Inactive-A I can only connect to internet in Safe Mode

fordgt0589 · Mar 31, 2014

I have been having this problem for a couple weeks now. Everything I do seems to be a temporary fix. For some reason, I am unable to keep a steady connetion to the internet in normal mode, however Skype and P2P programs work fine.

Broni · Mar 31, 2014

Welcome aboard

Please, complete all steps listed here: https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
Attached logs won't be reviewed.

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

fordgt0589 · Apr 1, 2014

It seems I am unable to install the antivirus software. Comodo and Avast both gave me error messages while installing and WME says that my version of Windows has Defender built in which would provide the same level of security.

Comodo Error: Cannot install COMODO Internet Security. Error: 1601. The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance.

Avast Error: The Installer is unable to initialize early avast! self-defense with error 0x0000043c! Aborting!

Broni · Apr 1, 2014

Is this Windows 8?
If so Windows Defender is what in earlier versions of Windows was Microsoft Security Essentials - decent AV program.
If the above is correct proceed with other steps.

fordgt0589 · Apr 2, 2014

Yes I am running WIndows 8.

Malwarebytes Log:

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 4/2/2014
Scan Time: 2:34:13 AM
Logfile: Scan.txt
Administrator: Yes

Version: 2.00.0.1000
Malware Database: v2014.04.02.03
Rootkit Database: v2014.03.27.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Chameleon: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: fordg_000

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 240607
Time Elapsed: 5 min, 35 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Shuriken: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 0
(No malicious items detected)

Registry Values: 0
(No malicious items detected)

Registry Data: 0
(No malicious items detected)

Folders: 0
(No malicious items detected)

Files: 0
(No malicious items detected)

Physical Sectors: 0
(No malicious items detected)

(end)

DDS.txt:

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16843
Run by fordg_000 at 2:36:28 on 2014-04-02
Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.8079.6157 [GMT -4:00]
.
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
C:\WINDOWS\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\WINDOWS\system32\svchost.exe -k RPCSS
C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\dwm.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\WINDOWS\system32\nvvsvc.exe
C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\System32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
C:\WINDOWS\system32\dashost.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe
C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet
C:\WINDOWS\system32\taskhostex.exe
C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\igfxpers.exe
C:\Users\fordg_000\AppData\Local\Apps\2.0\WC3AHZBR.6YB\KDP44OTC.4Z0\dell..tion_0f612f649c4a10af_0005.0005_9914611622934cec\DellSystemDetect.exe
C:\Program Files (x86)\Skype\Phone\Skype.exe
C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe
C:\Program Files (x86)\AdTrustMedia\PrivDog\1.8.0.15\trustedadssvc.exe
C:\Windows\System32\WWAHost.exe
C:\WINDOWS\WinStore\WSHost.exe
C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\WINDOWS\system32\taskhost.exe
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
C:\WINDOWS\splwow64.exe
C:\Program Files (x86)\Rosetta Stone\Rosetta Stone V3\RosettaStoneVersion3.exe
C:\Program Files (x86)\Rosetta Stone\Rosetta Stone V3\support\bin\win\RosettaStoneLtdServices.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchFilterHost.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://search.yahoo.com/?type=586383&fr=spigot-yhp-ie
mWinlogon: Userinit = userinit.exe,
BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
BHO: PrivDog Extension: {FB16E5C3-A9E2-47A2-8EFC-319E775E62CC} - C:\Program Files (x86)\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
uRun: [DellSystemDetect] C:\Users\fordg_000\AppData\Local\Apps\2.0\WC3AHZBR.6YB\KDP44OTC.4Z0\dell..tion_0f612f649c4a10af_0005.0005_9914611622934cec\DellSystemDetect.exe
uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
mRun: [PowerDVD13Agent] "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe"
mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
mRun: [ComodoFSFirefox] "C:\Program Files (x86)\AdTrustMedia\PrivDog\FinalizeSetup.exe" /f
mRun: [PrivDogService] "C:\Program Files (x86)\AdTrustMedia\PrivDog\1.8.0.15\trustedadssvc.exe"
IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
IE: {2F5C139F-79BD-4C84-A95A-E7140525BC55} - {5B06364D-FF00-4BD5-9D01-4379952513F2} - C:\Program Files (x86)\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
Trusted Zone: dell.com
TCP: NameServer = 75.75.75.75 75.75.76.76
TCP: Interfaces\{F3852D2A-8910-4C3A-B06C-C50836462624} : DHCPNameServer = 75.75.75.75 75.75.76.76
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
x64-BHO: PrivDog Extension: {FB16E5C3-A9E2-47A2-8EFC-319E775E62CC} - C:\Program Files\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
x64-Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
x64-Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
x64-Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
x64-Run: [ShadowPlay] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\nvspcap64.dll,ShadowPlayOnSystemStart
x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
x64-IE: {2F5C139F-79BD-4C84-A95A-E7140525BC55} - {5B06364D-FF00-4BD5-9D01-4379952513F2} - C:\Program Files\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-Notify: igfxcui - igfxdev.dll
x64-SSODL: WebCheck - <orphaned>
x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/?type=586383&fr=spigot-yhp-ff
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=586383&p=
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
.
============= SERVICES / DRIVERS ===============
.
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5};Power Control [2014/03/20 06:00:14];C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [2013-3-19 130320]
R2 c2cautoupdatesvc;Skype Click to Call Updater;C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-3-3 1363584]
R2 c2cpnrsvc;Skype Click to Call PNR Service;C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-3-3 1748608]
R2 CyberLink PowerDVD 13 Media Server Monitor Service;CyberLink PowerDVD 13 Media Server Monitor Service;C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [2014-3-20 77576]
R2 CyberLink PowerDVD 13 Media Server Service;CyberLink PowerDVD 13 Media Server Service;C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [2014-3-20 323336]
R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-3-31 1809720]
R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-3-31 857912]
R2 MSI_ODD_Service;MSI_ODD_Service;C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe [2011-10-4 76800]
R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-3-20 1593632]
R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-3-20 16939296]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-3-20 411936]
R3 MBAMProtector;MBAMProtector;C:\WINDOWS\System32\Drivers\mbam.sys [2014-3-31 25816]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\System32\Drivers\MBAMSwissArmy.sys [2014-3-31 119512]
R3 MBAMWebAccessControl;MBAMWebAccessControl;C:\WINDOWS\System32\Drivers\mwac.sys [2014-3-31 63192]
R3 NTIOLib_X64;NTIOLib_X64;C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [2010-1-18 14136]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\WINDOWS\System32\Drivers\nvvad64v.sys [2014-3-20 39200]
R3 RTL8168;Realtek 8168 NT Driver;C:\WINDOWS\System32\Drivers\Rt630x64.sys [2012-6-2 589824]
R3 WSDScan;WSD Scan Support;C:\WINDOWS\System32\Drivers\WSDScan.sys [2014-3-22 23552]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
.
=============== Created Last 30 ================
.
2014-04-01 20:02:23 -------- d-----w- C:\Users\fordg_000\AppData\Local\IsolatedStorage
2014-04-01 19:29:23 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\IsolatedStorage
2014-04-01 18:48:35 423240 ----a-w- C:\WINDOWS\System32\drivers\raqimtca.sys
2014-04-01 18:46:34 -------- d-----w- C:\Users\fordg_000\AppData\Local\AdTrustMedia
2014-04-01 18:45:48 -------- d-----w- C:\ProgramData\Adtrustmedia
2014-04-01 18:45:48 -------- d-----w- C:\Program Files\AdTrustMedia
2014-04-01 18:45:48 -------- d-----w- C:\Program Files (x86)\AdTrustMedia
2014-04-01 18:45:43 -------- d-----w- C:\ProgramData\Comodo Downloader
2014-04-01 18:45:16 -------- d-----w- C:\ProgramData\Comodo
2014-04-01 18:41:51 423240 ----a-w- C:\WINDOWS\System32\drivers\dgwtjwvu.sys
2014-04-01 18:41:44 423240 ----a-w- C:\WINDOWS\System32\drivers\jswsyyiw.sys
2014-04-01 18:41:43 -------- d-----w- C:\ProgramData\AVAST Software
2014-04-01 14:22:24 10521840 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5FB56A63-A86E-4BCB-880E-1C670201DAE5}\mpengine.dll
2014-03-31 17:23:55 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-03-31 17:15:00 -------- d-----w- C:\Users\fordg_000\AppData\Local\ElevatedDiagnostics
2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
2014-03-31 17:06:39 -------- d-----w- C:\Users\fordg_000\AppData\Local\Apple
2014-03-31 16:32:53 10521840 ------w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
2014-03-31 06:33:10 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\Sony Creative Software Inc
2014-03-31 05:20:44 -------- d-----w- C:\ProgramData\IsolatedStorage
2014-03-31 05:20:03 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\Vegasaur
2014-03-31 05:20:02 -------- d-----w- C:\ProgramData\Vegasaur
2014-03-31 05:20:02 -------- d-----w- C:\Program Files\Vegasaur
2014-03-31 05:10:41 119512 ----a-w- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
2014-03-31 05:10:32 91352 ----a-w- C:\WINDOWS\System32\drivers\mbamchameleon.sys
2014-03-31 05:10:32 63192 ----a-w- C:\WINDOWS\System32\drivers\mwac.sys
2014-03-31 05:10:32 25816 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys
2014-03-31 05:10:32 -------- d-----w- C:\ProgramData\Malwarebytes
2014-03-31 05:10:32 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-03-31 01:05:56 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\Subtitle Edit
2014-03-31 01:05:55 -------- d-----w- C:\Program Files (x86)\Subtitle Edit
2014-03-30 21:22:06 -------- d-----w- C:\ProgramData\Rosetta Stone
2014-03-29 08:07:20 -------- d-----w- C:\Program Files (x86)\Rosetta Stone
2014-03-26 08:13:57 23350272 ----a-w- C:\Program Files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2014-03-26 08:13:56 22615040 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2014-03-26 08:10:57 76288 ----a-w- C:\WINDOWS\System32\newdev.exe
2014-03-26 08:10:57 75264 ----a-w- C:\WINDOWS\System32\ndadmin.exe
2014-03-26 08:10:57 74240 ----a-w- C:\WINDOWS\SysWow64\newdev.exe
2014-03-26 08:10:57 73728 ----a-w- C:\WINDOWS\SysWow64\ndadmin.exe
2014-03-26 08:10:57 301568 ----a-w- C:\WINDOWS\System32\newdev.dll
2014-03-26 08:10:57 275968 ----a-w- C:\WINDOWS\SysWow64\newdev.dll
2014-03-26 08:05:19 13661696 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll
2014-03-26 07:55:29 109568 ----a-w- C:\WINDOWS\System32\dskquota.dll
2014-03-26 07:54:59 1045504 ----a-w- C:\WINDOWS\System32\usercpl.dll
2014-03-26 07:51:12 83968 ----a-w- C:\WINDOWS\System32\drivers\hidclass.sys
2014-03-26 07:51:12 32768 ----a-w- C:\WINDOWS\System32\drivers\hidparse.sys
2014-03-26 07:51:12 27648 ----a-w- C:\WINDOWS\System32\drivers\hidusb.sys
2014-03-26 07:41:22 1125888 ----a-w- C:\WINDOWS\System32\msctf.dll
2014-03-26 07:40:59 883712 ----a-w- C:\WINDOWS\HelpPane.exe
2014-03-22 19:51:02 -------- d-----w- C:\WINDOWS\System32\MRT
2014-03-22 19:43:59 560640 ----a-w- C:\WINDOWS\System32\mfmp4srcsnk.dll
2014-03-22 19:42:51 17888 ----a-w- C:\WINDOWS\System32\msvcr100_clr0400.dll
2014-03-22 19:42:50 17888 ----a-w- C:\WINDOWS\SysWow64\msvcr100_clr0400.dll
2014-03-22 19:40:57 3842560 ----a-w- C:\WINDOWS\System32\d2d1.dll
2014-03-22 19:39:59 1300992 ----a-w- C:\WINDOWS\System32\gdi32.dll
2014-03-22 19:38:50 945152 ----a-w- C:\WINDOWS\System32\resetengmig.dll
2014-03-22 19:38:50 443392 ----a-w- C:\WINDOWS\System32\ReAgent.dll
2014-03-22 19:38:50 375808 ----a-w- C:\WINDOWS\SysWow64\ReAgent.dll
2014-03-22 19:38:50 132096 ----a-w- C:\WINDOWS\System32\sysreset.exe
2014-03-22 19:38:50 1011200 ----a-w- C:\WINDOWS\System32\reseteng.dll
2014-03-22 19:38:49 2851840 ----a-w- C:\WINDOWS\System32\esent.dll
2014-03-22 19:38:49 2382336 ----a-w- C:\WINDOWS\SysWow64\esent.dll
2014-03-22 19:38:49 1628160 ----a-w- C:\WINDOWS\System32\WindowsCodecs.dll
2014-03-22 19:38:49 1339392 ----a-w- C:\WINDOWS\SysWow64\WindowsCodecs.dll
2014-03-22 19:32:58 312320 ----a-w- C:\WINDOWS\System32\msieftp.dll
2014-03-22 19:32:58 273408 ----a-w- C:\WINDOWS\SysWow64\msieftp.dll
2014-03-22 19:32:56 144896 ----a-w- C:\WINDOWS\System32\tssdisai.dll
2014-03-22 19:32:56 135680 ----a-w- C:\WINDOWS\System32\appserverai.dll
2014-03-22 19:32:56 126976 ----a-w- C:\WINDOWS\System32\RDWebAI.dll
2014-03-22 19:32:56 122880 ----a-w- C:\WINDOWS\System32\VmHostAI.dll
2014-03-22 19:32:55 148480 ----a-w- C:\WINDOWS\System32\poqexec.exe
2014-03-22 19:32:55 132608 ----a-w- C:\WINDOWS\SysWow64\poqexec.exe
2014-03-22 19:32:52 2048 ----a-w- C:\WINDOWS\SysWow64\tzres.dll
2014-03-22 19:32:52 2048 ----a-w- C:\WINDOWS\System32\tzres.dll
2014-03-21 07:16:47 -------- d-----w- C:\Users\fordg_000\AppData\Local\Macromedia
2014-03-21 07:08:12 270496 ------w- C:\WINDOWS\System32\MpSigStub.exe
2014-03-20 19:54:40 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
2014-03-20 19:54:23 -------- d-----w- C:\WINDOWS\PCHEALTH
2014-03-20 19:54:23 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2014-03-20 19:53:35 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
2014-03-20 19:53:11 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
2014-03-20 19:53:06 -------- d-----w- C:\Users\fordg_000\AppData\Local\Microsoft Help
2014-03-20 19:51:11 -------- d-----w- C:\Program Files (x86)\Elaborate Bytes
2014-03-20 15:34:57 254640 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10236.bin
2014-03-20 12:19:02 -------- d-sh--w- C:\Recovery
2014-03-20 10:47:18 -------- d-----w- C:\Users\fordg_000\.MakeMKV
2014-03-20 10:39:09 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\NVIDIA
2014-03-20 10:35:42 -------- d-----w- C:\WINDOWS\SysWow64\spool
2014-03-20 10:03:41 -------- d-----w- C:\Users\fordg_000\AppData\Local\Sony
2014-03-20 10:03:41 -------- d-----w- C:\Program Files\Sony
2014-03-20 10:03:41 -------- d-----w- C:\Program Files (x86)\Sony
2014-03-20 10:00:42 -------- d-----w- C:\Users\fordg_000\AppData\Local\Cyberlink SoftDMA
2014-03-20 10:00:12 -------- d-----w- C:\Users\fordg_000\AppData\Local\MediaServer
2014-03-20 10:00:09 599840 ----a-w- C:\WINDOWS\SysWow64\nvStreaming.exe
2014-03-20 09:59:56 -------- d-----w- C:\ProgramData\PDVD
2014-03-20 09:59:55 -------- d-----w- C:\WINDOWS\SysWow64\NV
2014-03-20 09:59:55 -------- d-----w- C:\WINDOWS\System32\NV
2014-03-20 09:59:51 922968 ----a-w- C:\WINDOWS\System32\nvvsvc.exe
2014-03-20 09:59:51 6714312 ----a-w- C:\WINDOWS\System32\nvcpl.dll
2014-03-20 09:59:51 64968 ----a-w- C:\WINDOWS\System32\nvshext.dll
2014-03-20 09:59:51 386336 ----a-w- C:\WINDOWS\System32\nvmctray.dll
2014-03-20 09:59:51 3649185 ----a-w- C:\WINDOWS\System32\nvcoproc.bin
2014-03-20 09:59:51 3497816 ----a-w- C:\WINDOWS\System32\nvsvc64.dll
2014-03-20 09:59:49 -------- d-----w- C:\Users\fordg_000\AppData\Local\CyberLink
2014-03-20 09:54:35 778856 ----a-w- C:\WINDOWS\SysWow64\PresentationNative_v0300.dll
2014-03-20 09:54:35 35400 ----a-w- C:\WINDOWS\SysWow64\TsWpfWrp.exe
2014-03-20 09:54:35 35400 ----a-w- C:\WINDOWS\System32\TsWpfWrp.exe
2014-03-20 09:54:35 1166440 ----a-w- C:\WINDOWS\System32\PresentationNative_v0300.dll
2014-03-20 09:52:32 -------- d-----w- C:\ProgramData\install_clap
2014-03-20 09:50:04 -------- d-----w- C:\Program Files (x86)\VideoLAN
2014-03-20 09:49:28 -------- d-----w- C:\Program Files (x86)\Audacity
2014-03-20 09:44:26 -------- d-----w- C:\Users\fordg_000\AppData\Local\NVIDIA Corporation
2014-03-20 09:44:05 511328 ----a-w- C:\WINDOWS\System32\d3dx10_43.dll
2014-03-20 09:44:05 470880 ----a-w- C:\WINDOWS\SysWow64\d3dx10_43.dll
2014-03-20 09:44:05 276832 ----a-w- C:\WINDOWS\System32\d3dx11_43.dll
2014-03-20 09:44:05 248672 ----a-w- C:\WINDOWS\SysWow64\d3dx11_43.dll
2014-03-20 09:44:05 2401112 ----a-w- C:\WINDOWS\System32\D3DX9_43.dll
2014-03-20 09:44:05 1998168 ----a-w- C:\WINDOWS\SysWow64\D3DX9_43.dll
2014-03-20 09:44:03 1179576 ----a-w- C:\WINDOWS\System32\nvspcap64.dll
2014-03-20 09:44:03 1048152 ----a-w- C:\WINDOWS\SysWow64\nvspcap.dll
2014-03-20 09:44:00 -------- d-----w- C:\Users\fordg_000\AppData\Local\NVIDIA
2014-03-20 09:43:54 -------- d-----w- C:\ProgramData\NVIDIA Corporation
2014-03-20 09:43:10 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation
2014-03-20 09:43:04 39200 ----a-w- C:\WINDOWS\System32\drivers\nvvad64v.sys
2014-03-20 09:43:04 35104 ----a-w- C:\WINDOWS\System32\nvaudcap64v.dll
2014-03-20 09:43:04 33056 ----a-w- C:\WINDOWS\SysWow64\nvaudcap32v.dll
2014-03-20 09:42:58 -------- d-----w- C:\Program Files\NVIDIA Corporation
2014-03-20 09:42:30 -------- d-----w- C:\Users\fordg_000\AppData\Local\Skype
2014-03-20 09:42:21 -------- d-----r- C:\Program Files (x86)\Skype
2014-03-20 09:40:16 -------- d-----w- C:\ProgramData\Freemake
2014-03-20 09:40:04 -------- d-----w- C:\Program Files (x86)\Freemake
2014-03-20 09:38:16 -------- d-----w- C:\Program Files (x86)\MakeMKV
2014-03-20 09:37:45 -------- d-----w- C:\Users\fordg_000\AppData\Local\Programs
2014-03-20 09:34:21 439296 ----a-w- C:\WINDOWS\System32\plsapp64.dll
2014-03-20 09:33:30 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\BitTorrent
2014-03-20 09:28:39 -------- d-----w- C:\Program Files\Common Files\Intel
2014-03-20 09:28:39 -------- d-----w- C:\Program Files (x86)\Common Files\Intel
2014-03-20 09:28:36 56832 ----a-w- C:\WINDOWS\System32\OpenCL.DLL
2014-03-20 09:28:36 56320 ----a-w- C:\WINDOWS\SysWow64\OpenCL.DLL
2014-03-20 09:26:20 -------- d-----w- C:\Users\fordg_000\AppData\Local\Deployment
2014-03-20 09:26:20 -------- d-----w- C:\Users\fordg_000\AppData\Local\Apps
2014-03-20 09:21:06 50784 ----a-w- C:\ProgramData\Microsoft\windowsfiltering\Sqm\Manifest\Sqm3.bin
2014-03-20 09:21:06 -------- d-----r- C:\Users\fordg_000\Searches
2014-03-20 09:21:06 -------- d-----r- C:\Users\fordg_000\Contacts
2014-03-20 09:21:00 17536 ----a-w- C:\ProgramData\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin
2014-03-20 08:59:34 -------- d-----w- C:\WINDOWS\Panther
.
==================== Find3M ====================
.
2014-03-04 22:52:34 78304 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
2014-03-04 22:52:34 694240 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
2014-02-23 08:13:41 2241536 ----a-w- C:\WINDOWS\System32\wininet.dll
2014-02-23 08:13:31 915968 ----a-w- C:\WINDOWS\System32\uxtheme.dll
2014-02-23 08:13:31 53760 ----a-w- C:\WINDOWS\System32\UXInit.dll
2014-02-23 08:11:59 3960320 ----a-w- C:\WINDOWS\System32\jscript9.dll
2014-02-23 08:11:52 67072 ----a-w- C:\WINDOWS\System32\iesetup.dll
2014-02-23 08:11:52 136704 ----a-w- C:\WINDOWS\System32\iesysprep.dll
2014-02-23 06:54:46 1767936 ----a-w- C:\WINDOWS\SysWow64\wininet.dll
2014-02-23 06:54:37 44032 ----a-w- C:\WINDOWS\SysWow64\UXInit.dll
2014-02-23 06:53:22 2877952 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll
2014-02-23 06:53:18 61440 ----a-w- C:\WINDOWS\SysWow64\iesetup.dll
2014-02-23 06:53:18 109056 ----a-w- C:\WINDOWS\SysWow64\iesysprep.dll
2014-02-23 06:35:36 2706432 ----a-w- C:\WINDOWS\System32\mshtml.tlb
2014-02-23 06:31:25 2706432 ----a-w- C:\WINDOWS\SysWow64\mshtml.tlb
2014-02-23 04:06:33 534528 ----a-w- C:\WINDOWS\SysWow64\uxtheme.dll
2014-02-08 04:34:42 4036608 ----a-w- C:\WINDOWS\System32\win32k.sys
2014-02-05 23:41:39 595968 ----a-w- C:\WINDOWS\System32\qedit.dll
2014-02-05 23:37:51 496640 ----a-w- C:\WINDOWS\SysWow64\qedit.dll
2014-01-17 20:24:12 94208 ----a-w- C:\WINDOWS\SysWow64\QuickTimeVR.qtx
2014-01-17 20:24:12 69632 ----a-w- C:\WINDOWS\SysWow64\QuickTime.qts
2014-01-12 23:30:39 2032640 ----a-w- C:\WINDOWS\SysWow64\d3d10warp.dll
2014-01-12 23:30:18 2238976 ----a-w- C:\WINDOWS\System32\d3d10warp.dll
.
============= FINISH: 2:37:02.32 ===============

