Search Protect #?

new

lh
New Helpee

Posts: 36

Search Protect #? Jul 6, 2014 9:58:53 GMT -8

Post by lh on Jul 6, 2014 9:58:53 GMT -8

Hello. I have Search Protect stuck on my computer, and I'm currently fighting off a flurry of ads as I type this.

Also, the computer has been grinding pretty hard and trying to cool off a lot lately.

I cannot uninstall the program, so I am left hanging as to what to do. I know that every computer is different, and so can the instructions for each computer.

Is there anyone here who knows how to handle this? This is our family computer!

Last Edit: Aug 3, 2014 21:09:22 GMT -8 by Quads

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Search Protect #? Jul 6, 2014 10:26:31 GMT -8

Post by Quads on Jul 6, 2014 10:26:31 GMT -8

Do Not use advanced tools or any tools used on this board without supervision.

Malware removal can be difficult over a forum as it is, without a user doing their own actions, the tools used are more advanced and thus have added danger that comes with that. This board is protected so that only Malware removers, Admin and Mods can reply to a users thread but all members can create a thread asking for removal of Infection(s)

Make changes to your computer only when the Malware Expert specifically states it. The Malware Experts request specific steps to be followed, as some malware removal requires multiple steps and evaluations along the way. When you take other advice or make other changes, this often negates the work done by the expert, and can sometimes result in an inoperable system.

This also includes any tools or steps other than those the from the Malware Expert. We need to be certain about the state of your system to see what actually is going on, and what is required to fix the system while not harming the rest of the system. Most often, well-intentioned independent efforts can make things much worse. The malware remediation tools are more advanced than othe tools, and can often create bigger problems when used without expert guidance.

Follow all the directions in order, and to the end. Please perform all steps in the order they are listed in each set of instructions. As you might imagine, some steps are a bit complicated. If things are not clear, be sure to stop and let the Malware Expert know the problem. We don't mind clarifying a situation, as others might have the same question. If a tool does not run as expected, don't force it. Stop the steps, and update the forum topic with the current situation. It is better stop and let us know, than to force a tool to run and cause bigger problems.

Also, when your computer is clean and we are finished, the Expert will tell you we are finished. Malware removal is a process that requires verification, and we want to be sure your system is completely clean before we're done.

When describing your problem, provide as much information as possible, as soon as possible. Explain as best you can what happens with your computer, e.g. it beeps three times, black screen with cursor then goes no further, system gets stuck at the Windows startup logo, etc. This helps the expert to understand what is happening to the system and what may be wrong. If your computer cannot start up successfully please provide details about your installed Windows Operating System, including the Version, Edition and if it is a 32bit or a 64bit system. (e.g. Windows Vista Home Premium 32-bit)

When the user follow instructions and things still go a little haywire, and it does happen, it is up to us to sort the extra problem out.

Take longer to read if your language is not English, so that hopefully it is understood.

Reply stating you have read the post fully.

I also if it is busy (have a lot of systems at once to deal with) like being in a supermarket checkout line, waiting their turn, I use the forum like a checkout line.

Quads

lh
New Helpee

Posts: 36

Search Protect #? Jul 6, 2014 12:00:59 GMT -8

Post by lh on Jul 6, 2014 12:00:59 GMT -8

Hello Quads. Thanks for taking time out for me on this. I'll be leaving for work in thirty minutes, so I will not be able to begin implementing your advice until I get home at 5 in the morning.

I've read the post, and I am ready for your instructions.

Quads Malware Removalists In New Zealand Posts: 9,387	Search Protect #? Jul 6, 2014 14:09:16 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Quads on Jul 6, 2014 14:09:16 GMT -8 What is your operating system including if it is 32 bit or 64 bit?? Quads

lh New Helpee Posts: 36	Search Protect #? Jul 7, 2014 2:19:19 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by lh on Jul 7, 2014 2:19:19 GMT -8 Okay. Off work now. The operating system is 64-bit.

Quads
Malware Removalists

In New Zealand

Posts: 9,387

Search Protect #? Jul 7, 2014 10:45:15 GMT -8

Post by Quads on Jul 7, 2014 10:45:15 GMT -8

Due to the system working hard, if FRST does not want to work as the system is going flat tack, don't force it, we will use a different way.

Read Slowly and all of it.

Please download www.bleepingcomputer.com/download/farbar-recovery-scan-tool/ You need to download the 64 bit version.

Place FRST64.exe onto your desktop from where ever it downloaded to.

Start FRST64 that is on your Desktop

The tool will start to run.
When the tool opens click Yes to disclaimer. (if it does)

Press Scan button.

It will make a logs (FRST.txt and addition.txt) on your Desktop Please attach the log in your reply back. Or open the logs in notepad and copy the logs and paste back in a message as a reply.

