10-10 08:06 - 2013-09-04 05:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
    2013-10-10 08:06 - 2013-08-28 19:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2013-10-10 08:06 - 2013-08-28 19:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2013-10-10 08:06 - 2013-08-28 19:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
    2013-10-10 08:06 - 2013-08-28 19:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2013-10-10 08:06 - 2013-08-28 19:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
    2013-10-10 08:06 - 2013-08-28 18:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2013-10-10 08:06 - 2013-08-28 18:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2013-10-10 08:06 - 2013-08-28 18:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2013-10-10 08:06 - 2013-08-28 18:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
    2013-10-10 08:06 - 2013-08-28 18:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2013-10-10 08:06 - 2013-08-28 18:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
    2013-10-10 08:06 - 2013-08-28 17:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2013-10-10 08:06 - 2013-08-28 17:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2013-10-10 08:06 - 2013-08-28 17:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2013-10-10 08:06 - 2013-08-28 17:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2013-10-10 08:06 - 2013-08-27 18:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2013-10-10 08:06 - 2013-08-27 18:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
    2013-10-10 08:06 - 2013-08-01 05:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
    2013-10-10 08:06 - 2013-07-20 03:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
    2013-10-10 08:06 - 2013-07-20 03:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
    2013-10-10 08:06 - 2013-07-04 05:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
    2013-10-10 08:06 - 2013-07-04 04:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
    2013-10-10 08:06 - 2013-06-05 22:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
    2013-10-10 08:06 - 2013-06-05 22:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2013-10-10 08:06 - 2013-06-05 22:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
    2013-10-10 08:06 - 2013-06-05 22:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
    2013-10-10 08:06 - 2013-06-05 21:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
    2013-10-10 08:06 - 2013-06-05 21:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2013-10-10 08:06 - 2013-06-05 21:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
    2013-10-10 08:06 - 2013-06-05 20:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2013-10-10 08:06 - 2013-06-05 20:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2013-10-10 08:06 - 2013-06-05 20:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2013-10-10 07:32 - 2013-10-10 14:05 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2013-10-09 21:31 - 2013-10-10 06:19 - 00000000 ____D C:\Users\rsinger\Desktop\RK_Quarantine
    2013-10-08 19:04 - 2013-10-08 19:04 - 00016833 _____ C:\Users\rsinger\Desktop\dds.txt
    2013-10-08 19:04 - 2013-10-08 19:04 - 00012039 _____ C:\Users\rsinger\Desktop\attach.txt
    2013-10-08 19:02 - 2013-10-08 19:03 - 00688992 ____R (Swearware) C:\Users\rsinger\Downloads\dds.com
    2013-10-08 17:41 - 2013-10-10 20:25 - 00000000 ____D C:\Users\rsinger\Desktop\Jones Bay Co
    2013-10-08 17:41 - 2013-10-08 17:42 - 00000000 ____D C:\Users\rsinger\AppData\Local\FileTypeAssistant
    2013-10-08 17:01 - 2013-10-08 17:01 - 00000000 ____D C:\Users\rsinger\Documents\Jones Bay Co
    2013-10-08 16:16 - 2013-10-08 16:16 - 00000000 ____D C:\Program Files (x86)\ESET
    2013-10-08 16:15 - 2013-10-08 16:16 - 02347384 _____ (ESET) C:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    2013-10-08 15:03 - 2013-10-08 15:16 - 00139704 _____ (ESET) C:\Windows\system32\Drivers\efavdrv.sys
    2013-10-08 14:57 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-10-08 12:11 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2013-10-08 09:33 - 2013-10-08 15:02 - 00000000 ____D C:\Users\rsinger\Downloads\Jones Bay Co Tools
    2013-10-08 01:26 - 2013-10-08 01:26 - 00000000 ____D C:\Users\rsinger\AppData\Local\ESET
    2013-10-07 23:49 - 2013-10-08 15:03 - 00000000 ____D C:\ProgramData\ESET
    2013-10-07 23:49 - 2013-10-07 23:49 - 00000000 ____D C:\Program Files\ESET
    2013-10-07 21:44 - 2013-10-08 17:41 - 00080384 ___SH C:\Users\rsinger\Desktop\Thumbs.db
    2013-10-07 19:28 - 2013-10-07 22:54 - 00000000 ____D C:\Windows\pss
    2013-10-07 19:15 - 2013-10-08 01:55 - 00007620 _____ C:\Users\rsinger\AppData\Local\Resmon.ResmonCfg
    2013-09-24 16:14 - 2013-09-24 16:14 - 00000000 ____D C:\ProgramData\Oracle
    2013-09-24 16:13 - 2013-09-24 16:13 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00000000 ____D C:\Program Files (x86)\Java
    2013-09-16 20:47 - 2013-10-04 15:34 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2013-09-15 00:16 - 2013-09-19 00:16 - 00000064 _____ C:\Users\rsinger\AppData\Roaming\WB.CFG
    2013-09-11 22:53 - 2013-08-04 19:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
    2013-09-11 22:52 - 2013-08-01 19:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
    2013-09-11 22:52 - 2013-08-01 19:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
    2013-09-11 22:52 - 2013-08-01 19:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2013-09-11 22:52 - 2013-08-01 18:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
    2013-09-11 22:52 - 2013-08-01 17:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2013-09-11 22:52 - 2013-08-01 17:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2013-09-11 22:51 - 2013-07-25 19:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2013-09-11 22:51 - 2013-07-25 19:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
    2013-09-11 22:51 - 2013-07-25 18:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2013-09-11 22:51 - 2013-07-25 18:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
    2013-09-10 00:11 - 2013-09-19 19:02 - 00000002 _____ C:\END
    2013-09-10 00:11 - 2013-09-10 00:11 - 00000387 _____ C:\Users\rsinger\Desktop\FREE Games.url
     
