Forums
New posts
Search forums
News
Security News
Technology News
Giveaways
Giveaways, Promotions and Contests
Discounts & Deals
Reviews
Users Reviews
Video Reviews
Support
Windows Malware Removal Help & Support
Mac Malware Removal Help & Support
Mobile Malware Removal Help & Support
Blog
Log in
Register
What's new
Search
Search titles only
By:
Search titles only
By:
Reply to thread
Menu
Install the app
Install
JavaScript is disabled. For a better experience, please enable JavaScript in your browser before proceeding.
You are using an out of date browser. It may not display this or other websites correctly.
You should upgrade or use an
alternative browser
.
Forums
Support
Windows Malware Removal Help & Support
Help Obrona Ads have taken over
Message
<blockquote data-quote="trice" data-source="post: 319408" data-attributes="member: 32176"><p>Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2014</p><p>Ran by Mary Morgan (administrator) on MARYMORGAN-PC on 22-12-2014 01:46:21</p><p>Running from C:\Users\Mary Morgan\Downloads</p><p>Loaded Profile: Mary Morgan (Available profiles: Mary Morgan)</p><p>Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)</p><p>Internet Explorer Version 11</p><p>Boot Mode: Normal</p><p>Tutorial for Farbar Recovery Scan Tool: <a href="http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/" target="_blank">http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/</a></p><p></p><p>==================== Processes (Whitelisted) =================</p><p></p><p>(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)</p><p></p><p>(AMD) C:\Windows\System32\atiesrxx.exe</p><p>(IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe</p><p>(AMD) C:\Windows\System32\atieclxx.exe</p><p>(Microsoft Corporation) C:\Windows\System32\wlanext.exe</p><p>(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe</p><p>(Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe</p><p>(LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe</p><p>(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe</p><p>(Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe</p><p>(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe</p><p>(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe</p><p>() C:\Program Files (x86)\Nyokurdize\Nyokurdize.exe</p><p>() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe</p><p>() C:\Program Files (x86)\Nyokurdize\NyokurdizeHelper.exe</p><p>(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe</p><p>(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe</p><p>(Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe</p><p>(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe</p><p>(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe</p><p>(McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.287\SSScheduler.exe</p><p>(Microsoft Corporation) C:\Windows\System32\rundll32.exe</p><p>( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe</p><p>(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe</p><p>(Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicatorCom.exe</p><p>(Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe</p><p>(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe</p><p>(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe</p><p>(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe</p><p>(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe</p><p>(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe</p><p>(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe</p><p>(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe</p><p>() C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe</p><p>(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe</p><p>(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe</p><p>(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe</p><p>(Alexander Roshal) C:\Program Files (x86)\WinRAR\WinRAR.exe</p><p>(Adobe Systems, Incorporated) C:\Users\Mary Morgan\AppData\Local\Temp\Rar$EXa0.360\Photoshop CS5 Portable by havingthemes\Photoshop.exe</p><p>(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</p><p>(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</p><p>(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</p><p>(Microsoft Corporation) C:\Windows\System32\mspaint.exe</p><p>(Microsoft Corporation) C:\Windows\System32\mspaint.exe</p><p>(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</p><p>(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</p><p>(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe</p><p>(Malwarebytes Corp.) C:\Users\Mary Morgan\Downloads\mbar-1.08.2.1001.exe</p><p>(Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe</p><p>(Malwarebytes Corporation) C:\Users\Mary Morgan\Desktop\mbar\mbar.exe</p><p></p><p></p><p>==================== Registry (Whitelisted) ==================</p><p></p><p>(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)</p><p></p><p>HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [<a href="http://malwaretips.com/tel:1814312" target="_blank">1814312</a> 2011-12-17] (Synaptics Incorporated)</p><p>HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-21] (IDT, Inc.)</p><p>HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2009-10-30] (Sun Microsystems, Inc.)</p><p>HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [477600 2013-01-24] (Adobe Systems Incorporated)</p><p>HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.)</p><p>HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-08-05] (Advanced Micro Devices, Inc.)</p><p>HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2010-02-25] ( Hewlett-Packard Development Company, L.P.)</p><p>HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation)</p><p>HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"</p><p>HKLM-x32\...\Run: [WirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard)</p><p>HKLM-x32\...\Run: [SMessaging] => C:\Users\Mary Morgan\AppData\Local\Strongvault Online Backup\SMessaging.exe</p><p>HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)</p><p>HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [<a href="http://malwaretips.com/tel:1073312" target="_blank">1073312</a> 2012-03-09] (Adobe Systems Incorporated)</p><p>HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.)</p><p>HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)</p><p>HKLM-x32\...\Run: [] => [X]</p><p>HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)</p><p>HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [<a href="http://malwaretips.com/tel:1021128" target="_blank">1021128</a> 2014-11-20] (Adobe Systems Incorporated)</p><p>HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.)</p><p>HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [<a href="http://malwaretips.com/tel:4085896" target="_blank">4085896</a>2014-10-14] (AVAST Software)</p><p>HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-11-11] (Hewlett-Packard)</p><p>HKLM-x32\...\RunOnce: [Malwarebytes Anti-Rootkit (cleanup)] => C:\ProgramData\Malwarebytes' Anti-Malware (portable)\mbamdor.exe [54072 2014-11-18] (Malwarebytes Corporation)</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [<a href="http://malwaretips.com/tel:2363392" target="_blank">2363392</a> 2010-03-19] (Hewlett-Packard Company)</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [AdobeBridge] => [X]</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [<a href="http://malwaretips.com/tel:2573416" target="_blank">2573416</a> 2012-10-17] (Hewlett-Packard Co.)</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [Obrona Block Ads] => "C:\Users\Mary Morgan\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" --hidden</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\RunOnce: [Adobe Speed Launcher] => <a href="http://malwaretips.com/tel:1419221820" target="_blank">1419221820</a></p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Policies\Explorer: [] </p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {a8ac7f78-b9de-11e3-a9a6-c80aa90cd2e0} - G:\ZTE_Handset_USB_Driver.exe</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {c6e293d7-5062-11e3-8433-c80aa90cd2e0} - H:\VZW_Software_upgrade_assistant.exe</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {cdc02c1e-f1a7-11e3-9bee-c80aa90cd2e0} - G:\OpenSecureFiles.exe</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [<a href="http://malwaretips.com/tel:2363392" target="_blank">2363392</a> 2010-03-19] (Hewlett-Packard Company)</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [AdobeBridge] => [X]</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [<a href="http://malwaretips.com/tel:2573416" target="_blank">2573416</a> 2012-10-17] (Hewlett-Packard Co.)</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [Obrona Block Ads] => "C:\Users\Mary Morgan\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" --hidden</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\RunOnce: [Adobe Speed Launcher] => <a href="http://malwaretips.com/tel:1419221820" target="_blank">1419221820</a></p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Policies\Explorer: [] </p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {a8ac7f78-b9de-11e3-a9a6-c80aa90cd2e0} - G:\ZTE_Handset_USB_Driver.exe</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {c6e293d7-5062-11e3-8433-c80aa90cd2e0} - H:\VZW_Software_upgrade_assistant.exe</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {cdc02c1e-f1a7-11e3-9bee-c80aa90cd2e0} - G:\OpenSecureFiles.exe</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [<a href="http://malwaretips.com/tel:2363392" target="_blank">2363392</a> 2010-03-19] (Hewlett-Packard Company)</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AdobeBridge] => [X]</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [<a href="http://malwaretips.com/tel:2573416" target="_blank">2573416</a> 2012-10-17] (Hewlett-Packard Co.)</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Obrona Block Ads] => "C:\Users\Mary Morgan\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" --hidden</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [Adobe Speed Launcher] => <a href="http://malwaretips.com/tel:1419221820" target="_blank">1419221820</a></p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [] </p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a8ac7f78-b9de-11e3-a9a6-c80aa90cd2e0} - G:\ZTE_Handset_USB_Driver.exe</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {c6e293d7-5062-11e3-8433-c80aa90cd2e0} - H:\VZW_Software_upgrade_assistant.exe</p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {cdc02c1e-f1a7-11e3-9bee-c80aa90cd2e0} - G:\OpenSecureFiles.exe</p><p>Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk</p><p>ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.287\SSScheduler.exe (McAfee, Inc.)</p><p>Startup: C:\Users\Mary Morgan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk</p><p>ShortcutTarget: Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk -> C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)</p><p>ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software)</p><p>ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.)</p><p>ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File</p><p></p><p>==================== Internet (Whitelisted) ====================</p><p></p><p>(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)</p><p></p><p>HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION</p><p>ProxyEnable: [S-1-5-21-201335642-3024121863-282455075-1001] => Internet Explorer proxy is enabled.