TechSpot

I can only connect to internet in Safe Mode

Inactive-A
By fordgt0589
Mar 31, 2014
  1. I have been having this problem for a couple weeks now. Everything I do seems to be a temporary fix. For some reason, I am unable to keep a steady connetion to the internet in normal mode, however Skype and P2P programs work fine.
     
  2. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    Welcome aboard [​IMG]

    Please, complete all steps listed here: http://www.techspot.com/vb/topic58138.html
    Make sure, you PASTE all logs. If some log exceeds 50,000 characters post limit, split it between couple of replies.
    Attached logs won't be reviewed.

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
     
  3. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    It seems I am unable to install the antivirus software. Comodo and Avast both gave me error messages while installing and WME says that my version of Windows has Defender built in which would provide the same level of security.


    Comodo Error: Cannot install COMODO Internet Security. Error: 1601. The Windows Installer Service could not be accessed. This can occur if the Windows Installer is not correctly installed. Contact your support personnel for assistance.

    Avast Error: The Installer is unable to initialize early avast! self-defense with error 0x0000043c! Aborting!
     
  4. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    Is this Windows 8?
    If so Windows Defender is what in earlier versions of Windows was Microsoft Security Essentials - decent AV program.
    If the above is correct proceed with other steps.
     
  5. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    Yes I am running WIndows 8.

    Malwarebytes Log:


    Malwarebytes Anti-Malware
    www.malwarebytes.org

    Scan Date: 4/2/2014
    Scan Time: 2:34:13 AM
    Logfile: Scan.txt
    Administrator: Yes

    Version: 2.00.0.1000
    Malware Database: v2014.04.02.03
    Rootkit Database: v2014.03.27.01
    License: Trial
    Malware Protection: Enabled
    Malicious Website Protection: Enabled
    Chameleon: Disabled

    OS: Windows 8
    CPU: x64
    File System: NTFS
    User: fordg_000

    Scan Type: Threat Scan
    Result: Completed
    Objects Scanned: 240607
    Time Elapsed: 5 min, 35 sec

    Memory: Enabled
    Startup: Enabled
    Filesystem: Enabled
    Archives: Enabled
    Rootkits: Disabled
    Shuriken: Enabled
    PUP: Enabled
    PUM: Enabled

    Processes: 0
    (No malicious items detected)

    Modules: 0
    (No malicious items detected)

    Registry Keys: 0
    (No malicious items detected)

    Registry Values: 0
    (No malicious items detected)

    Registry Data: 0
    (No malicious items detected)

    Folders: 0
    (No malicious items detected)

    Files: 0
    (No malicious items detected)

    Physical Sectors: 0
    (No malicious items detected)


    (end)

    DDS.txt:

    DDS (Ver_2012-11-20.01) - NTFS_AMD64
    Internet Explorer: 10.0.9200.16843
    Run by fordg_000 at 2:36:28 on 2014-04-02
    Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.8079.6157 [GMT -4:00]
    .
    AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost.exe -k DcomLaunch
    C:\WINDOWS\system32\nvvsvc.exe
    C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    C:\WINDOWS\system32\svchost.exe -k RPCSS
    C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\WINDOWS\system32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k LocalService
    C:\WINDOWS\system32\dwm.exe
    C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
    C:\WINDOWS\system32\nvvsvc.exe
    C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\WINDOWS\system32\svchost.exe -k NetworkService
    C:\WINDOWS\System32\spoolsv.exe
    C:\WINDOWS\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
    C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
    C:\WINDOWS\system32\dashost.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
    C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe
    C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\system32\svchost.exe -k LocalServiceAndNoImpersonation
    C:\WINDOWS\System32\svchost.exe -k LocalServicePeerNet
    C:\WINDOWS\system32\taskhostex.exe
    C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe
    C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
    C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\igfxpers.exe
    C:\Users\fordg_000\AppData\Local\Apps\2.0\WC3AHZBR.6YB\KDP44OTC.4Z0\dell..tion_0f612f649c4a10af_0005.0005_9914611622934cec\DellSystemDetect.exe
    C:\Program Files (x86)\Skype\Phone\Skype.exe
    C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe
    C:\Program Files (x86)\AdTrustMedia\PrivDog\1.8.0.15\trustedadssvc.exe
    C:\Windows\System32\WWAHost.exe
    C:\WINDOWS\WinStore\WSHost.exe
    C:\Program Files (x86)\Mozilla Firefox\plugin-container.exe
    C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
    C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
    C:\Program Files\Windows Media Player\wmpnetwk.exe
    C:\WINDOWS\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
    C:\WINDOWS\system32\taskhost.exe
    C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
    C:\WINDOWS\splwow64.exe
    C:\Program Files (x86)\Rosetta Stone\Rosetta Stone V3\RosettaStoneVersion3.exe
    C:\Program Files (x86)\Rosetta Stone\Rosetta Stone V3\support\bin\win\RosettaStoneLtdServices.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\WINDOWS\system32\SearchFilterHost.exe
    C:\WINDOWS\system32\wbem\wmiprvse.exe
    C:\WINDOWS\System32\cscript.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://search.yahoo.com/?type=586383&fr=spigot-yhp-ie
    mWinlogon: Userinit = userinit.exe,
    BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
    BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL
    BHO: PrivDog Extension: {FB16E5C3-A9E2-47A2-8EFC-319E775E62CC} - C:\Program Files (x86)\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
    uRun: [DellSystemDetect] C:\Users\fordg_000\AppData\Local\Apps\2.0\WC3AHZBR.6YB\KDP44OTC.4Z0\dell..tion_0f612f649c4a10af_0005.0005_9914611622934cec\DellSystemDetect.exe
    uRun: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun
    mRun: [PowerDVD13Agent] "C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe"
    mRun: [VirtualCloneDrive] "C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
    mRun: [BCSSync] "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
    mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
    mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
    mRun: [ComodoFSFirefox] "C:\Program Files (x86)\AdTrustMedia\PrivDog\FinalizeSetup.exe" /f
    mRun: [PrivDogService] "C:\Program Files (x86)\AdTrustMedia\PrivDog\1.8.0.15\trustedadssvc.exe"
    IE: E&xport to Microsoft Excel - C:\PROGRA~2\MICROS~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - C:\PROGRA~2\MICROS~1\Office14\ONBttnIE.dll/105
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIE.dll
    IE: {2F5C139F-79BD-4C84-A95A-E7140525BC55} - {5B06364D-FF00-4BD5-9D01-4379952513F2} - C:\Program Files (x86)\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
    IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files (x86)\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    Trusted Zone: dell.com
    TCP: NameServer = 75.75.75.75 75.75.76.76
    TCP: Interfaces\{F3852D2A-8910-4C3A-B06C-C50836462624} : DHCPNameServer = 75.75.75.75 75.75.76.76
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
    SSODL: WebCheck - <orphaned>
    SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL
    x64-BHO: Groove GFS Browser Helper: {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
    x64-BHO: Skype add-on for Internet Explorer: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL
    x64-BHO: PrivDog Extension: {FB16E5C3-A9E2-47A2-8EFC-319E775E62CC} - C:\Program Files\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
    x64-Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
    x64-Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
    x64-Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe
    x64-Run: [NvBackend] "C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe"
    x64-Run: [ShadowPlay] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\nvspcap64.dll,ShadowPlayOnSystemStart
    x64-IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - C:\Program Files\Microsoft Office\Office14\ONBttnIE.dll
    x64-IE: {2F5C139F-79BD-4C84-A95A-E7140525BC55} - {5B06364D-FF00-4BD5-9D01-4379952513F2} - C:\Program Files\AdTrustMedia\PrivDog\1.8.0.15\trustedads.dll
    x64-IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - C:\Program Files\Microsoft Office\Office14\ONBttnIELinkedNotes.dll
    x64-IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll
    x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
    x64-Notify: igfxcui - igfxdev.dll
    x64-SSODL: WebCheck - <orphaned>
    x64-SEH: Groove GFS Stub Execution Hook - {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - C:\Users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\
    FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/?type=586383&fr=spigot-yhp-ff
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=586383&p=
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
    FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
    FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
    FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
    FF - plugin: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5};Power Control [2014/03/20 06:00:14];C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [2013-3-19 130320]
    R2 c2cautoupdatesvc;Skype Click to Call Updater;C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [2014-3-3 1363584]
    R2 c2cpnrsvc;Skype Click to Call PNR Service;C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [2014-3-3 1748608]
    R2 CyberLink PowerDVD 13 Media Server Monitor Service;CyberLink PowerDVD 13 Media Server Monitor Service;C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [2014-3-20 77576]
    R2 CyberLink PowerDVD 13 Media Server Service;CyberLink PowerDVD 13 Media Server Service;C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [2014-3-20 323336]
    R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [2014-3-31 1809720]
    R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [2014-3-31 857912]
    R2 MSI_ODD_Service;MSI_ODD_Service;C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe [2011-10-4 76800]
    R2 NvNetworkService;NVIDIA Network Service;C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [2014-3-20 1593632]
    R2 NvStreamSvc;NVIDIA Streamer Service;C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [2014-3-20 16939296]
    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2014-3-20 411936]
    R3 MBAMProtector;MBAMProtector;C:\WINDOWS\System32\Drivers\mbam.sys [2014-3-31 25816]
    R3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\System32\Drivers\MBAMSwissArmy.sys [2014-3-31 119512]
    R3 MBAMWebAccessControl;MBAMWebAccessControl;C:\WINDOWS\System32\Drivers\mwac.sys [2014-3-31 63192]
    R3 NTIOLib_X64;NTIOLib_X64;C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [2010-1-18 14136]
    R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);C:\WINDOWS\System32\Drivers\nvvad64v.sys [2014-3-20 39200]
    R3 RTL8168;Realtek 8168 NT Driver;C:\WINDOWS\System32\Drivers\Rt630x64.sys [2012-6-2 589824]
    R3 WSDScan;WSD Scan Support;C:\WINDOWS\System32\Drivers\WSDScan.sys [2014-3-22 23552]
    S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-10-23 172192]
    .
    =============== Created Last 30 ================
    .
    2014-04-01 20:02:23 -------- d-----w- C:\Users\fordg_000\AppData\Local\IsolatedStorage
    2014-04-01 19:29:23 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\IsolatedStorage
    2014-04-01 18:48:35 423240 ----a-w- C:\WINDOWS\System32\drivers\raqimtca.sys
    2014-04-01 18:46:34 -------- d-----w- C:\Users\fordg_000\AppData\Local\AdTrustMedia
    2014-04-01 18:45:48 -------- d-----w- C:\ProgramData\Adtrustmedia
    2014-04-01 18:45:48 -------- d-----w- C:\Program Files\AdTrustMedia
    2014-04-01 18:45:48 -------- d-----w- C:\Program Files (x86)\AdTrustMedia
    2014-04-01 18:45:43 -------- d-----w- C:\ProgramData\Comodo Downloader
    2014-04-01 18:45:16 -------- d-----w- C:\ProgramData\Comodo
    2014-04-01 18:41:51 423240 ----a-w- C:\WINDOWS\System32\drivers\dgwtjwvu.sys
    2014-04-01 18:41:44 423240 ----a-w- C:\WINDOWS\System32\drivers\jswsyyiw.sys
    2014-04-01 18:41:43 -------- d-----w- C:\ProgramData\AVAST Software
    2014-04-01 14:22:24 10521840 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{5FB56A63-A86E-4BCB-880E-1C670201DAE5}\mpengine.dll
    2014-03-31 17:23:55 -------- d-----w- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    2014-03-31 17:15:00 -------- d-----w- C:\Users\fordg_000\AppData\Local\ElevatedDiagnostics
    2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin5.dll
    2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin4.dll
    2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin3.dll
    2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin2.dll
    2014-03-31 17:07:27 159744 ----a-w- C:\Program Files\Internet Explorer\Plugins\npqtplugin.dll
    2014-03-31 17:06:39 -------- d-----w- C:\Users\fordg_000\AppData\Local\Apple
    2014-03-31 16:32:53 10521840 ------w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\Backup\mpengine.dll
    2014-03-31 06:33:10 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\Sony Creative Software Inc
    2014-03-31 05:20:44 -------- d-----w- C:\ProgramData\IsolatedStorage
    2014-03-31 05:20:03 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\Vegasaur
    2014-03-31 05:20:02 -------- d-----w- C:\ProgramData\Vegasaur
    2014-03-31 05:20:02 -------- d-----w- C:\Program Files\Vegasaur
    2014-03-31 05:10:41 119512 ----a-w- C:\WINDOWS\System32\drivers\MBAMSwissArmy.sys
    2014-03-31 05:10:32 91352 ----a-w- C:\WINDOWS\System32\drivers\mbamchameleon.sys
    2014-03-31 05:10:32 63192 ----a-w- C:\WINDOWS\System32\drivers\mwac.sys
    2014-03-31 05:10:32 25816 ----a-w- C:\WINDOWS\System32\drivers\mbam.sys
    2014-03-31 05:10:32 -------- d-----w- C:\ProgramData\Malwarebytes
    2014-03-31 05:10:32 -------- d-----w- C:\Program Files (x86)\Malwarebytes Anti-Malware
    2014-03-31 01:05:56 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\Subtitle Edit
    2014-03-31 01:05:55 -------- d-----w- C:\Program Files (x86)\Subtitle Edit
    2014-03-30 21:22:06 -------- d-----w- C:\ProgramData\Rosetta Stone
    2014-03-29 08:07:20 -------- d-----w- C:\Program Files (x86)\Rosetta Stone
    2014-03-26 08:13:57 23350272 ----a-w- C:\Program Files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
    2014-03-26 08:13:56 22615040 ----a-w- C:\Program Files (x86)\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
    2014-03-26 08:10:57 76288 ----a-w- C:\WINDOWS\System32\newdev.exe
    2014-03-26 08:10:57 75264 ----a-w- C:\WINDOWS\System32\ndadmin.exe
    2014-03-26 08:10:57 74240 ----a-w- C:\WINDOWS\SysWow64\newdev.exe
    2014-03-26 08:10:57 73728 ----a-w- C:\WINDOWS\SysWow64\ndadmin.exe
    2014-03-26 08:10:57 301568 ----a-w- C:\WINDOWS\System32\newdev.dll
    2014-03-26 08:10:57 275968 ----a-w- C:\WINDOWS\SysWow64\newdev.dll
    2014-03-26 08:05:19 13661696 ----a-w- C:\WINDOWS\System32\Windows.UI.Xaml.dll
    2014-03-26 07:55:29 109568 ----a-w- C:\WINDOWS\System32\dskquota.dll
    2014-03-26 07:54:59 1045504 ----a-w- C:\WINDOWS\System32\usercpl.dll
    2014-03-26 07:51:12 83968 ----a-w- C:\WINDOWS\System32\drivers\hidclass.sys
    2014-03-26 07:51:12 32768 ----a-w- C:\WINDOWS\System32\drivers\hidparse.sys
    2014-03-26 07:51:12 27648 ----a-w- C:\WINDOWS\System32\drivers\hidusb.sys
    2014-03-26 07:41:22 1125888 ----a-w- C:\WINDOWS\System32\msctf.dll
    2014-03-26 07:40:59 883712 ----a-w- C:\WINDOWS\HelpPane.exe
    2014-03-22 19:51:02 -------- d-----w- C:\WINDOWS\System32\MRT
    2014-03-22 19:43:59 560640 ----a-w- C:\WINDOWS\System32\mfmp4srcsnk.dll
    2014-03-22 19:42:51 17888 ----a-w- C:\WINDOWS\System32\msvcr100_clr0400.dll
    2014-03-22 19:42:50 17888 ----a-w- C:\WINDOWS\SysWow64\msvcr100_clr0400.dll
    2014-03-22 19:40:57 3842560 ----a-w- C:\WINDOWS\System32\d2d1.dll
    2014-03-22 19:39:59 1300992 ----a-w- C:\WINDOWS\System32\gdi32.dll
    2014-03-22 19:38:50 945152 ----a-w- C:\WINDOWS\System32\resetengmig.dll
    2014-03-22 19:38:50 443392 ----a-w- C:\WINDOWS\System32\ReAgent.dll
    2014-03-22 19:38:50 375808 ----a-w- C:\WINDOWS\SysWow64\ReAgent.dll
    2014-03-22 19:38:50 132096 ----a-w- C:\WINDOWS\System32\sysreset.exe
    2014-03-22 19:38:50 1011200 ----a-w- C:\WINDOWS\System32\reseteng.dll
    2014-03-22 19:38:49 2851840 ----a-w- C:\WINDOWS\System32\esent.dll
    2014-03-22 19:38:49 2382336 ----a-w- C:\WINDOWS\SysWow64\esent.dll
    2014-03-22 19:38:49 1628160 ----a-w- C:\WINDOWS\System32\WindowsCodecs.dll
    2014-03-22 19:38:49 1339392 ----a-w- C:\WINDOWS\SysWow64\WindowsCodecs.dll
    2014-03-22 19:32:58 312320 ----a-w- C:\WINDOWS\System32\msieftp.dll
    2014-03-22 19:32:58 273408 ----a-w- C:\WINDOWS\SysWow64\msieftp.dll
    2014-03-22 19:32:56 144896 ----a-w- C:\WINDOWS\System32\tssdisai.dll
    2014-03-22 19:32:56 135680 ----a-w- C:\WINDOWS\System32\appserverai.dll
    2014-03-22 19:32:56 126976 ----a-w- C:\WINDOWS\System32\RDWebAI.dll
    2014-03-22 19:32:56 122880 ----a-w- C:\WINDOWS\System32\VmHostAI.dll
    2014-03-22 19:32:55 148480 ----a-w- C:\WINDOWS\System32\poqexec.exe
    2014-03-22 19:32:55 132608 ----a-w- C:\WINDOWS\SysWow64\poqexec.exe
    2014-03-22 19:32:52 2048 ----a-w- C:\WINDOWS\SysWow64\tzres.dll
    2014-03-22 19:32:52 2048 ----a-w- C:\WINDOWS\System32\tzres.dll
    2014-03-21 07:16:47 -------- d-----w- C:\Users\fordg_000\AppData\Local\Macromedia
    2014-03-21 07:08:12 270496 ------w- C:\WINDOWS\System32\MpSigStub.exe
    2014-03-20 19:54:40 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
    2014-03-20 19:54:23 -------- d-----w- C:\WINDOWS\PCHEALTH
    2014-03-20 19:54:23 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
    2014-03-20 19:53:35 -------- d-----w- C:\Program Files (x86)\Microsoft Visual Studio 8
    2014-03-20 19:53:11 -------- d-----w- C:\Program Files (x86)\Microsoft Analysis Services
    2014-03-20 19:53:06 -------- d-----w- C:\Users\fordg_000\AppData\Local\Microsoft Help
    2014-03-20 19:51:11 -------- d-----w- C:\Program Files (x86)\Elaborate Bytes
    2014-03-20 15:34:57 254640 ----a-w- C:\ProgramData\Microsoft\Windows\Sqm\Manifest\Sqm10236.bin
    2014-03-20 12:19:02 -------- d-sh--w- C:\Recovery
    2014-03-20 10:47:18 -------- d-----w- C:\Users\fordg_000\.MakeMKV
    2014-03-20 10:39:09 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\NVIDIA
    2014-03-20 10:35:42 -------- d-----w- C:\WINDOWS\SysWow64\spool
    2014-03-20 10:03:41 -------- d-----w- C:\Users\fordg_000\AppData\Local\Sony
    2014-03-20 10:03:41 -------- d-----w- C:\Program Files\Sony
    2014-03-20 10:03:41 -------- d-----w- C:\Program Files (x86)\Sony
    2014-03-20 10:00:42 -------- d-----w- C:\Users\fordg_000\AppData\Local\Cyberlink SoftDMA
    2014-03-20 10:00:12 -------- d-----w- C:\Users\fordg_000\AppData\Local\MediaServer
    2014-03-20 10:00:09 599840 ----a-w- C:\WINDOWS\SysWow64\nvStreaming.exe
    2014-03-20 09:59:56 -------- d-----w- C:\ProgramData\PDVD
    2014-03-20 09:59:55 -------- d-----w- C:\WINDOWS\SysWow64\NV
    2014-03-20 09:59:55 -------- d-----w- C:\WINDOWS\System32\NV
    2014-03-20 09:59:51 922968 ----a-w- C:\WINDOWS\System32\nvvsvc.exe
    2014-03-20 09:59:51 6714312 ----a-w- C:\WINDOWS\System32\nvcpl.dll
    2014-03-20 09:59:51 64968 ----a-w- C:\WINDOWS\System32\nvshext.dll
    2014-03-20 09:59:51 386336 ----a-w- C:\WINDOWS\System32\nvmctray.dll
    2014-03-20 09:59:51 3649185 ----a-w- C:\WINDOWS\System32\nvcoproc.bin
    2014-03-20 09:59:51 3497816 ----a-w- C:\WINDOWS\System32\nvsvc64.dll
    2014-03-20 09:59:49 -------- d-----w- C:\Users\fordg_000\AppData\Local\CyberLink
    2014-03-20 09:54:35 778856 ----a-w- C:\WINDOWS\SysWow64\PresentationNative_v0300.dll
    2014-03-20 09:54:35 35400 ----a-w- C:\WINDOWS\SysWow64\TsWpfWrp.exe
    2014-03-20 09:54:35 35400 ----a-w- C:\WINDOWS\System32\TsWpfWrp.exe
    2014-03-20 09:54:35 1166440 ----a-w- C:\WINDOWS\System32\PresentationNative_v0300.dll
    2014-03-20 09:52:32 -------- d-----w- C:\ProgramData\install_clap
    2014-03-20 09:50:04 -------- d-----w- C:\Program Files (x86)\VideoLAN
    2014-03-20 09:49:28 -------- d-----w- C:\Program Files (x86)\Audacity
    2014-03-20 09:44:26 -------- d-----w- C:\Users\fordg_000\AppData\Local\NVIDIA Corporation
    2014-03-20 09:44:05 511328 ----a-w- C:\WINDOWS\System32\d3dx10_43.dll
    2014-03-20 09:44:05 470880 ----a-w- C:\WINDOWS\SysWow64\d3dx10_43.dll
    2014-03-20 09:44:05 276832 ----a-w- C:\WINDOWS\System32\d3dx11_43.dll
    2014-03-20 09:44:05 248672 ----a-w- C:\WINDOWS\SysWow64\d3dx11_43.dll
    2014-03-20 09:44:05 2401112 ----a-w- C:\WINDOWS\System32\D3DX9_43.dll
    2014-03-20 09:44:05 1998168 ----a-w- C:\WINDOWS\SysWow64\D3DX9_43.dll
    2014-03-20 09:44:03 1179576 ----a-w- C:\WINDOWS\System32\nvspcap64.dll
    2014-03-20 09:44:03 1048152 ----a-w- C:\WINDOWS\SysWow64\nvspcap.dll
    2014-03-20 09:44:00 -------- d-----w- C:\Users\fordg_000\AppData\Local\NVIDIA
    2014-03-20 09:43:54 -------- d-----w- C:\ProgramData\NVIDIA Corporation
    2014-03-20 09:43:10 -------- d-----w- C:\Program Files (x86)\NVIDIA Corporation
    2014-03-20 09:43:04 39200 ----a-w- C:\WINDOWS\System32\drivers\nvvad64v.sys
    2014-03-20 09:43:04 35104 ----a-w- C:\WINDOWS\System32\nvaudcap64v.dll
    2014-03-20 09:43:04 33056 ----a-w- C:\WINDOWS\SysWow64\nvaudcap32v.dll
    2014-03-20 09:42:58 -------- d-----w- C:\Program Files\NVIDIA Corporation
    2014-03-20 09:42:30 -------- d-----w- C:\Users\fordg_000\AppData\Local\Skype
    2014-03-20 09:42:21 -------- d-----r- C:\Program Files (x86)\Skype
    2014-03-20 09:40:16 -------- d-----w- C:\ProgramData\Freemake
    2014-03-20 09:40:04 -------- d-----w- C:\Program Files (x86)\Freemake
    2014-03-20 09:38:16 -------- d-----w- C:\Program Files (x86)\MakeMKV
    2014-03-20 09:37:45 -------- d-----w- C:\Users\fordg_000\AppData\Local\Programs
    2014-03-20 09:34:21 439296 ----a-w- C:\WINDOWS\System32\plsapp64.dll
    2014-03-20 09:33:30 -------- d-----w- C:\Users\fordg_000\AppData\Roaming\BitTorrent
    2014-03-20 09:28:39 -------- d-----w- C:\Program Files\Common Files\Intel
    2014-03-20 09:28:39 -------- d-----w- C:\Program Files (x86)\Common Files\Intel
    2014-03-20 09:28:36 56832 ----a-w- C:\WINDOWS\System32\OpenCL.DLL
    2014-03-20 09:28:36 56320 ----a-w- C:\WINDOWS\SysWow64\OpenCL.DLL
    2014-03-20 09:26:20 -------- d-----w- C:\Users\fordg_000\AppData\Local\Deployment
    2014-03-20 09:26:20 -------- d-----w- C:\Users\fordg_000\AppData\Local\Apps
    2014-03-20 09:21:06 50784 ----a-w- C:\ProgramData\Microsoft\windowsfiltering\Sqm\Manifest\Sqm3.bin
    2014-03-20 09:21:06 -------- d-----r- C:\Users\fordg_000\Searches
    2014-03-20 09:21:06 -------- d-----r- C:\Users\fordg_000\Contacts
    2014-03-20 09:21:00 17536 ----a-w- C:\ProgramData\Microsoft\windowssampling\Sqm\Manifest\Sqm3.bin
    2014-03-20 08:59:34 -------- d-----w- C:\WINDOWS\Panther
    .
    ==================== Find3M ====================
    .
    2014-03-04 22:52:34 78304 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerCPLApp.cpl
    2014-03-04 22:52:34 694240 ----a-w- C:\WINDOWS\SysWow64\FlashPlayerApp.exe
    2014-02-23 08:13:41 2241536 ----a-w- C:\WINDOWS\System32\wininet.dll
    2014-02-23 08:13:31 915968 ----a-w- C:\WINDOWS\System32\uxtheme.dll
    2014-02-23 08:13:31 53760 ----a-w- C:\WINDOWS\System32\UXInit.dll
    2014-02-23 08:11:59 3960320 ----a-w- C:\WINDOWS\System32\jscript9.dll
    2014-02-23 08:11:52 67072 ----a-w- C:\WINDOWS\System32\iesetup.dll
    2014-02-23 08:11:52 136704 ----a-w- C:\WINDOWS\System32\iesysprep.dll
    2014-02-23 06:54:46 1767936 ----a-w- C:\WINDOWS\SysWow64\wininet.dll
    2014-02-23 06:54:37 44032 ----a-w- C:\WINDOWS\SysWow64\UXInit.dll
    2014-02-23 06:53:22 2877952 ----a-w- C:\WINDOWS\SysWow64\jscript9.dll
    2014-02-23 06:53:18 61440 ----a-w- C:\WINDOWS\SysWow64\iesetup.dll
    2014-02-23 06:53:18 109056 ----a-w- C:\WINDOWS\SysWow64\iesysprep.dll
    2014-02-23 06:35:36 2706432 ----a-w- C:\WINDOWS\System32\mshtml.tlb
    2014-02-23 06:31:25 2706432 ----a-w- C:\WINDOWS\SysWow64\mshtml.tlb
    2014-02-23 04:06:33 534528 ----a-w- C:\WINDOWS\SysWow64\uxtheme.dll
    2014-02-08 04:34:42 4036608 ----a-w- C:\WINDOWS\System32\win32k.sys
    2014-02-05 23:41:39 595968 ----a-w- C:\WINDOWS\System32\qedit.dll
    2014-02-05 23:37:51 496640 ----a-w- C:\WINDOWS\SysWow64\qedit.dll
    2014-01-17 20:24:12 94208 ----a-w- C:\WINDOWS\SysWow64\QuickTimeVR.qtx
    2014-01-17 20:24:12 69632 ----a-w- C:\WINDOWS\SysWow64\QuickTime.qts
    2014-01-12 23:30:39 2032640 ----a-w- C:\WINDOWS\SysWow64\d3d10warp.dll
    2014-01-12 23:30:18 2238976 ----a-w- C:\WINDOWS\System32\d3d10warp.dll
    .
    ============= FINISH: 2:37:02.32 ===============