Quads

lh
New Helpee

Posts: 36

Search Protect #? Jul 7, 2014 15:04:16 GMT -8

Post by lh on Jul 7, 2014 15:04:16 GMT -8

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 05-07-2014 01
Ran by Michael and Anna (administrator) on NOBIOUSMACHINE on 07-07-2014 17:40:51
Running from C:\Users\Michael and Anna\Desktop
Platform: Windows Vista (TM) Home Premium Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 7
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Agere Systems) C:\Program Files\LSI SoftModem\agr64svc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe
() C:\Windows\SysWOW64\PnkBstrA.exe
() C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
() C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAANTmon.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(The Privoxy team - http://www.privoxy.org) C:\Program Files (x86)\MSR\Privoxy\privoxy.exe
() C:\Windows\mHotkey.exe
(Microsoft Corporation) C:\Program Files\Windows Defender\MSASCui.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(PixArt Imaging Incorporation) C:\Windows\PixArt\Pac207\Monitor.exe
(Primax Electronics Ltd.) C:\Program Files\Rocketfish 2.4G Wireless Combo\ICO.EXE
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Chicony) C:\Windows\ChiFuncExt.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\ehome\ehsched.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe
(Creative) C:\Windows\CNYHKey.exe
(IOI) C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe
(CyberLink) C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\HP Software Update\hpwuSchd2.exe
(iMesh, Inc) C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\datamngrUI.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(RealNetworks, Inc.) C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
() C:\Program Files (x86)\Open JDK Explorer\ywnmon32.exe
(Microsoft Corporation) C:\Windows\ehome\ehrecvr.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Chicony) C:\Windows\ModLEDKey.exe
(kikillookj) C:\Users\Michael and Anna\AppData\Roaming\System32\csrss.exe
(Hewlett-Packard Co.) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqste08.exe
(Yahoo! Inc.) C:\Program Files (x86)\Yahoo!\Messenger\Ymsgr_tray.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Google Inc.) C:\Users\Michael and Anna\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael and Anna\AppData\Local\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Users\Michael and Anna\AppData\Local\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\Magnify.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] => C:\Program Files\Windows Defender\MSASCui.exe [1584184 2008-01-20] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] => C:\Program Files (x86)\Intel\Intel Matrix Storage Manager\iaanotif.exe [182808 2008-09-12] (Intel Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [7212576 2009-03-10] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-10] (Realtek Semiconductor Corp.)
HKLM\...\Run: [Monitor] => C:\Windows\PixArt\PAC207\Monitor.exe [319488 2006-11-03] (PixArt Imaging Incorporation)
HKLM\...\Run: [Mouse Suite 98 Daemon] => C:\Program Files\Rocketfish 2.4G Wireless Combo\ICO.EXE [114688 2009-07-18] (Primax Electronics Ltd.)
HKLM-x32\...\Run: [LchDrvKey] => C:\Windows\LchDrvKey.exe [36864 2007-03-28] ()
HKLM-x32\...\Run: [LedKey] => C:\Windows\CNYHKey.exe [339968 2008-04-23] (Creative)
HKLM-x32\...\Run: [Gateway Photo Frame] => C:\Program Files (x86)\Gateway Photo Frame\ButtonMonitor.exe [45056 2009-02-26] (IOI)
HKLM-x32\...\Run: [CLMLServer] => C:\Program Files (x86)\Cyberlink\Power2Go\CLMLSvc.exe [104936 2008-07-18] (CyberLink)
HKLM-x32\...\Run: [HP Software Update] => C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49152 2006-12-10] (Hewlett-Packard Co.)
HKLM-x32\...\Run: [DATAMNGR] => C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\datamngrUI.exe [1700784 2011-10-11] (iMesh, Inc)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [43848 2014-04-23] (Apple Inc.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2012-10-25] (Apple Inc.)
HKLM-x32\...\Run: [TkBellExe] => C:\Program Files (x86)\Real\RealPlayer\Update\realsched.exe [295512 2013-03-28] (RealNetworks, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-05-26] (Apple Inc.)
HKLM-x32\...\Run: [Windows YWN Monitor] => C:\Program Files (x86)\Open JDK Explorer\ywnmon32.exe [988160 2014-07-02] ()
HKLM-x32\...\Run: [ywnmon32] => C:\Program Files (x86)\Open JDK Explorer\ywnmon32.exe [988160 2014-07-02] ()
HKLM-x32\...\Run: [AnyProtect Scanner] => "C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe"
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] => rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [152064 2008-07-03] (Microsoft Corporation)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [Google Update] => C:\Users\Michael and Anna\AppData\Local\Google\Update\GoogleUpdate.exe [135664 2010-01-28] (Google Inc.)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [Messenger (Yahoo!)] => C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [5252408 2010-06-01] (Yahoo! Inc.)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: => C:\Users\Michael and Anna\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2012-07-12] (Facebook Inc.)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [cdloader] => C:\Users\Michael and Anna\AppData\Roaming\mjusbsp\cdloader2.exe [50592 2011-08-23] (magicJack L.P.)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [GoogleChromeAutoLaunch_9A0471399CC5A1AB4CE5A9DF8CBB2EC1] => C:\Users\Michael and Anna\AppData\Local\Google\Chrome\Application\chrome.exe [860488 2014-06-05] (Google Inc.)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [WMPNSCFG] => C:\Program Files (x86)\Windows Media Player\WMPNSCFG.exe
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [Client Server Runtime Process] => C:\Users\Michael and Anna\AppData\Roaming\csrss.exe [83232 2014-07-06] (kikillookj)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [Host-process Windows (Rundll32.exe)] => C:\Users\Michael and Anna\AppData\Roaming\System32\csrss.exe [83232 2014-07-06] (kikillookj)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\Run: [Service Host Process for Windows] => C:\Users\Michael and Anna\AppData\Roaming\System32\svchost.exe [83232 2014-07-06] (kikillookj)
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\MountPoints2: G - G:\wd_windows_tools\WDSetup.exe
HKU\S-1-5-21-3014262171-891651165-3714923240-1000\...\MountPoints2: {beba2196-ca2a-11de-967c-001d72beddde} - H:\VVD.exe
AppInit_DLLs: C:\PROGRA~2\SearchProtect\SearchProtect\bin\SPVC64Loader.dll => C:\Program Files (x86)\SearchProtect\SearchProtect\bin\SPVC64Loader.dll [220992 2014-06-26] ()
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\datamngr.dll => C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\x64\datamngr.dll [1778568 2011-10-11] (iMesh, Inc)