  18. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    ==================== One Month Modified Files and Folders =======
    2013-10-10 20:26 - 2013-10-10 20:26 - 00000000 ____D C:\FRST
    2013-10-10 20:25 - 2013-10-08 17:41 - 00000000 ____D C:\Users\rsinger\Desktop\Jones Bay Co
    2013-10-10 20:24 - 2010-12-08 18:27 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2013-10-10 20:22 - 2009-07-13 22:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2013-10-10 20:22 - 2009-07-13 21:51 - 00021627 _____ C:\Windows\setupact.log
    2013-10-10 20:20 - 2013-10-10 20:25 - 01954124 _____ (Farbar) C:\Users\rsinger\Desktop\FRST64.exe
    2013-10-10 14:44 - 2009-07-13 22:10 - 01279921 _____ C:\Windows\WindowsUpdate.log
    2013-10-10 14:42 - 2010-12-08 18:27 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2013-10-10 14:38 - 2009-07-13 21:45 - 00019728 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2013-10-10 14:38 - 2009-07-13 21:45 - 00019728 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2013-10-10 14:14 - 2009-07-13 22:13 - 00726444 _____ C:\Windows\system32\PerfStringBackup.INI
    2013-10-10 14:05 - 2013-10-10 07:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2013-10-10 12:02 - 2013-05-21 16:15 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
    2013-10-10 09:37 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\rescache
    2013-10-10 08:45 - 2009-07-13 21:45 - 00426400 _____ C:\Windows\system32\FNTCACHE.DAT
    2013-10-10 08:34 - 2011-01-23 19:02 - 00000000 ____D C:\ProgramData\Microsoft Help
    2013-10-10 08:30 - 2013-03-14 03:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
    2013-10-10 08:30 - 2013-03-14 03:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2013-10-10 07:27 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\Registration
    2013-10-10 06:19 - 2013-10-09 21:31 - 00000000 ____D C:\Users\rsinger\Desktop\RK_Quarantine
    2013-10-09 21:18 - 2010-11-12 20:08 - 09150780 _____ C:\Windows\PFRO.log
    2013-10-08 19:48 - 2010-12-08 18:27 - 00000000 ____D C:\Users\rsinger\AppData\Local\Google
    2013-10-08 19:04 - 2013-10-08 19:04 - 00016833 _____ C:\Users\rsinger\Desktop\dds.txt
    2013-10-08 19:04 - 2013-10-08 19:04 - 00012039 _____ C:\Users\rsinger\Desktop\attach.txt
    2013-10-08 19:03 - 2013-10-08 19:02 - 00688992 ____R (Swearware) C:\Users\rsinger\Downloads\dds.com
    2013-10-08 17:42 - 2013-10-08 17:41 - 00000000 ____D C:\Users\rsinger\AppData\Local\FileTypeAssistant
    2013-10-08 17:41 - 2013-10-07 21:44 - 00080384 ___SH C:\Users\rsinger\Desktop\Thumbs.db
    2013-10-08 17:01 - 2013-10-08 17:01 - 00000000 ____D C:\Users\rsinger\Documents\Jones Bay Co
    2013-10-08 16:16 - 2013-10-08 16:16 - 00000000 ____D C:\Program Files (x86)\ESET
    2013-10-08 16:16 - 2013-10-08 16:15 - 02347384 _____ (ESET) C:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    2013-10-08 15:16 - 2013-10-08 15:03 - 00139704 _____ (ESET) C:\Windows\system32\Drivers\efavdrv.sys
    2013-10-08 15:03 - 2013-10-07 23:49 - 00000000 ____D C:\ProgramData\ESET
    2013-10-08 15:02 - 2013-10-08 09:33 - 00000000 ____D C:\Users\rsinger\Downloads\Jones Bay Co Tools
    2013-10-08 13:10 - 2011-03-02 17:15 - 00000000 ____D C:\Program Files (x86)\FunWebProducts
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-10-08 01:55 - 2013-10-07 19:15 - 00007620 _____ C:\Users\rsinger\AppData\Local\Resmon.ResmonCfg
    2013-10-08 01:26 - 2013-10-08 01:26 - 00000000 ____D C:\Users\rsinger\AppData\Local\ESET
    2013-10-07 23:49 - 2013-10-07 23:49 - 00000000 ____D C:\Program Files\ESET
    2013-10-07 22:54 - 2013-10-07 19:28 - 00000000 ____D C:\Windows\pss
    2013-10-07 21:44 - 2011-06-24 13:50 - 00000000 ____D C:\Users\rsinger\Desktop\M's Canyon 2011
    2013-10-07 21:15 - 2010-12-01 15:54 - 00000000 ___RD C:\Users\rsinger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    2013-10-07 20:19 - 2011-02-23 04:16 - 00004096 ___SH C:\VSNAP.IDX
    2013-10-07 18:37 - 2009-07-13 20:20 - 00000000 __RHD C:\Users\Public\Libraries
    2013-10-07 13:08 - 2012-05-06 16:16 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Clip Art Collection
    2013-10-04 15:38 - 2012-02-23 01:10 - 00000000 ____D C:\ProgramData\CanonIJPLM
    2013-10-04 15:34 - 2013-09-16 20:47 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2013-09-24 16:14 - 2013-09-24 16:14 - 00000000 ____D C:\ProgramData\Oracle
    2013-09-24 16:13 - 2013-09-24 16:13 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00000000 ____D C:\Program Files (x86)\Java
    2013-09-24 16:13 - 2010-11-12 18:15 - 00790440 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
    2013-09-22 19:38 - 2012-07-26 17:47 - 00000000 ____D C:\Users\rsinger\Documents\Quicken
    2013-09-22 16:28 - 2013-10-10 08:32 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2013-09-22 16:28 - 2013-10-10 08:32 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2013-09-22 15:54 - 2013-10-10 08:32 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2013-09-20 20:38 - 2013-10-10 08:32 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2013-09-20 20:30 - 2013-10-10 08:32 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2013-09-20 19:48 - 2013-10-10 08:32 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
    2013-09-20 19:39 - 2013-10-10 08:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2013-09-20 12:21 - 2013-05-21 16:14 - 00000000 ____D C:\Program Files\My Dell
    2013-09-20 12:21 - 2010-12-01 17:00 - 00000000 ____D C:\ProgramData\PCDr
    2013-09-19 19:02 - 2013-09-10 00:11 - 00000002 _____ C:\END
    2013-09-19 00:16 - 2013-09-15 00:16 - 00000064 _____ C:\Users\rsinger\AppData\Roaming\WB.CFG
    2013-09-16 20:47 - 2010-12-08 18:26 - 00000000 ____D C:\Program Files (x86)\Google
    2013-09-13 18:10 - 2013-10-10 08:07 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
    2013-09-12 10:57 - 2010-12-25 17:53 - 00000000 ___RD C:\Users\rsinger\Virtual Machines
    2013-09-12 10:57 - 2010-12-01 16:08 - 00000000 ___RD C:\Users\rsinger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    2013-09-12 03:10 - 2013-08-15 03:03 - 00000000 ____D C:\Windows\system32\MRT
    2013-09-12 03:07 - 2010-12-02 14:17 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2013-09-11 01:28 - 2012-07-27 12:36 - 00000000 ____D C:\Users\rsinger\Documents\Assetlevels
    2013-09-10 00:32 - 2010-12-08 18:28 - 00000000 ____D C:\Users\rsinger\AppData\Local\Adobe
    2013-09-10 00:11 - 2013-09-10 00:11 - 00000387 _____ C:\Users\rsinger\Desktop\FREE Games.url
    Alureon:
    C:\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll
    ==================== Bamital & volsnap Check =================
    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    LastRegBack: 2013-10-01 06:14
    ==================== End Of Log ============================
    Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-10-2013
    Ran by rsinger at 2013-10-10 20:27:58
    Running from C:\Users\rsinger\Desktop
    Boot Mode: Normal
    ==========================================================

    ==================== Security Center ========================
    AV: ESET NOD32 Antivirus 6.0 (Enabled - Up to date) {77DEAFED-8149-104B-25A1-21771CA47CD1}
    AS: ESET NOD32 Antivirus 6.0 (Enabled - Up to date) {CCBF4E09-A773-1FC5-1F11-1A056723366C}
    AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    ==================== Installed Programs ======================
    Adobe AIR (x32 Version: 2.5.1.17730)
    Adobe Flash Player 10 Plugin (x32 Version: 10.1.53.64)
    Adobe Flash Player 11 ActiveX 64-bit (Version: 11.1.102.62)
    Adobe Reader X (10.0.1) (x32 Version: 10.0.1)
    Adobe Shockwave Player 11.5 (x32 Version: 11.5.9.615)
    AnswerWorks 5.0 English Runtime (x32 Version: 5.0.7)
    Bing Bar (x32 Version: 7.0.850.0)
    Canon CanoScan LiDE 110 User Registration (x32)
    Canon iP4600 series Printer Driver
    Canon iP4700 series Printer Driver
    Canon MP Navigator EX 4.0 (x32)
    Canon Solution Menu EX (x32)
    Canon Utilities Easy-PhotoPrint EX (x32)
    Canon Utilities My Printer (x32)
    Canon Utilities Solution Menu (x32)
    CanoScan LiDE 110 Scanner Driver
    Clip Art Collection (x32 Version: 1.0.0.0)
    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32)
    Dell Dock (Version: 2.0)
    Dell Dock (x32)
    Dell Edoc Viewer (Version: 1.0.0)
    Dell Getting Started Guide (x32 Version: 1.00.0000)
    Driver Manager (x32 Version: 7)
    ESET NOD32 Antivirus (Version: 6.0.316.0)
    ESET Online Scanner v3 (x32)
    Eudora OSE (1.0) (x32 Version: 1.0 (en-US))
    File Type Assistant (x32)
    Google Chrome (x32 Version: 30.0.1599.69)
    Google Toolbar for Internet Explorer (x32 Version: 1.0.0)
    Google Toolbar for Internet Explorer (x32 Version: 7.5.4601.54)
    Google Update Helper (x32 Version: 1.3.21.153)
    GoToAssist 8.0.0.514 (x32)
    Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2104)
    Internet Explorer (x32 Version: 8)
    Java 7 Update 40 (x32 Version: 7.0.400)
    Java Auto Updater (x32 Version: 2.1.9.8)
    Junk Mail filter update (x32 Version: 14.0.8089.726)
    LiveUpdate 3.2 (Symantec Corporation) (x32 Version: 3.2.0.68)
    Malwarebytes Anti-Malware version 1.75.0.1300 (x32 Version: 1.75.0.1300)
    Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
    Microsoft Application Error Reporting (Version: 12.0.6015.5000)
    Microsoft Choice Guard (x32 Version: 2.0.48.0)
    Microsoft Office 2010 Service Pack 1 (SP1) (x32)
    Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Home and Student 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Office 64-bit Components 2010 (Version: 14.0.6029.1000)
    Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Proof (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Proof (French) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.6029.1000)
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.6029.1000)
    Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Single Image 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.6029.1000)
    Microsoft Silverlight (Version: 5.1.20913.0)
    Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
    Microsoft Sync Framework Runtime Native v1.0 (x86) (x32 Version: 1.0.1215.0)
    Microsoft Sync Framework Services Native v1.0 (x86) (x32 Version: 1.0.1215.0)
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
    Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
    MSVCRT (x32 Version: 14.0.1468.721)
    Multimedia Card Reader (x32 Version: 1.6.915.87)
    My Dell (Version: 3.4.6308.28)
    Quicken 2008 (x32 Version: 17.1.5.3)
    Realtek High Definition Audio Driver (x32 Version: 6.0.1.6043)
    Roxio Burn (x32 Version: 1.01)
    Shared C Run-time for x64 (Version: 10.0.0)
    Skype Click to Call (x32 Version: 5.6.8312)
    Skype™ 5.10 (x32 Version: 5.10.116)
    Symantec Backup Exec System Recovery 2010 (x32 Version: 9.0.2.37914)
    TurboTax 2010 (x32)
    TurboTax 2010 WinPerFedFormset (x32 Version: 010.000.4227)
    TurboTax 2010 WinPerReleaseEngine (x32 Version: 010.000.0483)
    TurboTax 2010 WinPerTaxSupport (x32 Version: 010.000.0214)
    TurboTax 2010 wrapper (x32 Version: 010.000.0157)
    TurboTax 2011 (x32)
    TurboTax 2011 WinPerFedFormset (x32 Version: 011.000.2999)
    TurboTax 2011 WinPerReleaseEngine (x32 Version: 011.000.0474)
    TurboTax 2011 WinPerTaxSupport (x32 Version: 011.000.0214)
    TurboTax 2011 wrapper (x32 Version: 011.000.0121)
    TurboTax 2012 (x32 Version: 2012.0)
    TurboTax 2012 WinPerFedFormset (x32 Version: 012.000.2114)
    TurboTax 2012 WinPerReleaseEngine (x32 Version: 012.000.0451)
    TurboTax 2012 WinPerTaxSupport (x32 Version: 012.000.0179)
    TurboTax 2012 wrapper (x32 Version: 012.000.0127)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1)
    Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3)
    Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32)
    Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2494150) (x32)
    Update for Microsoft Office 2010 (KB2553065) (x32)
    Update for Microsoft Office 2010 (KB2553181) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2553267) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2553310) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2566458) (x32)
    Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2596964) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2598242) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2687503) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2767886) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32)
    Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32)
    Update for Microsoft OneNote 2010 (KB2553290) 32-Bit Edition (x32)
    Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32)
    Update for Microsoft Outlook 2010 (KB2687623) 32-Bit Edition (x32)
    Update for Microsoft Outlook Social Connector 2010 (KB2553406) 32-Bit Edition (x32)
    Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32)
    Update for Microsoft SharePoint Workspace 2010 (KB2589371) 32-Bit Edition (x32)
    Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32)
    Update for Microsoft Word 2010 (KB2827323) 32-Bit Edition (x32)
    WildTangent Games (x32 Version: 1.0.0.71)
    Windows Live Call (x32 Version: 14.0.8064.0206)
    Windows Live Communications Platform (x32 Version: 14.0.8064.206)
    Windows Live Essentials (x32 Version: 14.0.8089.0726)
    Windows Live Essentials (x32 Version: 14.0.8089.726)
    Windows Live Mail (x32 Version: 14.0.8089.0726)
    Windows Live Messenger (x32 Version: 14.0.8089.0726)
    Windows Live Movie Maker (x32 Version: 14.0.8091.0730)
    Windows Live Photo Gallery (x32 Version: 14.0.8081.709)
    Windows Live Sign-in Assistant (x32 Version: 5.000.818.5)
    Windows Live Sync (x32 Version: 14.0.8089.726)
    Windows Live Upload Tool (x32 Version: 14.0.8014.1029)
    Windows Live Writer (x32 Version: 14.0.8089.0726)
    Windows XP Mode (Version: 1.3.7600.16432)
    Yahoo! Detect (x32)
    Yahoo! Software Update (x32)
    Yahoo! Toolbar (x32)
    ==================== Restore Points =========================
    08-10-2013 03:17:04 Windows Update
    08-10-2013 04:13:17 Removed Java(TM) 6 Update 20 (64-bit)
    08-10-2013 06:47:14 Installed ESET NOD32 Antivirus
    10-10-2013 14:20:04 After RogueKiller and before MBAR
    10-10-2013 14:45:16 Malwarebytes Anti-Rootkit Restore Point
    10-10-2013 15:22:26 Windows Update
    10-10-2013 21:04:03 Malwarebytes Anti-Rootkit Restore Point
    ==================== Hosts content: ==========================
    2009-07-13 19:34 - 2009-06-10 14:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
    ==================== Scheduled Tasks (whitelisted) =============
    Task: {33432569-D4B3-4F73-82CB-B18BF91A875D} - System32\Tasks\ProgramUpdateCheck => C:\Program Files (x86)\File Type Assistant\TSAssist.exe [2012-02-28] (Trusted Software ApS)
    Task: {70DF0BF1-CFA0-4824-8BCF-4B383665256E} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-09-05] (PC-Doctor, Inc.)
    Task: {9D760034-4854-47F2-A761-E5A6F40E280E} - System32\Tasks\{F5631B09-2B24-44D8-9E33-862B13859DB1} => Iexplore.exe http://ui.skype.com/ui/0/5.8.0.158/en/abandoninstall?source=lightinstaller&amp;page=tsProgressBar
    Task: {A2B39D75-6421-4379-940F-82850F033B6C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-08] (Google Inc.)
    Task: {C33C4A7B-5211-4202-A69C-4B369986B1C8} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
    Task: {D044054F-4567-4C2E-9A68-6DDDE967384B} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-09-05] (PC-Doctor, Inc.)
    Task: {F4EE27D1-1446-4B20-8B55-41C380EDB7D1} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2010-12-08] (Google Inc.)
    Task: {FD070DF2-79C2-4542-B118-E0FE04CEE43A} - System32\Tasks\SystemToolsDailyTest => C:\Windows\System32\uaclauncher.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
    ==================== Loaded Modules (whitelisted) =============