    Attach.txt:

    Microsoft Windows 8
    Boot Device: \Device\HarddiskVolume1
    Install Date: 3/20/2014 5:20:19 AM
    System Uptime: 4/1/2014 2:50:43 PM (12 hours ago)
    .
    Motherboard: Alienware | | 06G6JW
    Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz | CPU 1 | 3101/100mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 931 GiB total, 719.494 GiB free.
    D: is CDROM (UDF)
    E: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP2: 3/24/2014 1:37:50 AM - Windows Update
    RP3: 3/31/2014 1:06:50 PM - Installed QuickTime 7
    .
    ==== Installed Programs ======================
    .
    Adobe Flash Player 12 Plugin
    Apple Application Support
    Apple Software Update
    Audacity 2.0.5
    BitTorrent
    CyberLink PowerDVD 13
    Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition
    Dell System Detect
    Freemake Video Converter version 4.1.3
    GeForce Experience NvStream Client Components
    Intel(R) Processor Graphics
    MakeMKV v1.8.9
    Malwarebytes Anti-Malware version 2.00.0.1000
    Microsoft Office Access MUI (English) 2010
    Microsoft Office Access Setup Metadata MUI (English) 2010
    Microsoft Office Excel MUI (English) 2010
    Microsoft Office Groove MUI (English) 2010
    Microsoft Office InfoPath MUI (English) 2010
    Microsoft Office Office 64-bit Components 2010
    Microsoft Office OneNote MUI (English) 2010
    Microsoft Office Outlook MUI (English) 2010
    Microsoft Office PowerPoint MUI (English) 2010
    Microsoft Office Professional Plus 2010
    Microsoft Office Proof (English) 2010
    Microsoft Office Proof (French) 2010
    Microsoft Office Proof (Spanish) 2010
    Microsoft Office Proofing (English) 2010
    Microsoft Office Publisher MUI (English) 2010
    Microsoft Office Shared 64-bit MUI (English) 2010
    Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    Microsoft Office Shared MUI (English) 2010
    Microsoft Office Shared Setup Metadata MUI (English) 2010
    Microsoft Office Word MUI (English) 2010
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Mozilla Firefox 28.0 (x86 en-US)
    Mozilla Maintenance Service
    MSI ODD Monitor
    MSVCRT Redists
    NVIDIA 3D Vision Controller Driver 335.21
    NVIDIA 3D Vision Driver 335.23
    NVIDIA Control Panel 335.23
    NVIDIA GeForce Experience 1.8.2
    NVIDIA Graphics Driver 335.23
    NVIDIA HD Audio Driver 1.3.30.1
    NVIDIA Install Application
    NVIDIA LED Visualizer 1.0
    NVIDIA Network Service
    NVIDIA Optimus Update 11.10.11
    NVIDIA PhysX
    NVIDIA PhysX System Software 9.13.1220
    NVIDIA ShadowPlay 11.10.11
    NVIDIA Stereoscopic 3D Driver
    NVIDIA Update 11.10.11
    NVIDIA Update Core
    NVIDIA Virtual Audio 1.2.20
    PrivDog
    QuickTime 7
    SHIELD Streaming
    Skype Click to Call
    Skype™ 6.14
    Subtitle Edit 3.3.14
    Update for Microsoft Office 2010 (KB2494150)
    Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition
    Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition
    Vegas Pro 11.0
    Vegas Pro 11.0 (64-bit)
    Vegasaur 1.9.2
    VirtualCloneDrive
    VLC media player 2.1.3
    WinRAR 5.10 beta 1 (32-bit)
    .
    ==== Event Viewer Messages From Past Week ========
    .
    4/1/2014 5:23:18 PM, Error: Microsoft-Windows-Kernel-Power [137] - The system firmware has changed the processor's memory type range registers (MTRRs) across a sleep state transition (S4). This can result in reduced resume performance.
    4/1/2014 2:50:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "Unavailable" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    4/1/2014 2:50:07 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    4/1/2014 2:48:30 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    4/1/2014 2:47:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    4/1/2014 2:46:12 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server: {9E175B68-F52A-11D8-B9A5-505054503030}
    4/1/2014 2:41:25 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service dps with arguments "Unavailable" in order to run the server: {DDCFD26B-FEED-44CD-B71D-79487D2E5E5A}
    4/1/2014 2:37:08 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service dps with arguments "Unavailable" in order to run the server: {7022A3B3-D004-4F52-AF11-E9E987FEE25F}
    4/1/2014 2:37:01 PM, Error: Service Control Manager [7001] - The HomeGroup Provider service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    4/1/2014 2:36:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "Unavailable" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    4/1/2014 2:36:45 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "Unavailable" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    3/31/2014 12:56:00 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Peer Networking Identity Manager service, but this action failed with the following error: An instance of the service is already running.
    3/31/2014 12:56:00 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Peer Networking Grouping service, but this action failed with the following error: An instance of the service is already running.
    3/31/2014 12:56:00 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Peer Name Resolution Protocol service, but this action failed with the following error: An instance of the service is already running.
    3/31/2014 12:51:00 AM, Error: Service Control Manager [7031] - The Peer Networking Identity Manager service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
    3/31/2014 12:51:00 AM, Error: Service Control Manager [7031] - The Peer Networking Grouping service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
    3/31/2014 12:51:00 AM, Error: Service Control Manager [7031] - The Peer Name Resolution Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
    3/31/2014 1:19:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "Unavailable" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
    3/31/2014 1:19:37 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "Unavailable" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    3/31/2014 1:14:42 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the DHCP Client service which failed to start because of the following error: The dependency service or group failed to start.
    3/31/2014 1:14:42 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    3/31/2014 1:14:42 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "Unavailable" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub System service which failed to start because of the following error: A device attached to the system is not functioning.
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI Proxy Service Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    3/31/2014 1:14:21 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancillary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    3/28/2014 2:38:57 PM, Error: Schannel [36888] - A fatal alert was generated and sent to the remote endpoint. This may result in termination of the connection. The TLS protocol defined fatal error code is 51. The Windows SChannel error state is 900.
    .
    ==== End Of File ===========================
     
  6. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    [​IMG] Download RogueKiller from one of the following links and save it to your Desktop:
    • Close all the running programs
    • Windows Vista/7/8 users: right click on RogueKiller.exe, click Run as Administrator
    • Otherwise just double-click on RogueKiller.exe
    • Pre-scan will start. Let it finish.
    • Click on SCAN button.
    • Wait until the Status box shows Scan Finished
    • Click on Delete.
    • Wait until the Status box shows Deleting Finished.
    • Click on Report and copy/paste the content of the Notepad into your next reply.
    • RKreport.txt could also be found on your desktop.
    • If more than one log is produced post all logs.
    • If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

    [​IMG] Create new restore point before proceeding with the next step....
    How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

    Download Malwarebytes Anti-Rootkit (MBAR) from HERE
    • Unzip downloaded file.
    • Open the folder where the contents were unzipped and run mbar.exe
    • Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
    • Click on the Cleanup button to remove any threats and reboot if prompted to do so.
    • Wait while the system shuts down and the cleanup process is performed.
    • Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
    • When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt
     
  7. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    RogueKiller Report


    RogueKiller V8.8.15 [Mar 27 2014] by Adlice Software
    mail : http://www.adlice.com/contact/
    Feedback : http://forum.adlice.com
    Website : http://www.adlice.com/softwares/roguekiller/
    Blog : http://www.adlice.com

    Operating System : Windows 8 (6.2.9200 ) 64 bits version
    Started in : Safe mode with network support
    User : fordg_000 [Admin rights]
    Mode : Remove -- Date : 04/03/2014 03:23:13
    | ARK || FAK || MBR |

    ¤¤¤ Bad processes : 0 ¤¤¤

    ¤¤¤ Registry Entries : 2 ¤¤¤
    [HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)
    [HJ DESK][PUM] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> REPLACED (0)

    ¤¤¤ Scheduled tasks : 0 ¤¤¤

    ¤¤¤ Startup Entries : 0 ¤¤¤

    ¤¤¤ Web browsers : 0 ¤¤¤

    ¤¤¤ Browser Addons : 0 ¤¤¤

    ¤¤¤ Particular Files / Folders: ¤¤¤

    ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤

    ¤¤¤ External Hives: ¤¤¤

    ¤¤¤ Infection : ¤¤¤

    ¤¤¤ HOSTS File: ¤¤¤
    --> %SystemRoot%\System32\drivers\etc\hosts




    ¤¤¤ MBR Check: ¤¤¤

    +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) WDC WD10EZEX-75ZF5A0 +++++
    --- User ---
    [MBR] d3c60bb9e058a59563f5b8436b6e7023
    [BSP] 032d295c298533a2ca1727dbea9334ff : Windows 7/8 MBR Code
    Partition table:
    0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 350 MB
    1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 718848 | Size: 953517 MB
    User = LL1 ... OK!
    User = LL2 ... OK!

