Fake App Attack: Misleading App File Downloading 3 #?

blazzen New Helpee Posts: 25	Fake App Attack: Misleading App File Downloading 3 #? Feb 4, 2014 8:07:11 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by blazzen on Feb 4, 2014 8:07:11 GMT -8 tried to scan with norton unistalled reinstalled browsers firefox and crome i only have 3 min maxs then crashes explorer is working fine though need some help guys

blazzen New Helpee Posts: 25	Fake App Attack: Misleading App File Downloading 3 #? Feb 4, 2014 8:07:58 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by blazzen on Feb 4, 2014 8:07:58 GMT -8 windows 7 64bit

blazzen New Helpee Posts: 25	Fake App Attack: Misleading App File Downloading 3 #? Feb 4, 2014 8:41:24 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by blazzen on Feb 4, 2014 8:41:24 GMT -8 Windows7 home premium 64bit

blazzen New Helpee Posts: 25	Fake App Attack: Misleading App File Downloading 3 #? Feb 4, 2014 11:13:10 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by blazzen on Feb 4, 2014 11:13:10 GMT -8 just a heads up guys i know you are busy but i am here

blazzen New Helpee Posts: 25	Fake App Attack: Misleading App File Downloading 3 #? Feb 4, 2014 11:38:57 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by blazzen on Feb 4, 2014 11:38:57 GMT -8 ok going to bed will check in tomorrow

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Fake App Attack: Misleading App File Downloading 3 #? Feb 4, 2014 14:37:07 GMT -8

Post by Quads on Feb 4, 2014 14:37:07 GMT -8

Do Not use advanced tools or any tools used on this board without supervision.

Malware removal can be difficult over a forum as it is, without a user doing their own actions, the tools used are more advanced and thus have added danger that comes with that. This board is protected so that only Malware removers, Admin and Mods can reply to a users thread but all members can create a thread asking for removal of Infection(s)

Make changes to your computer only when the Malware Expert specifically states it. The Malware Experts request specific steps to be followed, as some malware removal requires multiple steps and evaluations along the way. When you take other advice or make other changes, this often negates the work done by the expert, and can sometimes result in an inoperable system.

This also includes any tools or steps other than those the from the Malware Expert. We need to be certain about the state of your system to see what actually is going on, and what is required to fix the system while not harming the rest of the system. Most often, well-intentioned independent efforts can make things much worse. The malware remediation tools are more advanced than othe tools, and can often create bigger problems when used without expert guidance.

Follow all the directions in order, and to the end. Please perform all steps in the order they are listed in each set of instructions. As you might imagine, some steps are a bit complicated. If things are not clear, be sure to stop and let the Malware Expert know the problem. We don't mind clarifying a situation, as others might have the same question. If a tool does not run as expected, don't force it. Stop the steps, and update the forum topic with the current situation. It is better stop and let us know, than to force a tool to run and cause bigger problems.

Also, when your computer is clean and we are finished, the Expert will tell you we are finished. Malware removal is a process that requires verification, and we want to be sure your system is completely clean before we're done.

When describing your problem, provide as much information as possible, as soon as possible. Explain as best you can what happens with your computer, e.g. it beeps three times, black screen with cursor then goes no further, system gets stuck at the Windows startup logo, etc. This helps the expert to understand what is happening to the system and what may be wrong. If your computer cannot start up successfully please provide details about your installed Windows Operating System, including the Version, Edition and if it is a 32bit or a 64bit system. (e.g. Windows Vista Home Premium 32-bit)

When the user follow instructions and things still go a little haywire, and it does happen, it is up to us to sort the extra problem out.

Take longer to read if your language is not English, so that hopefully it is understood.

Reply stating you have read the post fully.

I also have a lot of systems at once to deal with like being in a supermarket checkout line, waiting their turn.

Quads

blazzen New Helpee Posts: 25	Fake App Attack: Misleading App File Downloading 3 #? Feb 5, 2014 7:45:43 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by blazzen on Feb 5, 2014 7:45:43 GMT -8 ok yes i have read this and am ready to go

dbrisen
Malware Removalists

Posts: 3,688

Fake App Attack: Misleading App File Downloading 3 #? Feb 5, 2014 8:11:06 GMT -8

Post by dbrisen on Feb 5, 2014 8:11:06 GMT -8

Read Slowly and all of it.

Please download www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ You need to download the 64 bit version.

Place FRST64.exe onto your desktop from where ever it downloaded to. IF IT IS NOT ON THE DESKTOP (YOU DID NOT DOWNLOAD DIRECTLY TO DESKTOP), THEN RIGHT CLICK ON THE DOWNLOADED FILE AND SELECT CUT. FIND A BLANK SPOT ON YOUR DESKTOP AND RIGHT CLICK ON IT, SELECT PASTE AND THE FILE WILL BE ON THE DESKTOP. Thank You (this is very important later on)!

Start FRST64 that is on your Desktop

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)
Press Scan button.

It will make two logs (FRST.txt and addition.txt) on your Desktop. Please attach the logs in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply. (Ask if you don't know how to do either of these).

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

blazzen
New Helpee

Posts: 25

Fake App Attack: Misleading App File Downloading 3 #? Feb 5, 2014 8:31:38 GMT -8

Post by blazzen on Feb 5, 2014 8:31:38 GMT -8

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-02-2014
Ran by Arthur (administrator) on ARTHUR-PC on 05-02-2014 17:27:40
Running from C:\Users\Arthur\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(SEIKO EPSON CORPORATION) C:\Program Files (x86)\Common Files\EPSON\EBAPI\eEBSvc.exe
(ABBYY) C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Broadcom Corporation.) C:\Windows\System32\BtwRSupportService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_S50RPB.EXE
(Nero AG) C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\ccsvchst.exe
() C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe
() C:\ProgramData\BetterSoft\ContinueToSave\ContinueToSave.exe
() C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
(Skype Technologies S.A.) C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE
() C:\Program Files (x86)\HTC\HTC Sync Manager\HTC Sync\adb.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\ccsvchst.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrl.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe
(BitTorrent Inc.) D:\uTorrent.exe
(ELAN Microelectronics Corp.) C:\Program Files\Elantech\ETDCtrlHelper.exe
(Spotify Ltd) C:\Users\Arthur\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIHQE.EXE
(SEIKO EPSON CORPORATION) C:\Windows\System32\spool\drivers\x64\3\E_IATIHQE.EXE
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BluetoothHeadsetProxy.exe
(Wondershare) C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
(Intel Corporation) C:\Windows\System32\igfxext.exe
(Intel Corporation) C:\Windows\System32\igfxsrvc.exe
(SEC) C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe
(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe
(SAMSUNG Electronics) C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Samsung Electronics) C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe
() C:\ProgramData\BetterSoft\ContinueToSave\ContinueToSave.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_11_2_202_233_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11895400 2011-06-25] (Realtek Semiconductor)
HKLM\...\Run: [ETDCtrl] - C:\Program Files\Elantech\ETDCtrl.exe [2588968 2010-11-12] (ELAN Microelectronics Corp.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM-x32\...\Run: [BrowserPlugInHelper] - C:\Program Files (x86)\Wondershare\Video Converter Ultimate\BrowserPlugInHelper.exe [1962896 2013-12-19] ()
HKLM-x32\...\Run: [Wondershare Helper Compact.exe] - C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe [1743648 2013-06-13] (Wondershare)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
Winlogon\Notify\igfxcui: C:\windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-21-1567553520-2598224956-3562314209-1001\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20584608 2013-11-14] (Skype Technologies S.A.)
HKU\S-1-5-21-1567553520-2598224956-3562314209-1001\...\Run: [uTorrent] - D:\uTorrent.exe [802136 2013-05-02] (BitTorrent Inc.)
HKU\S-1-5-21-1567553520-2598224956-3562314209-1001\...\Run: - C:\Users\Arthur\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-16] (Spotify Ltd)
HKU\S-1-5-21-1567553520-2598224956-3562314209-1001\...\Run: - C:\Users\Arthur\AppData\Roaming\Spotify\spotify.exe [6118400 2014-01-16] (Spotify Ltd)
HKU\S-1-5-21-1567553520-2598224956-3562314209-1001\...\Run: [EPLTarget\P0000000000000000] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIHQE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1567553520-2598224956-3562314209-1001\...\Run: [EPLTarget\P0000000000000001] - C:\windows\system32\spool\DRIVERS\x64\3\E_IATIHQE.EXE [283232 2012-02-29] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-1567553520-2598224956-3562314209-1001\...\RunOnce: [FlashPlayerUpdate] - C:\windows\system32\Macromed\Flash\FlashUtil64_11_2_202_233_ActiveX.exe [630944 2012-04-13] (Adobe Systems Incorporated)
HKU\S-1-5-21-1567553520-2598224956-3562314209-1001\...\MountPoints2: {21f5cfba-4f24-11e1-b246-90a4de9fc590} - F:\LaunchU3.exe -a
AppInit_DLLs: C:\windows\system32\nvinitx.dll => C:\windows\system32\nvinitx.dll [245432 2012-12-03] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\windows\syswow64\nvinit.dll => c:\windows\syswow64\nvinit.dll [201136 2012-12-03] (NVIDIA Corporation)
AppInit_DLLs-x32: c:\progra~2\contin~1\sprote~1.dll => C:\Program Files (x86)\ContinueToSave\sprotector.dll [1057280 2013-01-24] ()
AppInit_DLLs-x32: c:\progra~2\simple~1\sprote~1.dll => C:\Program Files (x86)\SimpleSpeedy\sprotector.dll [1032704 2013-01-24] ()