Attach.txt:

Microsoft Windows 8
Boot Device: \Device\HarddiskVolume1
Install Date: 3/20/2014 5:20:19 AM
System Uptime: 4/1/2014 2:50:43 PM (12 hours ago)
.
Motherboard: Alienware | | 06G6JW
Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz | CPU 1 | 3101/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 931 GiB total, 719.494 GiB free.
D: is CDROM (UDF)
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP2: 3/24/2014 1:37:50 AM - Windows Update
RP3: 3/31/2014 1:06:50 PM - Installed QuickTime 7
.
==== Installed Programs ======================
.
Adobe Flash Player 12 Plugin
Apple Application Support
Apple Software Update
Audacity 2.0.5
BitTorrent
CyberLink PowerDVD 13
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
Dell System Detect
Freemake Video Converter version 4.1.3
GeForce Experience NvStream Client Components
Intel(R) Processor Graphics
MakeMKV v1.8.9
Malwarebytes Anti-Malware version 2.00.0.1000
Microsoft Office Access MUI (English) 2010
Microsoft Office Access Setup Metadata MUI (English) 2010
Microsoft Office Excel MUI (English) 2010
Microsoft Office Groove MUI (English) 2010
Microsoft Office InfoPath MUI (English) 2010
Microsoft Office Office 64-bit Components 2010
Microsoft Office OneNote MUI (English) 2010
Microsoft Office Outlook MUI (English) 2010
Microsoft Office PowerPoint MUI (English) 2010
Microsoft Office Professional Plus 2010
Microsoft Office Proof (English) 2010
Microsoft Office Proof (French) 2010
Microsoft Office Proof (Spanish) 2010
Microsoft Office Proofing (English) 2010
Microsoft Office Publisher MUI (English) 2010
Microsoft Office Shared 64-bit MUI (English) 2010
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
Microsoft Office Shared MUI (English) 2010
Microsoft Office Shared Setup Metadata MUI (English) 2010
Microsoft Office Word MUI (English) 2010
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Mozilla Firefox 28.0 (x86 en-US)
Mozilla Maintenance Service
MSI ODD Monitor
MSVCRT Redists
NVIDIA 3D Vision Controller Driver 335.21
NVIDIA 3D Vision Driver 335.23
NVIDIA Control Panel 335.23
NVIDIA GeForce Experience 1.8.2
NVIDIA Graphics Driver 335.23
NVIDIA HD Audio Driver 1.3.30.1
NVIDIA Install Application
NVIDIA LED Visualizer 1.0
NVIDIA Network Service
NVIDIA Optimus Update 11.10.11
NVIDIA PhysX
NVIDIA PhysX System Software 9.13.1220
NVIDIA ShadowPlay 11.10.11
NVIDIA Stereoscopic 3D Driver
NVIDIA Update 11.10.11
NVIDIA Update Core
NVIDIA Virtual Audio 1.2.20
PrivDog
QuickTime 7
SHIELD Streaming
Skype Click to Call
Skype™ 6.14
Subtitle Edit 3.3.14
Update for Microsoft Office 2010 (KB2494150)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
Vegas Pro 11.0
Vegas Pro 11.0 (64-bit)
Vegasaur 1.9.2
VirtualCloneDrive
VLC media player 2.1.3
WinRAR 5.10 beta 1 (32-bit)
.
==== Event Viewer Messages From Past Week ========
.
4/1/2014 5:23:18 PM, Error: Microsoft-Windows-Kernel-Power [137] - The system firmware has changed the processor's memory type range registers (MTRRs) across a sleep state transition (S4). This can result in reduced resume performance.
4/1/2014 2:50:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
4/1/2014 2:50:07 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
4/1/2014 2:48:30 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
4/1/2014 2:47:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
4/1/2014 2:46:12 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server: {9E175B68-F52A-11D8-B9A5-505054503030}
4/1/2014 2:41:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service dps with arguments "Unavailable" in order to run the server: {DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}
4/1/2014 2:37:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service dps with arguments "Unavailable" in order to run the server: {7022A3B3-D004-4F52-AF11-E9E987FEE25F}
4/1/2014 2:37:01 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
4/1/2014 2:36:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
4/1/2014 2:36:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "Unavailable" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
3/31/2014 12:56:00 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Peer Networking Identity Manager service, but this action failed with the following error: An instance of the service is already running.
3/31/2014 12:56:00 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Peer Networking Grouping service, but this action failed with the following error: An instance of the service is already running.
3/31/2014 12:56:00 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Peer Name Resolution Protocol service, but this action failed with the following error: An instance of the service is already running.
3/31/2014 12:51:00 AM, Error: Service Control Manager [7031] - The Peer Networking Identity Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
3/31/2014 12:51:00 AM, Error: Service Control Manager [7031] - The Peer Networking Grouping service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
3/31/2014 12:51:00 AM, Error: Service Control Manager [7031] - The Peer Name Resolution Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
3/31/2014 1:19:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "Unavailable" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
3/31/2014 1:19:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "Unavailable" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
3/31/2014 1:14:42 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the DHCP Client service which failed to start because of the following error: The dependency service or group failed to start.
3/31/2014 1:14:42 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
3/31/2014 1:14:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "Unavailable" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub System service which failed to start because of the following error: A device attached to the system is not functioning.
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI Proxy Service Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
3/28/2014 2:38:57 PM, Error: Schannel [36888] - A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 51. The Windows SChannel error state is 900.
.
==== End Of File ===========================

Broni · Apr 2, 2014

Download RogueKiller from one of the following links and save it to your Desktop:

Close all the running programs
Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
Otherwise just double-click on RogueKiller.exe
Pre-scan will start. Let it finish.
Click on SCAN button.
Wait until the Status box shows Scan Finished
Click on Delete.
Wait until the Status box shows Deleting Finished.
Click on Report and copy/paste the content of the Notepad into your next reply.
RKreport.txt could also be found on your desktop.
If more than one log is produced post all logs.
If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Create new restore point before proceeding with the next step....
How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

Download Malwarebytes Anti-Rootkit (MBAR) from HERE

Unzip downloaded file.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

fordgt0589 · Apr 3, 2014

RogueKiller Report

RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
mail : http://www.adlice.com/contact/
Feedback : http://forum.adlice.com
Website : http://www.adlice.com/softwares/roguekiller/
Blog : http://www.adlice.com

Operating System : Windows 8 (6.2.9200 ) 64 bits version
Started in : Safe mode with network support
User : fordg_000 [Admin rights]
Mode : Remove -- Date : 04/03/2014 03:23:13
| ARK || FAK || MBR |

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 2 ¤¤¤
[HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
[HJ DESK][PUM] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

¤¤¤ Scheduled tasks : 0 ¤¤¤

¤¤¤ Startup Entries : 0 ¤¤¤

¤¤¤ Web browsers : 0 ¤¤¤

¤¤¤ Browser Addons : 0 ¤¤¤

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

¤¤¤ External Hives: ¤¤¤

¤¤¤ Infection : ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
--> %SystemRoot%\System32\drivers\etc\hosts

¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD10EZEX-75ZF5A0 +++++
--- User ---
[MBR] d3c60bb9e058a59563f5b8436b6e7023
[BSP] 032d295c298533a2ca1727dbea9334ff : Windows 7/8 MBR Code
Partition table:
0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 350 MB
1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 718848 | Size: 953517 MB
User = LL1 ... OK!
User = LL2 ... OK!