    Finished : << RKreport[0]_D_04032014_032313.txt >>
    RKreport[0]_S_04032014_032259.txt



    MBAR Log

    Malwarebytes Anti-Rootkit BETA 1.07.0.1009
    www.malwarebytes.org

    Database version: v2014.04.03.02

    Windows 8 x64 NTFS (Safe Mode/Networking)
    Internet Explorer 10.0.9200.16843
    fordg_000 :: SHAWNPC [administrator]

    4/3/2014 3:24:59 AM
    mbar-log-2014-04-03 (03-24-59).txt

    Scan type: Quick scan
    Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
    Scan options disabled:
    Objects scanned: 237305
    Time elapsed: 11 minute(s), 37 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 0
    (No malicious items detected)

    Registry Values Detected: 0
    (No malicious items detected)

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 0
    (No malicious items detected)

    Files Detected: 0
    (No malicious items detected)

    Physical Sectors Detected: 0
    (No malicious items detected)

    (end)

    System Log

    ---------------------------------------
    Malwarebytes Anti-Rootkit BETA 1.07.0.1009

    (c) Malwarebytes Corporation 2011-2012

    OS version: 6.2.9200 Windows 8 x64

    System is currently in a safe mode

    Account is Administrative

    Internet Explorer version: 10.0.9200.16843

    File system is: NTFS
    Disk drives: C:\ DRIVE_FIXED
    CPU speed: 3.093000 GHz
    Memory total: 8471359488, free: 6327767040

    Downloaded database version: v2014.04.03.02
    Downloaded database version: v2014.03.27.01
    =======================================
    ------------ Kernel report ------------
    04/03/2014 03:24:55
    ------------ Loaded modules -----------
    \SystemRoot\system32\ntoskrnl.exe
    \SystemRoot\system32\hal.dll
    \SystemRoot\system32\kd.dll
    \SystemRoot\system32\mcupdate_GenuineIntel.dll
    \SystemRoot\System32\drivers\CLFS.SYS
    \SystemRoot\System32\drivers\tm.sys
    \SystemRoot\system32\PSHED.dll
    \SystemRoot\system32\BOOTVID.dll
    \SystemRoot\system32\CI.dll
    \SystemRoot\System32\drivers\msrpc.sys
    \SystemRoot\system32\drivers\Wdf01000.sys
    \SystemRoot\system32\drivers\WDFLDR.SYS
    \SystemRoot\System32\Drivers\acpiex.sys
    \SystemRoot\System32\Drivers\WppRecorder.sys
    \SystemRoot\System32\drivers\ACPI.sys
    \SystemRoot\System32\drivers\WMILIB.SYS
    \SystemRoot\System32\drivers\msisadrv.sys
    \SystemRoot\System32\drivers\pci.sys
    \SystemRoot\System32\Drivers\cng.sys
    \SystemRoot\system32\drivers\tpm.sys
    \SystemRoot\System32\drivers\isapnp.sys
    \SystemRoot\System32\drivers\vdrvroot.sys
    \SystemRoot\system32\drivers\pdc.sys
    \SystemRoot\System32\drivers\partmgr.sys
    \SystemRoot\System32\drivers\spaceport.sys
    \SystemRoot\System32\drivers\volmgr.sys
    \SystemRoot\System32\drivers\volmgrx.sys
    \SystemRoot\System32\drivers\vmbus.sys
    \SystemRoot\System32\drivers\vmbkmcl.sys
    \SystemRoot\System32\drivers\winhv.sys
    \SystemRoot\System32\drivers\nvraid.sys
    \SystemRoot\System32\drivers\CLASSPNP.SYS
    \SystemRoot\System32\drivers\pciide.sys
    \SystemRoot\System32\drivers\PCIIDEX.SYS
    \SystemRoot\System32\drivers\intelide.sys
    \SystemRoot\System32\drivers\viaide.sys
    \SystemRoot\System32\drivers\bxvbda.sys
    \SystemRoot\System32\drivers\evbda.sys
    \SystemRoot\System32\drivers\sdbus.sys
    \SystemRoot\System32\drivers\pcmcia.sys
    \SystemRoot\System32\drivers\mountmgr.sys
    \SystemRoot\System32\drivers\iaStorV.sys
    \SystemRoot\System32\drivers\nvstor.sys
    \SystemRoot\System32\drivers\storport.sys
    \SystemRoot\System32\drivers\lsi_sas.sys
    \SystemRoot\System32\drivers\lsi_sas2.sys
    \SystemRoot\System32\drivers\lsi_sss.sys
    \SystemRoot\System32\drivers\3ware.sys
    \SystemRoot\System32\drivers\mvumis.sys
    \SystemRoot\System32\drivers\vstxraid.sys
    \SystemRoot\System32\drivers\lsi_scsi.sys
    \SystemRoot\System32\drivers\megasas.sys
    \SystemRoot\System32\drivers\MegaSR.sys
    \SystemRoot\System32\drivers\amdsata.sys
    \SystemRoot\System32\drivers\amdxata.sys
    \SystemRoot\System32\drivers\amdsbs.sys
    \SystemRoot\System32\drivers\adp94xx.sys
    \SystemRoot\System32\drivers\adpahci.sys
    \SystemRoot\System32\drivers\adpu320.sys
    \SystemRoot\System32\drivers\arc.sys
    \SystemRoot\System32\drivers\arcsas.sys
    \SystemRoot\System32\drivers\iirsp.sys
    \SystemRoot\System32\drivers\nfrd960.sys
    \SystemRoot\System32\drivers\vsmraid.sys
    \SystemRoot\System32\drivers\SiSRaid2.sys
    \SystemRoot\System32\drivers\sisraid4.sys
    \SystemRoot\System32\drivers\atapi.sys
    \SystemRoot\System32\drivers\ataport.SYS
    \SystemRoot\System32\drivers\storahci.sys
    \SystemRoot\System32\drivers\stexstor.sys
    \SystemRoot\System32\drivers\HpSAMD.sys
    \SystemRoot\System32\drivers\EhStorTcgDrv.sys
    \SystemRoot\System32\drivers\EhStorClass.sys
    \SystemRoot\system32\drivers\fltmgr.sys
    \SystemRoot\System32\drivers\fileinfo.sys
    \SystemRoot\System32\Drivers\Ntfs.sys
    \SystemRoot\System32\Drivers\ksecdd.sys
    \SystemRoot\System32\drivers\storvsc.sys
    \SystemRoot\System32\drivers\usbhub.sys
    \SystemRoot\System32\drivers\USBD.SYS
    \SystemRoot\System32\drivers\usbehci.sys
    \SystemRoot\System32\drivers\USBPORT.SYS
    \SystemRoot\System32\drivers\ucx01000.sys
    \SystemRoot\System32\drivers\UsbHub3.sys
    \SystemRoot\System32\drivers\pcw.sys
    \SystemRoot\System32\Drivers\Fs_Rec.sys
    \SystemRoot\system32\drivers\ndis.sys
    \SystemRoot\system32\drivers\NETIO.SYS
    \SystemRoot\System32\Drivers\ksecpkg.sys
    \SystemRoot\System32\drivers\tcpip.sys
    \SystemRoot\System32\drivers\fwpkclnt.sys
    \SystemRoot\system32\DRIVERS\wfplwfs.sys
    \SystemRoot\system32\DRIVERS\vmstorfl.sys
    \SystemRoot\System32\DRIVERS\fvevol.sys
    \SystemRoot\System32\drivers\gagp30kx.sys
    \SystemRoot\System32\drivers\uagp35.sys
    \SystemRoot\System32\drivers\agp440.sys
    \SystemRoot\System32\drivers\nv_agp.sys
    \SystemRoot\System32\drivers\uliagpkx.sys
    \SystemRoot\System32\drivers\wd.sys
    \SystemRoot\System32\drivers\volsnap.sys
    \SystemRoot\System32\drivers\USBXHCI.SYS
    \SystemRoot\System32\drivers\USBSTOR.SYS
    \SystemRoot\System32\drivers\uaspstor.sys
    \SystemRoot\System32\drivers\sdstor.sys
    \SystemRoot\System32\drivers\sbp2port.sys
    \SystemRoot\System32\drivers\rdyboost.sys
    \SystemRoot\System32\Drivers\mup.sys
    \SystemRoot\System32\drivers\disk.sys
    \SystemRoot\System32\Drivers\crashdmp.sys
    \SystemRoot\System32\drivers\usbccgp.sys
    \SystemRoot\System32\Drivers\Null.SYS
    \SystemRoot\System32\Drivers\Beep.SYS
    \SystemRoot\System32\drivers\BasicRender.sys
    \SystemRoot\System32\drivers\dxgkrnl.sys
    \SystemRoot\System32\drivers\watchdog.sys
    \SystemRoot\System32\drivers\dxgmms1.sys
    \SystemRoot\System32\drivers\hidusb.sys
    \SystemRoot\System32\drivers\HIDCLASS.SYS
    \SystemRoot\System32\drivers\HIDPARSE.SYS
    \SystemRoot\System32\drivers\kbdhid.sys
    \SystemRoot\System32\drivers\kbdclass.sys
    \SystemRoot\System32\drivers\BasicDisplay.sys
    \SystemRoot\system32\DRIVERS\ndistapi.sys
    \SystemRoot\system32\DRIVERS\ndiswan.sys
    \SystemRoot\system32\DRIVERS\rassstp.sys
    \SystemRoot\system32\DRIVERS\AgileVpn.sys
    \SystemRoot\system32\DRIVERS\tunnel.sys
    \SystemRoot\System32\drivers\CompositeBus.sys
    \SystemRoot\system32\DRIVERS\kdnic.sys
    \SystemRoot\System32\drivers\umbus.sys
    \SystemRoot\System32\drivers\HDAudBus.sys
    \SystemRoot\System32\drivers\HECIx64.sys
    \SystemRoot\system32\DRIVERS\Rt630x64.sys
    \SystemRoot\system32\DRIVERS\athrx.sys
    \SystemRoot\System32\drivers\vwifibus.sys
    \SystemRoot\System32\drivers\cdrom.sys
    \SystemRoot\System32\drivers\wmiacpi.sys
    \SystemRoot\system32\DRIVERS\raspptp.sys
    \SystemRoot\system32\DRIVERS\rasl2tp.sys
    \SystemRoot\system32\DRIVERS\raspppoe.sys
    \SystemRoot\System32\drivers\mssmbios.sys
    \SystemRoot\System32\drivers\swenum.sys
    \SystemRoot\System32\drivers\ks.sys
    \SystemRoot\System32\drivers\VClone.sys
    \SystemRoot\System32\drivers\rdpbus.sys
    \SystemRoot\System32\Drivers\NDProxy.SYS
    \SystemRoot\System32\drivers\mouhid.sys
    \SystemRoot\System32\drivers\mouclass.sys
    \SystemRoot\System32\Drivers\Npfs.SYS
    \SystemRoot\System32\Drivers\Msfs.SYS
    \SystemRoot\system32\DRIVERS\tdx.sys
    \SystemRoot\system32\DRIVERS\TDI.SYS
    \SystemRoot\System32\DRIVERS\netbt.sys
    \SystemRoot\system32\drivers\afd.sys
    \SystemRoot\system32\DRIVERS\pacer.sys
    \SystemRoot\system32\DRIVERS\vwififlt.sys
    \SystemRoot\system32\DRIVERS\netbios.sys
    \SystemRoot\system32\DRIVERS\rdbss.sys
    \SystemRoot\system32\drivers\nsiproxy.sys
    \SystemRoot\System32\drivers\npsvctrig.sys
    \SystemRoot\System32\Drivers\dfsc.sys
    \SystemRoot\system32\DRIVERS\udfs.sys
    \SystemRoot\System32\win32k.sys
    \SystemRoot\System32\TSDDD.dll
    \SystemRoot\System32\cdd.dll
    \SystemRoot\System32\Drivers\dump_diskdump.sys
    \SystemRoot\System32\Drivers\dump_storahci.sys
    \SystemRoot\System32\Drivers\dump_dumpfve.sys
    \SystemRoot\system32\DRIVERS\nwifi.sys
    \SystemRoot\system32\DRIVERS\ndisuio.sys
    \SystemRoot\system32\DRIVERS\vwifimp.sys
    \SystemRoot\system32\DRIVERS\bowser.sys
    \SystemRoot\System32\drivers\mpsdrv.sys
    \SystemRoot\system32\DRIVERS\mrxsmb.sys
    \SystemRoot\system32\DRIVERS\mrxsmb10.sys
    \SystemRoot\system32\DRIVERS\mrxsmb20.sys
    \SystemRoot\System32\drivers\condrv.sys
    \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
    \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
    ----------- End -----------
    Done!
    <<<1>>>
    Upper Device Name: \Device\Harddisk0\DR0
    Upper Device Object: 0xfffffa8007ce26e0
    Upper Device Driver Name: \Driver\disk\
    Lower Device Name: \Device\00000039\
    Lower Device Object: 0xfffffa8007645510
    Lower Device Driver Name: \Driver\storahci\
    <<<2>>>
    Physical Sector Size: 512
    Drive: 0, DevicePointer: 0xfffffa8007ce26e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
    --------- Disk Stack ------
    DevicePointer: 0xfffffa8007ce1040, DeviceName: Unknown, DriverName: \Driver\partmgr\
    DevicePointer: 0xfffffa8007ce26e0, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
    DevicePointer: 0xfffffa8007733d10, DeviceName: Unknown, DriverName: \Driver\ACPI\
    DevicePointer: 0xfffffa8007645510, DeviceName: \Device\00000039\, DriverName: \Driver\storahci\
    ------------ End ----------
    Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
    Upper DeviceData: 0x0, 0x0, 0x0
    Lower DeviceData: 0x0, 0x0, 0x0
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Scanning drivers directory: C:\WINDOWS\SYSTEM32\drivers...
    <<<2>>>
    <<<3>>>
    Volume: C:
    File system type: NTFS
    SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
    Read File: File "C:\Windows\System32\Drivers\vwifibus.sys" is compressed (flags = 1)
    Read File: File "C:\WINDOWS\SYSTEM32\drivers\vwifibus.sys" is compressed (flags = 1)
    Done!
    Drive 0
    Scanning MBR on drive 0...
    Inspecting partition table:
    MBR Signature: 55AA
    Disk Signature: E9356C60

    Partition information:

    Partition 0 type is Primary (0x7)
    Partition is ACTIVE.
    Partition starts at LBA: 2048 Numsec = 716800
    Partition file system is NTFS
    Partition is bootable

    Partition 1 type is Primary (0x7)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 718848 Numsec = 1952802816

    Partition 2 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Partition 3 type is Empty (0x0)
    Partition is NOT ACTIVE.
    Partition starts at LBA: 0 Numsec = 0

    Disk Size: 1000204886016 bytes
    Sector size: 512 bytes

    Scanning physical sectors of unpartitioned space on drive 0 (1-2047-1953505168-1953525168)...
    Done!
    Scan finished
    =======================================


    Removal queue found; removal started
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\VBR-0-0-2048-I.mbam...
    Removing C:\ProgramData\Malwarebytes' Anti-Malware (portable)\MBR-0-r.mbam...
    Removal finished
     
  8. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    Please download ComboFix from Here, Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Never rename Combofix unless instructed.
    • Close any open browsers.
    • Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
      If the connection is not there use restore point you created prior to running Combofix.
    • Double click on combofix.exe & follow the prompts.

    • NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
    **Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.


    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try the following...

    Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.
    Download Rkill (courtesy of BleepingComputer.com) to your desktop.
    There are 2 different versions. If one of them won't run then download and try to run the other one.
    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
    iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

    Restart computer in safe mode

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    When the scan is done Notepad will open with rKill.txt log.
    NOTE. rKill.txt log will also be present on your desktop.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.
     
