Operating System
Windows 7
Infection date and initial symptoms
11/16/2014. I was getting a lot of pop-ups and the Proxy error started.
Current issues and symptoms
Firefox is working ok, not as well as before, but not even able to use Google Crome or Internet Explorer. I have done all of the steps to reset or remove the proxy settings.
Steps taken in order to remove the infection
followed the steps on the proxy server is not responding blog http://malwaretips.com/blogs/the-proxy-server-isnt-responding-removal/#proxy. Still not resolved.

argus

Former MalwareTips Staff
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on
    icon and select
    Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
    Code:
    createsrpoint;
    Quickscan;
    autoclean;
    emptyalltemp;
    ipconfig /flushdns;b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.
 

Jason Bashaw

New Member
Here are the results from the zoek scan.


Zoek.exe v5.0.0.0 Updated 21-11-2014
Tool run by Bashaws on Fri 11/21/2014 at 13:05:19.75.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Bashaws\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-11-21-173733.log 425 bytes

==== System Restore Info ======================

11/21/2014 1:06:09 PM Zoek.exe System Restore Point Created Succesfully.

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{13453481-3F12-40A3-9EC4-435CF367C31B} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1ADF3594-2659-44A0-BA28-E3B273238AE7} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2209DFF1-ADA4-47D8-826C-32FDDD29019} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{223D32BC-1BD2-4885-BAE4-D77D6DBB126} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{239EEA5A-402E-4FC2-8C2A-61A6CE89C98} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{25045F98-C00C-4C4B-8F2B-2A700F3A277} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28258386-E7BB-4039-8DF3-F81F34D7A28E} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{282BDCBE-DB04-457A-87FD-E57FA7C25B0} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{2C6C59F1-7E0F-49BE-999A-2397BDB3B080} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{39DDDB08-2B82-4194-8BF7-3EC4494A3685} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3F53A99A-ADBE-4D13-8B9A-0C2D01A385} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{43519EC6-5DE4-48A9-9CBB-6A6E9D74BD10} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{45A7B4C-CEF4-4A2C-AEC4-05046AF16B} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{47D9421A-5DE3-4429-B173-7E2B5D9199A} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{47E556F0-9F4E-493F-A2D-F62E14BAB9B} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4A98F04A-F56D-4542-98D7-2DCEC08FABC2} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4B4E7C87-BD19-4DEB-BA14-51C344A165D4} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4D6C9E2E-E3CB-4667-8758-CD7A0C683C0} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{505DDA0-EB2B-4129-A794-743F2545A35A} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{52DE4212-D686-44DF-88B5-99B3B1FAC0} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59D7390C-1C0E-4A0B-9DE2-87862A813A2} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59F7C0A5-D69E-4B5D-89BE-16546C86738B} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5C0724FC-AAB4-4ED5-AFBA-DD6E23AAA62} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6096763C-1ED5-473A-AEF7-B7CE2843AA8C} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61518021-35C-4850-AED2-75A07FAB3DE6} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{61F72C97-9FA5-475D-B0D0-419016B69423} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{6947EA5A-5B7C-4A21-BC1A-C2C61878461C} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7144B94E-A09A-4B9B-8A8B-A16F27B3C926} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{73FBB0FA-3842-4844-9FF2-9120D968363} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{78B52456-5434-436C-83AB-1F693719D62C} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7A6D44D6-7A28-48DC-8BFE-BD4BCCCFC3F} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{81A05CA-7E2E-4698-B91B-DEBE65E8D37B} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{81FBF004-689-4A79-B0EA-FA44CA411091} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{838C4B8E-1274-4824-9CFC-4F3EABC7059} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{85036D24-C26-49D5-9A84-21B195AE58D7} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{861660C7-7034-4EE2-B84F-4EB1A55C3B23} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8A13DA1C-9B5F-44B9-84A8-C8DAD6E2C6CF} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{906CE1D9-B34F-444B-AC9E-D289E3190BC} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9118E574-8264-456F-A34B-AB8D68FE55B6} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{91BBB577-D03E-4692-9C7B-BAF2F876AC88} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9251423A-3FD0-4F38-98B0-1D17D7DE9E98} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{95E659FC-D7C1-4268-8C2-99526D6298A} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{993F75CC-11FD-4EEF-9C89-EEC4A35D851} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C094BCB-29DE-424D-87E1-31AFEA1F4B71} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B0952E42-BD32-4FEF-9012-4C2328EA714E} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B9488363-E6E0-47AA-8747-47E7FBECCA3F} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BDA5304C-C664-4B74-90AC-57498753A35} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C11D189E-377E-45EF-AA8C-3A25B1A5EF0} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C166490B-6A4A-4D97-BE18-1A5982FD736} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C39CCF92-E28D-4335-92B9-673F1A7045E6} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CDB2D16E-1EEC-4057-92D0-FEF2E874BEB} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D4584127-D59C-4BEC-B843-3E2B6D352E78} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D9E53A7B-4420-4697-A66A-AF8524CF7A73} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DB2138FA-890D-4E47-80BC-77A9F2F6C8C} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E5C2BEA9-C41B-46B5-BDE7-9E843B3EF38} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E63712E3-E731-4D57-9688-CE66AFA434} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6F70A95-1E64-43D9-A39B-FE9F6F3EE446} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E70D6BB1-50CB-4C44-A1FB-F7E6BE135D6C} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E9805106-3D5A-4632-8EBD-6A786050133A} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F8610344-569-469E-8EFF-F8D484D19091} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FA75188E-76C9-4905-8793-F222F5E44D4} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FC15FD82-D9D2-431C-8EA9-EFA1DE29CB33} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FCD79638-F8A5-459E-88C9-2D29C427B4A} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{FF88526F-1EB8-4FE6-AD63-E33248210} deleted successfully

==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Batch Command(s) Run By Tool======================


==== Deleting Files \ Folders ======================

C:\PROGRA~2\690b9ca4-a957-4b5e-89e9-2f3b2f5b0629 deleted
C:\LIL8EE6.tmp deleted
C:\LIL8F15.tmp deleted
C:\LIL8F34.tmp deleted
C:\LIL8F72.tmp deleted
C:\LIL8FD0.tmp deleted
C:\LIL8FE0.tmp deleted
C:\LIL8FE1.tmp deleted
C:\LIL906C.tmp deleted
C:\LIL908B.tmp deleted
C:\Users\Bashaws\AppData\Roaming\WB.CFG deleted
C:\Users\Bashaws\AppData\Roaming\AlawarEntertainment deleted
C:\Users\Bashaws\AppData\Roaming\YoudaGames deleted
C:\PROGRA~3\Avg_Update_0814tb deleted
C:\PROGRA~3\Avg_Update_1114tb deleted
C:\PROGRA~3\Kromtech deleted
C:\Users\Bashaws\AppData\Local\Kromtech deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Shopping and Services deleted
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk deleted
C:\windows\patsearch.bin deleted
C:\windows\sysWoW64\config\systemprofile\AppData\LocalLow\AVG SafeGuard toolbar deleted
C:\windows\tasks\AVG-Secure-Search-Update_0214b_rel.job deleted
C:\windows\tasks\AVG-Secure-Search-Update_0214b_rmv.job deleted
C:\windows\tasks\AVG-Secure-Search-Update_0414c_rel.job deleted
C:\windows\tasks\AVG-Secure-Search-Update_0414c_rmv.job deleted
C:\windows\SysNative\tasks\AVG-Secure-Search-Update_0214b_rel deleted
C:\windows\SysNative\tasks\AVG-Secure-Search-Update_0214b_rmv deleted
C:\windows\SysNative\tasks\AVG-Secure-Search-Update_0414c_rel deleted
C:\windows\SysNative\tasks\AVG-Secure-Search-Update_0414c_rmv deleted
C:\windows\SysNative\drivers\Msft_Kernel_webinstrT_01009.Wdf deleted
C:\windows\SysNative\config\systemprofile\Searches deleted
C:\windows\Syswow64\shoD3E1.tmp deleted
"C:\windows\Installer\1361c5.msi" deleted
"C:\Users\Bashaws\AppData\Roaming\APPKE" deleted
"C:\windows\tasks\APPKE.job" deleted
"C:\windows\SysNative\tasks\APPKE" deleted
"C:\Users\Bashaws\AppData\Roaming\BRQCBGD" deleted
"C:\windows\tasks\BRQCBGD.job" deleted
"C:\windows\SysNative\tasks\BRQCBGD" deleted
"C:\Users\Bashaws\AppData\Roaming\KS" deleted
"C:\windows\tasks\KS.job" deleted
"C:\windows\SysNative\tasks\KS" deleted
"C:\Users\Bashaws\AppData\Roaming\MOHDO" deleted
"C:\windows\tasks\MOHDO.job" deleted
"C:\windows\SysNative\tasks\MOHDO" deleted
"C:\Users\Bashaws\AppData\Roaming\MTIQ" deleted
"C:\windows\tasks\MTIQ.job" deleted
"C:\windows\SysNative\tasks\MTIQ" deleted
"C:\Users\Bashaws\AppData\Roaming\QCARYUG" deleted
"C:\windows\tasks\QCARYUG.job" deleted
"C:\windows\SysNative\tasks\QCARYUG" deleted
"C:\Users\Bashaws\AppData\Roaming\QYKA" deleted
"C:\windows\tasks\QYKA.job" deleted
"C:\windows\SysNative\tasks\QYKA" deleted
"C:\Users\Bashaws\AppData\Roaming\SWGXET" deleted
"C:\windows\tasks\SWGXET.job" deleted
"C:\windows\SysNative\tasks\SWGXET" deleted