AppInit_DLLs: C:\PROGRA~2\SEARCH~1\SEARCH~1\x64\IEBHO.dll => C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\x64\IEBHO.dll [1790856 2011-10-11] (iMesh, Inc)
AppInit_DLLs-x32: c:\progra~2\searchprotect\searchprotect\bin\spvc32loader.dll => c:\Program Files (x86)\searchprotect\searchprotect\bin\spvc32loader.dll [182080 2014-06-26] ()
AppInit_DLLs-x32: c:\progra~2\search~1\search~1\datamngr.dll => c:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\datamngr.dll [1236400 2011-10-11] (iMesh, Inc)
AppInit_DLLs-x32: c:\progra~2\search~1\search~1\iebho.dll => c:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\IEBHO.dll [1233800 2011-10-11] (iMesh, Inc)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
ShortcutTarget: Adobe Gamma Loader.lnk -> C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files (x86)\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\Michael and Anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Memeo AutoBackup Launcher.lnk
ShortcutTarget: Memeo AutoBackup Launcher.lnk -> C:\Users\Michael and Anna\AppData\Roaming\Microsoft\Installer\{39A908FD-7322-41AE-B374-C7A076B2FC97}\NewShortcut4_51A847D327C24F7797772AF2A4E486ED.exe (Macrovision Corporation)
Startup: C:\Users\Michael and Anna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Memeo AutoSync Launcher.lnk
ShortcutTarget: Memeo AutoSync Launcher.lnk -> C:\Program Files (x86)\Memeo\AutoSync\MemeoLauncher.exe (Memeo Inc.)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} => C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:8118;https=127.0.0.1:8118
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.drudgereport.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1006&m=sx2800
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1006&m=sx2800
HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1006&m=sx2800
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1006&m=sx2800
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = homepage.gateway.com/rdr.aspx?b=ACGW&l=0409&s=1&o=vp64&d=1006&m=sx2800
URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
URLSearchHook: HKCU - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn13\yt.dll (Yahoo! Inc.)
URLSearchHook: HKCU - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - No File
URLSearchHook: HKCU - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn13\yt.dll (Yahoo! Inc.)
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = search.imesh.com/web?src=ieb&appid=1083&systemid=1&sr=0&q={searchTerms}
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = rocket-find.com/results.php?f=4&q={searchTerms}&a=rckt_cmi_14_27_ch&cd=2XzuyEtN2Y1L1QzutDtDtC0DyBtB0B0E0D0D0D0Ezz0AtC0BtN0D0Tzu0SzytCyCtN1L2XzutBtFtBtCtFtCyEtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StBtByDtDzz0Bzy0DtGtDtCtDtDtG0CtBtCtDtG0F0AyBzytGyBzy0AtCyCzytD0BzzyDyCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0E0E0DyCyEtB0EtG0FyBzzyDtG0EyC0CzytG0DzyyEtAtGtD0FtCyE0FtAtD0CtAtByEyC2Q&cr=302745315&ir=
SearchScopes: HKLM - {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = search.imesh.com/web?src=ieb&appid=1083&systemid=1&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - DefaultScope {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = search.imesh.com/web?src=ieb&appid=1083&systemid=1&sr=0&q={searchTerms}
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKLM-x32 - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW
SearchScopes: HKLM-x32 - {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = search.imesh.com/web?src=ieb&appid=1083&systemid=1&sr=0&q={searchTerms}
SearchScopes: HKCU - DefaultScope {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = rocket-find.com/results.php?f=4&q={searchTerms}&a=rckt_cmi_14_27_ch&cd=2XzuyEtN2Y1L1QzutDtDtC0DyBtB0B0E0D0D0D0Ezz0AtC0BtN0D0Tzu0SzytCyCtN1L2XzutBtFtBtCtFtCyEtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StBtByDtDzz0Bzy0DtGtDtCtDtDtG0CtBtCtDtG0F0AyBzytGyBzy0AtCyCzytD0BzzyDyCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0E0E0DyCyEtB0EtG0FyBzzyDtG0EyC0CzytG0DzyyEtAtGtD0FtCyE0FtAtD0CtAtByEyC2Q&cr=302745315&ir=
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
SearchScopes: HKCU - {67A2568C-7A0A-4EED-AECC-B5405DE63B64} URL = www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7ACGW
SearchScopes: HKCU - {77AA745B-F4F8-45DA-9B14-61D2D95054C8} URL = rocket-find.com/results.php?f=4&q={searchTerms}&a=rckt_cmi_14_27_ch&cd=2XzuyEtN2Y1L1QzutDtDtC0DyBtB0B0E0D0D0D0Ezz0AtC0BtN0D0Tzu0SzytCyCtN1L2XzutBtFtBtCtFtCyEtFtDtN1L1CzutCyEtBzytDyD1V1TtN1L1G1B1V1N2Y1L1Qzu2StBtByDtDzz0Bzy0DtGtDtCtDtDtG0CtBtCtDtG0F0AyBzytGyBzy0AtCyCzytD0BzzyDyCtC2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyB0E0E0DyCyEtB0EtG0FyBzzyDtG0EyC0CzytG0DzyyEtAtGtD0FtCyE0FtAtD0CtAtByEyC2Q&cr=302745315&ir=
SearchScopes: HKCU - {9BB47C17-9C68-4BB3-B188-DD9AF0FD21} URL = search.imesh.com/web?src=ieb&appid=1083&systemid=1&sr=0&q={searchTerms}
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg64.dll (Google Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: SearchCore for Browsers - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\x64\BrowserConnection.dll (SearchCore for Browsers)
BHO-x32: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn13\yt.dll (Yahoo! Inc.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll ()
BHO-x32: RealNetworks Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\IE\rndlbrowserrecordplugin.dll (RealDownloader)
BHO-x32: No Name - {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: IEHlprObj Class - {8CA5ED52-F3FB-4414-A105-2E3491156990} - C:\Users\Michael and Anna\Desktop\iWin Games\iWinGamesHookIE.dll No File
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO-x32: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Skype add-on for Internet Explorer - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll (Google Inc.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: SearchCore for Browsers - {BE7A24F5-69CB-4708-B77B-B1EDA6043B95} - C:\Program Files (x86)\SearchCore for Browsers\SearchCore for Browsers\BrowserConnection.dll (SearchCore for Browsers)
BHO-x32: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files (x86)\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn2\YTSingleInstance.dll (Yahoo! Inc)
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn13\yt.dll (Yahoo! Inc.)
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKLM-x32 - MediaBar - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\Program Files (x86)\iMesh Applications\MediaBar\Datamngr\ToolBar\imeshdtxmltbpi.dll ()
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
Toolbar: HKCU - &Links - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\Windows\system32\ieframe.dll (Microsoft Corporation)
DPF: HKLM-x32 {406B5949-7190-4245-91A9-30A17DE16AD0} photo2.walgreens.com/WalgreensActivia.cab
DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.5.0.cab
DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.14.0.8117.0416.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 68.105.28.11 68.105.29.11 68.105.28.12