  9. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    Combofix Log
    ComboFix 14-04-03.01 - fordg_000 04/03/2014 13:59:33.1.4 - x64 NETWORK
    Microsoft Windows 8 6.2.9200.0.1252.1.1033.18.8079.6428 [GMT -4:00]
    Running from: c:\users\fordg_000\Desktop\ComboFix.exe
    AV: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    * Created a new restore point
    .
    .
    ((((((((((((((((((((((((( Files Created from 2014-03-03 to 2014-04-03 )))))))))))))))))))))))))))))))
    .
    .
    2014-04-03 18:03 . 2014-04-03 18:03 -------- d-----w- c:\users\Default\AppData\Local\temp
    2014-04-03 17:14 . 2014-03-07 01:43 10521840 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{8E552AF0-14CE-4A3B-B78D-56EAB495261B}\mpengine.dll
    2014-04-03 07:29 . 2014-04-03 07:29 -------- d-----w- c:\program files (x86)\Common Files\Macrovision Shared
    2014-04-01 18:48 . 2014-04-01 18:48 423240 ----a-w- c:\windows\system32\drivers\raqimtca.sys
    2014-04-01 18:45 . 2014-04-01 18:45 -------- d-----w- c:\programdata\Adtrustmedia
    2014-04-01 18:45 . 2014-04-01 18:45 -------- d-----w- c:\program files\AdTrustMedia
    2014-04-01 18:45 . 2014-04-01 18:45 -------- d-----w- c:\programdata\Comodo Downloader
    2014-04-01 18:45 . 2014-04-01 18:45 -------- d-----w- c:\programdata\Comodo
    2014-04-01 18:41 . 2014-04-01 18:41 423240 ----a-w- c:\windows\system32\drivers\dgwtjwvu.sys
    2014-04-01 18:41 . 2014-04-01 18:41 423240 ----a-w- c:\windows\system32\drivers\jswsyyiw.sys
    2014-04-01 18:41 . 2014-04-01 18:41 -------- d-----w- c:\programdata\AVAST Software
    2014-03-31 17:23 . 2014-04-03 07:36 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
    2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin5.dll
    2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin4.dll
    2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin3.dll
    2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin2.dll
    2014-03-31 17:07 . 2014-03-31 17:07 159744 ----a-w- c:\program files\Internet Explorer\Plugins\npqtplugin.dll
    2014-03-31 17:07 . 2014-03-31 17:07 -------- d-----w- c:\program files (x86)\QuickTime
    2014-03-31 17:07 . 2014-03-31 17:07 -------- d-----w- c:\programdata\Apple Computer
    2014-03-31 17:06 . 2014-03-31 17:06 -------- d-----w- c:\program files (x86)\Common Files\Apple
    2014-03-31 17:06 . 2014-03-31 17:06 -------- d-----w- c:\programdata\Apple
    2014-03-31 17:06 . 2014-03-31 17:06 -------- d-----w- c:\program files (x86)\Apple Software Update
    2014-03-31 05:20 . 2014-03-31 05:20 -------- d-----w- c:\programdata\IsolatedStorage
    2014-03-31 05:20 . 2014-03-31 05:20 -------- d-----w- c:\programdata\Vegasaur
    2014-03-31 05:20 . 2014-03-31 05:20 -------- d-----w- c:\program files\Vegasaur
    2014-03-31 05:10 . 2014-04-03 17:52 119512 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
    2014-03-31 05:10 . 2014-04-03 07:24 91352 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
    2014-03-31 05:10 . 2014-03-31 05:10 -------- d-----w- c:\program files (x86)\Malwarebytes Anti-Malware
    2014-03-31 05:10 . 2014-03-31 05:10 -------- d-----w- c:\programdata\Malwarebytes
    2014-03-31 05:10 . 2014-03-05 13:26 63192 ----a-w- c:\windows\system32\drivers\mwac.sys
    2014-03-31 05:10 . 2014-03-05 13:26 25816 ----a-w- c:\windows\system32\drivers\mbam.sys
    2014-03-31 01:05 . 2014-03-31 01:05 -------- d-----w- c:\program files (x86)\Subtitle Edit
    2014-03-30 21:22 . 2014-03-30 21:22 -------- d-----w- c:\programdata\Rosetta Stone
    2014-03-29 08:07 . 2014-03-30 21:22 -------- d-----w- c:\program files (x86)\Rosetta Stone
    2014-03-26 08:13 . 2013-11-01 01:45 23350272 ----a-w- c:\program files\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
    2014-03-26 08:13 . 2013-11-01 01:16 22615040 ----a-w- c:\program files (x86)\Common Files\Microsoft Shared\Microsoft Camera Codec Pack\MicrosoftRawCodec.dll
    2014-03-26 08:10 . 2012-09-27 07:17 76288 ----a-w- c:\windows\system32\newdev.exe
    2014-03-26 08:10 . 2012-09-27 07:17 75264 ----a-w- c:\windows\system32\ndadmin.exe
    2014-03-26 08:10 . 2012-09-27 07:15 301568 ----a-w- c:\windows\system32\newdev.dll
    2014-03-26 08:10 . 2012-09-27 06:35 74240 ----a-w- c:\windows\SysWow64\newdev.exe
    2014-03-26 08:10 . 2012-09-27 06:35 73728 ----a-w- c:\windows\SysWow64\ndadmin.exe
    2014-03-26 08:10 . 2012-09-27 06:34 275968 ----a-w- c:\windows\SysWow64\newdev.dll
    2014-03-26 08:05 . 2013-07-24 23:07 13661696 ----a-w- c:\windows\system32\Windows.UI.Xaml.dll
    2014-03-26 07:55 . 2012-10-12 06:13 109568 ----a-w- c:\windows\system32\dskquota.dll
    2014-03-26 07:54 . 2012-10-11 05:45 1045504 ----a-w- c:\windows\system32\usercpl.dll
    2014-03-26 07:51 . 2013-11-25 23:17 83968 ----a-w- c:\windows\system32\drivers\hidclass.sys
    2014-03-26 07:51 . 2013-06-29 03:08 32768 ----a-w- c:\windows\system32\drivers\hidparse.sys
    2014-03-26 07:51 . 2013-05-04 04:48 27648 ----a-w- c:\windows\system32\drivers\hidusb.sys
    2014-03-26 07:46 . 2013-12-07 06:36 19751936 ----a-w- c:\windows\system32\shell32.dll
    2014-03-26 07:41 . 2013-04-09 23:17 1125888 ----a-w- c:\windows\system32\msctf.dll
    2014-03-26 07:40 . 2012-11-06 04:48 1150160 ----a-w- c:\windows\SysWow64\ole32.dll
    2014-03-22 19:51 . 2014-03-22 19:51 -------- d-----w- c:\windows\system32\MRT
    2014-03-22 19:43 . 2013-05-04 06:57 560640 ----a-w- c:\windows\system32\mfmp4srcsnk.dll
    2014-03-22 19:42 . 2012-08-31 00:52 17888 ----a-w- c:\windows\system32\msvcr100_clr0400.dll
    2014-03-22 19:42 . 2012-08-31 00:53 17888 ----a-w- c:\windows\SysWow64\msvcr100_clr0400.dll
    2014-03-22 19:40 . 2014-01-12 23:30 2238976 ----a-w- c:\windows\system32\d3d10warp.dll
    2014-03-22 19:39 . 2013-10-02 23:25 1300992 ----a-w- c:\windows\system32\gdi32.dll
    2014-03-22 19:38 . 2013-03-02 08:23 375808 ----a-w- c:\windows\SysWow64\ReAgent.dll
    2014-03-22 19:38 . 2013-03-02 02:44 1011200 ----a-w- c:\windows\system32\reseteng.dll
    2014-03-22 19:38 . 2012-12-15 04:55 443392 ----a-w- c:\windows\system32\ReAgent.dll
    2014-03-22 19:38 . 2012-11-03 05:26 132096 ----a-w- c:\windows\system32\sysreset.exe
    2014-03-22 19:38 . 2012-11-03 05:25 945152 ----a-w- c:\windows\system32\resetengmig.dll
    2014-03-22 19:38 . 2014-01-31 00:48 1339392 ----a-w- c:\windows\SysWow64\WindowsCodecs.dll
    2014-03-22 19:38 . 2014-01-31 00:06 1628160 ----a-w- c:\windows\system32\WindowsCodecs.dll
    2014-03-22 19:38 . 2013-03-22 03:49 2382336 ----a-w- c:\windows\SysWow64\esent.dll
    2014-03-22 19:38 . 2013-03-21 22:47 2851840 ----a-w- c:\windows\system32\esent.dll
    2014-03-22 19:32 . 2013-11-01 05:38 312320 ----a-w- c:\windows\system32\msieftp.dll
    2014-03-22 19:32 . 2013-11-01 03:49 273408 ----a-w- c:\windows\SysWow64\msieftp.dll
    2014-03-22 19:32 . 2013-08-07 05:15 144896 ----a-w- c:\windows\system32\tssdisai.dll
    2014-03-22 19:32 . 2012-11-10 04:22 122880 ----a-w- c:\windows\system32\VmHostAI.dll
    2014-03-22 19:32 . 2012-11-10 04:22 126976 ----a-w- c:\windows\system32\RDWebAI.dll
    2014-03-22 19:32 . 2012-11-10 04:20 135680 ----a-w- c:\windows\system32\appserverai.dll
    2014-03-22 19:32 . 2012-11-10 04:23 132608 ----a-w- c:\windows\SysWow64\poqexec.exe
    2014-03-22 19:32 . 2012-11-10 04:23 148480 ----a-w- c:\windows\system32\poqexec.exe
    2014-03-22 19:32 . 2012-12-13 04:00 2048 ----a-w- c:\windows\system32\tzres.dll
    2014-03-22 19:32 . 2012-12-13 03:59 2048 ----a-w- c:\windows\SysWow64\tzres.dll
    2014-03-21 07:14 . 2014-03-21 07:14 -------- d-----w- c:\windows\ServiceProfiles\LocalService\winhttp
    2014-03-21 07:08 . 2014-01-19 07:33 270496 ------w- c:\windows\system32\MpSigStub.exe
    2014-03-20 19:54 . 2014-03-20 19:54 -------- d-----w- c:\program files (x86)\Microsoft Synchronization Services
    2014-03-20 19:54 . 2014-03-20 19:54 -------- d-----w- c:\windows\PCHEALTH
    2014-03-20 19:54 . 2014-03-20 19:54 -------- d-----w- c:\program files (x86)\Microsoft Sync Framework
    2014-03-20 19:54 . 2014-03-20 19:54 -------- d-----w- c:\program files (x86)\Microsoft SQL Server Compact Edition
    2014-03-20 19:53 . 2014-03-20 19:53 -------- d-----w- c:\program files (x86)\Microsoft Visual Studio 8
    2014-03-20 19:53 . 2014-03-20 19:53 -------- d-----w- c:\program files\Microsoft Office
    2014-03-20 19:53 . 2014-03-20 19:53 -------- d-----w- c:\program files (x86)\Microsoft Analysis Services
    2014-03-20 19:53 . 2014-03-22 19:50 -------- d-----w- c:\programdata\Microsoft Help
    2014-03-20 19:51 . 2014-03-20 19:51 -------- d-----w- c:\program files (x86)\Elaborate Bytes
    2014-03-20 15:34 . 2014-03-20 15:34 254640 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10236.bin
    2014-03-20 12:19 . 2014-03-20 12:19 -------- d-----w- C:\Recovery
    2014-03-20 10:35 . 2014-03-20 10:35 -------- d-----w- c:\windows\SysWow64\spool
    2014-03-20 10:35 . 2014-03-20 10:35 -------- d-----w- c:\programdata\Sony
    2014-03-20 10:03 . 2014-03-20 10:35 -------- d-----w- c:\program files (x86)\Sony
    2014-03-20 10:03 . 2014-03-20 10:03 -------- d-----w- c:\program files\Sony
    2014-03-20 10:00 . 2014-03-20 10:00 -------- d-----w- c:\program files (x86)\AGEIA Technologies
    2014-03-20 10:00 . 2014-03-04 11:32 599840 ----a-w- c:\windows\SysWow64\nvStreaming.exe
    2014-03-20 09:59 . 2014-03-20 19:39 -------- d-----w- c:\programdata\PDVD
    2014-03-20 09:59 . 2014-04-03 17:52 -------- d-----w- c:\programdata\NVIDIA
    2014-03-20 09:59 . 2014-03-20 10:02 -------- d-----w- c:\windows\SysWow64\NV
    2014-03-20 09:59 . 2014-03-20 10:02 -------- d-----w- c:\windows\system32\NV
    2014-03-20 09:59 . 2014-03-04 13:06 6714312 ----a-w- c:\windows\system32\nvcpl.dll
    2014-03-20 09:59 . 2014-03-04 13:06 3497816 ----a-w- c:\windows\system32\nvsvc64.dll
    2014-03-20 09:59 . 2014-03-04 13:05 922968 ----a-w- c:\windows\system32\nvvsvc.exe
    2014-03-20 09:59 . 2014-03-04 13:05 64968 ----a-w- c:\windows\system32\nvshext.dll
    2014-03-20 09:59 . 2014-03-04 13:05 386336 ----a-w- c:\windows\system32\nvmctray.dll
    2014-03-20 09:59 . 2014-03-04 13:05 3649185 ----a-w- c:\windows\system32\nvcoproc.bin
    2014-03-20 09:59 . 2014-03-24 03:11 -------- d-----w- c:\programdata\CyberLink
    2014-03-20 09:59 . 2014-03-20 09:59 -------- d-----w- c:\users\Public\CyberLink
    2014-03-20 09:56 . 2014-03-20 09:56 -------- d-----w- c:\program files (x86)\Reference Assemblies
    2014-03-20 09:56 . 2014-03-20 19:55 -------- d-----w- c:\program files (x86)\MSBuild
    2014-03-20 09:56 . 2014-03-20 09:56 -------- d-----w- c:\program files\Reference Assemblies
    2014-03-20 09:56 . 2014-03-20 09:56 -------- d-----w- c:\program files\MSBuild
    2014-03-20 09:54 . 2012-07-06 02:02 778856 ----a-w- c:\windows\SysWow64\PresentationNative_v0300.dll
    2014-03-20 09:54 . 2012-07-06 02:02 35400 ----a-w- c:\windows\SysWow64\TsWpfWrp.exe
    2014-03-20 09:54 . 2012-07-06 02:02 35400 ----a-w- c:\windows\system32\TsWpfWrp.exe
    2014-03-20 09:54 . 2012-07-06 02:02 1166440 ----a-w- c:\windows\system32\PresentationNative_v0300.dll
    2014-03-20 09:52 . 2014-03-20 09:52 -------- d-----w- c:\programdata\install_clap
    2014-03-20 09:50 . 2014-03-20 09:50 -------- d-----w- c:\program files (x86)\VideoLAN
    2014-03-20 09:49 . 2014-03-20 09:49 -------- d-----w- c:\program files (x86)\Audacity
    2014-03-20 09:44 . 2010-05-26 15:41 511328 ----a-w- c:\windows\system32\d3dx10_43.dll
    2014-03-20 09:44 . 2010-05-26 15:41 470880 ----a-w- c:\windows\SysWow64\d3dx10_43.dll
    2014-03-20 09:44 . 2010-05-26 15:41 276832 ----a-w- c:\windows\system32\d3dx11_43.dll
    2014-03-20 09:40 . 2014-03-20 19:12 -------- d-----w- c:\programdata\Freemake
    2014-03-20 09:40 . 2014-03-20 09:40 -------- d-----w- c:\program files (x86)\Freemake
    2014-03-20 09:38 . 2014-03-20 09:38 -------- d-----w- c:\program files (x86)\MakeMKV
    2014-03-20 09:34 . 2013-11-14 03:41 439296 ----a-w- c:\windows\system32\plsapp64.dll
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2014-03-20 09:20 . 2012-07-26 08:13 22240 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
    2014-03-04 22:52 . 2012-07-26 08:14 78304 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
    2014-03-04 22:52 . 2012-07-26 08:14 694240 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
    2014-03-04 14:35 . 2012-07-25 20:22 18302384 ----a-w- c:\windows\system32\nvwgf2umx.dll
    2014-03-04 14:35 . 2012-06-28 02:06 14709720 ----a-w- c:\windows\SysWow64\nvd3dum.dll
    2014-01-17 20:24 . 2014-01-17 20:24 94208 ----a-w- c:\windows\SysWow64\QuickTimeVR.qtx
    2014-01-17 20:24 . 2014-01-17 20:24 69632 ----a-w- c:\windows\SysWow64\QuickTime.qts
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DellSystemDetect"="c:\users\fordg_000\AppData\Local\Apps\2.0\WC3AHZBR.6YB\KDP44OTC.4Z0\dell..tion_0f612f649c4a10af_0005.0005_9914611622934cec\DellSystemDetect.exe" [2014-03-20 253952]
    "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2014-02-10 20922016]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
    "PowerDVD13Agent"="c:\program files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe" [2013-03-20 513048]
    "VirtualCloneDrive"="c:\program files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2013-03-10 88984]
    "BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-01-21 91520]
    "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-09-13 59720]
    "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2014-01-17 421888]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "ConsentPromptBehaviorAdmin"= 5 (0x5)
    "EnableUIADesktopToggle"= 0 (0x0)
    "EnableCursorSuppression"= 1 (0x1)
    "ConsentPromptBehaviorUser"= 3 (0x3)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
    "LoadAppInit_DLLs"=1 (0x1)
    .
    [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
    "mixer2"=wdmaud.drv
    .
    R2 {09F57980-3432-4AFC-957D-27AC45FAE1F5};Power Control [2014/03/20 06:00];c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl;c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl [x]
    R2 c2cautoupdatesvc;Skype Click to Call Updater;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe;c:\program files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe [x]
    R2 c2cpnrsvc;Skype Click to Call PNR Service;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe;c:\program files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe [x]
    R2 CyberLink PowerDVD 13 Media Server Monitor Service;CyberLink PowerDVD 13 Media Server Monitor Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe [x]
    R2 CyberLink PowerDVD 13 Media Server Service;CyberLink PowerDVD 13 Media Server Service;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe;c:\program files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe [x]
    R2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [x]
    R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [x]
    R2 MSI_ODD_Service;MSI_ODD_Service;c:\program files (x86)\msi\ODD Monitor\ODD_Monitor.exe;c:\program files (x86)\msi\ODD Monitor\ODD_Monitor.exe [x]
    R2 NvNetworkService;NVIDIA Network Service;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe;c:\program files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [x]
    R2 NvStreamSvc;NVIDIA Streamer Service;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe;c:\program files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [x]
    R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
    R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
    R3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys;c:\windows\SYSNATIVE\drivers\mwac.sys [x]
    R3 NTIOLib_X64;NTIOLib_X64;c:\program files (x86)\msi\ODD Monitor\NTIOLib_X64.sys;c:\program files (x86)\msi\ODD Monitor\NTIOLib_X64.sys [x]
    R3 nvvad_WaveExtensible;NVIDIA Virtual Audio Device (Wave Extensible) (WDM);c:\windows\system32\drivers\nvvad64v.sys;c:\windows\SYSNATIVE\drivers\nvvad64v.sys [x]
    R3 WSDScan;WSD Scan Support;c:\windows\System32\drivers\WSDScan.sys;c:\windows\SYSNATIVE\drivers\WSDScan.sys [x]
    R3 WUDFWpdMtp;WUDFWpdMtp;c:\windows\system32\DRIVERS\WUDFRd.sys;c:\windows\SYSNATIVE\DRIVERS\WUDFRd.sys [x]
    S3 RTL8168;Realtek 8168 NT Driver;c:\windows\system32\DRIVERS\Rt630x64.sys;c:\windows\SYSNATIVE\DRIVERS\Rt630x64.sys [x]
    .
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2014-04-03 c:\windows\Tasks\Adobe Flash Player Updater.job
    - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-21 07:16]
    .
    .
    --------- X64 Entries -----------
    .
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-10-06 171040]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-10-06 399392]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2012-10-06 441888]
    "NvBackend"="c:\program files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe" [2014-01-21 2234144]
    "ShadowPlay"="c:\windows\system32\nvspcap64.dll" [2014-01-21 1179576]
    .
    ------- Supplementary Scan -------
    .
    uLocal Page = c:\windows\system32\blank.htm
    uStart Page = hxxp://search.yahoo.com/?type=586383&fr=spigot-yhp-ie
    mLocal Page = c:\windows\SysWOW64\blank.htm
    IE: E&xport to Microsoft Excel - c:\progra~2\MICROS~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~2\MICROS~1\Office14\ONBttnIE.dll/105
    Trusted Zone: dell.com
    TCP: DhcpNameServer = 75.75.75.75 75.75.76.76
    FF - ProfilePath - c:\users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\
    FF - prefs.js: browser.startup.homepage - hxxp://search.yahoo.com/?type=586383&fr=spigot-yhp-ff
    FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=586383&p=
    .
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\{09F57980-3432-4AFC-957D-27AC45FAE1F5}]
    "ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
    @Denied: (A) (Everyone)
    "Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
    @Denied: (A) (Everyone)
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
    "Key"="ActionsPane3"
    "Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
    @Denied: (Full) (Everyone)
    @SACL=(02 0000)
    .
    Completion time: 2014-04-03 14:04:24
    ComboFix-quarantined-files.txt 2014-04-03 18:04
    .
    Pre-Run: 853,683,175,424 bytes free
    Post-Run: 854,273,191,936 bytes free
    .
    - - End Of File - - 1BBDD8A45337C3C03C463EA0C486AEA2
    A36C5E4F47E84449FF07ED3517B43A31
     
  10. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    Looks good.

    From now on please download all next tools in safe mode but run them from normal mode.

    [​IMG] Please download AdwCleaner by Xplode onto your desktop.
    • Close all open programs and internet browsers.
    • Double click on adwcleaner.exe to run the tool.
    • Click on Scan button.
    • When the scan has finished click on Clean button.
    • Your computer will be rebooted automatically. A text file will open after the restart.
    • Please post the contents of that logfile with your next reply.
    • You can find the logfile at C:\AdwCleaner[S1].txt as well.

    [​IMG] Please download Junkware Removal Tool to your desktop.
    • Shut down your protection software now to avoid potential conflicts.
    • Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
    • The tool will open and start scanning your system.
    • Please be patient as this can take a while to complete depending on your system's specifications.
    • On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
    • Post the contents of JRT.txt into your next message.