==== Files Recently Created / Modified ======================

====== C:\windows ====
====== C:\Users\Bashaws\AppData\Local\Temp ====
2014-11-18 22:56:33 E0DC8C6BBC787B972A9A468648DBFD85 1008128 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\libiconv2.dll
2014-11-18 22:56:33 D202BAA425176287017FFE1FB5D1B77C 103424 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\libintl3.dll
2014-11-18 22:56:33 57CAC848FA14AE38F14F9441F8933282 140288 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\pcre3.dll
2014-11-18 22:56:33 547C43567AB8C08EB30F6C6BACB479A3 79360 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\regex2.dll
2014-11-18 22:56:32 2E0323A94915FAAB10A25F3BABF82584 157696 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
2014-11-18 00:45:42 C6D7703993FCC51A405E09B4B6085C8F 991040 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.31.4.510_0\APISupport\APISupport.dll
2014-11-18 00:45:40 67789261821FDAD768C21E7471C188EA 541504 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.31.4.510_0\plugins\ChromeApiPlugin.dll
2014-11-18 00:45:40 23C8F9C2CB81732A3207D197B9E9A4D4 1087296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe
2014-11-18 00:35:52 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-18 00:35:52 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-18 00:35:52 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-18 00:35:52 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-18 00:35:52 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-18 00:35:50 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-18 00:35:45 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-18 00:18:42 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{C759D2A6-42CE-4551-B3E5-D37A1FDD6C05}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-18 00:18:42 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{C759D2A6-42CE-4551-B3E5-D37A1FDD6C05}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-18 00:18:42 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{C759D2A6-42CE-4551-B3E5-D37A1FDD6C05}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-18 00:18:42 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{C759D2A6-42CE-4551-B3E5-D37A1FDD6C05}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-18 00:18:42 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{C759D2A6-42CE-4551-B3E5-D37A1FDD6C05}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-18 00:18:40 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{C759D2A6-42CE-4551-B3E5-D37A1FDD6C05}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-18 00:18:36 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{C759D2A6-42CE-4551-B3E5-D37A1FDD6C05}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-18 00:14:05 6006ADBF1CAE8AA3286140159B25C668 220264 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\~un0\u0.exe
2014-11-18 00:12:50 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite99056.dll
2014-11-18 00:09:38 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\scoped_dir_3152_28189\CRX_INSTALL\TBHostSupport\TBHostSupport.dll
2014-11-18 00:07:39 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite11279.dll
2014-11-17 19:44:39 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9CD467B8-FE78-415C-9525-AA429389F8E1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 19:44:39 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9CD467B8-FE78-415C-9525-AA429389F8E1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 19:44:39 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9CD467B8-FE78-415C-9525-AA429389F8E1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 19:44:39 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9CD467B8-FE78-415C-9525-AA429389F8E1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 19:44:39 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9CD467B8-FE78-415C-9525-AA429389F8E1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 19:44:35 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9CD467B8-FE78-415C-9525-AA429389F8E1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 19:44:28 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9CD467B8-FE78-415C-9525-AA429389F8E1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 19:43:59 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{3C5F7622-8321-4A7D-88AF-0F09F624B656}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 19:43:59 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{3C5F7622-8321-4A7D-88AF-0F09F624B656}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 19:43:59 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{3C5F7622-8321-4A7D-88AF-0F09F624B656}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 19:43:59 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{3C5F7622-8321-4A7D-88AF-0F09F624B656}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 19:43:59 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{3C5F7622-8321-4A7D-88AF-0F09F624B656}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 19:43:55 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{3C5F7622-8321-4A7D-88AF-0F09F624B656}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 19:43:49 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{3C5F7622-8321-4A7D-88AF-0F09F624B656}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 19:36:01 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{2A2AA28A-394C-474B-AFCC-C750C22C5853}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 19:35:59 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{2A2AA28A-394C-474B-AFCC-C750C22C5853}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 19:35:56 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{2A2AA28A-394C-474B-AFCC-C750C22C5853}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 19:35:56 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{2A2AA28A-394C-474B-AFCC-C750C22C5853}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 19:35:56 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{2A2AA28A-394C-474B-AFCC-C750C22C5853}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 19:35:37 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{2A2AA28A-394C-474B-AFCC-C750C22C5853}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 19:34:47 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{2A2AA28A-394C-474B-AFCC-C750C22C5853}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 19:33:26 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite81348.dll
2014-11-17 19:28:34 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{5706ECE5-4C61-44EB-A98A-748FBE624894}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 19:28:34 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{5706ECE5-4C61-44EB-A98A-748FBE624894}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 19:28:34 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{5706ECE5-4C61-44EB-A98A-748FBE624894}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 19:28:34 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{5706ECE5-4C61-44EB-A98A-748FBE624894}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 19:28:34 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{5706ECE5-4C61-44EB-A98A-748FBE624894}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 19:28:31 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{5706ECE5-4C61-44EB-A98A-748FBE624894}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 19:28:23 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{5706ECE5-4C61-44EB-A98A-748FBE624894}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 19:28:13 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite10671.dll
2014-11-17 05:51:39 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D382C18F-46F3-43D5-B0B9-A7F8C7AA4F4F}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 05:51:39 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D382C18F-46F3-43D5-B0B9-A7F8C7AA4F4F}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 05:51:39 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D382C18F-46F3-43D5-B0B9-A7F8C7AA4F4F}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 05:51:39 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D382C18F-46F3-43D5-B0B9-A7F8C7AA4F4F}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 05:51:39 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D382C18F-46F3-43D5-B0B9-A7F8C7AA4F4F}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:51:38 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D382C18F-46F3-43D5-B0B9-A7F8C7AA4F4F}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 05:51:29 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D382C18F-46F3-43D5-B0B9-A7F8C7AA4F4F}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 05:50:30 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{704F8793-DF68-4495-9CA9-DF80A1E48DF1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 05:50:30 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{704F8793-DF68-4495-9CA9-DF80A1E48DF1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:50:29 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{704F8793-DF68-4495-9CA9-DF80A1E48DF1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 05:50:29 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{704F8793-DF68-4495-9CA9-DF80A1E48DF1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 05:50:29 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{704F8793-DF68-4495-9CA9-DF80A1E48DF1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 05:50:26 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{704F8793-DF68-4495-9CA9-DF80A1E48DF1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 05:50:19 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{704F8793-DF68-4495-9CA9-DF80A1E48DF1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 05:49:44 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F7CD0422-1AF3-4F50-9B99-33E77BF6BD24}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 05:49:44 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F7CD0422-1AF3-4F50-9B99-33E77BF6BD24}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 05:49:44 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F7CD0422-1AF3-4F50-9B99-33E77BF6BD24}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 05:49:44 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F7CD0422-1AF3-4F50-9B99-33E77BF6BD24}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:49:43 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F7CD0422-1AF3-4F50-9B99-33E77BF6BD24}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 05:49:42 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F7CD0422-1AF3-4F50-9B99-33E77BF6BD24}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 05:49:37 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F7CD0422-1AF3-4F50-9B99-33E77BF6BD24}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 05:46:07 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F6C28DCE-B06D-468C-80D3-86CB23CE67E7}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:46:06 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F6C28DCE-B06D-468C-80D3-86CB23CE67E7}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 05:46:06 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F6C28DCE-B06D-468C-80D3-86CB23CE67E7}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 05:46:06 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F6C28DCE-B06D-468C-80D3-86CB23CE67E7}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 05:46:06 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F6C28DCE-B06D-468C-80D3-86CB23CE67E7}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 05:46:04 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F6C28DCE-B06D-468C-80D3-86CB23CE67E7}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 05:46:00 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F6C28DCE-B06D-468C-80D3-86CB23CE67E7}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 05:44:43 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E50B5CC3-96A7-4CA0-929E-DFCCCD8F40C6}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:44:42 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E50B5CC3-96A7-4CA0-929E-DFCCCD8F40C6}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 05:44:42 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E50B5CC3-96A7-4CA0-929E-DFCCCD8F40C6}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 05:44:42 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E50B5CC3-96A7-4CA0-929E-DFCCCD8F40C6}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 05:44:42 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E50B5CC3-96A7-4CA0-929E-DFCCCD8F40C6}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 05:44:41 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E50B5CC3-96A7-4CA0-929E-DFCCCD8F40C6}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 05:44:33 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E50B5CC3-96A7-4CA0-929E-DFCCCD8F40C6}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 05:41:31 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F0181803-A3A8-47A4-A8DD-4B007395957C}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:41:30 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F0181803-A3A8-47A4-A8DD-4B007395957C}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 05:41:30 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F0181803-A3A8-47A4-A8DD-4B007395957C}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 05:41:30 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F0181803-A3A8-47A4-A8DD-4B007395957C}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 05:41:30 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F0181803-A3A8-47A4-A8DD-4B007395957C}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 05:41:27 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F0181803-A3A8-47A4-A8DD-4B007395957C}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 05:41:17 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F0181803-A3A8-47A4-A8DD-4B007395957C}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 05:39:37 C6D7703993FCC51A405E09B4B6085C8F 991040 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.31.4.510_0\APISupport\APISupport.dll
2014-11-17 05:39:35 67789261821FDAD768C21E7471C188EA 541504 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.31.4.510_0\plugins\ChromeApiPlugin.dll
2014-11-17 05:39:35 23C8F9C2CB81732A3207D197B9E9A4D4 1087296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:33:00 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 05:33:00 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 05:33:00 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 05:33:00 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 05:33:00 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:32:55 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 05:32:47 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 05:04:40 181020AE3FC61205C1DA67BE131A1095 439296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\21686uninstall.exe
2014-11-17 04:33:49 C966B5062302D06A38D15564282088FB 287008 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D6E1527F-4144-45D0-9B1B-99F7FC050857}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\TBVerifier.dll
2014-11-17 04:33:49 C16C1C61498FD8271909DFD400538DE0 887584 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D6E1527F-4144-45D0-9B1B-99F7FC050857}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\ConduitChromeApiPlugin.dll
2014-11-17 04:33:49 9E037AE8A603C7C44582E3DD2C357E08 68896 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D6E1527F-4144-45D0-9B1B-99F7FC050857}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-cwmp.dll
2014-11-17 04:33:49 99F97C9FE748C37528C338A423577FCB 163256 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D6E1527F-4144-45D0-9B1B-99F7FC050857}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\plugins\np-mswmp.dll
2014-11-17 04:33:49 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D6E1527F-4144-45D0-9B1B-99F7FC050857}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 04:33:47 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D6E1527F-4144-45D0-9B1B-99F7FC050857}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 04:33:40 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D6E1527F-4144-45D0-9B1B-99F7FC050857}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\TBHostSupport\TBHostSupport.dll
2014-11-17 04:18:44 6B108C476F498CBDBBC83FF656EDA724 62240 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\scoped_dir_5296_12756\CRX_INSTALL\Search\plugins\npConduitNewTabPlugin.dll
2014-11-17 04:18:26 88AD8656CB1E1CD6AF8BC1B6D6174CC1 458016 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\scoped_dir_5296_12756\CRX_INSTALL\TBHostSupport\TBHostSupport.dll
2014-11-17 04:16:15 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite17462.dll
2014-11-17 03:58:46 E7CAED467F80B29F4E63BA493614DBB1 127488 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\OSProvider.dll
2014-11-17 03:58:46 CCF6EC908566900E9626DC3360B9E35E 112128 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\DismCorePS.dll
2014-11-17 03:58:46 A909643B215FC0587A043C9C15959D41 186368 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\DismProv.dll
2014-11-17 03:58:46 A7AFC7D5313C94E1060648609DAFCE64 271360 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\SmiProvider.dll
2014-11-17 03:58:46 A492B7C2C223C5C6163F45AA5275BE34 302080 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\UnattendProvider.dll
2014-11-17 03:58:46 85F83E44A77DEA06780FB670CC8A0359 438272 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\DmiProvider.dll
2014-11-17 03:58:46 7B38D7916A7CD058C16A0A6CA5077901 271360 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\wdscore.dll
2014-11-17 03:58:46 739968678548BA15F6B9372E8760C012 444416 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\TransmogProvider.dll
2014-11-17 03:58:46 711325BFDAC759FA69B9EDAF7EA0319C 471040 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\WimProvider.dll
2014-11-17 03:58:46 64B66A41B61D511E8EBE94625EC0E45A 53760 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\FolderProvider.dll
2014-11-17 03:58:46 516A5FCE06BB388499238A5F9286CB74 96768 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\DismHost.exe
2014-11-17 03:58:46 45FF4FA5CA5432BFCCDED4433FE2A85B 216576 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\MsiProvider.dll
2014-11-17 03:58:46 08C71F57BDFC3DF75A51B12DDF69A33B 312832 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\IntlProvider.dll
2014-11-17 03:58:45 78B4D1F2FE371A6E85C66DD3D40D404A 183296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\CompatProvider.dll
2014-11-17 03:58:45 6EBC2138A3C9B3B7D1E69E0629B6C815 289792 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\DismCore.dll
2014-11-17 03:58:45 1C9B5D23AC0CD2E6BF4B29F35FE219AE 1672192 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\CbsProvider.dll
2014-11-17 03:47:19 144A9AA1A785234E820D44A0D2B6423D 7820568 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\supoptsetup.exe
2014-11-17 03:46:57 13EDA298A0CCB68AF5ADB06EFAFB7BAC 3369792 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\156Btmp\silentsddsetup.exe
2014-11-17 03:46:57 13EDA298A0CCB68AF5ADB06EFAFB7BAC 3369792 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\14C0tmp\silentsddsetup.exe
2014-11-17 03:46:38 C732B52B245444E3F568D372CE399911 1037015 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\154Btmp\cloudscout.exe
2014-11-17 03:46:34 18457FC029B26A8E7626D3D4E7755270 88064 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\B7D701F0-473C-CE46-91F8-E5C522D8F595.dll
2014-11-17 03:46:32 C732B52B245444E3F568D372CE399911 1037015 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\14AEtmp\cloudscout.exe
2014-11-17 03:46:24 C61471B6987FEE827E7ED61FDAFE744C 3920757 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\1508tmp\5555-1001_newplayer.exe
2014-11-17 03:46:19 C61471B6987FEE827E7ED61FDAFE744C 3920757 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\147Btmp\5555-1001_newplayer.exe
2014-11-17 03:46:19 C27E418EE71E218F5944FAB069C7A233 2203422 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\14A8tmp\jfilemanagersetup.exe
2014-11-17 03:46:19 C27E418EE71E218F5944FAB069C7A233 2203422 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\144Btmp\jfilemanagersetup.exe
2014-11-17 03:46:19 353CDBE393E56EA46542064FA2B0F3AE 8533520 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\1518tmp\superoptimizersetup.exe
2014-11-17 03:46:19 353CDBE393E56EA46542064FA2B0F3AE 8533520 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\148Dtmp\superoptimizersetup.exe
2014-11-17 03:39:44 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite81476.dll
2014-11-17 03:31:16 181020AE3FC61205C1DA67BE131A1095 439296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\12895uninstall.exe
2014-11-17 03:24:27 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite52508.dll
2014-11-17 03:12:26 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite43229.dll
2014-11-17 03:01:26 C27E418EE71E218F5944FAB069C7A233 2203422 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\12C5tmp\jfilemanagersetup.exe
2014-11-17 03:01:24 C732B52B245444E3F568D372CE399911 1037015 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\12C8tmp\cloudscout.exe
2014-11-17 02:19:24 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite18223.dll
2014-11-17 01:33:48 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite61843.dll
2014-11-17 01:25:06 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite80082.dll
2014-11-17 01:22:15 F1E994BD5C745F5403098727B3684273 2129408 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\RarSFX0\curl.exe
2014-11-17 01:20:51 DD7F24DACD85EEDD221A55313E97DA10 5826632 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\optprosetup.exe
2014-11-17 01:19:57 006CC8260405E231C2006A0CEA2127FD 1053184 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\System.Data.SQLite.dll
2014-11-16 13:18:10 3EAE59EEFFEC1E7699185DEF6C4105B5 175123 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\is45637729\1879879_stp\Generic_vo.exe
2014-11-08 08:47:13 5C73E64374D9BA37AC5569D1F7DE5C9B 665682 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\sqlite3.dll
2014-11-08 08:33:34 7AAB90847C56E6F7E922BB29D5B3EA8A 601088 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\Quarantine.exe
====== Java Cache =====
====== C:\windows\SysWOW64 =====
2014-11-18 21:47:52 ADFB31FA72AFE0298A60BF4AC1045A42 550912 ----a-w- C:\windows\SysWOW64\kerberos.dll
2014-11-18 21:47:52 98B3C919C6B9C5F810FF2CAFA339822B 186880 ----a-w- C:\windows\SysWOW64\pku2u.dll
2014-11-17 04:16:25 B6F002B6776D5E658F95830BE910788F 552 ----a-w- C:\windows\SysWOW64\schtasks.bin
2014-11-12 01:33:14 9AB39ADD28C7C1A685B1EA8C6A25CF08 146432 ----a-w- C:\windows\SysWOW64\msaudite.dll
2014-11-12 01:33:14 980EEEE8815DA7593708774D1225BD35 681984 ----a-w- C:\windows\SysWOW64\adtschema.dll
2014-11-12 01:33:13 9216ABFD53F5EC1F35C3554AD1A175DE 22016 ----a-w- C:\windows\SysWOW64\secur32.dll
2014-11-12 01:33:13 13E5B1CD503A4B21E9F0A2D55A00198B 96768 ----a-w- C:\windows\SysWOW64\sspicli.dll
2014-11-12 01:33:10 B6273619A3DF28F03B64E911E45A6AB2 30720 ----a-w- C:\windows\SysWOW64\iernonce.dll
2014-11-12 01:33:10 5D5640C34C4A97467F77489DBB157568 47616 ----a-w- C:\windows\SysWOW64\ieetwproxystub.dll
2014-11-12 01:33:09 FB56C76FEA44693752BD99D7D9930ABA 341168 ----a-w- C:\windows\SysWOW64\iedkcs32.dll
2014-11-12 01:33:09 A6E51BDCB8F4B84E874F918F0452763D 76288 ----a-w- C:\windows\SysWOW64\mshtmled.dll
2014-11-12 01:33:08 93074C4FA92A8399404D032F6AF72C1B 19781632 ----a-w- C:\windows\SysWOW64\mshtml.dll
2014-11-12 01:33:08 843BD9DAF03ABB6761DEE6D155301F28 60416 ----a-w- C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-12 01:33:08 66F4FFDBCD501260ABC198317D2B0D10 285696 ----a-w- C:\windows\SysWOW64\dxtrans.dll
2014-11-12 01:33:08 4772DB007FFBD4BBE3F526704BCA67FE 1310208 ----a-w- C:\windows\SysWOW64\urlmon.dll
2014-11-12 01:33:08 26EE6C9780A8FC872C60F9E35D7EBD4B 688640 ----a-w- C:\windows\SysWOW64\msfeeds.dll
2014-11-12 01:33:07 5972510EF1C6097D9C14C17387A5EDB2 2724864 ----a-w- C:\windows\SysWOW64\mshtml.tlb
2014-11-12 01:33:07 19D68FDEE62519C5A0387EB4E88A01EF 62464 ----a-w- C:\windows\SysWOW64\iesetup.dll
2014-11-12 01:33:06 FA310BD4A5DE904445DDDE54C5A654F2 2277376 ----a-w- C:\windows\SysWOW64\iertutil.dll
2014-11-12 01:33:06 7748B3DDDC92C7FC11F7462DB872E8E7 2051072 ----a-w- C:\windows\SysWOW64\inetcpl.cpl
2014-11-12 01:33:06 5E01004CBC35A78FE2AB4016CCAD4760 708096 ----a-w- C:\windows\SysWOW64\ieapfltr.dll
2014-11-12 01:33:05 A1A2EE55A2C69F79AED00973E604B9C4 418304 ----a-w- C:\windows\SysWOW64\dxtmsft.dll
2014-11-12 01:33:05 8A46404AC1AEB22AA2D4C906D0FC86C2 620032 ----a-w- C:\windows\SysWOW64\jscript9diag.dll
2014-11-12 01:33:05 8585BC27224F97458C186AA085B754A7 478208 ----a-w- C:\windows\SysWOW64\ieui.dll
2014-11-12 01:33:05 6DDC0F44A70976C492CB1666BA9A7912 47104 ----a-w- C:\windows\SysWOW64\jsproxy.dll
2014-11-12 01:33:05 4F8CD74CD69A94ED1A5D7E837A356F4E 115712 ----a-w- C:\windows\SysWOW64\ieUnatt.exe
2014-11-12 01:33:04 36EE0A2A981617610F921BCBB997DB06 12819456 ----a-w- C:\windows\SysWOW64\ieframe.dll
2014-11-12 01:33:02 AE39939F1E25401B9A4952A7A8D372AC 4298240 ----a-w- C:\windows\SysWOW64\jscript9.dll
2014-11-12 01:33:02 4169C6A6613856D69224498620F0C2B5 1155072 ----a-w- C:\windows\SysWOW64\mshtmlmedia.dll
2014-11-12 01:33:01 9ED3132B7F0D36FA9911721E8B2CB968 501248 ----a-w- C:\windows\SysWOW64\vbscript.dll
2014-11-12 01:33:01 755D0A90CFC4BCB178D7070B0351F0AE 64000 ----a-w- C:\windows\SysWOW64\MshtmlDac.dll
2014-11-12 01:33:01 6DD7D61A8EF3DFEC4FAEFEB395E77424 1892864 ----a-w- C:\windows\SysWOW64\wininet.dll
2014-11-12 01:33:01 139E85C4E5DF322AE1BF6544D8C32B0A 168960 ----a-w- C:\windows\SysWOW64\msrating.dll
2014-11-12 01:32:03 537184E7306E06BB22C5B93D2AFA4DF8 1237504 ----a-w- C:\windows\SysWOW64\msxml3.dll
2014-11-12 01:32:03 09FA271EE1F9AD68B2D1C1C210F4B71F 2048 ----a-w- C:\windows\SysWOW64\msxml3r.dll
2014-11-12 01:32:02 5FDBDEECA34E73325D87C5ACD16A3EEC 701440 ----a-w- C:\windows\SysWOW64\IMJP10K.DLL
2014-11-12 01:32:01 FD79B005E849DF3D7E9B5EB7A637C528 374784 ----a-w- C:\windows\SysWOW64\AudioEng.dll
2014-11-12 01:32:01 8D338464B851DDD76E2B876A3E09EB70 442880 ----a-w- C:\windows\SysWOW64\AUDIOKSE.dll
2014-11-12 01:32:00 AA7325057A1E1CC401798C0B1238E182 195584 ----a-w- C:\windows\SysWOW64\AudioSes.dll
2014-11-12 01:31:51 8FE6AB488ECDC60930CE973A7051B0D4 221184 ----a-w- C:\windows\SysWOW64\ncrypt.dll
2014-11-12 01:31:51 8CFAEFCD7F1E004950FCAE870A501B3E 248832 ----a-w- C:\windows\SysWOW64\schannel.dll
2014-11-12 01:31:50 B580A6B9932669DE703001AEE66D5BB1 259584 ----a-w- C:\windows\SysWOW64\msv1_0.dll
2014-11-12 01:31:50 9CEA80FFC617E6B6DD7B52E6225C0D38 65536 ----a-w- C:\windows\SysWOW64\TSpkg.dll
2014-11-12 01:31:50 37BC079204BF9B087D6DE6B728908B4B 172032 ----a-w- C:\windows\SysWOW64\wdigest.dll
2014-11-12 01:31:49 8205E55DFB11809E5F2AAD1C48840535 17408 ----a-w- C:\windows\SysWOW64\credssp.dll
2014-11-12 01:31:39 0F39AC3274312EFFD03928291E8BA7CA 67584 ----a-w- C:\windows\SysWOW64\packager.dll
2014-11-12 01:31:33 CB55B9AAB060C803BE4AD229AA0FEC28 2363904 ----a-w- C:\windows\SysWOW64\msi.dll
2014-11-12 01:31:29 EDA54D2E17C0271D2CDA946ABE344110 571904 ----a-w- C:\windows\SysWOW64\oleaut32.dll
====== C:\windows\SysWOW64\drivers =====
====== C:\windows\Sysnative =====
2014-11-18 23:27:42 3C7F8E8398024D005886C764E28610EB 54016 ----a-w- C:\windows\Sysnative\.crusader
2014-11-18 21:47:52 8A8CB073A4B9F9D97CFA8CA9C1C851CE 728064 ----a-w- C:\windows\Sysnative\kerberos.dll
2014-11-18 21:47:52 1306E6A1BF4D506CD687DF9F947270F2 241152 ----a-w- C:\windows\Sysnative\pku2u.dll
2014-11-12 01:33:18 F992AAE3F2DF1D7D2A75B681B0C5280E 304640 ----a-w- C:\windows\Sysnative\generaltel.dll
2014-11-12 01:33:17 9F1FA4F36406693C77CC5779AA7E532D 228864 ----a-w- C:\windows\Sysnative\aepdu.dll
2014-11-12 01:33:17 6021CF6A11DE9B5FC1BD210B6855C497 424448 ----a-w- C:\windows\Sysnative\aeinv.dll
2014-11-12 01:33:14 C4C1B73FC2FF151BA08E1EAFDE2A2FAF 1460736 ----a-w- C:\windows\Sysnative\lsasrv.dll
2014-11-12 01:33:14 58F87BF5659C8EBC61EB439C916F2F9A 681984 ----a-w- C:\windows\Sysnative\adtschema.dll
2014-11-12 01:33:14 008CD4EBFABCF78D0F19B3778492648C 683520 ----a-w- C:\windows\Sysnative\termsrv.dll
2014-11-12 01:33:13 7184AEACDA13E64B10F84E9DD79C8A01 146432 ----a-w- C:\windows\Sysnative\msaudite.dll
2014-11-12 01:33:09 854B230F5D77486B67D809FFB8A10C7E 2724864 ----a-w- C:\windows\Sysnative\mshtml.tlb
2014-11-12 01:33:09 7293701905DF1F40760C851F20DDC9EC 114688 ----a-w- C:\windows\Sysnative\ieetwcollector.exe
2014-11-12 01:33:09 4E47ABA3C6C5032446A2AF7EFD026037 716800 ----a-w- C:\windows\Sysnative\ie4uinit.exe
2014-11-12 01:33:09 26BC4EC95E363DD59171710E22108F15 34304 ----a-w- C:\windows\Sysnative\iernonce.dll
2014-11-12 01:33:09 1F3794CE1AEA5DA12ACF90210EAE4ECB 48640 ----a-w- C:\windows\Sysnative\ieetwproxystub.dll
2014-11-12 01:33:08 33098C85B789630865CD3F5D22FB0DFC 77824 ----a-w- C:\windows\Sysnative\JavaScriptCollectionAgent.dll
2014-11-12 01:33:06 56651A76C63DAF2C593F1F767FC8A856 1550336 ----a-w- C:\windows\Sysnative\urlmon.dll
2014-11-12 01:33:06 1C216980E7D21100A357B52B3C45F78D 388272 ----a-w- C:\windows\Sysnative\iedkcs32.dll
2014-11-12 01:33:05 E17C34BECCD1388E9B386A9F82F01222 4096 ----a-w- C:\windows\Sysnative\ieetwcollectorres.dll
2014-11-12 01:33:05 C6A719FD0B07B2DD0ADACD07636F4BAD 968704 ----a-w- C:\windows\Sysnative\MsSpellCheckingFacility.exe
2014-11-12 01:33:05 2A1A7F17C906941334C6A67E935F214B 316928 ----a-w- C:\windows\Sysnative\dxtrans.dll
2014-11-12 01:33:05 1E30BECF0DB35481588FB72C9CF97CA2 800768 ----a-w- C:\windows\Sysnative\msfeeds.dll
2014-11-12 01:33:04 BD708EBEDB35E474F1A19747154ACC47 799232 ----a-w- C:\windows\Sysnative\ieapfltr.dll
2014-11-12 01:33:04 6507CA9349500A535AF70670F248E525 66560 ----a-w- C:\windows\Sysnative\iesetup.dll
2014-11-12 01:33:03 5C9D58591D0091630452B04F35527240 2124288 ----a-w- C:\windows\Sysnative\inetcpl.cpl
2014-11-12 01:33:02 BA4EC6139B8830BBA9CC5D065CA5796C 2884096 ----a-w- C:\windows\Sysnative\iertutil.dll
2014-11-12 01:33:01 31F2A5ECFD2C75F970A3007ACD5627C7 54784 ----a-w- C:\windows\Sysnative\jsproxy.dll
2014-11-12 01:33:01 08BCDD6C9E23D00309F359620461DFE8 144384 ----a-w- C:\windows\Sysnative\ieUnatt.exe
2014-11-12 01:33:00 7EE5FBD190BF5B27F7977EA6CBF0DCAC 92160 ----a-w- C:\windows\Sysnative\mshtmled.dll
2014-11-12 01:33:00 69602F6259598A7837CB83D3608FE293 633856 ----a-w- C:\windows\Sysnative\ieui.dll
2014-11-12 01:33:00 277A4735954F1BF29EE3D138A5251BFE 490496 ----a-w- C:\windows\Sysnative\dxtmsft.dll
2014-11-12 01:33:00 154B8555A118BCFD95F358390E418B00 14390272 ----a-w- C:\windows\Sysnative\ieframe.dll
2014-11-12 01:32:59 F208D7FB40FD80EA9F123BABF687359C 6040064 ----a-w- C:\windows\Sysnative\jscript9.dll
2014-11-12 01:32:59 B6DC4597FF946B0C8B29650A71F52D4E 580096 ----a-w- C:\windows\Sysnative\vbscript.dll
2014-11-12 01:32:59 98088A13F65BE35DA3693F264740CEEC 1359360 ----a-w- C:\windows\Sysnative\mshtmlmedia.dll
2014-11-12 01:32:59 7EC80DB959695D4F927D2D601DA59F35 814080 ----a-w- C:\windows\Sysnative\jscript9diag.dll
2014-11-12 01:32:59 6FC2819A4F80AAB2DADEDFC1EFEE3C3F 2365440 ----a-w- C:\windows\Sysnative\wininet.dll
2014-11-12 01:32:58 EE3592B010E3F69D141323E592C01A1A 199680 ----a-w- C:\windows\Sysnative\msrating.dll
2014-11-12 01:32:58 4B6D9AB2ECD11AF5F6B1C42D938E0A85 88064 ----a-w- C:\windows\Sysnative\MshtmlDac.dll
2014-11-12 01:32:57 BBD6A636AAA65D874F3863280CD8373D 25110016 ----a-w- C:\windows\Sysnative\mshtml.dll
2014-11-12 01:32:03 D005697F0467BBDDAB7638496DA5DB52 2048 ----a-w- C:\windows\Sysnative\msxml3r.dll
2014-11-12 01:32:03 364ECFF4ABD9D575F4F7CF7EB7928EF3 1882624 ----a-w- C:\windows\Sysnative\msxml3.dll
2014-11-12 01:32:03 1FEBD408F32DFC523882E7DA5AC57819 878080 ----a-w- C:\windows\Sysnative\IMJP10K.DLL
2014-11-12 01:32:01 FAFCB80D42A65964B6F4945283B8C10F 296448 ----a-w- C:\windows\Sysnative\AudioSes.dll
2014-11-12 01:32:01 DE3E38431B00C2EA247C53675DCF01A0 680960 ----a-w- C:\windows\Sysnative\audiosrv.dll
2014-11-12 01:32:01 B1BB7B91C3C878FDB2874138CE81C4EF 284672 ----a-w- C:\windows\Sysnative\EncDump.dll
2014-11-12 01:32:01 A2C9E45F4069A002E985D1563D16813B 440832 ----a-w- C:\windows\Sysnative\AudioEng.dll
2014-11-12 01:32:01 9383B21A4B77C130940262DDC5F3F49B 500224 ----a-w- C:\windows\Sysnative\AUDIOKSE.dll
2014-11-12 01:31:51 A71B81AC2C14ABA013CCF1225D9E3E36 342016 ----a-w- C:\windows\Sysnative\schannel.dll
2014-11-12 01:31:51 109CC0DF72CC07A6CB59D2995255A1DA 309760 ----a-w- C:\windows\Sysnative\ncrypt.dll
2014-11-12 01:31:50 DF30FC54FFF79BC744B22A4850A3CF92 86528 ----a-w- C:\windows\Sysnative\TSpkg.dll
2014-11-12 01:31:50 55F0CF40479A1FC89CFA578909A540F2 210944 ----a-w- C:\windows\Sysnative\wdigest.dll
2014-11-12 01:31:50 47C48C705F4F1EFC99B50B43AE4301FE 314880 ----a-w- C:\windows\Sysnative\msv1_0.dll
2014-11-12 01:31:49 336BA030AB7B05300CB0B5C6AFB27176 22016 ----a-w- C:\windows\Sysnative\credssp.dll
2014-11-12 01:31:39 93C055B6AAD76360A60CB7E59A491531 3198976 ----a-w- C:\windows\Sysnative\win32k.sys
2014-11-12 01:31:39 934735F508E297504460935B71E99F0B 77824 ----a-w- C:\windows\Sysnative\packager.dll
2014-11-12 01:31:33 2720C94ADCC1727A66365CCB1CE456C4 3241984 ----a-w- C:\windows\Sysnative\msi.dll
2014-11-12 01:31:29 B938AF16A521C913791C6F7AFF032757 861696 ----a-w- C:\windows\Sysnative\oleaut32.dll
====== C:\windows\Sysnative\drivers =====
2014-11-12 01:33:14 41774FF331F609EF442B7398EE6202B1 155064 ----a-w- C:\windows\Sysnative\drivers\ksecpkg.sys
====== C:\windows\Tasks ======
2014-11-17 19:34:58 30BE14EECB6AA4093ECC81C543D15104 3322 ----a-w- C:\windows\Sysnative\Tasks\SuperFastPC_AutorunOnStartup
2014-11-17 05:44:44 3E7C7B9F299DEC4581D6794500B8D468 3110 ----a-w- C:\windows\Sysnative\Tasks\{EE798A9B-0592-4486-A96B-51EFD6F03341}
====== C:\windows\Temp ======
======= C:\Program Files =====
2014-11-18 23:10:55 -------- d-----w- C:\Program Files\HitmanPro
2014-11-17 04:00:01 -------- d-----w- C:\Program Files\COMODO
2014-10-25 01:30:14 -------- d-----w- C:\Program Files\Common Files\Wolfram Research
2014-10-25 01:30:13 -------- d-----w- C:\Program Files\Extras
======= C:\PROGRA~2 =====
2014-10-25 01:30:14 -------- d-----w- C:\PROGRA~2\COMMON~1\Wolfram Research
2014-10-25 01:30:13 -------- d-----w- C:\PROGRA~2\COMMON~1\ResearchSoft
2014-10-25 01:28:38 -------- d-----w- C:\PROGRA~2\Wolfram Research
2014-10-23 22:38:58 -------- d-----w- C:\PROGRA~2\QuickTime
======= C: =====
====== C:\Users\Bashaws\AppData\Roaming ======
2014-11-17 19:34:55 -------- d-----w- C:\Users\Bashaws\AppData\Roaming\1H1Q1V0B1L1G1N1V0M1P1Q1L1T0D1P1E2Z
2014-11-17 03:56:26 -------- d-----w- C:\Users\Bashaws\AppData\Local\33C1FBAC-DF5D-9DDB-AE00-000000B100
2014-11-17 03:03:45 FDCFDA1949FC3D2CE13A8F4F4018BDF8 7 ----a-w- C:\Users\Bashaws\AppData\Roaming\handle.txt
2014-11-17 01:29:57 -------- d-sh--w- C:\Users\Bashaws\AppData\Locallow\EmieBrowserModeList
2014-11-17 01:28:48 -------- d-sh--w- C:\Users\Bashaws\AppData\Local\EmieBrowserModeList
2014-11-17 01:22:54 -------- d-----w- C:\windows\sysWoW64\config\systemprofile\AppData\Locallow\Sun
2014-11-17 01:22:13 -------- d-----w- C:\Users\Bashaws\AppData\Local\IsolatedStorage
2014-10-25 01:31:12 -------- d-----w- C:\Users\Bashaws\AppData\Roaming\MathematicaPlayer
2014-10-25 01:31:12 -------- d-----w- C:\Users\Bashaws\AppData\Local\MathematicaPlayer
====== C:\Users\Bashaws ======
2014-11-21 00:59:54 0CCA673D5DDB45871D05F6A733059E56 1055936 ----a-w- C:\Users\Bashaws\Downloads\install_flashplayer15x32_mssa_aaa_aih(1).exe
2014-11-18 23:10:55 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-11-18 23:10:06 -------- d-----w- C:\ProgramData\HitmanPro
2014-11-18 23:09:18 00FD7C6BEDEE9B24B0DB02B68B07AD54 11222744 ----a-w- C:\Users\Bashaws\Downloads\HitmanPro_x64.exe
2014-11-18 22:56:16 8573E3C2603DD23E1A8DE3177D146D18 1707532 ----a-w- C:\Users\Bashaws\Downloads\JRT.exe
2014-11-18 22:46:49 6504113C2218667814D4F54847BA046A 2140160 ----a-w- C:\Users\Bashaws\Downloads\adwcleaner_4.101.exe
2014-11-18 22:44:53 1747A50E01D0FDB324F9F50E025FDB66 401920 ----a-w- C:\Users\Bashaws\Downloads\MiniToolBox.exe
2014-11-18 21:54:47 0CCA673D5DDB45871D05F6A733059E56 1055936 ----a-w- C:\Users\Bashaws\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe
2014-11-18 01:42:58 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-18 01:41:27 31AD2D566C369B00F0B07FAA6BAD7D87 880784 ----a-w- C:\Users\Bashaws\Downloads\ChromeSetup.exe
2014-11-18 01:25:00 33398D340008A0577507FCA7FD443622 19828376 ----a-w- C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025(2).exe
2014-11-18 01:24:18 33398D340008A0577507FCA7FD443622 19828376 ----a-w- C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025(1).exe
2014-11-18 01:23:38 33398D340008A0577507FCA7FD443622 19828376 ----a-w- C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-17 19:39:05 -------- d-----w- C:\ProgramData\Oracle
2014-11-17 19:35:16 -------- d-----w- C:\ProgramData\Unchecky
2014-11-17 19:34:16 6FA7457F23AB31E68A674E5342FE32BD 29405096 ----a-w- C:\Users\Bashaws\Downloads\JavaRuntimeEnvironmentSetup.exe
2014-11-17 19:32:43 554D11357450E8DC80888285273D05DA 860576 ----a-w- C:\Users\Bashaws\Downloads\JavaSetup.exe
2014-11-17 04:00:14 -------- d-----w- C:\ProgramData\COMODO
2014-11-17 03:59:04 5B915884D19C1B1DA6409C039E7235CD 42533968 ----a-w- C:\Users\Bashaws\Downloads\ChromeStandaloneSetup.exe
2014-11-17 03:51:30 9ADF09DA2F4A161B9DEC8B815D9FF0B6 844552 ----a-w- C:\Users\Bashaws\Downloads\chrome-setup (1).exe
2014-11-17 03:49:57 9ADF09DA2F4A161B9DEC8B815D9FF0B6 844552 ----a-w- C:\Users\Bashaws\Downloads\chrome-setup.exe
2014-11-17 03:49:55 -------- d--h--w- C:\Users\Public\Temp
2014-11-17 03:45:42 5C87C0D9B111108332B25F44745A6DD1 844560 ----a-w- C:\Users\Bashaws\Downloads\adobeflashplayer15betastandalone-setup (1).exe
2014-11-17 03:44:42 1D65D6F0E8BB6FD37E0B9333C60585B0 844560 ----a-w- C:\Users\Bashaws\Downloads\adobeflashplayer15betastandalone-setup.exe
2014-11-17 03:30:39 86A0A588328C6FC6CA83B66775779BFA 1238 ----a-w- C:\ProgramData\tempimage.bmp
2014-11-17 01:18:54 3A6371EF0FCC62BEF39BF94B43003C9D 399224 ----a-w- C:\Users\Bashaws\Downloads\Java_Setup (1).exe
2014-11-17 01:18:39 D2A286F8D08309D56905DF7B7F71EF26 399224 ----a-w- C:\Users\Bashaws\Downloads\Java_Setup.exe
2014-11-07 02:46:49 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2014-10-25 01:31:12 -------- d-----w- C:\ProgramData\MathematicaPlayer
2014-10-25 01:30:13 -------- d-----w- C:\ProgramData\Mathematica
2014-10-25 01:30:11 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram CDF Player
2014-10-23 22:39:11 -------- d-----w- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime

====== C: exe-files ==
2014-11-21 00:59:54 0CCA673D5DDB45871D05F6A733059E56 1055936 ----a-w- C:\Users\Bashaws\Downloads\install_flashplayer15x32_mssa_aaa_aih(1).exe
2014-11-18 23:10:57 E9499A51801037F4E7CD2D7937D76542 127752 ----a-w- C:\Program Files\HitmanPro\hmpsched.exe
2014-11-18 23:10:55 00FD7C6BEDEE9B24B0DB02B68B07AD54 11222744 ----a-w- C:\Program Files\HitmanPro\HitmanPro.exe
2014-11-18 23:09:18 00FD7C6BEDEE9B24B0DB02B68B07AD54 11222744 ----a-w- C:\Users\Bashaws\Downloads\HitmanPro_x64.exe
2014-11-18 22:56:32 2E0323A94915FAAB10A25F3BABF82584 157696 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\erunt\ERUNT.EXE
2014-11-18 22:56:16 8573E3C2603DD23E1A8DE3177D146D18 1707532 ----a-w- C:\Users\Bashaws\Downloads\JRT.exe
2014-11-18 22:46:49 6504113C2218667814D4F54847BA046A 2140160 ----a-w- C:\Users\Bashaws\Downloads\adwcleaner_4.101.exe
2014-11-18 22:44:53 1747A50E01D0FDB324F9F50E025FDB66 401920 ----a-w- C:\Users\Bashaws\Downloads\MiniToolBox.exe
2014-11-18 21:54:47 0CCA673D5DDB45871D05F6A733059E56 1055936 ----a-w- C:\Users\Bashaws\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe
2014-11-18 01:42:46 D804A4D7DF4228FC0C6105933EEAD715 41093712 ----a-w- C:\Program Files (x86)\Google\Update\Install\{6787320C-1E60-42D7-B6DB-1C5B3C507A3C}\38.0.2125.122_chrome_installer.exe
2014-11-18 01:42:45 D804A4D7DF4228FC0C6105933EEAD715 41093712 ----a-w- C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\38.0.2125.122\38.0.2125.122_chrome_installer.exe
2014-11-18 01:41:27 31AD2D566C369B00F0B07FAA6BAD7D87 880784 ----a-w- C:\Users\Bashaws\Downloads\ChromeSetup.exe
2014-11-18 01:25:00 33398D340008A0577507FCA7FD443622 19828376 ----a-w- C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025(2).exe
2014-11-18 01:24:18 33398D340008A0577507FCA7FD443622 19828376 ----a-w- C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025(1).exe
2014-11-18 01:23:38 33398D340008A0577507FCA7FD443622 19828376 ----a-w- C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-18 00:45:40 23C8F9C2CB81732A3207D197B9E9A4D4 1087296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe
2014-11-18 00:35:52 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9F62F96D-86F3-4B34-B4C4-B4730117285E}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-18 00:18:42 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{C759D2A6-42CE-4551-B3E5-D37A1FDD6C05}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-18 00:14:05 6006ADBF1CAE8AA3286140159B25C668 220264 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\~un0\u0.exe
2014-11-17 19:44:39 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{9CD467B8-FE78-415C-9525-AA429389F8E1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 19:43:59 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{3C5F7622-8321-4A7D-88AF-0F09F624B656}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 19:36:01 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{2A2AA28A-394C-474B-AFCC-C750C22C5853}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 19:34:55 BF375A90FE0B135395E20B0EB9190C11 572739 ----a-w- C:\Users\Bashaws\AppData\Roaming\1H1Q1V0B1L1G1N1V0M1P1Q1L1T0D1P1E2Z\Java Runtime Environment Packages\uninstaller.exe
2014-11-17 19:34:16 6FA7457F23AB31E68A674E5342FE32BD 29405096 ----a-w- C:\Users\Bashaws\Downloads\JavaRuntimeEnvironmentSetup.exe
2014-11-17 19:32:43 554D11357450E8DC80888285273D05DA 860576 ----a-w- C:\Users\Bashaws\Downloads\JavaSetup.exe
2014-11-17 19:28:34 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{5706ECE5-4C61-44EB-A98A-748FBE624894}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:51:39 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D382C18F-46F3-43D5-B0B9-A7F8C7AA4F4F}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:50:30 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{704F8793-DF68-4495-9CA9-DF80A1E48DF1}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:49:44 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F7CD0422-1AF3-4F50-9B99-33E77BF6BD24}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:46:07 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F6C28DCE-B06D-468C-80D3-86CB23CE67E7}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:44:43 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E50B5CC3-96A7-4CA0-929E-DFCCCD8F40C6}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:41:31 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{F0181803-A3A8-47A4-A8DD-4B007395957C}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:39:35 23C8F9C2CB81732A3207D197B9E9A4D4 1087296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.31.4.510_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:33:00 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{E2C2F68F-E8BC-4E16-903A-4735D3E9FAF2}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 05:04:40 181020AE3FC61205C1DA67BE131A1095 439296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\21686uninstall.exe
2014-11-17 04:33:49 20DA5C80C03DF9A417354319F56E9545 381728 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\{26E50819-51C3-41D2-9E50-5F88137C4538}\{D6E1527F-4144-45D0-9B1B-99F7FC050857}\Default\Extensions\banjjklfojcdbofbhbgiedekefohoaff\10.22.0.93_0\nativeMessaging\TBMessagingHost.exe
2014-11-17 04:05:47 D804A4D7DF4228FC0C6105933EEAD715 41093712 ----atw- C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\38.0.2125.122\chrome_installer.exe
2014-11-17 03:59:04 5B915884D19C1B1DA6409C039E7235CD 42533968 ----a-w- C:\Users\Bashaws\Downloads\ChromeStandaloneSetup.exe
2014-11-17 03:58:46 516A5FCE06BB388499238A5F9286CB74 96768 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\8E6B8FB6-08A0-4AA5-9FD5-C280C1C5EAB2\DismHost.exe
2014-11-17 03:58:30 9F1AE66D7954FE2E0909A5EBC6B94798 67072 ----a-w- C:\Users\Bashaws\AppData\Local\33C1FBAC-DF5D-9DDB-AE00-000000B100\Chrome-bin\wow_helper.exe
2014-11-17 03:58:28 5D2D737B0B6FB1FFC7FFAAAAB92141A0 655872 ----a-w- C:\Users\Bashaws\AppData\Local\33C1FBAC-DF5D-9DDB-AE00-000000B100\Chrome-bin\chrome.exe
2014-11-17 03:56:33 AC95D64D7A5DFAAABEC07D4B2DB77A73 204072 ----a-w- C:\Users\Bashaws\AppData\Local\33C1FBAC-DF5D-9DDB-AE00-000000B100\uninstall.exe
2014-11-17 03:55:03 F27CAB0047E10119CF315B0C71FFC9A0 213754 ----a-w- C:\c3f6beae-d430-4a21-802a-4c703bc75b60\62804985-6E8C-4DBF-A256-C43DB76EAA29.exe
2014-11-17 03:51:30 9ADF09DA2F4A161B9DEC8B815D9FF0B6 844552 ----a-w- C:\Users\Bashaws\Downloads\chrome-setup (1).exe
2014-11-17 03:49:57 9ADF09DA2F4A161B9DEC8B815D9FF0B6 844552 ----a-w- C:\Users\Bashaws\Downloads\chrome-setup.exe
2014-11-17 03:47:19 144A9AA1A785234E820D44A0D2B6423D 7820568 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\supoptsetup.exe
2014-11-17 03:46:57 13EDA298A0CCB68AF5ADB06EFAFB7BAC 3369792 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\156Btmp\silentsddsetup.exe
2014-11-17 03:46:57 13EDA298A0CCB68AF5ADB06EFAFB7BAC 3369792 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\14C0tmp\silentsddsetup.exe
2014-11-17 03:46:38 C732B52B245444E3F568D372CE399911 1037015 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\154Btmp\cloudscout.exe
2014-11-17 03:46:32 C732B52B245444E3F568D372CE399911 1037015 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\14AEtmp\cloudscout.exe
2014-11-17 03:46:24 C61471B6987FEE827E7ED61FDAFE744C 3920757 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\1508tmp\5555-1001_newplayer.exe
2014-11-17 03:46:19 C61471B6987FEE827E7ED61FDAFE744C 3920757 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\147Btmp\5555-1001_newplayer.exe
2014-11-17 03:46:19 C27E418EE71E218F5944FAB069C7A233 2203422 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\14A8tmp\jfilemanagersetup.exe
2014-11-17 03:46:19 C27E418EE71E218F5944FAB069C7A233 2203422 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\144Btmp\jfilemanagersetup.exe
2014-11-17 03:46:19 353CDBE393E56EA46542064FA2B0F3AE 8533520 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\1518tmp\superoptimizersetup.exe
2014-11-17 03:46:19 353CDBE393E56EA46542064FA2B0F3AE 8533520 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\148Dtmp\superoptimizersetup.exe
2014-11-17 03:45:42 5C87C0D9B111108332B25F44745A6DD1 844560 ----a-w- C:\Users\Bashaws\Downloads\adobeflashplayer15betastandalone-setup (1).exe
2014-11-17 03:44:42 1D65D6F0E8BB6FD37E0B9333C60585B0 844560 ----a-w- C:\Users\Bashaws\Downloads\adobeflashplayer15betastandalone-setup.exe
2014-11-17 03:31:16 181020AE3FC61205C1DA67BE131A1095 439296 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\12895uninstall.exe
2014-11-17 03:01:26 C27E418EE71E218F5944FAB069C7A233 2203422 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\12C5tmp\jfilemanagersetup.exe
2014-11-17 03:01:24 C732B52B245444E3F568D372CE399911 1037015 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\12C8tmp\cloudscout.exe
2014-11-17 01:22:15 F1E994BD5C745F5403098727B3684273 2129408 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\RarSFX0\curl.exe
2014-11-17 01:20:51 DD7F24DACD85EEDD221A55313E97DA10 5826632 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\optprosetup.exe
2014-11-17 01:18:54 3A6371EF0FCC62BEF39BF94B43003C9D 399224 ----a-w- C:\Users\Bashaws\Downloads\Java_Setup (1).exe
2014-11-17 01:18:39 D2A286F8D08309D56905DF7B7F71EF26 399224 ----a-w- C:\Users\Bashaws\Downloads\Java_Setup.exe
2014-11-16 13:18:10 3EAE59EEFFEC1E7699185DEF6C4105B5 175123 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\is45637729\1879879_stp\Generic_vo.exe
2014-11-15 00:34:57 87EB5AFD21E52CB08883E04605B55829 880784 ----a-w- C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleUpdateSetup.exe
2014-11-15 00:34:57 5B4ED5734945619EE3BCDB9825D2F526 51080 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleUpdateOnDemand.exe
2014-11-15 00:34:57 06036279056145E0F08FC095CB789E6A 51080 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleUpdateBroker.exe
2014-11-15 00:34:50 EDD3E562684CB4C50704B471BEAB1F86 114568 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleUpdateComRegisterShell64.exe
2014-11-15 00:34:50 CB8C1CC4F46FBAC78150754D77460C73 230792 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler.exe
2014-11-15 00:34:50 7161E8E31B7FD3B1CE083C2CA5FD5F44 285064 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleCrashHandler64.exe
2014-11-15 00:34:49 F172AD4E906D97ED8F071896FC6789DC 107912 ----atw- C:\Program Files (x86)\Google\Update\1.3.25.11\GoogleUpdate.exe
2014-11-15 00:34:47 87EB5AFD21E52CB08883E04605B55829 880784 ----a-w- C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.25.11\GoogleUpdateSetup.exe
=== C: other files ==
2014-11-18 22:56:30 F69854EA9F4462090B0AEBB3723881B5 14957 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\get.bat
2014-11-18 22:56:30 F56A319979F631C141F5FF02DF87FDB1 43563 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\prelim.bat
2014-11-18 22:56:30 DF7FA1F19DECC2671D46B33E6B1C0785 190133 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\misc.bat
2014-11-18 22:56:30 DD1E4D974B1672ABD09EFFB225791C4A 1230 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\TDL4.bat
2014-11-18 22:56:30 AD2F52DC72B10AF331692E4A4DD80DFC 18670 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\medfos.bat
2014-11-18 22:56:30 AA0C656F898523BEDF2DA6923197BB80 1264 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\surfvox.bat
2014-11-18 22:56:30 8E6020C14F982CF11B3FE7DBB0CB8EDE 24738 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\searchlnk.bat
2014-11-18 22:56:30 86707BCE5CBB65D9B1C41E249B4423BA 152733 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\firefox.bat
2014-11-18 22:56:30 83F691D8398F0E37E71E9355BF730DB9 719 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\ev_clear.bat
2014-11-18 22:56:30 6D12411EDA5A8EFC2018F64A6860BB78 10606 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\runvalues.bat
2014-11-18 22:56:30 38A0BDF322ACCC968B0A824C38D50157 29635 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\ask.bat
2014-11-18 22:56:30 335DFF8F23E5EC02B5426362F0F8509B 31401 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\iexplore.bat
2014-11-18 22:56:30 0C4649A62845AB5D5DBCC4998477FF6D 1813 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\delfolders.bat
2014-11-18 22:56:30 080CFDE64F31E7B50EECF4552033E84D 9937 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\mws.bat
2014-11-18 22:56:30 048407135C9B1FB6A355E256BD96160D 14192 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\jrt\chrome.bat
2014-11-18 00:09:33 D7F249656B130E1BF569B25710DDFCBE 3074039 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\scoped_dir_3152_28189\banjjklfojcdbofbhbgiedekefohoaff.crx
2014-11-17 05:51:28 D7F249656B130E1BF569B25710DDFCBE 3074039 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\scoped_dir_8980_32269\banjjklfojcdbofbhbgiedekefohoaff.crx
2014-11-17 05:40:59 D7F249656B130E1BF569B25710DDFCBE 3074039 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\scoped_dir_9684_1344\banjjklfojcdbofbhbgiedekefohoaff.crx
2014-11-17 04:18:22 D7F249656B130E1BF569B25710DDFCBE 3074039 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\scoped_dir_5296_12756\banjjklfojcdbofbhbgiedekefohoaff.crx
2014-11-17 03:59:17 D7F249656B130E1BF569B25710DDFCBE 3074039 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\scoped_dir_4116_17544\banjjklfojcdbofbhbgiedekefohoaff.crx
2014-11-17 03:55:16 4F7B52597DD085227C895F2BC2EED850 756646 ----a-w- C:\c3f6beae-d430-4a21-802a-4c703bc75b60\MediaDownloader.zip
2014-11-17 03:47:31 9A5579B199A8522D1B93D3CA1D231088 148 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\SDD.bat
2014-11-17 03:47:13 383F11FEC6484CE4443BF6C460757160 162 ----a-w- C:\Users\Bashaws\AppData\Local\Temp\SDDUpdater.bat