    ==================== Alternate Data Streams (whitelisted) =========

    ==================== Safe Mode (whitelisted) ===================
    HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist => ""="Service"
    ==================== Faulty Device Manager Devices =============

    ==================== Event log errors: =========================
    Application errors:
    ==================
    Error: (10/10/2013 07:18:08 AM) (Source: SideBySide) (User: )
    Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
    A component version required by the application conflicts with another component version already active.
    Conflicting components are:.
    Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
    Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
    Error: (10/10/2013 07:16:57 AM) (Source: SideBySide) (User: )
    Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
    Multiple requestedPrivileges elements are not allowed in manifest.
    Error: (10/08/2013 05:44:10 PM) (Source: SideBySide) (User: )
    Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
    A component version required by the application conflicts with another component version already active.
    Conflicting components are:.
    Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
    Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
    Error: (10/08/2013 04:16:33 PM) (Source: SideBySide) (User: )
    Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
    A component version required by the application conflicts with another component version already active.
    Conflicting components are:.
    Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
    Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
    Error: (10/08/2013 04:16:28 PM) (Source: SideBySide) (User: )
    Description: Activation context generation failed for "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest1".Error in manifest or policy file "C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest2" on line C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest3.
    A component version required by the application conflicts with another component version already active.
    Conflicting components are:.
    Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
    Component 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
    Error: (10/08/2013 11:19:21 AM) (Source: SideBySide) (User: )
    Description: Activation context generation failed for "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"1".Error in manifest or policy file "WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"2" on line WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"3.
    Component identity found in manifest does not match the identity of the component requested.
    Reference is WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1".
    Definition is WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1".
    Please use sxstrace.exe for detailed diagnosis.
    Error: (10/08/2013 11:18:30 AM) (Source: SideBySide) (User: )
    Description: Activation context generation failed for "1".Error in manifest or policy file "2" on line 3.
    Multiple requestedPrivileges elements are not allowed in manifest.
    Error: (10/08/2013 10:55:57 AM) (Source: ESENT) (User: )
    Description: wuaueng.dll (1012) SUS20ClientDataStore: The version store for this instance (0) has reached its maximum size of 32Mb. It is likely that a long-running transaction is preventing cleanup of the version store and causing it to build up in size. Updates will be rejected until the long-running transaction has been completely committed or rolled back.
    Possible long-running transaction:
    SessionId: 0x00000000018204A0
    Session-context: 0x00000000
    Session-context ThreadId: 0x0000000000000D5C
    Cleanup: 1
    Error: (10/08/2013 01:37:39 AM) (Source: Application Error) (User: )
    Description: Faulting application name: dllhost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bca54
    Faulting module name: unknown, version: 0.0.0.0, time stamp: 0x00000000
    Exception code: 0xc0000005
    Fault offset: 0x0000000001d3269b
    Faulting process id: 0x101c
    Faulting application start time: 0xdllhost.exe0
    Faulting application path: dllhost.exe1
    Faulting module path: dllhost.exe2
    Report Id: dllhost.exe3
    Error: (10/08/2013 01:00:44 AM) (Source: Backup Exec System Recovery) (User: )
    Description: Error EC8F17B7: Cannot create recovery points for job: My Computer Backup.
    Error EC8F03FE: Cannot read the properties of the job.
    Error EC8F1F62: Cannot find external device 'RAS500G1'.
    Error EBAB03F1: The system cannot find the path specified. (UMI:V-281-3215-6071)

    Details:
    Source: Backup Exec System Recovery

    System errors:
    =============
    Error: (10/10/2013 08:22:25 PM) (Source: VDS Basic Provider) (User: )
    Description: Unexpected failure. Error code: D@01010004
    Error: (10/10/2013 08:22:24 PM) (Source: VDS Basic Provider) (User: )
    Description: Unexpected failure. Error code: D@01010004
    Error: (10/10/2013 02:34:55 PM) (Source: mbamchameleon) (User: )
    Description: \Device\HarddiskVolume3\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    Error: (10/10/2013 02:34:55 PM) (Source: mbamchameleon) (User: )
    Description: \Device\HarddiskVolume3\PROGRAM FILES\ESET\ESET NOD32 ANTIVIRUS\X86\EKRN.EXE
    Error: (10/10/2013 00:03:27 PM) (Source: mbamchameleon) (User: )
    Description: C01C0005
    Error: (10/10/2013 00:03:12 PM) (Source: mbamchameleon) (User: )
    Description: C01C0005
    Error: (10/10/2013 00:02:59 PM) (Source: mbamchameleon) (User: )
    Description: C01C0005
    Error: (10/10/2013 09:57:03 AM) (Source: mbamchameleon) (User: )
    Description: C000000D
    Error: (10/10/2013 09:57:03 AM) (Source: mbamchameleon) (User: )
    Description: C000000D
    Error: (10/10/2013 09:57:02 AM) (Source: mbamchameleon) (User: )
    Description: C000000D

    Microsoft Office Sessions:
    =========================
    Error: (10/10/2013 07:18:08 AM) (Source: SideBySide)(User: )
    Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestc:\program files (x86)\ESET\eset online scanner\ESETSmartInstaller.exe
    Error: (10/10/2013 07:16:57 AM) (Source: SideBySide)(User: )
    Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
    Error: (10/08/2013 05:44:10 PM) (Source: SideBySide)(User: )
    Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    Error: (10/08/2013 04:16:33 PM) (Source: SideBySide)(User: )
    Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    Error: (10/08/2013 04:16:28 PM) (Source: SideBySide)(User: )
    Description: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifestC:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifestC:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    Error: (10/08/2013 11:19:21 AM) (Source: SideBySide)(User: )
    Description: WLMFDS,processorArchitecture="AMD64",type="win32",version="1.0.0.1"WLMFDS,processorArchitecture="x86",type="win32",version="1.0.0.1"c:\program files (x86)\windows live\photo gallery\MovieMaker.Exec:\program files (x86)\windows live\photo gallery\WLMFDS.DLL8
    Error: (10/08/2013 11:18:30 AM) (Source: SideBySide)(User: )
    Description: C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exeC:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe2
    Error: (10/08/2013 10:55:57 AM) (Source: ESENT)(User: )
    Description: wuaueng.dll1012SUS20ClientDataStore: 0320x00000000018204A00x000000000x0000000000000D5C1
    Error: (10/08/2013 01:37:39 AM) (Source: Application Error)(User: )
    Description: dllhost.exe6.1.7600.163854a5bca54unknown0.0.0.000000000c00000050000000001d3269b101c01cec40196cd4cf5C:\Windows\system32\dllhost.exeunknowne38438df-2ff4-11e3-9897-842b2bb027cc
    Error: (10/08/2013 01:00:44 AM) (Source: Backup Exec System Recovery)(User: )
    Description: Error EC8F17B7: Cannot create recovery points for job: My Computer Backup.
    Error EC8F03FE: Cannot read the properties of the job.
    Error EC8F1F62: Cannot find external device 'RAS500G1'.
    Error EBAB03F1: The system cannot find the path specified. (UMI:V-281-3215-6071)