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = samsung.msn.com
URLSearchHook: HKLM-x32 - BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files (x86)\BitTorrentBar\prxtbBitT.dll No File
URLSearchHook: HKCU - (No Name) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - No File
URLSearchHook: HKCU - BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files (x86)\BitTorrentBar\prxtbBitT.dll No File
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} URL = www.searchqu.com/web?src=ieb&appid=0&systemid=421&sr=0&q={searchTerms}
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} URL = www.searchqu.com/web?src=ieb&appid=0&systemid=421&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} URL = www.searchqu.com/web?src=ieb&appid=0&systemid=421&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} URL = www.searchqu.com/web?src=ieb&appid=0&systemid=421&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = websearch.simplespeedy.info/?l=1&q={searchTerms}
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD2421} URL = www.searchqu.com/web?src=ieb&appid=0&systemid=421&sr=0&q={searchTerms}
SearchScopes: HKCU - {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} URL = websearch.simplespeedy.info/?l=1&q={searchTerms}
BHO: Complitly - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\Arthur\AppData\Roaming\Complitly\64\Complitly64.dll (SimplyGen)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
BHO: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Complitly - {0FB6A909-6086-458F-BD92-1F8EE10042A0} - C:\Users\Arthur\AppData\Roaming\Complitly\Complitly.dll (SimplyGen)
BHO-x32: continuetosave - {5B1D5685-C658-464D-33CF-1AE03D034289} - C:\ProgramData\continuetosave\5102c7e7f2dec.dll ()
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
BHO-x32: Wondershare Video Converter Ultimate - {65DEE40A-3E93-4cae-9F98-B8E06DCEE2BF} - C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRIEPlugin.dll (Wondershare Software Co., Ltd.)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files (x86)\BitTorrentBar\prxtbBitT.dll No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll No File
BHO-x32: Samsung BHO Class - {AA609D72-8482-4076-8991-8CDAE5B93BCB} - C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll ()
BHO-x32: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - Easy Photo Print - {9421DD08-935F-4701-A9CA-22DF90AC4EA6} - C:\Program Files (x86)\Epson Software\Easy Photo Print\EPTBL.dll (SEIKO EPSON CORPORATION)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\21.1.0.18\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - BitTorrentBar Toolbar - {88c7f2aa-f93f-432c-8f0e-b7d85967a527} - C:\Program Files (x86)\BitTorrentBar\prxtbBitT.dll No File
Toolbar: HKLM-x32 - Searchqu Toolbar - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\WIA6EB~1\Datamngr\ToolBar\searchqudtx.dll No File
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - No File
Toolbar: HKCU - No Name - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 130.67.15.198 193.213.112.4 10.0.0.138

FireFox:
========
FF ProfilePath: C:\Users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\x0kmd2z3.default-1390652040157
FF DefaultSearchEngine: user_pref("browser.search.defaultenginename", "");
FF SearchEngineOrder.user_pref("browser.search.order.1", "");: user_pref("browser.search.order.1", "");
FF SearchEngineOrder.user_pref("browser.search.order.1,S", "");: user_pref("browser.search.order.1,S", "");
FF SelectedSearchEngine: user_pref("browser.search.selectedEngine", "");
FF Keyword.URL: user_pref("keyword.URL", "");
FF NetworkProxy: "type", 0
FF Homepage: user_pref("browser.startup.homepage", "");
FF Plugin: @adobe.com/FlashPlayer - C:\windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll ()
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF Plugin-x32: @apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.7 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\searchplugins\SearchResults.xml
FF Extension: Adblock Plus - C:\Users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\x0kmd2z3.default-1390652040157\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-01-25]
FF Extension: Greasemonkey - C:\Users\Arthur\AppData\Roaming\Mozilla\Firefox\Profiles\x0kmd2z3.default-1390652040157\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2014-01-25]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-12-21]
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2013-12-21]
FF Extension: Skype Click to Call - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2013-12-21]
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\coFFPlgn\ []
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_21.1.0.18\IPSFF [2013-11-20]
FF HKLM-x32\...\Firefox\Extensions: [{8D150B8F-EFE8-45a3-A4A3-053020F48FAC}] - C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRFirefoxExt\
FF Extension: Wondershare Video Converter Ultimate - C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRFirefoxExt\ []
FF HKCU\...\Firefox\Extensions: [{8D150B8F-EFE8-45a3-A4A3-053020F48FAC}] - C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRFirefoxExt\
FF Extension: Wondershare Video Converter Ultimate - C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRFirefoxExt\ []

Chrome:
=======
CHR HomePage:
CHR RestoreOnStartup: ""
CHR Extension: (Docs) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-01-25]
CHR Extension: (Google Drive) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-01-25]
CHR Extension: (YouTube) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-01-25]
CHR Extension: (Last updated at $time$ on $date$) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfhdojbkjhnklbpkdaibdccddilifddb [2014-01-25]
CHR Extension: (Wondershare Video Converter Ultimate) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\chgdeabpmphfhkoemjjglmilajldekbp [2014-01-25]
CHR Extension: (Google Search) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-01-25]
CHR Extension: (Facebook Customizer (by Adblock Plus)) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\deoeenbkoccjaefmmhpmlegngdjohdcm [2014-01-25]
CHR Extension: (YouTube Customizer (by Adblock Plus)) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmddkphkkipkepkllomhcbooojhhhcpa [2014-01-25]
CHR Extension: (Proxomitron adblock) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\mapakpokmeipcmjipjfmlnlfdcbllelg [2014-01-25]
CHR Extension: (Google Wallet) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-01-25]
CHR Extension: (Gmail) - C:\Users\Arthur\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-01-25]
CHR HKLM-x32\...\Chrome\Extension: [bejbohlohkkgompgecdcbbglkpjfjgdj] - C:\Users\Arthur\AppData\Local\Temp\ccex.crx [2012-03-07]
CHR HKLM-x32\...\Chrome\Extension: [bgnnidmnbdkmhfkjgdnngciimpdgohok] - C:\Program Files (x86)\FirstRowSportApp.com\stv11.crx [2012-03-07]
CHR HKLM-x32\...\Chrome\Extension: [chgdeabpmphfhkoemjjglmilajldekbp] - C:\Program Files (x86)\Wondershare\Video Converter Ultimate\SVRChromePlugin.crx [2014-01-05]
CHR HKLM-x32\...\Chrome\Extension: [dlfienamagdnkekbbbocojppncdambda] - C:\Program Files (x86)\Complitly\chrome\ComplitlyChrome.crx [2012-02-01]
CHR HKLM-x32\...\Chrome\Extension: [mhfdcmehmjcclgopdodkjdicohagipid] - C:\Users\Arthur\AppData\Local\Temp\ccex.crx [2012-03-07]
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\Exts\Chrome.crx [2014-01-20]
CHR HKLM-x32\...\Chrome\Extension: [pfmopbbadnfoelckkcmjjeaaegjpjjbk] - C:\Program Files (x86)\Gophoto.it\gophotoit14.crx [2012-07-31]

==================== Services (Whitelisted) =================

R2 ABBYY.Licensing.FineReader.Sprint.9.0; C:\Program Files (x86)\Common Files\ABBYY\FineReaderSprint\9.00\Licensing\NetworkLicenseServer.exe [759048 2009-05-14] (ABBYY)
R2 BcmBtRSupport; C:\Windows\system32\BtwRSupportService.exe [2252504 2013-08-09] (Broadcom Corporation.)
R2 HTCMonitorService; C:\Program Files (x86)\HTC\HTC Sync Manager\HSMServiceEntry.exe [87368 2012-07-16] (Nero AG)
R2 MCLIENT; C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\ccSvcHst.exe [143928 2012-12-05] (Symantec Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\NIS.exe [275696 2013-10-08] (Symantec Corporation)
R2 PassThru Service; C:\Program Files (x86)\HTC\Internet Pass-Through\PassThruSvr.exe [166912 2012-10-08] ()
R2 RichVideo; C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe [244904 2009-12-01] ()