</p><p>ProxyServer: [S-1-5-21-201335642-3024121863-282455075-1001] => http=127.0.0.1:9880;https=<a href="http://127.0.0.1:9880/" target="_blank">127.0.0.1:9880</a></p><p>ProxyEnable: [S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => Internet Explorer proxy is enabled.</p><p>ProxyServer: [S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => http=127.0.0.1:9880;https=<a href="http://127.0.0.1:9880/" target="_blank">127.0.0.1:9880</a></p><p>HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://speedial.com/?f=1&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=" target="_blank">http://speedial.com/?f=1&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=</a></p><p>HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = <a href="https://www.yahoo.com/?fr=hp-avast&type=odc179" target="_blank">https://www.yahoo.com/?fr=hp-avast&type=odc179</a></p><p>HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = </p><p>HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = </p><p>HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = <a href="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome" target="_blank">http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome</a></p><p>HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = <a href="http://g.msn.com/HPNOT/1" target="_blank">http://g.msn.com/HPNOT/1</a></p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\Software\Microsoft\Internet Explorer\Main,Search Page = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = <a href="https://www.yahoo.com/?fr=hp-avast&type=odc179" target="_blank">https://www.yahoo.com/?fr=hp-avast&type=odc179</a></p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Bar = <a href="https://www.yahoo.com/?fr=hp-avast&type=odc179" target="_blank">https://www.yahoo.com/?fr=hp-avast&type=odc179</a></p><p>SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = </p><p>SearchScopes: HKLM -> {3003A449-E8C8-4D74-B449-6F28EEE84BC4} URL = <a href="http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl" target="_blank">http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl</a></p><p>SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = <a href="http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=" target="_blank">http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=</a></p><p>SearchScopes: HKLM -> {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = <a href="http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox" target="_blank">http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox</a></p><p>SearchScopes: HKLM-x32 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = </p><p>SearchScopes: HKLM-x32 -> {3003A449-E8C8-4D74-B449-6F28EEE84BC4} URL = <a href="http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl" target="_blank">http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl</a></p><p>SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>SearchScopes: HKLM-x32 -> {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = <a href="http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox" target="_blank">http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox</a></p><p>SearchScopes: HKLM-x32 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = <a href="http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}" target="_blank">http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}</a></p><p>SearchScopes: HKU\.DEFAULT -> DefaultScope {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = </p><p>SearchScopes: HKU\.DEFAULT -> {031AB733-D4C1-4744-9C48-022D0EF0A8D2} URL = <a href="http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC" target="_blank">http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {180780f0-b348-4b44-8210-94a8f3ee15b2} URL = <a href="http://search.comcast.net/search/?cat=Web&con=toolbar&q={searchTerms}" target="_blank">http://search.comcast.net/search/?cat=Web&con=toolbar&q={searchTerms}</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {3003A449-E8C8-4D74-B449-6F28EEE84BC4} URL = <a href="http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl" target="_blank">http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = <a href="http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=" target="_blank">http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {96726A08-86CB-409E-A3DA-B80C37C25DED} URL = <a href="http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC" target="_blank">http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = <a href="http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox" target="_blank">http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = <a href="http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}" target="_blank">http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {180780f0-b348-4b44-8210-94a8f3ee15b2} URL = <a href="http://search.comcast.net/search/?cat=Web&con=toolbar&q={searchTerms}" target="_blank">http://search.comcast.net/search/?cat=Web&con=toolbar&q={searchTerms}</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {3003A449-E8C8-4D74-B449-6F28EEE84BC4} URL = <a href="http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl" target="_blank">http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = <a href="http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=" target="_blank">http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {96726A08-86CB-409E-A3DA-B80C37C25DED} URL = <a href="http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC" target="_blank">http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = <a href="https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}" target="_blank">https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = <a href="http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox" target="_blank">http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox</a></p><p>SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = <a href="http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}" target="_blank">http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}</a></p><p>BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)</p><p>BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)</p><p>BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)</p><p>BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)</p><p>BHO-x32: No Name -> {11111111-1111-1111-1111-110011441193} -> No File</p><p>BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File</p><p>BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)</p><p>BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)</p><p>BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)</p><p>BHO-x32: Microsoft Live Search Toolbar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)</p><p>BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)</p><p>BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)</p><p>BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)</p><p>Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File</p><p>Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.)</p><p>Toolbar: HKU\.DEFAULT -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File</p><p>Toolbar: HKU\.DEFAULT -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File</p><p>Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File</p><p>Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File</p><p>Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File</p><p>Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File</p><p>Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File</p><p>Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File</p><p>Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)</p><p>Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)</p><p>Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76</p><p></p><p>FireFox:</p><p>========</p><p>FF Plugin: @<a href="http://adobe.com/FlashPlayer" target="_blank">adobe.com/FlashPlayer</a> -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll ()</p><p>FF Plugin: @<a href="http://microsoft.com/GENUINE" target="_blank">microsoft.com/GENUINE</a>-> disabled No File</p><p>FF Plugin: @<a href="http://microsoft.com/NpCtrl,version=1.0" target="_blank">Microsoft.com/NpCtrl,version=1.0</a> -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)</p><p>FF Plugin: <a href="http://adobe.com/AdobeAAMDetect" target="_blank">adobe.com/AdobeAAMDetect</a> -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)</p><p>FF Plugin-x32: @<a href="http://adobe.com/FlashPlayer" target="_blank">adobe.com/FlashPlayer</a> -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll ()</p><p>FF Plugin-x32: @<a href="http://adobe.com/ShockwavePlayer" target="_blank">adobe.com/ShockwavePlayer</a> -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)</p><p>FF Plugin-x32: @<a href="http://apple.com/iTunes,version=1.0" target="_blank">Apple.com/iTunes,version=1.0</a> -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()</p><p>FF Plugin-x32: @<a href="http://java.com/DTPlugin,version=10.21.2" target="_blank">java.com/DTPlugin,version=10.21.2</a>-> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)</p><p>FF Plugin-x32: @<a href="http://java.com/JavaPlugin,version=10.21.2" target="_blank">java.com/JavaPlugin,version=10.21.2</a> -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)</p><p>FF Plugin-x32: @<a href="http://microsoft.com/GENUINE" target="_blank">microsoft.com/GENUINE</a> -> disabled No File</p><p>FF Plugin-x32: @<a href="http://microsoft.com/NpCtrl,version=1.0" target="_blank">Microsoft.com/NpCtrl,version=1.0</a> -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)</p><p>FF Plugin-x32: @<a href="http://microsoft.com/WLPG,version=14.0.8081.0709" target="_blank">microsoft.com/WLPG,version=14.0.8081.0709</a> -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)</p><p>FF Plugin-x32: @<a href="http://tools.google.com/Google" target="_blank">tools.google.com/Google</a>Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)</p><p>FF Plugin-x32: @<a href="http://tools.google.com/Google" target="_blank">tools.google.com/Google</a>Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)</p><p>FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)</p><p>FF Plugin-x32: <a href="http://adobe.com/AdobeAAMDetect" target="_blank">adobe.com/AdobeAAMDetect</a> -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)</p><p>FF HKLM\...\Firefox\Extensions: [{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}] - C:\Program Files\Updater By SweetPacks\Firefox</p><p>FF HKLM-x32\...\Firefox\Extensions: [<a href="mailto:smartwebprinting@hp.com">smartwebprinting@hp.com</a>] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3</p><p>FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2009-10-30]</p><p>FF HKLM-x32\...\Firefox\Extensions: [{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}] - C:\Program Files\Updater By SweetPacks\Firefox</p><p>FF HKLM-x32\...