FireFox:
========
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
FF Plugin-x32: @apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @java.com/DTPlugin - C:\Program Files (x86)\Java\jre6\bin\npDeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6 - C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF Plugin-x32: @microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=14.0.8117.0416 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WPF,version=3.5 - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin-x32: @pandonetworks.com/PandoWebPlugin - C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll No File
FF Plugin-x32: @real.com/nppl3260;version=16.0.1.18 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlchromebrowserrecordext;version=1.3.1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlhtml5videoshim;version=1.3.1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlhtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprndlpepperflashvideoshim;version=1.3.1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\MozillaPlugins\nprndlpepperflashvideoshim.dll (RealNetworks, Inc.)
FF Plugin-x32: @real.com/nprpplugin;version=16.0.1.18 - C:\Program Files (x86)\Real\RealPlayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin-x32: @realnetworks.com/npdlplugin;version=1 - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\npdlplugin.dll (RealDownloader)
FF Plugin-x32: @zylom.com/ZylomGamesPlayer - C:\ProgramData\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @skype Limited.com/Facebook Video Calling Plugin - C:\Users\Michael and Anna\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Michael and Anna\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Michael and Anna\AppData\Local\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: amazon.com/AmazonMP3DownloaderPlugin - C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin101799.dll (Amazon.com, Inc.)
FF HKLM-x32\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-07-14]
FF HKLM-x32\...\Firefox\Extensions: [{6E19037A-12E3-4295-8915-ED48BC341614}] - C:\Program Files (x86)\RelevantKnowledge
FF HKLM-x32\...\Firefox\Extensions: [{7BA52691-1876-45ce-9EE6-54BCB3B04BBC}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn
FF HKLM-x32\...\Firefox\Extensions: [{DAC3F861-B30D-40dd-9166-F4E75327FAC7}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext
FF Extension: RealDownloader - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext [2013-03-28]

Chrome:
=======
CHR HomePage: hxxp://www.drudgereport.com/
CHR StartupUrls: "hxxp://www.drudgereport.com/"
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Michael and Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-22]
CHR Extension: (Google Wallet) - C:\Users\Michael and Anna\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-20]
CHR Extension: (Extutil) - C:\Users\MICHAE~1\AppData\Local\Temp\D7ADFCCA-EE7E-442C-9999-C4D14FEF360B [2014-07-05]
CHR Extension: (Managera) - C:\Users\MICHAE~1\AppData\Local\Temp\38fdaae5-8e0e-493c-88ec-e05c3be06e42 [2014-07-05]
CHR HKLM-x32\...\Chrome\Extension: [dhkplhfnhceodhffomolpfigojocbpcb] - C:\Program Files (x86)\Babylon\Babylon-Pro\Utils\BabylonChrome.crx [2014-07-05]
CHR HKLM-x32\...\Chrome\Extension: [idhngdhcfkoamngbedgpaokgjbnpdiji] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Chrome\Ext\realdownloader.crx [2013-03-06]