Finished : << RKreport[0]_D_04032014_032313.txt >>
RKreport[0]_S_04032014_032259.txt

MBAR Log

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.04.03.02

Windows 8 x64 NTFS (Safe Mode/Networking)
Internet Explorer 10.0.9200.16843
fordg_000 :: SHAWNPC [administrator]

4/3/2014 3:24:59 AM
mbar-log-2014-04-03 (03-24-59).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 237305
Time elapsed: 11 minute(s), 37 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

System Log

---------------------------------------
Malwarebytes Anti-Rootkit BETA 1.07.0.1009

(c) Malwarebytes Corporation 2011-2012

OS version: 6.2.9200 Windows 8 x64

System is currently in a safe mode

Account is Administrative

Internet Explorer version: 10.0.9200.16843

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED
CPU speed: 3.093000 GHz
Memory total: 8471359488, free: 6327767040

Downloaded database version: v2014.04.03.02
Downloaded database version: v2014.03.27.01
=======================================
------------ Kernel report ------------
04/03/2014 03:24:55
------------ Loaded modules -----------
\SystemRoot\system32\ntoskrnl.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kd.dll
\SystemRoot\system32\mcupdate_GenuineIntel.dll
\SystemRoot\System32\drivers\CLFS.SYS
\SystemRoot\System32\drivers\tm.sys
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CI.dll
\SystemRoot\System32\drivers\msrpc.sys
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\System32\Drivers\acpiex.sys
\SystemRoot\System32\Drivers\WppRecorder.sys
\SystemRoot\System32\drivers\ACPI.sys
\SystemRoot\System32\drivers\WMILIB.SYS
\SystemRoot\System32\drivers\msisadrv.sys
\SystemRoot\System32\drivers\pci.sys
\SystemRoot\System32\Drivers\cng.sys
\SystemRoot\system32\drivers\tpm.sys
\SystemRoot\System32\drivers\isapnp.sys
\SystemRoot\System32\drivers\vdrvroot.sys
\SystemRoot\system32\drivers\pdc.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\System32\drivers\spaceport.sys
\SystemRoot\System32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\System32\drivers\vmbus.sys
\SystemRoot\System32\drivers\vmbkmcl.sys
\SystemRoot\System32\drivers\winhv.sys
\SystemRoot\System32\drivers\nvraid.sys
\SystemRoot\System32\drivers\CLASSPNP.SYS
\SystemRoot\System32\drivers\pciide.sys
\SystemRoot\System32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\intelide.sys
\SystemRoot\System32\drivers\viaide.sys
\SystemRoot\System32\drivers\bxvbda.sys
\SystemRoot\System32\drivers\evbda.sys
\SystemRoot\System32\drivers\sdbus.sys
\SystemRoot\System32\drivers\pcmcia.sys
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\System32\drivers\iaStorV.sys
\SystemRoot\System32\drivers\nvstor.sys
\SystemRoot\System32\drivers\storport.sys
\SystemRoot\System32\drivers\lsi_sas.sys
\SystemRoot\System32\drivers\lsi_sas2.sys
\SystemRoot\System32\drivers\lsi_sss.sys
\SystemRoot\System32\drivers\3ware.sys
\SystemRoot\System32\drivers\mvumis.sys
\SystemRoot\System32\drivers\vstxraid.sys
\SystemRoot\System32\drivers\lsi_scsi.sys
\SystemRoot\System32\drivers\megasas.sys
\SystemRoot\System32\drivers\MegaSR.sys
\SystemRoot\System32\drivers\amdsata.sys
\SystemRoot\System32\drivers\amdxata.sys
\SystemRoot\System32\drivers\amdsbs.sys
\SystemRoot\System32\drivers\adp94xx.sys
\SystemRoot\System32\drivers\adpahci.sys
\SystemRoot\System32\drivers\adpu320.sys
\SystemRoot\System32\drivers\arc.sys
\SystemRoot\System32\drivers\arcsas.sys
\SystemRoot\System32\drivers\iirsp.sys
\SystemRoot\System32\drivers\nfrd960.sys
\SystemRoot\System32\drivers\vsmraid.sys
\SystemRoot\System32\drivers\SiSRaid2.sys
\SystemRoot\System32\drivers\sisraid4.sys
\SystemRoot\System32\drivers\atapi.sys
\SystemRoot\System32\drivers\ataport.SYS
\SystemRoot\System32\drivers\storahci.sys
\SystemRoot\System32\drivers\stexstor.sys
\SystemRoot\System32\drivers\HpSAMD.sys
\SystemRoot\System32\drivers\EhStorTcgDrv.sys
\SystemRoot\System32\drivers\EhStorClass.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\System32\drivers\fileinfo.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\System32\drivers\storvsc.sys
\SystemRoot\System32\drivers\usbhub.sys
\SystemRoot\System32\drivers\USBD.SYS
\SystemRoot\System32\drivers\usbehci.sys
\SystemRoot\System32\drivers\USBPORT.SYS
\SystemRoot\System32\drivers\ucx01000.sys
\SystemRoot\System32\drivers\UsbHub3.sys
\SystemRoot\System32\drivers\pcw.sys
\SystemRoot\System32\Drivers\Fs_Rec.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\Drivers\ksecpkg.sys
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\system32\DRIVERS\wfplwfs.sys
\SystemRoot\system32\DRIVERS\vmstorfl.sys
\SystemRoot\System32\DRIVERS\fvevol.sys
\SystemRoot\System32\drivers\gagp30kx.sys
\SystemRoot\System32\drivers\uagp35.sys
\SystemRoot\System32\drivers\agp440.sys
\SystemRoot\System32\drivers\nv_agp.sys
\SystemRoot\System32\drivers\uliagpkx.sys
\SystemRoot\System32\drivers\wd.sys
\SystemRoot\System32\drivers\volsnap.sys
\SystemRoot\System32\drivers\USBXHCI.SYS
\SystemRoot\System32\drivers\USBSTOR.SYS
\SystemRoot\System32\drivers\uaspstor.sys
\SystemRoot\System32\drivers\sdstor.sys
\SystemRoot\System32\drivers\sbp2port.sys
\SystemRoot\System32\drivers\rdyboost.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\disk.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\drivers\usbccgp.sys
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\BasicRender.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\System32\drivers\dxgmms1.sys
\SystemRoot\System32\drivers\hidusb.sys
\SystemRoot\System32\drivers\HIDCLASS.SYS
\SystemRoot\System32\drivers\HIDPARSE.SYS
\SystemRoot\System32\drivers\kbdhid.sys
\SystemRoot\System32\drivers\kbdclass.sys
\SystemRoot\System32\drivers\BasicDisplay.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\AgileVpn.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\System32\drivers\CompositeBus.sys
\SystemRoot\system32\DRIVERS\kdnic.sys
\SystemRoot\System32\drivers\umbus.sys
\SystemRoot\System32\drivers\HDAudBus.sys
\SystemRoot\System32\drivers\HECIx64.sys
\SystemRoot\system32\DRIVERS\Rt630x64.sys
\SystemRoot\system32\DRIVERS\athrx.sys
\SystemRoot\System32\drivers\vwifibus.sys
\SystemRoot\System32\drivers\cdrom.sys
\SystemRoot\System32\drivers\wmiacpi.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\System32\drivers\mssmbios.sys
\SystemRoot\System32\drivers\swenum.sys
\SystemRoot\System32\drivers\ks.sys
\SystemRoot\System32\drivers\VClone.sys
\SystemRoot\System32\drivers\rdpbus.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\System32\drivers\mouhid.sys
\SystemRoot\System32\drivers\mouclass.sys
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\vwififlt.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\SystemRoot\System32\drivers\npsvctrig.sys
\SystemRoot\System32\Drivers\dfsc.sys
\SystemRoot\system32\DRIVERS\udfs.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_storahci.sys
\SystemRoot\System32\Drivers\dump_dumpfve.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\vwifimp.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\drivers\condrv.sys
\??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
\??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
----------- End -----------
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xfffffa8007ce26e0
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\00000039\
Lower Device Object: 0xfffffa8007645510
Lower Device Driver Name: \Driver\storahci\
<<<2>>>
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xfffffa8007ce26e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
--------- Disk Stack ------
DevicePointer: 0xfffffa8007ce1040, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xfffffa8007ce26e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xfffffa8007733d10, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xfffffa8007645510, DeviceName: \Device\00000039\, DriverName: \Driver\storahci\
------------ End ----------
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
<<<2>>>
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Read File: File "C:\Windows\System32\Drivers\vwifibus.sys" is compressed (flags = 1)
Read File: File "C:\WINDOWS\SYSTEM32\drivers\vwifibus.sys" is compressed (flags = 1)
Done!
Drive 0
Scanning MBR on drive 0...
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: E9356C60

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 2048 Numsec = 716800
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 718848 Numsec = 1952802816

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 1000204886016 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953505168-1953525168)...
Done!
Scan finished
=======================================

Removal queue found; removal started
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-I.mbam...
Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
Removal finished

Broni · Apr 3, 2014

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.
Close any open browsers.
Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.
Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