\Firefox\Extensions: [<a href="mailto:wrc@avast.com">wrc@avast.com</a>] - C:\Program Files\AVAST Software\Avast\WebRep\FF</p><p>FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-16]</p><p></p><p>Chrome: </p><p>=======</p><p>CHR Profile: C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default</p><p>CHR Extension: (Google Drive) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-30]</p><p>CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-30]</p><p>CHR Extension: (YouTube) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-30]</p><p>CHR Extension: (Google Search) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-30]</p><p>CHR Extension: (Google Wallet) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-30]</p><p>CHR Extension: (Gmail) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-30]</p><p>CHR HKLM\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path</p><p>CHR HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path</p><p>CHR HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path</p><p>CHR HKLM-x32\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path</p><p>CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-09-14]</p><p></p><p>==================== Services (Whitelisted) =================</p><p></p><p>(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)</p><p></p><p>R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation)</p><p>R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.)</p><p>R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-14] (AVAST Software)</p><p>R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]</p><p>S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed]</p><p>R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-03-19] (Hewlett-Packard Company) [File not signed]</p><p>S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [<a href="http://malwaretips.com/tel:1871160" target="_blank">1871160</a> 2014-11-21] (Malwarebytes Corporation)</p><p>S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)</p><p>R2 Nyokurdize; C:\Program Files (x86)\Nyokurdize\Nyokurdize.exe [<a href="http://malwaretips.com/tel:4377560" target="_blank">4377560</a> 2014-11-26] ()</p><p>R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] ()</p><p>R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe [240128 2009-07-21] (IDT, Inc.)</p><p>S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed]</p><p>S4 NIApplicationWebServer64; "C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe" -user [X]</p><p>S2 Update Rock Turner; "C:\Program Files (x86)\Rock Turner\updateRockTurner.exe" [X]</p><p></p><p>==================== Drivers (Whitelisted) ====================</p><p></p><p>(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)</p><p></p><p>R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-09-14] ()</p><p>R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-09-14] (AVAST Software)</p><p>R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-09-14] (AVAST Software)</p><p>R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-09-14] ()</p><p>R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [<a href="http://malwaretips.com/tel:1041168" target="_blank">1041168</a> 2014-11-21] (AVAST Software)</p><p>R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-10-14] (AVAST Software)</p><p>R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-09-14] (AVAST Software)</p><p>R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-09-14] ()</p><p>R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.)</p><p>R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.)</p><p>R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-18] (AVG Technologies CZ, s.r.o.)</p><p>S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.)</p><p>S0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.)</p><p>R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.)</p><p>R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.)</p><p>R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.)</p><p>S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [96472 2014-12-21] (Malwarebytes Corporation)</p><p>S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation)</p><p>R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [135384 2014-12-22] (Malwarebytes Corporation)</p><p>S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation)</p><p>U0 rjaty; C:\Windows\System32\drivers\imofugc.sys [79064 2014-12-22] (Malwarebytes Corporation)</p><p>S3 SilvrLnk; C:\Windows\System32\DRIVERS\silvrlnk.sys [129536 2012-03-07] (Texas Instruments) [File not signed]</p><p>U4 eabfiltr; No ImagePath</p><p>S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X]</p><p>S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X]</p><p>S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X]</p><p></p><p>==================== NetSvcs (Whitelisted) ===================</p><p></p><p>(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)</p><p></p><p></p><p>==================== One Month Created Files and Folders ========</p><p></p><p>(If an entry is included in the fixlist, the file\folder will be moved.)</p><p></p><p>2014-12-22 01:19 - 2014-12-22 01:19 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\imofugc.sys</p><p>2014-12-20 23:54 - 2014-12-21 00:19 - 00034599 _____ () C:\Users\Mary Morgan\Downloads\Addition.txt</p><p>2014-12-20 23:42 - 2014-12-22 01:55 - 00034961 _____ () C:\Users\Mary Morgan\Downloads\FRST.txt</p><p>2014-12-20 23:41 - 2014-12-22 01:48 - 00000000 ____D () C:\FRST</p><p>2014-12-20 12:42 - 2014-12-22 01:50 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)</p><p>2014-12-20 12:00 - 2014-12-22 01:34 - 00000000 ____D () C:\Users\Mary Morgan\Desktop\mbar</p><p>2014-12-20 11:45 - 2014-12-20 11:49 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Mary Morgan\Downloads\mbar-1.08.2.1001.exe</p><p>2014-12-20 11:42 - 2014-12-20 11:44 - 02122240 _____ (Farbar) C:\Users\Mary Morgan\Downloads\FRST64.exe</p><p>2014-12-19 23:17 - 2014-12-22 01:46 - 00135384 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys</p><p>2014-12-19 23:14 - 2014-12-19 23:14 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk</p><p>2014-12-19 23:14 - 2014-12-19 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware</p><p>2014-12-19 23:13 - 2014-12-21 15:47 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys</p><p>2014-12-19 23:13 - 2014-12-19 23:14 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware</p><p>2014-12-19 23:13 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys</p><p>2014-12-19 23:13 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys</p><p>2014-12-19 23:07 - 2014-12-19 23:12 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Mary Morgan\Downloads\mbam-setup-2.0.4.1028.exe</p><p>2014-12-19 22:55 - 2014-12-19 22:55 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk</p><p>2014-12-19 22:55 - 2014-12-19 22:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome</p><p>2014-12-19 22:52 - 2014-12-22 01:58 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job</p><p>2014-12-19 22:52 - 2014-12-21 23:17 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job</p><p>2014-12-19 22:52 - 2014-12-19 22:52 - 00003904 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA</p><p>2014-12-19 22:52 - 2014-12-19 22:52 - 00003652 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore</p><p>2014-12-19 10:22 - 2014-12-13 00:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe</p><p>2014-12-19 10:22 - 2014-12-12 22:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe</p><p>2014-12-12 00:52 - 2014-12-12 00:52 - 00000000 ____D () C:\Windows\system32\appraiser</p><p>2014-12-11 09:03 - 2014-10-17 21:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll</p><p>2014-12-11 09:03 - 2014-10-17 20:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll</p><p>2014-12-10 08:13 - 2014-12-03 21:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll</p><p>2014-12-10 08:13 - 2014-12-03 21:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll</p><p>2014-12-10 08:13 - 2014-12-03 21:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll</p><p>2014-12-10 08:13 - 2014-12-03 21:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll</p><p>2014-12-10 08:13 - 2014-12-03 21:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll</p><p>2014-12-10 08:13 - 2014-12-03 21:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll</p><p>2014-12-10 08:13 - 2014-12-03 21:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll</p><p>2014-12-10 08:13 - 2014-12-01 18:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe</p><p>2014-12-10 08:13 - 2014-11-26 20:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll</p><p>2014-12-10 08:13 - 2014-11-21 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb</p><p>2014-12-10 08:13 - 2014-11-21 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll</p><p>2014-12-10 08:13 - 2014-11-21 21:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll</p><p>2014-12-10 08:13 - 2014-11-21 21:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe</p><p>2014-12-10 08:13 - 2014-11-21 21:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll</p><p>2014-12-10 08:13 - 2014-11-21 21:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll</p><p>2014-12-10 08:13 - 2014-11-21 20:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll</p><p>2014-12-10 08:13 - 2014-11-21 20:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe</p><p>2014-12-10 08:13 - 2014-11-21 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll</p><p>2014-12-10 08:13 - 2014-11-21 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll</p><p>2014-12-10 08:13 - 2014-11-21 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll</p><p>2014-12-10 08:13 - 2014-11-21 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll</p><p>2014-12-10 08:13 - 2014-11-10 22:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll</p><p>2014-12-10 08:13 - 2014-11-10 21:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll</p><p>2014-12-10 08:13 - 2014-11-10 20:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys</p><p>2014-12-10 08:12 - 2014-11-26 20:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll</p><p>2014-12-10 08:12 - 2014-11-21 22:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll</p><p>2014-12-10 08:12 - 2014-11-21 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe</p><p>2014-12-10 08:12 - 2014-11-21 21:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb</p><p>2014-12-10 08:12 - 2014-11-21 21:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll</p><p>2014-12-10 08:12 - 2014-11-21 21:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl</p><p>2014-12-10 08:12 - 2014-11-21 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl</p><p>2014-12-10 08:12 - 2014-11-21 20:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll</p><p>2014-12-10 08:12 - 2014-11-21 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll</p><p>2014-12-10 08:12 - 2014-11-21 19:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll</p><p>2014-12-10 08:10 - 2014-10-29 21:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe</p><p>2014-12-10 08:10 - 2014-10-29 20:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe</p><p>2014-12-10 08:09 - 2014-11-07 22:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll</p><p>2014-12-10 08:09 - 2014-11-07 21:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll</p><p>2014-12-10 08:09 - 2014-10-02 21:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll</p><p>2014-12-10 08:09 - 2014-10-02 21:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll</p><p>2014-12-10 08:09 - 2014-10-02 21:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll</p><p>2014-12-10 08:09 - 2014-10-02 21:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll</p><p>2014-12-10 