    [​IMG] Download OTL to your Desktop.
    Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  11. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    AdwCleaner.txt


    # AdwCleaner v3.023 - Report created 04/04/2014 at 02:26:52
    # Updated 01/04/2014 by Xplode
    # Operating System : Windows 8 (64 bits)
    # Username : fordg_000 - SHAWNPC
    # Running from : C:\Users\fordg_000\Desktop\adwcleaner.exe
    # Option : Clean

    ***** [ Services ] *****


    ***** [ Files / Folders ] *****


    ***** [ Shortcuts ] *****


    ***** [ Registry ] *****

    Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
    Key Deleted : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
    Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
    Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
    Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}
    Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE805869-2E5C-4ED4-8F7B-F1F7851A4497}

    ***** [ Browsers ] *****

    -\\ Internet Explorer v10.0.9200.16843


    -\\ Mozilla Firefox v28.0 (en-US)

    [ File : C:\Users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\prefs.js ]


    *************************

    AdwCleaner[R0].txt - [1496 octets] - [04/04/2014 02:26:29]
    AdwCleaner[S0].txt - [1423 octets] - [04/04/2014 02:26:52]

    ########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [1483 octets] ##########

    JRT.txt

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Junkware Removal Tool (JRT) by Thisisu
    Version: 6.1.3 (03.23.2014:1)
    OS: Windows 8 x64
    Ran by fordg_000 on Fri 04/04/2014 at 2:29:26.28
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




    ~~~ Services



    ~~~ Registry Values



    ~~~ Registry Keys



    ~~~ Files



    ~~~ Folders

    Successfully deleted: [Folder] "C:\ProgramData\adtrustmedia"
    Successfully deleted: [Folder] "C:\Users\fordg_000\appdata\local\adtrustmedia"



    ~~~ FireFox

    Emptied folder: C:\Users\fordg_000\AppData\Roaming\mozilla\firefox\profiles\5c6yfvpy.default\minidumps [2 files]



    ~~~ Event Viewer Logs were cleared





    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    Scan was completed on Fri 04/04/2014 at 2:33:03.09
    End of JRT log
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     
     
  12. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    OTL.txt


    OTL logfile created on: 4/4/2014 2:34:50 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\fordg_000\Desktop
    64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
    Internet Explorer (Version = 9.10.9200.16843)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
    7.89 Gb Total Physical Memory | 6.20 Gb Available Physical Memory | 78.64% Memory free
    9.08 Gb Paging File | 7.29 Gb Available in Paging File | 80.34% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]
    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 931.17 Gb Total Space | 791.34 Gb Free Space | 84.98% Space Free | Partition Type: NTFS
    Drive D: | 45.06 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
    Computer Name: SHAWNPC | User Name: fordg_000 | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
    ========== Processes (SafeList) ==========
    PRC - [2014/04/04 02:15:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\fordg_000\Desktop\OTL.exe
    PRC - [2014/03/21 03:16:41 | 001,863,560 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
    PRC - [2014/03/15 04:40:21 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
    PRC - [2014/03/05 09:24:48 | 000,857,912 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
    PRC - [2014/03/05 09:24:46 | 001,809,720 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
    PRC - [2014/03/05 09:24:40 | 007,430,968 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
    PRC - [2014/03/04 07:32:56 | 000,411,936 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
    PRC - [2014/03/03 09:53:02 | 001,363,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe
    PRC - [2014/03/03 09:52:32 | 001,748,608 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe
    PRC - [2014/01/20 22:57:40 | 002,234,144 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe
    PRC - [2014/01/20 22:57:07 | 001,593,632 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe
    PRC - [2013/03/20 07:23:33 | 000,513,048 | ---- | M] (CyberLink Corp.) -- C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe
    PRC - [2013/03/20 07:23:29 | 000,323,336 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe
    PRC - [2013/03/20 07:23:27 | 000,077,576 | ---- | M] (CyberLink) -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe
    PRC - [2011/10/04 15:42:30 | 000,076,800 | ---- | M] (Micro-Star Int'l Co., Ltd.) -- C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe
    ========== Modules (No Company Name) ==========
    MOD - [2014/03/21 03:16:40 | 016,276,872 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll
    MOD - [2014/03/15 04:40:39 | 003,642,480 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
    MOD - [2014/03/04 10:35:23 | 000,014,280 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\coprocmanager\detoured.dll
    MOD - [2013/03/20 07:24:55 | 000,043,272 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DHProcedure\DHProcedure.dll
    MOD - [2011/08/24 04:39:11 | 000,655,360 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\Koan\_ssl.pyd
    MOD - [2011/08/24 04:39:11 | 000,081,920 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\Koan\_ctypes.pyd
    MOD - [2011/08/24 04:39:11 | 000,053,248 | ---- | M] () -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\Koan\_socket.pyd
    MOD - [2010/01/21 01:34:10 | 008,793,952 | ---- | M] () -- C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
    MOD - [2010/01/09 20:18:18 | 004,254,560 | ---- | M] () -- C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
    ========== Services (SafeList) ==========
    SRV:64bit: - [2014/01/20 22:56:53 | 016,939,296 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe -- (NvStreamSvc)
    SRV:64bit: - [2013/10/25 03:34:55 | 000,016,048 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
    SRV:64bit: - [2013/08/16 01:39:26 | 002,371,728 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\WSService.dll -- (WSService)
    SRV:64bit: - [2013/06/24 18:54:45 | 000,263,680 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\wcmsvc.dll -- (Wcmsvc)
    SRV:64bit: - [2013/06/01 05:19:58 | 000,207,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\DeviceSetupManager.dll -- (DsmSvc)
    SRV:64bit: - [2013/05/04 02:58:02 | 000,470,528 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\netprofmsvc.dll -- (netprofm)
    SRV:64bit: - [2013/05/04 02:57:05 | 000,179,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\bisrv.dll -- (BrokerInfrastructure)
    SRV:64bit: - [2013/04/09 00:48:42 | 000,169,472 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\AudioEndpointBuilder.dll -- (AudioEndpointBuilder)
    SRV:64bit: - [2013/03/01 22:45:07 | 000,171,008 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\TimeBrokerServer.dll -- (TimeBroker)
    SRV:64bit: - [2013/03/01 22:45:05 | 000,180,224 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\SystemEventsBrokerServer.dll -- (SystemEventsBroker)
    SRV:64bit: - [2013/01/09 19:23:16 | 001,964,544 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\wlidsvc.dll -- (wlidsvc)
    SRV:64bit: - [2013/01/09 19:22:35 | 000,438,272 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\lsm.dll -- (LSM)
    SRV:64bit: - [2012/09/20 02:31:18 | 000,116,736 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\fhsvc.dll -- (fhsvc)
    SRV:64bit: - [2012/07/25 23:30:05 | 002,675,200 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll -- (PrintNotify)
    SRV:64bit: - [2012/07/25 23:07:47 | 000,065,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\wiarpc.dll -- (WiaRpc)
    SRV:64bit: - [2012/07/25 23:07:40 | 000,283,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\vaultsvc.dll -- (VaultSvc)
    SRV:64bit: - [2012/07/25 23:07:25 | 000,012,800 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svsvc.dll -- (svsvc)
    SRV:64bit: - [2012/07/25 23:06:34 | 000,743,936 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\netlogon.dll -- (Netlogon)
    SRV:64bit: - [2012/07/25 23:06:33 | 000,161,792 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\NcaSvc.dll -- (NcaSvc)
    SRV:64bit: - [2012/07/25 23:06:33 | 000,073,728 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\NcdAutoSetup.dll -- (NcdAutoSetup)
    SRV:64bit: - [2012/07/25 23:05:55 | 000,059,904 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\SysNative\keyiso.dll -- (KeyIso)
    SRV:64bit: - [2012/07/25 23:05:34 | 000,037,376 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\efssvc.dll -- (EFS)
    SRV:64bit: - [2012/07/25 23:05:24 | 000,342,016 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\SysNative\das.dll -- (DeviceAssociationService)
    SRV:64bit: - [2012/07/25 23:05:08 | 000,122,368 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\AUInstallAgent.dll -- (AllUserInstallAgent)
    SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicvss)
    SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmictimesync)
    SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicshutdown)
    SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicrdv)
    SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmickvpexchange)
    SRV:64bit: - [2012/07/25 20:24:02 | 000,336,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\icsvc.dll -- (vmicheartbeat)
    SRV - [2014/04/03 03:29:10 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
    SRV - [2014/03/21 03:16:41 | 000,257,928 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
    SRV - [2014/03/15 04:40:31 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
    SRV - [2014/03/05 09:24:48 | 000,857,912 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2014/03/05 09:24:46 | 001,809,720 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
    SRV - [2014/03/04 07:32:56 | 000,411,936 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
    SRV - [2014/03/03 09:53:02 | 001,363,584 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\AutoUpdate\SkypeC2CAutoUpdateSvc.exe -- (c2cautoupdatesvc)
    SRV - [2014/03/03 09:52:32 | 001,748,608 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files (x86)\Skype\Toolbars\PNRSvc\SkypeC2CPNRSvc.exe -- (c2cpnrsvc)
    SRV - [2014/01/20 22:57:07 | 001,593,632 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe -- (NvNetworkService)
    SRV - [2013/10/23 08:15:08 | 000,172,192 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
    SRV - [2013/03/20 07:23:29 | 000,323,336 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSServerPDVD13.exe -- (CyberLink PowerDVD 13 Media Server Service)
    SRV - [2013/03/20 07:23:27 | 000,077,576 | ---- | M] (CyberLink) [Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Kernel\DMS\CLMSMonitorServicePDVD13.exe -- (CyberLink PowerDVD 13 Media Server Monitor Service)
    SRV - [2012/10/06 00:12:10 | 000,277,024 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs)
    SRV - [2012/07/25 23:30:05 | 002,675,200 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll -- (PrintNotify)
    SRV - [2012/07/25 23:20:04 | 000,018,432 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\StorSvc.dll -- (StorSvc)
    SRV - [2011/10/04 15:42:30 | 000,076,800 | ---- | M] (Micro-Star Int'l Co., Ltd.) [Auto | Running] -- C:\Program Files (x86)\msi\ODD Monitor\ODD_Monitor.exe -- (MSI_ODD_Service)
    ========== Driver Services (SafeList) ==========
    DRV:64bit: - [2014/04/04 02:27:50 | 000,119,512 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\MBAMSwissArmy.sys -- (MBAMSwissArmy)
    DRV:64bit: - [2014/03/05 09:26:22 | 000,063,192 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\mwac.sys -- (MBAMWebAccessControl)
    DRV:64bit: - [2014/03/05 09:26:04 | 000,025,816 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\Drivers\mbam.sys -- (MBAMProtector)
    DRV:64bit: - [2013/12/27 14:42:26 | 000,039,200 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\nvvad64v.sys -- (nvvad_WaveExtensible)
    DRV:64bit: - [2013/11/28 09:38:18 | 000,197,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\nvhda64v.sys -- (NVHDA)
    DRV:64bit: - [2013/10/25 03:34:52 | 000,035,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WdBoot.sys -- (WdBoot)
    DRV:64bit: - [2013/10/24 18:34:32 | 000,248,240 | ---- | M] (Microsoft Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\Drivers\WdFilter.sys -- (WdFilter)
    DRV:64bit: - [2013/10/10 07:53:35 | 000,096,600 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\wfplwfs.sys -- (WFPLWFS)
    DRV:64bit: - [2013/10/05 02:10:20 | 000,285,016 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\spaceport.sys -- (spaceport)
    DRV:64bit: - [2013/10/01 22:50:07 | 000,447,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\USBHUB3.SYS -- (USBHUB3)
    DRV:64bit: - [2013/08/16 01:41:13 | 000,058,200 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\Windows\SysNative\Drivers\dam.sys -- (dam)
    DRV:64bit: - [2013/08/10 02:30:22 | 000,151,896 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\tpm.sys -- (TPM)
    DRV:64bit: - [2013/07/24 11:02:55 | 000,034,816 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\VClone.sys -- (VClone)
    DRV:64bit: - [2013/07/09 04:04:07 | 000,120,144 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpioclx.sys -- (GPIOClx0101)
    DRV:64bit: - [2013/07/01 21:41:47 | 000,337,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\USBXHCI.SYS -- (USBXHCI)
    DRV:64bit: - [2013/07/01 21:41:47 | 000,213,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\UCX01000.SYS -- (UCX01000)
    DRV:64bit: - [2013/06/29 02:15:54 | 000,195,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdbus.sys -- (sdbus)
    DRV:64bit: - [2013/05/31 23:08:57 | 000,037,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthAvrcpTg.sys -- (BthAvrcpTg)
    DRV:64bit: - [2013/03/04 08:24:27 | 000,040,344 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\ElbyCDIO.sys -- (ElbyCDIO)
    DRV:64bit: - [2013/03/02 06:57:46 | 000,077,544 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\storahci.sys -- (storahci)
    DRV:64bit: - [2013/03/02 06:39:38 | 000,069,864 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\pdc.sys -- (pdc)
    DRV:64bit: - [2013/01/09 21:53:32 | 000,028,904 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\msgpiowin32.sys -- (msgpiowin32)
    DRV:64bit: - [2012/11/26 23:55:44 | 000,029,952 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\BthhfHid.sys -- (bthhfhid)
    DRV:64bit: - [2012/11/20 00:54:31 | 000,039,936 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hidi2c.sys -- (hidi2c)
    DRV:64bit: - [2012/11/05 23:55:44 | 000,022,528 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\fxppm.sys -- (FxPPM)
    DRV:64bit: - [2012/10/12 04:08:01 | 000,027,880 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
    DRV:64bit: - [2012/10/11 03:25:48 | 000,056,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\sdstor.sys -- (sdstor)
    DRV:64bit: - [2012/10/11 01:19:44 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\WSDScan.sys -- (WSDScan)
    DRV:64bit: - [2012/10/06 00:12:34 | 009,004,384 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\igdkmd64.sys -- (igfx)
    DRV:64bit: - [2012/09/20 03:55:27 | 003,265,256 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\evbda.sys -- (ebdrv)
    DRV:64bit: - [2012/09/20 03:55:24 | 000,533,224 | ---- | M] (Broadcom Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\bxvbda.sys -- (b06bdrv)
    DRV:64bit: - [2012/07/26 01:26:46 | 000,025,328 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\WINDOWS\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
    DRV:64bit: - [2012/07/26 01:26:45 | 000,033,792 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\condrv.sys -- (condrv)
    DRV:64bit: - [2012/07/26 01:00:58 | 000,322,800 | ---- | M] (VIA Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\VSTXRAID.SYS -- (VSTXRAID)
    DRV:64bit: - [2012/07/26 01:00:58 | 000,106,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\VerifierExt.sys -- (VerifierExt)
    DRV:64bit: - [2012/07/26 01:00:58 | 000,097,008 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\uaspstor.sys -- (UASPStor)
    DRV:64bit: - [2012/07/26 01:00:57 | 000,077,040 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\acpiex.sys -- (acpiex)
    DRV:64bit: - [2012/07/26 01:00:55 | 000,064,240 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\mvumis.sys -- (mvumis)
    DRV:64bit: - [2012/07/26 01:00:55 | 000,030,960 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\stexstor.sys -- (stexstor)
    DRV:64bit: - [2012/07/26 01:00:52 | 000,092,400 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sas2.sys -- (LSI_SAS2)
    DRV:64bit: - [2012/07/26 01:00:52 | 000,081,136 | ---- | M] (LSI Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\lsi_sss.sys -- (LSI_SSS)
    DRV:64bit: - [2012/07/26 01:00:52 | 000,064,752 | ---- | M] (Hewlett-Packard Company) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\HpSAMD.sys -- (HpSAMD)
    DRV:64bit: - [2012/07/26 01:00:51 | 000,113,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys -- (EhStorTcgDrv)
    DRV:64bit: - [2012/07/26 01:00:51 | 000,081,136 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\EhStorClass.sys -- (EhStorClass)
    DRV:64bit: - [2012/07/26 01:00:49 | 000,258,288 | ---- | M] (AMD Technologies Inc.) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsbs.sys -- (amdsbs)
    DRV:64bit: - [2012/07/26 01:00:49 | 000,106,736 | ---- | M] (LSI) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\3ware.sys -- (3ware)
    DRV:64bit: - [2012/07/26 01:00:49 | 000,076,016 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdsata.sys -- (amdsata)
    DRV:64bit: - [2012/07/26 01:00:48 | 000,026,352 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Stopped] -- C:\Windows\SysNative\Drivers\amdxata.sys -- (amdxata)
    DRV:64bit: - [2012/07/26 00:57:54 | 000,361,200 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\clfs.sys -- (CLFS)
    DRV:64bit: - [2012/07/26 00:53:16 | 000,067,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vpci.sys -- (vpci)
    DRV:64bit: - [2012/07/25 23:17:38 | 000,036,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\terminpt.sys -- (terminpt)
    DRV:64bit: - [2012/07/25 22:29:47 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\WSDPrint.sys -- (WSDPrintDevice)
    DRV:64bit: - [2012/07/25 22:29:14 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mshidumdf.sys -- (mshidumdf)
    DRV:64bit: - [2012/07/25 22:29:08 | 000,048,640 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicDisplay.sys -- (BasicDisplay)
    DRV:64bit: - [2012/07/25 22:29:03 | 000,024,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\HyperVideo.sys -- (HyperVideo)
    DRV:64bit: - [2012/07/25 22:28:52 | 000,029,696 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\BasicRender.sys -- (BasicRender)
    DRV:64bit: - [2012/07/25 22:27:58 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\vmgencounter.sys -- (gencounter)
    DRV:64bit: - [2012/07/25 22:27:41 | 000,018,432 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\kdnic.sys -- (kdnic)
    DRV:64bit: - [2012/07/25 22:27:37 | 000,010,752 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpitime.sys -- (acpitime)
    DRV:64bit: - [2012/07/25 22:27:33 | 000,023,552 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Drivers\npsvctrig.sys -- (npsvctrig)
    DRV:64bit: - [2012/07/25 22:27:29 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\WpdUpFltr.sys -- (WpdUpFltr)
    DRV:64bit: - [2012/07/25 22:27:16 | 000,010,240 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\acpipagr.sys -- (acpipagr)
    DRV:64bit: - [2012/07/25 22:27:01 | 000,011,776 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\hyperkbd.sys -- (hyperkbd)
    DRV:64bit: - [2012/07/25 22:26:46 | 000,062,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SerCx.sys -- (SerCx)
    DRV:64bit: - [2012/07/25 22:26:43 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\SpbCx.sys -- (SpbCx)
    DRV:64bit: - [2012/07/25 22:26:34 | 000,030,208 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbGD.sys -- (TsUsbGD)
    DRV:64bit: - [2012/07/25 22:26:13 | 000,051,200 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\bthhfenum.sys -- (BthHFEnum)
    DRV:64bit: - [2012/07/25 22:25:57 | 000,033,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\dmvsc.sys -- (dmvsc)
    DRV:64bit: - [2012/07/25 22:25:56 | 000,057,344 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\TsUsbFlt.sys -- (TsUsbFlt)
    DRV:64bit: - [2012/07/25 22:25:13 | 000,045,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\wpcfltr.sys -- (wpcfltr)
    DRV:64bit: - [2012/07/25 22:25:01 | 000,126,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\NdisImPlatform.sys -- (NdisImPlatform)
    DRV:64bit: - [2012/07/25 22:23:53 | 000,068,608 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\mslldp.sys -- (MsLldp)
    DRV:64bit: - [2012/07/25 22:23:42 | 000,097,792 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\Drivers\Ndu.sys -- (Ndu)
    DRV:64bit: - [2012/06/02 10:31:56 | 000,589,824 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\Rt630x64.sys -- (RTL8168)
    DRV:64bit: - [2012/06/02 10:31:32 | 002,935,808 | ---- | M] (Qualcomm Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\athrx.sys -- (athr)
    DRV:64bit: - [2010/10/19 23:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\Drivers\HECIx64.sys -- (MEIx64)
    DRV - [2013/03/19 11:08:28 | 000,130,320 | ---- | M] (CyberLink Corp.) [2014/03/20 06:00:14] [Kernel | Auto | Running] -- C:\Program Files (x86)\CyberLink\PowerDVD13\Common\NavFilter\000.fcl -- ({09F57980-3432-4AFC-957D-27AC45FAE1F5})
    DRV - [2010/01/18 10:36:44 | 000,014,136 | ---- | M] (MSI) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\msi\ODD Monitor\NTIOLib_X64.sys -- (NTIOLib_X64)
    ========== Standard Registry (SafeList) ==========
    ========== Internet Explorer ==========

    IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
    IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
    IE - HKLM\..\SearchScopes,DefaultScope =
    IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
    IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com/?type=586383&fr=spigot-yhp-ie
    IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\..\SearchScopes,DefaultScope =
    IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
    IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\..\SearchScopes\{44FD12AE-49C5-40CA-9683-94AE454FDA0F}: "URL" = http://search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=586383&p={searchTerms}
    IE - HKU\S-1-5-21-1752066307-218487803-444230657-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    ========== FireFox ==========
    FF - prefs.js..browser.startup.homepage: "http://search.yahoo.com/?type=586383&fr=spigot-yhp-ff"
    FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:28.0
    FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=586383&p="
    FF - user.js - File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll File not found
    FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
    FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
    FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
    FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 28.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
    [2014/03/20 05:32:36 | 000,000,000 | ---D | M] (No name found) -- C:\Users\fordg_000\AppData\Roaming\Mozilla\Extensions
    [2014/03/23 23:22:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\extensions
    [2014/03/31 00:51:56 | 000,000,803 | ---- | M] () -- C:\Users\fordg_000\AppData\Roaming\Mozilla\Firefox\Profiles\5c6yfvpy.default\searchplugins\yahoo_ff.xml
    [2014/03/20 05:44:23 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
    [2014/03/20 05:32:21 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    O1 HOSTS File: ([2012/07/26 01:26:49 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
    O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [NvBackend] C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe (NVIDIA Corporation)
    O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)
    O4:64bit: - HKLM..\Run: [ShadowPlay] C:\WINDOWS\SysNative\nvspcap64.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
    O4 - HKLM..\Run: [PowerDVD13Agent] C:\Program Files (x86)\CyberLink\PowerDVD13\PowerDVD13Agent.exe (CyberLink Corp.)
    O4 - HKU\S-1-5-21-1752066307-218487803-444230657-1001..\Run: [DellSystemDetect] C:\Users\fordg_000\AppData\Local\Apps\2.0\WC3AHZBR.6YB\KDP44OTC.4Z0\dell..tion_0f612f649c4a10af_0005.0005_9914611622934cec\DellSystemDetect.exe (Dell)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-1752066307-218487803-444230657-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-1752066307-218487803-444230657-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
    O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    O13 - gopher Prefix: missing
    O15 - HKU\S-1-5-21-1752066307-218487803-444230657-1001\..Trusted Domains: dell.com ([]* in Trusted sites)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 75.75.75.75 75.75.76.76
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F3852D2A-8910-4C3A-B06C-C50836462624}: DhcpNameServer = 75.75.75.75 75.75.76.76
    O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
    O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
    O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\SkypeIEPlugin.dll (Microsoft Corporation)
    O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20:64bit: - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\SysWow64\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
    O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\WINDOWS\SysNative\igfxdev.dll (Intel Corporation)
    O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
    O30 - LSA: Security Packages - (livessp) - File not found
    O32 - HKLM CDRom: AutoRun - 1
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35:64bit: - HKLM\..comfile [open] -- "%1" %*
    O35:64bit: - HKLM\..exefile [open] -- "%1" %*
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
    O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*
    O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
    O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
    ========== Files/Folders - Created Within 30 Days ==========
    [2014/04/04 02:29:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERUNT
    [2014/04/04 02:26:26 | 000,000,000 | ---D | C] -- C:\AdwCleaner
    [2014/04/04 02:15:31 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\fordg_000\Desktop\OTL.exe
    [2014/04/04 02:15:27 | 001,038,974 | ---- | C] (Thisisu) -- C:\Users\fordg_000\Desktop\JRT.exe
    [2014/04/04 02:05:50 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\CrashDumps
    [2014/04/03 14:04:29 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2014/04/03 14:04:25 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
    [2014/04/03 14:04:25 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\temp
    [2014/04/03 13:58:15 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2014/04/03 13:58:15 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2014/04/03 13:58:15 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2014/04/03 13:58:15 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
    [2014/04/03 13:58:12 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2014/04/03 13:58:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\erdnt
    [2014/04/03 13:54:44 | 005,193,944 | R--- | C] (Swearware) -- C:\Users\fordg_000\Desktop\ComboFix.exe
    [2014/04/03 03:29:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Macrovision Shared
    [2014/04/03 03:24:27 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Desktop\mbar
    [2014/04/03 03:21:18 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Desktop\RK_Quarantine
    [2014/04/01 16:02:23 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\IsolatedStorage
    [2014/04/01 15:29:23 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\IsolatedStorage
    [2014/04/01 14:48:35 | 000,423,240 | ---- | C] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\raqimtca.sys
    [2014/04/01 14:45:48 | 000,000,000 | ---D | C] -- C:\Program Files\AdTrustMedia
    [2014/04/01 14:45:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo Downloader
    [2014/04/01 14:45:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo
    [2014/04/01 14:41:51 | 000,423,240 | ---- | C] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\dgwtjwvu.sys
    [2014/04/01 14:41:44 | 000,423,240 | ---- | C] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\jswsyyiw.sys
    [2014/04/01 14:41:43 | 000,000,000 | ---D | C] -- C:\ProgramData\AVAST Software
    [2014/03/31 13:35:23 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Apple Computer
    [2014/03/31 13:23:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
    [2014/03/31 13:15:00 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\ElevatedDiagnostics
    [2014/03/31 13:07:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
    [2014/03/31 13:07:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\QuickTime
    [2014/03/31 13:07:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple Computer
    [2014/03/31 13:06:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Apple
    [2014/03/31 13:06:39 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Apple
    [2014/03/31 13:06:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Apple Software Update
    [2014/03/31 13:06:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Apple
    [2014/03/31 02:33:10 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Sony Creative Software Inc
    [2014/03/31 01:20:44 | 000,000,000 | ---D | C] -- C:\ProgramData\IsolatedStorage
    [2014/03/31 01:20:03 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Vegasaur
    [2014/03/31 01:20:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Vegasaur
    [2014/03/31 01:20:02 | 000,000,000 | ---D | C] -- C:\Program Files\Vegasaur
    [2014/03/31 01:10:41 | 000,119,512 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\MBAMSwissArmy.sys
    [2014/03/31 01:10:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
    [2014/03/31 01:10:32 | 000,091,352 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbamchameleon.sys
    [2014/03/31 01:10:32 | 000,063,192 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mwac.sys
    [2014/03/31 01:10:32 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbam.sys
    [2014/03/31 01:10:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
    [2014/03/31 01:10:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2014/03/30 22:25:40 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Documents\OFX Presets
    [2014/03/30 21:05:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Subtitle Edit
    [2014/03/30 21:05:56 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Subtitle Edit
    [2014/03/30 21:05:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Subtitle Edit
    [2014/03/30 17:22:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Rosetta Stone
    [2014/03/29 04:07:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Rosetta Stone
    [2014/03/22 15:51:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysNative\MRT
    [2014/03/21 03:16:47 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Macromedia
    [2014/03/20 15:55:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SharePoint
    [2014/03/20 15:55:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office
    [2014/03/20 15:55:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DESIGNER
    [2014/03/20 15:54:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Synchronization Services
    [2014/03/20 15:54:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\PCHEALTH
    [2014/03/20 15:54:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Sync Framework
    [2014/03/20 15:54:23 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
    [2014/03/20 15:53:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Visual Studio 8
    [2014/03/20 15:53:26 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
    [2014/03/20 15:53:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Analysis Services
    [2014/03/20 15:53:06 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Microsoft Help
    [2014/03/20 15:53:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office
    [2014/03/20 15:53:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft Help
    [2014/03/20 15:51:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Elaborate Bytes
    [2014/03/20 15:51:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Elaborate Bytes
    [2014/03/20 15:13:12 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\vlc
    [2014/03/20 08:19:02 | 000,000,000 | ---D | C] -- C:\Recovery
    [2014/03/20 08:17:57 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
    [2014/03/20 08:14:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
    [2014/03/20 06:47:18 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\.MakeMKV
    [2014/03/20 06:39:17 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Publish Providers
    [2014/03/20 06:39:09 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\NVIDIA
    [2014/03/20 06:35:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\spool
    [2014/03/20 06:35:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony
    [2014/03/20 06:03:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
    [2014/03/20 06:03:41 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Sony
    [2014/03/20 06:03:41 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
    [2014/03/20 06:03:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sony
    [2014/03/20 06:00:42 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Cyberlink SoftDMA
    [2014/03/20 06:00:40 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Documents\CyberLink
    [2014/03/20 06:00:40 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\CyberLink
    [2014/03/20 06:00:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AGEIA Technologies
    [2014/03/20 06:00:12 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\MediaServer
    [2014/03/20 06:00:12 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\CyberLink
    [2014/03/20 05:59:56 | 000,000,000 | ---D | C] -- C:\ProgramData\PDVD
    [2014/03/20 05:59:55 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA
    [2014/03/20 05:59:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysWow64\NV
    [2014/03/20 05:59:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\SysNative\NV
    [2014/03/20 05:59:49 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\CyberLink
    [2014/03/20 05:59:49 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
    [2014/03/20 05:59:48 | 000,000,000 | R--D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD 13
    [2014/03/20 05:58:43 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\CyberLink
    [2014/03/20 05:56:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Reference Assemblies
    [2014/03/20 05:56:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MSBuild
    [2014/03/20 05:56:01 | 000,000,000 | ---D | C] -- C:\Program Files\Reference Assemblies
    [2014/03/20 05:56:00 | 000,000,000 | ---D | C] -- C:\Program Files\MSBuild
    [2014/03/20 05:52:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Temp
    [2014/03/20 05:52:32 | 000,000,000 | ---D | C] -- C:\ProgramData\install_clap
    [2014/03/20 05:51:56 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\WinRAR
    [2014/03/20 05:51:43 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WinRAR
    [2014/03/20 05:51:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
    [2014/03/20 05:51:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinRAR
    [2014/03/20 05:50:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
    [2014/03/20 05:50:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VideoLAN
    [2014/03/20 05:49:33 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Audacity
    [2014/03/20 05:49:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Audacity
    [2014/03/20 05:44:26 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\NVIDIA Corporation
    [2014/03/20 05:44:00 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\NVIDIA
    [2014/03/20 05:43:54 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA Corporation
    [2014/03/20 05:43:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
    [2014/03/20 05:43:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
    [2014/03/20 05:42:58 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation
    [2014/03/20 05:42:30 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Skype
    [2014/03/20 05:42:24 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Skype
    [2014/03/20 05:42:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
    [2014/03/20 05:42:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
    [2014/03/20 05:42:21 | 000,000,000 | R--D | C] -- C:\Program Files (x86)\Skype
    [2014/03/20 05:42:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
    [2014/03/20 05:41:34 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Sony
    [2014/03/20 05:40:16 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\Documents\Freemake
    [2014/03/20 05:40:16 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Freemake
    [2014/03/20 05:40:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Freemake
    [2014/03/20 05:40:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Freemake
    [2014/03/20 05:40:04 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Freemake
    [2014/03/20 05:38:17 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\MakeMKV
    [2014/03/20 05:38:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\MakeMKV
    [2014/03/20 05:37:45 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Programs
    [2014/03/20 05:34:21 | 000,439,296 | ---- | C] (Sendori) -- C:\WINDOWS\SysNative\plsapp64.dll
    [2014/03/20 05:33:30 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\BitTorrent
    [2014/03/20 05:32:30 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Mozilla
    [2014/03/20 05:32:29 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Mozilla
    [2014/03/20 05:32:22 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
    [2014/03/20 05:32:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
    [2014/03/20 05:32:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
    [2014/03/20 05:32:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\InstallShield Installation Information
    [2014/03/20 05:32:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\msi
    [2014/03/20 05:31:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
    [2014/03/20 05:28:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intel
    [2014/03/20 05:28:39 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Intel
     
  13. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    [2014/03/20 05:28:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Intel
    [2014/03/20 05:28:36 | 000,056,832 | ---- | C] (Khronos Group) -- C:\WINDOWS\SysNative\OpenCL.DLL
    [2014/03/20 05:28:36 | 000,056,320 | ---- | C] (Khronos Group) -- C:\WINDOWS\SysWow64\OpenCL.DLL
    [2014/03/20 05:27:03 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dell
    [2014/03/20 05:26:20 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Deployment
    [2014/03/20 05:26:20 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Apps
    [2014/03/20 05:24:20 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Macromedia
    [2014/03/20 05:21:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
    [2014/03/20 05:21:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Searches
    [2014/03/20 05:21:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Contacts
    [2014/03/20 05:21:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
    [2014/03/20 05:21:06 | 000,000,000 | -H-D | C] -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\User Pinned
    [2014/03/20 05:21:04 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Adobe
    [2014/03/20 05:20:34 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\VirtualStore
    [2014/03/20 05:20:25 | 000,000,000 | ---D | C] -- C:\ProgramData\PRICache
    [2014/03/20 05:20:25 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Packages
    [2014/03/20 05:20:06 | 000,000,000 | --SD | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Videos
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Saved Games
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Pictures
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Music
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Links
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Favorites
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Downloads
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Documents
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\Desktop
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
    [2014/03/20 05:20:06 | 000,000,000 | R--D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\AppData\Local\Temporary Internet Files
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Templates
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Start Menu
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\SendTo
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Recent
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\PrintHood
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\NetHood
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Documents\My Videos
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Documents\My Pictures
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Documents\My Music
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\My Documents
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Local Settings
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\AppData\Local\History
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Cookies
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\Application Data
    [2014/03/20 05:20:06 | 000,000,000 | -HSD | C] -- C:\Users\fordg_000\AppData\Local\Application Data
    [2014/03/20 05:20:06 | 000,000,000 | -H-D | C] -- C:\Users\fordg_000\AppData
    [2014/03/20 05:20:06 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Local\Microsoft
    [2014/03/20 05:20:06 | 000,000,000 | ---D | C] -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
    [2014/03/20 04:59:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\Panther
    [2014/03/16 15:22:38 | 000,000,000 | ---D | C] -- C:\Config.Msi
    ========== Files - Modified Within 30 Days ==========
    [2014/04/04 02:34:37 | 000,848,230 | ---- | M] () -- C:\WINDOWS\SysNative\PerfStringBackup.INI
    [2014/04/04 02:34:37 | 000,718,176 | ---- | M] () -- C:\WINDOWS\SysNative\perfh009.dat
    [2014/04/04 02:34:37 | 000,132,542 | ---- | M] () -- C:\WINDOWS\SysNative\perfc009.dat
    [2014/04/04 02:29:36 | 000,067,584 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2014/04/04 02:27:50 | 000,119,512 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\MBAMSwissArmy.sys
    [2014/04/04 02:27:35 | 268,435,456 | -HS- | M] () -- C:\swapfile.sys
    [2014/04/04 02:27:32 | 2482,118,655 | -HS- | M] () -- C:\hiberfil.sys
    [2014/04/04 02:15:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\fordg_000\Desktop\OTL.exe
    [2014/04/04 02:15:30 | 001,038,974 | ---- | M] (Thisisu) -- C:\Users\fordg_000\Desktop\JRT.exe
    [2014/04/04 02:15:25 | 001,426,178 | ---- | M] () -- C:\Users\fordg_000\Desktop\adwcleaner.exe
    [2014/04/03 17:07:00 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
    [2014/04/03 15:28:22 | 000,099,984 | ---- | M] () -- C:\Users\fordg_000\Desktop\Capture_20140403.avi.sfk
    [2014/04/03 13:54:48 | 005,193,944 | R--- | M] (Swearware) -- C:\Users\fordg_000\Desktop\ComboFix.exe
    [2014/04/03 03:24:28 | 000,091,352 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbamchameleon.sys
    [2014/04/02 04:23:10 | 000,000,000 | -H-- | M] () -- C:\WINDOWS\SysNative\drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
    [2014/04/01 14:48:35 | 000,423,240 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\raqimtca.sys
    [2014/04/01 14:43:34 | 000,002,259 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
    [2014/04/01 14:41:51 | 000,423,240 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\dgwtjwvu.sys
    [2014/04/01 14:41:44 | 000,423,240 | ---- | M] (AVAST Software) -- C:\WINDOWS\SysNative\drivers\jswsyyiw.sys
    [2014/03/31 00:51:40 | 000,007,632 | ---- | M] () -- C:\Users\fordg_000\AppData\Local\Resmon.ResmonCfg
    [2014/03/29 04:03:24 | 000,565,652 | ---- | M] () -- C:\Users\fordg_000\Documents\0127132031.jpg
    [2014/03/29 02:50:27 | 000,422,160 | ---- | M] () -- C:\WINDOWS\SysNative\FNTCACHE.DAT
    [2014/03/20 05:59:48 | 000,001,411 | ---- | M] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 13.lnk
    [2014/03/20 05:50:10 | 000,001,066 | ---- | M] () -- C:\Users\Public\Desktop\VLC media player.lnk
    [2014/03/20 05:42:22 | 000,002,697 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
    [2014/03/20 05:38:17 | 000,000,991 | ---- | M] () -- C:\Users\fordg_000\Desktop\MakeMKV.lnk
    [2014/03/20 05:32:23 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
    [2014/03/20 05:23:43 | 000,001,424 | ---- | M] () -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2014/03/05 09:26:22 | 000,063,192 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mwac.sys
    [2014/03/05 09:26:04 | 000,025,816 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\SysNative\drivers\mbam.sys
    ========== Files Created - No Company Name ==========
    [2014/04/04 02:15:20 | 001,426,178 | ---- | C] () -- C:\Users\fordg_000\Desktop\adwcleaner.exe
    [2014/04/04 02:14:16 | 000,001,509 | ---- | C] () -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RosettaStoneVersion3.lnk
    [2014/04/03 15:28:10 | 000,099,984 | ---- | C] () -- C:\Users\fordg_000\Desktop\Capture_20140403.avi.sfk
    [2014/04/03 13:58:15 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2014/04/03 13:58:15 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2014/04/03 13:58:15 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2014/04/03 13:58:15 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2014/04/03 13:58:15 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2014/04/02 04:23:10 | 000,000,000 | -H-- | C] () -- C:\WINDOWS\SysNative\drivers\Msft_User_WpdMtpDr_01_11_00.Wdf
    [2014/04/01 14:43:34 | 000,002,259 | ---- | C] () -- C:\WINDOWS\epplauncher.mif
    [2014/03/31 13:06:38 | 000,002,519 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Apple Software Update.lnk
    [2014/03/31 00:48:30 | 000,007,632 | ---- | C] () -- C:\Users\fordg_000\AppData\Local\Resmon.ResmonCfg
    [2014/03/29 04:02:58 | 000,565,652 | ---- | C] () -- C:\Users\fordg_000\Documents\0127132031.jpg
    [2014/03/29 02:50:21 | 000,422,160 | ---- | C] () -- C:\WINDOWS\SysNative\FNTCACHE.DAT
    [2014/03/26 04:11:09 | 000,110,592 | ---- | C] () -- C:\WINDOWS\SysNative\OEMLicense.dll
    [2014/03/26 03:51:12 | 000,385,614 | ---- | C] () -- C:\WINDOWS\SysNative\ApnDatabase.xml
    [2014/03/22 15:43:21 | 000,083,968 | ---- | C] () -- C:\WINDOWS\SysWow64\OEMLicense.dll
    [2014/03/21 03:16:41 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
    [2014/03/20 08:14:24 | 268,435,456 | -HS- | C] () -- C:\swapfile.sys
    [2014/03/20 05:59:51 | 003,649,185 | ---- | C] () -- C:\WINDOWS\SysNative\nvcoproc.bin
    [2014/03/20 05:59:48 | 000,001,411 | ---- | C] () -- C:\Users\Public\Desktop\CyberLink PowerDVD 13.lnk
    [2014/03/20 05:58:03 | 000,024,544 | ---- | C] () -- C:\WINDOWS\SysNative\nvinfo.pb
    [2014/03/20 05:50:10 | 000,001,066 | ---- | C] () -- C:\Users\Public\Desktop\VLC media player.lnk
    [2014/03/20 05:49:32 | 000,001,019 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audacity.lnk
    [2014/03/20 05:42:22 | 000,002,697 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
    [2014/03/20 05:38:17 | 000,000,991 | ---- | C] () -- C:\Users\fordg_000\Desktop\MakeMKV.lnk
    [2014/03/20 05:32:23 | 000,001,159 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
    [2014/03/20 05:32:23 | 000,001,147 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
    [2014/03/20 05:23:43 | 000,001,424 | ---- | C] () -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
    [2014/03/20 05:21:04 | 000,001,430 | ---- | C] () -- C:\Users\fordg_000\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
    [2014/03/20 05:20:06 | 000,000,352 | ---- | C] () -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\Shows Desktop.lnk
    [2014/03/20 05:20:06 | 000,000,334 | ---- | C] () -- C:\Users\fordg_000\Application Data\Microsoft\Internet Explorer\Quick Launch\Window Switcher.lnk
    [2012/10/06 00:12:28 | 000,598,780 | ---- | C] () -- C:\WINDOWS\SysWow64\igvpkrng700.bin
    [2012/10/06 00:12:22 | 000,755,048 | ---- | C] () -- C:\WINDOWS\SysWow64\igcodeckrng700.bin
    [2012/10/06 00:12:10 | 000,064,512 | ---- | C] () -- C:\WINDOWS\SysWow64\igdde32.dll
    [2012/07/26 04:13:10 | 000,215,943 | ---- | C] () -- C:\WINDOWS\SysWow64\dssec.dat
    [2012/07/26 04:13:09 | 000,000,741 | ---- | C] () -- C:\WINDOWS\SysWow64\NOISE.DAT
    [2012/07/26 03:21:26 | 000,067,584 | --S- | C] () -- C:\WINDOWS\bootstat.dat
    [2012/07/25 21:17:42 | 000,043,520 | ---- | C] () -- C:\WINDOWS\SysWow64\BWContextHandler.dll
    [2012/07/25 16:37:29 | 000,043,131 | ---- | C] () -- C:\WINDOWS\mib.bin
    [2012/07/25 16:28:31 | 000,364,544 | ---- | C] () -- C:\WINDOWS\SysWow64\msjetoledb40.dll
    [2012/06/02 10:31:19 | 000,673,088 | ---- | C] () -- C:\WINDOWS\SysWow64\mlang.dat
    ========== ZeroAccess Check ==========
    [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
    [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
    "" = C:\Windows\SysNative\shell32.dll -- [2013/12/07 02:36:58 | 019,751,936 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment
    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
    "" = %SystemRoot%\system32\shell32.dll -- [2013/12/07 01:15:36 | 017,560,576 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Apartment
    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2012/07/25 23:05:38 | 001,004,544 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free
    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
    "" = %systemroot%\system32\wbem\fastprox.dll -- [2012/07/25 23:18:27 | 000,784,896 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Free
    [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
    "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2012/07/25 23:07:41 | 000,455,680 | ---- | M] (Microsoft Corporation)
    "ThreadingModel" = Both
    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
    ========== LOP Check ==========
    [2014/04/03 15:44:38 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Audacity
    [2014/04/04 02:15:45 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\BitTorrent
    [2014/04/01 15:29:23 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\IsolatedStorage
    [2014/03/20 06:39:17 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Publish Providers
    [2014/03/26 14:35:58 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Sony
    [2014/03/31 02:33:10 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Sony Creative Software Inc
    [2014/03/30 23:52:38 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Subtitle Edit
    [2014/03/31 01:20:03 | 000,000,000 | ---D | M] -- C:\Users\fordg_000\AppData\Roaming\Vegasaur
    ========== Purity Check ==========