==================== Drivers (Whitelisted) ====================

R3 bcbtums; C:\Windows\System32\drivers\bcbtums.sys [170712 2013-08-09] (Broadcom Corporation.)
R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\BASHDefs\20140121.001\BHDrvx64.sys [1526488 2013-12-18] (Symantec Corporation)
R1 ccSet_MCLIENT; C:\Windows\system32\drivers\MCLIENTx64\0302020.00C\ccSetx64.sys [168096 2012-10-04] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1501000.012\ccSetx64.sys [162392 2013-09-26] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-11-21] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [137648 2013-11-21] (Symantec Corporation)
S3 GemCCID; C:\Windows\System32\Drivers\GemCCID.sys [119680 2009-08-10] (Gemalto)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\IPSDefs\20140205.001\IDSvia64.sys [521944 2014-01-21] (Symantec Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140204.024\ENG64.SYS [126040 2013-11-15] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton Internet Security\NortonData\21.1.0.18\Definitions\VirusDefs\20140204.024\EX64.SYS [2099288 2013-11-15] (Symantec Corporation)
S3 rtport; C:\windows\SysWOW64\drivers\rtport.sys [15144 2011-10-28] (Windows (R) 2003 DDK 3790 provider)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1501000.012\SRTSP64.SYS [858200 2013-09-27] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1501000.012\SRTSPX64.SYS [36952 2013-09-10] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1501000.012\SYMDS64.SYS [493656 2013-09-10] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1501000.012\SYMEFA64.SYS [1147480 2013-09-27] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2013-11-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1501000.012\Ironx64.SYS [264280 2013-09-27] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1501000.012\SYMNETS.SYS [590936 2013-09-26] (Symantec Corporation)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-02-05 17:27 - 2014-02-05 17:28 - 00025785 _____ () C:\Users\Arthur\Desktop\FRST.txt
2014-02-05 17:27 - 2014-02-05 17:27 - 00000000 ____D () C:\FRST
2014-02-05 17:26 - 2014-02-05 17:26 - 02080256 _____ (Farbar) C:\Users\Arthur\Desktop\FRST64.exe
2014-02-05 17:24 - 2014-02-05 17:24 - 02080256 _____ (Farbar) C:\Users\Arthur\Downloads\FRST64 (1).exe
2014-02-05 17:23 - 2014-02-05 17:23 - 02080256 _____ (Farbar) C:\Users\Arthur\Downloads\FRST64.exe
2014-02-03 20:30 - 2014-02-03 20:30 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-02-03 20:30 - 2014-02-03 20:30 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-02-03 20:30 - 2014-02-03 20:30 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-02-03 20:30 - 2014-02-03 20:30 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-03 20:29 - 2014-02-03 20:29 - 29141928 _____ (Oracle Corporation) C:\Users\Arthur\Downloads\jre-7u51-windows-i586.exe
2014-02-03 20:24 - 2014-02-03 20:24 - 00921000 _____ (Oracle Corporation) C:\Users\Arthur\Downloads\chromeinstall-7u51.exe
2014-02-03 20:13 - 2014-02-03 20:13 - 00921000 _____ (Oracle Corporation) C:\Users\Arthur\Downloads\jxpiinstall(5).exe
2014-02-03 20:09 - 2014-02-03 20:09 - 00921000 _____ (Oracle Corporation) C:\Users\Arthur\Downloads\jxpiinstall(4).exe
2014-02-03 17:57 - 2014-02-03 17:57 - 03053496 ____N (Symantec Corporation) C:\Users\Arthur\Downloads\NPE.exe
2014-02-03 17:49 - 2014-02-03 17:49 - 19755430 _____ () C:\Users\Arthur\Desktop\koc snapshots.pptx
2014-02-02 20:52 - 2014-02-02 20:52 - 00051712 _____ () C:\Users\Arthur\Downloads\Reiseregning Ulsteinvik.xls
2014-02-02 20:18 - 2014-02-02 20:36 - 00051712 _____ () C:\Users\Ann-Helen\Desktop\Reiseregning Ulsteinvik.xls
2014-01-31 12:30 - 2014-01-31 12:30 - 00014220 _____ () C:\Users\Arthur\Downloads\Step_Up_3D_(2010).torrent
2014-01-31 12:30 - 2014-01-31 12:30 - 00013233 _____ () C:\Users\Arthur\Downloads\Step_Up_2_The_Streets_(2008).torrent
2014-01-31 12:30 - 2014-01-31 12:30 - 00013187 _____ () C:\Users\Arthur\Downloads\Step_Up_(2006).torrent
2014-01-25 13:14 - 2014-01-25 13:14 - 00000000 ____D () C:\Users\Arthur\Desktop\Old Firefox Data
2014-01-19 20:09 - 2014-01-19 20:57 - 00000000 ____D () C:\Users\Arthur\Desktop\tatto pics
2014-01-18 10:54 - 2014-01-18 10:54 - 00005175 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-15 15:24 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbhub.sys
2014-01-15 15:24 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbport.sys
2014-01-15 15:24 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbccgp.sys
2014-01-15 15:24 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbehci.sys
2014-01-15 15:24 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbuhci.sys
2014-01-15 15:24 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbohci.sys
2014-01-15 15:24 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\windows\system32\Drivers\usbd.sys
2014-01-15 15:24 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netio.sys
2014-01-15 15:24 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2014-01-14 20:26 - 2014-01-14 20:26 - 00055620 _____ () C:\Users\Arthur\Downloads\Breaking.Bad.S05.HDTV.x264-TD.torrent
2014-01-12 22:03 - 2014-01-12 22:04 - 04687623 _____ () C:\Users\Arthur\Desktop\BDAY CARD.psd
2014-01-08 22:48 - 2014-01-08 22:48 - 00000000 ____D () C:\Users\Arthur\Desktop\Ann-Helen
2014-01-06 20:15 - 2014-01-06 20:16 - 00260794 _____ () C:\windows\msxml4-KB2758694-enu.LOG