08:09 - 2014-10-02 21:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe</p><p>2014-12-10 08:09 - 2014-10-02 20:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll</p><p>2014-12-10 08:09 - 2014-10-02 20:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll</p><p>2014-12-10 08:09 - 2014-10-02 20:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll</p><p>2014-12-10 08:09 - 2014-10-02 20:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll</p><p>2014-12-10 08:09 - 2014-10-02 20:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe</p><p>2014-12-09 11:43 - 2014-12-09 11:43 - 00000680 _____ () C:\Users\Mary Morgan\Downloads\30086-BS2-Code (1).zip</p><p>2014-12-09 11:42 - 2014-12-09 11:42 - 00000680 _____ () C:\Users\Mary Morgan\Downloads\30086-BS2-Code.zip</p><p>2014-12-04 12:57 - 2014-12-04 14:12 - 00000000 ____D () C:\Users\Mary Morgan\Documents\AutoCAD Sheet Sets</p><p>2014-12-02 16:44 - 2014-12-02 16:44 - 01444352 _____ () C:\Users\Mary Morgan\Downloads\Kinematics_final.ppt</p><p>2014-12-01 02:26 - 2014-12-01 02:32 - 00000000 ____D () C:\Users\Mary Morgan\Documents\all</p><p>2014-11-30 22:42 - 2014-11-30 22:42 - 00000000 ____D () C:\Program Files (x86)\AVG</p><p>2014-11-30 22:21 - 2014-12-01 01:43 - 00000000 ____D () C:\ProgramData\MFAData</p><p>2014-11-30 22:21 - 2014-11-30 22:21 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\MFAData</p><p>2014-11-29 19:32 - 2014-12-20 23:37 - 00000000 __SHD () C:\Program Files (x86)\Nyokurdize</p><p>2014-11-24 19:22 - 2014-11-24 19:22 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\Publish Providers</p><p>2014-11-24 19:02 - 2014-11-30 22:21 - 00007720 _____ () C:\Windows\system32\--traceoff</p><p>2014-11-24 19:02 - 2014-11-24 19:02 - 00000000 _____ () C:\Windows\system32\--debugoff</p><p>2014-11-24 18:59 - 2014-11-24 19:07 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\Sony</p><p>2014-11-24 18:56 - 2014-11-24 19:22 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\Sony</p><p>2014-11-24 18:22 - 2014-11-30 13:38 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software</p><p>2014-11-24 18:22 - 2014-11-24 18:22 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\NCH Software</p><p>2014-11-24 18:22 - 2014-11-24 18:22 - 00000000 ____D () C:\ProgramData\NCH Software</p><p>2014-11-23 01:35 - 2014-11-23 01:35 - 00000000 __SHD () C:\Users\Mary Morgan\AppData\Local\EmieBrowserModeList</p><p></p><p>==================== One Month Modified Files and Folders =======</p><p></p><p>(If an entry is included in the fixlist, the file\folder will be moved.)</p><p></p><p>2014-12-22 02:09 - 2010-06-07 19:35 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\Adobe</p><p>2014-12-22 02:08 - 2012-04-03 07:07 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job</p><p>2014-12-22 01:47 - 2012-03-26 14:38 - 00269251 _____ () C:\Windows\setupact.log</p><p>2014-12-22 01:19 - 2009-07-14 00:32 - 00000000 ____D () C:\Windows\addins</p><p>2014-12-22 01:13 - 2014-10-09 15:05 - 00000000 ____D () C:\Users\Mary Morgan\Documents\luxe</p><p>2014-12-21 23:25 - 2009-07-13 23:45 - 00026192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0</p><p>2014-12-21 23:25 - 2009-07-13 23:45 - 00026192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0</p><p>2014-12-21 23:21 - 2012-03-26 14:40 - 01337365 _____ () C:\Windows\WindowsUpdate.log</p><p>2014-12-21 23:16 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT</p><p>2014-12-21 17:17 - 2013-02-16 13:04 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update</p><p>2014-12-21 17:15 - 2012-07-11 09:33 - 00513468 _____ () C:\Windows\PFRO.log</p><p>2014-12-21 16:38 - 2011-11-05 17:48 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\CrashDumps</p><p>2014-12-19 23:13 - 2012-03-26 12:51 - 00000000 ____D () C:\ProgramData\Malwarebytes</p><p>2014-12-19 22:53 - 2012-09-18 02:41 - 00000000 ____D () C:\Program Files (x86)\Google</p><p>2014-12-19 22:52 - 2010-04-19 18:50 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\Deployment</p><p>2014-12-19 22:24 - 2013-07-08 14:25 - 00029174 _____ () C:\Windows\DPINST.LOG</p><p>2014-12-19 19:57 - 2010-04-19 18:50 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\Google</p><p>2014-12-19 12:57 - 2010-04-19 18:49 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\Adobe</p><p>2014-12-19 11:35 - 2011-12-17 17:21 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt</p><p>2014-12-19 11:35 - 2010-07-07 20:46 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log</p><p>2014-12-12 01:03 - 2014-04-23 19:55 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk</p><p>2014-12-12 00:52 - 2014-05-19 17:17 - 00000000 ___SD () C:\Windows\system32\CompatTel</p><p>2014-12-12 00:52 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions</p><p>2014-12-12 00:52 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\AppCompat</p><p>2014-12-11 09:42 - 2009-10-30 21:57 - 00000000 ____D () C:\ProgramData\Microsoft Help</p><p>2014-12-11 09:39 - 2013-08-15 08:04 - 00000000 ____D () C:\Windows\system32\MRT</p><p>2014-12-11 09:15 - 2011-11-15 22:42 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe</p><p>2014-12-10 11:08 - 2013-06-18 14:58 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\cache</p><p>2014-12-10 11:08 - 2012-04-03 07:07 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe</p><p>2014-12-10 11:08 - 2012-04-03 07:07 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater</p><p>2014-12-10 11:08 - 2011-11-06 18:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl</p><p>2014-12-04 09:48 - 2010-04-20 06:42 - 00000000 ____D () C:\Users\Mary Morgan</p><p>2014-12-03 23:16 - 2013-06-12 12:50 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\Autodesk</p><p>2014-12-03 23:16 - 2013-06-12 12:50 - 00000000 ____D () C:\ProgramData\Autodesk</p><p>2014-11-26 16:03 - 2014-11-10 01:52 - 00000000 ____D () C:\Users\Mary Morgan\Documents\robotic</p><p>2014-11-24 18:24 - 2013-06-27 22:25 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\muvee Technologies</p><p>2014-11-24 14:04 - 2010-06-26 09:08 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe</p><p></p><p>Files to move or delete:</p><p>====================</p><p>C:\ProgramData\uninstaller.exe</p><p></p><p></p><p>Some content of TEMP:</p><p>====================</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\AAMHelper.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\AcDeltree.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\AdbeRdr1012_en_US.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\ApnStub.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\BackupSetup.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\Extract.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\FlashPlayerUpdate.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\FlashPlayerUpdate01.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\fsprod.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\fssfm.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\GenericUninstall.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\gtbcheck.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\GURBF48.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\GURD2C8.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\HPHelpUpdater.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\HPQSi.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\hsbing_717_active.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\htmlayout.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\i2iup1w4.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\install_flashplayer11x32axau_gtba_chra_dy_aaa_aih.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\install_flash_player.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna1401191956681244069.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna2364191691446776988.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna3124277654735573921.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna4431772785725460415.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna4526163516091062593.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna5547968474558266161.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna6274173929784156034.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna8800888306638551426.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jna9130479762195970403.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\mgsqlite3.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\mssinstaller.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\ObronaBlockAds.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\ohjk9akx.dll</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\preconfig.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\Resource.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\setup.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\Shortcut_sweetpacks_dlcom_5312013.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\SP47636.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\sp48071.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\SP48159.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\SP48394.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\SP48755.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\SP48792.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\SP49394.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\sp50843.exe.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\sp54373.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\sp58915.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\sp64126.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\SpotifyUninstall.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\Strongvault.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\toolbar66603690.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\uninst1.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\uninstall67746054.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\uninstall67759611.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\uninstall67759705.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\uninstall67759783.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\uninstaller.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\UninstallHPSA.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\UninstallHPTCA.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\wmpfirefoxplugin.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\WSSetup.exe</p><p>C:\Users\Mary Morgan\AppData\Local\Temp\{E58C0B81-6D4B-4E51-90EE-4587B1AA3204}-24.0.1312.56_23.0.1271.97_chrome_updater.exe</p><p></p><p></p><p>==================== Bamital & volsnap Check =================</p><p></p><p>(There is no automatic fix for files that do not pass verification.)</p><p></p><p>C:\Windows\System32\winlogon.exe => File is digitally signed</p><p>C:\Windows\System32\wininit.exe => File is digitally signed</p><p>C:\Windows\SysWOW64\wininit.exe => File is digitally signed</p><p>C:\Windows\explorer.exe => File is digitally signed</p><p>C:\Windows\SysWOW64\explorer.exe => File is digitally signed</p><p>C:\Windows\System32\svchost.exe => File is digitally signed</p><p>C:\Windows\SysWOW64\svchost.exe => File is digitally signed</p><p>C:\Windows\System32\services.exe => File is digitally signed</p><p>C:\Windows\System32\User32.dll => File is digitally signed</p><p>C:\Windows\SysWOW64\User32.dll => File is digitally signed</p><p>C:\Windows\System32\userinit.exe => File is digitally signed</p><p>C:\Windows\SysWOW64\userinit.exe => File is digitally signed</p><p>C:\Windows\System32\rpcss.dll => File is digitally signed</p><p>C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed</p><p></p><p></p><p>LastRegBack: 2014-09-18 23:58</p><p></p><p>==================== End Of Log ============================</p></blockquote><p></p>