==== Startup Registry Enabled ======================

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="%ProgramFiles%\Windows\Sidebar.exe /autoRun"

[HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
"Spotify"="C:\Users\Bashaws\AppData\Roaming\Spotify\Spotify.exe /uri spotify:autostart"
"PCKeeper2"="C:\Program Files\Kromtech\PCKeeper Live\PCKeeper.exe /autorun"

[HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"mctadmin"="C:\Windows\System32\mctadmin.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe MSRun"
"HP Software Update"="c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe"
"PDF Complete"="C:\Program Files (x86)\PDF Complete\pdfsty.exe"
"APSDaemon"="C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
"GrooveMonitor"="C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe"
"Adobe ARM"="C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"iTunesHelper"="C:\Program Files (x86)\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files (x86)\QuickTime\QTTask.exe -atboottime"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Spotify Web Helper"="C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"
"Spotify"="C:\Users\Bashaws\AppData\Roaming\Spotify\Spotify.exe /uri spotify:autostart"
"PCKeeper2"="C:\Program Files\Kromtech\PCKeeper Live\PCKeeper.exe /autorun"

==== Startup Registry Enabled x64 ======================

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe"
"MSC"="C:\Program Files\Microsoft Security Client\msseces.exe -hide -runkey"
"IntelliType Pro"="C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe"
"IntelliPoint"="C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NCPluginUpdater"="C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe Update"

==== Startup Folders ======================


==== Task Scheduler Jobs ======================

C:\windows\tasks\Adobe Flash Player Updater.job --a------ C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [11/12/2014 03:35 PM]
C:\windows\tasks\GoogleUpdateTaskMachineCore.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [10/25/2014 10:28 AM]
C:\windows\tasks\GoogleUpdateTaskMachineUA.job --a------ C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [10/25/2014 10:28 AM]
C:\windows\tasks\HPCeeScheduleForBashaws.job --a------ C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [07/15/2011 06:43 AM]

==== Other Scheduled Tasks ======================

"C:\windows\SysNative\tasks\Adobe Flash Player Updater" [C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe]
"C:\windows\SysNative\tasks\GoogleUpdateTaskMachineCore" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\windows\SysNative\tasks\GoogleUpdateTaskMachineUA" [C:\Program Files (x86)\Google\Update\GoogleUpdate.exe]
"C:\windows\SysNative\tasks\HPCeeScheduleForBashaws" [C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe]
"C:\windows\SysNative\tasks\MotoCast Update" ["C:\Program Files (x86)\Motorola Mobility\MotoCast\LiveUpdate\MotoCastUpdate.exe"]
"C:\windows\SysNative\tasks\Motorola Device Manager Engine" ["C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe"]
"C:\windows\SysNative\tasks\Motorola Device Manager Update" ["C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe"]
"C:\windows\SysNative\tasks\ProPCCleaner_Popup" [C:\Program Files (x86)\Pro PC Cleaner\Splash.exe]
"C:\windows\SysNative\tasks\ProPCCleaner_Start" [C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe]
"C:\windows\SysNative\tasks\SuperFastPC_AutorunOnStartup" [C:\Program Files (x86)\System Optimizer Pro\SystemOptimizerPro.exe]
"C:\windows\SysNative\tasks\User_Feed_Synchronization-{3861E564-79D6-4D7B-87FE-43F49E84FDB7}" [C:\windows\system32\msfeedssync.exe]
"C:\windows\SysNative\tasks\Apple\AppleSoftwareUpdate" [C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe]
"C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe]
"C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe]
"C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\Update Check" [C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe]
"C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(No)" [c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe]
"C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(Yes)" [c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe]
"C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe]
"C:\windows\SysNative\tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan" [C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe]
"C:\windows\SysNative\tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask" [%systemroot%\system32\sc.exe start osppsvc]

==== Firefox Extensions Registry ======================

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions]
"{dc11fe86-30ee-446f-9e0f-41448bd17c12}"="C:\Program Files (x86)\Mozilla Firefox\extensions\{dc11fe86-30ee-446f-9e0f-41448bd17c12}" []
[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{e4f94d1e-2f53-401e-8885-681602c0ddd8}"="C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi" [04/04/2014 05:36 AM]

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Bashaws\AppData\Roaming\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975
67D325B5AEB28E381B84E8DE1A90C7A8 - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll - Shockwave Flash


==== Chromium Look ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions
oilkkkefbalmbfppgjmgjoefbclebkce - No path found[]

HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions
oilkkkefbalmbfppgjmgjoefbclebkce - No path found[]

Docs - Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake
Google Drive - Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf
YouTube - Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo
Google Search - Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf
Gmail - Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"
{D944BB61-2E34-4DBF-A683-47E505C587DC} Unknown Url="Not_Found"

==== Deleting CLSID Registry Keys ======================

HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_CLASSES_ROOT\Wow6432Node\CLSID\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d2ce3e00-f94a-4740-988e-03dc2f38c34f} deleted successfully

==== Deleting CLSID Registry Values ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{8dcb7100-df86-4384-8842-8fa844297b3f} deleted successfully
HKEY_LOCAL_MACHINE\software\Wow6432Node\mozilla\Firefox\extensions\{dc11fe86-30ee-446f-9e0f-41448bd17c12} deleted successfully

==== Deleting Registry Keys ======================

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4E30E037E0535E84D9E3349209D354D4 deleted successfully
HKEY_LOCAL_MACHINE\Software\wow6432node\Policies\Google deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\wow6432node\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce deleted successfully
HKEY_CURRENT_USER\SOFTWARE\Google\Chrome\Extensions\oilkkkefbalmbfppgjmgjoefbclebkce deleted successfully
HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{730E03E4-350E-48E5-9D3E-4329903D454D} deleted successfully
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\4E30E037E0535E84D9E3349209D354D4 deleted successfully

==== Empty IE Cache ======================

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Bashaws\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Bashaws\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\Users\Bashaws\AppData\Local\Temp\acrord32_sbx\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Bashaws\AppData\Local\Temp\Low\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Bashaws\AppData\Local\Temp\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Bashaws\AppData\Local\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=139 folders=29 32061183 bytes)

==== Empty Temp Folders ======================

C:\Users\Bashaws\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\windows\Temp successfully emptied
C:\Users\Bashaws\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on Fri 11/21/2014 at 13:36:32.67 ======================
 

argus

Former MalwareTips Staff
Scan with ZOEK

Please download ZOEK by Smeenk and save it to your desktop (preferred version is the *.exe one)
Temporary disable your AntiVirus and AntiSpyware protection - instructions here.

  • Right-click on
    icon and select
    Run as Administrator to start the tool.
  • Wait patiently until the main console will appear, it may take a minute or two.
  • In the main box please paste in the following script:
    Code:
    [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Mozilla\Firefox\Extensions];r
    "{dc11fe86-30ee-446f-9e0f-41448bd17c12}"=-;r
    {dc11fe86-30ee-446f-9e0f-41448bd17c12};c
    {D944BB61-2E34-4DBF-A683-47E505C587DC};c
    autoclean;
    emptyalltemp;
    ipconfig /flushdns;b
  • Make sure that Scan All Users option is checked.
  • Push Run Script and wait patiently. The scan may take a couple of minutes.
  • When the scan completes, a zoek-results logfile should open in notepad.
  • If a reboot is needed, it will be opened after it. You may also find it at your main drive (usually C:\ drive)

Post its content into your next reply.
 

Jason Bashaw

New Member
Here are the results of that scan.


Zoek.exe v5.0.0.0 Updated 21-11-2014
Tool run by Bashaws on Fri 11/21/2014 at 14:05:27.50.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Bashaws\Downloads\zoek.exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-11-21-173733.log 425 bytes
C:\zoek-results2014-11-21-183632.log 98395 bytes

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================


==== Deleting Services ======================


==== Registry Fix Code ======================

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{dc11fe86-30ee-446f-9e0f-41448bd17c12}"=-

==== Batch Command(s) Run By Tool======================


==== Firefox Extensions Registry ======================

[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{e4f94d1e-2f53-401e-8885-681602c0ddd8}"="C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi" [04/04/2014 05:36 AM]

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Bashaws\AppData\Roaming\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975
67D325B5AEB28E381B84E8DE1A90C7A8 - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll - Shockwave Flash


==== Chromium Look ======================

Docs - Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"

==== Empty IE Cache ======================

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Bashaws\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Bashaws\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5 emptied successfully
C:\windows\SysNative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWoW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\windows\sysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Bashaws\AppData\Local\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=139 folders=29 32061183 bytes)

==== Empty Temp Folders ======================

C:\Users\Bashaws\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\windows\Temp successfully emptied
C:\Users\Bashaws\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on Fri 11/21/2014 at 14:22:43.70 ======================
 

Jason Bashaw

New Member
Same still. On IE, when I go to the internet options and unclick proxy server, then select ok. it simply just puts it back in, even after I reset. Same when I reset for crome. Pop-ups are still happening as well.
 

argus

Former MalwareTips Staff
Scan with Farbar Recovery Scan Tool
Please re-run Farbar Recovery Scan Tool to give me a fresh look at your system.
  • Right-click on
    icon and select
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Make sure that Addition option is checked.
  • Press Scan button and wait.
  • The tool will produce two logfiles on your desktop: FRST.txt and Addition.txt.
Please include their content into your next reply.
 

Jason Bashaw

New Member
It's not giving me the option to select run as administrator when I right click the icon. It's giving view image, copy image, copy image location, save image as, email image, set as desktop background, view image info and inspect element.
 

Jason Bashaw

New Member
Here are the results from the mini toolbar scan I just completed.

MiniToolBox by Farbar Version: 21-07-2014
Ran by Bashaws (administrator) on 21-11-2014 at 16:25:52
Running from "C:\Users\Bashaws\Downloads"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
***************************************************************************

========================= Flush DNS: ===================================

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

========================= IE Proxy Settings: ==============================

Proxy is not enabled.
No Proxy Server is set.

"Reset IE Proxy Settings": IE Proxy Settings were reset.

========================= FF Proxy Settings: ==============================

"network.proxy.type", 0

"Reset FF Proxy Settings": Firefox Proxy settings were reset.

========================= Hosts content: =================================



========================= IP Configuration: ================================

802.11n Wireless LAN Card = Wireless Network Connection (Connected)
Realtek PCIe GBE Family Controller = Local Area Connection (Media disconnected)
D-Link DWA-140 RangeBooster N USB Adapter(rev.B2) = Wireless Network Connection 2 (Media disconnected)


# ----------------------------------
# IPv4 Configuration
# ----------------------------------
pushd interface ipv4

reset
set global icmpredirects=enabled


popd
# End of IPv4 configuration



Windows IP Configuration

Host Name . . . . . . . . . . . . : Bashaws-HP
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : attlocal.net

Wireless LAN adapter Wireless Network Connection 2:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : D-Link DWA-140 RangeBooster N USB Adapter(rev.B2)
Physical Address. . . . . . . . . : B0-C5-54-BE-BC-66
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes

Wireless LAN adapter Wireless Network Connection:

Connection-specific DNS Suffix . : attlocal.net
Description . . . . . . . . . . . : 802.11n Wireless LAN Card
Physical Address. . . . . . . . . : 74-E5-43-32-05-5E
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2602:252:d79:66a0::47(Preferred)
Lease Obtained. . . . . . . . . . : Friday, November 21, 2014 2:55:47 PM
Lease Expires . . . . . . . . . . : Sunday, December 21, 2014 2:55:47 PM
IPv6 Address. . . . . . . . . . . : 2602:252:d79:66a0:a442:5be2:13be:d494(Preferred)
Temporary IPv6 Address. . . . . . : 2602:252:d79:66a0:9570:a834:489a:6b07(Preferred)
Link-local IPv6 Address . . . . . : fe80::a442:5be2:13be:d494%13(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.1.66(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Friday, November 21, 2014 2:55:45 PM
Lease Expires . . . . . . . . . . : Saturday, November 22, 2014 2:55:45 PM
Default Gateway . . . . . . . . . : fe80::9662:69ff:fe16:58c0%13
192.168.1.254
DHCP Server . . . . . . . . . . . : 192.168.1.254
DHCPv6 IAID . . . . . . . . . . . : 256142679
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-17-49-C9-2A-4C-72-B9-1C-DA-D4
DNS Servers . . . . . . . . . . . : 31.168.224.100
5.135.12.56
NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : hsd1.ct.comcast.net.
Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
Physical Address. . . . . . . . . : 4C-72-B9-1C-DA-D4
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Server: bzq-224-168-31-100.red.bezeqint.net
Address: 31.168.224.100

Name: google.com
Addresses: 2a00:1450:4013:c00::8a
173.194.65.138
173.194.65.139
173.194.65.102
173.194.65.100
173.194.65.101
173.194.65.113


Pinging google.com [2a00:1450:4009:800::1009] with 32 bytes of data:
Request timed out.
Reply from 2a00:1450:4009:800::1009: time=108ms

Ping statistics for 2a00:1450:4009:800::1009:
Packets: Sent = 2, Received = 1, Lost = 1 (50% loss),
Approximate round trip times in milli-seconds:
Minimum = 108ms, Maximum = 108ms, Average = 108ms
Server: bzq-224-168-31-100.red.bezeqint.net
Address: 31.168.224.100

Name: yahoo.com
Addresses: 206.190.36.45
98.139.183.24
98.138.253.109


Pinging yahoo.com [98.139.183.24] with 32 bytes of data:
Reply from 98.139.183.24: bytes=32 time=35ms TTL=49
Reply from 98.139.183.24: bytes=32 time=34ms TTL=49

Ping statistics for 98.139.183.24:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 34ms, Maximum = 35ms, Average = 34ms

Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128

Ping statistics for 127.0.0.1:
Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
===========================================================================
Interface List
14...b0 c5 54 be bc 66 ......D-Link DWA-140 RangeBooster N USB Adapter(rev.B2)
13...74 e5 43 32 05 5e ......802.11n Wireless LAN Card
12...4c 72 b9 1c da d4 ......Realtek PCIe GBE Family Controller
1...........................Software Loopback Interface 1
===========================================================================

IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.66 25
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
192.168.1.0 255.255.255.0 On-link 192.168.1.66 281
192.168.1.66 255.255.255.255 On-link 192.168.1.66 281
192.168.1.255 255.255.255.255 On-link 192.168.1.66 281
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.1.66 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.1.66 281
===========================================================================
Persistent Routes:
None

IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
13 281 ::/0 fe80::9662:69ff:fe16:58c0
1 306 ::1/128 On-link
13 33 2602:252:d79:66a0::/64 On-link
13 41 2602:252:d79:66a0::/64 fe80::9662:69ff:fe16:58c0
13 281 2602:252:d79:66a0::47/128
On-link
13 281 2602:252:d79:66a0:9570:a834:489a:6b07/128
On-link
13 281 2602:252:d79:66a0:a442:5be2:13be:d494/128
On-link
13 281 fe80::/64 On-link
13 281 fe80::a442:5be2:13be:d494/128
On-link
1 306 ff00::/8 On-link
13 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
========================= Winsock entries =====================================

Catalog5 01 C:\windows\SysWOW64\NLAapi.dll [52224] (Microsoft Corporation)
Catalog5 02 C:\windows\SysWOW64\napinsp.dll [52224] (Microsoft Corporation)
Catalog5 03 C:\windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 04 C:\windows\SysWOW64\pnrpnsp.dll [65024] (Microsoft Corporation)
Catalog5 05 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog5 06 C:\windows\SysWOW64\winrnr.dll [20992] (Microsoft Corporation)
Catalog5 07 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.)
Catalog5 08 C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [145280] (Microsoft Corp.)
Catalog5 09 C:\Program Files (x86)\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Catalog9 01 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 02 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 03 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 04 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 05 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 06 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 07 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 08 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 09 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
Catalog9 10 C:\windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation)
x64-Catalog5 01 C:\Windows\System32\NLAapi.dll [70656] (Microsoft Corporation)
x64-Catalog5 02 C:\Windows\System32\napinsp.dll [68096] (Microsoft Corporation)
x64-Catalog5 03 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 04 C:\Windows\System32\pnrpnsp.dll [86016] (Microsoft Corporation)
x64-Catalog5 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog5 06 C:\Windows\System32\winrnr.dll [28672] (Microsoft Corporation)
x64-Catalog5 07 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392] (Microsoft Corp.)
x64-Catalog5 08 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [171392] (Microsoft Corp.)
x64-Catalog5 09 C:\Program Files\Bonjour\mdnsNSP.dll [132968] (Apple Inc.)
x64-Catalog9 01 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 02 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 03 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 04 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 05 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 06 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 07 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 08 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 09 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)
x64-Catalog9 10 C:\Windows\System32\mswsock.dll [327168] (Microsoft Corporation)

========================= Event log errors: ===============================

Application errors:
==================
Error: (11/21/2014 02:57:09 PM) (Source: Application Error) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0xdf0
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/21/2014 02:23:40 PM) (Source: Application Error) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x10e8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/21/2014 02:18:37 PM) (Source: Application Error) (User: )
Description: Faulting application name: plugin-container.exe, version: 33.1.0.5423, time stamp: 0x545c0a59
Faulting module name: mozalloc.dll, version: 33.1.0.5423, time stamp: 0x545be5ee
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x162c
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (11/21/2014 01:37:58 PM) (Source: Application Error) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x7c8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/21/2014 01:29:23 PM) (Source: Application Error) (User: )
Description: Faulting application name: plugin-container.exe, version: 33.1.0.5423, time stamp: 0x545c0a59
Faulting module name: mozalloc.dll, version: 33.1.0.5423, time stamp: 0x545be5ee
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x1948
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (11/21/2014 01:19:55 PM) (Source: Application Error) (User: )
Description: Faulting application name: plugin-container.exe, version: 33.1.0.5423, time stamp: 0x545c0a59
Faulting module name: mozalloc.dll, version: 33.1.0.5423, time stamp: 0x545be5ee
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x1558
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (11/21/2014 00:50:48 PM) (Source: Application Error) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x12e8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/21/2014 11:51:36 AM) (Source: Application Error) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x8b8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/20/2014 07:38:34 PM) (Source: Application Error) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x132c
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/20/2014 09:26:54 AM) (Source: Application Error) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x10a8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3


System errors:
=============
Error: (11/21/2014 02:17:36 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 02:17:36 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 02:17:35 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 02:17:35 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 02:17:34 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:45 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:45 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:44 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:44 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:44 PM) (Source: Service Control Manager) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.