==================== One Month Modified Files and Folders =======

2014-02-05 17:28 - 2014-02-05 17:27 - 00025785 _____ () C:\Users\Arthur\Desktop\FRST.txt
2014-02-05 17:27 - 2014-02-05 17:27 - 00000000 ____D () C:\FRST
2014-02-05 17:26 - 2014-02-05 17:26 - 02080256 _____ (Farbar) C:\Users\Arthur\Desktop\FRST64.exe
2014-02-05 17:26 - 2013-04-01 13:38 - 00000000 ____D () C:\Users\Arthur\AppData\Roaming\uTorrent
2014-02-05 17:24 - 2014-02-05 17:24 - 02080256 _____ (Farbar) C:\Users\Arthur\Downloads\FRST64 (1).exe
2014-02-05 17:23 - 2014-02-05 17:23 - 02080256 _____ (Farbar) C:\Users\Arthur\Downloads\FRST64.exe
2014-02-05 17:20 - 2011-07-30 14:42 - 01216424 _____ () C:\windows\WindowsUpdate.log
2014-02-05 17:10 - 2013-02-25 20:52 - 00000992 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-02-05 16:45 - 2013-02-25 20:52 - 00000988 _____ () C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-02-04 18:13 - 2009-07-14 05:45 - 00021200 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-04 18:13 - 2009-07-14 05:45 - 00021200 ____H () C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-04 17:33 - 2009-07-14 06:32 - 00000000 ____D () C:\windows\system32\FxsTmp
2014-02-03 20:43 - 2009-07-14 06:13 - 00727334 _____ () C:\windows\system32\PerfStringBackup.INI
2014-02-03 20:40 - 2013-12-01 14:46 - 00000000 ____D () C:\Users\Arthur\AppData\Roaming\Spotify
2014-02-03 20:40 - 2013-02-06 19:45 - 00000000 ____D () C:\Users\Arthur\AppData\Local\HTC MediaHub
2014-02-03 20:40 - 2012-01-29 03:15 - 00000000 ____D () C:\Users\Arthur\AppData\Roaming\Skype
2014-02-03 20:38 - 2013-01-25 18:35 - 00000430 ____H () C:\windows\Tasks\schedule!1143840799.job
2014-02-03 20:38 - 2009-07-14 06:08 - 00000006 ____H () C:\windows\Tasks\SA.DAT
2014-02-03 20:38 - 2009-07-14 05:51 - 00129860 _____ () C:\windows\setupact.log
2014-02-03 20:30 - 2014-02-03 20:30 - 00264616 _____ (Oracle Corporation) C:\windows\SysWOW64\javaws.exe
2014-02-03 20:30 - 2014-02-03 20:30 - 00175016 _____ (Oracle Corporation) C:\windows\SysWOW64\javaw.exe
2014-02-03 20:30 - 2014-02-03 20:30 - 00174504 _____ (Oracle Corporation) C:\windows\SysWOW64\java.exe
2014-02-03 20:30 - 2014-02-03 20:30 - 00096168 _____ (Oracle Corporation) C:\windows\SysWOW64\WindowsAccessBridge-32.dll
2014-02-03 20:29 - 2014-02-03 20:29 - 29141928 _____ (Oracle Corporation) C:\Users\Arthur\Downloads\jre-7u51-windows-i586.exe
2014-02-03 20:24 - 2014-02-03 20:24 - 00921000 _____ (Oracle Corporation) C:\Users\Arthur\Downloads\chromeinstall-7u51.exe
2014-02-03 20:20 - 2009-07-14 04:20 - 00000000 ____D () C:\windows\system32\NDF
2014-02-03 20:15 - 2012-08-01 19:48 - 00000000 ____D () C:\Users\Arthur\AppData\Local\NPE
2014-02-03 20:14 - 2013-10-17 15:29 - 00000000 ____D () C:\ProgramData\Oracle
2014-02-03 20:13 - 2014-02-03 20:13 - 00921000 _____ (Oracle Corporation) C:\Users\Arthur\Downloads\jxpiinstall(5).exe
2014-02-03 20:09 - 2014-02-03 20:09 - 00921000 _____ (Oracle Corporation) C:\Users\Arthur\Downloads\jxpiinstall(4).exe
2014-02-03 19:57 - 2010-11-21 04:47 - 01079864 _____ () C:\windows\PFRO.log
2014-02-03 19:42 - 2012-01-28 22:39 - 00000000 ____D () C:\Users\Arthur\AppData\Local\Deployment
2014-02-03 18:13 - 2012-02-19 15:45 - 00000000 ____D () C:\Program Files (x86)\Microsoft Application Virtualization Client
2014-02-03 17:57 - 2014-02-03 17:57 - 03053496 ____N (Symantec Corporation) C:\Users\Arthur\Downloads\NPE.exe
2014-02-03 17:49 - 2014-02-03 17:49 - 19755430 _____ () C:\Users\Arthur\Desktop\koc snapshots.pptx
2014-02-03 17:49 - 2012-02-25 19:42 - 00566784 ___SH () C:\Users\Arthur\Desktop\Thumbs.db
2014-02-02 20:52 - 2014-02-02 20:52 - 00051712 _____ () C:\Users\Arthur\Downloads\Reiseregning Ulsteinvik.xls
2014-02-02 20:36 - 2014-02-02 20:18 - 00051712 _____ () C:\Users\Ann-Helen\Desktop\Reiseregning Ulsteinvik.xls
2014-02-02 20:16 - 2013-08-15 22:28 - 00002259 _____ () C:\Users\Ann-Helen\Desktop\Google Chrome.lnk
2014-02-01 11:08 - 2013-06-27 20:12 - 00000000 ____D () C:\Users\Arthur\AppData\Roaming\vlc
2014-01-31 12:30 - 2014-01-31 12:30 - 00014220 _____ () C:\Users\Arthur\Downloads\Step_Up_3D_(2010).torrent
2014-01-31 12:30 - 2014-01-31 12:30 - 00013233 _____ () C:\Users\Arthur\Downloads\Step_Up_2_The_Streets_(2008).torrent
2014-01-31 12:30 - 2014-01-31 12:30 - 00013187 _____ () C:\Users\Arthur\Downloads\Step_Up_(2006).torrent
2014-01-30 20:48 - 2012-12-10 17:55 - 00000000 ____D () C:\Users\Arthur\Documents\Vegas Movie Studio HD 11.0 Projects
2014-01-30 20:42 - 2012-02-25 08:25 - 00054784 ___SH () C:\Users\Arthur\Thumbs.db
2014-01-30 16:35 - 2013-12-01 15:05 - 00000000 ____D () C:\Users\Arthur\AppData\Local\Spotify
2014-01-29 20:11 - 2012-04-02 16:51 - 00000000 ____D () C:\Users\Arthur\AppData\Roaming\dvdcss
2014-01-25 20:45 - 2013-01-05 09:09 - 00000000 ____D () C:\ProgramData\Wondershare Video Converter Ultimate
2014-01-25 17:33 - 2012-06-29 16:38 - 00000000 ____D () C:\Users\Arthur\AppData\Local\Google
2014-01-25 17:32 - 2012-12-15 11:19 - 00000000 ____D () C:\Program Files (x86)\Google
2014-01-25 13:35 - 2012-03-20 14:53 - 00000000 ____D () C:\Program Files (x86)\CometBird
2014-01-25 13:14 - 2014-01-25 13:14 - 00000000 ____D () C:\Users\Arthur\Desktop\Old Firefox Data
2014-01-24 20:06 - 2014-01-05 11:50 - 00000000 ____D () C:\ProgramData\Nero
2014-01-24 12:01 - 2013-02-08 09:17 - 00000000 ____D () C:\Users\Ann-Helen\AppData\Local\HTC MediaHub
2014-01-19 20:57 - 2014-01-19 20:09 - 00000000 ____D () C:\Users\Arthur\Desktop\tatto pics
2014-01-18 10:54 - 2014-01-18 10:54 - 00005175 _____ () C:\windows\SysWOW64\jupdate-1.7.0_51-b13.log
2014-01-18 10:54 - 2012-06-16 11:34 - 00000000 ____D () C:\Program Files (x86)\Java
2014-01-16 03:22 - 2009-07-14 05:45 - 00427376 _____ () C:\windows\system32\FNTCACHE.DAT
2014-01-16 03:04 - 2013-08-05 18:43 - 00000000 ____D () C:\windows\system32\MRT
2014-01-16 03:00 - 2012-02-08 15:40 - 86054176 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2014-01-14 20:26 - 2014-01-14 20:26 - 00055620 _____ () C:\Users\Arthur\Downloads\Breaking.Bad.S05.HDTV.x264-TD.torrent
2014-01-13 18:00 - 2012-01-28 23:30 - 00000000 ____D () C:\Users\Arthur
2014-01-12 22:04 - 2014-01-12 22:03 - 04687623 _____ () C:\Users\Arthur\Desktop\BDAY CARD.psd
2014-01-12 21:32 - 2012-01-28 23:49 - 00000000 ____D () C:\Users\Arthur\AppData\Roaming\Adobe
2014-01-12 16:33 - 2012-02-04 14:10 - 00000000 ____D () C:\Users\Arthur\AppData\Roaming\U3
2014-01-11 11:07 - 2014-01-05 14:15 - 00000000 ____D () C:\Users\Arthur\AppData\Local\Nero
2014-01-08 22:48 - 2014-01-08 22:48 - 00000000 ____D () C:\Users\Arthur\Desktop\Ann-Helen
2014-01-06 20:16 - 2014-01-06 20:15 - 00260794 _____ () C:\windows\msxml4-KB2758694-enu.LOG

Some content of TEMP:
====================
C:\Users\Ann-Helen\AppData\Local\Temp\install_flashplayer11x32au_mssa_aih_1.exe
C:\Users\Ann-Helen\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\AskSLib.dll
C:\Users\Arthur\AppData\Local\Temp\GUninstaller.exe
C:\Users\Arthur\AppData\Local\Temp\i4jdel0.exe
C:\Users\Arthur\AppData\Local\Temp\installhelper.dll
C:\Users\Arthur\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Arthur\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\jre-7u21-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\jre-7u25-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\jre-7u51-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\Arthur\AppData\Local\Temp\n5y8l2rx.dll
C:\Users\Arthur\AppData\Local\Temp\SetupDataMngr_Searchqu.exe
C:\Users\Arthur\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Arthur\AppData\Local\Temp\softonic_chr_1-8-16-10.exe
C:\Users\Arthur\AppData\Local\Temp\SpotifyUninstall.exe
C:\Users\Arthur\AppData\Local\Temp\SpotifyUpgrader.exe
C:\Users\Arthur\AppData\Local\Temp\SRAssetsHelper.dll
C:\Users\Arthur\AppData\Local\Temp\tbuTor.dll
C:\Users\Arthur\AppData\Local\Temp\uninst1.exe
C:\Users\Arthur\AppData\Local\Temp\utt49BC.tmp.exe
C:\Users\Arthur\AppData\Local\Temp\video-converter-ultimate_full975.exe
C:\Users\Arthur\AppData\Local\Temp\vlc-2.0.2-win32.exe
C:\Users\Arthur\AppData\Local\Temp\vlc-2.0.4-win32.exe
C:\Users\Arthur\AppData\Local\Temp\_is3138.exe
C:\Users\Arthur\AppData\Local\Temp\_is3E7.exe
C:\Users\Arthur\AppData\Local\Temp\_is56AC.exe
C:\Users\Arthur\AppData\Local\Temp\_is61DF.exe
C:\Users\Arthur\AppData\Local\Temp\_is7ABA.exe
C:\Users\Arthur\AppData\Local\Temp\_isA72D.exe
C:\Users\Arthur\AppData\Local\Temp\_isD5BC.exe
C:\Users\Arthur\AppData\Local\Temp\~SpUnin~.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