    Details:
    Source: Backup Exec System Recovery

    ==================== Memory info ===========================
    Percentage of memory in use: 36%
    Total physical RAM: 3895.12 MB
    Available physical RAM: 2482.98 MB
    Total Pagefile: 7788.41 MB
    Available Pagefile: 6270.68 MB
    Total Virtual: 8192 MB
    Available Virtual: 8191.81 MB
    ==================== Drives ================================
    Drive c: (OS) (Fixed) (Total:687.15 GB) (Free:597.82 GB) NTFS
    Drive e: (USB DISK) (Removable) (Total:3.82 GB) (Free:3.07 GB) FAT32
    ==================== MBR & Partition Table ==================
    ========================================================
    Disk: 0 (Size: 699 GB) (Disk ID: 259D4594)
    Partition 1: (Not Active) - (Size=39 MB) - (Type=DE)
    Partition 2: (Active) - (Size=11 GB) - (Type=07 NTFS)
    Partition 3: (Not Active) - (Size=687 GB) - (Type=07 NTFS)
    ========================================================
    Disk: 5 (Size: 4 GB) (Disk ID: 00000000)
    Partition 1: (Not Active) - (Size=4 GB) - (Type=0B)
    ==================== End Of Log ============================
    Please note that even though Additional.txt reports that eset NOD32 Antivirus is enabled and up-to-date, in fact I have been unable to update the virus signature database on the affected computer and its database is dated March 2013 (I think), at least it is quite old. I can download the update file but the update ends with an unspecified error.
     
  19. Broni

    Broni Malware Annihilator Posts: 46,868   +254

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST/FRST64 and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

    Re-run FRST one more time and post new log.
     

    Attached Files:

  20. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013
    Ran by rsinger at 2013-10-10 21:36:09 Run:1
    Running from C:\Users\rsinger\Desktop
    Boot Mode: Normal
    ==============================================
    Content of fixlist:
    *****************
    HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll ATTENTION! ====> ZeroAccess?
    C:\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll
    C:\Users\rsinger\AppData\Local\Temp\soxymxr
    *****************
    HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} => Key deleted successfully. If the key returned, move the associated file, reboot and list the key for deletion.
    C:\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll => Moved successfully.
    C:\Users\rsinger\AppData\Local\Temp\soxymxr => Moved successfully.
    ==== End of Fixlog ====
     
  21. Broni

    Broni Malware Annihilator Posts: 46,868   +254

     
  22. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
    Ran by rsinger (administrator) on RSINGER-PC on 10-10-2013 21:41:28
    Running from C:\Users\rsinger\Desktop
    Windows 7 Professional Service Pack 1 (X64) OS Language: English(US)
    Internet Explorer Version 10
    Boot Mode: Normal
    ==================== Processes (Whitelisted) =================
    (Symantec Corporation) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    (Symantec) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    (Symantec Corporation) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe
    () C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
    ==================== Registry (Whitelisted) ==================
    HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060832 2010-02-08] (Realtek Semiconductor)
    HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [6330568 2013-03-21] (ESET)
    HKLM-x32\...\Runonce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [x]
    Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKLM\...\Policies\Explorer: [NoControlPanel] 0
    HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-08] (Google Inc.)
    HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll ATTENTION! ====> ZeroAccess?
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2011-01-30] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-10] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Symantec Backup Exec System Recovery 2010] - C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe [2599784 2010-09-14] (Symantec Corporation)
    HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-12-15] ()
    Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    ==================== Internet (Whitelisted) ====================
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=1
    HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM-x32 - DefaultScope {575721B7-914D-44DC-9300-00022BE8B753} URL =
    SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 - {575721B7-914D-44DC-9300-00022BE8B753 URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM-x32 - {751C5749-E1BE-333C-9EFD-165567F7F20C} URL =
    SearchScopes: HKCU - DefaultScope {575721B7-914D-44DC-9300-00022BE8B753} URL = http://search.conduit.com/ResultsEx...4&ctid=CT3299872&CUI=UN42554263349168884&UM=2
    SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searc...SP_ss&mntrId=4e217da6000000000000842b2bb027cc
    SearchScopes: HKCU - {5482F9A9-F44B-45F2-9852-F37719DFBA8A} URL =
    SearchScopes: HKCU - {575721B7-914D-44DC-9300-00022BE8B753 URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKCU - {575721B7-914D-44DC-9300-00022BE8B753} URL = http://search.conduit.com/ResultsEx...4&ctid=CT3299872&CUI=UN42554263349168884&UM=2
    SearchScopes: HKCU - {68893FA0-A909-33C3-7C51-6656545E3C51} URL =
    SearchScopes: HKCU - {E58E0C07-470F-4C08-8079-3382D927C525} URL = http://search.yahoo.com/search?p={s...e=W3i_DS,136,0_0,Search,20120417,17118,0,18,0
    BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
    BHO-x32: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
    BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
    BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
    Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
    Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
    Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
    Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{CCBF9E61-3B52-4C69-AE7B-2D83B07E3977}: [NameServer]64.119.0.4,8.8.8.8
    Chrome:
    =======
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll ()
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\pdf.dll ()
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
    CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
    CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
    CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
    CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
    CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File
    CHR Extension: (Google Docs) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
    CHR Extension: (Google Drive) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
    CHR Extension: (YouTube) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
    CHR Extension: (Google Search) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
    CHR Extension: (Chrome In-App Payments service) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
    CHR Extension: (Gmail) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
    ==================== Services (Whitelisted) =================
    R2 Backup Exec System Recovery; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe [4596064 2010-09-14] (Symantec Corporation)
    R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1341664 2013-03-21] (ESET)
    S3 GenericMount Helper Service; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-12] (Symantec)
    S3 LiveUpdate; C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE [2999664 2007-09-12] (Symantec Corporation)
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
    S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)
    R3 SymSnapService; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe [2965496 2010-09-06] (Symantec)
    ==================== Drivers (Whitelisted) ====================
    S3 AE1000; C:\Windows\System32\DRIVERS\ae1000w7.sys [1101600 2010-03-22] (Ralink Technology Corp.)
    R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-20] (ESET)
    S3 efavdrv; C:\Windows\system32\drivers\efavdrv.sys [139704 2013-10-08] (ESET)
    R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
    R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [139768 2013-01-10] (ESET)
    R3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
    S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
    R0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170544 2010-09-06] (StorageCraft)
    S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
    S3 esihdrv; \??\C:\Users\rsinger\AppData\Local\Temp\esihdrv.sys [x]
    U2 V2iMount;
    ==================== NetSvcs (Whitelisted) ===================