Microsoft Office Sessions:
=========================


=========================== Installed Programs ============================
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.6.0.19120 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD APP SDK Runtime (Version: 2.5.732.1 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{601B10F8-06B0-2EB1-CCAD-C3F7D7E32FD1}) (Version: 3.0.842.0 - Advanced Micro Devices, Inc.)
AMD Media Foundation Decoders (Version: 1.0.60914.1136 - Advanced Micro Devices, Inc.) Hidden
AMD Steady Video Plug-In (Version: 1.00.0000 - AMD) Hidden
AMD VISION Engine Control Center (x32 Version: 2011.0908.1355.23115 - Advanced Micro Devices, Inc.) Hidden
Amulet of Time: Shadow of La Rochelle (x32 Version: 3.0.2.32 - WildTangent) Hidden
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{9FA13759-5C2B-4177-9DDC-0038F8B5BEFD}) (Version: 7.0.826.0 - Microsoft Corporation)
Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blio (HKLM-x32\...\{741006D1-7B2B-4E33-B2B0-831F282EEF64}) (Version: 2.2.8188 - K-NFB Reading Technology, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bubble Wrap (HKLM-x32\...\{5BFFDDEB-AFD7-499F-BB13-7A6EAD927CDA}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Cases of Stolen Beauty (x32 Version: 2.2.0.110 - WildTangent) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2011.0908.1355.23115 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2011.0908.1355.23115 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2011.0908.1355.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2011.0908.1354.23115 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2011.0908.1355.23115 - Advanced Micro Devices, Inc.) Hidden
Cheatbusters (x32 Version: 2.2.0.110 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
City of Fools (x32 Version: 2.2.0.110 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Criminal Minds (x32 Version: 2.2.0.110 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
Eastville Chronicles: The Drama Queen Murder (x32 Version: 3.0.2.32 - WildTangent) Hidden
Facebook (HKLM-x32\...\{8AE50893-3A87-4439-9A57-942ED43F7189}) (Version: 1.1.0004 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.98 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
Flash Player Pro V5.4 (HKLM-x32\...\Flash Player Pro_is1) (Version: - FlashPlayerPro.com)
Gem Smashers (x32 Version: 2.2.0.98 - WildTangent) Hidden
Ghost Whisperer (x32 Version: 3.0.2.32 - WildTangent) Hidden
Golden Trails 3: The Guardian's Creed Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.122 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Haunted Past Realm of Ghosts Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hidden Path of Faery (x32 Version: 3.0.2.32 - WildTangent) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.232 - SurfRight B.V.)
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden
HP Application Assistant (HKLM\...\{B34A07DD-C6F7-414A-AE63-01019482EAF0}) (Version: 1.0.393.3870 - Hewlett-Packard)
HP Auto (Version: 1.0.12935.3667 - Hewlett-Packard Company) Hidden
HP Calendar (HKLM-x32\...\{2B38E0FA-D8A5-4EBF-A018-E3C1C8E7A2E2}) (Version: 5.1.4245.23508 - Hewlett-Packard)
HP Client Services (Version: 1.1.12938.3539 - Hewlett-Packard) Hidden
HP Clock (HKLM-x32\...\{0EEC4E49-D4C2-4E23-87F2-B5641F1A09E4}) (Version: 5.1.4244.16367 - Hewlett-Packard)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP LinkUp (HKLM-x32\...\{7E750542-55BC-4300-8B7B-AC2A762FB435}) (Version: 2.01.029 - Hewlett-Packard)
HP Magic Canvas (HKLM-x32\...\{DDFDC9D6-4220-41F8-BF9A-8E7512C4EF52}) (Version: 5.1.15.0 - Hewlett-Packard)
HP Magic Canvas Tutorials (HKLM-x32\...\{858FCB65-7C6D-4BA4-AD80-A3CB3744CE09}_is1) (Version: 5.0.0.3 - Hewlett-Packard)
HP MovieStore (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.1.21091.0 - Hewlett-Packard Company)
HP MovieStore (x32 Version: 2.1.091 - Hewlett-Packard) Hidden
HP Notes (HKLM-x32\...\{86BAB08A-5E66-4C53-82E3-C1E91673C7CA}) (Version: 5.1.4274.30382 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP RSS (HKLM-x32\...\{A35E58D6-2A0F-4051-983B-79342081338E}) (Version: 5.1.4301.21494 - Hewlett-Packard)
HP Setup (HKLM-x32\...\{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}) (Version: 9.0.15130.3904 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.2.15145.3905 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
HP TouchSmart RecipeBox (HKLM-x32\...\{20714B53-FC73-4F9C-9687-49EB237D6FD7}) (Version: 3.0.3830.27730 - Hewlett-Packard)
HP Update (HKLM-x32\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.12.1.0 - Hewlett-Packard)
HP Weather (HKLM-x32\...\{8364E531-493B-4B05-8041-09D5CE38B975}) (Version: 5.1.4295.16450 - Hewlett-Packard)
iCloud (HKLM\...\{2AAF09D5-4B3F-4975-B6A9-ECE2631FC942}) (Version: 4.0.5.20 - Apple Inc.)
Idle Crawler (HKLM-x32\...\33C1FBAC-DF5D-9DDB-AE00-000000B100) (Version: 104.0.0.451 - MILE 27 LTD)
Infected: The Twin Vaccine Collector's Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kobo (HKLM-x32\...\Kobo) (Version: 2.0.3 - Kobo Inc.)
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4507 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.4507 - CyberLink Corp.) Hidden
Legacy Tales: Mercy of the Gallows Collector's Edition (x32 Version: 3.0.2.51 - WildTangent) Hidden
Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Live Novels Jane Austin's Pride and Prejudice (x32 Version: 2.2.0.110 - WildTangent) Hidden
Luxor HD (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mathematica Extras 9.0 (4092550) (HKLM\...\A-WIN-Extras 9.0.1 4092550_is1) (Version: 9.0.1 - Wolfram Research, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Metric Converter (HKLM-x32\...\{D0661463-50F7-4A1E-83CB-37CC590589AE}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Mathematics (HKLM-x32\...\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.0.162.0 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (Version: 2.0.162.0 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Groove MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (x32 Version: - Microsoft) Hidden
Microsoft Office Publisher MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.5139.5005 - Microsoft Corporation)
Microsoft Office Word MUI (English) 2007 (x32 Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Security Client (Version: 4.6.0305.0 - Microsoft Corporation) Hidden
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft WSE 3.0 Runtime (x32 Version: 3.0.5305.0 - Microsoft Corp.) Hidden
MotoCast (HKLM-x32\...\{5401CEE8-3C2D-4835-A802-213306537FF4}) (Version: 2.0.31 - Motorola Mobility)
Motorola Device Manager (HKLM-x32\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.2.35 - Motorola Mobility)
Motorola Device Software Update (x32 Version: 1.0.41 - Motorola Mobility) Hidden
MOTOROLA MEDIA LINK (x32 Version: 1.9.0002.0 - Motorola) Hidden
Motorola Mobile Drivers Installation 5.9.0 (Version: 5.9.0 - Motorola Inc.) Hidden
Mozilla Firefox 33.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 en-US)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Mysteries of Ancient Inventors (x32 Version: 3.0.2.32 - WildTangent) Hidden
Mystery Murders: The Sleeping Palace (x32 Version: 3.0.2.51 - WildTangent) Hidden
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.65 - PDF Complete, Inc)
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.5706 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.5706 - CyberLink Corp.) Hidden
PressReader (HKLM-x32\...\{912CED74-88D3-4C5B-ACB0-132318649765}) (Version: 5.11.0721.0 - NewspaperDirect Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Ralink 802.11n Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.25.0 - Mediatek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6531 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.4424 - CyberLink Corp.) Hidden
Redemption Cemetery: Childrens Plight (x32 Version: 3.0.2.51 - WildTangent) Hidden
Remote Graphics Receiver (HKLM-x32\...\{16FC3056-90C0-4757-8A68-64D8DA846ADA}) (Version: 5.4.5 - Hewlett-Packard)
RollerCoaster Tycoon 3: Platinum (x32 Version: 2.2.0.98 - WildTangent) Hidden
Sacra Terra: Kiss of Death Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
Shadow Shelter (x32 Version: 3.0.2.59 - WildTangent) Hidden
Sisters Secrecy: Arcanum Bloodlines Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Special Enquiry Detail: Engaged to Kill (x32 Version: 2.2.0.110 - WildTangent) Hidden
Spirits and Curses 3 in 1 Bundle (x32 Version: 3.0.2.32 - WildTangent) Hidden
Spot (HKLM-x32\...\{3D171340-B528-42E0-92E4-BDA7AEEF6F32}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Spotify (HKCU\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
SUABnR (HKLM-x32\...\InstallShield_{2485354C-6B65-4978-BB91-CCE61442377B}) (Version: 1.1.0.13103_1 - Samsung Electronics Co., Ltd.)
SUABnR (x32 Version: 1.1.0.13103_1 - Samsung Electronics Co., Ltd.) Hidden
Tap Tap Bear (HKLM-x32\...\{A393CDFF-BEB8-48EA-990D-2EB35B311D23}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Tearstone (x32 Version: 3.0.2.32 - WildTangent) Hidden
The Lake House: Children of Silence (x32 Version: 3.0.2.48 - WildTangent) Hidden
The Princess Case: A Royal Scoop (x32 Version: 2.2.0.110 - WildTangent) Hidden
The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden
Theatre of the Absurd Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Titanic's Keys to the Past (x32 Version: 3.0.2.32 - WildTangent) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{AB365889-0395-4FAD-B702-CA5985D53D42}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{A024FC7B-77DE-45DE-A058-1C049A17BFB3}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{CB68A5B0-3508-4193-AEB9-AF636DAECE0F}) (Version: - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{E9A82945-BA29-4EE8-8F2A-2F49545E9CF2}) (Version: - Microsoft)
Update for Microsoft Office Access 2007 Help (KB963663) (HKLM-x32\...\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}) (Version: - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{199DF7B6-169C-448C-B511-1054101BE9C9}) (Version: - Microsoft)
Update for Microsoft Office Infopath 2007 Help (KB963662) (HKLM-x32\...\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{716B81B8-B13C-41DF-8EAC-7A2F656CAB63}) (Version: - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (HKLM-x32\...\{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2744EF05-38E1-4D5D-B333-E021EDAEA245}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{ED38F8A3-4F61-494E-8BCA-E3AC7760C924}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 (KB2863811) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{53DEC068-4690-4F6B-9946-7D21EF02236B}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{0451F231-E3E3-4943-AB9F-58EB96171784}) (Version: - Microsoft)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2899525) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{B6160A7F-1EDB-4ED7-96DD-CF6F83DB347A}) (Version: - Microsoft)
Update for Microsoft Office PowerPoint 2007 (KB2597972) 32-Bit Edition (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{7B9D2746-D03B-442B-A691-90B748E316B4}) (Version: - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{397B1D4F-ED7B-4ACA-A637-43B670843876}) (Version: - Microsoft)
Update for Microsoft Office Publisher 2007 Help (KB963667) (HKLM-x32\...\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2E40DE55-B289-4C8B-8901-5D369B16814F}) (Version: - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (HKLM-x32\...\{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}) (Version: - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{80E762AA-C921-4839-9D7D-DB62A72C0726}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Verizon Wireless Software Upgrade Assistant - Samsung(ar) (HKLM-x32\...\{D31032BD-B70C-4E1E-8BE3-0B870A910983}) (Version: 2.14.1002 - Samsung Electronics Co., Ltd.)
Verizon Wireless Software Utility Application for Android - Samsung (HKLM-x32\...\{74870974-832F-42D3-8047-D87A5A722CC3}) (Version: 2.14.1002 - Samsung Electronics Co., Ltd.)
Victorian Mysteries®: The Yellow Room (x32 Version: 2.2.0.110 - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App for HP (x32 Version: 4.0.11.2 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3538.0513 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Wolfram CDF Player (M-WIN-D 9.0.1 4092685) (HKLM-x32\...\M-WIN-D 9.0.1 4092685_is1) (Version: 9.0.1 - Wolfram Research, Inc.)
Youda Legend - The Curse of the Amsterdam Diamond (x32 Version: 2.2.0.110 - WildTangent) Hidden
Youda Legend: The Golden Bird of Paradise (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zinio Reader 4 (HKLM-x32\...\ZinioReader4) (Version: 4.2.4164 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

========================= Devices: ================================

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


========================= Memory info: ===================================

Percentage of memory in use: 33%
Total physical RAM: 7666.86 MB
Available physical RAM: 5070.27 MB
Total Pagefile: 15331.91 MB
Available Pagefile: 12110.84 MB
Total Virtual: 4095.88 MB
Available Virtual: 3973.26 MB

========================= Partitions: =====================================

1 Drive c: (OS) (Fixed) (Total:914.52 GB) (Free:801.09 GB) NTFS
2 Drive d: (HP_RECOVERY) (Fixed) (Total:16.77 GB) (Free:2.1 GB) NTFS
8 Drive k: (My Book) (Fixed) (Total:1862.98 GB) (Free:1776.51 GB) NTFS

========================= Users: ========================================

User accounts for \\BASHAWS-HP

Administrator Bashaws Guest

========================= Minidump Files ==================================

No minidump file found

========================= Restore Points ==================================

17-11-2014 05:01:04 Removed GeekBuddy.
17-11-2014 05:01:56 Removed GeekBuddy.
17-11-2014 05:06:17 Removed PCKeeper Live
17-11-2014 05:07:52 Removed KromtechAccountService
17-11-2014 19:35:39 Windows Update
18-11-2014 01:38:23 Removed Java 7 Update 60
18-11-2014 01:38:52 Removed Java 7 Update 60
18-11-2014 23:25:47 Checkpoint by HitmanPro
18-11-2014 23:27:20 Checkpoint by HitmanPro
19-11-2014 02:32:33 Windows Update
19-11-2014 18:49:22 Windows Update
21-11-2014 17:37:02 zoek.exe restore point
21-11-2014 18:05:57 zoek.exe restore point

**** End of log ****
 

Jason Bashaw

New Member
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 20-11-2014
Ran by Bashaws (administrator) on BASHAWS-HP on 21-11-2014 17:21:10
Running from C:\Users\Bashaws\Downloads
Loaded Profile: Bashaws (Available profiles: Bashaws)
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(SurfRight B.V.) C:\Program Files\HitmanPro\hmpsched.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Nero AG) C:\Program Files (x86)\Motorola Media Link\Lite\NServiceEntry.exe
(Hewlett-Packard Company) C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
() C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(PDF Complete Inc) C:\Program Files (x86)\PDF Complete\pdfsvc.exe
(Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
() C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
(Microsoft Corporation) C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
(Spotify Ltd) C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(Spotify Ltd) C:\Users\Bashaws\AppData\Roaming\Spotify\spotify.exe
(Hewlett-Packard) C:\Program Files (x86)\Hp\HP Software Update\hpwuschd2.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
() C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\HPTouchSmartSyncCalReminderApp.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_223.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_15_0_0_223.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [hpsysdrv] => c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [1331288 2014-08-22] (Microsoft Corporation)
HKLM\...\Run: [IntelliType Pro] => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [1464944 2012-11-02] (Microsoft Corporation)
HKLM\...\Run: [IntelliPoint] => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2076272 2012-11-02] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => c:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [343168 2011-09-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [HP Software Update] => c:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-10] (Hewlett-Packard)
HKLM-x32\...\Run: [] => [X]
HKLM-x32\...\Run: [PDF Complete] => C:\Program Files (x86)\PDF Complete\pdfsty.exe [658424 2011-08-12] (PDF Complete Inc)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60712 2014-10-11] (Apple Inc.)
HKLM-x32\...\Run: [GrooveMonitor] => C:\Program Files (x86)\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [157480 2014-10-15] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-10-02] (Apple Inc.)
HKLM\...\RunOnce: [NCPluginUpdater] => C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe [21720 2014-10-21] (Hewlett-Packard)
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\Run: [Spotify Web Helper] => C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1514040 2014-10-11] (Spotify Ltd)
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\Run: [Spotify] => C:\Users\Bashaws\AppData\Roaming\Spotify\Spotify.exe [6553144 2014-10-11] (Spotify Ltd)
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\Run: [MotoCast] => C:\Program Files (x86)\Motorola Mobility\MotoCast\MotoLauncher.lnk [2057 2013-11-10] ()
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\Run: [PCKeeper2] => "C:\Program Files\Kromtech\PCKeeper Live\PCKeeper.exe" /autorun
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\MountPoints2: {0ca89e76-3e8b-11e3-844c-4c72b91cdad4} - J:\MotoCastSetup.exe -a
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\MountPoints2: {75227bc2-5bc0-11e4-866f-4c72b91cdad4} - J:\VZW_Software_upgrade_assistant.exe
Startup: C:\Users\Bashaws\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Verizon Wireless Software Utility Application for Android – Samsung.lnk
ShortcutTarget: Verizon Wireless Software Utility Application for Android – Samsung.lnk -> C:\Users\Bashaws\AppData\Roaming\VERIZON\UA_ar\UA.exe (SAMSUNG Electornics Co., Ltd.)
BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

SearchScopes: HKLM -> DefaultScope {6A1806CD-94D4-4689-BA73-E35EA1EA9990} URL =
SearchScopes: HKLM -> {9C4AEC1A-EE5A-4327-8A56-613783F7CEAA} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link_code=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {DC91FAFB-6CEA-49E5-BB74-9CEE75D09B77} URL =
SearchScopes: HKLM-x32 -> {9C4AEC1A-EE5A-4327-8A56-613783F7CEAA} URL = http://www.amazon.com/s/ref=azs_osd_iea?ie=UTF-8&tag=hp-us1-vsb-20&link_code=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = http://en.wikipedia.org/wiki/Special:Search?search={searchTerms}
BHO: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> c:\Program Files\AMD\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: MSS+ Identifier -> {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} -> C:\Program Files\McAfee Security Scan\3.8.150\McAfeeMSS_IE.dll (McAfee, Inc.)
BHO-x32: SteadyVideoBHO Class -> {6C680BAE-655C-4E3D-8FC4-E6A520C3D928} -> c:\Program Files (x86)\amd\SteadyVideo\SteadyVideo.dll (Advanced Micro Devices)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKU\S-1-5-21-2842075429-1242635110-2963454771-1001 -> No Name - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
Toolbar: HKU\S-1-5-21-2842075429-1242635110-2963454771-1001 -> Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Filter: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\Program Files\AMD\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/mp4 - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Filter-x32: video/x-flv - {20C75730-7C25-476B-95DC-C65810F9E489} - c:\Program Files (x86)\amd\SteadyVideo\VideoMIMEFilter.dll (Advanced Micro Devices)
Tcpip\Parameters: [DhcpNameServer] 192.168.1.254
Tcpip\..\Interfaces\{5D400110-9F0C-4111-90C7-8FEB0C45831E}: [NameServer] 31.168.224.100,5.135.12.56
Tcpip\..\Interfaces\{F8C8F553-85B0-4F3F-A7A3-B1B290D45052}: [NameServer] 31.168.224.100,5.135.12.56

FireFox:
========
FF ProfilePath: C:\Users\Bashaws\AppData\Roaming\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975
FF NewTab: about:blank
FF Homepage: https://www.google.com
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_15_0_0_223.dll ()
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\11\NP_wtapp.dll ()
FF Plugin-x32: @wolfram.com/Mathematica -> C:\Program Files (x86)\Common Files\Wolfram Research\Browser\9.0.1.4092550\npmathplugin.dll (Wolfram Research, Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\Firefox\Extensions: [{e4f94d1e-2f53-401e-8885-681602c0ddd8}] - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi
FF Extension: McAfee Security Scan Plus - C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi [2014-04-04]