LastRegBack: 2014-01-29 17:42

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 04-02-2014
Ran by Arthur at 2014-02-05 17:28:43
Running from C:\Users\Arthur\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AV: Norton Internet Security (Enabled - Up to date) {63DF5164-9100-186D-2187-8DC619EFD8BF}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Up to date) {D8BEB080-B73A-17E3-1B37-B6B462689202}
FW: Norton Internet Security (Enabled) {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}

==================== Installed Programs ======================

„Windows Live Essentials“ (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
„Windows Live Mail“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live Messenger“ (x32 Version: 15.4.3502.0922 - „Microsoft Corporation“) Hidden
„Windows Live“ fotogalerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
µTorrent (x32 Version: 3.3.0.29420 - BitTorrent Inc.)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY)
ABBYY FineReader 9.0 Sprint (x32 Version: 9.01.513.58212 - ABBYY) Hidden
Adobe AIR (x32 Version: 2.6.0.19140 - Adobe Systems Incorporated)
Adobe AIR (x32 Version: 2.6.0.19140 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX 64-bit (Version: 11.2.202.233 - Adobe Systems Incorporated)
Adobe Flash Player 11 Plugin (x32 Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 5.2 64-bit (Version: 5.2.1 - Adobe)
Adobe Reader X (10.1.9) (x32 Version: 10.1.9 - Adobe Systems Incorporated)
Agatha Christie - Death on the Nile (x32 Version: 2.2.0.82 - WildTangent) Hidden
Apple Application Support (x32 Version: 2.3.3 - Apple Inc.)
Apple Mobile Device Support (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (x32 Version: 2.1.3.127 - Apple Inc.)
BatteryLifeExtender (x32 Version: 1.0.11 - Samsung)
Bejeweled 2 Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Bonjour (Version: 3.0.0.10 - Apple Inc.)
Broadcom 802.11 Network Adapter (Version: 5.60.48.55 - Broadcom Corporation)
Brukerhåndbok EPSON PX730 Series (x32 Version: - )
Build-a-lot (x32 Version: 2.2.0.82 - WildTangent) Hidden
ChargeableUSB (x32 Version: 1.0.0.0 - SAMSUNG)
Chuzzle Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
Complitly (x32 Version: - Complitly) <==== ATTENTION
ContinueToSave (Version: 1.0 - BetterSoft) <==== ATTENTION
continuetosave (x32 Version: - continue to save) <==== ATTENTION
ContinueToSave 1.74 (x32 Version: - ) <==== ATTENTION
CopyTrans Suite Remove Only (HKCU Version: 2.35 - WindSolutions)
Curse Client (HKCU Version: 5.1.1.792 - Curse)
CyberLink Media Suite (x32 Version: 8.0.2227 - CyberLink Corp.)
CyberLink Media Suite (x32 Version: 8.0.2227 - CyberLink Corp.) Hidden
CyberLink Media+ Player10 (x32 Version: 10.0.1110.00 - CyberLink Corp.)
CyberLink Media+ Player10 (x32 Version: 10.0.1110.00 - CyberLink Corp.) Hidden
CyberLink MediaShow (x32 Version: 5.0.1130a - CyberLink Corp.)
CyberLink MediaShow (x32 Version: 5.0.1130a - CyberLink Corp.) Hidden
CyberLink Power2Go (x32 Version: 6.1.3802 - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.1.3802 - CyberLink Corp.) Hidden
CyberLink PowerDirector (x32 Version: 8.0.3306 - CyberLink Corp.)
CyberLink PowerDirector (x32 Version: 8.0.3306 - CyberLink Corp.) Hidden
CyberLink YouCam (x32 Version: 3.1.3509 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.1.3509 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (x32 Version: - Microsoft)
Diner Dash 2 Restaurant Rescue (x32 Version: 2.2.0.82 - WildTangent) Hidden
Easy Content Share (x32 Version: 1.0 - Samsung Electronics Co., LTD)
Easy Display Manager (x32 Version: 3.2 - Samsung Electronics Co., Ltd.)
Easy Migration (x32 Version: 1.0 - Samsung Electronics Co., Ltd.)
Easy Network Manager (x32 Version: 4.4.7 - Samsung)
Easy SpeedUp Manager (x32 Version: 2.1.1.1 - Samsung Electronics Co.,Ltd.)
EasyBatteryManager (x32 Version: 4.0.0.4 - Samsung)
EasyFileShare (x32 Version: 1.0.13 - Samsung)
Epson Connect Printer Setup (x32 Version: 1.0.2 - SEIKO EPSON CORPORATION)
Epson Download Navigator (x32 Version: 1.0.1 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print 2 (x32 Version: 2.3.0.0 - SEIKO EPSON CORPORATION)
Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser) (x32 Version: 1.00.0000 - SEIKO EPSON CORPORATION2)
Epson Event Manager (x32 Version: 2.50.0000 - SEIKO EPSON CORPORATION)
Epson Print CD (x32 Version: 2.05.00 - SEIKO EPSON CORPORATION)
EPSON PX730 Series Printer Uninstall (Version: - SEIKO EPSON Corporation)
EPSON Scan (x32 Version: - Seiko Epson Corporation)
EpsonNet Print (x32 Version: 2.4j - SEIKO EPSON CORPORATION)
ETDWare PS/2-X64 8.0.7.2_WHQL (Version: 8.0.7.2 - ELAN Microelectronic Corp.)
Farm Frenzy (x32 Version: 2.2.0.82 - WildTangent) Hidden
Fast Start (x32 Version: 2.2.0.0 - SAMSUNG)
Fotogalerija Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Free Easy Burner V 5.1 (x32 Version: 5.1.0.0 - Koyote soft)
Galeria de Fotografias do Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie foto Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Google Chrome (x32 Version: 32.0.1700.107 - Google Inc.)
Google Earth Plug-in (x32 Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.22.3 - Google Inc.) Hidden
HTC Driver Installer (x32 Version: 4.0.0.007 - HTC Corporation)
HTC Sync Manager (x32 Version: 1.1.27.0 - HTC)
Insaniquarium Deluxe (x32 Version: 2.2.0.82 - WildTangent) Hidden
Intel(R) Control Center (x32 Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Management Engine Components (x32 Version: 7.0.0.1118 - Intel Corporation)
Intel(R) Processor Graphics (x32 Version: 8.15.10.2253 - Intel Corporation)
Intel(R) Rapid Storage Technology (x32 Version: 10.1.5.1001 - Intel Corporation)
Intel® Turbo Boost-teknologi monitor 2.0 (Version: 2.0.82.0 - Intel)
IPTInstaller (x32 Version: 4.0.4 - HTC)
iTunes (Version: 11.0.2.26 - Apple Inc.)
Java 7 Update 51 (x32 Version: 7.0.510 - Oracle)
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
John Deere Drive Green (x32 Version: 2.2.0.82 - WildTangent) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Click-to-Run 2010 (Version: 14.0.4763.1000 - Microsoft Corporation) Hidden
Microsoft Office Click-to-Run 2010 (x32 Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Single Image 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft PowerPoint Viewer (x32 Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219 - Microsoft Corporation)
Movie Color Enhancer (x32 Version: 1.0 - Samsung Electronics Co., Ltd.)
Mozilla Firefox 26.0 (x86 en-US) (x32 Version: 26.0 - Mozilla)
Mozilla Maintenance Service (x32 Version: 26.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT Redists (Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT Redists (x32 Version: 1.0 - Sony Creative Software Inc.) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (x32 Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (x32 Version: 4.30.2117.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (x32 Version: 4.30.2100.0 - Microsoft Corporation)
Multimedia POP (x32 Version: 1.1 - )
Nettverkshåndbok EPSON PX730 Series (x32 Version: - )
Norton Internet Security (x32 Version: 21.1.0.18 - Symantec Corporation)
Norton Management (x32 Version: 3.2.2.12 - Symantec Corporation)
NVIDIA Control Panel 310.70 (Version: 310.70 - NVIDIA Corporation) Hidden
NVIDIA Graphics Driver 310.70 (Version: 310.70 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.95.599 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA PhysX (x32 Version: 9.12.1031 - NVIDIA Corporation) Hidden
NVIDIA PhysX System Software 9.12.1031 (Version: 9.12.1031 - NVIDIA Corporation)
NVIDIA Update 1.11.3 (Version: 1.11.3 - NVIDIA Corporation)
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
Peggle (x32 Version: 2.2.0.82 - WildTangent) Hidden
Penguins! (x32 Version: 2.2.0.82 - WildTangent) Hidden
Plants vs. Zombies (x32 Version: 2.2.0.82 - WildTangent) Hidden
Poczta usługi Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Polar Golfer (x32 Version: 2.2.0.82 - WildTangent) Hidden
Pošta Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
QuickTime (x32 Version: 7.73.80.64 - Apple Inc.)
Raccolta foto di Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek Ethernet Controller Driver (x32 Version: 7.45.516.2011 - Realtek)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6400 - Realtek Semiconductor Corp.)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.30.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.0.30.0 - Renesas Electronics Corporation) Hidden
Samsung AnyWeb Print (x32 Version: 2.0.67.1 - Samsung Electronics Co., Ltd.)
Samsung Printer Live Update (x32 Version: - Samsung Electronics Co., Ltd.)
Samsung Recovery Solution 5 (x32 Version: 5.0.0.9 - Samsung)
Samsung Support Center 1.0 (x32 Version: 1.1.38 - Samsung)
Samsung Universal Print Driver (x32 Version: 2.02.05.00:27 - Samsung Electronics Co., Ltd.)
Samsung Universal Scan Driver (x32 Version: 1.2.5.0 - Samsung Electronics Co., Ltd.)
Samsung Update Plus (x32 Version: 3.0.0.17 - Samsung Electronics Co., Ltd.)
Search Assistant SimpleSpeedy 1.74 (x32 Version: - )
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Skype Click to Call (x32 Version: 6.13.13771 - Skype Technologies S.A.)
Skype™ 6.11 (x32 Version: 6.11.102 - Skype Technologies S.A.)
Spotify (HKCU Version: 0.9.7.16.g4b197456 - Spotify AB)
System Requirements Lab for Intel (x32 Version: 4.5.13.0 - Husdawg, LLC)
TeamViewer 7 (x32 Version: 7.0.14563 - TeamViewer)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (x32 Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (x32 Version: 3 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2810071) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2826026) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2810072) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2553145) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2810066) 32-Bit Edition (x32 Version: - Microsoft)
Update for Microsoft Word 2010 (KB2837593) 32-Bit Edition (x32 Version: - Microsoft)
User Guide (x32 Version: 1.5 - )
Vegas Movie Studio HD 11.0 (x32 Version: 11.0.75 - Sony)
VLC media player 2.0.7 (x32 Version: 2.0.7 - VideoLAN)
WIDCOMM Bluetooth Software (Version: 6.3.0.7000 - Broadcom Corporation)
WildTangent Games (x32 Version: 1.0.1.5 - WildTangent)
WildTangent ORB Game Console (x32 Version: - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live fotoattēlu galerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogaléria (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Foto-galerija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalleri (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotoğraf Galerisi (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotótár (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galeria de Fotos (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Galerija fotografija (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Pošta (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Temel Parçalar (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 메일 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 사진 갤러리 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 필수 패키지 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 影像中心 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 照片库 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live 程式集 (x32 Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live 软件包 (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven asennustyökalu (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven sähköposti (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Liven valokuvavalikoima (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Wondershare Video Converter Ultimate(Build 6.7.1.0) (x32 Version: 6.7.1.0 - Wondershare Software)
Zuma Deluxe (x32 Version: 2.2.0.95 - WildTangent) Hidden
Συλλογή φωτογραφιών του Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Основные компоненты Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Почта Windows Live (x32 Version: 15.4.3502.0922 - Корпорация Майкрософт) Hidden
Фотоальбом Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Фотогалерия на Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
גלריית התמונות של Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
بريد Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
معرض صور Windows Live (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Restore Points =========================