fordgt0589 · Apr 3, 2014

Combofix Log
ComboFix 14-04-03.01 - fordg_000 04/03/2014 13:59:33.1.4 - x64 NETWORK
Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.8079.6428 [GMT -4:00]
Running from: c:\users\fordg_000\Desktop\ComboFix.exe
AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Created a new restore point
.
.
((((((((((((((((((((((((( Files Created from 2014-03-03 to 2014-04-03 )))))))))))))))))))))))))))))))
.
.
2014-04-03 18:03 . 2014-04-03 18:03 -------- d-----w- c:\users\Default\AppData\Local\temp
2014-04-03 17:14 . 2014-03-07 01:43 10521840 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8E552AF0-14CE-4A3B-B78D-56EAB495261B}\mpengine.dll
2014-04-03 07:29 . 2014-04-03 07:29 -------- d-----w- c:\program files (x86)\Common Files\Macrovision Shared
2014-04-01 18:48 . 2014-04-01 18:48 423240 ----a-w- c:\windows\system32\drivers\raqimtca.sys
2014-04-01 18:45 . 2014-04-01 18:45 -------- d-----w- c:\programdata\Adtrustmedia
2014-04-01 18:45 . 2014-04-01 18:45 -------- d-----w- c:\program files\AdTrustMedia
2014-04-01 18:45 . 2014-04-01 18:45 -------- d-----w- c:\programdata\Comodo Downloader
2014-04-01 18:45 . 2014-04-01 18:45 -------- d-----w- c:\programdata\Comodo
2014-04-01 18:41 . 2014-04-01 18:41 423240 ----a-w- c:\windows\system32\drivers\dgwtjwvu.sys
2014-04-01 18:41 . 2014-04-01 18:41 423240 ----a-w- c:\windows\system32\drivers\jswsyyiw.sys
2014-04-01 18:41 . 2014-04-01 18:41 -------- d-----w- c:\programdata\AVAST Software
2014-03-31 17:23 . 2014-04-03 07:36 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
2014-03-31 17:07 . 2014-03-31 17:07 -------- d-----w- c:\program files (x86)\QuickTime
2014-03-31 17:07 . 2014-03-31 17:07 -------- d-----w- c:\programdata\Apple Computer
2014-03-31 17:06 . 2014-03-31 17:06 -------- d-----w- c:\program files (x86)\Common Files\Apple
2014-03-31 17:06 . 2014-03-31 17:06 -------- d-----w- c:\programdata\Apple
2014-03-31 17:06 . 2014-03-31 17:06 -------- d-----w- c:\program files (x86)\Apple Software Update
2014-03-31 05:20 . 2014-03-31 05:20 -------- d-----w- c:\programdata\IsolatedStorage
2014-03-31 05:20 . 2014-03-31 05:20 -------- d-----w- c:\programdata\Vegasaur
2014-03-31 05:20 . 2014-03-31 05:20 -------- d-----w- c:\program files\Vegasaur
2014-03-31 05:10 . 2014-04-03 17:52 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-03-31 05:10 . 2014-04-03 07:24 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-03-31 05:10 . 2014-03-31 05:10 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
2014-03-31 05:10 . 2014-03-31 05:10 -------- d-----w- c:\programdata\Malwarebytes
2014-03-31 05:10 . 2014-03-05 13:26 63192 ----a-w- c:\windows\system32\drivers\mwac.sys
2014-03-31 05:10 . 2014-03-05 13:26 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-03-31 01:05 . 2014-03-31 01:05 -------- d-----w- c:\program files (x86)\Subtitle Edit
2014-03-30 21:22 . 2014-03-30 21:22 -------- d-----w- c:\programdata\Rosetta Stone
2014-03-29 08:07 . 2014-03-30 21:22 -------- d-----w- c:\program files (x86)\Rosetta Stone
2014-03-26 08:13 . 2013-11-01 01:45 23350272 ----a-w- c:\program files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2014-03-26 08:13 . 2013-11-01 01:16 22615040 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
2014-03-26 08:10 . 2012-09-27 07:17 76288 ----a-w- c:\windows\system32\newdev.exe
2014-03-26 08:10 . 2012-09-27 07:17 75264 ----a-w- c:\windows\system32\ndadmin.exe
2014-03-26 08:10 . 2012-09-27 07:15 301568 ----a-w- c:\windows\system32\newdev.dll
2014-03-26 08:10 . 2012-09-27 06:35 74240 ----a-w- c:\windows\SysWow64\newdev.exe
2014-03-26 08:10 . 2012-09-27 06:35 73728 ----a-w- c:\windows\SysWow64\ndadmin.exe
2014-03-26 08:10 . 2012-09-27 06:34 275968 ----a-w- c:\windows\SysWow64\newdev.dll
2014-03-26 08:05 . 2013-07-24 23:07 13661696 ----a-w- c:\windows\system32\Windows.UI.Xaml.dll
2014-03-26 07:55 . 2012-10-12 06:13 109568 ----a-w- c:\windows\system32\dskquota.dll
2014-03-26 07:54 . 2012-10-11 05:45 1045504 ----a-w- c:\windows\system32\usercpl.dll
2014-03-26 07:51 . 2013-11-25 23:17 83968 ----a-w- c:\windows\system32\drivers\hidclass.sys
2014-03-26 07:51 . 2013-06-29 03:08 32768 ----a-w- c:\windows\system32\drivers\hidparse.sys
2014-03-26 07:51 . 2013-05-04 04:48 27648 ----a-w- c:\windows\system32\drivers\hidusb.sys
2014-03-26 07:46 . 2013-12-07 06:36 19751936 ----a-w- c:\windows\system32\shell32.dll
2014-03-26 07:41 . 2013-04-09 23:17 1125888 ----a-w- c:\windows\system32\msctf.dll
2014-03-26 07:40 . 2012-11-06 04:48 1150160 ----a-w- c:\windows\SysWow64\ole32.dll
2014-03-22 19:51 . 2014-03-22 19:51 -------- d-----w- c:\windows\system32\MRT
2014-03-22 19:43 . 2013-05-04 06:57 560640 ----a-w- c:\windows\system32\mfmp4srcsnk.dll
2014-03-22 19:42 . 2012-08-31 00:52 17888 ----a-w- c:\windows\system32\msvcr100_clr0400.dll
2014-03-22 19:42 . 2012-08-31 00:53 17888 ----a-w- c:\windows\SysWow64\msvcr100_clr0400.dll
2014-03-22 19:40 . 2014-01-12 23:30 2238976 ----a-w- c:\windows\system32\d3d10warp.dll
2014-03-22 19:39 . 2013-10-02 23:25 1300992 ----a-w- c:\windows\system32\gdi32.dll
2014-03-22 19:38 . 2013-03-02 08:23 375808 ----a-w- c:\windows\SysWow64\ReAgent.dll
2014-03-22 19:38 . 2013-03-02 02:44 1011200 ----a-w- c:\windows\system32\reseteng.dll
2014-03-22 19:38 . 2012-12-15 04:55 443392 ----a-w- c:\windows\system32\ReAgent.dll
2014-03-22 19:38 . 2012-11-03 05:26 132096 ----a-w- c:\windows\system32\sysreset.exe
2014-03-22 19:38 . 2012-11-03 05:25 945152 ----a-w- c:\windows\system32\resetengmig.dll
2014-03-22 19:38 . 2014-01-31 00:48 1339392 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
2014-03-22 19:38 . 2014-01-31 00:06 1628160 ----a-w- c:\windows\system32\WindowsCodecs.dll
2014-03-22 19:38 . 2013-03-22 03:49 2382336 ----a-w- c:\windows\SysWow64\esent.dll
2014-03-22 19:38 . 2013-03-21 22:47 2851840 ----a-w- c:\windows\system32\esent.dll
2014-03-22 19:32 . 2013-11-01 05:38 312320 ----a-w- c:\windows\system32\msieftp.dll
2014-03-22 19:32 . 2013-11-01 03:49 273408 ----a-w- c:\windows\SysWow64\msieftp.dll
2014-03-22 19:32 . 2013-08-07 05:15 144896 ----a-w- c:\windows\system32\tssdisai.dll
2014-03-22 19:32 . 2012-11-10 04:22 122880 ----a-w- c:\windows\system32\VmHostAI.dll
2014-03-22 19:32 . 2012-11-10 04:22 126976 ----a-w- c:\windows\system32\RDWebAI.dll
2014-03-22 19:32 . 2012-11-10 04:20 135680 ----a-w- c:\windows\system32\appserverai.dll
2014-03-22 19:32 . 2012-11-10 04:23 132608 ----a-w- c:\windows\SysWow64\poqexec.exe
2014-03-22 19:32 . 2012-11-10 04:23 148480 ----a-w- c:\windows\system32\poqexec.exe
2014-03-22 19:32 . 2012-12-13 04:00 2048 ----a-w- c:\windows\system32\tzres.dll
2014-03-22 19:32 . 2012-12-13 03:59 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-03-21 07:14 . 2014-03-21 07:14 -------- d-----w- c:\windows\ServiceProfiles\LocalService\winhttp
2014-03-21 07:08 . 2014-01-19 07:33 270496 ------w- c:\windows\system32\MpSigStub.exe
2014-03-20 19:54 . 2014-03-20 19:54 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services
2014-03-20 19:54 . 2014-03-20 19:54 -------- d-----w- c:\windows\PCHEALTH
2014-03-20 19:54 . 2014-03-20 19:54 -------- d-----w- c:\program files (x86)\Microsoft Sync Framework
2014-03-20 19:54 . 2014-03-20 19:54 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
2014-03-20 19:53 . 2014-03-20 19:53 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
2014-03-20 19:53 . 2014-03-20 19:53 -------- d-----w- c:\program files\Microsoft Office
2014-03-20 19:53 . 2014-03-20 19:53 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
2014-03-20 19:53 . 2014-03-22 19:50 -------- d-----w- c:\programdata\Microsoft Help
2014-03-20 19:51 . 2014-03-20 19:51 -------- d-----w- c:\program files (x86)\Elaborate Bytes
2014-03-20 15:34 . 2014-03-20 15:34 254640 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10236.bin
2014-03-20 12:19 . 2014-03-20 12:19 -------- d-----w- C:\Recovery
2014-03-20 10:35 . 2014-03-20 10:35 -------- d-----w- c:\windows\SysWow64\spool
2014-03-20 10:35 . 2014-03-20 10:35 -------- d-----w- c:\programdata\Sony
2014-03-20 10:03 . 2014-03-20 10:35 -------- d-----w- c:\program files (x86)\Sony
2014-03-20 10:03 . 2014-03-20 10:03 -------- d-----w- c:\program files\Sony
2014-03-20 10:00 . 2014-03-20 10:00 -------- d-----w- c:\program files (x86)\AGEIA Technologies
2014-03-20 10:00 . 2014-03-04 11:32 599840 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2014-03-20 09:59 . 2014-03-20 19:39 -------- d-----w- c:\programdata\PDVD
2014-03-20 09:59 . 2014-04-03 17:52 -------- d-----w- c:\programdata\NVIDIA
2014-03-20 09:59 . 2014-03-20 10:02 -------- d-----w- c:\windows\SysWow64\NV
2014-03-20 09:59 . 2014-03-20 10:02 -------- d-----w- c:\windows\system32\NV
2014-03-20 09:59 . 2014-03-04 13:06 6714312 ----a-w- c:\windows\system32\nvcpl.dll
2014-03-20 09:59 . 2014-03-04 13:06 3497816 ----a-w- c:\windows\system32\nvsvc64.dll
2014-03-20 09:59 . 2014-03-04 13:05 922968 ----a-w- c:\windows\system32\nvvsvc.exe
2014-03-20 09:59 . 2014-03-04 13:05 64968 ----a-w- c:\windows\system32\nvshext.dll
2014-03-20 09:59 . 2014-03-04 13:05 386336 ----a-w- c:\windows\system32\nvmctray.dll
2014-03-20 09:59 . 2014-03-04 13:05 3649185 ----a-w- c:\windows\system32\nvcoproc.bin
2014-03-20 09:59 . 2014-03-24 03:11 -------- d-----w- c:\programdata\CyberLink
2014-03-20 09:59 . 2014-03-20 09:59 -------- d-----w- c:\users\Public\CyberLink
2014-03-20 09:56 . 2014-03-20 09:56 -------- d-----w- c:\program files (x86)\Reference Assemblies
2014-03-20 09:56 . 2014-03-20 19:55 -------- d-----w- c:\program files (x86)\MSBuild
2014-03-20 09:56 . 2014-03-20 09:56 -------- d-----w- c:\program files\Reference Assemblies
2014-03-20 09:56 . 2014-03-20 09:56 -------- d-----w- c:\program files\MSBuild
2014-03-20 09:54 . 2012-07-06 02:02 778856 ----a-w- c:\windows\SysWow64\PresentationNative_v0300.dll
2014-03-20 09:54 . 2012-07-06 02:02 35400 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
2014-03-20 09:54 . 2012-07-06 02:02 35400 ----a-w- c:\windows\system32\TsWpfWrp.exe
2014-03-20 09:54 . 2012-07-06 02:02 1166440 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
2014-03-20 09:52 . 2014-03-20 09:52 -------- d-----w- c:\programdata\install_clap
2014-03-20 09:50 . 2014-03-20 09:50 -------- d-----w- c:\program files (x86)\VideoLAN
2014-03-20 09:49 . 2014-03-20 09:49 -------- d-----w- c:\program files (x86)\Audacity
2014-03-20 09:44 . 2010-05-26 15:41 511328 ----a-w- c:\windows\system32\d3dx10_43.dll
2014-03-20 09:44 . 2010-05-26 15:41 470880 ----a-w- c:\windows\SysWow64\d3dx10_43.dll
2014-03-20 09:44 . 2010-05-26 15:41 276832 ----a-w- c:\windows\system32\d3dx11_43.dll
2014-03-20 09:40 . 2014-03-20 19:12 -------- d-----w- c:\programdata\Freemake
2014-03-20 09:40 . 2014-03-20 09:40 -------- d-----w- c:\program files (x86)\Freemake
2014-03-20 09:38 . 2014-03-20 09:38 -------- d-----w- c:\program files (x86)\MakeMKV
2014-03-20 09:34 . 2013-11-14 03:41 439296 ----a-w- c:\windows\system32\plsapp64.dll
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-03-20 09:20 . 2012-07-26 08:13 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2014-03-04 22:52 . 2012-07-26 08:14 78304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-03-04 22:52 . 2012-07-26 08:14 694240 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-03-04 14:35 . 2012-07-25 20:22 18302384 ----a-w- c:\windows\system32\nvwgf2umx.dll
2014-03-04 14:35 . 2012-06-28 02:06 14709720 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2014-01-17 20:24 . 2014-01-17 20:24 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
2014-01-17 20:24 . 2014-01-17 20:24 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSystemDetect"="c:\users\fordg_000\AppData\Local\Apps\2.0\WC3AHZBR.6YB\KDP44OTC.4Z0\dell..tion_0f612f649c4a10af_0005.0005_9914611622934cec\DellSystemDetect.exe" [2014-03-20 253952]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20922016]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"PowerDVD13Agent"="c:\program files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" [2013-03-20 513048]
"VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2013-03-10 88984]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"EnableUIADesktopToggle"= 0 (0x0)
"EnableCursorSuppression"= 1 (0x1)
"ConsentPromptBehaviorUser"= 3 (0x3)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"mixer2"=wdmaud.drv
.
R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5};Power Control [2014/03/20 06:00];c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl;c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [x]
R2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
R2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
R2 CyberLink PowerDVD 13 Media Server Monitor Service;CyberLink PowerDVD 13 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [x]
R2 CyberLink PowerDVD 13 Media Server Service;CyberLink PowerDVD 13 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [x]
R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
R2 MSI_ODD_Service;MSI_ODD_Service;c:\program files (x86)\msi\ODD Monitor\ODD_Monitor.exe;c:\program files (x86)\msi\ODD Monitor\ODD_Monitor.exe [x]
R2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
R2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
R3 NTIOLib_X64;NTIOLib_X64;c:\program files (x86)\msi\ODD Monitor\NTIOLib_X64.sys;c:\program files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [x]
R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
R3 WSDScan;WSD Scan Support;c:\windows\System32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
.
.
Contents of the 'Scheduled Tasks' folder
.
2014-04-03 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-21 07:16]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-10-06 171040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-10-06 399392]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-10-06 441888]
"NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-01-21 2234144]
"ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-01-21 1179576]
.
------- Supplementary Scan -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://search.yahoo.com/?type=586383&fr=spigot-yhp-ie
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
Trusted Zone: dell.com
TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
FF - ProfilePath - c:\users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\
FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/?type=586383&fr=spigot-yhp-ff
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=586383&p=
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{09F57980-3432-4AFC-957D-27AC45FAE1F5}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
@SACL=(02 0000)
.
Completion time: 2014-04-03 14:04:24
ComboFix-quarantined-files.txt 2014-04-03 18:04
.
Pre-Run: 853,683,175,424 bytes free
Post-Run: 854,273,191,936 bytes free
.
- - End Of File - - 1BBDD8A45337C3C03C463EA0C486AEA2
A36C5E4F47E84449FF07ED3517B43A31

Broni · Apr 3, 2014

Looks good.