Chrome:
=======
CHR Profile: C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Docs) - C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-17]
CHR Extension: (Google Drive) - C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-17]
CHR Extension: (YouTube) - C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-17]
CHR Extension: (Google Search) - C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-17]
CHR Extension: (Gmail) - C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-17]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 CalendarSynchService; C:\Program Files (x86)\Hewlett-Packard\TouchSmart\Calendar\Service\GCalService.exe [16384 2011-08-16] (Hewlett-Packard) [File not signed]
S3 GamesAppIntegrationService; C:\Program Files (x86)\WildTangent Games\App\GamesAppIntegrationService.exe [227904 2014-01-27] (WildTangent)
R2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [127752 2014-11-18] (SurfRight B.V.)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-10-01] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [968504 2014-10-01] (Malwarebytes Corporation)
S3 McComponentHostService; C:\Program Files\McAfee Security Scan\3.8.150\McCHSvc.exe [289256 2014-04-09] (McAfee, Inc.)
R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [120728 2012-10-02] ()
R2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [23784 2014-08-22] (Microsoft Corporation)
R3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [368624 2014-08-22] (Microsoft Corporation)
R2 pdfcDispatcher; C:\Program Files (x86)\PDF Complete\pdfsvc.exe [1128952 2011-08-12] (PDF Complete Inc)
R2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R3 MBAMProtector; C:\windows\system32\drivers\mbam.sys [25816 2014-10-01] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\windows\system32\drivers\MBAMSwissArmy.sys [129752 2014-11-21] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\windows\system32\drivers\mwac.sys [63704 2014-10-01] (Malwarebytes Corporation)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [269008 2014-07-17] (Microsoft Corporation)
R3 netr28ux; C:\Windows\System32\DRIVERS\Dnetr28ux.sys [987648 2009-08-06] (Ralink Technology Corp.)
R2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [125584 2014-07-17] (Microsoft Corporation)
S3 Serial; C:\Windows\system32\drivers\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-21 17:21 - 2014-11-21 17:21 - 00018304 _____ () C:\Users\Bashaws\Downloads\FRST.txt
2014-11-21 17:20 - 2014-11-21 17:21 - 00000000 ____D () C:\FRST
2014-11-21 17:19 - 2014-11-21 17:19 - 02117632 _____ (Farbar) C:\Users\Bashaws\Downloads\FRST64.exe
2014-11-21 16:24 - 2014-11-21 16:25 - 00401920 _____ (Farbar) C:\Users\Bashaws\Downloads\MiniToolBox(1).exe
2014-11-21 14:21 - 2014-11-21 14:05 - 00024064 _____ () C:\windows\zoek-delete.exe
2014-11-21 14:06 - 2014-11-21 13:36 - 00098395 _____ () C:\zoek-results2014-11-21-183632.log
2014-11-21 13:05 - 2014-11-21 12:37 - 00000425 _____ () C:\zoek-results2014-11-21-173733.log
2014-11-21 12:36 - 2014-11-21 14:22 - 00004742 _____ () C:\zoek-results.log
2014-11-21 12:34 - 2014-11-21 13:19 - 00000000 ____D () C:\zoek_backup
2014-11-21 12:34 - 2014-11-21 12:34 - 01294848 _____ () C:\Users\Bashaws\Downloads\zoek.exe
2014-11-20 19:59 - 2014-11-20 20:00 - 01055936 _____ (Adobe) C:\Users\Bashaws\Downloads\install_flashplayer15x32_mssa_aaa_aih(1).exe
2014-11-18 18:27 - 2014-11-18 18:27 - 00054016 _____ () C:\windows\system32\.crusader
2014-11-18 18:10 - 2014-11-18 18:33 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-11-18 18:10 - 2014-11-18 18:10 - 00001899 _____ () C:\Users\Public\Desktop\HitmanPro.lnk
2014-11-18 18:10 - 2014-11-18 18:10 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
2014-11-18 18:10 - 2014-11-18 18:10 - 00000000 ____D () C:\Program Files\HitmanPro
2014-11-18 18:09 - 2014-11-18 18:09 - 11222744 _____ (SurfRight B.V.) C:\Users\Bashaws\Downloads\HitmanPro_x64.exe
2014-11-18 17:56 - 2014-11-18 17:56 - 01707532 _____ (Thisisu) C:\Users\Bashaws\Downloads\JRT.exe
2014-11-18 17:56 - 2014-11-18 17:56 - 00000000 ____D () C:\windows\ERUNT
2014-11-18 17:47 - 2014-11-18 17:50 - 00000000 ____D () C:\AdwCleaner
2014-11-18 17:46 - 2014-11-18 17:46 - 02140160 _____ () C:\Users\Bashaws\Downloads\adwcleaner_4.101.exe
2014-11-18 17:45 - 2014-11-21 16:26 - 00050684 _____ () C:\Users\Bashaws\Downloads\Result.txt
2014-11-18 17:44 - 2014-11-18 17:44 - 00401920 _____ (Farbar) C:\Users\Bashaws\Downloads\MiniToolBox.exe
2014-11-18 16:54 - 2014-11-18 16:54 - 01055936 _____ (Adobe) C:\Users\Bashaws\Downloads\install_flashplayer15x32_mssa_aaa_aih.exe
2014-11-18 16:47 - 2014-11-10 22:08 - 00728064 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2014-11-18 16:47 - 2014-11-10 22:08 - 00241152 _____ (Microsoft Corporation) C:\windows\system32\pku2u.dll
2014-11-18 16:47 - 2014-11-10 21:44 - 00550912 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2014-11-18 16:47 - 2014-11-10 21:44 - 00186880 _____ (Microsoft Corporation) C:\windows\SysWOW64\pku2u.dll
2014-11-17 21:00 - 2014-11-17 21:08 - 00000000 ____D () C:\Users\Bashaws\Desktop\Old Firefox Data
2014-11-17 20:42 - 2014-11-17 20:42 - 00002261 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-11-17 20:42 - 2014-11-17 20:42 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-11-17 20:41 - 2014-11-17 20:41 - 00880784 _____ (Google Inc.) C:\Users\Bashaws\Downloads\ChromeSetup.exe
2014-11-17 20:26 - 2014-11-17 20:26 - 00001108 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-11-17 20:25 - 2014-11-17 20:25 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025(2).exe
2014-11-17 20:24 - 2014-11-17 20:24 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025(1).exe
2014-11-17 20:23 - 2014-11-17 20:23 - 19828376 _____ (Malwarebytes Corporation ) C:\Users\Bashaws\Downloads\mbam-setup-2.0.3.1025.exe
2014-11-17 14:39 - 2014-11-17 14:39 - 00000000 ____D () C:\ProgramData\Oracle
2014-11-17 14:35 - 2014-11-17 14:42 - 00000000 ____D () C:\ProgramData\Unchecky
2014-11-17 14:34 - 2014-11-17 19:09 - 00003322 _____ () C:\windows\System32\Tasks\SuperFastPC_AutorunOnStartup
2014-11-17 14:34 - 2014-11-17 14:34 - 29405096 _____ (Oracle Corporation) C:\Users\Bashaws\Downloads\JavaRuntimeEnvironmentSetup.exe
2014-11-17 14:32 - 2014-11-17 14:32 - 00860576 _____ ( ) C:\Users\Bashaws\Downloads\JavaSetup.exe
2014-11-17 00:44 - 2014-11-17 00:44 - 00003110 _____ () C:\windows\System32\Tasks\{EE798A9B-0592-4486-A96B-51EFD6F03341}
2014-11-16 23:16 - 2014-11-17 19:09 - 00000552 _____ () C:\windows\SysWOW64\schtasks.bin
2014-11-16 23:00 - 2014-11-16 23:00 - 00000000 ____D () C:\ProgramData\COMODO
2014-11-16 23:00 - 2014-11-16 23:00 - 00000000 ____D () C:\Program Files\COMODO
2014-11-16 22:59 - 2014-11-16 23:00 - 42533968 _____ (Google Inc.) C:\Users\Bashaws\Downloads\ChromeStandaloneSetup.exe
2014-11-16 22:56 - 2014-11-20 19:50 - 00000000 ____D () C:\Users\Bashaws\AppData\Local\33C1FBAC-DF5D-9DDB-AE00-000000B100
2014-11-16 22:55 - 2014-11-16 22:55 - 00000000 ____D () C:\c3f6beae-d430-4a21-802a-4c703bc75b60
2014-11-16 22:51 - 2014-11-16 22:51 - 00844552 _____ () C:\Users\Bashaws\Downloads\chrome-setup (1).exe
2014-11-16 22:49 - 2014-11-17 14:25 - 00000000 ___HD () C:\Users\Public\Temp
2014-11-16 22:49 - 2014-11-16 22:50 - 00844552 _____ () C:\Users\Bashaws\Downloads\chrome-setup.exe
2014-11-16 22:45 - 2014-11-16 22:45 - 00844560 _____ () C:\Users\Bashaws\Downloads\adobeflashplayer15betastandalone-setup (1).exe
2014-11-16 22:44 - 2014-11-16 22:44 - 00844560 _____ () C:\Users\Bashaws\Downloads\adobeflashplayer15betastandalone-setup.exe
2014-11-16 22:30 - 2014-11-16 22:30 - 00001238 _____ () C:\ProgramData\tempimage.bmp
2014-11-16 22:16 - 2014-11-16 22:16 - 00003468 _____ () C:\windows\System32\Tasks\ProPCCleaner_Popup
2014-11-16 22:16 - 2014-11-16 22:16 - 00003204 _____ () C:\windows\System32\Tasks\ProPCCleaner_Start
2014-11-16 22:03 - 2014-11-16 22:03 - 00000007 _____ () C:\Users\Bashaws\AppData\Roaming\handle.txt
2014-11-16 20:28 - 2014-11-16 20:28 - 00000000 __SHD () C:\Users\Bashaws\AppData\Local\EmieBrowserModeList
2014-11-16 20:22 - 2014-11-16 20:22 - 00000000 ____D () C:\Users\Bashaws\AppData\Local\IsolatedStorage
2014-11-16 20:18 - 2014-11-16 20:18 - 00399224 _____ (Installer Pack ) C:\Users\Bashaws\Downloads\Java_Setup.exe
2014-11-16 20:18 - 2014-11-16 20:18 - 00399224 _____ (Installer Pack ) C:\Users\Bashaws\Downloads\Java_Setup (1).exe
2014-11-14 14:12 - 2014-11-14 14:12 - 00033481 _____ () C:\Users\Bashaws\Downloads\TS102807616.dotx
2014-11-14 14:09 - 2014-11-14 14:09 - 00026112 _____ () C:\Users\Bashaws\Downloads\TS006369284.dot
2014-11-12 13:44 - 2014-11-12 13:44 - 00344843 _____ () C:\Users\Bashaws\Desktop\Unemployment application Submission.xps
2014-11-12 13:27 - 2014-11-12 13:27 - 00449562 _____ () C:\Users\Bashaws\Desktop\Unemployment application.xps
2014-11-11 20:33 - 2014-11-07 14:49 - 00388272 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2014-11-11 20:33 - 2014-11-07 14:23 - 00341168 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2014-11-11 20:33 - 2014-11-05 23:04 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2014-11-11 20:33 - 2014-11-05 23:03 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2014-11-11 20:33 - 2014-11-05 22:47 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2014-11-11 20:33 - 2014-11-05 22:46 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2014-11-11 20:33 - 2014-11-05 22:43 - 02884096 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2014-11-11 20:33 - 2014-11-05 22:36 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2014-11-11 20:33 - 2014-11-05 22:35 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2014-11-11 20:33 - 2014-11-05 22:31 - 00633856 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2014-11-11 20:33 - 2014-11-05 22:30 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2014-11-11 20:33 - 2014-11-05 22:30 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2014-11-11 20:33 - 2014-11-05 22:28 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2014-11-11 20:33 - 2014-11-05 22:20 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2014-11-11 20:33 - 2014-11-05 22:16 - 00490496 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2014-11-11 20:33 - 2014-11-05 22:13 - 00501248 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2014-11-11 20:33 - 2014-11-05 22:13 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2014-11-11 20:33 - 2014-11-05 22:12 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2014-11-11 20:33 - 2014-11-05 22:10 - 19781632 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2014-11-11 20:33 - 2014-11-05 22:10 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2014-11-11 20:33 - 2014-11-05 22:07 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2014-11-11 20:33 - 2014-11-05 22:05 - 02277376 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2014-11-11 20:33 - 2014-11-05 22:04 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2014-11-11 20:33 - 2014-11-05 22:03 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2014-11-11 20:33 - 2014-11-05 22:00 - 00478208 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2014-11-11 20:33 - 2014-11-05 22:00 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2014-11-11 20:33 - 2014-11-05 21:59 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2014-11-11 20:33 - 2014-11-05 21:58 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2014-11-11 20:33 - 2014-11-05 21:57 - 00316928 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2014-11-11 20:33 - 2014-11-05 21:48 - 00418304 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2014-11-11 20:33 - 2014-11-05 21:42 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-11-11 20:33 - 2014-11-05 21:41 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2014-11-11 20:33 - 2014-11-05 21:41 - 00716800 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2014-11-11 20:33 - 2014-11-05 21:38 - 02124288 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2014-11-11 20:33 - 2014-11-05 21:37 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2014-11-11 20:33 - 2014-11-05 21:36 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2014-11-11 20:33 - 2014-11-05 21:34 - 00285696 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2014-11-11 20:33 - 2014-11-05 21:30 - 14390272 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2014-11-11 20:33 - 2014-11-05 21:22 - 00688640 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2014-11-11 20:33 - 2014-11-05 21:21 - 04298240 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2014-11-11 20:33 - 2014-11-05 21:21 - 02051072 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2014-11-11 20:33 - 2014-11-05 21:20 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2014-11-11 20:33 - 2014-11-05 21:04 - 01550336 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2014-11-11 20:33 - 2014-11-05 21:03 - 12819456 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2014-11-11 20:33 - 2014-11-05 20:53 - 00799232 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2014-11-11 20:33 - 2014-11-05 20:52 - 01892864 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2014-11-11 20:33 - 2014-11-05 20:48 - 01310208 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2014-11-11 20:33 - 2014-11-05 20:47 - 00708096 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2014-11-11 20:33 - 2014-11-05 12:56 - 00304640 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2014-11-11 20:33 - 2014-11-05 12:56 - 00228864 _____ (Microsoft Corporation) C:\windows\system32\aepdu.dll
2014-11-11 20:33 - 2014-11-05 12:52 - 00424448 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2014-11-11 20:33 - 2014-10-13 21:16 - 00155064 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2014-11-11 20:33 - 2014-10-13 21:13 - 00683520 _____ (Microsoft Corporation) C:\windows\system32\termsrv.dll
2014-11-11 20:33 - 2014-10-13 21:12 - 01460736 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2014-11-11 20:33 - 2014-10-13 21:09 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2014-11-11 20:33 - 2014-10-13 21:07 - 00681984 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2014-11-11 20:33 - 2014-10-13 20:50 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2014-11-11 20:33 - 2014-10-13 20:49 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2014-11-11 20:33 - 2014-10-13 20:47 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2014-11-11 20:33 - 2014-10-13 20:46 - 00681984 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2014-11-11 20:32 - 2014-11-05 23:03 - 25110016 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2014-11-11 20:32 - 2014-11-05 22:46 - 00580096 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2014-11-11 20:32 - 2014-11-05 22:44 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2014-11-11 20:32 - 2014-11-05 22:29 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2014-11-11 20:32 - 2014-11-05 22:23 - 06040064 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2014-11-11 20:32 - 2014-11-05 22:02 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2014-11-11 20:32 - 2014-11-05 21:39 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2014-11-11 20:32 - 2014-11-05 21:17 - 02365440 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2014-11-11 20:32 - 2014-10-02 21:12 - 00500224 _____ (Microsoft Corporation) C:\windows\system32\AUDIOKSE.dll
2014-11-11 20:32 - 2014-10-02 21:11 - 00680960 _____ (Microsoft Corporation) C:\windows\system32\audiosrv.dll
2014-11-11 20:32 - 2014-10-02 21:11 - 00440832 _____ (Microsoft Corporation) C:\windows\system32\AudioEng.dll
2014-11-11 20:32 - 2014-10-02 21:11 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\AudioSes.dll
2014-11-11 20:32 - 2014-10-02 21:11 - 00284672 _____ (Microsoft Corporation) C:\windows\system32\EncDump.dll
2014-11-11 20:32 - 2014-10-02 20:44 - 00442880 _____ (Microsoft Corporation) C:\windows\SysWOW64\AUDIOKSE.dll
2014-11-11 20:32 - 2014-10-02 20:44 - 00374784 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioEng.dll
2014-11-11 20:32 - 2014-10-02 20:44 - 00195584 _____ (Microsoft Corporation) C:\windows\SysWOW64\AudioSes.dll
2014-11-11 20:32 - 2014-08-21 01:43 - 01882624 _____ (Microsoft Corporation) C:\windows\system32\msxml3.dll
2014-11-11 20:32 - 2014-08-21 01:40 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\msxml3r.dll
2014-11-11 20:32 - 2014-08-21 01:26 - 01237504 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3.dll
2014-11-11 20:32 - 2014-08-21 01:23 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\msxml3r.dll
2014-11-11 20:32 - 2014-08-11 21:02 - 00878080 _____ (Microsoft Corporation) C:\windows\system32\IMJP10K.DLL
2014-11-11 20:32 - 2014-08-11 20:36 - 00701440 _____ (Microsoft Corporation) C:\windows\SysWOW64\IMJP10K.DLL
2014-11-11 20:31 - 2014-10-24 20:57 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\packager.dll
2014-11-11 20:31 - 2014-10-24 20:32 - 00067584 _____ (Microsoft Corporation) C:\windows\SysWOW64\packager.dll
2014-11-11 20:31 - 2014-10-17 21:05 - 00861696 _____ (Microsoft Corporation) C:\windows\system32\oleaut32.dll
2014-11-11 20:31 - 2014-10-17 20:33 - 00571904 _____ (Microsoft Corporation) C:\windows\SysWOW64\oleaut32.dll
2014-11-11 20:31 - 2014-10-13 21:13 - 03241984 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2014-11-11 20:31 - 2014-10-13 20:50 - 02363904 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2014-11-11 20:31 - 2014-10-09 19:57 - 03198976 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-11-11 20:31 - 2014-09-19 04:42 - 00342016 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2014-11-11 20:31 - 2014-09-19 04:42 - 00314880 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2014-11-11 20:31 - 2014-09-19 04:42 - 00309760 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2014-11-11 20:31 - 2014-09-19 04:42 - 00210944 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2014-11-11 20:31 - 2014-09-19 04:42 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2014-11-11 20:31 - 2014-09-19 04:42 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2014-11-11 20:31 - 2014-09-19 04:23 - 00259584 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2014-11-11 20:31 - 2014-09-19 04:23 - 00248832 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2014-11-11 20:31 - 2014-09-19 04:23 - 00221184 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2014-11-11 20:31 - 2014-09-19 04:23 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2014-11-11 20:31 - 2014-09-19 04:23 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2014-11-11 20:31 - 2014-09-19 04:23 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2014-11-11 16:07 - 2014-11-17 00:44 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-11-10 11:39 - 2014-11-10 11:39 - 00061049 _____ () C:\Users\Bashaws\Desktop\Veteran & Military Services Coordinator.xps
2014-11-07 11:06 - 2014-11-07 11:06 - 00129739 _____ () C:\Users\Bashaws\Desktop\Frontier reward..xps
2014-11-06 21:46 - 2014-11-06 21:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iCloud
2014-10-24 20:31 - 2014-10-24 20:31 - 00000000 ____D () C:\Users\Bashaws\AppData\Roaming\MathematicaPlayer
2014-10-24 20:31 - 2014-10-24 20:31 - 00000000 ____D () C:\Users\Bashaws\AppData\Local\MathematicaPlayer
2014-10-24 20:31 - 2014-10-24 20:31 - 00000000 ____D () C:\ProgramData\MathematicaPlayer
2014-10-24 20:30 - 2014-10-24 20:30 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wolfram CDF Player
2014-10-24 20:30 - 2014-10-24 20:30 - 00000000 ____D () C:\ProgramData\Mathematica
2014-10-24 20:30 - 2014-10-24 20:30 - 00000000 ____D () C:\Program Files\Extras
2014-10-24 20:30 - 2014-10-24 20:30 - 00000000 ____D () C:\Program Files\Common Files\Wolfram Research
2014-10-24 20:29 - 2013-02-07 18:39 - 00369968 _____ (Wolfram Research, Inc.) C:\windows\SysWOW64\ml32i3.dll
2014-10-24 20:29 - 2013-02-07 18:39 - 00360752 _____ (Wolfram Research, Inc.) C:\windows\SysWOW64\mltcpip32.mlp
2014-10-24 20:29 - 2013-02-07 18:39 - 00258864 _____ (Wolfram Research, Inc.) C:\windows\SysWOW64\ml32i2.dll
2014-10-24 20:29 - 2013-02-07 18:39 - 00252720 _____ (Wolfram Research, Inc.) C:\windows\SysWOW64\ml32i1.dll
2014-10-24 20:29 - 2013-02-07 18:39 - 00173360 _____ (Wolfram Research, Inc.) C:\windows\SysWOW64\mlmodule32.dll
2014-10-24 20:29 - 2013-02-07 18:39 - 00095536 _____ (Wolfram Research, Inc.) C:\windows\SysWOW64\mltcp32.mlp
2014-10-24 20:29 - 2013-02-07 18:39 - 00088368 _____ (Wolfram Research, Inc.) C:\windows\SysWOW64\mlshm32.mlp
2014-10-24 20:29 - 2013-02-07 18:39 - 00078128 _____ (Wolfram Research, Inc.) C:\windows\SysWOW64\mlmap32.mlp
2014-10-24 20:28 - 2014-10-24 20:28 - 00000000 ____D () C:\Program Files (x86)\Wolfram Research
2014-10-24 20:24 - 2014-10-24 20:26 - 201814584 _____ (Wolfram Research, Inc. ) C:\Users\Bashaws\Downloads\CDFPlayer_9.0.1_WIN.exe
2014-10-23 17:39 - 2014-10-23 17:39 - 00001847 _____ () C:\Users\Public\Desktop\QuickTime Player.lnk
2014-10-23 17:39 - 2014-10-23 17:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
2014-10-23 17:38 - 2014-10-23 17:39 - 00000000 ____D () C:\Program Files (x86)\QuickTime