01-02-2014 07:52:03 Scheduled Checkpoint
03-02-2014 19:11:41 Removed Java 7 Update 51
03-02-2014 19:12:38 Removed Java(TM) 6 Update 35
03-02-2014 19:29:50 Installed Java 7 Update 51

==================== Hosts content: ==========================

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

Task: {1A2501DF-D042-41FD-9814-E6EF03BA36CB} - System32\Tasks\WifiManager => C:\Program Files (x86)\Samsung\Easy Display Manager\WifiManager.exe [2010-12-06] (Samsung Electronics Co., Ltd.)
Task: {1CEF7118-3014-4077-9F4C-C0835737D4F3} - System32\Tasks\SUPBackground => C:\Program Files (x86)\Samsung\Samsung Update Plus\SUPBackground.exe [2011-01-11] (Samsung Electronics)
Task: {1F6B873C-6BD6-4BCE-88B0-715E7F18A8C6} - System32\Tasks\SmartRestarter => C:\Program Files\Samsung\SamsungFastStart\SmartRestarter.exe [2010-08-05] (Samsung Electronics Co., Ltd.)
Task: {2D65E3E8-62C6-4B57-B87C-D8A098C55FD0} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\WSCStub.exe [2013-10-08] (Symantec Corporation)
Task: {2E76C4A0-E44A-41FE-83CF-3CB9A837F00A} - System32\Tasks\{2C86C5EE-F932-43FE-A32B-4C95DD52BD86} => Firefox.exe ui.skype.com/ui/0/5.10.0.116/no/abandoninstall?source=lightinstaller&page=tsMain
Task: {364B937E-89A1-47D0-9F4E-FBF2EED05E13} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe [2013-08-01] (Symantec Corporation)
Task: {3BD1A344-58B2-4D61-A537-FD21F8BD1C56} - System32\Tasks\{839D40F4-9FA8-45FE-8FF5-84AD1FA054B6} => Firefox.exe ui.skype.com/ui/0/5.10.0.116.259/en/abandoninstall?source=lightinstaller&page=tsMain
Task: {40F8C61E-E802-4323-B3B1-A64DBED52735} - System32\Tasks\SamsungSupportCenter => C:\Program Files (x86)\Samsung\Samsung Support Center\SSCKbdHk.exe [2011-09-04] (SAMSUNG Electronics)
Task: {482C2BBA-9684-430F-BA3B-C77851517B6E} - System32\Tasks\MovieColorEnhancer => C:\Program Files (x86)\Samsung\Movie Color Enhancer\MovieColorEnhancer.exe [2010-11-29] (Samsung Electronics Co., Ltd.)
Task: {496A2F4C-3173-47B9-AFE5-8C8BE9C10864} - System32\Tasks\Adobe Flash Player Updater => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-12-13] (Adobe Systems Incorporated)
Task: {4BDB74B4-BC40-4086-9901-B55FC287ECC0} - System32\Tasks\{46479496-778A-4E8A-93B2-78532300DE06} => Firefox.exe ui.skype.com/ui/0/5.10.0.116.259/no/abandoninstall?source=lightinstaller&page=tsMain
Task: {57F80B5B-4183-4718-9EE2-5DC07C0BF971} - System32\Tasks\schedule!1143840799 => C:\ProgramData\BetterSoft\ContinueToSave\ContinueToSave.exe [2013-01-23] () <==== ATTENTION
Task: {5F03117C-4049-40EF-B6D2-3EE714C4CEFA} - System32\Tasks\EasyBatteryManager => C:\Program Files (x86)\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe [2010-07-20] (SAMSUNG Electronics co., LTD.)
Task: {63AE5476-901A-48C6-890E-B828E7E9FB70} - System32\Tasks\Norton Management\Norton Error Processor => C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\SymErr.exe [2012-10-19] (Symantec Corporation)
Task: {66A78BAD-9FB0-4CC9-BC6F-9300F38A1768} - System32\Tasks\{37E5D2B6-F2A1-4117-9B93-1F65A7077C6B} => Firefox.exe ui.skype.com/ui/0/5.10.0.116.259/no/abandoninstall?source=lightinstaller&page=tsMain
Task: {76802BB8-134A-4992-8BF7-84D78854A9E9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {76AFAFE3-8415-460F-9BF0-9ECAF1D19DC2} - System32\Tasks\{AF0C0C24-76E4-4D3F-B87E-1830D8E4F830} => Firefox.exe ui.skype.com/ui/0/5.10.0.116.259/no/abandoninstall?source=lightinstaller&page=tsMain
Task: {858A78CB-DA1E-45F0-BC81-F147831D131E} - System32\Tasks\{7280B5A8-4635-421E-BC11-CE32C82E8BEF} => Firefox.exe ui.skype.com/ui/0/5.10.0.116.259/no/abandoninstall?source=lightinstaller&page=tsMain
Task: {88FDB142-A5C9-4B86-83C2-DF705DB192FB} - System32\Tasks\Norton Management\Norton Error Analyzer => C:\Program Files (x86)\Norton Management\Engine\3.2.2.12\SymErr.exe [2012-10-19] (Symantec Corporation)
Task: {8A564261-F579-4630-9C3F-6F9FC78C8380} - System32\Tasks\EasySpeedUpManager => C:\Program Files (x86)\Samsung\EasySpeedUpManager\EasySpeedUpManager2.exe [2010-12-23] (Samsung Electronics)
Task: {8D79F279-A8E1-46FF-89DB-A52B220B9BF2} - System32\Tasks\EasyDisplayMgr => C:\Program Files (x86)\Samsung\Easy Display Manager\dmhkcore.exe [2010-12-06] (Samsung Electronics Co., Ltd.)
Task: {AF67F0D5-1724-4DB6-9BB2-449469FB84F0} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2010-11-10] (CyberLink)
Task: {B161F324-6B55-4683-98B9-E65B89BD17ED} - System32\Tasks\advSRS5 => C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\WCScheduler.exe [2010-11-17] (SEC)
Task: {B22A5F1F-3B10-4664-9092-F85F29856C7E} - System32\Tasks\EasyPartitionManager => C:\Windows\MSetup\BA46-12225A02\EPM.exe
Task: {BFADB8BE-EC48-459D-A0DC-37031A599878} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-25] (Google Inc.)
Task: {CCCAF9EB-2032-4523-9178-8E2CBB281243} - System32\Tasks\BatteryLifeExtender => C:\Program Files (x86)\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe [2010-12-18] (Samsung Electronics. Co. Ltd.)
Task: {D04F7C42-CCF6-4394-842A-D978C32C0F87} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\21.1.0.18\SymErr.exe [2013-08-01] (Symantec Corporation)
Task: {D22E3716-CEAB-4E0C-81BF-4BEE288017D5} - System32\Tasks\{2C54D6F0-A51B-4381-A614-F0AFEAD7AC80} => Firefox.exe ui.skype.com/ui/0/5.10.0.116.259/no/abandoninstall?source=lightinstaller&page=tsMain
Task: {EB327114-DD7F-4FA3-8E98-E64E3E4ED800} - System32\Tasks\{CD5F801F-F0E6-4A9D-8A13-FE1748CA5298} => Firefox.exe ui.skype.com/ui/0/5.10.0.116/no/abandoninstall?source=lightinstaller&page=tsMain
Task: {FA8BB896-8978-4CF7-B1E1-6DA17952D787} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2013-02-25] (Google Inc.)
Task: C:\windows\Tasks\Adobe Flash Player Updater.job => C:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\schedule!1143840799.job => C:\ProgramData\BetterSoft\ContinueToSave\ContinueToSave.exe <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2014-01-05 17:30 - 2013-08-23 13:36 - 00721263 _____ () C:\windows\SysWOW64\WSCM64.dll
2011-11-01 23:26 - 2011-11-01 23:26 - 00087912 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-11-01 23:26 - 2011-11-01 23:26 - 01242472 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2012-09-26 18:11 - 2012-09-26 18:11 - 00024496 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DbAccess.dll
2012-09-26 18:12 - 2012-09-26 18:12 - 00466256 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\sqlite3.dll
2012-09-26 18:12 - 2012-09-26 18:12 - 00043944 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NAdvLog.dll
2012-09-26 18:12 - 2012-09-26 18:12 - 00035776 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\NFileCacheDBAccess.dll
2012-09-26 18:15 - 2012-09-26 18:15 - 00223152 _____ () C:\Program Files (x86)\HTC\HTC Sync Manager\DevConnMon.dll
2011-07-30 00:21 - 2006-08-12 04:48 - 00049152 _____ () C:\Program Files (x86)\Samsung\Easy Display Manager\HookDllPS2.dll
2011-07-29 23:06 - 2010-07-05 11:42 - 00203776 _____ () C:\Program Files (x86)\Samsung\Movie Color Enhancer\WinCRT.dll
2013-01-24 12:32 - 2013-01-24 12:32 - 01057280 _____ () C:\Program Files (x86)\ContinueToSave\sprotector.dll
2013-01-24 12:20 - 2013-01-24 12:20 - 01032704 _____ () C:\Program Files (x86)\SimpleSpeedy\sprotector.dll
2011-07-29 23:23 - 2010-05-07 15:22 - 01636864 _____ () C:\Program Files (x86)\Samsung\Samsung Recovery Solution 5\Resdll.dll
2013-01-25 18:35 - 2013-01-25 18:59 - 00120832 _____ () C:\ProgramData\continuetosave\5102c7e7f2dec.dll
2011-07-29 23:25 - 2010-10-25 13:44 - 01973760 _____ () C:\Program Files\Samsung AnyWeb Print\W2PBrowser.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:7631EA83