[QUOTE="trice, post: 319408, member: 32176"] Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-12-2014 Ran by Mary Morgan (administrator) on MARYMORGAN-PC on 22-12-2014 01:46:21 Running from C:\Users\Mary Morgan\Downloads Loaded Profile: Mary Morgan (Available profiles: Mary Morgan) Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States) Internet Explorer Version 11 Boot Mode: Normal Tutorial for Farbar Recovery Scan Tool: [url]http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/[/url] ==================== Processes (Whitelisted) ================= (If an entry is included in the fixlist, the process will be closed. The file will not be moved.) (AMD) C:\Windows\System32\atiesrxx.exe (IDT, Inc.) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\stacsv64.exe (AMD) C:\Windows\System32\atieclxx.exe (Microsoft Corporation) C:\Windows\System32\wlanext.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe (Andrea Electronics Corporation) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe (LSI Corporation) C:\Program Files\LSI SoftModem\agr64svc.exe (Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe (Autodesk, Inc.) C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe (Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe () C:\Program Files (x86)\Nyokurdize\Nyokurdize.exe () C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe () C:\Program Files (x86)\Nyokurdize\NyokurdizeHelper.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe (Sun Microsystems, Inc.) C:\Program Files\Java\jre6\bin\jusched.exe (Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe (McAfee, Inc.) C:\Program Files (x86)\McAfee Security Scan\3.0.287\SSScheduler.exe (Microsoft Corporation) C:\Windows\System32\rundll32.exe ( Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard Co.) C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPNetworkCommunicatorCom.exe (Hewlett-Packard) C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe (AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe (Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe (Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe (Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe () C:\Program Files (x86)\Hewlett-Packard\Shared\HpqToaster.exe (Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe (ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Alexander Roshal) C:\Program Files (x86)\WinRAR\WinRAR.exe (Adobe Systems, Incorporated) C:\Users\Mary Morgan\AppData\Local\Temp\Rar$EXa0.360\Photoshop CS5 Portable by havingthemes\Photoshop.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Microsoft Corporation) C:\Windows\System32\mspaint.exe (Microsoft Corporation) C:\Windows\System32\mspaint.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe (Malwarebytes Corp.) C:\Users\Mary Morgan\Downloads\mbar-1.08.2.1001.exe (Microsoft Corporation) C:\Windows\SysWOW64\cmd.exe (Malwarebytes Corporation) C:\Users\Mary Morgan\Desktop\mbar\mbar.exe ==================== Registry (Whitelisted) ================== (If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.) HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [[URL='http://malwaretips.com/tel:1814312']1814312[/URL] 2011-12-17] (Synaptics Incorporated) HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [450048 2009-07-21] (IDT, Inc.) HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Java\jre6\bin\jusched.exe [171520 2009-10-30] (Sun Microsystems, Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [477600 2013-01-24] (Adobe Systems Incorporated) HKLM\...\Run: [Autodesk Sync] => C:\Program Files\Autodesk\Autodesk Sync\AdSync.exe [415680 2012-02-05] (Autodesk, Inc.) HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2009-08-05] (Advanced Micro Devices, Inc.) HKLM-x32\...\Run: [QlbCtrl.exe] => C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe [323640 2010-02-25] ( Hewlett-Packard Development Company, L.P.) HKLM-x32\...\Run: [NortonOnlineBackupReminder] => C:\Program Files (x86)\Symantec\Norton Online Backup\Activation\NobuActivation.exe [600936 2009-06-29] (Symantec Corporation) HKLM-x32\...\Run: [Adobe Reader Speed Launcher] => "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" HKLM-x32\...\Run: [WirelessAssistant] => C:\Program Files (x86)\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe [498744 2009-07-23] (Hewlett-Packard) HKLM-x32\...\Run: [SMessaging] => C:\Users\Mary Morgan\AppData\Local\Strongvault Online Backup\SMessaging.exe HKLM-x32\...\Run: [SwitchBoard] => C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\...\Run: [AdobeCS6ServiceManager] => C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe [[URL='http://malwaretips.com/tel:1073312']1073312[/URL] 2012-03-09] (Adobe Systems Incorporated) HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43816 2014-07-03] (Apple Inc.) HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard) HKLM-x32\...\Run: [] => [X] HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation) HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [[URL='http://malwaretips.com/tel:1021128']1021128[/URL] 2014-11-20] (Adobe Systems Incorporated) HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-07-08] (Apple Inc.) HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [[URL='http://malwaretips.com/tel:4085896']4085896[/URL]2014-10-14] (AVAST Software) HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-11-11] (Hewlett-Packard) HKLM-x32\...\RunOnce: [Malwarebytes Anti-Rootkit (cleanup)] => C:\ProgramData\Malwarebytes' Anti-Malware (portable)\mbamdor.exe [54072 2014-11-18] (Malwarebytes Corporation) HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [[URL='http://malwaretips.com/tel:2363392']2363392[/URL] 2010-03-19] (Hewlett-Packard Company) HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [[URL='http://malwaretips.com/tel:2573416']2573416[/URL] 2012-10-17] (Hewlett-Packard Co.) HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [Obrona Block Ads] => "C:\Users\Mary Morgan\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" --hidden HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\RunOnce: [Adobe Speed Launcher] => [URL='http://malwaretips.com/tel:1419221820']1419221820[/URL] HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Policies\Explorer: [] HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {a8ac7f78-b9de-11e3-a9a6-c80aa90cd2e0} - G:\ZTE_Handset_USB_Driver.exe HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {c6e293d7-5062-11e3-8433-c80aa90cd2e0} - H:\VZW_Software_upgrade_assistant.exe HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {cdc02c1e-f1a7-11e3-9bee-c80aa90cd2e0} - G:\OpenSecureFiles.exe HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [[URL='http://malwaretips.com/tel:2363392']2363392[/URL] 2010-03-19] (Hewlett-Packard Company) HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [[URL='http://malwaretips.com/tel:2573416']2573416[/URL] 2012-10-17] (Hewlett-Packard Co.) HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Run: [Obrona Block Ads] => "C:\Users\Mary Morgan\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" --hidden HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\RunOnce: [Adobe Speed Launcher] => [URL='http://malwaretips.com/tel:1419221820']1419221820[/URL] HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Policies\Explorer: [] HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {a8ac7f78-b9de-11e3-a9a6-c80aa90cd2e0} - G:\ZTE_Handset_USB_Driver.exe HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {c6e293d7-5062-11e3-8433-c80aa90cd2e0} - H:\VZW_Software_upgrade_assistant.exe HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\MountPoints2: {cdc02c1e-f1a7-11e3-9bee-c80aa90cd2e0} - G:\OpenSecureFiles.exe HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [LightScribe Control Panel] => C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [[URL='http://malwaretips.com/tel:2363392']2363392[/URL] 2010-03-19] (Hewlett-Packard Company) HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [AdobeBridge] => [X] HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [HP Deskjet 3510 series (NET)] => C:\Program Files\HP\HP Deskjet 3510 series\Bin\ScanToPCActivationApp.exe [[URL='http://malwaretips.com/tel:2573416']2573416[/URL] 2012-10-17] (Hewlett-Packard Co.) HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [Obrona Block Ads] => "C:\Users\Mary Morgan\AppData\Local\Obrona Block Ads\ObronaBlockAds.exe" --hidden HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\RunOnce: [Adobe Speed Launcher] => [URL='http://malwaretips.com/tel:1419221820']1419221820[/URL] HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Policies\Explorer: [] HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {a8ac7f78-b9de-11e3-a9a6-c80aa90cd2e0} - G:\ZTE_Handset_USB_Driver.exe HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {c6e293d7-5062-11e3-8433-c80aa90cd2e0} - H:\VZW_Software_upgrade_assistant.exe HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {cdc02c1e-f1a7-11e3-9bee-c80aa90cd2e0} - G:\OpenSecureFiles.exe Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files (x86)\McAfee Security Scan\3.0.287\SSScheduler.exe (McAfee, Inc.) Startup: C:\Users\Mary Morgan\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk ShortcutTarget: Monitor Ink Alerts - HP Deskjet 3510 series (Network).lnk -> C:\Program Files\HP\HP Deskjet 3510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.) ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShA64.dll (AVAST Software) ShellIconOverlayIdentifiers: [AutoCAD Digital Signatures Icon Overlay Handler] -> {36A21736-36C2-4C11-8ACB-D4136F2B57BD} => C:\Windows\system32\AcSignIcon.dll (Autodesk, Inc.) ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} => No File ==================== Internet (Whitelisted) ==================== (If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.) HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION ProxyEnable: [S-1-5-21-201335642-3024121863-282455075-1001] => Internet Explorer proxy is enabled. ProxyServer: [S-1-5-21-201335642-3024121863-282455075-1001] => http=127.0.0.1:9880;https=[URL='http://127.0.0.1:9880/']127.0.0.1:9880[/URL] ProxyEnable: [S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => Internet Explorer proxy is enabled. ProxyServer: [S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0] => http=127.0.0.1:9880;https=[URL='http://127.0.0.1:9880/']127.0.0.1:9880[/URL] HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://speedial.com/?f=1&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=[/url] HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = [url]https://www.yahoo.com/?fr=hp-avast&type=odc179[/url] HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Search_URL = HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome[/url] HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,First Home Page = [url]http://g.msn.com/HPNOT/1[/url] HKU\S-1-5-21-201335642-3024121863-282455075-1001\Software\Microsoft\Internet Explorer\Main,Search Page = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] HKU\S-1-5-21-201335642-3024121863-282455075-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = [url]https://www.yahoo.com/?fr=hp-avast&type=odc179[/url] HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Page = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\Software\Microsoft\Internet Explorer\Main,Search Bar = [url]https://www.yahoo.com/?fr=hp-avast&type=odc179[/url] SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM -> {3003A449-E8C8-4D74-B449-6F28EEE84BC4} URL = [url]http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl[/url] SearchScopes: HKLM -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = [url]http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=[/url] SearchScopes: HKLM -> {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = [url]http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox[/url] SearchScopes: HKLM-x32 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 -> {3003A449-E8C8-4D74-B449-6F28EEE84BC4} URL = [url]http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl[/url] SearchScopes: HKLM-x32 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] SearchScopes: HKLM-x32 -> {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = [url]http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox[/url] SearchScopes: HKLM-x32 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = [url]http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}[/url] SearchScopes: HKU\.DEFAULT -> DefaultScope {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = SearchScopes: HKU\.DEFAULT -> {031AB733-D4C1-4744-9C48-022D0EF0A8D2} URL = [url]http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {180780f0-b348-4b44-8210-94a8f3ee15b2} URL = [url]http://search.comcast.net/search/?cat=Web&con=toolbar&q={searchTerms}[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {3003A449-E8C8-4D74-B449-6F28EEE84BC4} URL = [url]http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = [url]http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {96726A08-86CB-409E-A3DA-B80C37C25DED} URL = [url]http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = [url]http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = [url]http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> DefaultScope {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {180780f0-b348-4b44-8210-94a8f3ee15b2} URL = [url]http://search.comcast.net/search/?cat=Web&con=toolbar&q={searchTerms}[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {3003A449-E8C8-4D74-B449-6F28EEE84BC4} URL = [url]http://www.ask.com/web?q={searchterms}&l=dis&o=ushpl[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {31090377-0740-419E-BEFC-A56E50500D5B} URL = [url]http://speedial.com/results.php?f=4&q={searchTerms}&a=spd_dsites03_14_22_ie&cd=2XzuyEtN2Y1L1Qzu0CzztD0A0AzytD0C0DtB0EtDzyyCyEtDtN0D0Tzu0SzzzztBtN1L2XzutBtFtBtDtFtCzytFtBtN1L1CzutCyEtBzytDyD1V1StN1L1G1B1V1N2Y1L1Qzu2SyD0B0DtD0DtB0E0DtGtDyCzyyCtG0A0C0E0CtGzztC0CtCtGtDyCtCtCyC0CzyyEyEyD0E0F2QtN1M1F1B2Z1V1N2Y1L1Qzu2StByDyEyDzytDzztAtGyBtC0FyCtG0EtDzzzytGyE0Ezz0FtGyC0D0BtByDyDyDzztC0EzytA2Q&cr=650511336&ir=[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {96726A08-86CB-409E-A3DA-B80C37C25DED} URL = [url]http://websearch.ask.com/redirect?client=ie&tb=ORJ&o=100000031&src=kw&q={searchTerms}&locale=en_US&apn_ptnrs=TV&apn_dtid=OSJ000YYUS&apn_uid=31AEA350-0516-423A-91D0-94440564F198&apn_sauid=D436F93F-7359-431C-A12F-3EC3E2C0EBDC[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {9CB96984-43C3-4D44-90EF-01466EFCF7BB} URL = [url]https://search.yahoo.com/yhs/search?type=odc179&hspart=avast&hsimp=yhs-001&p={searchTerms}[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {AC08DBF8-8CE4-4E80-8DCB-227321BBA886} URL = [url]http://www.bing.com/search?q={searchTerms}&form=HPNTDF&pc=HPNTDF&src=IE-SearchBox[/url] SearchScopes: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> {EEE6C360-6118-11DC-9C72-001320C79847} URL = [url]http://start.sweetpacks.com/?src=6&q={searchTerms}&st=12&crg=3.5000006.10045&barid={987C9A9D-CE41-11E2-8E00-C217FEAA4E51}[/url] BHO: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software) BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: HP Print Enhancer -> {0347C33E-8762-4905-BF09-768834316C61} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) BHO-x32: No Name -> {11111111-1111-1111-1111-110011441193} -> No File BHO-x32: No Name -> {5C255C8A-E604-49b4-9D64-90988571CECB} -> No File BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: avast! Online Security -> {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} -> C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software) BHO-x32: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) BHO-x32: Microsoft Live Search Toolbar Helper -> {d2ce3e00-f94a-4740-988e-03dc2f38c34f} -> c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.) BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) BHO-x32: HP Smart BHO Class -> {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} -> C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) Toolbar: HKLM - avast! WebRep - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - No File Toolbar: HKLM-x32 - Microsoft Live Search Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files (x86)\MSN\Toolbar\3.0.0566.0\msneshellx.dll (Microsoft Corp.) Toolbar: HKU\.DEFAULT -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File Toolbar: HKU\.DEFAULT -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0 -> No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8089.0726.dll (Microsoft Corporation) Tcpip\Parameters: [DhcpNameServer] 75.75.75.75 75.75.76.76 FireFox: ======== FF Plugin: @[URL='http://adobe.com/FlashPlayer']adobe.com/FlashPlayer[/URL] -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_246.dll () FF Plugin: @[URL='http://microsoft.com/GENUINE']microsoft.com/GENUINE[/URL]-> disabled No File FF Plugin: @[URL='http://microsoft.com/NpCtrl,version=1.0']Microsoft.com/NpCtrl,version=1.0[/URL] -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin: [URL='http://adobe.com/AdobeAAMDetect']adobe.com/AdobeAAMDetect[/URL] -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems) FF Plugin-x32: @[URL='http://adobe.com/FlashPlayer']adobe.com/FlashPlayer[/URL] -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_246.dll () FF Plugin-x32: @[URL='http://adobe.com/ShockwavePlayer']adobe.com/ShockwavePlayer[/URL] -> C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF Plugin-x32: @[URL='http://apple.com/iTunes,version=1.0']Apple.com/iTunes,version=1.0[/URL] -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll () FF Plugin-x32: @[URL='http://java.com/DTPlugin,version=10.21.2']java.com/DTPlugin,version=10.21.2[/URL]-> C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @[URL='http://java.com/JavaPlugin,version=10.21.2']java.com/JavaPlugin,version=10.21.2[/URL] -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @[URL='http://microsoft.com/GENUINE']microsoft.com/GENUINE[/URL] -> disabled No File FF Plugin-x32: @[URL='http://microsoft.com/NpCtrl,version=1.0']Microsoft.com/NpCtrl,version=1.0[/URL] -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @[URL='http://microsoft.com/WLPG,version=14.0.8081.0709']microsoft.com/WLPG,version=14.0.8081.0709[/URL] -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @[URL='http://tools.google.com/Google']tools.google.com/Google[/URL]Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @[URL='http://tools.google.com/Google']tools.google.com/Google[/URL]Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin-x32: [URL='http://adobe.com/AdobeAAMDetect']adobe.com/AdobeAAMDetect[/URL] -> C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems) FF HKLM\...\Firefox\Extensions: [{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}] - C:\Program Files\Updater By SweetPacks\Firefox FF HKLM-x32\...\Firefox\Extensions: [[EMAIL]smartwebprinting@hp.com[/EMAIL]] - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 FF Extension: HP Smart Web Printing - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2009-10-30] FF HKLM-x32\...\Firefox\Extensions: [{7D4F1959-3F72-49d5-8E59-F02F8AA6815D}] - C:\Program Files\Updater By SweetPacks\Firefox FF HKLM-x32\...\Firefox\Extensions: [[EMAIL]wrc@avast.com[/EMAIL]] - C:\Program Files\AVAST Software\Avast\WebRep\FF FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-02-16] Chrome: ======= CHR Profile: C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default CHR Extension: (Google Drive) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-30] CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-30] CHR Extension: (YouTube) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-30] CHR Extension: (Google Search) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-30] CHR Extension: (Google Wallet) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-30] CHR Extension: (Gmail) - C:\Users\Mary Morgan\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-30] CHR HKLM\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path CHR HKU\S-1-5-21-201335642-3024121863-282455075-1001\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path CHR HKU\S-1-5-21-201335642-3024121863-282455075-1001-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path CHR HKLM-x32\...\Chrome\Extension: [bakijjialdiiboeaknfpmflphhmljfkd] - No Path CHR HKLM-x32\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2014-09-14] ==================== Services (Whitelisted) ================= (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\AESTSr64.exe [89600 2009-03-02] (Andrea Electronics Corporation) R2 Autodesk Content Service; C:\Program Files (x86)\Autodesk\Content Service\Connect.Service.ContentService.exe [19232 2012-01-31] (Autodesk, Inc.) R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-09-14] (AVAST Software) R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed] S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [69632 2005-11-14] (Macrovision Corporation) [File not signed] R2 LightScribeService; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-03-19] (Hewlett-Packard Company) [File not signed] S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [[URL='http://malwaretips.com/tel:1871160']1871160[/URL] 2014-11-21] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation) R2 Nyokurdize; C:\Program Files (x86)\Nyokurdize\Nyokurdize.exe [[URL='http://malwaretips.com/tel:4377560']4377560[/URL] 2014-11-26] () R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [247152 2009-07-06] () R2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_ccf0dd3cb081af84\STacSV64.exe [240128 2009-07-21] (IDT, Inc.) S3 SwitchBoard; C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) [File not signed] S4 NIApplicationWebServer64; "C:\Program Files\National Instruments\Shared\NI WebServer\ApplicationWebServer.exe" -user [X] S2 Update Rock Turner; "C:\Program Files (x86)\Rock Turner\updateRockTurner.exe" [X] ==================== Drivers (Whitelisted) ==================== (If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.) R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-09-14] () R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-09-14] (AVAST Software) R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-09-14] (AVAST