    ==================== One Month Created Files and Folders ========
    2013-10-10 21:32 - 2013-10-10 20:28 - 00023462 _____ C:\Users\rsinger\Desktop\Addition.txt
    2013-10-10 20:26 - 2013-10-10 20:26 - 00000000 ____D C:\FRST
    2013-10-10 20:25 - 2013-10-10 20:20 - 01954124 _____ (Farbar) C:\Users\rsinger\Desktop\FRST64.exe
    2013-10-10 08:32 - 2013-09-22 16:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2013-10-10 08:32 - 2013-09-22 16:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2013-10-10 08:32 - 2013-09-22 15:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2013-10-10 08:32 - 2013-09-20 20:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2013-10-10 08:32 - 2013-09-20 20:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2013-10-10 08:32 - 2013-09-20 19:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
    2013-10-10 08:32 - 2013-09-20 19:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2013-10-10 08:08 - 2013-07-12 03:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
    2013-10-10 08:08 - 2013-07-12 03:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
    2013-10-10 08:08 - 2013-07-02 21:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
    2013-10-10 08:08 - 2013-07-02 21:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
    2013-10-10 08:08 - 2013-07-02 21:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
    2013-10-10 08:08 - 2013-06-25 15:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
    2013-10-10 08:07 - 2013-09-13 18:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
    2013-10-10 08:07 - 2013-09-07 19:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
    2013-10-10 08:07 - 2013-09-07 19:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
    2013-10-10 08:07 - 2013-09-07 19:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
    2013-10-10 08:07 - 2013-07-04 05:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
    2013-10-10 08:07 - 2013-07-04 05:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
    2013-10-10 08:07 - 2013-07-04 04:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
    2013-10-10 08:07 - 2013-07-04 04:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
    2013-10-10 08:07 - 2013-07-04 03:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
    2013-10-10 08:06 - 2013-09-04 05:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
    2013-10-10 08:06 - 2013-08-28 19:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2013-10-10 08:06 - 2013-08-28 19:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2013-10-10 08:06 - 2013-08-28 19:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
    2013-10-10 08:06 - 2013-08-28 19:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2013-10-10 08:06 - 2013-08-28 19:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
    2013-10-10 08:06 - 2013-08-28 18:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2013-10-10 08:06 - 2013-08-28 18:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2013-10-10 08:06 - 2013-08-28 18:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2013-10-10 08:06 - 2013-08-28 18:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
    2013-10-10 08:06 - 2013-08-28 18:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2013-10-10 08:06 - 2013-08-28 18:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
    2013-10-10 08:06 - 2013-08-28 17:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2013-10-10 08:06 - 2013-08-28 17:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2013-10-10 08:06 - 2013-08-28 17:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2013-10-10 08:06 - 2013-08-28 17:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2013-10-10 08:06 - 2013-08-27 18:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2013-10-10 08:06 - 2013-08-27 18:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
    2013-10-10 08:06 - 2013-08-01 05:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
    2013-10-10 08:06 - 2013-07-20 03:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
    2013-10-10 08:06 - 2013-07-20 03:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
    2013-10-10 08:06 - 2013-07-04 05:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
    2013-10-10 08:06 - 2013-07-04 04:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
    2013-10-10 08:06 - 2013-06-05 22:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
    2013-10-10 08:06 - 2013-06-05 22:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2013-10-10 08:06 - 2013-06-05 22:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
    2013-10-10 08:06 - 2013-06-05 22:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
    2013-10-10 08:06 - 2013-06-05 21:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
    2013-10-10 08:06 - 2013-06-05 21:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2013-10-10 08:06 - 2013-06-05 21:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
    2013-10-10 08:06 - 2013-06-05 20:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2013-10-10 08:06 - 2013-06-05 20:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2013-10-10 08:06 - 2013-06-05 20:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2013-10-10 07:32 - 2013-10-10 14:05 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2013-10-09 21:31 - 2013-10-10 06:19 - 00000000 ____D C:\Users\rsinger\Desktop\RK_Quarantine
    2013-10-08 19:04 - 2013-10-08 19:04 - 00016833 _____ C:\Users\rsinger\Desktop\dds.txt
    2013-10-08 19:04 - 2013-10-08 19:04 - 00012039 _____ C:\Users\rsinger\Desktop\attach.txt
    2013-10-08 19:02 - 2013-10-08 19:03 - 00688992 ____R (Swearware) C:\Users\rsinger\Downloads\dds.com
    2013-10-08 17:41 - 2013-10-10 21:32 - 00000000 ____D C:\Users\rsinger\Desktop\Jones Bay Co
    2013-10-08 17:41 - 2013-10-08 17:42 - 00000000 ____D C:\Users\rsinger\AppData\Local\FileTypeAssistant
    2013-10-08 17:01 - 2013-10-08 17:01 - 00000000 ____D C:\Users\rsinger\Documents\Jones Bay Co
    2013-10-08 16:16 - 2013-10-08 16:16 - 00000000 ____D C:\Program Files (x86)\ESET
    2013-10-08 16:15 - 2013-10-08 16:16 - 02347384 _____ (ESET) C:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    2013-10-08 15:03 - 2013-10-08 15:16 - 00139704 _____ (ESET) C:\Windows\system32\Drivers\efavdrv.sys
    2013-10-08 14:57 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-10-08 12:11 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2013-10-08 09:33 - 2013-10-08 15:02 - 00000000 ____D C:\Users\rsinger\Downloads\Jones Bay Co Tools
    2013-10-08 01:26 - 2013-10-08 01:26 - 00000000 ____D C:\Users\rsinger\AppData\Local\ESET
    2013-10-07 23:49 - 2013-10-08 15:03 - 00000000 ____D C:\ProgramData\ESET
    2013-10-07 23:49 - 2013-10-07 23:49 - 00000000 ____D C:\Program Files\ESET
    2013-10-07 21:44 - 2013-10-08 17:41 - 00080384 ___SH C:\Users\rsinger\Desktop\Thumbs.db
    2013-10-07 19:28 - 2013-10-07 22:54 - 00000000 ____D C:\Windows\pss
    2013-10-07 19:15 - 2013-10-08 01:55 - 00007620 _____ C:\Users\rsinger\AppData\Local\Resmon.ResmonCfg
    2013-09-24 16:14 - 2013-09-24 16:14 - 00000000 ____D C:\ProgramData\Oracle
    2013-09-24 16:13 - 2013-09-24 16:13 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00000000 ____D C:\Program Files (x86)\Java
    2013-09-16 20:47 - 2013-10-04 15:34 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2013-09-15 00:16 - 2013-09-19 00:16 - 00000064 _____ C:\Users\rsinger\AppData\Roaming\WB.CFG
    2013-09-11 22:53 - 2013-08-04 19:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
    2013-09-11 22:52 - 2013-08-01 19:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
    2013-09-11 22:52 - 2013-08-01 19:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
    2013-09-11 22:52 - 2013-08-01 19:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2013-09-11 22:52 - 2013-08-01 18:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
    2013-09-11 22:52 - 2013-08-01 17:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2013-09-11 22:52 - 2013-08-01 17:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2013-09-11 22:51 - 2013-07-25 19:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2013-09-11 22:51 - 2013-07-25 19:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
    2013-09-11 22:51 - 2013-07-25 18:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2013-09-11 22:51 - 2013-07-25 18:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
    2013-09-10 00:11 - 2013-09-19 19:02 - 00000002 _____ C:\END
    2013-09-10 00:11 - 2013-09-10 00:11 - 00000387 _____ C:\Users\rsinger\Desktop\FREE Games.url
    ==================== One Month Modified Files and Folders =======
    2013-10-10 21:32 - 2013-10-08 17:41 - 00000000 ____D C:\Users\rsinger\Desktop\Jones Bay Co
    2013-10-10 20:42 - 2010-12-08 18:27 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2013-10-10 20:29 - 2009-07-13 21:45 - 00019728 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2013-10-10 20:29 - 2009-07-13 21:45 - 00019728 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2013-10-10 20:28 - 2013-10-10 21:32 - 00023462 _____ C:\Users\rsinger\Desktop\Addition.txt
    2013-10-10 20:26 - 2013-10-10 20:26 - 00000000 ____D C:\FRST
    2013-10-10 20:24 - 2010-12-08 18:27 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2013-10-10 20:22 - 2009-07-13 22:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2013-10-10 20:22 - 2009-07-13 21:51 - 00021627 _____ C:\Windows\setupact.log
    2013-10-10 20:20 - 2013-10-10 20:25 - 01954124 _____ (Farbar) C:\Users\rsinger\Desktop\FRST64.exe
    2013-10-10 14:44 - 2009-07-13 22:10 - 01280016 _____ C:\Windows\WindowsUpdate.log
    2013-10-10 14:14 - 2009-07-13 22:13 - 00726444 _____ C:\Windows\system32\PerfStringBackup.INI
    2013-10-10 14:05 - 2013-10-10 07:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2013-10-10 12:02 - 2013-05-21 16:15 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
    2013-10-10 09:37 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\rescache
    2013-10-10 08:45 - 2009-07-13 21:45 - 00426400 _____ C:\Windows\system32\FNTCACHE.DAT
    2013-10-10 08:34 - 2011-01-23 19:02 - 00000000 ____D C:\ProgramData\Microsoft Help
    2013-10-10 08:30 - 2013-03-14 03:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
    2013-10-10 08:30 - 2013-03-14 03:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2013-10-10 07:27 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\Registration
    2013-10-10 06:19 - 2013-10-09 21:31 - 00000000 ____D C:\Users\rsinger\Desktop\RK_Quarantine
    2013-10-09 21:18 - 2010-11-12 20:08 - 09150780 _____ C:\Windows\PFRO.log
    2013-10-08 19:48 - 2010-12-08 18:27 - 00000000 ____D C:\Users\rsinger\AppData\Local\Google
    2013-10-08 19:04 - 2013-10-08 19:04 - 00016833 _____ C:\Users\rsinger\Desktop\dds.txt
    2013-10-08 19:04 - 2013-10-08 19:04 - 00012039 _____ C:\Users\rsinger\Desktop\attach.txt
    2013-10-08 19:03 - 2013-10-08 19:02 - 00688992 ____R (Swearware) C:\Users\rsinger\Downloads\dds.com
    2013-10-08 17:42 - 2013-10-08 17:41 - 00000000 ____D C:\Users\rsinger\AppData\Local\FileTypeAssistant
    2013-10-08 17:41 - 2013-10-07 21:44 - 00080384 ___SH C:\Users\rsinger\Desktop\Thumbs.db
    2013-10-08 17:01 - 2013-10-08 17:01 - 00000000 ____D C:\Users\rsinger\Documents\Jones Bay Co
    2013-10-08 16:16 - 2013-10-08 16:16 - 00000000 ____D C:\Program Files (x86)\ESET
    2013-10-08 16:16 - 2013-10-08 16:15 - 02347384 _____ (ESET) C:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    2013-10-08 15:16 - 2013-10-08 15:03 - 00139704 _____ (ESET) C:\Windows\system32\Drivers\efavdrv.sys
    2013-10-08 15:03 - 2013-10-07 23:49 - 00000000 ____D C:\ProgramData\ESET
    2013-10-08 15:02 - 2013-10-08 09:33 - 00000000 ____D C:\Users\rsinger\Downloads\Jones Bay Co Tools
    2013-10-08 13:10 - 2011-03-02 17:15 - 00000000 ____D C:\Program Files (x86)\FunWebProducts
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-10-08 01:55 - 2013-10-07 19:15 - 00007620 _____ C:\Users\rsinger\AppData\Local\Resmon.ResmonCfg
    2013-10-08 01:26 - 2013-10-08 01:26 - 00000000 ____D C:\Users\rsinger\AppData\Local\ESET
    2013-10-07 23:49 - 2013-10-07 23:49 - 00000000 ____D C:\Program Files\ESET
    2013-10-07 22:54 - 2013-10-07 19:28 - 00000000 ____D C:\Windows\pss
    2013-10-07 21:44 - 2011-06-24 13:50 - 00000000 ____D C:\Users\rsinger\Desktop\M's Canyon 2011
    2013-10-07 21:15 - 2010-12-01 15:54 - 00000000 ___RD C:\Users\rsinger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    2013-10-07 20:19 - 2011-02-23 04:16 - 00004096 ___SH C:\VSNAP.IDX
    2013-10-07 18:37 - 2009-07-13 20:20 - 00000000 __RHD C:\Users\Public\Libraries
    2013-10-07 13:08 - 2012-05-06 16:16 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Clip Art Collection
    2013-10-04 15:38 - 2012-02-23 01:10 - 00000000 ____D C:\ProgramData\CanonIJPLM
    2013-10-04 15:34 - 2013-09-16 20:47 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2013-09-24 16:14 - 2013-09-24 16:14 - 00000000 ____D C:\ProgramData\Oracle
    2013-09-24 16:13 - 2013-09-24 16:13 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00000000 ____D C:\Program Files (x86)\Java
    2013-09-24 16:13 - 2010-11-12 18:15 - 00790440 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
    2013-09-22 19:38 - 2012-07-26 17:47 - 00000000 ____D C:\Users\rsinger\Documents\Quicken
    2013-09-22 16:28 - 2013-10-10 08:32 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2013-09-22 16:28 - 2013-10-10 08:32 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2013-09-22 15:54 - 2013-10-10 08:32 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2013-09-20 20:38 - 2013-10-10 08:32 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2013-09-20 20:30 - 2013-10-10 08:32 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2013-09-20 19:48 - 2013-10-10 08:32 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
    2013-09-20 19:39 - 2013-10-10 08:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2013-09-20 12:21 - 2013-05-21 16:14 - 00000000 ____D C:\Program Files\My Dell
    2013-09-20 12:21 - 2010-12-01 17:00 - 00000000 ____D C:\ProgramData\PCDr
    2013-09-19 19:02 - 2013-09-10 00:11 - 00000002 _____ C:\END
    2013-09-19 00:16 - 2013-09-15 00:16 - 00000064 _____ C:\Users\rsinger\AppData\Roaming\WB.CFG
    2013-09-16 20:47 - 2010-12-08 18:26 - 00000000 ____D C:\Program Files (x86)\Google
    2013-09-13 18:10 - 2013-10-10 08:07 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
    2013-09-12 10:57 - 2010-12-25 17:53 - 00000000 ___RD C:\Users\rsinger\Virtual Machines
    2013-09-12 10:57 - 2010-12-01 16:08 - 00000000 ___RD C:\Users\rsinger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    2013-09-12 03:10 - 2013-08-15 03:03 - 00000000 ____D C:\Windows\system32\MRT
    2013-09-12 03:07 - 2010-12-02 14:17 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2013-09-11 01:28 - 2012-07-27 12:36 - 00000000 ____D C:\Users\rsinger\Documents\Assetlevels
    2013-09-10 00:32 - 2010-12-08 18:28 - 00000000 ____D C:\Users\rsinger\AppData\Local\Adobe
    2013-09-10 00:11 - 2013-09-10 00:11 - 00000387 _____ C:\Users\rsinger\Desktop\FREE Games.url
    ==================== Bamital & volsnap Check =================
    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    LastRegBack: 2013-10-01 06:14
    ==================== End Of Log ============================
     