==================== Services (Whitelisted) =================

R2 AgereModemAudio; C:\Program Files\LSI SoftModem\agr64svc.exe [16896 2008-08-26] (Agere Systems)
S4 CltMngSvc; C:\Program Files (x86)\SearchProtect\Main\bin\CltMngSvc.exe [2832704 2014-06-26] () [File not signed]
R3 hpqcxs08; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll [225280 2007-03-13] (Hewlett-Packard Co.) [File not signed]
R2 hpqddsvc; C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll [131072 2007-03-13] (Hewlett-Packard Co.) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [69632 2006-11-08] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [88064 2006-11-08] (Hewlett-Packard) [File not signed]
R2 PnkBstrA; C:\Windows\SysWOW64\PnkBstrA.exe [66872 2010-06-24] ()
R2 RealNetworks Downloader Resolver Service; C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe [39056 2013-03-06] ()
R2 SystemUpdatekb70007; C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe [18944 2014-05-08] () [File not signed]
S3 aspnet_state; %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [X]
S2 iWinTrusted; C:\Users\Michael and Anna\Desktop\iWin Games\iWinTrusted.exe [X]
S2 RelevantKnowledge; C:\Program Files (x86)\RelevantKnowledge\rlservice.exe /service [X]

==================== Drivers (Whitelisted) ====================

S3 PAC207; C:\Windows\System32\DRIVERS\PFC027.SYS [572416 2006-12-05] (PixArt Imaging Inc.)
S3 pelmouse; C:\Windows\System32\DRIVERS\pelmouse.sys [23040 2010-03-16] (TPMX Electronics Ltd.)
S3 pelusblf; C:\Windows\System32\DRIVERS\pelusblf.sys [32256 2010-03-16] (TPMX Electronics Ltd.)
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-07-07 17:40 - 2014-07-07 17:41 - 00031827 _____ () C:\Users\Michael and Anna\Desktop\FRST.txt
2014-07-07 17:40 - 2014-07-07 17:40 - 00000000 ____D () C:\FRST
2014-07-07 17:38 - 2014-07-07 17:38 - 02084352 _____ (Farbar) C:\Users\Michael and Anna\Desktop\FRST64.exe
2014-07-07 05:34 - 2014-07-07 05:34 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (14).exe
2014-07-07 05:10 - 2014-07-07 05:10 - 00412448 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (13).exe
2014-07-07 05:05 - 2014-07-06 15:56 - 00083232 __RSH (kikillookj) C:\Users\Michael and Anna\AppData\Roaming\csrss.exe
2014-07-07 03:01 - 2014-07-07 03:02 - 00442244 _____ () C:\Windows\dd_vcredistMSI7F1D.txt
2014-07-07 03:01 - 2014-07-07 03:02 - 00011622 _____ () C:\Windows\dd_vcredistUI7F1D.txt
2014-07-07 02:38 - 2014-07-07 02:38 - 00228728 _____ (System Applet ) C:\Users\Michael and Anna\Downloads\Player-Chrome (7).exe
2014-07-07 02:08 - 2014-07-07 02:08 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (12).exe
2014-07-07 00:37 - 2014-07-07 00:37 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (11).exe
2014-07-07 00:15 - 2014-07-07 00:15 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (10).exe
2014-07-06 22:58 - 2014-07-06 22:58 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (9).exe
2014-07-06 22:57 - 2014-07-06 22:57 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (8).exe
2014-07-06 17:23 - 2014-07-06 17:24 - 00294472 _____ (VLCPlayer) C:\Users\Michael and Anna\Downloads\HD_Player__CD5MTCD15543_bf09f61d0980be429c55f92eeb918454.exe
2014-07-06 15:56 - 2014-07-06 15:56 - 00083232 __RSH (kikillookj) C:\Users\Michael and Anna\AppData\Roaming\svchost.exe
2014-07-06 15:56 - 2014-07-06 15:56 - 00083232 __RSH (kikillookj) C:\Users\Michael and Anna\AppData\Roaming\rundll32.exe
2014-07-06 14:55 - 2014-07-06 14:55 - 00412448 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (7).exe
2014-07-06 05:44 - 2014-07-06 05:44 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (6).exe
2014-07-06 05:35 - 2014-07-06 05:35 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (5).exe
2014-07-06 04:42 - 2014-07-06 04:42 - 00000732 _____ () C:\Users\Michael and Anna\AppData\Local\d3d9caps64.dat
2014-07-06 03:25 - 2014-07-06 03:25 - 00412448 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (4).exe
2014-07-06 03:01 - 2014-07-06 03:02 - 00445620 _____ () C:\Windows\dd_vcredistMSI3108.txt
2014-07-06 03:01 - 2014-07-06 03:02 - 00011622 _____ () C:\Windows\dd_vcredistUI3108.txt
2014-07-06 01:26 - 2014-07-06 01:26 - 00225144 _____ (System Applet ) C:\Users\Michael and Anna\Downloads\Player-Chrome (6).exe
2014-07-06 00:50 - 2014-07-06 00:50 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (3).exe
2014-07-05 22:14 - 2014-07-05 22:14 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (2).exe
2014-07-05 06:23 - 2014-07-05 06:23 - 00591320 _____ (ClickMeIn Limited) C:\Users\Michael and Anna\AppData\Local\nsn6527.tmp
2014-07-05 06:12 - 2014-07-05 06:23 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Local\29882
2014-07-05 06:12 - 2014-07-05 06:12 - 00410624 _____ () C:\Users\Michael and Anna\AppData\Local\CompTmp.exe
2014-07-05 06:12 - 2014-07-05 06:12 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-07-05 05:57 - 2014-07-05 05:57 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Local\visi_coupon
2014-07-05 05:42 - 2014-07-05 06:22 - 00000903 _____ () C:\Users\Michael and Anna\Desktop\Continue VuuPC Installation.lnk
2014-07-05 05:40 - 2014-07-05 05:40 - 00000000 ____D () C:\ProgramData\374311380
2014-07-05 05:24 - 2014-07-07 17:41 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-05 05:24 - 2014-07-06 06:23 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-07-05 05:24 - 2014-07-05 13:54 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-07-05 05:24 - 2014-07-05 06:43 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-07-05 05:24 - 2014-07-05 06:23 - 00002850 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-07-05 05:24 - 2014-07-05 06:23 - 00002848 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-07-05 05:24 - 2014-07-05 06:23 - 00002848 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-07-05 05:24 - 2014-07-05 06:23 - 00000324 _____ () C:\Users\Michael and Anna\AppData\Roaming\aps.uninstall.scan.results
2014-07-05 05:24 - 2014-07-05 05:24 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-05 05:24 - 2014-07-05 05:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-05 05:24 - 2014-07-05 05:24 - 00003684 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-05 05:24 - 2014-07-05 05:24 - 00000000 ____D () C:\Windows\system32\Macromed
2014-07-05 05:24 - 2014-07-05 05:24 - 00000000 ____D () C:\Systweak
2014-07-05 05:23 - 2014-07-07 17:23 - 00000320 _____ () C:\Windows\Tasks\Rocket Updater.job
2014-07-05 05:23 - 2014-07-05 05:23 - 00003294 _____ () C:\Windows\System32\Tasks\Rocket Updater
2014-07-05 05:23 - 2014-07-05 05:23 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Roaming\RocketUpdater
2014-07-05 05:22 - 2014-07-05 05:31 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Roaming\Systweak
2014-07-05 05:22 - 2014-07-05 05:22 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Local\StormFall
2014-07-05 05:22 - 2014-07-04 13:23 - 00575887 _____ (ClickMeIn Limited) C:\Users\Michael and Anna\AppData\Local\AnyProtectScannerSetup.exe
2014-07-05 05:22 - 2014-06-30 17:55 - 00020328 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2014-07-05 05:10 - 2014-07-07 17:39 - 18001920 _____ () C:\Users\Michael and Anna\AppData\Local\ChromeHitoryDB
2014-07-05 05:10 - 2014-07-05 05:10 - 00421238 _____ () C:\Users\Michael and Anna\AppData\Local\dd_vcredistMSI451F.txt
2014-07-05 05:10 - 2014-07-05 05:10 - 00017472 _____ () C:\Users\Michael and Anna\AppData\Local\dd_vcredistUI451F.txt
2014-07-05 05:10 - 2014-07-05 05:10 - 00000000 ____D () C:\Program Files (x86)\Open JDK Explorer
2014-07-05 05:06 - 2014-07-05 05:06 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Local\SearchProtect
2014-07-05 05:06 - 2014-07-05 05:06 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-07-05 05:05 - 2014-07-05 05:05 - 00229240 _____ (System Applet ) C:\Users\Michael and Anna\Downloads\Java_Updater_Setup.exe
2014-07-05 05:02 - 2014-07-05 05:04 - 00000000 ____D () C:\ProgramData\Battle.net
2014-07-02 04:28 - 2014-07-02 04:28 - 00946472 _____ () C:\Users\Michael and Anna\Downloads\java_installer (2).exe
2014-06-27 23:56 - 2014-06-27 23:56 - 00946472 _____ () C:\Users\Michael and Anna\Downloads\java_installer (1).exe