From now on please download all next tools in safe mode but run them from normal mode.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

fordgt0589 · Apr 4, 2014

AdwCleaner.txt

# AdwCleaner v3.023 - Report created 04/04/2014 at 02:26:52
# Updated 01/04/2014 by Xplode
# Operating System : Windows 8 (64 bits)
# Username : fordg_000 - SHAWNPC
# Running from : C:\Users\fordg_000\Desktop\adwcleaner.exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16843

-\\ Mozilla Firefox v28.0 (en-US)

[ File : C:\Users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\prefs.js ]

*************************

AdwCleaner[R0].txt - [1496 octets] - [04/04/2014 02:26:29]
AdwCleaner[S0].txt - [1423 octets] - [04/04/2014 02:26:52]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1483 octets] ##########

JRT.txt

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.3 (03.23.2014:1)
OS: Windows 8 x64
Ran by fordg_000 on Fri 04/04/2014 at 2:29:26.28
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

~~~ Files

~~~ Folders

Successfully deleted: [Folder] "C:\ProgramData\adtrustmedia"
Successfully deleted: [Folder] "C:\Users\fordg_000\appdata\local\adtrustmedia"

~~~ FireFox

Emptied folder: C:\Users\fordg_000\AppData\Roaming\mozilla\firefox\profiles\5c6yfvpy.default\minidumps [2 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on Fri 04/04/2014 at 2:33:03.09
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

fordgt0589 · Apr 4, 2014

OTL.txt

OTL logfile created on: 4/4/2014 2:34:50 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\fordg_000\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16843)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
7.89 Gb Total Physical Memory | 6.20 Gb Available Physical Memory | 78.64% Memory free
9.08 Gb Paging File | 7.29 Gb Available in Paging File | 80.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.17 Gb Total Space | 791.34 Gb Free Space | 84.98% Space Free | Partition Type: NTFS
Drive D: | 45.06 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Computer Name: SHAWNPC | User Name: fordg_000 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2014/04/04 02:15:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\fordg_000\Desktop\OTL.exe
PRC - [2014/03/21 03:16:41 | 001,863,560 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
PRC - [2014/03/15 04:40:21 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2014/03/05 09:24:48 | 000,857,912 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
PRC - [2014/03/05 09:24:46 | 001,809,720 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
PRC - [2014/03/05 09:24:40 | 007,430,968 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
PRC - [2014/03/04 07:32:56 | 000,411,936 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2014/03/03 09:53:02 | 001,363,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
PRC - [2014/03/03 09:52:32 | 001,748,608 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
PRC - [2014/01/20 22:57:40 | 002,234,144 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
PRC - [2014/01/20 22:57:07 | 001,593,632 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
PRC - [2013/03/20 07:23:33 | 000,513,048 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe
PRC - [2013/03/20 07:23:29 | 000,323,336 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
PRC - [2013/03/20 07:23:27 | 000,077,576 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
PRC - [2011/10/04 15:42:30 | 000,076,800 | ---- | M] (Micro-Star Int'l Co., Ltd.) -- C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe
========== Modules (No Company Name) ==========
MOD - [2014/03/21 03:16:40 | 016,276,872 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
MOD - [2014/03/15 04:40:39 | 003,642,480 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2014/03/04 10:35:23 | 000,014,280 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\coprocmanager\detoured.dll
MOD - [2013/03/20 07:24:55 | 000,043,272 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DHProcedure\DHProcedure.dll
MOD - [2011/08/24 04:39:11 | 000,655,360 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\Koan\_ssl.pyd
MOD - [2011/08/24 04:39:11 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\Koan\_ctypes.pyd
MOD - [2011/08/24 04:39:11 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\Koan\_socket.pyd
MOD - [2010/01/21 01:34:10 | 008,793,952 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
MOD - [2010/01/09 20:18:18 | 004,254,560 | ---- | M] () -- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
========== Services (SafeList) ==========
SRV:64bit: - [2014/01/20 22:56:53 | 016,939,296 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
SRV:64bit: - [2013/10/25 03:34:55 | 000,016,048 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV:64bit: - [2013/08/16 01:39:26 | 002,371,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)
SRV:64bit: - [2013/06/24 18:54:45 | 000,263,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)
SRV:64bit: - [2013/06/01 05:19:58 | 000,207,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)
SRV:64bit: - [2013/05/04 02:58:02 | 000,470,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)
SRV:64bit: - [2013/05/04 02:57:05 | 000,179,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)
SRV:64bit: - [2013/04/09 00:48:42 | 000,169,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)
SRV:64bit: - [2013/03/01 22:45:07 | 000,171,008 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)
SRV:64bit: - [2013/03/01 22:45:05 | 000,180,224 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)
SRV:64bit: - [2013/01/09 19:23:16 | 001,964,544 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)
SRV:64bit: - [2013/01/09 19:22:35 | 000,438,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)
SRV:64bit: - [2012/09/20 02:31:18 | 000,116,736 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)
SRV:64bit: - [2012/07/25 23:30:05 | 002,675,200 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)
SRV:64bit: - [2012/07/25 23:07:47 | 000,065,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)
SRV:64bit: - [2012/07/25 23:07:40 | 000,283,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)
SRV:64bit: - [2012/07/25 23:07:25 | 000,012,800 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)
SRV:64bit: - [2012/07/25 23:06:34 | 000,743,936 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)
SRV:64bit: - [2012/07/25 23:06:33 | 000,161,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)
SRV:64bit: - [2012/07/25 23:06:33 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)
SRV:64bit: - [2012/07/25 23:05:55 | 000,059,904 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)
SRV:64bit: - [2012/07/25 23:05:34 | 000,037,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)
SRV:64bit: - [2012/07/25 23:05:24 | 000,342,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)
SRV:64bit: - [2012/07/25 23:05:08 | 000,122,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AUInstallAgent.dll -- (AllUserInstallAgent)
SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)
SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)
SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)
SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)
SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)
SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)
SRV - [2014/04/03 03:29:10 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2014/03/21 03:16:41 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2014/03/15 04:40:31 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2014/03/05 09:24:48 | 000,857,912 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2014/03/05 09:24:46 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2014/03/04 07:32:56 | 000,411,936 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2014/03/03 09:53:02 | 001,363,584 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)
SRV - [2014/03/03 09:52:32 | 001,748,608 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)
SRV - [2014/01/20 22:57:07 | 001,593,632 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
SRV - [2013/10/23 08:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013/03/20 07:23:29 | 000,323,336 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe -- (CyberLink PowerDVD 13 Media Server Service)
SRV - [2013/03/20 07:23:27 | 000,077,576 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe -- (CyberLink PowerDVD 13 Media Server Monitor Service)
SRV - [2012/10/06 00:12:10 | 000,277,024 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
SRV - [2012/07/25 23:30:05 | 002,675,200 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll -- (PrintNotify)
SRV - [2012/07/25 23:20:04 | 000,018,432 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)
SRV - [2011/10/04 15:42:30 | 000,076,800 | ---- | M] (Micro-Star Int'l Co., Ltd.) [Auto | Running] -- C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe -- (MSI_ODD_Service)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2014/04/04 02:27:50 | 000,119,512 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
DRV:64bit: - [2014/03/05 09:26:22 | 000,063,192 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\mwac.sys -- (MBAMWebAccessControl)
DRV:64bit: - [2014/03/05 09:26:04 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013/12/27 14:42:26 | 000,039,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
DRV:64bit: - [2013/11/28 09:38:18 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2013/10/25 03:34:52 | 000,035,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WdBoot.sys -- (WdBoot)
DRV:64bit: - [2013/10/24 18:34:32 | 000,248,240 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\Drivers\WdFilter.sys -- (WdFilter)
DRV:64bit: - [2013/10/10 07:53:35 | 000,096,600 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\wfplwfs.sys -- (WFPLWFS)
DRV:64bit: - [2013/10/05 02:10:20 | 000,285,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\spaceport.sys -- (spaceport)
DRV:64bit: - [2013/10/01 22:50:07 | 000,447,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\USBHUB3.SYS -- (USBHUB3)
DRV:64bit: - [2013/08/16 01:41:13 | 000,058,200 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\Drivers\dam.sys -- (dam)
DRV:64bit: - [2013/08/10 02:30:22 | 000,151,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\tpm.sys -- (TPM)
DRV:64bit: - [2013/07/24 11:02:55 | 000,034,816 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\VClone.sys -- (VClone)
DRV:64bit: - [2013/07/09 04:04:07 | 000,120,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpioclx.sys -- (GPIOClx0101)
DRV:64bit: - [2013/07/01 21:41:47 | 000,337,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\USBXHCI.SYS -- (USBXHCI)
DRV:64bit: - [2013/07/01 21:41:47 | 000,213,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\UCX01000.SYS -- (UCX01000)
DRV:64bit: - [2013/06/29 02:15:54 | 000,195,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2013/05/31 23:08:57 | 000,037,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthAvrcpTg.sys -- (BthAvrcpTg)
DRV:64bit: - [2013/03/04 08:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys -- (ElbyCDIO)
DRV:64bit: - [2013/03/02 06:57:46 | 000,077,544 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\storahci.sys -- (storahci)
DRV:64bit: - [2013/03/02 06:39:38 | 000,069,864 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\pdc.sys -- (pdc)
DRV:64bit: - [2013/01/09 21:53:32 | 000,028,904 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpiowin32.sys -- (msgpiowin32)
DRV:64bit: - [2012/11/26 23:55:44 | 000,029,952 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthhfHid.sys -- (bthhfhid)
DRV:64bit: - [2012/11/20 00:54:31 | 000,039,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hidi2c.sys -- (hidi2c)
DRV:64bit: - [2012/11/05 23:55:44 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\fxppm.sys -- (FxPPM)
DRV:64bit: - [2012/10/12 04:08:01 | 000,027,880 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012/10/11 03:25:48 | 000,056,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdstor.sys -- (sdstor)
DRV:64bit: - [2012/10/11 01:19:44 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2012/10/06 00:12:34 | 009,004,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2012/09/20 03:55:27 | 003,265,256 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2012/09/20 03:55:24 | 000,533,224 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2012/07/26 01:26:46 | 000,025,328 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\WINDOWS\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012/07/26 01:26:45 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\condrv.sys -- (condrv)
DRV:64bit: - [2012/07/26 01:00:58 | 000,322,800 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\VSTXRAID.SYS -- (VSTXRAID)
DRV:64bit: - [2012/07/26 01:00:58 | 000,106,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\VerifierExt.sys -- (VerifierExt)
DRV:64bit: - [2012/07/26 01:00:58 | 000,097,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\uaspstor.sys -- (UASPStor)
DRV:64bit: - [2012/07/26 01:00:57 | 000,077,040 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\acpiex.sys -- (acpiex)
DRV:64bit: - [2012/07/26 01:00:55 | 000,064,240 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\mvumis.sys -- (mvumis)
DRV:64bit: - [2012/07/26 01:00:55 | 000,030,960 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2012/07/26 01:00:52 | 000,092,400 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2012/07/26 01:00:52 | 000,081,136 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sss.sys -- (LSI_SSS)
DRV:64bit: - [2012/07/26 01:00:52 | 000,064,752 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2012/07/26 01:00:51 | 000,113,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)
DRV:64bit: - [2012/07/26 01:00:51 | 000,081,136 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\EhStorClass.sys -- (EhStorClass)
DRV:64bit: - [2012/07/26 01:00:49 | 000,258,288 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2012/07/26 01:00:49 | 000,106,736 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\3ware.sys -- (3ware)
DRV:64bit: - [2012/07/26 01:00:49 | 000,076,016 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2012/07/26 01:00:48 | 000,026,352 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2012/07/26 00:57:54 | 000,361,200 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\clfs.sys -- (CLFS)
DRV:64bit: - [2012/07/26 00:53:16 | 000,067,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vpci.sys -- (vpci)
DRV:64bit: - [2012/07/25 23:17:38 | 000,036,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\terminpt.sys -- (terminpt)
DRV:64bit: - [2012/07/25 22:29:47 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2012/07/25 22:29:14 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mshidumdf.sys -- (mshidumdf)
DRV:64bit: - [2012/07/25 22:29:08 | 000,048,640 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicDisplay.sys -- (BasicDisplay)
DRV:64bit: - [2012/07/25 22:29:03 | 000,024,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\HyperVideo.sys -- (HyperVideo)
DRV:64bit: - [2012/07/25 22:28:52 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicRender.sys -- (BasicRender)
DRV:64bit: - [2012/07/25 22:27:58 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vmgencounter.sys -- (gencounter)
DRV:64bit: - [2012/07/25 22:27:41 | 000,018,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\kdnic.sys -- (kdnic)
DRV:64bit: - [2012/07/25 22:27:37 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpitime.sys -- (acpitime)
DRV:64bit: - [2012/07/25 22:27:33 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\npsvctrig.sys -- (npsvctrig)
DRV:64bit: - [2012/07/25 22:27:29 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WpdUpFltr.sys -- (WpdUpFltr)
DRV:64bit: - [2012/07/25 22:27:16 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpipagr.sys -- (acpipagr)
DRV:64bit: - [2012/07/25 22:27:01 | 000,011,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hyperkbd.sys -- (hyperkbd)
DRV:64bit: - [2012/07/25 22:26:46 | 000,062,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SerCx.sys -- (SerCx)
DRV:64bit: - [2012/07/25 22:26:43 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SpbCx.sys -- (SpbCx)
DRV:64bit: - [2012/07/25 22:26:34 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2012/07/25 22:26:13 | 000,051,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\bthhfenum.sys -- (BthHFEnum)
DRV:64bit: - [2012/07/25 22:25:57 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2012/07/25 22:25:56 | 000,057,344 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012/07/25 22:25:13 | 000,045,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\wpcfltr.sys -- (wpcfltr)
DRV:64bit: - [2012/07/25 22:25:01 | 000,126,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\NdisImPlatform.sys -- (NdisImPlatform)
DRV:64bit: - [2012/07/25 22:23:53 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mslldp.sys -- (MsLldp)
DRV:64bit: - [2012/07/25 22:23:42 | 000,097,792 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\Drivers\Ndu.sys -- (Ndu)
DRV:64bit: - [2012/06/02 10:31:56 | 000,589,824 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\Rt630x64.sys -- (RTL8168)
DRV:64bit: - [2012/06/02 10:31:32 | 002,935,808 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/10/19 23:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\HECIx64.sys -- (MEIx64)
DRV - [2013/03/19 11:08:28 | 000,130,320 | ---- | M] (CyberLink Corp.) [2014/03/20 06:00:14] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl -- ({09F57980-3432-4AFC-957D-27AC45FAE1F5})
DRV - [2010/01/18 10:36:44 | 000,014,136 | ---- | M] (MSI) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys -- (NTIOLib_X64)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com/?type=586383&fr=spigot-yhp-ie
IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\..\SearchScopes\{44FD12AE-49C5-40CA-9683-94AE454FDA0F}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=586383&p={searchTerms}
IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.startup.homepage: "http://search.yahoo.com/?type=586383&fr=spigot-yhp-ff"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:28.0
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=586383&p="
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2014/03/20 05:32:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\fordg_000\AppData\Roaming\Mozilla\Extensions
[2014/03/23 23:22:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\extensions
[2014/03/31 00:51:56 | 000,000,803 | ---- | M] () -- C:\Users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\searchplugins\yahoo_ff.xml
[2014/03/20 05:44:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2014/03/20 05:32:21 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
O1 HOSTS File: ([2012/07/26 01:26:49 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [ShadowPlay] C:\WINDOWS\SysNative\nvspcap64.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [PowerDVD13Agent] C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe (CyberLink Corp.)
O4 - HKU\S-1-5-21-1752066307-218487803-444230657-1001..\Run: [DellSystemDetect] C:\Users\fordg_000\AppData\Local\Apps\2.0\WC3AHZBR.6YB\KDP44OTC.4Z0\dell..tion_0f612f649c4a10af_0005.0005_9914611622934cec\DellSystemDetect.exe (Dell)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1752066307-218487803-444230657-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1752066307-218487803-444230657-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O15 - HKU\S-1-5-21-1752066307-218487803-444230657-1001\..Trusted Domains: dell.com ([]* in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F3852D2A-8910-4C3A-B06C-C50836462624}: DhcpNameServer = 75.75.75.75 75.75.76.76
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\WINDOWS\SysNative\igfxdev.dll (Intel Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) - File not found
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2014/04/04 02:29:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
[2014/04/04 02:26:26 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014/04/04 02:15:31 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\fordg_000\Desktop\OTL.exe
[2014/04/04 02:15:27 | 001,038,974 | ---- | C] (Thisisu) -- C:\Users\fordg_000\Desktop\JRT.exe
[2014/04/04 02:05:50 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\CrashDumps
[2014/04/03 14:04:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014/04/03 14:04:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2014/04/03 14:04:25 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\temp
[2014/04/03 13:58:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2014/04/03 13:58:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2014/04/03 13:58:15 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2014/04/03 13:58:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2014/04/03 13:58:12 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014/04/03 13:58:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
[2014/04/03 13:54:44 | 005,193,944 | R--- | C] (Swearware) -- C:\Users\fordg_000\Desktop\ComboFix.exe
[2014/04/03 03:29:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared
[2014/04/03 03:24:27 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Desktop\mbar
[2014/04/03 03:21:18 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Desktop\RK_Quarantine
[2014/04/01 16:02:23 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\IsolatedStorage
[2014/04/01 15:29:23 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\IsolatedStorage
[2014/04/01 14:48:35 | 000,423,240 | ---- | C] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\raqimtca.sys
[2014/04/01 14:45:48 | 000,000,000 | ---D | C] -- C:\Program Files\AdTrustMedia
[2014/04/01 14:45:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo Downloader
[2014/04/01 14:45:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
[2014/04/01 14:41:51 | 000,423,240 | ---- | C] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\dgwtjwvu.sys
[2014/04/01 14:41:44 | 000,423,240 | ---- | C] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\jswsyyiw.sys
[2014/04/01 14:41:43 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
[2014/03/31 13:35:23 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Apple Computer
[2014/03/31 13:23:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2014/03/31 13:15:00 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\ElevatedDiagnostics
[2014/03/31 13:07:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2014/03/31 13:07:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
[2014/03/31 13:07:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
[2014/03/31 13:06:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
[2014/03/31 13:06:39 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Apple
[2014/03/31 13:06:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
[2014/03/31 13:06:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
[2014/03/31 02:33:10 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Sony Creative Software Inc