  23. Broni

    Broni Malware Annihilator Posts: 46,868   +254

    This is my last post for tonight...

    Delete your existing "fixlist.txt" file.

    Download attached fixlist.txt file and save it to the Desktop.
    NOTE. It's important that both files, FRST and fixlist.txt are in the same location or the fix will not work.

    NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

    Run FRST/FRST64 and press the Fix button just once and wait.
    The tool will make a log on the Desktop (Fixlog.txt). Please post it to your reply.

    Re-run FRST one more time and post new log.
     

    Attached Files:

  24. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 02-10-2013
    Ran by rsinger at 2013-10-10 21:56:31 Run:2
    Running from C:\Users\rsinger\Desktop
    Boot Mode: Normal
    ==============================================
    Content of fixlist:
    *****************
    HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll ATTENTION! ====> ZeroAccess?
    C:\Users\rsinger\AppData\Local\Temp\soxymxr
    *****************
    HKCU\Software\Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} => Key deleted successfully. If the key returned, move the associated file, reboot and list the key for deletion.
    "C:\Users\rsinger\AppData\Local\Temp\soxymxr" => File/Directory not found.
    ==== End of Fixlog ====
     
  25. William Clemens

    William Clemens TS Rookie Topic Starter Posts: 65

    Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-10-2013
    Ran by rsinger (administrator) on RSINGER-PC on 10-10-2013 22:05:05
    Running from C:\Users\rsinger\Desktop
    Windows 7 Professional Service Pack 1 (X64) OS Language: English(US)
    Internet Explorer Version 10
    Boot Mode: Normal
    ==================== Processes (Whitelisted) =================
    (Symantec Corporation) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe
    (Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
    (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
    (Symantec) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe
    (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
    (ESET) C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
    (Symantec Corporation) C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe
    () C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe
    ==================== Registry (Whitelisted) ==================
    HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10060832 2010-02-08] (Realtek Semiconductor)
    HKLM\...\Run: [egui] - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe [6330568 2013-03-21] (ESET)
    HKLM-x32\...\Runonce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [x]
    Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
    Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
    HKLM\...\Policies\Explorer: [NoControlPanel] 0
    HKCU\...\Run: [swg] - C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2010-12-08] (Google Inc.)
    HKCU\...409d6c4515e9\InprocServer32: [Default-shell32] \\?\globalroot\Device\HarddiskVolume3\Users\rsinger\AppData\Local\Temp\soxymxr\swrhber\wow.dll ATTENTION! ====> ZeroAccess?
    HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [35736 2011-01-30] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [932288 2010-11-10] (Adobe Systems Incorporated)
    HKLM-x32\...\Run: [Symantec Backup Exec System Recovery 2010] - C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProTray.exe [2599784 2010-09-14] (Symantec Corporation)
    HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe [498160 2009-12-15] ()
    Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk
    ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
    ==================== Internet (Whitelisted) ====================
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=1
    HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
    HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://start.mysearchdial.com/?f=1&...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM - DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM - {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM-x32 - DefaultScope {575721B7-914D-44DC-9300-00022BE8B753} URL =
    SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
    SearchScopes: HKLM-x32 - {575721B7-914D-44DC-9300-00022BE8B753 URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKLM-x32 - {751C5749-E1BE-333C-9EFD-165567F7F20C} URL =
    SearchScopes: HKCU - DefaultScope {575721B7-914D-44DC-9300-00022BE8B753} URL = http://search.conduit.com/ResultsEx...4&ctid=CT3299872&CUI=UN42554263349168884&UM=2
    SearchScopes: HKCU - {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = http://search.babylon.com/?q={searc...SP_ss&mntrId=4e217da6000000000000842b2bb027cc
    SearchScopes: HKCU - {5482F9A9-F44B-45F2-9852-F37719DFBA8A} URL =
    SearchScopes: HKCU - {575721B7-914D-44DC-9300-00022BE8B753 URL = http://start.mysearchdial.com/resul...CtDyBtDtN1L1Czu1L1C1H1B1QzzyE&cr=319078563&ir=
    SearchScopes: HKCU - {575721B7-914D-44DC-9300-00022BE8B753} URL = http://search.conduit.com/ResultsEx...4&ctid=CT3299872&CUI=UN42554263349168884&UM=2
    SearchScopes: HKCU - {68893FA0-A909-33C3-7C51-6656545E3C51} URL =
    SearchScopes: HKCU - {E58E0C07-470F-4C08-8079-3382D927C525} URL = http://search.yahoo.com/search?p={s...e=W3i_DS,136,0_0,Search,20120417,17118,0,18,0
    BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll No File
    BHO-x32: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
    BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO-x32: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
    BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
    BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
    BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
    Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File
    Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
    DPF: HKLM-x32 {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
    Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
    Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
    Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
    Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Tcpip\Parameters: [DhcpNameServer] 192.168.1.1
    Tcpip\..\Interfaces\{CCBF9E61-3B52-4C69-AE7B-2D83B07E3977}: [NameServer]64.119.0.4,8.8.8.8
    Chrome:
    =======
    CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\ppGoogleNaClPluginChrome.dll ()
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\30.0.1599.69\pdf.dll ()
    CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
    CHR Plugin: (Java Deployment Toolkit 6.0.300.12) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
    CHR Plugin: (Java(TM) Platform SE 6 U30) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
    CHR Plugin: (McAfee Security Scanner +) - C:\Program Files (x86)\McAfee Security Scan\3.0.318\npMcAfeeMss.dll No File
    CHR Plugin: (Windows Live\u00AE Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
    CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
    CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
    CHR Plugin: (McAfee SecurityCenter) - c:\PROGRA~2\mcafee\msc\NPMCSN~1.DLL No File
    CHR Extension: (Google Docs) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0
    CHR Extension: (Google Drive) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0
    CHR Extension: (YouTube) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0
    CHR Extension: (Google Search) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
    CHR Extension: (Chrome In-App Payments service) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0
    CHR Extension: (Gmail) - C:\Users\rsinger\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1
    ==================== Services (Whitelisted) =================
    R2 Backup Exec System Recovery; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Agent\VProSvc.exe [4596064 2010-09-14] (Symantec Corporation)
    R2 ekrn; C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe [1341664 2013-03-21] (ESET)
    S3 GenericMount Helper Service; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-12] (Symantec)
    S3 LiveUpdate; C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE [2999664 2007-09-12] (Symantec Corporation)
    R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
    R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
    S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)
    R3 SymSnapService; C:\Program Files (x86)\Symantec\Backup Exec System Recovery\Shared\Drivers\SymSnapServicex64.exe [2965496 2010-09-06] (Symantec)
    ==================== Drivers (Whitelisted) ====================
    S3 AE1000; C:\Windows\System32\DRIVERS\ae1000w7.sys [1101600 2010-03-22] (Ralink Technology Corp.)
    R1 eamonm; C:\Windows\System32\DRIVERS\eamonm.sys [213416 2013-02-20] (ESET)
    S3 efavdrv; C:\Windows\system32\drivers\efavdrv.sys [139704 2013-10-08] (ESET)
    R1 ehdrv; C:\Windows\System32\DRIVERS\ehdrv.sys [150616 2013-01-10] (ESET)
    R2 epfwwfpr; C:\Windows\System32\DRIVERS\epfwwfpr.sys [139768 2013-01-10] (ESET)
    R3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
    R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
    S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)
    R0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170544 2010-09-06] (StorageCraft)
    S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
    S3 esihdrv; \??\C:\Users\rsinger\AppData\Local\Temp\esihdrv.sys [x]
    U2 V2iMount;
    ==================== NetSvcs (Whitelisted) ===================