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-21 16:39 - 2012-08-15 20:01 - 00000898 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-21 16:36 - 2012-08-12 08:54 - 00000000 ____D () C:\Users\Bashaws\AppData\Roaming\Spotify
2014-11-21 16:35 - 2012-08-15 06:22 - 00000830 _____ () C:\windows\Tasks\Adobe Flash Player Updater.job
2014-11-21 15:03 - 2009-07-13 23:45 - 00024608 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-21 15:03 - 2009-07-13 23:45 - 00024608 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-21 14:58 - 2012-08-11 02:31 - 01710903 _____ () C:\windows\WindowsUpdate.log
2014-11-21 14:57 - 2012-08-13 05:53 - 00000000 ____D () C:\Users\Bashaws\AppData\Local\CrashDumps
2014-11-21 14:57 - 2012-08-11 14:39 - 00003942 _____ () C:\windows\System32\Tasks\User_Feed_Synchronization-{3861E564-79D6-4D7B-87FE-43F49E84FDB7}
2014-11-21 14:56 - 2013-11-10 23:42 - 00000000 ____D () C:\Temp
2014-11-21 14:56 - 2012-08-15 20:01 - 00000894 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-21 14:55 - 2014-07-03 16:40 - 00129752 _____ (Malwarebytes Corporation) C:\windows\system32\Drivers\MBAMSwissArmy.sys
2014-11-21 14:55 - 2012-05-19 16:01 - 00000000 ____D () C:\ProgramData\PDFC
2014-11-21 14:55 - 2009-07-14 00:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-11-21 14:55 - 2009-07-13 23:51 - 00103908 _____ () C:\windows\setupact.log
2014-11-21 14:22 - 2014-08-31 16:59 - 00000340 _____ () C:\windows\Tasks\HPCeeScheduleForBashaws.job
2014-11-21 14:22 - 2010-11-20 22:47 - 00964620 _____ () C:\windows\PFRO.log
2014-11-21 13:38 - 2014-08-31 16:59 - 00003198 _____ () C:\windows\System32\Tasks\HPCeeScheduleForBashaws
2014-11-21 13:38 - 2012-08-11 02:32 - 00000000 ____D () C:\Users\Bashaws
2014-11-21 12:49 - 2010-11-21 02:16 - 00000000 ____D () C:\windows\ShellNew
2014-11-20 20:01 - 2014-09-07 09:12 - 00000000 ____D () C:\Users\Bashaws\AppData\Local\Adobe
2014-11-19 12:44 - 2012-08-12 08:55 - 00000000 ____D () C:\Users\Bashaws\AppData\Local\Spotify
2014-11-17 20:58 - 2009-07-14 00:08 - 00032554 _____ () C:\windows\Tasks\SCHEDLGU.TXT
2014-11-17 20:46 - 2014-07-03 06:06 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-11-17 20:43 - 2012-08-15 20:01 - 00000000 ____D () C:\Users\Bashaws\AppData\Local\Google
2014-11-17 20:42 - 2012-08-15 20:01 - 00000000 ____D () C:\Program Files (x86)\Google
2014-11-17 20:26 - 2014-07-03 06:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-11-17 20:17 - 2013-11-10 23:43 - 00000000 ____D () C:\Users\Bashaws\.gstreamer-0.10
2014-11-17 20:17 - 2013-11-10 23:37 - 00000000 ____D () C:\Users\Bashaws\AppData\Roaming\MotoCast
2014-11-17 20:08 - 2009-07-13 22:20 - 00000000 ____D () C:\windows\system32\NDF
2014-11-17 19:15 - 2009-07-14 00:13 - 00783424 _____ () C:\windows\system32\PerfStringBackup.INI
2014-11-17 14:44 - 2009-07-13 21:34 - 00000580 _____ () C:\windows\win.ini
2014-11-17 00:42 - 2012-05-19 16:00 - 00000000 ____D () C:\Program Files (x86)\Adobe
2014-11-16 22:50 - 2009-07-13 22:20 - 00000000 ____D () C:\windows\Resources
2014-11-14 19:34 - 2012-08-15 20:01 - 00003894 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-11-14 19:34 - 2012-08-15 20:01 - 00003642 _____ () C:\windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-11-12 16:00 - 2012-08-11 14:48 - 00000000 ____D () C:\Users\Bashaws\Desktop\Jason's School Paperwork
2014-11-12 15:35 - 2012-08-15 06:22 - 00701104 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerApp.exe
2014-11-12 15:35 - 2012-08-15 06:22 - 00003768 _____ () C:\windows\System32\Tasks\Adobe Flash Player Updater
2014-11-12 15:35 - 2012-05-19 15:59 - 00071344 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-11-12 11:55 - 2009-07-13 22:20 - 00000000 ____D () C:\windows\rescache
2014-11-12 10:48 - 2009-07-13 23:45 - 00432424 _____ () C:\windows\system32\FNTCACHE.DAT
2014-11-12 10:46 - 2014-05-18 02:18 - 00000000 ___SD () C:\windows\system32\CompatTel
2014-11-11 23:37 - 2012-09-05 05:51 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-11-11 23:34 - 2013-08-14 06:24 - 00000000 ____D () C:\windows\system32\MRT
2014-11-11 23:31 - 2012-08-14 19:28 - 103374192 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-11-11 21:24 - 2014-06-25 20:28 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-11-09 21:44 - 2013-02-24 20:29 - 00000000 _____ () C:\windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-11-09 21:44 - 2012-08-12 19:52 - 00000052 _____ () C:\windows\SysWOW64\DOErrors.log
2014-10-30 06:25 - 2010-11-20 22:27 - 00275080 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2014-10-24 20:36 - 2012-08-11 14:41 - 00116296 _____ () C:\Users\Bashaws\AppData\Local\GDIPFONTCACHEV1.DAT
2014-10-24 20:14 - 2014-08-05 20:11 - 00000000 ____D () C:\Users\Bashaws\AppData\Roaming\VERIZON
2014-10-24 20:07 - 2014-08-05 20:13 - 00000000 ____D () C:\Users\Bashaws\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Verizon

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-11-15 16:44

==================== End Of Log ============================
 

Jason Bashaw

New Member
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 20-11-2014
Ran by Bashaws at 2014-11-21 17:22:30
Running from C:\Users\Bashaws\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Microsoft Security Essentials (Enabled - Up to date) {4F35CFC4-45A3-FC37-EF17-759A02E39AB1}
AS: Microsoft Security Essentials (Enabled - Up to date) {F4542E20-6399-F3B9-D5A7-4EE87964D00C}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 2.6.0.19120 - Adobe Systems Incorporated)
Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.223 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{601B10F8-06B0-2EB1-CCAD-C3F7D7E32FD1}) (Version: 3.0.842.0 - Advanced Micro Devices, Inc.)
Amulet of Time: Shadow of La Rochelle (x32 Version: 3.0.2.32 - WildTangent) Hidden
Apple Application Support (HKLM-x32\...\{83CAF0DE-8D3B-4C37-A631-2B8F16EC3031}) (Version: 3.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}) (Version: 8.0.5.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bejeweled 3 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bing Bar (HKLM-x32\...\{9FA13759-5C2B-4177-9DDC-0038F8B5BEFD}) (Version: 7.0.826.0 - Microsoft Corporation)
Blackhawk Striker 2 (x32 Version: 2.2.0.95 - WildTangent) Hidden
Blio (HKLM-x32\...\{741006D1-7B2B-4E33-B2B0-831F282EEF64}) (Version: 2.2.8188 - K-NFB Reading Technology, Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bubble Wrap (HKLM-x32\...\{5BFFDDEB-AFD7-499F-BB13-7A6EAD927CDA}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Cases of Stolen Beauty (x32 Version: 2.2.0.110 - WildTangent) Hidden
Cheatbusters (x32 Version: 2.2.0.110 - WildTangent) Hidden
Chuzzle Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
City of Fools (x32 Version: 2.2.0.110 - WildTangent) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Criminal Minds (x32 Version: 2.2.0.110 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
Dora's World Adventure (x32 Version: 2.2.0.95 - WildTangent) Hidden
Eastville Chronicles: The Drama Queen Murder (x32 Version: 3.0.2.32 - WildTangent) Hidden
Facebook (HKLM-x32\...\{8AE50893-3A87-4439-9A57-942ED43F7189}) (Version: 1.1.0004 - Hewlett-Packard)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Farmscapes (x32 Version: 2.2.0.98 - WildTangent) Hidden
FATE (x32 Version: 2.2.0.97 - WildTangent) Hidden
Final Drive Fury (x32 Version: 2.2.0.95 - WildTangent) Hidden
Flash Player Pro V5.4 (HKLM-x32\...\Flash Player Pro_is1) (Version: - FlashPlayerPro.com)
Gem Smashers (x32 Version: 2.2.0.98 - WildTangent) Hidden
Ghost Whisperer (x32 Version: 3.0.2.32 - WildTangent) Hidden
Golden Trails 3: The Guardian's Creed Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.122 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Haunted Past Realm of Ghosts Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
Hidden Path of Faery (x32 Version: 3.0.2.32 - WildTangent) Hidden
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.9.232 - SurfRight B.V.)
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
Hoyle Card Games (x32 Version: 2.2.0.95 - WildTangent) Hidden
HP Application Assistant (HKLM\...\{B34A07DD-C6F7-414A-AE63-01019482EAF0}) (Version: 1.0.393.3870 - Hewlett-Packard)
HP Calendar (HKLM-x32\...\{2B38E0FA-D8A5-4EBF-A018-E3C1C8E7A2E2}) (Version: 5.1.4245.23508 - Hewlett-Packard)
HP Clock (HKLM-x32\...\{0EEC4E49-D4C2-4E23-87F2-B5641F1A09E4}) (Version: 5.1.4244.16367 - Hewlett-Packard)
HP Games (HKLM-x32\...\WildTangent hp Master Uninstall) (Version: 1.0.2.5 - WildTangent)
HP LinkUp (HKLM-x32\...\{7E750542-55BC-4300-8B7B-AC2A762FB435}) (Version: 2.01.029 - Hewlett-Packard)
HP Magic Canvas (HKLM-x32\...\{DDFDC9D6-4220-41F8-BF9A-8E7512C4EF52}) (Version: 5.1.15.0 - Hewlett-Packard)
HP Magic Canvas Tutorials (HKLM-x32\...\{858FCB65-7C6D-4BA4-AD80-A3CB3744CE09}_is1) (Version: 5.0.0.3 - Hewlett-Packard)
HP MovieStore (HKLM-x32\...\{9008D736-35CA-40DB-A2BE-5F32D954E5AA}) (Version: 2.1.21091.0 - Hewlett-Packard Company)
HP Notes (HKLM-x32\...\{86BAB08A-5E66-4C53-82E3-C1E91673C7CA}) (Version: 5.1.4274.30382 - Hewlett-Packard)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP RSS (HKLM-x32\...\{A35E58D6-2A0F-4051-983B-79342081338E}) (Version: 5.1.4301.21494 - Hewlett-Packard)
HP Setup (HKLM-x32\...\{F5E7D9AF-60F6-4A30-87E3-4EA94D322CE1}) (Version: 9.0.15130.3904 - Hewlett-Packard Company)
HP Setup Manager (HKLM-x32\...\{AE856388-AFAD-4753-81DF-D96B19D0A17C}) (Version: 1.2.15145.3905 - Hewlett-Packard Company)
HP Support Assistant (HKLM-x32\...\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
HP TouchSmart RecipeBox (HKLM-x32\...\{20714B53-FC73-4F9C-9687-49EB237D6FD7}) (Version: 3.0.3830.27730 - Hewlett-Packard)
HP Update (HKLM-x32\...\{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}) (Version: 5.003.001.001 - Hewlett-Packard)
HP Vision Hardware Diagnostics (HKLM\...\{D79A02E9-6713-4335-9668-AAC7474C0C0E}) (Version: 2.12.1.0 - Hewlett-Packard)
HP Weather (HKLM-x32\...\{8364E531-493B-4B05-8041-09D5CE38B975}) (Version: 5.1.4295.16450 - Hewlett-Packard)
iCloud (HKLM\...\{2AAF09D5-4B3F-4975-B6A9-ECE2631FC942}) (Version: 4.0.5.20 - Apple Inc.)
Idle Crawler (HKLM-x32\...\33C1FBAC-DF5D-9DDB-AE00-000000B100) (Version: 104.0.0.451 - MILE 27 LTD) <==== ATTENTION
Infected: The Twin Vaccine Collector's Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
iTunes (HKLM\...\{2ABBBD91-91E5-4AD7-929A-FE15D1DC0576}) (Version: 12.0.1.26 - Apple Inc.)
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Jewel Quest Mysteries: The Seventh Gate Collector's Edition (x32 Version: 2.2.0.98 - WildTangent) Hidden
John Deere Drive Green (x32 Version: 2.2.0.95 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Kobo (HKLM-x32\...\Kobo) (Version: 2.0.3 - Kobo Inc.)
LabelPrint (HKLM-x32\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.4507 - CyberLink Corp.)
LabelPrint (x32 Version: 2.5.4507 - CyberLink Corp.) Hidden
Legacy Tales: Mercy of the Gallows Collector's Edition (x32 Version: 3.0.2.51 - WildTangent) Hidden
Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Live Novels Jane Austin's Pride and Prejudice (x32 Version: 2.2.0.110 - WildTangent) Hidden
Luxor HD (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.0.3.1025 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.3.1025 - Malwarebytes Corporation)
Mathematica Extras 9.0 (4092550) (HKLM\...\A-WIN-Extras 9.0.1 4092550_is1) (Version: 9.0.1 - Wolfram Research, Inc.)
McAfee Security Scan Plus (HKLM\...\McAfee Security Scan) (Version: 3.8.150.1 - McAfee, Inc.)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Metric Converter (HKLM-x32\...\{D0661463-50F7-4A1E-83CB-37CC590589AE}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Mathematics (HKLM-x32\...\{4D090F70-6F08-4B60-9357-A1DFD4458F09}) (Version: 4.0 - Microsoft Corporation)
Microsoft Mouse and Keyboard Center (HKLM\...\Microsoft Mouse and Keyboard Center) (Version: 2.0.162.0 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version: - Microsoft)
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Click-to-Run 2010 (HKLM-x32\...\Office14.Click2Run) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Starter 2010 - English (HKLM-x32\...\{90140011-0066-0409-0000-0000000FF1CE}) (Version: 14.0.5139.5005 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.6.305.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319 (HKLM-x32\...\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
MotoCast (HKLM-x32\...\{5401CEE8-3C2D-4835-A802-213306537FF4}) (Version: 2.0.31 - Motorola Mobility)
Motorola Device Manager (HKLM-x32\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.2.35 - Motorola Mobility)
Motorola Device Software Update (x32 Version: 1.0.41 - Motorola Mobility) Hidden
MOTOROLA MEDIA LINK (x32 Version: 1.9.0002.0 - Motorola) Hidden
Motorola Mobile Drivers Installation 5.9.0 (Version: 5.9.0 - Motorola Inc.) Hidden
Mozilla Firefox 33.1 (x86 en-US) (HKLM-x32\...\Mozilla Firefox 33.1 (x86 en-US)) (Version: 33.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
Mysteries of Ancient Inventors (x32 Version: 3.0.2.32 - WildTangent) Hidden
Mystery Murders: The Sleeping Palace (x32 Version: 3.0.2.51 - WildTangent) Hidden
Mystery P.I. - Curious Case of Counterfeit Cove (x32 Version: 2.2.0.98 - WildTangent) Hidden
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDF Complete Special Edition (HKLM-x32\...\PDF Complete) (Version: 4.0.65 - PDF Complete, Inc)
Penguins! (x32 Version: 2.2.0.98 - WildTangent) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
PlayReady PC Runtime x86 (HKLM-x32\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Poker Superstars III (x32 Version: 2.2.0.95 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Polar Golfer (x32 Version: 2.2.0.98 - WildTangent) Hidden
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.5706 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.5706 - CyberLink Corp.) Hidden
PressReader (HKLM-x32\...\{912CED74-88D3-4C5B-ACB0-132318649765}) (Version: 5.11.0721.0 - NewspaperDirect Inc.)
QuickTime 7 (HKLM-x32\...\{3D2CBC2C-65D4-4463-87AB-BB2C859C1F3E}) (Version: 7.76.80.95 - Apple Inc.)
Ralink 802.11n Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.25.0 - Mediatek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6531 - Realtek Semiconductor Corp.)
Recovery Manager (x32 Version: 5.5.0.4424 - CyberLink Corp.) Hidden
Redemption Cemetery: Childrens Plight (x32 Version: 3.0.2.51 - WildTangent) Hidden
Remote Graphics Receiver (HKLM-x32\...\{16FC3056-90C0-4757-8A68-64D8DA846ADA}) (Version: 5.4.5 - Hewlett-Packard)
RollerCoaster Tycoon 3: Platinum (x32 Version: 2.2.0.98 - WildTangent) Hidden
Sacra Terra: Kiss of Death Collector's Edition (x32 Version: 3.0.2.48 - WildTangent) Hidden
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.45.0 - SAMSUNG Electronics Co., Ltd.)
Shadow Shelter (x32 Version: 3.0.2.59 - WildTangent) Hidden
Sisters Secrecy: Arcanum Bloodlines Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Special Enquiry Detail: Engaged to Kill (x32 Version: 2.2.0.110 - WildTangent) Hidden
Spirits and Curses 3 in 1 Bundle (x32 Version: 3.0.2.32 - WildTangent) Hidden
Spot (HKLM-x32\...\{3D171340-B528-42E0-92E4-BDA7AEEF6F32}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Spotify (HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\Spotify) (Version: 0.9.14.13.gba5645ad - Spotify AB)
SUABnR (HKLM-x32\...\InstallShield_{2485354C-6B65-4978-BB91-CCE61442377B}) (Version: 1.1.0.13103_1 - Samsung Electronics Co., Ltd.)
SUABnR (x32 Version: 1.1.0.13103_1 - Samsung Electronics Co., Ltd.) Hidden
Tap Tap Bear (HKLM-x32\...\{A393CDFF-BEB8-48EA-990D-2EB35B311D23}_is1) (Version: 1.0.0.0 - XM Asia Pacific Pte Ltd)
Tearstone (x32 Version: 3.0.2.32 - WildTangent) Hidden
The Lake House: Children of Silence (x32 Version: 3.0.2.48 - WildTangent) Hidden
The Princess Case: A Royal Scoop (x32 Version: 2.2.0.110 - WildTangent) Hidden
The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden
Theatre of the Absurd Collector's Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Titanic's Keys to the Past (x32 Version: 3.0.2.32 - WildTangent) Hidden
Torchlight (x32 Version: 2.2.0.98 - WildTangent) Hidden
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version: - Microsoft)
Update Installer for WildTangent Games App (x32 Version: - WildTangent) Hidden
Verizon Wireless Software Upgrade Assistant - Samsung(ar) (HKLM-x32\...\{D31032BD-B70C-4E1E-8BE3-0B870A910983}) (Version: 2.14.1002 - Samsung Electronics Co., Ltd.)
Verizon Wireless Software Utility Application for Android - Samsung (HKLM-x32\...\{74870974-832F-42D3-8047-D87A5A722CC3}) (Version: 2.14.1002 - Samsung Electronics Co., Ltd.)
Victorian Mysteries®: The Yellow Room (x32 Version: 2.2.0.110 - WildTangent) Hidden
Virtual Villagers 4 - The Tree of Life (x32 Version: 2.2.0.98 - WildTangent) Hidden
WildTangent Games (HKLM-x32\...\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App for HP (x32 Version: 4.0.11.2 - WildTangent) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Wolfram CDF Player (M-WIN-D 9.0.1 4092685) (HKLM-x32\...\M-WIN-D 9.0.1 4092685_is1) (Version: 9.0.1 - Wolfram Research, Inc.)
Youda Legend - The Curse of the Amsterdam Diamond (x32 Version: 2.2.0.110 - WildTangent) Hidden
Youda Legend: The Golden Bird of Paradise (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zinio Reader 4 (HKLM-x32\...\ZinioReader4) (Version: 4.2.4164 - Zinio LLC)
Zinio Reader 4 (x32 Version: 4.2.4164 - Zinio LLC) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points =========================