    < End of report >

    OTL Extras logfile created on: 4/4/2014 2:34:50 AM - Run 1
    OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\fordg_000\Desktop
    64bit- An unknown product (Version = 6.2.9200) - Type = NTWorkstation
    Internet Explorer (Version = 9.10.9200.16843)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
    7.89 Gb Total Physical Memory | 6.20 Gb Available Physical Memory | 78.64% Memory free
    9.08 Gb Paging File | 7.29 Gb Available in Paging File | 80.34% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]
    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files (x86)
    Drive C: | 931.17 Gb Total Space | 791.34 Gb Free Space | 84.98% Space Free | Partition Type: NTFS
    Drive D: | 45.06 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
    Computer Name: SHAWNPC | User Name: fordg_000 | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
    ========== Extra Registry (SafeList) ==========
    ========== File Associations ==========

    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
    .url[@ = InternetShortcut] -- C:\WINDOWS\SysNative\rundll32.exe (Microsoft Corporation)
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- C:\WINDOWS\SysWow64\control.exe (Microsoft Corporation)
    .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
    [HKEY_USERS\S-1-5-21-1752066307-218487803-444230657-1001\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
    ========== Shell Spawning ==========
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
    http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
    InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
    Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\OpenWith.exe "%1" (Microsoft Corporation)
    Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
    Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [explore] -- Reg Error: Value error.
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
    CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
    ========== Security Center Settings ==========
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "VistaSp1" = CE 37 E6 AF FF 6A CD 01 [binary data]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    ========== System Restore Settings ==========
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0
    ========== Firewall Settings ==========
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0
    ========== Authorized Applications List ==========
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    ========== Vista Active Open Ports Exception List ==========
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{038763C0-C932-4BEC-B8F5-DD68E2E3397F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{05A97EBA-1E84-438C-8595-D2773B14BC63}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{169266B5-B9C7-409D-BB8C-A3AA65E86250}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
    "{19292D58-FF83-4FB5-BB56-B006192074B0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{1D31017C-E720-4899-9E19-640D052E76D3}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
    "{30FC6A2A-1034-4043-9898-8B7094FFE134}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{35063D56-1038-4F15-BDA2-9805CEB30325}" = lport=139 | protocol=6 | dir=in | app=system |
    "{3DA3E271-B237-4633-849A-BECDC12FB3BD}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
    "{44E417DB-5321-4582-A4CD-20876CA4A1CD}" = lport=137 | protocol=17 | dir=in | app=system |
    "{46F43F0C-7DD6-483A-BD50-F691AFCBA6CA}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
    "{48B9AF3C-F466-488C-9EAA-1CC1B45A0FCD}" = lport=10243 | protocol=6 | dir=in | app=system |
    "{4CEF7D17-FB5B-4A24-8D02-73F9275148AE}" = lport=47991 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
    "{4E64DC8E-CDE4-4F6F-970A-E898EDE267A3}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{4F1DD5C1-380C-492C-8199-3BDA4D764F1C}" = rport=137 | protocol=17 | dir=out | app=system |
    "{54316FF0-87E8-4866-AFB3-9D03C5F494C0}" = rport=139 | protocol=6 | dir=out | app=system |
    "{694FC807-E2DB-41B5-97F4-DBE1B05F1F5F}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{7667398E-EEA9-472E-9A62-1D118A14B119}" = lport=47987 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamsvc.exe |
    "{7735DAE5-23D3-4403-90CE-D2A8B20F4CD7}" = lport=445 | protocol=6 | dir=in | app=system |
    "{8E198130-63CD-442C-83A4-46F4B84E6FA6}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{9F2348ED-A60C-42E8-B7AC-D037B9C8ECED}" = rport=10243 | protocol=6 | dir=out | app=system |
    "{A99E3F8C-D9A0-4EC5-9D2C-4B7A2AA8B029}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{B933D64F-B6D2-4F4E-B471-981A13EC817B}" = rport=445 | protocol=6 | dir=out | app=system |
    "{C4E5BB10-7D7C-49C8-9A48-93B9559CA5C3}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{CA8EC181-B5EE-40B2-AD74-A613F5C055E1}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
    "{D5208722-E277-4DA4-909C-55E6541BD2C3}" = lport=138 | protocol=17 | dir=in | app=system |
    "{E76C728D-92DC-48B8-8A64-8F86993C3E1F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{FAD45480-7921-4543-B04B-8C0D51FBD0CE}" = lport=6004 | protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\outlook.exe |
    "{FC22B03E-77C3-4714-B35E-895C0FCB9296}" = rport=138 | protocol=17 | dir=out | app=system |
    ========== Vista Active Application Exception List ==========
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{0D91A9C5-6B54-44F6-8641-E8E75E5F9D1F}" = dir=in | name=@{microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
    "{10A96EAC-D808-43BC-9A41-73739EB363D4}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
    "{1B2FA862-C771-4B2E-8B75-57D375BA60D9}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\powerdvd13ml.exe |
    "{20736FB5-4D16-4BB3-92A6-5EE84DEBD275}" = protocol=6 | dir=in | app=c:\users\fordg_000\appdata\roaming\bittorrent\bittorrent.exe |
    "{2C577C60-E25F-49E3-B793-68363675F525}" = dir=out | name=@{microsoft.xboxlivegames_1.3.10.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.xboxlivegames/resources/34150} |
    "{2F72F7E8-C5D5-4F68-898A-FE3F8B00FE01}" = protocol=17 | dir=in | app=c:\users\fordg_000\appdata\local\temp\7zs962c.tmp\symnrt.exe |
    "{3081EE5F-D3A7-4816-92C0-7B827018ADF1}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{3115986D-208B-47CC-BB40-AFBB7AFF17E0}" = dir=out | name=@{microsoft.reader_6.2.9200.20780_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
    "{328E680B-45B5-452F-AA2A-344F531A4E26}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{3DD2F4CE-359C-48CD-B2A8-76CED15E4A72}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
    "{3FA04318-154D-4E27-AFCF-0B4C5F891F70}" = dir=out | name=@{microsoft.bingnews_2.0.0.308_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingnews/resources/news} |
    "{43672B1B-E478-4971-8DFB-1E2E804A48AC}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\powerdvd13.exe |
    "{4A7A287B-1429-49C4-A504-68830A1907D3}" = dir=out | name=@{microsoft.windowsphotos_16.4.4396.311_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
    "{4F0A0478-9D3A-411E-8095-90F715F6E189}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{555AB38F-D5C4-4302-A405-2364F9524157}" = dir=out | name=@{microsoft.bingweather_2.0.0.310_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingweather/resources/apptitle} |
    "{593D4978-6A91-444C-AD41-E92BFAC4EAB6}" = dir=out | name=@{microsoft.bingsports_2.0.0.310_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingsports/resources/bingsports} |
    "{60E83EC1-1F2F-46EB-8B78-B9A96FEE88F4}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\powerdvd13agent.exe |
    "{628A311A-DD99-4957-BA3D-551C3C6B38AF}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{62D34697-7C69-48D2-8751-39333B6B8776}" = protocol=6 | dir=in | app=c:\users\fordg_000\appdata\local\temp\7zs962c.tmp\symnrt.exe |
    "{6986F23F-7B85-47C8-9D2E-F661C647A4E0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{69F1CDF4-BC76-439C-B3E8-1D60D718A639}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\movie\powerdvd.exe |
    "{6CE53056-A0A1-46B2-BFA1-84694D62C46B}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
    "{6FB1DD5A-77FF-4252-9B4A-73A185A439C2}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
    "{7A91A74E-56BF-4C92-A7C2-1FD4090EFF59}" = protocol=6 | dir=in | app=c:\users\fordg_000\downloads\bittorrent.exe |
    "{7C56402F-8F63-4F4F-84E9-0FF6CB64B431}" = dir=out | name=@{microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowscommunicationsapps/resources/communicationspackagename} |
    "{7E8AA5FD-A014-4C06-B07F-D8BFBD4FDECD}" = protocol=17 | dir=in | app=c:\users\fordg_000\downloads\bittorrent.exe |
    "{808F1451-4108-46FD-ADBB-F17324B5F0BD}" = dir=out | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
    "{91D999A4-E5FA-4B8E-A936-4B4D86F52648}" = dir=out | name=@{microsoft.microsoftskydrive_16.4.4396.311_x64__8wekyb3d8bbwe?ms-resource://microsoft.microsoftskydrive/resources/shortproductname} |
    "{95DFEDBC-4BCD-4C7B-8E16-A79B943B94FE}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
    "{976007EB-E172-46EA-A923-E4C796021C70}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{97AC5E77-DF11-4481-A823-9DCC5C945700}" = dir=out | name=@{microsoft.bingtravel_2.0.0.308_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingtravel/resources/apptitle} |
    "{9920E0F2-9637-465E-9C6D-651AA40D5558}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{9BAE036E-CD07-4CDE-A069-1A6874DFD6EF}" = dir=out | name=@{microsoft.zunevideo_1.5.767.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunevideo/resources/ids_manifest_video_app_name} |
    "{A7905E8D-7097-4321-9E98-F682E4B72880}" = dir=in | name=@{microsoft.windowsphotos_16.4.4396.311_x64__8wekyb3d8bbwe?ms-resource://microsoft.windowsphotos/photo/residappname} |
    "{ADD8307C-33F5-49A1-B388-E0607F6DAE4E}" = dir=out | name=@{yahooinc.yahoomail_1.7.0.23_neutral__xvnatx83ncrvj?ms-resource://yahooinc.yahoomail/resources/str_branding_mail} |
    "{B00C0A88-CD7E-4613-B1E7-BEFB52F2BC84}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
    "{B1D5D6C4-C80D-4380-A57D-31AFA123D62F}" = protocol=6 | dir=out | app=system |
    "{B2D572A6-7432-493D-8D3C-A97D919C0E83}" = dir=out | name=@{microsoft.zunemusic_1.5.216.0_x64__8wekyb3d8bbwe?ms-resource://microsoft.zunemusic/resources/ids_manifest_music_app_name} |
    "{C2C6B8F9-F2BA-40DE-99FC-2B12A9AF6B93}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\kernel\dms\clmsserverpdvd13.exe |
    "{C6C35D07-C2AF-4620-BAF5-6D38B5BAB185}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{C7E64BFC-8248-4E82-A2CC-2110EACD001C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{CA376988-8260-4260-A614-FFD6E0F15E38}" = dir=in | name=@{microsoft.reader_6.2.9200.20780_x64__8wekyb3d8bbwe?ms-resource://microsoft.reader/resources/shortdisplayname} |
    "{CC537FE6-D680-4918-86C7-2DAFD4D8588F}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{CEB632EF-910D-4012-84AB-FF2459999AA0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{D33A093A-54D3-4DA1-B189-251E986A7C15}" = protocol=17 | dir=in | app=c:\users\fordg_000\appdata\roaming\bittorrent\bittorrent.exe |
    "{DCEF16CA-DE1A-4728-B494-1AECE318A30C}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\kernel\dmr\powerdvd13dmrengine.exe |
    "{DDC93753-4720-44C7-A7CD-1F9AD25F6585}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{DFFEADBA-ED55-429B-B0B2-3CFED35C8F6C}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{E08C69F0-1131-47AB-BF87-C3834C95C9E3}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
    "{E0A266BA-8C73-4606-BBEF-4D528BFDE6EB}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd13\movie\powerdvd cinema\powerdvdcinema13.exe |
    "{E10CBA22-A9D3-436E-A92E-5E64C65B2399}" = dir=out | name=@{microsoft.bingfinance_2.0.0.308_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingfinance/resources/apptitle} |
    "{E5206F96-E280-43FF-9BD9-7A51C7D396C4}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\groove.exe |
    "{E727DCE6-279F-4A26-BC55-A40484138F17}" = dir=out | name=@{microsoft.bingmaps_1.6.1821.2624_x64__8wekyb3d8bbwe?ms-resource://microsoft.bingmaps/resources/appdisplayname} |
    "{E73E73EE-CA82-4D82-8FAB-FB0E905F607B}" = dir=out | name=@{microsoft.bing_1.5.1.259_x64__8wekyb3d8bbwe?ms-resource://microsoft.bing/resources/app_name} |
    "{E7985E1D-C36F-4787-80A8-6350D07E9266}" = dir=in | name=@{c:\windows\winstore\resources.pri?ms-resource://winstore/resources/displayname} |
    "{E97069CF-CCAE-4E42-9B7D-E61EBC0C24D5}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office14\onenote.exe |
    "{EE6B0FFB-BECC-4937-AF75-59DEA234AFA6}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{F95211E3-D564-42FD-B72C-346E4DFA53AF}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    ========== HKEY_LOCAL_MACHINE Uninstall List ==========
    64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{314DDDC0-E935-11E0-8F9F-F04DA23A5C58}" = Vegas Pro 11.0 (64-bit)
    "{33C19CDE-E935-11E0-A0DA-F04DA23A5C58}" = MSVCRT Redists
    "{90140000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2010
    "{90140000-002A-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (English) 2010
    "{90140000-0116-0409-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 335.23
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 335.23
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 335.23
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience" = NVIDIA GeForce Experience 1.8.2
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 335.21
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus Update 11.10.11
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.13.1220
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 11.10.11
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.LEDVisualizer" = NVIDIA LED Visualizer 1.0
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamC" = GeForce Experience NvStream Client Components
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv" = SHIELD Streaming
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.30.1
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Network.Service" = NVIDIA Network Service
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShadowPlay" = NVIDIA ShadowPlay 11.10.11
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Update.Core" = NVIDIA Update Core
    "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver" = NVIDIA Virtual Audio 1.2.20
    "Vegasaur_is1" = Vegasaur 1.9.2
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{111EE7DF-FC45-40C7-98A7-753AC46B12FB}" = QuickTime 7
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{3CFDF154-7E60-4E98-A8DF-C693A4F8E6B6}" = CyberLink PowerDVD 13
    "{46F044A5-CE8B-4196-984E-5BD6525E361D}" = Apple Application Support
    "{6AEFCA01-8DF1-11E1-A17B-F04DA23A5C58}" = Vegas Pro 11.0
    "{70CB6C40-8DF1-11E1-BDCF-F04DA23A5C58}" = MSVCRT Redists
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
    "{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}" = Skype™ 6.14
    "{80407BA7-7763-4395-AB98-5233F1B34E65}" = NVIDIA PhysX
    "{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
    "{90140000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2010
    "{90140000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2010
    "{90140000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2010
    "{90140000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2010
    "{90140000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2010
    "{90140000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2010
    "{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
    "{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
    "{90140000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2010
    "{90140000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2010
    "{90140000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2010
    "{90140000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2010
    "{90140000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2010
    "{90140000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2010
    "{90140000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2010
    "{90140000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2010
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{B7D9BAAA-F068-4BF8-B929-462C3A8AB677}" = MSI ODD Monitor
    "{BB285C9F-C821-4770-8970-56C4AB52C87E}" = Skype Click to Call
    "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
    "Adobe Flash Player Plugin" = Adobe Flash Player 12 Plugin
    "Audacity_is1" = Audacity 2.0.5
    "Freemake Video Converter_is1" = Freemake Video Converter version 4.1.3
    "InstallShield_{3CFDF154-7E60-4E98-A8DF-C693A4F8E6B6}" = CyberLink PowerDVD 13
    "InstallShield_{B7D9BAAA-F068-4BF8-B929-462C3A8AB677}" = MSI ODD Monitor
    "MakeMKV" = MakeMKV v1.8.9
    "Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware version 2.00.0.1000
    "Mozilla Firefox 28.0 (x86 en-US)" = Mozilla Firefox 28.0 (x86 en-US)
    "MozillaMaintenanceService" = Mozilla Maintenance Service
    "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
    "Office14.PROPLUS" = Microsoft Office Professional Plus 2010
    "SubtitleEdit_is1" = Subtitle Edit 3.3.14
    "VirtualCloneDrive" = VirtualCloneDrive
    "VLC media player" = VLC media player 2.1.3
    "WinRAR archiver" = WinRAR 5.10 beta 1 (32-bit)
    ========== HKEY_USERS Uninstall List ==========
    [HKEY_USERS\S-1-5-21-1752066307-218487803-444230657-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "9204f5692a8faf3b" = Dell System Detect
    "BitTorrent" = BitTorrent
    < End of report >
     
  14. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    OTL logs look fine.