    ==================== One Month Created Files and Folders ========
    2013-10-10 21:32 - 2013-10-10 20:28 - 00023462 _____ C:\Users\rsinger\Desktop\Addition.txt
    2013-10-10 20:26 - 2013-10-10 20:26 - 00000000 ____D C:\FRST
    2013-10-10 20:25 - 2013-10-10 20:20 - 01954124 _____ (Farbar) C:\Users\rsinger\Desktop\FRST64.exe
    2013-10-10 08:32 - 2013-09-22 16:28 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2013-10-10 08:32 - 2013-09-22 16:28 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2013-10-10 08:32 - 2013-09-22 16:27 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2013-10-10 08:32 - 2013-09-22 15:55 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2013-10-10 08:32 - 2013-09-22 15:54 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2013-10-10 08:32 - 2013-09-22 15:54 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2013-10-10 08:32 - 2013-09-20 20:38 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2013-10-10 08:32 - 2013-09-20 20:30 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2013-10-10 08:32 - 2013-09-20 19:48 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
    2013-10-10 08:32 - 2013-09-20 19:39 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2013-10-10 08:08 - 2013-07-12 03:41 - 00185344 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbvideo.sys
    2013-10-10 08:08 - 2013-07-12 03:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys
    2013-10-10 08:08 - 2013-07-02 21:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys
    2013-10-10 08:08 - 2013-07-02 21:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys
    2013-10-10 08:08 - 2013-07-02 21:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys
    2013-10-10 08:08 - 2013-06-25 15:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys
    2013-10-10 08:07 - 2013-09-13 18:10 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
    2013-10-10 08:07 - 2013-09-07 19:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
    2013-10-10 08:07 - 2013-09-07 19:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll
    2013-10-10 08:07 - 2013-09-07 19:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll
    2013-10-10 08:07 - 2013-07-04 05:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll
    2013-10-10 08:07 - 2013-07-04 05:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll
    2013-10-10 08:07 - 2013-07-04 04:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll
    2013-10-10 08:07 - 2013-07-04 04:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll
    2013-10-10 08:07 - 2013-07-04 03:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys
    2013-10-10 08:06 - 2013-09-04 05:12 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys
    2013-10-10 08:06 - 2013-09-04 05:11 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys
    2013-10-10 08:06 - 2013-08-28 19:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
    2013-10-10 08:06 - 2013-08-28 19:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
    2013-10-10 08:06 - 2013-08-28 19:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll
    2013-10-10 08:06 - 2013-08-28 19:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll
    2013-10-10 08:06 - 2013-08-28 19:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll
    2013-10-10 08:06 - 2013-08-28 18:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
    2013-10-10 08:06 - 2013-08-28 18:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
    2013-10-10 08:06 - 2013-08-28 18:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll
    2013-10-10 08:06 - 2013-08-28 18:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll
    2013-10-10 08:06 - 2013-08-28 18:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
    2013-10-10 08:06 - 2013-08-28 18:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll
    2013-10-10 08:06 - 2013-08-28 17:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
    2013-10-10 08:06 - 2013-08-28 17:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
    2013-10-10 08:06 - 2013-08-28 17:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
    2013-10-10 08:06 - 2013-08-28 17:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
    2013-10-10 08:06 - 2013-08-27 18:21 - 03155968 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
    2013-10-10 08:06 - 2013-08-27 18:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll
    2013-10-10 08:06 - 2013-08-01 05:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
    2013-10-10 08:06 - 2013-07-20 03:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
    2013-10-10 08:06 - 2013-07-20 03:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
    2013-10-10 08:06 - 2013-07-04 05:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll
    2013-10-10 08:06 - 2013-07-04 04:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll
    2013-10-10 08:06 - 2013-06-05 22:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
    2013-10-10 08:06 - 2013-06-05 22:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
    2013-10-10 08:06 - 2013-06-05 22:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
    2013-10-10 08:06 - 2013-06-05 22:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
    2013-10-10 08:06 - 2013-06-05 21:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
    2013-10-10 08:06 - 2013-06-05 21:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
    2013-10-10 08:06 - 2013-06-05 21:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
    2013-10-10 08:06 - 2013-06-05 20:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
    2013-10-10 08:06 - 2013-06-05 20:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
    2013-10-10 08:06 - 2013-06-05 20:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
    2013-10-10 07:32 - 2013-10-10 14:05 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2013-10-09 21:31 - 2013-10-10 06:19 - 00000000 ____D C:\Users\rsinger\Desktop\RK_Quarantine
    2013-10-08 19:04 - 2013-10-08 19:04 - 00016833 _____ C:\Users\rsinger\Desktop\dds.txt
    2013-10-08 19:04 - 2013-10-08 19:04 - 00012039 _____ C:\Users\rsinger\Desktop\attach.txt
    2013-10-08 19:02 - 2013-10-08 19:03 - 00688992 ____R (Swearware) C:\Users\rsinger\Downloads\dds.com
    2013-10-08 17:41 - 2013-10-10 21:32 - 00000000 ____D C:\Users\rsinger\Desktop\Jones Bay Co
    2013-10-08 17:41 - 2013-10-08 17:42 - 00000000 ____D C:\Users\rsinger\AppData\Local\FileTypeAssistant
    2013-10-08 17:01 - 2013-10-08 17:01 - 00000000 ____D C:\Users\rsinger\Documents\Jones Bay Co
    2013-10-08 16:16 - 2013-10-08 16:16 - 00000000 ____D C:\Program Files (x86)\ESET
    2013-10-08 16:15 - 2013-10-08 16:16 - 02347384 _____ (ESET) C:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    2013-10-08 15:03 - 2013-10-08 15:16 - 00139704 _____ (ESET) C:\Windows\system32\Drivers\efavdrv.sys
    2013-10-08 14:57 - 2013-08-07 04:22 - 00278800 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-10-08 12:11 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
    2013-10-08 09:33 - 2013-10-08 15:02 - 00000000 ____D C:\Users\rsinger\Downloads\Jones Bay Co Tools
    2013-10-08 01:26 - 2013-10-08 01:26 - 00000000 ____D C:\Users\rsinger\AppData\Local\ESET
    2013-10-07 23:49 - 2013-10-08 15:03 - 00000000 ____D C:\ProgramData\ESET
    2013-10-07 23:49 - 2013-10-07 23:49 - 00000000 ____D C:\Program Files\ESET
    2013-10-07 21:44 - 2013-10-08 17:41 - 00080384 ___SH C:\Users\rsinger\Desktop\Thumbs.db
    2013-10-07 19:28 - 2013-10-07 22:54 - 00000000 ____D C:\Windows\pss
    2013-10-07 19:15 - 2013-10-08 01:55 - 00007620 _____ C:\Users\rsinger\AppData\Local\Resmon.ResmonCfg
    2013-09-24 16:14 - 2013-09-24 16:14 - 00000000 ____D C:\ProgramData\Oracle
    2013-09-24 16:13 - 2013-09-24 16:13 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00000000 ____D C:\Program Files (x86)\Java
    2013-09-16 20:47 - 2013-10-04 15:34 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2013-09-15 00:16 - 2013-09-19 00:16 - 00000064 _____ C:\Users\rsinger\AppData\Roaming\WB.CFG
    2013-09-11 22:53 - 2013-08-04 19:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys
    2013-09-11 22:52 - 2013-08-01 19:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll
    2013-09-11 22:52 - 2013-08-01 19:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll
    2013-09-11 22:52 - 2013-08-01 19:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 19:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
    2013-09-11 22:52 - 2013-08-01 18:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 18:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe
    2013-09-11 22:52 - 2013-08-01 17:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
    2013-09-11 22:52 - 2013-08-01 17:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
    2013-09-11 22:52 - 2013-08-01 17:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
    2013-09-11 22:51 - 2013-07-25 19:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