==================== One Month Modified Files and Folders =======

2014-07-07 17:41 - 2014-07-07 17:40 - 00031827 _____ () C:\Users\Michael and Anna\Desktop\FRST.txt
2014-07-07 17:41 - 2014-07-05 05:24 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-07 17:40 - 2014-07-07 17:40 - 00000000 ____D () C:\FRST
2014-07-07 17:39 - 2014-07-05 05:10 - 18001920 _____ () C:\Users\Michael and Anna\AppData\Local\ChromeHitoryDB
2014-07-07 17:38 - 2014-07-07 17:38 - 02084352 _____ (Farbar) C:\Users\Michael and Anna\Desktop\FRST64.exe
2014-07-07 17:33 - 2006-10-10 13:27 - 02092773 _____ () C:\Windows\WindowsUpdate.log
2014-07-07 17:23 - 2014-07-05 05:23 - 00000320 _____ () C:\Windows\Tasks\Rocket Updater.job
2014-07-07 17:07 - 2010-01-28 23:55 - 00000952 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000UA.job
2014-07-07 16:08 - 2010-01-28 23:55 - 00000900 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000Core.job
2014-07-07 16:04 - 2006-11-02 10:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-07 16:04 - 2006-11-02 10:22 - 00003216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-07 15:41 - 2011-08-24 00:30 - 00000972 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000UA.job
2014-07-07 10:11 - 2006-11-02 07:46 - 00716862 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-07-07 10:05 - 2014-06-05 10:15 - 00003374 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3014262171-891651165-3714923240-1000
2014-07-07 10:05 - 2014-06-05 10:15 - 00003262 _____ () C:\Windows\System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3014262171-891651165-3714923240-1000
2014-07-07 10:05 - 2006-11-02 10:07 - 00000000 ___RD () C:\Users\Public\Recorded TV
2014-07-07 10:04 - 2006-11-02 10:42 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-07 09:13 - 2006-11-02 10:42 - 00032556 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-07-07 05:34 - 2014-07-07 05:34 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (14).exe
2014-07-07 05:10 - 2014-07-07 05:10 - 00412448 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (13).exe
2014-07-07 03:02 - 2014-07-07 03:01 - 00442244 _____ () C:\Windows\dd_vcredistMSI7F1D.txt
2014-07-07 03:02 - 2014-07-07 03:01 - 00011622 _____ () C:\Windows\dd_vcredistUI7F1D.txt
2014-07-07 02:38 - 2014-07-07 02:38 - 00228728 _____ (System Applet ) C:\Users\Michael and Anna\Downloads\Player-Chrome (7).exe
2014-07-07 02:08 - 2014-07-07 02:08 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (12).exe
2014-07-07 00:41 - 2011-08-24 00:30 - 00000950 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000Core.job
2014-07-07 00:37 - 2014-07-07 00:37 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (11).exe
2014-07-07 00:15 - 2014-07-07 00:15 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (10).exe
2014-07-06 22:58 - 2014-07-06 22:58 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (9).exe
2014-07-06 22:57 - 2014-07-06 22:57 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (8).exe
2014-07-06 17:24 - 2014-07-06 17:23 - 00294472 _____ (VLCPlayer) C:\Users\Michael and Anna\Downloads\HD_Player__CD5MTCD15543_bf09f61d0980be429c55f92eeb918454.exe
2014-07-06 15:56 - 2014-07-07 05:05 - 00083232 __RSH (kikillookj) C:\Users\Michael and Anna\AppData\Roaming\csrss.exe
2014-07-06 15:56 - 2014-07-06 15:56 - 00083232 __RSH (kikillookj) C:\Users\Michael and Anna\AppData\Roaming\svchost.exe
2014-07-06 15:56 - 2014-07-06 15:56 - 00083232 __RSH (kikillookj) C:\Users\Michael and Anna\AppData\Roaming\rundll32.exe
2014-07-06 15:28 - 2013-01-05 22:57 - 00000000 ____D () C:\Users\Michael and Anna\Desktop\Bovodar and the Dragons
2014-07-06 14:55 - 2014-07-06 14:55 - 00412448 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (7).exe
2014-07-06 06:23 - 2014-07-05 05:24 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP2.job
2014-07-06 05:44 - 2014-07-06 05:44 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (6).exe
2014-07-06 05:35 - 2014-07-06 05:35 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (5).exe
2014-07-06 04:42 - 2014-07-06 04:42 - 00000732 _____ () C:\Users\Michael and Anna\AppData\Local\d3d9caps64.dat
2014-07-06 03:25 - 2014-07-06 03:25 - 00412448 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (4).exe
2014-07-06 03:02 - 2014-07-06 03:01 - 00445620 _____ () C:\Windows\dd_vcredistMSI3108.txt
2014-07-06 03:02 - 2014-07-06 03:01 - 00011622 _____ () C:\Windows\dd_vcredistUI3108.txt
2014-07-06 03:02 - 2006-11-02 08:33 - 00000000 ____D () C:\Program Files\Common Files\Microsoft Shared
2014-07-06 01:26 - 2014-07-06 01:26 - 00225144 _____ (System Applet ) C:\Users\Michael and Anna\Downloads\Player-Chrome (6).exe
2014-07-06 00:50 - 2014-07-06 00:50 - 00413416 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (3).exe
2014-07-05 22:14 - 2014-07-05 22:14 - 00413600 _____ (Setup Process) C:\Users\Michael and Anna\Downloads\Setup (2).exe
2014-07-05 13:54 - 2014-07-05 05:24 - 00000376 _____ () C:\Windows\Tasks\APSnotifierPP3.job
2014-07-05 13:54 - 2008-01-20 22:26 - 00303966 _____ () C:\Windows\PFRO.log
2014-07-05 06:43 - 2014-07-05 05:24 - 00000378 _____ () C:\Windows\Tasks\APSnotifierPP1.job
2014-07-05 06:23 - 2014-07-05 06:23 - 00591320 _____ (ClickMeIn Limited) C:\Users\Michael and Anna\AppData\Local\nsn6527.tmp
2014-07-05 06:23 - 2014-07-05 06:12 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Local\29882
2014-07-05 06:23 - 2014-07-05 05:24 - 00002850 _____ () C:\Windows\System32\Tasks\APSnotifierPP1
2014-07-05 06:23 - 2014-07-05 05:24 - 00002848 _____ () C:\Windows\System32\Tasks\APSnotifierPP3
2014-07-05 06:23 - 2014-07-05 05:24 - 00002848 _____ () C:\Windows\System32\Tasks\APSnotifierPP2
2014-07-05 06:23 - 2014-07-05 05:24 - 00000324 _____ () C:\Users\Michael and Anna\AppData\Roaming\aps.uninstall.scan.results
2014-07-05 06:22 - 2014-07-05 05:42 - 00000903 _____ () C:\Users\Michael and Anna\Desktop\Continue VuuPC Installation.lnk
2014-07-05 06:12 - 2014-07-05 06:12 - 00410624 _____ () C:\Users\Michael and Anna\AppData\Local\CompTmp.exe
2014-07-05 06:12 - 2014-07-05 06:12 - 00000000 ____D () C:\Program Files (x86)\MSR
2014-07-05 05:57 - 2014-07-05 05:57 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Local\visi_coupon
2014-07-05 05:40 - 2014-07-05 05:40 - 00000000 ____D () C:\ProgramData\374311380
2014-07-05 05:31 - 2014-07-05 05:22 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Roaming\Systweak
2014-07-05 05:30 - 2009-07-13 22:21 - 00001487 _____ () C:\Windows\wininit.ini
2014-07-05 05:24 - 2014-07-05 05:24 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-05 05:24 - 2014-07-05 05:24 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-05 05:24 - 2014-07-05 05:24 - 00003684 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-05 05:24 - 2014-07-05 05:24 - 00000000 ____D () C:\Windows\system32\Macromed
2014-07-05 05:24 - 2014-07-05 05:24 - 00000000 ____D () C:\Systweak
2014-07-05 05:23 - 2014-07-05 05:23 - 00003294 _____ () C:\Windows\System32\Tasks\Rocket Updater
2014-07-05 05:23 - 2014-07-05 05:23 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Roaming\RocketUpdater
2014-07-05 05:22 - 2014-07-05 05:22 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Local\StormFall
2014-07-05 05:10 - 2014-07-05 05:10 - 00421238 _____ () C:\Users\Michael and Anna\AppData\Local\dd_vcredistMSI451F.txt
2014-07-05 05:10 - 2014-07-05 05:10 - 00017472 _____ () C:\Users\Michael and Anna\AppData\Local\dd_vcredistUI451F.txt
2014-07-05 05:10 - 2014-07-05 05:10 - 00000000 ____D () C:\Program Files (x86)\Open JDK Explorer
2014-07-05 05:06 - 2014-07-05 05:06 - 00000000 ____D () C:\Users\Michael and Anna\AppData\Local\SearchProtect
2014-07-05 05:06 - 2014-07-05 05:06 - 00000000 ____D () C:\Program Files (x86)\SearchProtect
2014-07-05 05:05 - 2014-07-05 05:05 - 00229240 _____ (System Applet ) C:\Users\Michael and Anna\Downloads\Java_Updater_Setup.exe
2014-07-05 05:04 - 2014-07-05 05:02 - 00000000 ____D () C:\ProgramData\Battle.net
2014-07-04 13:23 - 2014-07-05 05:22 - 00575887 _____ (ClickMeIn Limited) C:\Users\Michael and Anna\AppData\Local\AnyProtectScannerSetup.exe
2014-07-04 01:24 - 2009-08-11 02:51 - 00034304 _____ () C:\Users\Michael and Anna\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-07-02 04:28 - 2014-07-02 04:28 - 00946472 _____ () C:\Users\Michael and Anna\Downloads\java_installer (2).exe
2014-06-30 17:55 - 2014-07-05 05:22 - 00020328 _____ (Systweak Inc., (www.systweak.com)) C:\Windows\system32\roboot64.exe
2014-06-27 23:56 - 2014-06-27 23:56 - 00946472 _____ () C:\Users\Michael and Anna\Downloads\java_installer (1).exe
2014-06-26 16:03 - 2010-01-28 23:55 - 00003858 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000UA
2014-06-26 16:03 - 2010-01-28 23:55 - 00003462 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000Core
2014-06-26 04:05 - 2006-11-02 10:27 - 00054376 _____ () C:\Windows\setupact.log
2014-06-26 03:07 - 2013-08-15 09:23 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-26 03:04 - 2009-04-02 03:33 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-06-26 03:04 - 2006-11-02 07:35 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Some content of TEMP:
====================
C:\Users\Michael and Anna\AppData\Local\Temp\669269.exe
C:\Users\Michael and Anna\AppData\Local\Temp\CloudBackup4700.exe
C:\Users\Michael and Anna\AppData\Local\Temp\dlLogic.exe
C:\Users\Michael and Anna\AppData\Local\Temp\dltr.exe
C:\Users\Michael and Anna\AppData\Local\Temp\GCVerifier.dll
C:\Users\Michael and Anna\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Michael and Anna\AppData\Local\Temp\nse21B6.exe
C:\Users\Michael and Anna\AppData\Local\Temp\nsk186.exe
C:\Users\Michael and Anna\AppData\Local\Temp\nsk257F.exe
C:\Users\Michael and Anna\AppData\Local\Temp\nsu4D1.exe
C:\Users\Michael and Anna\AppData\Local\Temp\oi_{BF2FF931-2585-4BBD-8BEA-4D1D7CC1CB85}.exe
C:\Users\Michael and Anna\AppData\Local\Temp\setup__8707.exe
C:\Users\Michael and Anna\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Michael and Anna\AppData\Local\Temp\vcredist_x64.exe
C:\Users\Michael and Anna\AppData\Local\Temp\verifier.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-07-07 10:10

==================== End Of Log ============================

lh
New Helpee

Posts: 36

Search Protect #? Jul 7, 2014 15:06:23 GMT -8

Post by lh on Jul 7, 2014 15:06:23 GMT -8

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-07-2014 01
Ran by Michael and Anna at 2014-07-07 17:41:46
Running from C:\Users\Michael and Anna\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