==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SMR300 => ""="Service"

==================== Faulty Device Manager Devices =============

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

==================== Event log errors: =========================

Application errors:
==================
Error: (02/04/2014 04:35:55 PM) (Source: Application Error) (User: )
Description: Faulting application name: chrome.exe, version: 32.0.1700.102, time stamp: 0x52e09b23
Faulting module name: sprote~1.dll, version: 0.0.0.0, time stamp: 0x51011be0
Exception code: 0xc0000417
Fault offset: 0x000b4981
Faulting process id: 0xe18
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3

Error: (02/04/2014 04:33:45 PM) (Source: Application Error) (User: )
Description: Faulting application name: chrome.exe, version: 32.0.1700.102, time stamp: 0x52e09b23
Faulting module name: sprote~1.dll, version: 0.0.0.0, time stamp: 0x51011be0
Exception code: 0xc0000417
Fault offset: 0x000b4981
Faulting process id: 0x10cc
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3

Error: (02/03/2014 08:45:37 PM) (Source: Application Error) (User: )
Description: Faulting application name: chrome.exe, version: 32.0.1700.102, time stamp: 0x52e09b23
Faulting module name: sprote~1.dll, version: 0.0.0.0, time stamp: 0x51011be0
Exception code: 0xc0000417
Fault offset: 0x000b4981
Faulting process id: 0x13b0
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3

Error: (02/03/2014 08:43:19 PM) (Source: Application Error) (User: )
Description: Faulting application name: chrome.exe, version: 32.0.1700.102, time stamp: 0x52e09b23
Faulting module name: sprote~1.dll, version: 0.0.0.0, time stamp: 0x51011be0
Exception code: 0xc0000417
Fault offset: 0x000b4981
Faulting process id: 0x172c
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3

Error: (02/03/2014 08:39:54 PM) (Source: WinMgmt) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/03/2014 08:36:49 PM) (Source: Application Error) (User: )
Description: Faulting application name: chrome.exe, version: 32.0.1700.102, time stamp: 0x52e09b23
Faulting module name: sprote~1.dll, version: 0.0.0.0, time stamp: 0x51011be0
Exception code: 0xc0000417
Fault offset: 0x000b4981
Faulting process id: 0x1974
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3

Error: (02/03/2014 08:31:13 PM) (Source: Application Error) (User: )
Description: Faulting application name: chrome.exe, version: 32.0.1700.102, time stamp: 0x52e09b23
Faulting module name: sprote~1.dll, version: 0.0.0.0, time stamp: 0x51011be0
Exception code: 0xc0000417
Fault offset: 0x000b4981
Faulting process id: 0x1ad4
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3

Error: (02/03/2014 08:29:50 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error calling routine ConvertStringSidToSid(S-1-5-21-1567553520-2598224956-3562314209-1008.bak). hr = 0x80070539, The security ID structure is invalid.
.