Software) R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-09-14] () R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [[URL='http://malwaretips.com/tel:1041168']1041168[/URL] 2014-11-21] (AVAST Software) R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [427360 2014-10-14] (AVAST Software) R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [92008 2014-09-14] (AVAST Software) R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [224896 2014-09-14] () R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [153368 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 Avgfwfd; C:\Windows\System32\DRIVERS\avgfwd6a.sys [57144 2013-09-26] (AVG Technologies CZ, s.r.o.) R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [190744 2014-06-18] (AVG Technologies CZ, s.r.o.) S1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [243480 2014-08-28] (AVG Technologies CZ, s.r.o.) S0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [313624 2014-07-18] (AVG Technologies CZ, s.r.o.) R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [124184 2014-10-05] (AVG Technologies CZ, s.r.o.) R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31512 2014-06-18] (AVG Technologies CZ, s.r.o.) R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [274200 2014-10-10] (AVG Technologies CZ, s.r.o.) S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [96472 2014-12-21] (Malwarebytes Corporation) S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-11-21] (Malwarebytes Corporation) R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [135384 2014-12-22] (Malwarebytes Corporation) S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-11-21] (Malwarebytes Corporation) U0 rjaty; C:\Windows\System32\drivers\imofugc.sys [79064 2014-12-22] (Malwarebytes Corporation) S3 SilvrLnk; C:\Windows\System32\DRIVERS\silvrlnk.sys [129536 2012-03-07] (Texas Instruments) [File not signed] U4 eabfiltr; No ImagePath S3 RSUSBSTOR; System32\Drivers\RtsUStor.sys [X] S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [X] S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [X] ==================== NetSvcs (Whitelisted) =================== (If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.) ==================== One Month Created Files and Folders ======== (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-22 01:19 - 2014-12-22 01:19 - 00079064 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\imofugc.sys 2014-12-20 23:54 - 2014-12-21 00:19 - 00034599 _____ () C:\Users\Mary Morgan\Downloads\Addition.txt 2014-12-20 23:42 - 2014-12-22 01:55 - 00034961 _____ () C:\Users\Mary Morgan\Downloads\FRST.txt 2014-12-20 23:41 - 2014-12-22 01:48 - 00000000 ____D () C:\FRST 2014-12-20 12:42 - 2014-12-22 01:50 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable) 2014-12-20 12:00 - 2014-12-22 01:34 - 00000000 ____D () C:\Users\Mary Morgan\Desktop\mbar 2014-12-20 11:45 - 2014-12-20 11:49 - 16448208 _____ (Malwarebytes Corp.) C:\Users\Mary Morgan\Downloads\mbar-1.08.2.1001.exe 2014-12-20 11:42 - 2014-12-20 11:44 - 02122240 _____ (Farbar) C:\Users\Mary Morgan\Downloads\FRST64.exe 2014-12-19 23:17 - 2014-12-22 01:46 - 00135384 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys 2014-12-19 23:14 - 2014-12-19 23:14 - 00001102 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2014-12-19 23:14 - 2014-12-19 23:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware 2014-12-19 23:13 - 2014-12-21 15:47 - 00096472 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys 2014-12-19 23:13 - 2014-12-19 23:14 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware 2014-12-19 23:13 - 2014-11-21 06:14 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys 2014-12-19 23:13 - 2014-11-21 06:14 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys 2014-12-19 23:07 - 2014-12-19 23:12 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Mary Morgan\Downloads\mbam-setup-2.0.4.1028.exe 2014-12-19 22:55 - 2014-12-19 22:55 - 00002255 _____ () C:\Users\Public\Desktop\Google Chrome.lnk 2014-12-19 22:55 - 2014-12-19 22:55 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome 2014-12-19 22:52 - 2014-12-22 01:58 - 00000908 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-12-19 22:52 - 2014-12-21 23:17 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-12-19 22:52 - 2014-12-19 22:52 - 00003904 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-12-19 22:52 - 2014-12-19 22:52 - 00003652 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-12-19 10:22 - 2014-12-13 00:09 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-12-19 10:22 - 2014-12-12 22:33 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-12-12 00:52 - 2014-12-12 00:52 - 00000000 ____D () C:\Windows\system32\appraiser 2014-12-11 09:03 - 2014-10-17 21:05 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll 2014-12-11 09:03 - 2014-10-17 20:33 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll 2014-12-10 08:13 - 2014-12-03 21:50 - 00830976 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll 2014-12-10 08:13 - 2014-12-03 21:50 - 00741376 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll 2014-12-10 08:13 - 2014-12-03 21:50 - 00413184 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll 2014-12-10 08:13 - 2014-12-03 21:50 - 00396800 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll 2014-12-10 08:13 - 2014-12-03 21:50 - 00227328 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll 2014-12-10 08:13 - 2014-12-03 21:50 - 00192000 _____ (Microsoft Corporation) C:\Windows\system32\aepic.dll 2014-12-10 08:13 - 2014-12-03 21:44 - 01083392 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll 2014-12-10 08:13 - 2014-12-01 18:28 - 01232040 _____ (Microsoft Corporation) C:\Windows\system32\aitstatic.exe 2014-12-10 08:13 - 2014-11-26 20:10 - 00342200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-12-10 08:13 - 2014-11-21 22:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-12-10 08:13 - 2014-11-21 21:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-12-10 08:13 - 2014-11-21 21:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-12-10 08:13 - 2014-11-21 21:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-12-10 08:13 - 2014-11-21 21:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-12-10 08:13 - 2014-11-21 21:06 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-12-10 08:13 - 2014-11-21 20:58 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-12-10 08:13 - 2014-11-21 20:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-12-10 08:13 - 2014-11-21 20:40 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-12-10 08:13 - 2014-11-21 20:35 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-12-10 08:13 - 2014-11-21 20:33 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-12-10 08:13 - 2014-11-21 19:56 - 01307136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-12-10 08:13 - 2014-11-10 22:09 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-12-10 08:13 - 2014-11-10 21:44 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-12-10 08:13 - 2014-11-10 20:46 - 00119296 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tdx.sys 2014-12-10 08:12 - 2014-11-26 20:43 - 00389296 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-12-10 08:12 - 2014-11-21 22:13 - 25059840 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-12-10 08:12 - 2014-11-21 22:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-12-10 08:12 - 2014-11-21 21:50 - 00580096 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-12-10 08:12 - 2014-11-21 21:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-12-10 08:12 - 2014-11-21 21:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-12-10 08:12 - 2014-11-21 21:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-12-10 08:12 - 2014-11-21 21:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-12-10 08:12 - 2014-11-21 21:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-12-10 08:12 - 2014-11-21 21:34 - 06039552 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-12-10 08:12 - 2014-11-21 21:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-12-10 08:12 - 2014-11-21 21:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-12-10 08:12 - 2014-11-21 21:22 - 19749376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-12-10 08:12 - 2014-11-21 21:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-12-10 08:12 - 2014-11-21 21:20 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-12-10 08:12 - 2014-11-21 21:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-12-10 08:12 - 2014-11-21 21:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-12-10 08:12 - 2014-11-21 21:07 - 00501248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-12-10 08:12 - 2014-11-21 21:07 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-12-10 08:12 - 2014-11-21 21:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-12-10 08:12 - 2014-11-21 21:05 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-12-10 08:12 - 2014-11-21 21:01 - 02277888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-12-10 08:12 - 2014-11-21 20:59 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-12-10 08:12 - 2014-11-21 20:56 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-12-10 08:12 - 2014-11-21 20:54 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-12-10 08:12 - 2014-11-21 20:49 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-12-10 08:12 - 2014-11-21 20:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-12-10 08:12 - 2014-11-21 20:46 - 02125312 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-12-10 08:12 - 2014-11-21 20:45 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-12-10 08:12 - 2014-11-21 20:43 - 14412800 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-12-10 08:12 - 2014-11-21 20:36 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-12-10 08:12 - 2014-11-21 20:29 - 04299264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-12-10 08:12 - 2014-11-21 20:28 - 02358272 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-12-10 08:12 - 2014-11-21 20:23 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-12-10 08:12 - 2014-11-21 20:22 - 02052096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-12-10 08:12 - 2014-11-21 20:21 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-12-10 08:12 - 2014-11-21 20:15 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-12-10 08:12 - 2014-11-21 20:13 - 12836864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-12-10 08:12 - 2014-11-21 20:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-12-10 08:12 - 2014-11-21 20:00 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-12-10 08:12 - 2014-11-21 19:54 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-12-10 08:10 - 2014-10-29 21:03 - 00165888 _____ (Microsoft Corporation) C:\Windows\system32\charmap.exe 2014-12-10 08:10 - 2014-10-29 20:45 - 00155136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\charmap.exe 2014-12-10 08:09 - 2014-11-07 22:16 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-12-10 08:09 - 2014-11-07 21:45 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-12-10 08:09 - 2014-10-02 21:12 - 02020352 _____ (Microsoft Corporation) C:\Windows\system32\WsmSvc.dll 2014-12-10 08:09 - 2014-10-02 21:12 - 00346624 _____ (Microsoft Corporation) C:\Windows\system32\WSManMigrationPlugin.dll 2014-12-10 08:09 - 2014-10-02 21:12 - 00310272 _____ (Microsoft Corporation) C:\Windows\system32\WsmWmiPl.dll 2014-12-10 08:09 - 2014-10-02 21:12 - 00181248 _____ (Microsoft Corporation) C:\Windows\system32\WsmAuto.dll 2014-12-10 08:09 - 2014-10-02 21:11 - 00266240 _____ (Microsoft Corporation) C:\Windows\system32\WSManHTTPConfig.exe 2014-12-10 08:09 - 2014-10-02 20:45 - 01177088 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmSvc.dll 2014-12-10 08:09 - 2014-10-02 20:45 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManMigrationPlugin.dll 2014-12-10 08:09 - 2014-10-02 20:45 - 00214016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmWmiPl.dll 2014-12-10 08:09 - 2014-10-02 20:45 - 00145920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WsmAuto.dll 2014-12-10 08:09 - 2014-10-02 20:44 - 00198656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WSManHTTPConfig.exe 2014-12-09 11:43 - 2014-12-09 11:43 - 00000680 _____ () C:\Users\Mary Morgan\Downloads\30086-BS2-Code (1).zip 2014-12-09 11:42 - 2014-12-09 11:42 - 00000680 _____ () C:\Users\Mary Morgan\Downloads\30086-BS2-Code.zip 2014-12-04 12:57 - 2014-12-04 14:12 - 00000000 ____D () C:\Users\Mary Morgan\Documents\AutoCAD Sheet Sets 2014-12-02 16:44 - 2014-12-02 16:44 - 01444352 _____ () C:\Users\Mary Morgan\Downloads\Kinematics_final.ppt 2014-12-01 02:26 - 2014-12-01 02:32 - 00000000 ____D () C:\Users\Mary Morgan\Documents\all 2014-11-30 22:42 - 2014-11-30 22:42 - 00000000 ____D () C:\Program Files (x86)\AVG 2014-11-30 22:21 - 2014-12-01 01:43 - 00000000 ____D () C:\ProgramData\MFAData 2014-11-30 22:21 - 2014-11-30 22:21 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\MFAData 2014-11-29 19:32 - 2014-12-20 23:37 - 00000000 __SHD () C:\Program Files (x86)\Nyokurdize 2014-11-24 19:22 - 2014-11-24 19:22 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\Publish Providers 2014-11-24 19:02 - 2014-11-30 22:21 - 00007720 _____ () C:\Windows\system32\--traceoff 2014-11-24 19:02 - 2014-11-24 19:02 - 00000000 _____ () C:\Windows\system32\--debugoff 2014-11-24 18:59 - 2014-11-24 19:07 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\Sony 2014-11-24 18:56 - 2014-11-24 19:22 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\Sony 2014-11-24 18:22 - 2014-11-30 13:38 - 00000000 ____D () C:\Windows\System32\Tasks\NCH Software 2014-11-24 18:22 - 2014-11-24 18:22 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\NCH Software 2014-11-24 18:22 - 2014-11-24 18:22 - 00000000 ____D () C:\ProgramData\NCH Software 2014-11-23 01:35 - 2014-11-23 01:35 - 00000000 __SHD () C:\Users\Mary Morgan\AppData\Local\EmieBrowserModeList ==================== One Month Modified Files and Folders ======= (If an entry is included in the fixlist, the file\folder will be moved.) 2014-12-22 02:09 - 2010-06-07 19:35 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\Adobe 2014-12-22 02:08 - 2012-04-03 07:07 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-12-22 01:47 - 2012-03-26 14:38 - 00269251 _____ () C:\Windows\setupact.log 2014-12-22 01:19 - 2009-07-14 00:32 - 00000000 ____D () C:\Windows\addins 2014-12-22 01:13 - 2014-10-09 15:05 - 00000000 ____D () C:\Users\Mary Morgan\Documents\luxe 2014-12-21 23:25 - 2009-07-13 23:45 - 00026192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-12-21 23:25 - 2009-07-13 23:45 - 00026192 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-12-21 23:21 - 2012-03-26 14:40 - 01337365 _____ () C:\Windows\WindowsUpdate.log 2014-12-21 23:16 - 2009-07-14 00:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-12-21 17:17 - 2013-02-16 13:04 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update 2014-12-21 17:15 - 2012-07-11 09:33 - 00513468 _____ () C:\Windows\PFRO.log 2014-12-21 16:38 - 2011-11-05 17:48 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\CrashDumps 2014-12-19 23:13 - 2012-03-26 12:51 - 00000000 ____D () C:\ProgramData\Malwarebytes 2014-12-19 22:53 - 2012-09-18 02:41 - 00000000 ____D () C:\Program Files (x86)\Google 2014-12-19 22:52 - 2010-04-19 18:50 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\Deployment 2014-12-19 22:24 - 2013-07-08 14:25 - 00029174 _____ () C:\Windows\DPINST.LOG 2014-12-19 19:57 - 2010-04-19 18:50 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\Google 2014-12-19 12:57 - 2010-04-19 18:49 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\Adobe 2014-12-19 11:35 - 2011-12-17 17:21 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-12-19 11:35 - 2010-07-07 20:46 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-12-12 01:03 - 2014-04-23 19:55 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk 2014-12-12 00:52 - 2014-05-19 17:17 - 00000000 ___SD () C:\Windows\system32\CompatTel 2014-12-12 00:52 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-12-12 00:52 - 2009-07-13 22:20 - 00000000 ____D () C:\Windows\AppCompat 2014-12-11 09:42 - 2009-10-30 21:57 - 00000000 ____D () C:\ProgramData\Microsoft Help 2014-12-11 09:39 - 2013-08-15 08:04 - 00000000 ____D () C:\Windows\system32\MRT 2014-12-11 09:15 - 2011-11-15 22:42 - 112710672 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe 2014-12-10 11:08 - 2013-06-18 14:58 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Local\cache 2014-12-10 11:08 - 2012-04-03 07:07 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-12-10 11:08 - 2012-04-03 07:07 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-12-10 11:08 - 2011-11-06 18:32 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-12-04 09:48 - 2010-04-20 06:42 - 00000000 ____D () C:\Users\Mary Morgan 2014-12-03 23:16 - 2013-06-12 12:50 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\Autodesk 2014-12-03 23:16 - 2013-06-12 12:50 - 00000000 ____D () C:\ProgramData\Autodesk 2014-11-26 16:03 - 2014-11-10 01:52 - 00000000 ____D () C:\Users\Mary Morgan\Documents\robotic 2014-11-24 18:24 - 2013-06-27 22:25 - 00000000 ____D () C:\Users\Mary Morgan\AppData\Roaming\muvee Technologies 2014-11-24 14:04 - 2010-06-26 09:08 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe Files to move or delete: ==================== C:\ProgramData\uninstaller.exe Some content of TEMP: ==================== C:\Users\Mary Morgan\AppData\Local\Temp\AAMHelper.exe C:\Users\Mary Morgan\AppData\Local\Temp\AcDeltree.exe C:\Users\Mary Morgan\AppData\Local\Temp\AdbeRdr1012_en_US.exe C:\Users\Mary Morgan\AppData\Local\Temp\ApnStub.exe C:\Users\Mary Morgan\AppData\Local\Temp\BackupSetup.exe C:\Users\Mary Morgan\AppData\Local\Temp\Extract.exe C:\Users\Mary Morgan\AppData\Local\Temp\FlashPlayerUpdate.exe C:\Users\Mary Morgan\AppData\Local\Temp\FlashPlayerUpdate01.exe C:\Users\Mary Morgan\AppData\Local\Temp\fsprod.dll C:\Users\Mary Morgan\AppData\Local\Temp\fssfm.dll C:\Users\Mary Morgan\AppData\Local\Temp\GenericUninstall.exe C:\Users\Mary Morgan\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe C:\Users\Mary Morgan\AppData\Local\Temp\gtbcheck.exe C:\Users\Mary Morgan\AppData\Local\Temp\GURBF48.exe C:\Users\Mary Morgan\AppData\Local\Temp\GURD2C8.exe C:\Users\Mary Morgan\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Mary Morgan\AppData\Local\Temp\HPQSi.exe C:\Users\Mary Morgan\AppData\Local\Temp\hsbing_717_active.exe C:\Users\Mary Morgan\AppData\Local\Temp\htmlayout.dll C:\Users\Mary Morgan\AppData\Local\Temp\i2iup1w4.dll C:\Users\Mary Morgan\AppData\Local\Temp\install_flashplayer11x32axau_gtba_chra_dy_aaa_aih.exe C:\Users\Mary Morgan\AppData\Local\Temp\install_flash_player.exe C:\Users\Mary Morgan\AppData\Local\Temp\jna1401191956681244069.dll C:\Users\Mary Morgan\AppData\Local\Temp\jna2364191691446776988.dll C:\Users\Mary Morgan\AppData\Local\Temp\jna3124277654735573921.dll C:\Users\Mary Morgan\AppData\Local\Temp\jna4431772785725460415.dll C:\Users\Mary Morgan\AppData\Local\Temp\jna4526163516091062593.dll C:\Users\Mary Morgan\AppData\Local\Temp\jna5547968474558266161.dll C:\Users\Mary Morgan\AppData\Local\Temp\jna6274173929784156034.dll C:\Users\Mary Morgan\AppData\Local\Temp\jna8800888306638551426.dll C:\Users\Mary Morgan\AppData\Local\Temp\jna9130479762195970403.dll C:\Users\Mary Morgan\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe C:\Users\Mary Morgan\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\Mary Morgan\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\Mary Morgan\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe C:\Users\Mary Morgan\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe C:\Users\Mary Morgan\AppData\Local\Temp\mgsqlite3.dll C:\Users\Mary Morgan\AppData\Local\Temp\mssinstaller.exe C:\Users\Mary Morgan\AppData\Local\Temp\ObronaBlockAds.exe C:\Users\Mary Morgan\AppData\Local\Temp\ohjk9akx.dll C:\Users\Mary Morgan\AppData\Local\Temp\preconfig.exe C:\Users\Mary Morgan\AppData\Local\Temp\Resource.exe C:\Users\Mary Morgan\AppData\Local\Temp\setup.exe C:\Users\Mary Morgan\AppData\Local\Temp\Shortcut_sweetpacks_dlcom_5312013.exe C:\Users\Mary Morgan\AppData\Local\Temp\SP47636.exe C:\Users\Mary Morgan\AppData\Local\Temp\sp48071.exe C:\Users\Mary Morgan\AppData\Local\Temp\SP48159.exe C:\Users\Mary Morgan\AppData\Local\Temp\SP48394.exe C:\Users\Mary Morgan\AppData\Local\Temp\SP48755.exe C:\Users\Mary Morgan\AppData\Local\Temp\SP48792.exe C:\Users\Mary Morgan\AppData\Local\Temp\SP49394.exe C:\Users\Mary Morgan\AppData\Local\Temp\sp50843.exe.exe C:\Users\Mary Morgan\AppData\Local\Temp\sp54373.exe C:\Users\Mary Morgan\AppData\Local\Temp\sp58915.exe C:\Users\Mary Morgan\AppData\Local\Temp\sp64126.exe C:\Users\Mary Morgan\AppData\Local\Temp\SpotifyUninstall.exe C:\Users\Mary Morgan\AppData\Local\Temp\Strongvault.exe C:\Users\Mary Morgan\AppData\Local\Temp\toolbar66603690.exe C:\Users\Mary Morgan\AppData\Local\Temp\uninst1.exe C:\Users\Mary Morgan\AppData\Local\Temp\uninstall67746054.exe C:\Users\Mary Morgan\AppData\Local\Temp\uninstall67759611.exe C:\Users\Mary Morgan\AppData\Local\Temp\uninstall67759705.exe C:\Users\Mary Morgan\AppData\Local\Temp\uninstall67759783.exe C:\Users\Mary Morgan\AppData\Local\Temp\uninstaller.exe C:\Users\Mary Morgan\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Mary Morgan\AppData\Local\Temp\UninstallHPTCA.exe C:\Users\Mary Morgan\AppData\Local\Temp\wmpfirefoxplugin.exe C:\Users\Mary Morgan\AppData\Local\Temp\WSSetup.exe C:\Users\Mary Morgan\AppData\Local\Temp\{E58C0B81-6D4B-4E51-90EE-4587B1AA3204}-24.0.1312.56_23.0.1271.97_chrome_updater.exe ==================== Bamital & volsnap Check ================= (There is no automatic fix for files that do not pass verification.) C:\Windows\System32\winlogon.exe => File is digitally signed C:\Windows\System32\wininit.exe => File is digitally signed C:\Windows\SysWOW64\wininit.exe => File is digitally signed C:\Windows\explorer.exe => File is digitally signed C:\Windows\SysWOW64\explorer.exe => File is digitally signed C:\Windows\System32\svchost.exe => File is digitally signed C:\Windows\SysWOW64\svchost.exe => File is digitally signed C:\Windows\System32\services.exe => File is digitally signed C:\Windows\System32\User32.dll => File is digitally signed C:\Windows\SysWOW64\User32.dll => File is digitally signed C:\Windows\System32\userinit.exe => File is digitally signed C:\Windows\SysWOW64\userinit.exe => File is digitally signed C:\Windows\System32\rpcss.dll => File is digitally signed C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed LastRegBack: 2014-09-18 23:58 ==================== End Of Log ============================ [/QUOTE]
Insert quotes…
Verification
Post reply
Top