1600 (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
1600_Help (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
1600Trb (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
64 Bit HP CIO Components Installer (Version: 1.0.0 - Hewlett-Packard) Hidden
Acrobat.com (HKLM-x32\...\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 1.1.377 - Adobe Systems Incorporated)
Acrobat.com (x32 Version: 0.0.0 - Adobe Systems Incorporated) Hidden
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 1.0.4990 - Adobe Systems Inc.)
Adobe AIR (x32 Version: 1.0.8.4990 - Adobe Systems Inc.) Hidden
Adobe Flash Player 10 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 10.0.42.34 - Adobe Systems Incorporated)
Adobe Flash Player 11 ActiveX (HKLM-x32\...\{41042E28-CCA1-4147-869F-9E928B38F04C}) (Version: 11.9.900.170 - Adobe Systems Incorporated)
Adobe Photoshop 7.0 (HKLM-x32\...\Adobe Photoshop 7.0) (Version: 7.0 - Adobe Systems, Inc.)
Adobe Reader X (10.1.4) (HKLM-x32\...\{AC76BA86-7AD7-1033-7B44-AA1000000001}) (Version: 10.1.4 - Adobe Systems Incorporated)
Age of Empires Online (HKLM-x32\...\Steam App 105430) (Version: - Microsoft)
Agere Systems PCI-SV92EX Soft Modem (HKLM\...\Agere Systems Soft Modem) (Version: - LSI Corporation)
AIO_CDB_ProductContext (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
AIO_CDB_Software (x32 Version: 82.0.242.000 - Hewlett-Packard) Hidden
AIO_CDB_ToolboxIni64 (Version: 82.0.242.000 - Hewlett-Packard) Hidden
AIO_Scan (x32 Version: 82.0.173.000 - Hewlett-Packard) Hidden
Alan Wake (HKLM-x32\...\Steam App 108710) (Version: - Remedy Entertainment)
Amazon Kindle (HKCU\...\Amazon Kindle) (Version: - Amazon)
Amazon MP3 Downloader 1.0.17 (HKLM-x32\...\Amazon MP3 Downloader) (Version: 1.0.17 - Amazon Services LLC)
Apple Application Support (HKLM-x32\...\{D9DAD0FF-495A-472B-9F10-BAE430A26682}) (Version: 3.0.3 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{787136D2-F0F8-4625-AA3F-72D7795AC842}) (Version: 7.1.1.3 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Audacity 1.2.6 (HKLM-x32\...\Audacity_is1) (Version: - )
AutoREALM Version 2.2.1 (HKLM-x32\...\AutoREALM_is1) (Version: - )
Bing Bar (HKLM-x32\...\{16D0F2D2-242C-4885-BEF1-4B1655C141AE}) (Version: 7.0.822.0 - Microsoft Corporation)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BufferChm (x32 Version: 82.0.173.000 - Hewlett-Packard) Hidden
Build A Lot 2 (remove only) (HKLM-x32\...\Build A Lot 2) (Version: - )
Build-a-lot - Town of the Year (HKLM-x32\...\am-buildalottownoftheyear) (Version: - )
Build-a-lot 2: Town of the Year (HKLM-x32\...\Build-a-lot 2: Town of the Year) (Version: 32.0.0.0 - Shockwave.com)
Compatibility Pack for the 2007 Office system (HKLM-x32\...\{90120000-0020-0409-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Copy (x32 Version: 82.0.188.000 - Hewlett-Packard) Hidden
CustomerResearchQFolder (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
CyberLink Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.0.2325a - CyberLink Corp.)
CyberLink Power2Go (x32 Version: 6.0.2325a - CyberLink Corp.) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{CA75CBF9-B078-47CB-ABA3-74EFD4FC9A43}) (Version: - Microsoft)
Destinations (x32 Version: 82.0.173.000 - Hewlett-Packard) Hidden
DeviceManagementQFolder (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
DocProc (x32 Version: 8.1.0.0 - Hewlett-Packard) Hidden
DocProcQFolder (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
Empire Earth II (HKLM-x32\...\{DF315348-721C-40B8-BAE2-58C6C7D935A2}) (Version: - )
Empire Earth II Gold Edition (HKLM-x32\...\Empire Earth II Gold Edition_is1) (Version: - GOG.com)
Entropia Universe (HKLM-x32\...\Entropia Universe) (Version: 12.7.0.98247 - MindArk PE AB)
eSupportQFolder (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
Facebook Video Calling 2.0.0.447 (HKLM-x32\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
Fax (x32 Version: 82.0.188.000 - Hewlett-Packard) Hidden
FUSHICAI VIDEO DVR (HKLM-x32\...\{A6D372B4-70D5-48F9-AD3E-FDBA608724D4}) (Version: 2012.04.17 - -)
GameHouse (HKLM-x32\...\GameHouse) (Version: - )
Gateway Games (HKLM-x32\...\WildTangent gateway Master Uninstall) (Version: 1.0.0.52 - WildTangent)
Gateway Photo Frame 4.2.3.6 (HKLM-x32\...\Gateway Photo Frame) (Version: 4.2.3.6 - I/O Interconnect)
Gateway Recovery Management (HKLM-x32\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.00.3006 - Acer Incorporated)
Google Chrome (HKCU\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Half-Life (HKLM-x32\...\Steam App 70) (Version: - Valve)
Half-Life 2 (HKLM-x32\...\Steam App 220) (Version: - Valve)
Half-Life 2: Deathmatch (HKLM-x32\...\Steam App 320) (Version: - Valve)
Half-Life 2: Episode One (HKLM-x32\...\Steam App 380) (Version: - Valve)
Half-Life 2: Episode Two (HKLM-x32\...\Steam App 420) (Version: - Valve)
Half-Life 2: Lost Coast (HKLM-x32\...\Steam App 340) (Version: - Valve)
Half-Life: Blue Shift (HKLM-x32\...\Steam App 130) (Version: - Gearbox)
Half-Life: Opposing Force (HKLM-x32\...\Steam App 50) (Version: - Gearbox)
HandBrake 0.9.8 (HKLM-x32\...\HandBrake) (Version: 0.9.8 - )
honestech VHS to DVD 2.0 SE (HKLM-x32\...\{2856F5EA-E98A-40E4-BAD6-8C644A4A3F3C}) (Version: 2.0 - honestech)
HP Customer Participation Program 8.0 (HKLM\...\HPExtendedCapabilities) (Version: 8.0 - HP)
HP Imaging Device Functions 8.0 (HKLM\...\HP Imaging Device Functions) (Version: 8.0 - HP)
HP OCR Software 8.0 (HKLM\...\HPOCR) (Version: 8.0 - HP)
HP Photosmart Essential (HKLM-x32\...\{EB21A812-671B-4D08-B974-2A347F0D8F70}) (Version: 1.12.0.46 - HP)
HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B (HKLM\...\{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}) (Version: 8.0 - HP)
HP Solution Center 8.0 (HKLM\...\HP Solution Center & Imaging Support Tools) (Version: 8.0 - HP)
HP Update (HKLM-x32\...\{8C6027FD-53DC-446D-BB75-CACD7028A134}) (Version: 4.000.005.006 - Hewlett-Packard)
HPProductAssistant (x32 Version: 82.0.173.000 - Hewlett-Packard) Hidden
HPSSupply (HKLM-x32\...\{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}) (Version: 2.1.3.0000 - Hewlett Packard Development Company L.P.)
Intel(R) Graphics Media Accelerator Driver (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2555 - Intel Corporation)