Operation:
OnIdentify event
Gathering Writer Data

Context:
Execution Context: Shadow Copy Optimization Writer
Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Name: Shadow Copy Optimization Writer
Writer Instance ID: {5c64a834-3467-49b2-97d1-b3b2f4618e4e}

Error: (02/03/2014 08:28:41 PM) (Source: Application Error) (User: )
Description: Faulting application name: chrome.exe, version: 32.0.1700.102, time stamp: 0x52e09b23
Faulting module name: sprote~1.dll, version: 0.0.0.0, time stamp: 0x51011be0
Exception code: 0xc0000417
Fault offset: 0x000b4981
Faulting process id: 0x19d4
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3

Error: (02/03/2014 08:26:31 PM) (Source: Application Error) (User: )
Description: Faulting application name: chrome.exe, version: 32.0.1700.102, time stamp: 0x52e09b23
Faulting module name: sprote~1.dll, version: 0.0.0.0, time stamp: 0x51011be0
Exception code: 0xc0000417
Fault offset: 0x000b4981
Faulting process id: 0x10a0
Faulting application start time: 0xchrome.exe0
Faulting application path: chrome.exe1
Faulting module path: chrome.exe2
Report Id: chrome.exe3

System errors:
=============
Error: (02/04/2014 08:45:48 PM) (Source: DCOM) (User: Arthur-PC)
Description: application-specificLocalActivation{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}Arthur-PCArthurS-1-5-21-1567553520-2598224956-3562314209-1001LocalHost (Using LRPC)

Error: (02/04/2014 08:45:48 PM) (Source: DCOM) (User: Arthur-PC)
Description: application-specificLocalActivation{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}Arthur-PCArthurS-1-5-21-1567553520-2598224956-3562314209-1001LocalHost (Using LRPC)

Error: (02/04/2014 08:45:48 PM) (Source: DCOM) (User: Arthur-PC)
Description: application-specificLocalActivation{B77C4C36-0154-4C52-AB49-FAA03837E47F}{EA022610-0748-4C24-B229-6C507EBDFDBB}Arthur-PCArthurS-1-5-21-1567553520-2598224956-3562314209-1001LocalHost (Using LRPC)

Error: (02/04/2014 08:41:11 PM) (Source: DCOM) (User: Arthur-PC)
Description: application-specificLocalActivation{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}Arthur-PCArthurS-1-5-21-1567553520-2598224956-3562314209-1001LocalHost (Using LRPC)

Error: (02/04/2014 08:41:11 PM) (Source: DCOM) (User: Arthur-PC)
Description: application-specificLocalActivation{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}Arthur-PCArthurS-1-5-21-1567553520-2598224956-3562314209-1001LocalHost (Using LRPC)

Error: (02/04/2014 08:41:10 PM) (Source: DCOM) (User: Arthur-PC)
Description: application-specificLocalActivation{B77C4C36-0154-4C52-AB49-FAA03837E47F}{EA022610-0748-4C24-B229-6C507EBDFDBB}Arthur-PCArthurS-1-5-21-1567553520-2598224956-3562314209-1001LocalHost (Using LRPC)

Error: (02/03/2014 08:00:25 PM) (Source: DCOM) (User: )
Description: {51FA2736-5DEE-11D4-98E8-006008BF430C}

Error: (02/03/2014 07:56:19 PM) (Source: DCOM) (User: )
Description: {51FA2736-5DEE-11D4-98E8-006008BF430C}

Error: (02/01/2014 07:33:44 AM) (Source: Service Control Manager) (User: )
Description: The NVIDIA Update Service Daemon service hung on starting.

Error: (02/01/2014 07:29:38 AM) (Source: Service Control Manager) (User: )
Description: The Windows Search service failed to start due to the following error:
%%1053

Microsoft Office Sessions:
=========================
Error: (02/04/2014 04:35:55 PM) (Source: Application Error)(User: )
Description: chrome.exe32.0.1700.10252e09b23sprote~1.dll0.0.0.051011be0c0000417000b4981e1801cf21be8278f226C:\Program Files (x86)\Google\Chrome\Application\chrome.exec:\progra~2\contin~1\sprote~1.dll08c166f6-8db2-11e3-b27d-e81132a1d846

Error: (02/04/2014 04:33:45 PM) (Source: Application Error)(User: )
Description: chrome.exe32.0.1700.10252e09b23sprote~1.dll0.0.0.051011be0c0000417000b498110cc01cf21be35a81404C:\Program Files (x86)\Google\Chrome\Application\chrome.exec:\progra~2\contin~1\sprote~1.dllbb4486f5-8db1-11e3-b27d-e81132a1d846

Error: (02/03/2014 08:45:37 PM) (Source: Application Error)(User: )
Description: chrome.exe32.0.1700.10252e09b23sprote~1.dll0.0.0.051011be0c0000417000b498113b001cf21183a1252faC:\Program Files (x86)\Google\Chrome\Application\chrome.exec:\progra~2\contin~1\sprote~1.dllc04ed115-8d0b-11e3-b27d-e81132a1d846

Error: (02/03/2014 08:43:19 PM) (Source: Application Error)(User: )
Description: chrome.exe32.0.1700.10252e09b23sprote~1.dll0.0.0.051011be0c0000417000b4981172c01cf2117e6e7c312C:\Program Files (x86)\Google\Chrome\Application\chrome.exec:\progra~2\contin~1\sprote~1.dll6e560ca8-8d0b-11e3-b27d-e81132a1d846

Error: (02/03/2014 08:39:54 PM) (Source: WinMgmt)(User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (02/03/2014 08:36:49 PM) (Source: Application Error)(User: )
Description: chrome.exe32.0.1700.10252e09b23sprote~1.dll0.0.0.051011be0c0000417000b4981197401cf2116ff3c6ebfC:\Program Files (x86)\Google\Chrome\Application\chrome.exec:\progra~2\contin~1\sprote~1.dll85a0b901-8d0a-11e3-ba02-90a4de9fc590

Error: (02/03/2014 08:31:13 PM) (Source: Application Error)(User: )
Description: chrome.exe32.0.1700.10252e09b23sprote~1.dll0.0.0.051011be0c0000417000b49811ad401cf211638663e9dC:\Program Files (x86)\Google\Chrome\Application\chrome.exec:\progra~2\contin~1\sprote~1.dllbdcf6410-8d09-11e3-ba02-90a4de9fc590

Error: (02/03/2014 08:29:50 PM) (Source: VSS)(User: )
Description: ConvertStringSidToSid(S-1-5-21-1567553520-2598224956-3562314209-1008.bak)0x80070539, The security ID structure is invalid.

Operation:
OnIdentify event
Gathering Writer Data

Context:
Execution Context: Shadow Copy Optimization Writer
Writer Class Id: {4dc3bdd4-ab48-4d07-adb0-3bee2926fd7f}
Writer Name: Shadow Copy Optimization Writer
Writer Instance ID: {5c64a834-3467-49b2-97d1-b3b2f4618e4e}

Error: (02/03/2014 08:28:41 PM) (Source: Application Error)(User: )
Description: chrome.exe32.0.1700.10252e09b23sprote~1.dll0.0.0.051011be0c0000417000b498119d401cf2115dcf3f314C:\Program Files (x86)\Google\Chrome\Application\chrome.exec:\progra~2\contin~1\sprote~1.dll62c1a071-8d09-11e3-ba02-90a4de9fc590

Error: (02/03/2014 08:26:31 PM) (Source: Application Error)(User: )
Description: chrome.exe32.0.1700.10252e09b23sprote~1.dll0.0.0.051011be0c0000417000b498110a001cf21158ea48047C:\Program Files (x86)\Google\Chrome\Application\chrome.exec:\progra~2\contin~1\sprote~1.dll15448481-8d09-11e3-ba02-90a4de9fc590

==================== Memory info ===========================

Percentage of memory in use: 28%
Total physical RAM: 8104.29 MB
Available physical RAM: 5775.08 MB
Total Pagefile: 14244.47 MB
Available Pagefile: 11460.91 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:271 GB) (Free:128.48 GB) NTFS
Drive d: () (Fixed) (Total:404.18 GB) (Free:195.88 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: 3E5B2712)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=271 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=404 GB) - (Type=OF Extended)
Partition 4: (Not Active) - (Size=23 GB) - (Type=27)

==================== End Of Log ============================

Last Edit: Feb 6, 2014 13:16:24 GMT -8 by Quads

dbrisen
Malware Removalists

Posts: 3,688

Fake App Attack: Misleading App File Downloading 3 #? Feb 5, 2014 8:42:54 GMT -8

Post by dbrisen on Feb 5, 2014 8:42:54 GMT -8

Quads will be by later to check your logs for the fine details that need to be removed; he's in NZ so there is a time zone lag somewhat. In the mean time, please go to Start > Control Panel > Programs and Features and uninstall the following programs:

ContinueToSave
Search Assistant SimpleSpeedy

These should uninstall easily; please tell us how the uninstall goes. This is to help with browser crashes; there is still much more to clean up.

I will not provide malware removal by PM; please post in your thread on the Malware Removal board.
My help is always free but if you would like to help encourage me or show your thanks -----> DONATE

Fake App Attack: Misleading App File Downloading 3 #?

Post by blazzen on Feb 4, 2014 8:07:11 GMT -8

Post by blazzen on Feb 4, 2014 8:07:58 GMT -8

Post by blazzen on Feb 4, 2014 8:41:24 GMT -8

Post by blazzen on Feb 4, 2014 11:13:10 GMT -8

Post by blazzen on Feb 4, 2014 11:38:57 GMT -8

Post by Quads on Feb 4, 2014 14:37:07 GMT -8

Post by blazzen on Feb 5, 2014 7:45:43 GMT -8

Post by dbrisen on Feb 5, 2014 8:11:06 GMT -8

Post by blazzen on Feb 5, 2014 8:31:38 GMT -8

Post by dbrisen on Feb 5, 2014 8:42:54 GMT -8