17-11-2014 05:01:04 Removed GeekBuddy.
17-11-2014 05:01:56 Removed GeekBuddy.
17-11-2014 05:06:17 Removed PCKeeper Live
17-11-2014 05:07:52 Removed KromtechAccountService
17-11-2014 19:35:39 Windows Update
18-11-2014 01:38:23 Removed Java 7 Update 60
18-11-2014 01:38:52 Removed Java 7 Update 60
18-11-2014 23:25:47 Checkpoint by HitmanPro
18-11-2014 23:27:20 Checkpoint by HitmanPro
19-11-2014 02:32:33 Windows Update
19-11-2014 18:49:22 Windows Update
21-11-2014 17:37:02 zoek.exe restore point
21-11-2014 18:05:57 zoek.exe restore point

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:34 - 2014-11-17 19:14 - 00000824 ____A C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0485BEA3-8C61-413E-843C-7B4FE8C395F6} - System32\Tasks\MotoCast Update => C:\Program Files (x86)\Motorola Mobility\MotoCast\LiveUpdate\MotoCastUpdate.exe [2012-07-24] ()
Task: {08341E72-2AB0-43C2-8201-680DD64A977E} - System32\Tasks\OfficeSoftwareProtectionPlatform\SvcRestartTask => Sc.exe start osppsvc
Task: {10663282-FA8C-455D-A679-D89136F671CE} - \TidyNetwork Update No Task File <==== ATTENTION
Task: {11455AF1-7FBA-47AD-B370-9095BB2CEB44} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2012-09-28] ()
Task: {1A33FBFD-A7C9-46C7-899C-E851F4CB8648} - \DonutQuotes No Task File <==== ATTENTION
Task: {30058EAB-FF69-4E29-A9D7-93772F82894C} - System32\Tasks\Microsoft_Hardware_Launch_mousekeyboardcenter_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\mousekeyboardcenter.exe [2012-11-02] (Microsoft)
Task: {4ADC568E-9EAB-4A78-BA22-3374CE45F44E} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {7109D38D-0514-4C4C-A793-037ED8B5FC07} - System32\Tasks\Microsoft_Hardware_Launch_itype_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe [2012-11-02] (Microsoft Corporation)
Task: {8762A54A-9F62-4007-BA4C-61D536821E32} - System32\Tasks\Microsoft_Hardware_Launch_ipoint_exe => C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [2012-11-02] (Microsoft Corporation)
Task: {92D7D6A2-C4DE-4F0B-8EAB-9D6E2E2EE226} - \Microsoft\Windows\Maintenance\Update IC No Task File <==== ATTENTION
Task: {93F94E84-0AEF-48A4-A676-8AA795B3BB89} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(Yes) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe
Task: {95102F30-E144-4351-A2DA-9CA8C5DB31EF} - System32\Tasks\SuperFastPC_AutorunOnStartup => C:\Program Files (x86)\System Optimizer Pro\SystemOptimizerPro.exe <==== ATTENTION
Task: {9BFF89C7-7E8F-4392-9173-3FF4FDAE6E7B} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {A03EA460-8E33-41F4-BE68-34D46AE15531} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {A1A68AD5-9D42-431E-947E-28B97D456D35} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {B8EE0691-BD9C-4C08-A388-50411800A269} - System32\Tasks\HPCeeScheduleForBashaws => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {BC371A34-1A42-40E0-B85D-18C2E506D13D} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-09-22] (Hewlett-Packard)
Task: {CD594538-B24D-4420-B798-46436FF20F67} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Warranty Opt-In(No) => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\Detection_PostWarrantyAlert.exe
Task: {D5C84DE2-B17E-438D-B471-B4A395101933} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-11-12] (Adobe Systems Incorporated)
Task: {D666DD41-AEAE-43DD-9A9A-9980002042DE} - System32\Tasks\ProPCCleaner_Popup => C:\Program Files (x86)\Pro PC Cleaner\Splash.exe
Task: {DF6819C2-842B-4CCB-9C65-E96AF5995B5F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-10-25] (Google Inc.)
Task: {EDBF0B61-F087-4A3B-A051-78EB09E3C39A} - \Runner IC No Task File <==== ATTENTION
Task: {F56223AB-4092-4343-8A18-922C07A1C037} - System32\Tasks\ProPCCleaner_Start => C:\Program Files (x86)\Pro PC Cleaner\ProPCCleaner.exe
Task: {F5DF1379-E75D-4214-B22B-010DA47FF398} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {F900ED64-95DA-4947-8ABE-1424BDBD9504} - System32\Tasks\Hewlett-Packard\HP Support Assistant\WarrantyChecker_DeviceScan => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPWarrantyCheck\HPWarrantyChecker.exe [2014-09-22] (Hewlett-Packard)
Task: {F9853568-2FF3-4579-9983-3A7D172AA094} - System32\Tasks\Motorola Device Manager Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2012-09-28] ()
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\HPCeeScheduleForBashaws.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2012-10-02 13:45 - 2012-10-02 13:45 - 00120728 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
2012-10-02 13:41 - 2012-10-02 13:41 - 00694168 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
2013-09-25 05:50 - 2014-10-11 20:13 - 00613944 _____ () C:\Users\Bashaws\AppData\Roaming\Spotify\Data\SpotifyHelper.exe
2011-09-08 15:53 - 2011-09-08 15:53 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-08-02 14:41 - 2011-08-02 14:41 - 00098304 _____ () c:\Program Files (x86)\ATI Technologies\ATI.ACE\Branding\Branding.dll
2014-01-20 13:17 - 2014-01-20 13:17 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-10-11 12:05 - 2014-10-11 12:05 - 01044776 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-09-07 21:35 - 2012-09-07 21:35 - 00128960 _____ () C:\Program Files (x86)\Motorola Media Link\Lite\liveupdatetactics.dll
2012-09-07 21:35 - 2012-09-07 21:35 - 00024496 _____ () C:\Program Files (x86)\Motorola Media Link\Lite\DbAccess.dll
2012-09-07 21:37 - 2012-09-07 21:37 - 00466256 _____ () C:\Program Files (x86)\Motorola Media Link\Lite\sqlite3.dll
2012-09-07 21:36 - 2012-09-07 21:36 - 00045992 _____ () C:\Program Files (x86)\Motorola Media Link\Lite\NAdvLog.dll
2012-09-07 21:36 - 2012-09-07 21:36 - 00034752 _____ () C:\Program Files (x86)\Motorola Media Link\Lite\NFileCacheDBAccess.dll
2012-09-26 16:57 - 2012-09-26 16:57 - 00172032 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\css_core.dll
2012-08-12 08:55 - 2014-10-11 20:13 - 36966968 _____ () C:\Users\Bashaws\AppData\Roaming\Spotify\Data\libcef.dll
2014-07-09 17:38 - 2014-10-11 20:13 - 00867896 _____ () C:\Users\Bashaws\AppData\Roaming\Spotify\Data\ffmpegsumo.dll
2013-09-25 05:50 - 2014-10-11 20:13 - 00886840 _____ () C:\Users\Bashaws\AppData\Roaming\Spotify\Data\libglesv2.dll
2013-09-25 05:50 - 2014-10-11 20:13 - 00108600 _____ () C:\Users\Bashaws\AppData\Roaming\Spotify\Data\libegl.dll
2014-11-11 16:07 - 2014-11-11 16:07 - 03649648 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
2014-11-12 15:35 - 2014-11-12 15:35 - 16840880 _____ () C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-2842075429-1242635110-2963454771-500 - Administrator - Disabled)
Bashaws (S-1-5-21-2842075429-1242635110-2963454771-1001 - Administrator - Enabled) => C:\Users\Bashaws
Guest (S-1-5-21-2842075429-1242635110-2963454771-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-2842075429-1242635110-2963454771-1002 - Limited - Enabled)

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft Teredo Tunneling Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/21/2014 02:57:09 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0xdf0
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/21/2014 02:23:40 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x10e8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/21/2014 02:18:37 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 33.1.0.5423, time stamp: 0x545c0a59
Faulting module name: mozalloc.dll, version: 33.1.0.5423, time stamp: 0x545be5ee
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x162c
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (11/21/2014 01:37:58 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x7c8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/21/2014 01:29:23 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 33.1.0.5423, time stamp: 0x545c0a59
Faulting module name: mozalloc.dll, version: 33.1.0.5423, time stamp: 0x545be5ee
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x1948
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (11/21/2014 01:19:55 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: plugin-container.exe, version: 33.1.0.5423, time stamp: 0x545c0a59
Faulting module name: mozalloc.dll, version: 33.1.0.5423, time stamp: 0x545be5ee
Exception code: 0x80000003
Fault offset: 0x00001425
Faulting process id: 0x1558
Faulting application start time: 0xplugin-container.exe0
Faulting application path: plugin-container.exe1
Faulting module path: plugin-container.exe2
Report Id: plugin-container.exe3

Error: (11/21/2014 00:50:48 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x12e8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/21/2014 11:51:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x8b8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/20/2014 07:38:34 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x132c
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3

Error: (11/20/2014 09:26:54 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: UA.exe, version: 1.0.0.1, time stamp: 0x543cc0e4
Faulting module name: MSVCR90.dll, version: 9.0.30729.6161, time stamp: 0x4dace5b9
Exception code: 0xc0000005
Fault offset: 0x00056b1d
Faulting process id: 0x10a8
Faulting application start time: 0xUA.exe0
Faulting application path: UA.exe1
Faulting module path: UA.exe2
Report Id: UA.exe3


System errors:
=============
Error: (11/21/2014 02:17:36 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 02:17:36 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 02:17:35 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 02:17:35 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 02:17:34 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:45 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:45 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:44 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:44 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.

Error: (11/21/2014 01:19:44 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.


Microsoft Office Sessions:
=========================

==================== Memory info ===========================

Processor: AMD A6-3650 APU with Radeon(tm) HD Graphics
Percentage of memory in use: 38%
Total physical RAM: 7666.86 MB
Available physical RAM: 4741.61 MB
Total Pagefile: 15331.91 MB
Available Pagefile: 11736.7 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:914.52 GB) (Free:800.89 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (HP_RECOVERY) (Fixed) (Total:16.77 GB) (Free:2.1 GB) NTFS
Drive k: (My Book) (Fixed) (Total:1862.98 GB) (Free:1776.51 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B7EADF65)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 1863 GB) (Disk ID: 00021365)
Partition 1: (Not Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End Of Log ============================
 

argus

Former MalwareTips Staff
Uninstall

Optimizer Pro
ProPCCleaner_Popup


Fix with Farbar Recovery Scan Tool

This fix was created for this user for use on that particular machine.

Running it on another one may cause damage and render the system unstable.
Download attached fixlist.txt file and save it to the Desktop:

Both files, FRST and fixlist.txt have to be in the same location or the fix will not work!

  • Right-click on
    icon and select
    Run as Administrator to start the tool.
    (XP users click run after receipt of Windows Security Warning - Open File).
  • Press the Fix button just once and wait.
  • If for some reason the tool needs a restart, please make sure you let the system restart normally. After that let the tool complete its run.
  • When finished FRST will generate a log on the Desktop, called Fixlog.txt.

Please attach it to your reply.
 

Attachments

argus

Former MalwareTips Staff
Re-run zoek and run this script:

Code:
resetIEproxy;
FFdefaults;
chrdefaults;
iedefaults;
emptyalltemp;
autoclean;
emptyclsid;
 
Last edited:

Jason Bashaw

New Member
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-11-2014
Ran by Bashaws at 2014-11-22 14:15:16 Run:1
Running from C:\Users\Bashaws\Desktop
Loaded Profile: Bashaws (Available profiles: Bashaws)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CloseProcesses:
EmptyTemp:
Task: {10663282-FA8C-455D-A679-D89136F671CE} - \TidyNetwork Update No Task File <==== ATTENTION
Task: {1A33FBFD-A7C9-46C7-899C-E851F4CB8648} - \DonutQuotes No Task File <==== ATTENTION
Task: {92D7D6A2-C4DE-4F0B-8EAB-9D6E2E2EE226} - \Microsoft\Windows\Maintenance\Update IC No Task File <==== ATTENTION
Task: {95102F30-E144-4351-A2DA-9CA8C5DB31EF} - System32\Tasks\SuperFastPC_AutorunOnStartup => C:\Program Files (x86)\System Optimizer Pro\SystemOptimizerPro.exe <==== ATTENTION
Task: {EDBF0B61-F087-4A3B-A051-78EB09E3C39A} - \Runner IC No Task File <==== ATTENTION
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\MountPoints2: {0ca89e76-3e8b-11e3-844c-4c72b91cdad4} - J:\MotoCastSetup.exe -a
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\MountPoints2: {75227bc2-5bc0-11e4-866f-4c72b91cdad4} - J:\VZW_Software_upgrade_assistant.exe
 

Jason Bashaw

New Member
Sorry, wasn't the complete log.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 20-11-2014
Ran by Bashaws at 2014-11-22 14:15:16 Run:1
Running from C:\Users\Bashaws\Desktop
Loaded Profile: Bashaws (Available profiles: Bashaws)
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
CloseProcesses:
EmptyTemp:
Task: {10663282-FA8C-455D-A679-D89136F671CE} - \TidyNetwork Update No Task File <==== ATTENTION
Task: {1A33FBFD-A7C9-46C7-899C-E851F4CB8648} - \DonutQuotes No Task File <==== ATTENTION
Task: {92D7D6A2-C4DE-4F0B-8EAB-9D6E2E2EE226} - \Microsoft\Windows\Maintenance\Update IC No Task File <==== ATTENTION
Task: {95102F30-E144-4351-A2DA-9CA8C5DB31EF} - System32\Tasks\SuperFastPC_AutorunOnStartup => C:\Program Files (x86)\System Optimizer Pro\SystemOptimizerPro.exe <==== ATTENTION
Task: {EDBF0B61-F087-4A3B-A051-78EB09E3C39A} - \Runner IC No Task File <==== ATTENTION
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\MountPoints2: {0ca89e76-3e8b-11e3-844c-4c72b91cdad4} - J:\MotoCastSetup.exe -a
HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\...\MountPoints2: {75227bc2-5bc0-11e4-866f-4c72b91cdad4} - J:\VZW_Software_upgrade_assistant.exe































*****************

Processes closed successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{10663282-FA8C-455D-A679-D89136F671CE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{10663282-FA8C-455D-A679-D89136F671CE}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\TidyNetwork Update" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{1A33FBFD-A7C9-46C7-899C-E851F4CB8648}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{1A33FBFD-A7C9-46C7-899C-E851F4CB8648}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\DonutQuotes" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Plain\{92D7D6A2-C4DE-4F0B-8EAB-9D6E2E2EE226}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{92D7D6A2-C4DE-4F0B-8EAB-9D6E2E2EE226}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\Maintenance\Update IC" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{95102F30-E144-4351-A2DA-9CA8C5DB31EF}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{95102F30-E144-4351-A2DA-9CA8C5DB31EF}" => Key deleted successfully.
C:\Windows\System32\Tasks\SuperFastPC_AutorunOnStartup => Moved successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\SuperFastPC_AutorunOnStartup" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Logon\{EDBF0B61-F087-4A3B-A051-78EB09E3C39A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{EDBF0B61-F087-4A3B-A051-78EB09E3C39A}" => Key deleted successfully.
"HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Runner IC" => Key deleted successfully.
"HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0ca89e76-3e8b-11e3-844c-4c72b91cdad4}" => Key deleted successfully.
"HKCR\CLSID\{0ca89e76-3e8b-11e3-844c-4c72b91cdad4}" => Key not found.
"HKU\S-1-5-21-2842075429-1242635110-2963454771-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{75227bc2-5bc0-11e4-866f-4c72b91cdad4}" => Key deleted successfully.
"HKCR\CLSID\{75227bc2-5bc0-11e4-866f-4c72b91cdad4}" => Key not found.
EmptyTemp: => Removed 138.7 MB temporary data.


The system needed a reboot.

==== End of Fixlog ====
 

Jason Bashaw

New Member
After the Zoek re-run.


Zoek.exe v5.0.0.0 Updated 21-11-2014
Tool run by Bashaws on Sat 11/22/2014 at 14:21:02.05.
Microsoft Windows 7 Home Premium 6.1.7601 Service Pack 1 x64
Running in: Normal Mode Internet Access Detected
Launched: C:\Users\Bashaws\Downloads\zoek(1).exe [Scan all users] [Script inserted]

==== Older Logs ======================

C:\zoek-results2014-11-21-173733.log 425 bytes
C:\zoek-results2014-11-21-183632.log 98395 bytes
C:\zoek-results2014-11-21-192243.log 4742 bytes

==== Deleting CLSID Registry Keys ======================


==== Deleting CLSID Registry Values ======================

HKEY_USERS\S-1-5-21-2842075429-1242635110-2963454771-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} deleted successfully

==== Deleting Services ======================


==== FireFox Fix ======================

Deleted from C:\Users\Bashaws\AppData\Roaming\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975\prefs.js:
user_pref("browser.startup.homepage", "https://www.google.com");
user_pref("browser.newtab.url", "about:blank");

Added to C:\Users\Bashaws\AppData\Roaming\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975\prefs.js:
user_pref("browser.startup.homepage", "http://www.google.com");
user_pref("browser.search.defaulturl", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.newtab.url", "http://www.google.com/");
user_pref("browser.search.defaultengine", "Google");
user_pref("browser.search.defaultenginename", "Google");
user_pref("browser.search.selectedEngine", "Google");
user_pref("browser.search.order.1", "Google");
user_pref("keyword.URL", "http://www.google.com/search?btnG=Google+Search&q=");
user_pref("browser.search.suggest.enabled", true);
user_pref("browser.search.useDBForOrder", true);

==== Firefox Extensions Registry ======================

[HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions]
"{e4f94d1e-2f53-401e-8885-681602c0ddd8}"="C:\ProgramData\McAfee Security Scan\Extensions\{e4f94d1e-2f53-401e-8885-681602c0ddd8}.xpi" [04/04/2014 05:36 AM]

==== Firefox Extensions ======================

AppDir: C:\Program Files (x86)\Mozilla Firefox
- Default - %AppDir%\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

==== Firefox Plugins ======================

Profilepath: C:\Users\Bashaws\AppData\Roaming\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975
67D325B5AEB28E381B84E8DE1A90C7A8 - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_223.dll - Shockwave Flash


==== Chromium Look ======================

Docs - Bashaws\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake

==== Set IE to Default ======================

Old Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

New Values:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com"

==== All HKCU SearchScopes ======================

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
{012E1000-F331-11DB-8314-0800200C9A66} Google Url="http://www.google.com/search?q={searchTerms}"
{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Bing Url="http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"

==== Reset Google Chrome ======================

C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Preferences was reset successfully
C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Web Data was reset successfully

==== Reset IE Proxy ======================

Value(s) before fix:
"ProxyOverride"="<-loopback>;192.168.*.*"

Value(s) after fix:
"ProxyEnable"=dword:00000000

==== Empty IE Cache ======================

C:\windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully
C:\Users\Bashaws\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5 emptied successfully

==== Empty FireFox Cache ======================

C:\Users\Bashaws\AppData\Local\Mozilla\Firefox\Profiles\yu4mr6zw.default-1416276520975\cache2 emptied successfully

==== Empty Chrome Cache ======================

C:\Users\Bashaws\AppData\Local\Google\Chrome\User Data\Default\Cache emptied successfully

==== Empty All Flash Cache ======================

Flash Cache Emptied Successfully

==== Empty All Java Cache ======================

Java Cache cleared successfully

==== C:\zoek_backup content ======================

C:\zoek_backup (files=139 folders=29 32061183 bytes)

==== Empty Temp Folders ======================

C:\Users\Bashaws\AppData\Local\Temp will be emptied at reboot
C:\Users\Default\AppData\Local\Temp emptied successfully
C:\Users\Default User\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\networkservice\AppData\Local\Temp emptied successfully
C:\windows\serviceprofiles\Localservice\AppData\Local\Temp emptied successfully
C:\windows\Temp will be emptied at reboot

==== After Reboot ======================

==== Empty Temp Folders ======================

C:\windows\Temp successfully emptied
C:\Users\Bashaws\AppData\Local\Temp successfully emptied

==== Empty Recycle Bin ======================

C:\$RECYCLE.BIN successfully emptied

==== EOF on Sat 11/22/2014 at 14:39:13.96 ======================
 

Jason Bashaw

New Member
Still getting the proxy server is not responding issue or unable to connect to proxy server. I took the steps again to take it off and reset on Internet Explorer and Google Crome again, but still the same, not working.