[2014/03/31 01:20:44 | 000,000,000 | ---D | C] -- C:\ProgramData\IsolatedStorage
[2014/03/31 01:20:03 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Vegasaur
[2014/03/31 01:20:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Vegasaur
[2014/03/31 01:20:02 | 000,000,000 | ---D | C] -- C:\Program Files\Vegasaur
[2014/03/31 01:10:41 | 000,119,512 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\MBAMSwissArmy.sys
[2014/03/31 01:10:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2014/03/31 01:10:32 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbamchameleon.sys
[2014/03/31 01:10:32 | 000,063,192 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mwac.sys
[2014/03/31 01:10:32 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbam.sys
[2014/03/31 01:10:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
[2014/03/31 01:10:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014/03/30 22:25:40 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Documents\OFX Presets
[2014/03/30 21:05:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
[2014/03/30 21:05:56 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Subtitle Edit
[2014/03/30 21:05:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Subtitle Edit
[2014/03/30 17:22:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Rosetta Stone
[2014/03/29 04:07:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rosetta Stone
[2014/03/22 15:51:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysNative\MRT
[2014/03/21 03:16:47 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Macromedia
[2014/03/20 15:55:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
[2014/03/20 15:55:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
[2014/03/20 15:55:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
[2014/03/20 15:54:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services
[2014/03/20 15:54:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\PCHEALTH
[2014/03/20 15:54:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework
[2014/03/20 15:54:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
[2014/03/20 15:53:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
[2014/03/20 15:53:26 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2014/03/20 15:53:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
[2014/03/20 15:53:06 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Microsoft Help
[2014/03/20 15:53:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
[2014/03/20 15:53:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
[2014/03/20 15:51:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
[2014/03/20 15:51:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Elaborate Bytes
[2014/03/20 15:13:12 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\vlc
[2014/03/20 08:19:02 | 000,000,000 | ---D | C] -- C:\Recovery
[2014/03/20 08:17:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[2014/03/20 08:14:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2014/03/20 06:47:18 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\.MakeMKV
[2014/03/20 06:39:17 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Publish Providers
[2014/03/20 06:39:09 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\NVIDIA
[2014/03/20 06:35:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\spool
[2014/03/20 06:35:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony
[2014/03/20 06:03:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2014/03/20 06:03:41 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Sony
[2014/03/20 06:03:41 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2014/03/20 06:03:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
[2014/03/20 06:00:42 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Cyberlink SoftDMA
[2014/03/20 06:00:40 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Documents\CyberLink
[2014/03/20 06:00:40 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\CyberLink
[2014/03/20 06:00:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies
[2014/03/20 06:00:12 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\MediaServer
[2014/03/20 06:00:12 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CyberLink
[2014/03/20 05:59:56 | 000,000,000 | ---D | C] -- C:\ProgramData\PDVD
[2014/03/20 05:59:55 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
[2014/03/20 05:59:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\NV
[2014/03/20 05:59:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysNative\NV
[2014/03/20 05:59:49 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\CyberLink
[2014/03/20 05:59:49 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2014/03/20 05:59:48 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 13
[2014/03/20 05:58:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CyberLink
[2014/03/20 05:56:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Reference Assemblies
[2014/03/20 05:56:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSBuild
[2014/03/20 05:56:01 | 000,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies
[2014/03/20 05:56:00 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
[2014/03/20 05:52:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
[2014/03/20 05:52:32 | 000,000,000 | ---D | C] -- C:\ProgramData\install_clap
[2014/03/20 05:51:56 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\WinRAR
[2014/03/20 05:51:43 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
[2014/03/20 05:51:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
[2014/03/20 05:51:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinRAR
[2014/03/20 05:50:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2014/03/20 05:50:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN
[2014/03/20 05:49:33 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Audacity
[2014/03/20 05:49:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity
[2014/03/20 05:44:26 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\NVIDIA Corporation
[2014/03/20 05:44:00 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\NVIDIA
[2014/03/20 05:43:54 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
[2014/03/20 05:43:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2014/03/20 05:43:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2014/03/20 05:42:58 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
[2014/03/20 05:42:30 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Skype
[2014/03/20 05:42:24 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Skype
[2014/03/20 05:42:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2014/03/20 05:42:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2014/03/20 05:42:21 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
[2014/03/20 05:42:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2014/03/20 05:41:34 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Sony
[2014/03/20 05:40:16 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Documents\Freemake
[2014/03/20 05:40:16 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
[2014/03/20 05:40:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
[2014/03/20 05:40:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake
[2014/03/20 05:40:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Freemake
[2014/03/20 05:38:17 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MakeMKV
[2014/03/20 05:38:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MakeMKV
[2014/03/20 05:37:45 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Programs
[2014/03/20 05:34:21 | 000,439,296 | ---- | C] (Sendori) -- C:\WINDOWS\SysNative\plsapp64.dll
[2014/03/20 05:33:30 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\BitTorrent
[2014/03/20 05:32:30 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Mozilla
[2014/03/20 05:32:29 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Mozilla
[2014/03/20 05:32:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2014/03/20 05:32:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2014/03/20 05:32:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2014/03/20 05:32:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\InstallShield Installation Information
[2014/03/20 05:32:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\msi
[2014/03/20 05:31:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2014/03/20 05:28:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
[2014/03/20 05:28:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intel

fordgt0589 · Apr 4, 2014

[2014/03/20 05:28:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
[2014/03/20 05:28:36 | 000,056,832 | ---- | C] (Khronos Group) -- C:\WINDOWS\SysNative\OpenCL.DLL
[2014/03/20 05:28:36 | 000,056,320 | ---- | C] (Khronos Group) -- C:\WINDOWS\SysWow64\OpenCL.DLL
[2014/03/20 05:27:03 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell
[2014/03/20 05:26:20 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Deployment
[2014/03/20 05:26:20 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Apps
[2014/03/20 05:24:20 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Macromedia
[2014/03/20 05:21:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2014/03/20 05:21:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Searches
[2014/03/20 05:21:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Contacts
[2014/03/20 05:21:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2014/03/20 05:21:06 | 000,000,000 | -H-D | C] -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
[2014/03/20 05:21:04 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Adobe
[2014/03/20 05:20:34 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\VirtualStore
[2014/03/20 05:20:25 | 000,000,000 | ---D | C] -- C:\ProgramData\PRICache
[2014/03/20 05:20:25 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Packages
[2014/03/20 05:20:06 | 000,000,000 | --SD | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Videos
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Saved Games
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Pictures
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Music
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Links
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Favorites
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Downloads
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Documents
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Desktop
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\AppData\Local\Temporary Internet Files
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Templates
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Start Menu
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\SendTo
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Recent
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\PrintHood
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\NetHood
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Documents\My Videos
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Documents\My Pictures
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Documents\My Music
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\My Documents
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Local Settings
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\AppData\Local\History
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Cookies
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Application Data
[2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\AppData\Local\Application Data
[2014/03/20 05:20:06 | 000,000,000 | -H-D | C] -- C:\Users\fordg_000\AppData
[2014/03/20 05:20:06 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Microsoft
[2014/03/20 05:20:06 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2014/03/20 04:59:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\Panther
[2014/03/16 15:22:38 | 000,000,000 | ---D | C] -- C:\Config.Msi
========== Files - Modified Within 30 Days ==========
[2014/04/04 02:34:37 | 000,848,230 | ---- | M] () -- C:\WINDOWS\SysNative\PerfStringBackup.INI
[2014/04/04 02:34:37 | 000,718,176 | ---- | M] () -- C:\WINDOWS\SysNative\perfh009.dat
[2014/04/04 02:34:37 | 000,132,542 | ---- | M] () -- C:\WINDOWS\SysNative\perfc009.dat
[2014/04/04 02:29:36 | 000,067,584 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2014/04/04 02:27:50 | 000,119,512 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\MBAMSwissArmy.sys
[2014/04/04 02:27:35 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys
[2014/04/04 02:27:32 | 2482,118,655 | -HS- | M] () -- C:\hiberfil.sys
[2014/04/04 02:15:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\fordg_000\Desktop\OTL.exe
[2014/04/04 02:15:30 | 001,038,974 | ---- | M] (Thisisu) -- C:\Users\fordg_000\Desktop\JRT.exe
[2014/04/04 02:15:25 | 001,426,178 | ---- | M] () -- C:\Users\fordg_000\Desktop\adwcleaner.exe
[2014/04/03 17:07:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/04/03 15:28:22 | 000,099,984 | ---- | M] () -- C:\Users\fordg_000\Desktop\Capture_20140403.avi.sfk
[2014/04/03 13:54:48 | 005,193,944 | R--- | M] (Swearware) -- C:\Users\fordg_000\Desktop\ComboFix.exe
[2014/04/03 03:24:28 | 000,091,352 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbamchameleon.sys
[2014/04/02 04:23:10 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\SysNative\drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
[2014/04/01 14:48:35 | 000,423,240 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\raqimtca.sys
[2014/04/01 14:43:34 | 000,002,259 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2014/04/01 14:41:51 | 000,423,240 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\dgwtjwvu.sys
[2014/04/01 14:41:44 | 000,423,240 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\jswsyyiw.sys
[2014/03/31 00:51:40 | 000,007,632 | ---- | M] () -- C:\Users\fordg_000\AppData\Local\Resmon.ResmonCfg
[2014/03/29 04:03:24 | 000,565,652 | ---- | M] () -- C:\Users\fordg_000\Documents\0127132031.jpg
[2014/03/29 02:50:27 | 000,422,160 | ---- | M] () -- C:\WINDOWS\SysNative\FNTCACHE.DAT
[2014/03/20 05:59:48 | 000,001,411 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 13.lnk
[2014/03/20 05:50:10 | 000,001,066 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2014/03/20 05:42:22 | 000,002,697 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2014/03/20 05:38:17 | 000,000,991 | ---- | M] () -- C:\Users\fordg_000\Desktop\MakeMKV.lnk
[2014/03/20 05:32:23 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2014/03/20 05:23:43 | 000,001,424 | ---- | M] () -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2014/03/05 09:26:22 | 000,063,192 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mwac.sys
[2014/03/05 09:26:04 | 000,025,816 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbam.sys
========== Files Created - No Company Name ==========
[2014/04/04 02:15:20 | 001,426,178 | ---- | C] () -- C:\Users\fordg_000\Desktop\adwcleaner.exe
[2014/04/04 02:14:16 | 000,001,509 | ---- | C] () -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RosettaStoneVersion3.lnk
[2014/04/03 15:28:10 | 000,099,984 | ---- | C] () -- C:\Users\fordg_000\Desktop\Capture_20140403.avi.sfk
[2014/04/03 13:58:15 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2014/04/03 13:58:15 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2014/04/03 13:58:15 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2014/04/03 13:58:15 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2014/04/03 13:58:15 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2014/04/02 04:23:10 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\SysNative\drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
[2014/04/01 14:43:34 | 000,002,259 | ---- | C] () -- C:\WINDOWS\epplauncher.mif
[2014/03/31 13:06:38 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
[2014/03/31 00:48:30 | 000,007,632 | ---- | C] () -- C:\Users\fordg_000\AppData\Local\Resmon.ResmonCfg
[2014/03/29 04:02:58 | 000,565,652 | ---- | C] () -- C:\Users\fordg_000\Documents\0127132031.jpg
[2014/03/29 02:50:21 | 000,422,160 | ---- | C] () -- C:\WINDOWS\SysNative\FNTCACHE.DAT
[2014/03/26 04:11:09 | 000,110,592 | ---- | C] () -- C:\WINDOWS\SysNative\OEMLicense.dll
[2014/03/26 03:51:12 | 000,385,614 | ---- | C] () -- C:\WINDOWS\SysNative\ApnDatabase.xml
[2014/03/22 15:43:21 | 000,083,968 | ---- | C] () -- C:\WINDOWS\SysWow64\OEMLicense.dll
[2014/03/21 03:16:41 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2014/03/20 08:14:24 | 268,435,456 | -HS- | C] () -- C:\swapfile.sys
[2014/03/20 05:59:51 | 003,649,185 | ---- | C] () -- C:\WINDOWS\SysNative\nvcoproc.bin
[2014/03/20 05:59:48 | 000,001,411 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 13.lnk
[2014/03/20 05:58:03 | 000,024,544 | ---- | C] () -- C:\WINDOWS\SysNative\nvinfo.pb
[2014/03/20 05:50:10 | 000,001,066 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
[2014/03/20 05:49:32 | 000,001,019 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
[2014/03/20 05:42:22 | 000,002,697 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2014/03/20 05:38:17 | 000,000,991 | ---- | C] () -- C:\Users\fordg_000\Desktop\MakeMKV.lnk
[2014/03/20 05:32:23 | 000,001,159 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2014/03/20 05:32:23 | 000,001,147 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2014/03/20 05:23:43 | 000,001,424 | ---- | C] () -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2014/03/20 05:21:04 | 000,001,430 | ---- | C] () -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2014/03/20 05:20:06 | 000,000,352 | ---- | C] () -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
[2014/03/20 05:20:06 | 000,000,334 | ---- | C] () -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
[2012/10/06 00:12:28 | 000,598,780 | ---- | C] () -- C:\WINDOWS\SysWow64\igvpkrng700.bin
[2012/10/06 00:12:22 | 000,755,048 | ---- | C] () -- C:\WINDOWS\SysWow64\igcodeckrng700.bin
[2012/10/06 00:12:10 | 000,064,512 | ---- | C] () -- C:\WINDOWS\SysWow64\igdde32.dll
[2012/07/26 04:13:10 | 000,215,943 | ---- | C] () -- C:\WINDOWS\SysWow64\dssec.dat
[2012/07/26 04:13:09 | 000,000,741 | ---- | C] () -- C:\WINDOWS\SysWow64\NOISE.DAT
[2012/07/26 03:21:26 | 000,067,584 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2012/07/25 21:17:42 | 000,043,520 | ---- | C] () -- C:\WINDOWS\SysWow64\BWContextHandler.dll
[2012/07/25 16:37:29 | 000,043,131 | ---- | C] () -- C:\WINDOWS\mib.bin
[2012/07/25 16:28:31 | 000,364,544 | ---- | C] () -- C:\WINDOWS\SysWow64\msjetoledb40.dll
[2012/06/02 10:31:19 | 000,673,088 | ---- | C] () -- C:\WINDOWS\SysWow64\mlang.dat
========== ZeroAccess Check ==========
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013/12/07 02:36:58 | 019,751,936 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013/12/07 01:15:36 | 017,560,576 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012/07/25 23:05:38 | 001,004,544 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2012/07/25 23:18:27 | 000,784,896 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012/07/25 23:07:41 | 000,455,680 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2014/04/03 15:44:38 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Audacity
[2014/04/04 02:15:45 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\BitTorrent
[2014/04/01 15:29:23 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\IsolatedStorage
[2014/03/20 06:39:17 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Publish Providers
[2014/03/26 14:35:58 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Sony
[2014/03/31 02:33:10 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Sony Creative Software Inc
[2014/03/30 23:52:38 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Subtitle Edit
[2014/03/31 01:20:03 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Vegasaur
========== Purity Check ==========

< End of report >

OTL Extras logfile created on: 4/4/2014 2:34:50 AM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\fordg_000\Desktop
64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16843)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
7.89 Gb Total Physical Memory | 6.20 Gb Available Physical Memory | 78.64% Memory free
9.08 Gb Paging File | 7.29 Gb Available in Paging File | 80.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931.17 Gb Total Space | 791.34 Gb Free Space | 84.98% Space Free | Partition Type: NTFS
Drive D: | 45.06 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Computer Name: SHAWNPC | User Name: fordg_000 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\WINDOWS\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\WINDOWS\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-1752066307-218487803-444230657-1001\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{038763C0-C932-4BEC-B8F5-DD68E2E3397F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{05A97EBA-1E84-438C-8595-D2773B14BC63}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{169266B5-B9C7-409D-BB8C-A3AA65E86250}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{19292D58-FF83-4FB5-BB56-B006192074B0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{1D31017C-E720-4899-9E19-640D052E76D3}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{30FC6A2A-1034-4043-9898-8B7094FFE134}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{35063D56-1038-4F15-BDA2-9805CEB30325}" = lport=139 | protocol=6 | dir=in | app=system |
"{3DA3E271-B237-4633-849A-BECDC12FB3BD}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{44E417DB-5321-4582-A4CD-20876CA4A1CD}" = lport=137 | protocol=17 | dir=in | app=system |
"{46F43F0C-7DD6-483A-BD50-F691AFCBA6CA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{48B9AF3C-F466-488C-9EAA-1CC1B45A0FCD}" = lport=10243 | protocol=6 | dir=in | app=system |
"{4CEF7D17-FB5B-4A24-8D02-73F9275148AE}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{4E64DC8E-CDE4-4F6F-970A-E898EDE267A3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{4F1DD5C1-380C-492C-8199-3BDA4D764F1C}" = rport=137 | protocol=17 | dir=out | app=system |
"{54316FF0-87E8-4866-AFB3-9D03C5F494C0}" = rport=139 | protocol=6 | dir=out | app=system |
"{694FC807-E2DB-41B5-97F4-DBE1B05F1F5F}" = lport=2869 | protocol=6 | dir=in | app=system |
"{7667398E-EEA9-472E-9A62-1D118A14B119}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
"{7735DAE5-23D3-4403-90CE-D2A8B20F4CD7}" = lport=445 | protocol=6 | dir=in | app=system |
"{8E198130-63CD-442C-83A4-46F4B84E6FA6}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9F2348ED-A60C-42E8-B7AC-D037B9C8ECED}" = rport=10243 | protocol=6 | dir=out | app=system |
"{A99E3F8C-D9A0-4EC5-9D2C-4B7A2AA8B029}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B933D64F-B6D2-4F4E-B471-981A13EC817B}" = rport=445 | protocol=6 | dir=out | app=system |
"{C4E5BB10-7D7C-49C8-9A48-93B9559CA5C3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{CA8EC181-B5EE-40B2-AD74-A613F5C055E1}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{D5208722-E277-4DA4-909C-55E6541BD2C3}" = lport=138 | protocol=17 | dir=in | app=system |
"{E76C728D-92DC-48B8-8A64-8F86993C3E1F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{FAD45480-7921-4543-B04B-8C0D51FBD0CE}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