    2013-09-11 22:51 - 2013-07-25 19:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll
    2013-09-11 22:51 - 2013-07-25 18:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
    2013-09-11 22:51 - 2013-07-25 18:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll
    2013-09-10 00:11 - 2013-09-19 19:02 - 00000002 _____ C:\END
    2013-09-10 00:11 - 2013-09-10 00:11 - 00000387 _____ C:\Users\rsinger\Desktop\FREE Games.url
    ==================== One Month Modified Files and Folders =======
    2013-10-10 21:42 - 2010-12-08 18:27 - 00000900 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2013-10-10 21:32 - 2013-10-08 17:41 - 00000000 ____D C:\Users\rsinger\Desktop\Jones Bay Co
    2013-10-10 20:29 - 2009-07-13 21:45 - 00019728 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2013-10-10 20:29 - 2009-07-13 21:45 - 00019728 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2013-10-10 20:28 - 2013-10-10 21:32 - 00023462 _____ C:\Users\rsinger\Desktop\Addition.txt
    2013-10-10 20:26 - 2013-10-10 20:26 - 00000000 ____D C:\FRST
    2013-10-10 20:24 - 2010-12-08 18:27 - 00000896 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2013-10-10 20:22 - 2009-07-13 22:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
    2013-10-10 20:22 - 2009-07-13 21:51 - 00021627 _____ C:\Windows\setupact.log
    2013-10-10 20:20 - 2013-10-10 20:25 - 01954124 _____ (Farbar) C:\Users\rsinger\Desktop\FRST64.exe
    2013-10-10 14:44 - 2009-07-13 22:10 - 01280016 _____ C:\Windows\WindowsUpdate.log
    2013-10-10 14:14 - 2009-07-13 22:13 - 00726444 _____ C:\Windows\system32\PerfStringBackup.INI
    2013-10-10 14:05 - 2013-10-10 07:32 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2013-10-10 12:02 - 2013-05-21 16:15 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
    2013-10-10 09:37 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\rescache
    2013-10-10 08:45 - 2009-07-13 21:45 - 00426400 _____ C:\Windows\system32\FNTCACHE.DAT
    2013-10-10 08:34 - 2011-01-23 19:02 - 00000000 ____D C:\ProgramData\Microsoft Help
    2013-10-10 08:30 - 2013-03-14 03:01 - 00000000 ____D C:\Program Files\Microsoft Silverlight
    2013-10-10 08:30 - 2013-03-14 03:01 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
    2013-10-10 07:27 - 2009-07-13 20:20 - 00000000 ____D C:\Windows\Registration
    2013-10-10 06:19 - 2013-10-09 21:31 - 00000000 ____D C:\Users\rsinger\Desktop\RK_Quarantine
    2013-10-09 21:18 - 2010-11-12 20:08 - 09150780 _____ C:\Windows\PFRO.log
    2013-10-08 19:48 - 2010-12-08 18:27 - 00000000 ____D C:\Users\rsinger\AppData\Local\Google
    2013-10-08 19:04 - 2013-10-08 19:04 - 00016833 _____ C:\Users\rsinger\Desktop\dds.txt
    2013-10-08 19:04 - 2013-10-08 19:04 - 00012039 _____ C:\Users\rsinger\Desktop\attach.txt
    2013-10-08 19:03 - 2013-10-08 19:02 - 00688992 ____R (Swearware) C:\Users\rsinger\Downloads\dds.com
    2013-10-08 17:42 - 2013-10-08 17:41 - 00000000 ____D C:\Users\rsinger\AppData\Local\FileTypeAssistant
    2013-10-08 17:41 - 2013-10-07 21:44 - 00080384 ___SH C:\Users\rsinger\Desktop\Thumbs.db
    2013-10-08 17:01 - 2013-10-08 17:01 - 00000000 ____D C:\Users\rsinger\Documents\Jones Bay Co
    2013-10-08 16:16 - 2013-10-08 16:16 - 00000000 ____D C:\Program Files (x86)\ESET
    2013-10-08 16:16 - 2013-10-08 16:15 - 02347384 _____ (ESET) C:\Users\rsinger\Downloads\esetsmartinstaller_enu.exe
    2013-10-08 15:16 - 2013-10-08 15:03 - 00139704 _____ (ESET) C:\Windows\system32\Drivers\efavdrv.sys
    2013-10-08 15:03 - 2013-10-07 23:49 - 00000000 ____D C:\ProgramData\ESET
    2013-10-08 15:02 - 2013-10-08 09:33 - 00000000 ____D C:\Users\rsinger\Downloads\Jones Bay Co Tools
    2013-10-08 13:10 - 2011-03-02 17:15 - 00000000 ____D C:\Program Files (x86)\FunWebProducts
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\ProgramData\Malwarebytes
    2013-10-08 12:11 - 2013-10-08 12:11 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
    2013-10-08 01:55 - 2013-10-07 19:15 - 00007620 _____ C:\Users\rsinger\AppData\Local\Resmon.ResmonCfg
    2013-10-08 01:26 - 2013-10-08 01:26 - 00000000 ____D C:\Users\rsinger\AppData\Local\ESET
    2013-10-07 23:49 - 2013-10-07 23:49 - 00000000 ____D C:\Program Files\ESET
    2013-10-07 22:54 - 2013-10-07 19:28 - 00000000 ____D C:\Windows\pss
    2013-10-07 21:44 - 2011-06-24 13:50 - 00000000 ____D C:\Users\rsinger\Desktop\M's Canyon 2011
    2013-10-07 21:15 - 2010-12-01 15:54 - 00000000 ___RD C:\Users\rsinger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    2013-10-07 20:19 - 2011-02-23 04:16 - 00004096 ___SH C:\VSNAP.IDX
    2013-10-07 18:37 - 2009-07-13 20:20 - 00000000 __RHD C:\Users\Public\Libraries
    2013-10-07 13:08 - 2012-05-06 16:16 - 00000000 ____D C:\Users\rsinger\AppData\Roaming\Clip Art Collection
    2013-10-04 15:38 - 2012-02-23 01:10 - 00000000 ____D C:\ProgramData\CanonIJPLM
    2013-10-04 15:34 - 2013-09-16 20:47 - 00002185 _____ C:\Users\Public\Desktop\Google Chrome.lnk
    2013-09-24 16:14 - 2013-09-24 16:14 - 00000000 ____D C:\ProgramData\Oracle
    2013-09-24 16:13 - 2013-09-24 16:13 - 00868264 _____ (Oracle Corporation) C:\Windows\SysWOW64\npDeployJava1.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00175016 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
    2013-09-24 16:13 - 2013-09-24 16:13 - 00096168 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
    2013-09-24 16:13 - 2013-09-24 16:13 - 00000000 ____D C:\Program Files (x86)\Java
    2013-09-24 16:13 - 2010-11-12 18:15 - 00790440 _____ (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
    2013-09-22 19:38 - 2012-07-26 17:47 - 00000000 ____D C:\Users\rsinger\Documents\Quicken
    2013-09-22 16:28 - 2013-10-10 08:32 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
    2013-09-22 16:28 - 2013-10-10 08:32 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 14335488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 02876928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00039424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
    2013-09-22 16:27 - 2013-10-10 08:32 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
    2013-09-22 15:55 - 2013-10-10 08:32 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
    2013-09-22 15:54 - 2013-10-10 08:32 - 19252224 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 15404544 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 02647552 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
    2013-09-22 15:54 - 2013-10-10 08:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
    2013-09-20 20:38 - 2013-10-10 08:32 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
    2013-09-20 20:30 - 2013-10-10 08:32 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
    2013-09-20 19:48 - 2013-10-10 08:32 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
    2013-09-20 19:39 - 2013-10-10 08:32 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
    2013-09-20 12:21 - 2013-05-21 16:14 - 00000000 ____D C:\Program Files\My Dell
    2013-09-20 12:21 - 2010-12-01 17:00 - 00000000 ____D C:\ProgramData\PCDr
    2013-09-19 19:02 - 2013-09-10 00:11 - 00000002 _____ C:\END
    2013-09-19 00:16 - 2013-09-15 00:16 - 00000064 _____ C:\Users\rsinger\AppData\Roaming\WB.CFG
    2013-09-16 20:47 - 2010-12-08 18:26 - 00000000 ____D C:\Program Files (x86)\Google
    2013-09-13 18:10 - 2013-10-10 08:07 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys
    2013-09-12 10:57 - 2010-12-25 17:53 - 00000000 ___RD C:\Users\rsinger\Virtual Machines
    2013-09-12 10:57 - 2010-12-01 16:08 - 00000000 ___RD C:\Users\rsinger\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    2013-09-12 03:10 - 2013-08-15 03:03 - 00000000 ____D C:\Windows\system32\MRT
    2013-09-12 03:07 - 2010-12-02 14:17 - 79143768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
    2013-09-11 01:28 - 2012-07-27 12:36 - 00000000 ____D C:\Users\rsinger\Documents\Assetlevels
    2013-09-10 00:32 - 2010-12-08 18:28 - 00000000 ____D C:\Users\rsinger\AppData\Local\Adobe
    2013-09-10 00:11 - 2013-09-10 00:11 - 00000387 _____ C:\Users\rsinger\Desktop\FREE Games.url
    ==================== Bamital & volsnap Check =================
    C:\Windows\System32\winlogon.exe => MD5 is legit
    C:\Windows\System32\wininit.exe => MD5 is legit
    C:\Windows\SysWOW64\wininit.exe => MD5 is legit
    C:\Windows\explorer.exe => MD5 is legit
    C:\Windows\SysWOW64\explorer.exe => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\SysWOW64\svchost.exe => MD5 is legit
    C:\Windows\System32\services.exe => MD5 is legit
    C:\Windows\System32\User32.dll => MD5 is legit
    C:\Windows\SysWOW64\User32.dll => MD5 is legit
    C:\Windows\System32\userinit.exe => MD5 is legit
    C:\Windows\SysWOW64\userinit.exe => MD5 is legit
    C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

    LastRegBack: 2013-10-01 06:14
    ==================== End Of Log ============================
     


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.