    [​IMG] Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center/Action Center
      • Windows Update
      • Windows Defender
      • Other Services
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.

    [​IMG] Please download MiniToolBox, save it to your desktop and run it.

    Checkmark following boxes:
    • Report IE Proxy Settings
    • Report FF Proxy Settings
    • List content of Hosts
    • List IP configuration
    • List Winsock Entries
    • List last 10 Event Viewer log
    • List Devices (do NOT change any settings)
    • List Restore Points
    Click Go and post the result.
     
  15. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    Farbar Service Scanner Version: 25-02-2014
    Ran by fordg_000 (administrator) on 04-04-2014 at 13:43:21
    Running from "C:\Users\fordg_000\Desktop"
    Microsoft Windows 8 (X64)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Google.com is accessible.
    Yahoo.com is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============

    System Restore Disabled Policy:
    ========================


    Action Center:
    ============


    Windows Update:
    ============
    wuauserv Service is not running. Checking service configuration:
    The start type of wuauserv service is OK.
    The ImagePath of wuauserv service is OK.
    The ServiceDll of wuauserv service is OK.


    Windows Autoupdate Disabled Policy:
    ============================


    Windows Defender:
    ==============

    Other Services:
    ==============


    File Check:
    ========
    C:\Windows\System32\nsisvc.dll => MD5 is legit
    C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\System32\dhcpcore.dll => MD5 is legit
    C:\Windows\System32\drivers\afd.sys
    [2014-03-22 15:43] - [2013-09-03 23:11] - 0576512 ____A (Microsoft Corporation) 7C0E0EDF18D6CC565D7BFBB451709FA5

    C:\Windows\System32\drivers\tdx.sys => MD5 is legit
    C:\Windows\System32\Drivers\tcpip.sys
    [2014-03-22 15:41] - [2013-11-01 01:53] - 2232664 ____A (Microsoft Corporation) DD4249F03598043DED6FA540EB14898A

    C:\Windows\System32\dnsrslvr.dll => MD5 is legit
    C:\Windows\System32\mpssvc.dll
    [2014-03-26 03:50] - [2013-10-31 01:56] - 0915968 ____A (Microsoft Corporation) 9DE3341BD4E14BC5FADFCAD3019F2D0D

    C:\Windows\System32\bfe.dll
    [2014-03-22 15:41] - [2013-10-10 05:20] - 0723968 ____A (Microsoft Corporation) 53AA55632B94622F2DC3695E86EF9363

    C:\Windows\System32\drivers\mpsdrv.sys
    [2014-03-26 03:50] - [2013-10-30 23:42] - 0074752 ____A (Microsoft Corporation) 4CCBBD4944777CA100B9A6C2F149A46F

    C:\Windows\System32\SDRSVC.dll => MD5 is legit
    C:\Windows\System32\vssvc.exe => MD5 is legit
    C:\Windows\System32\wscsvc.dll => MD5 is legit
    C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\System32\wuaueng.dll
    [2014-03-26 04:07] - [2013-10-08 18:27] - 3279872 ____A (Microsoft Corporation) 311E5E1976E0BD9110A88B93158055D5

    C:\Windows\System32\qmgr.dll => MD5 is legit
    C:\Windows\System32\es.dll => MD5 is legit
    C:\Windows\System32\cryptsvc.dll => MD5 is legit
    C:\Program Files\Windows Defender\MpSvc.dll
    [2014-03-22 15:41] - [2013-10-24 18:34] - 1571328 ____A (Microsoft Corporation) 8077537B1600AF493E7EE1A7A5C90799

    C:\Program Files\Windows Defender\MsMpEng.exe
    [2014-03-22 15:41] - [2013-10-25 03:34] - 0016048 ____A (Microsoft Corporation) 0BB1CEE3514CE93A0A4E6376A9038EFF

    C:\Windows\System32\ipnathlp.dll => MD5 is legit
    C:\Windows\System32\iphlpsvc.dll => MD5 is legit
    C:\Windows\System32\svchost.exe => MD5 is legit
    C:\Windows\System32\rpcss.dll => MD5 is legit


    **** End of log ****

    MiniToolBox by Farbar Version: 23-01-2014
    Ran by fordg_000 (administrator) on 04-04-2014 at 13:44:31
    Running from "C:\Users\fordg_000\Desktop"
    Microsoft Windows 8 (X64)
    Boot Mode: Normal
    ***************************************************************************

    ========================= IE Proxy Settings: ==============================

    Proxy is not enabled.
    No Proxy Server is set.

    ========================= FF Proxy Settings: ==============================

    ========================= Hosts content: =================================



    ========================= IP Configuration: ================================

    Dell Wireless 1502 802.11b/g/n = Wi-Fi (Connected)
    Realtek PCIe GBE Family Controller = Ethernet (Media disconnected)


    # ----------------------------------
    # IPv4 Configuration
    # ----------------------------------
    pushd interface ipv4

    reset
    set global icmpredirects=enabled
    set interface interface="Local Area Connection* 9" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
    set interface interface="Wi-Fi" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
    set interface interface="Ethernet" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled
    set interface interface="Local Area Connection* 11" forwarding=enabled advertise=enabled nud=enabled ignoredefaultroutes=disabled


    popd
    # End of IPv4 configuration



    Windows IP Configuration

    Host Name . . . . . . . . . . . . : ShawnPC
    Primary Dns Suffix . . . . . . . :
    Node Type . . . . . . . . . . . . : Hybrid
    IP Routing Enabled. . . . . . . . : No
    WINS Proxy Enabled. . . . . . . . : No
    DNS Suffix Search List. . . . . . : hsd1.nj.comcast.net.

    Wireless LAN adapter Local Area Connection* 11:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Microsoft Wi-Fi Direct Virtual Adapter
    Physical Address. . . . . . . . . : B6-17-31-29-A2-08
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes

    Ethernet adapter Ethernet:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
    Physical Address. . . . . . . . . : D4-BE-D9-FC-F8-79
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes

    Wireless LAN adapter Wi-Fi:

    Connection-specific DNS Suffix . : hsd1.nj.comcast.net.
    Description . . . . . . . . . . . : Dell Wireless 1502 802.11b/g/n
    Physical Address. . . . . . . . . : A4-17-31-29-A2-08
    DHCP Enabled. . . . . . . . . . . : Yes
    Autoconfiguration Enabled . . . . : Yes
    IPv6 Address. . . . . . . . . . . : 2601:c:3b00:464:f000:f007:6aff:f55d(Preferred)
    Temporary IPv6 Address. . . . . . : 2601:c:3b00:464:5172:a035:c73a:a8a8(Preferred)
    Link-local IPv6 Address . . . . . : fe80::f000:f007:6aff:f55d%12(Preferred)
    IPv4 Address. . . . . . . . . . . : 10.0.0.5(Preferred)
    Subnet Mask . . . . . . . . . . . : 255.255.255.0
    Lease Obtained. . . . . . . . . . : Friday, April 4, 2014 4:36:49 AM
    Lease Expires . . . . . . . . . . : Friday, April 11, 2014 1:08:19 PM
    Default Gateway . . . . . . . . . : fe80::21d:d6ff:fe6d:9861%12
    10.0.0.1
    DHCP Server . . . . . . . . . . . : 10.0.0.1
    DHCPv6 IAID . . . . . . . . . . . : 262412081
    DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-BC-94-19-A4-17-31-29-A2-08
    DNS Servers . . . . . . . . . . . : 2001:558:feed::1
    2001:558:feed::2
    75.75.75.75
    75.75.76.76
    NetBIOS over Tcpip. . . . . . . . : Enabled

    Tunnel adapter isatap.hsd1.nj.comcast.net.:

    Media State . . . . . . . . . . . : Media disconnected
    Connection-specific DNS Suffix . : hsd1.nj.comcast.net.
    Description . . . . . . . . . . . : Microsoft ISATAP Adapter
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes

    Tunnel adapter Local Area Connection* 13:

    Connection-specific DNS Suffix . :
    Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
    Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
    DHCP Enabled. . . . . . . . . . . : No
    Autoconfiguration Enabled . . . . : Yes
    IPv6 Address. . . . . . . . . . . : 2001:0:9d38:90d7:142a:198a:bbc0:53df(Preferred)
    Link-local IPv6 Address . . . . . : fe80::142a:198a:bbc0:53df%16(Preferred)
    Default Gateway . . . . . . . . . :
    NetBIOS over Tcpip. . . . . . . . : Disabled
    Server: cdns01.comcast.net
    Address: 2001:558:feed::1

    Name: google.com
    Addresses: 2607:f8b0:4006:807::1009
    74.125.226.32
    74.125.226.40
    74.125.226.34
    74.125.226.46
    74.125.226.38
    74.125.226.33
    74.125.226.36
    74.125.226.35
    74.125.226.39
    74.125.226.41
    74.125.226.37


    Pinging google.com [2607:f8b0:4006:801::1002] with 32 bytes of data:
    Request timed out.
    Reply from 2607:f8b0:4006:801::1002: time=17ms

    Ping statistics for 2607:f8b0:4006:801::1002:
    Packets: Sent = 2, Received = 1, Lost = 1 (50% loss),
    Approximate round trip times in milli-seconds:
    Minimum = 17ms, Maximum = 17ms, Average = 17ms
    Server: cdns01.comcast.net
    Address: 2001:558:feed::1

    Name: yahoo.com
    Addresses: 98.139.183.24
    206.190.36.45
    98.138.253.109


    Pinging yahoo.com [206.190.36.45] with 32 bytes of data:
    Reply from 206.190.36.45: bytes=32 time=96ms TTL=46
    Reply from 206.190.36.45: bytes=32 time=139ms TTL=46

    Ping statistics for 206.190.36.45:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
    Minimum = 96ms, Maximum = 139ms, Average = 117ms

    Pinging 127.0.0.1 with 32 bytes of data:
    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

    Ping statistics for 127.0.0.1:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms
    ===========================================================================
    Interface List
    14...b6 17 31 29 a2 08 ......Microsoft Wi-Fi Direct Virtual Adapter
    13...d4 be d9 fc f8 79 ......Realtek PCIe GBE Family Controller
    12...a4 17 31 29 a2 08 ......Dell Wireless 1502 802.11b/g/n
    1...........................Software Loopback Interface 1
    15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
    16...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
    ===========================================================================

    IPv4 Route Table
    ===========================================================================
    Active Routes:
    Network Destination Netmask Gateway Interface Metric
    0.0.0.0 0.0.0.0 10.0.0.1 10.0.0.5 25
    10.0.0.0 255.255.255.0 On-link 10.0.0.5 281
    10.0.0.5 255.255.255.255 On-link 10.0.0.5 281
    10.0.0.255 255.255.255.255 On-link 10.0.0.5 281
    127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
    127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
    127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
    224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
    224.0.0.0 240.0.0.0 On-link 10.0.0.5 281
    255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
    255.255.255.255 255.255.255.255 On-link 10.0.0.5 281
    ===========================================================================
    Persistent Routes:
    None

    IPv6 Route Table
    ===========================================================================
    Active Routes:
    If Metric Network Destination Gateway
    12 281 ::/0 fe80::21d:d6ff:fe6d:9861
    1 306 ::1/128 On-link
    16 306 2001::/32 On-link
    16 306 2001:0:9d38:90d7:142a:198a:bbc0:53df/128
    On-link
    12 281 2601:c:3b00:464::/64 On-link
    12 281 2601:c:3b00:464:5172:a035:c73a:a8a8/128
    On-link
    12 281 2601:c:3b00:464:f000:f007:6aff:f55d/128
    On-link
    12 281 fe80::/64 On-link
    16 306 fe80::/64 On-link
    16 306 fe80::142a:198a:bbc0:53df/128
    On-link
    12 281 fe80::f000:f007:6aff:f55d/128
    On-link
    1 306 ff00::/8 On-link
    16 306 ff00::/8 On-link
    12 281 ff00::/8 On-link
    ===========================================================================
    Persistent Routes:
    None
    ========================= Winsock entries =====================================

    Catalog5 01 C:\WINDOWS\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
    Catalog5 02 C:\WINDOWS\SysWOW64\pnrpnsp.dll [67584] (Microsoft Corporation)
    Catalog5 03 C:\WINDOWS\SysWOW64\pnrpnsp.dll [67584] (Microsoft Corporation)
    Catalog5 04 C:\WINDOWS\SysWOW64\NLAapi.dll [55296] (Microsoft Corporation)
    Catalog5 05 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog5 06 C:\WINDOWS\SysWOW64\winrnr.dll [21504] (Microsoft Corporation)
    Catalog9 01 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 02 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 03 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 04 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 05 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 06 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 07 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 08 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 09 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    Catalog9 10 C:\WINDOWS\SysWOW64\mswsock.dll [289280] (Microsoft Corporation)
    x64-Catalog5 01 C:\Windows\System32\napinsp.dll [66560] (Microsoft Corporation)
    x64-Catalog5 02 C:\Windows\System32\pnrpnsp.dll [85504] (Microsoft Corporation)
    x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [85504] (Microsoft Corporation)
    x64-Catalog5 04 C:\Windows\System32\NLAapi.dll [72192] (Microsoft Corporation)
    x64-Catalog5 05 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog5 06 C:\Windows\System32\winrnr.dll [53760] (Microsoft Corporation)
    x64-Catalog9 01 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 02 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 03 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 04 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 05 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 06 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 07 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 08 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 09 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)
    x64-Catalog9 10 C:\Windows\System32\mswsock.dll [355328] (Microsoft Corporation)

    ========================= Event log errors: ===============================

    Application errors:
    ==================
    Error: (04/04/2014 04:30:29 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SHAWNPC)
    Description: Activation of app windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

    Error: (04/04/2014 04:30:13 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SHAWNPC)
    Description: Activation of app windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

    Error: (04/04/2014 04:29:55 AM) (Source: Microsoft-Windows-Immersive-Shell) (User: SHAWNPC)
    Description: Activation of app windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.


    System errors:
    =============
    Error: (04/04/2014 10:26:38 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
    Description: 4

    Error: (04/04/2014 08:46:23 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
    Description: 4

    Error: (04/04/2014 07:49:14 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
    Description: 4

    Error: (04/04/2014 06:32:43 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
    Description: 4

    Error: (04/04/2014 05:51:10 AM) (Source: Microsoft-Windows-Kernel-Power) (User: )
    Description: 4

    Error: (04/04/2014 04:36:16 AM) (Source: DCOM) (User: SHAWNPC)
    Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

    Error: (04/04/2014 04:35:45 AM) (Source: DCOM) (User: SHAWNPC)
    Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

    Error: (04/04/2014 04:35:32 AM) (Source: DCOM) (User: SHAWNPC)
    Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

    Error: (04/04/2014 04:35:16 AM) (Source: DCOM) (User: SHAWNPC)
    Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}

    Error: (04/04/2014 04:35:03 AM) (Source: DCOM) (User: SHAWNPC)
    Description: 1084ShellHWDetectionUnavailable{DD522ACC-F821-461A-A407-50B198B896DC}


    Microsoft Office Sessions:
    =========================
    Error: (04/04/2014 04:30:29 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: SHAWNPC)
    Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

    Error: (04/04/2014 04:30:13 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: SHAWNPC)
    Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151

    Error: (04/04/2014 04:29:55 AM) (Source: Microsoft-Windows-Immersive-Shell)(User: SHAWNPC)
    Description: windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel-2144927151


    ========================= Devices: ================================

    ========================= Restore Points ==================================

    24-03-2014 05:37:50 Windows Update
    31-03-2014 17:06:50 Installed QuickTime 7

    **** End of log ****
     
  16. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    I don't see any issue with your internet connection.
    What are the signs you can't connect from your point of view?
     
  17. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    I dont have any problems with Skype or BitTorrent, but sometimes when I try to load pages it takes a very long time, or when I stream videos the video will take a long time to buffer or it will freeze. When this happens, I check my receiving speed through Task Manager and it will be less than 100 kbs. However, if I restart my pc, it will work fine for awhile.
     
  18. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    Which browser gives you issues?

    Then...

    [​IMG] Download Security Check from here or here and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
    NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
    NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.


    [​IMG] Download Temp File Cleaner (TFC)
    Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.

    [​IMG] Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Click on "Run ESET Online Scanner" button.
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  19. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    I use Mozilla, but I have tested with both Mozilla and IE, and the problem occurs with both.

    Results of screen317's Security Check version 0.99.81
    x64 (UAC is enabled)
    Internet Explorer 10 Out of date!
    ``````````````Antivirus/Firewall Check:``````````````
    Windows Firewall Enabled!
    Windows Defender
    WMI entry may not exist for antivirus; attempting automatic update.
    `````````Anti-malware/Other Utilities Check:`````````
    Adobe Flash Player 12.0.0.77
    Mozilla Firefox (28.0)
    ````````Process Check: objlist.exe by Laurent````````
    Windows Defender MSMpEng.exe
    Malwarebytes Anti-Malware mbamservice.exe
    `````````````````System Health check`````````````````
    Total Fragmentation on Drive C: %
    ````````````````````End of Log``````````````````````

    The others found no threats......
     
  20. Broni

    Broni Malware Annihilator Posts: 47,986   +271

  21. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    There was no explanation of how to get the log for Temp File Cleaner, also the directions for ESET said it would not produce and logs if their were no threats found.
     
  22. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    I don't need any log from TFC.

    How are things after resetting browsers?
     
  23. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    They are fine right now, however. I was having issues last night. I was trying to stream a video and the video just wouldnt load. (BTW this too was after I reset the browser). It always seems to work until it doesnt work lol.
     
  24. fordgt0589

    fordgt0589 TS Rookie Topic Starter Posts: 16

    Im uploading a picture to show you how my internet is when I try to load pages. [​IMG]

    That picture isnt working on my end (probably because of my internet) but here is a link just in case http://tinypic.com/r/2eqaq28/8.
     
  25. Broni

    Broni Malware Annihilator Posts: 47,986   +271

    To get more info get ethernet cable and connect your computer using the cable...see how the connection is then.
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.