"{FC22B03E-77C3-4714-B35E-895C0FCB9296}" = rport=138 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0D91A9C5-6B54-44F6-8641-E8E75E5F9D1F}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{10A96EAC-D808-43BC-9A41-73739EB363D4}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{1B2FA862-C771-4B2E-8B75-57D375BA60D9}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\powerdvd13ml.exe |
"{20736FB5-4D16-4BB3-92A6-5EE84DEBD275}" = protocol=6 | dir=in | app=c:\users\fordg_000\appdata\roaming\bittorrent\bittorrent.exe |
"{2C577C60-E25F-49E3-B793-68363675F525}" = dir=out | name=@{microsoft.xboxlivegames_1.3.10.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
"{2F72F7E8-C5D5-4F68-898A-FE3F8B00FE01}" = protocol=17 | dir=in | app=c:\users\fordg_000\appdata\local\temp\7zs962c.tmp\symnrt.exe |
"{3081EE5F-D3A7-4816-92C0-7B827018ADF1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3115986D-208B-47CC-BB40-AFBB7AFF17E0}" = dir=out | name=@{microsoft.reader_6.2.9200.20780_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{328E680B-45B5-452F-AA2A-344F531A4E26}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{3DD2F4CE-359C-48CD-B2A8-76CED15E4A72}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{3FA04318-154D-4E27-AFCF-0B4C5F891F70}" = dir=out | name=@{microsoft.bingnews_2.0.0.308_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
"{43672B1B-E478-4971-8DFB-1E2E804A48AC}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\powerdvd13.exe |
"{4A7A287B-1429-49C4-A504-68830A1907D3}" = dir=out | name=@{microsoft.windowsphotos_16.4.4396.311_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{4F0A0478-9D3A-411E-8095-90F715F6E189}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{555AB38F-D5C4-4302-A405-2364F9524157}" = dir=out | name=@{microsoft.bingweather_2.0.0.310_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
"{593D4978-6A91-444C-AD41-E92BFAC4EAB6}" = dir=out | name=@{microsoft.bingsports_2.0.0.310_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} |
"{60E83EC1-1F2F-46EB-8B78-B9A96FEE88F4}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\powerdvd13agent.exe |
"{628A311A-DD99-4957-BA3D-551C3C6B38AF}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{62D34697-7C69-48D2-8751-39333B6B8776}" = protocol=6 | dir=in | app=c:\users\fordg_000\appdata\local\temp\7zs962c.tmp\symnrt.exe |
"{6986F23F-7B85-47C8-9D2E-F661C647A4E0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{69F1CDF4-BC76-439C-B3E8-1D60D718A639}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\movie\powerdvd.exe |
"{6CE53056-A0A1-46B2-BFA1-84694D62C46B}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{6FB1DD5A-77FF-4252-9B4A-73A185A439C2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{7A91A74E-56BF-4C92-A7C2-1FD4090EFF59}" = protocol=6 | dir=in | app=c:\users\fordg_000\downloads\bittorrent.exe |
"{7C56402F-8F63-4F4F-84E9-0FF6CB64B431}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
"{7E8AA5FD-A014-4C06-B07F-D8BFBD4FDECD}" = protocol=17 | dir=in | app=c:\users\fordg_000\downloads\bittorrent.exe |
"{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{91D999A4-E5FA-4B8E-A936-4B4D86F52648}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4396.311_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
"{95DFEDBC-4BCD-4C7B-8E16-A79B943B94FE}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{976007EB-E172-46EA-A923-E4C796021C70}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{97AC5E77-DF11-4481-A823-9DCC5C945700}" = dir=out | name=@{microsoft.bingtravel_2.0.0.308_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
"{9920E0F2-9637-465E-9C6D-651AA40D5558}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{9BAE036E-CD07-4CDE-A069-1A6874DFD6EF}" = dir=out | name=@{microsoft.zunevideo_1.5.767.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} |
"{A7905E8D-7097-4321-9E98-F682E4B72880}" = dir=in | name=@{microsoft.windowsphotos_16.4.4396.311_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
"{ADD8307C-33F5-49A1-B388-E0607F6DAE4E}" = dir=out | name=@{yahooinc.yahoomail_1.7.0.23_neutral__xvnatx83ncrvj?ms-resource://yahooinc.yahoomail/resources/str_branding_mail} |
"{B00C0A88-CD7E-4613-B1E7-BEFB52F2BC84}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B1D5D6C4-C80D-4380-A57D-31AFA123D62F}" = protocol=6 | dir=out | app=system |
"{B2D572A6-7432-493D-8D3C-A97D919C0E83}" = dir=out | name=@{microsoft.zunemusic_1.5.216.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/ids_manifest_music_app_name} |
"{C2C6B8F9-F2BA-40DE-99FC-2B12A9AF6B93}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\kernel\dms\clmsserverpdvd13.exe |
"{C6C35D07-C2AF-4620-BAF5-6D38B5BAB185}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C7E64BFC-8248-4E82-A2CC-2110EACD001C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{CA376988-8260-4260-A614-FFD6E0F15E38}" = dir=in | name=@{microsoft.reader_6.2.9200.20780_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
"{CC537FE6-D680-4918-86C7-2DAFD4D8588F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CEB632EF-910D-4012-84AB-FF2459999AA0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D33A093A-54D3-4DA1-B189-251E986A7C15}" = protocol=17 | dir=in | app=c:\users\fordg_000\appdata\roaming\bittorrent\bittorrent.exe |
"{DCEF16CA-DE1A-4728-B494-1AECE318A30C}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\kernel\dmr\powerdvd13dmrengine.exe |
"{DDC93753-4720-44C7-A7CD-1F9AD25F6585}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{DFFEADBA-ED55-429B-B0B2-3CFED35C8F6C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E08C69F0-1131-47AB-BF87-C3834C95C9E3}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{E0A266BA-8C73-4606-BBEF-4D528BFDE6EB}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\movie\powerdvd cinema\powerdvdcinema13.exe |
"{E10CBA22-A9D3-436E-A92E-5E64C65B2399}" = dir=out | name=@{microsoft.bingfinance_2.0.0.308_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} |
"{E5206F96-E280-43FF-9BD9-7A51C7D396C4}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
"{E727DCE6-279F-4A26-BC55-A40484138F17}" = dir=out | name=@{microsoft.bingmaps_1.6.1821.2624_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
"{E73E73EE-CA82-4D82-8FAB-FB0E905F607B}" = dir=out | name=@{microsoft.bing_1.5.1.259_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
"{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
"{E97069CF-CCAE-4E42-9B7D-E61EBC0C24D5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
"{EE6B0FFB-BECC-4937-AF75-59DEA234AFA6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{F95211E3-D564-42FD-B72C-346E4DFA53AF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{314DDDC0-E935-11E0-8F9F-F04DA23A5C58}" = Vegas Pro 11.0 (64-bit)
"{33C19CDE-E935-11E0-A0DA-F04DA23A5C58}" = MSVCRT Redists
"{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
"{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
"{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 335.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 335.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 335.23
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience" = NVIDIA GeForce Experience 1.8.2
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 335.21
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus Update 11.10.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.13.1220
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 11.10.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.LEDVisualizer" = NVIDIA LED Visualizer 1.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamC" = GeForce Experience NvStream Client Components
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv" = SHIELD Streaming
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.30.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Network.Service" = NVIDIA Network Service
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShadowPlay" = NVIDIA ShadowPlay 11.10.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Update.Core" = NVIDIA Update Core
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver" = NVIDIA Virtual Audio 1.2.20
"Vegasaur_is1" = Vegasaur 1.9.2
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{111EE7DF-FC45-40C7-98A7-753AC46B12FB}" = QuickTime 7
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{3CFDF154-7E60-4E98-A8DF-C693A4F8E6B6}" = CyberLink PowerDVD 13
"{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support
"{6AEFCA01-8DF1-11E1-A17B-F04DA23A5C58}" = Vegas Pro 11.0
"{70CB6C40-8DF1-11E1-BDCF-F04DA23A5C58}" = MSVCRT Redists
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}" = Skype™ 6.14
"{80407BA7-7763-4395-AB98-5233F1B34E65}" = NVIDIA PhysX
"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
"{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
"{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
"{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
"{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
"{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
"{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
"{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
"{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
"{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
"{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
"{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
"{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{B7D9BAAA-F068-4BF8-B929-462C3A8AB677}" = MSI ODD Monitor
"{BB285C9F-C821-4770-8970-56C4AB52C87E}" = Skype Click to Call
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin
"Audacity_is1" = Audacity 2.0.5
"Freemake Video Converter_is1" = Freemake Video Converter version 4.1.3
"InstallShield_{3CFDF154-7E60-4E98-A8DF-C693A4F8E6B6}" = CyberLink PowerDVD 13
"InstallShield_{B7D9BAAA-F068-4BF8-B929-462C3A8AB677}" = MSI ODD Monitor
"MakeMKV" = MakeMKV v1.8.9
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.00.0.1000
"Mozilla Firefox 28.0 (x86 en-US)" = Mozilla Firefox 28.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"SubtitleEdit_is1" = Subtitle Edit 3.3.14
"VirtualCloneDrive" = VirtualCloneDrive
"VLC media player" = VLC media player 2.1.3
"WinRAR archiver" = WinRAR 5.10 beta 1 (32-bit)
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-1752066307-218487803-444230657-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"9204f5692a8faf3b" = Dell System Detect
"BitTorrent" = BitTorrent
< End of report >

Broni · Apr 4, 2014

OTL logs look fine.

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center/Action Center
- Windows Update
- Windows Defender
- Other Services
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Please download MiniToolBox, save it to your desktop and run it.

Checkmark following boxes:

Report IE Proxy Settings
Report FF Proxy Settings
List content of Hosts
List IP configuration
List Winsock Entries
List last 10 Event Viewer log
List Devices (do NOT change any settings)
List Restore Points

Click Go and post the result.

fordgt0589 · Apr 4, 2014

Farbar Service Scanner Version: 25-02-2014
Ran by fordg_000 (administrator) on 04-04-2014 at 13:43:21
Running from "C:\Users\fordg_000\Desktop"
Microsoft Windows 8 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============
wuauserv Service is not running. Checking service configuration:
The start type of wuauserv service is OK.
The ImagePath of wuauserv service is OK.
The ServiceDll of wuauserv service is OK.

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys
[2014-03-22 15:43] - [2013-09-03 23:11] - 0576512 ____A (Microsoft Corporation) 7C0E0EDF18D6CC565D7BFBB451709FA5

C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys
[2014-03-22 15:41] - [2013-11-01 01:53] - 2232664 ____A (Microsoft Corporation) DD4249F03598043DED6FA540EB14898A

C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll
[2014-03-26 03:50] - [2013-10-31 01:56] - 0915968 ____A (Microsoft Corporation) 9DE3341BD4E14BC5FADFCAD3019F2D0D

C:\Windows\System32\bfe.dll
[2014-03-22 15:41] - [2013-10-10 05:20] - 0723968 ____A (Microsoft Corporation) 53AA55632B94622F2DC3695E86EF9363

C:\Windows\System32\drivers\mpsdrv.sys
[2014-03-26 03:50] - [2013-10-30 23:42] - 0074752 ____A (Microsoft Corporation) 4CCBBD4944777CA100B9A6C2F149A46F

C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll
[2014-03-26 04:07] - [2013-10-08 18:27] - 3279872 ____A (Microsoft Corporation) 311E5E1976E0BD9110A88B93158055D5

C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll
[2014-03-22 15:41] - [2013-10-24 18:34] - 1571328 ____A (Microsoft Corporation) 8077537B1600AF493E7EE1A7A5C90799

C:\Program Files\Windows Defender\MsMpEng.exe
[2014-03-22 15:41] - [2013-10-25 03:34] - 0016048 ____A (Microsoft Corporation) 0BB1CEE3514CE93A0A4E6376A9038EFF

C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

MiniToolBox by Farbar Version: 23-01-2014
Ran by fordg_000 (administrator) on 04-04-2014 at 13:44:31
Running from "C:\Users\fordg_000\Desktop"
Microsoft Windows 8 (X64)
Boot Mode: Normal
***************************************************************************

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

========================= FF Proxy Settings: ==============================

========================= Hosts content: =================================

========================= IP Configuration: ================================

Dell Wireless 1502 802.11b/g/n = Wi-Fi (Connected)
Realtek PCIe GBE Family Controller = Ethernet (Media disconnected)

# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled
set interface interface="Local Area Connection* 9" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Wi-Fi" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Ethernet" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
set interface interface="Local Area Connection* 11" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled

popd
# End of IPv4 configuration

Windows IP Configuration

Host Name . . . . . . . . . . . . : ShawnPC
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : hsd1.nj.comcast.net.

Wireless LAN adapter Local Area Connection* 11:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
Physical Address. . . . . . . . . : B6-17-31-29-A2-08
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Ethernet adapter Ethernet:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
Physical Address. . . . . . . . . : D4-BE-D9-FC-F8-79
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wi-Fi:

Connection-specific DNS Suffix . : hsd1.nj.comcast.net.
Description . . . . . . . . . . . : Dell Wireless 1502 802.11b/g/n
Physical Address. . . . . . . . . : A4-17-31-29-A2-08
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2601:c:3b00:464:f000:f007:6aff:f55d(Preferred)
Temporary IPv6 Address. . . . . . : 2601:c:3b00:464:5172:a035:c73a:a8a8(Preferred)
Link-local IPv6 Address . . . . . : fe80::f000:f007:6aff:f55d%12(Preferred)
IPv4 Address. . . . . . . . . . . : 10.0.0.5(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, April 4, 2014 4:36:49 AM
Lease Expires . . . . . . . . . . : Friday, April 11, 2014 1:08:19 PM
Default Gateway . . . . . . . . . : fe80::21d:d6ff:fe6d:9861%12
10.0.0.1
DHCP Server . . . . . . . . . . . : 10.0.0.1
DHCPv6 IAID . . . . . . . . . . . : 262412081
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-BC-94-19-A4-17-31-29-A2-08
DNS Servers . . . . . . . . . . . : 2001:558:feed::1
2001:558:feed::2
75.75.75.75
75.75.76.76
NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.hsd1.nj.comcast.net.:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : hsd1.nj.comcast.net.
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 13:

Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2001:0:9d38:90d7:142a:198a:bbc0:53df(Preferred)
Link-local IPv6 Address . . . . . : fe80::142a:198a:bbc0:53df%16(Preferred)
Default Gateway . . . . . . . . . :
NetBIOS over Tcpip. . . . . . . . : Disabled
Server: cdns01.comcast.net
Address: 2001:558:feed::1

Name: google.com
Addresses: 2607:f8b0:4006:807::1009
74.125.226.32
74.125.226.40
74.125.226.34
74.125.226.46
74.125.226.38
74.125.226.33
74.125.226.36
74.125.226.35
74.125.226.39
74.125.226.41
74.125.226.37

Pinging google.com [2607:f8b0:4006:801::1002] with 32 bytes of data:
Request timed out.
Reply from 2607:f8b0:4006:801::1002: time=17ms

Ping statistics for 2607:f8b0:4006:801::1002:
Packets: Sent = 2, Received = 1, Lost = 1 (50% loss),
Approximate round trip times in milli-seconds:
Minimum = 17ms, Maximum = 17ms, Average = 17ms
Server: cdns01.comcast.net
Address: 2001:558:feed::1

Name: yahoo.com
Addresses: 98.139.183.24
206.190.36.45
98.138.253.109

Pinging yahoo.com [206.190.36.45] with 32 bytes of data:
Reply from 206.190.36.45: bytes=32 time=96ms TTL=46
Reply from 206.190.36.45: bytes=32 time=139ms TTL=46

Ping statistics for 206.190.36.45:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 96ms, Maximum = 139ms, Average = 117ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
14...b6 17 31 29 a2 08 ......Microsoft Wi-Fi Direct Virtual Adapter
13...d4 be d9 fc f8 79 ......Realtek PCIe GBE Family Controller
12...a4 17 31 29 a2 08 ......Dell Wireless 1502 802.11b/g/n
1...........................Software Loopback Interface 1
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.0.1 10.0.0.5 25
10.0.0.0 255.255.255.0 On-link 10.0.0.5 281
10.0.0.5 255.255.255.255 On-link 10.0.0.5 281
10.0.0.255 255.255.255.255 On-link 10.0.0.5 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.0.5 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.0.5 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
12 281 ::/0 fe80::21d:d6ff:fe6d:9861
1 306 ::1/128 On-link
16 306 2001::/32 On-link
16 306 2001:0:9d38:90d7:142a:198a:bbc0:53df/128
On-link
12 281 2601:c:3b00:464::/64 On-link
12 281 2601:c:3b00:464:5172:a035:c73a:a8a8/128
On-link
12 281 2601:c:3b00:464:f000:f007:6aff:f55d/128
On-link
12 281 fe80::/64 On-link
16 306 fe80::/64 On-link
16 306 fe80::142a:198a:bbc0:53df/128
On-link
12 281 fe80::f000:f007:6aff:f55d/128
On-link
1 306 ff00::/8 On-link
16 306 ff00::/8 On-link
12 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [67584] (Microsoft Corporation)
Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [67584] (Microsoft Corporation)
Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [55296] (Microsoft Corporation)
Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [21504] (Microsoft Corporation)
Catalog9 01 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 02 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 03 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 04 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 05 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 06 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 07 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 08 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 09 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
Catalog9 10 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\napinsp.dll [66560] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [85504] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [85504] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [72192] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [53760] (Microsoft Corporation)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (04/04/2014 04:30:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SHAWNPC)
Description: Activation of app windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (04/04/2014 04:30:13 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SHAWNPC)
Description: Activation of app windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (04/04/2014 04:29:55 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SHAWNPC)
Description: Activation of app windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

System errors:
=============
Error: (04/04/2014 10:26:38 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
Description: 4

Error: (04/04/2014 08:46:23 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
Description: 4

Error: (04/04/2014 07:49:14 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
Description: 4

Error: (04/04/2014 06:32:43 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
Description: 4

Error: (04/04/2014 05:51:10 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
Description: 4

Error: (04/04/2014 04:36:16 AM) (Source: DCOM) (User: SHAWNPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (04/04/2014 04:35:45 AM) (Source: DCOM) (User: SHAWNPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (04/04/2014 04:35:32 AM) (Source: DCOM) (User: SHAWNPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (04/04/2014 04:35:16 AM) (Source: DCOM) (User: SHAWNPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Error: (04/04/2014 04:35:03 AM) (Source: DCOM) (User: SHAWNPC)
Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

Microsoft Office Sessions:
=========================
Error: (04/04/2014 04:30:29 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: SHAWNPC)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

Error: (04/04/2014 04:30:13 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: SHAWNPC)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

Error: (04/04/2014 04:29:55 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: SHAWNPC)
Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

========================= Devices: ================================

========================= Restore Points ==================================

24-03-2014 05:37:50 Windows Update
31-03-2014 17:06:50 Installed QuickTime 7

**** End of log ****

Broni · Apr 4, 2014

I don't see any issue with your internet connection.
What are the signs you can't connect from your point of view?

fordgt0589 · Apr 5, 2014

I dont have any problems with Skype or BitTorrent, but sometimes when I try to load pages it takes a very long time, or when I stream videos the video will take a long time to buffer or it will freeze. When this happens, I check my receiving speed through Task Manager and it will be less than 100 kbs. However, if I restart my pc, it will work fine for awhile.

Broni · Apr 6, 2014

Which browser gives you issues?

Then...

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Click on "Run ESET Online Scanner" button.
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click on List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

fordgt0589 · Apr 7, 2014

I use Mozilla, but I have tested with both Mozilla and IE, and the problem occurs with both.

Results of screen317's Security Check version 0.99.81
x64 (UAC is enabled)
Internet Explorer 10 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Windows Firewall Enabled!
Windows Defender
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
`````````Anti-malware/Other Utilities Check:`````````
Adobe Flash Player 12.0.0.77
Mozilla Firefox (28.0)
````````Process Check: objlist.exe by Laurent````````
Windows Defender MSMpEng.exe
Malwarebytes Anti-Malware mbamservice.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C: %
````````````````````End of Log``````````````````````

The others found no threats......

Broni · Apr 7, 2014

Reset Internet Explorer.
Go here: http://support.microsoft.com/kb/923737 and run "FixIt" procedure.
You can use ANY browser to download "FixIt" file.
Make sure you follow ALL steps listed there.

Reset Firefox: https://support.mozilla.org/en-US/kb/reset-firefox-easily-fix-most-problems

I still need other logs.

fordgt0589 · Apr 8, 2014

There was no explanation of how to get the log for Temp File Cleaner, also the directions for ESET said it would not produce and logs if their were no threats found.

Broni · Apr 8, 2014

I don't need any log from TFC.

How are things after resetting browsers?

fordgt0589 · Apr 8, 2014

They are fine right now, however. I was having issues last night. I was trying to stream a video and the video just wouldnt load. (BTW this too was after I reset the browser). It always seems to work until it doesnt work lol.

fordgt0589 · Apr 8, 2014

Im uploading a picture to show you how my internet is when I try to load pages.

That picture isnt working on my end (probably because of my internet) but here is a link just in case http://tinypic.com/r/2eqaq28/8.

Broni · Apr 8, 2014

To get more info get ethernet cable and connect your computer using the cable...see how the connection is then.

Inactive-A I can only connect to internet in Safe Mode

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 16 +0

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 56,041 +516

Posts: 16 +0

Posts: 16 +0

Posts: 56,041 +516

Similar threads