Intel® Matrix Storage Manager (HKLM\...\{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}) (Version: - Intel Corporation)
InterActual Player (HKLM-x32\...\InterActual Player) (Version: - )
iTunes (HKLM\...\{5A68A656-979F-4168-8795-E2E368AA4DC2}) (Version: 11.2.2.3 - Apple Inc.)
iWin Games (remove only) (HKLM-x32\...\iWinArcade) (Version: - )
Java Auto Updater (x32 Version: 2.1.9.8 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 26 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216026FF}) (Version: 6.0.260 - Oracle)
Java(TM) 6 Update 5 (HKLM-x32\...\{3248F0A8-6813-11D6-A77B-00B0D0160050}) (Version: 1.6.0.50 - Sun Microsystems, Inc.)
Junk Mail filter update (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
KB0817 Keyboard Driver (HKLM-x32\...\{ED5DCA6F-5FEA-47CB-83DB-210A468C298B}) (Version: 1.30.0000 - Gateway)
LAME v3.99.3 (for Windows) (HKLM-x32\...\LAME_is1) (Version: - )
magicJack (HKCU\...\magicJack) (Version: 2.0.6073.4252 - magicJack L.P.)
MarketResearch (x32 Version: 82.0.174.000 - Hewlett-Packard) Hidden
MediaBar (HKLM-x32\...\iMesh 1 MediaBar) (Version: 3.0.0.116189 - iMesh Inc.) <==== ATTENTION
Memeo AutoBackup (HKCU\...\InstallShield_{39A908FD-7322-41AE-B374-C7A076B2FC97}) (Version: 2.50.2985 - Memeo Inc)
Memeo AutoBackup (x32 Version: 2.50.2985 - Memeo Inc) Hidden
Memeo AutoSync (HKCU\...\InstallShield_{FD29EB58-CF8D-4BE9-9AE8-8EE4FEF6D2E0}) (Version: 2.50.2922 - Memeo Inc)
Memeo AutoSync (x32 Version: 2.50.2922 - Memeo Inc) Hidden
Microsoft .NET Framework 1.1 (HKLM-x32\...\Microsoft .NET Framework 1.1 (1033)) (Version: - )
Microsoft .NET Framework 1.1 (x32 Version: 1.1.4322 - Microsoft) Hidden
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version: - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Age of Empires II (HKLM-x32\...\Age of Empires 2.0) (Version: - )
Microsoft Age of Empires II: The Conquerors Expansion (HKLM-x32\...\Age of Empires II: The Conquerors Expansion 1.0) (Version: - )
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Choice Guard (x32 Version: 2.0.48.0 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM-x32\...\{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}) (Version: 3.5.92.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM-x32\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Money Essentials (HKLM-x32\...\Money2007b) (Version: 16 - Microsoft)
Microsoft Money Shared Libraries (x32 Version: 16.0.0.705 - Microsoft Corporation) Hidden
Microsoft Office Access MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Access Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUS) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit Setup Metadata MUI (English) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053 (HKLM\...\{B6E3757B-5E77-3915-866A-CCFC4B8D194C}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM-x32\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Works (HKLM-x32\...\{67E03279-F703-408F-B4BF-46B5FC8D70CD}) (Version: 9.7.0621 - Microsoft Corporation)
MP3MyMP3 3.0 (HKLM-x32\...\MP3MyMP3_is1) (Version: - Bruce McArthur)
MSVCRT (x32 Version: 14.0.1468.721 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MWSnap 3 (HKLM-x32\...\MWSnap 3) (Version: 3.0.0.74 - Mirek Wojtowicz)
Open PLS in Windows Media Player 2.3.0 (HKLM-x32\...\{F868C16D-75F8-4EE8-BCBF-422D0833415D}_is1) (Version: 2.3 - Jon Galloway)
PlayReady PC runtime (HKLM\...\{704ABF63-B0B1-446B-9D92-C5D06AFCE7B6}) (Version: 1 - Microsoft Corporation)
Portal (HKLM-x32\...\Steam App 400) (Version: - Valve)
PunkBuster Services (HKLM-x32\...\PunkBusterSvc) (Version: 0.986 - Even Balance, Inc.)
QuickTime (HKLM-x32\...\{AF0CE7C0-A3E4-4D73-988B-B29187EC6E9A}) (Version: 7.73.80.64 - Apple Inc.)
RealDownloader (x32 Version: 1.3.1 - RealNetworks, Inc.) Hidden
RealNetworks - Microsoft Visual C++ 2008 Runtime (x32 Version: 9.0 - RealNetworks, Inc) Hidden
RealNetworks - Microsoft Visual C++ 2010 Runtime (x32 Version: 10.0 - RealNetworks, Inc) Hidden
RealPlayer (HKLM-x32\...\RealPlayer 16.0) (Version: 16.0.0 - RealNetworks)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5807 - Realtek Semiconductor Corp.)
RealUpgrade 1.1 (x32 Version: 1.1.0 - RealNetworks, Inc.) Hidden
Rocketfish 2.4G Wireless Combo (HKLM\...\MouseSuite98) (Version: 2.1.1.0 - Rocketfish)
Scan (x32 Version: 8.1.0.0 - Hewlett-Packard) Hidden
Search Protect (HKLM-x32\...\SearchProtect) (Version: 2.15.11.3 - Client Connect LTD) <==== ATTENTION
SearchCore for Browsers (HKLM-x32\...\SearchCore for Browsers) (Version: 3.0.0.116189 - iMesh Inc.) <==== ATTENTION
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
Sid Meier's Civilization V - Demo (HKLM-x32\...\Steam App 65900) (Version: - Firaxis Games)
Skype Toolbars (HKLM-x32\...\{981029E0-7FC9-4CF3-AB39-6F133621921A}) (Version: 1.0.4051 - Skype Technologies S.A.)
Skype™ 6.11 (HKLM-x32\...\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}) (Version: 6.11.102 - Skype Technologies S.A.)
Snes9x 1.52 (HKLM-x32\...\Snes9x) (Version: 1.52 - Snes9x)
SolutionCenter (x32 Version: 82.0.188.000 - Hewlett-Packard) Hidden
Spelling Dictionaries Support For Adobe Reader 9 (HKLM-x32\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Status (x32 Version: 82.0.173.000 - Hewlett-Packard) Hidden
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Stronghold (HKLM-x32\...\Stronghold_is1) (Version: - GOG.com)
System Requirements Lab for Intel (HKLM-x32\...\{C5DA59CF-2BB8-48D5-8E5B-17F2E0F0FEE4}) (Version: 4.5.5.0 - Husdawg, LLC)
System Update kb70007 (x32 Version: 1.0.0 - MSR) Hidden
Team Fortress 2 (HKLM-x32\...\Steam App 440) (Version: - Valve)
Team Fortress Classic (HKLM-x32\...\Steam App 20) (Version: - Valve)
The Banner Saga: Factions (HKLM-x32\...\Steam App 219340) (Version: - )
The Last Starfighter (HKLM-x32\...\InstallShield_{C892C691-99DC-4B49-BEAA-65B96BB3460D}) (Version: 7.6.2.2 - RogueSynapse)
The Lord of the Rings Online™ v03.03.05.8039 (HKLM-x32\...\12bbe590-c890-11d9-9669-0800200c9a66_is1) (Version: 03.03.05.8039 - Turbine, Inc.)
Toolbox (x32 Version: 82.0.173.000 - Hewlett-Packard) Hidden
TrayApp (x32 Version: 82.0.188.000 - Hewlett-Packard) Hidden
UnloadSupport (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (HKLM-x32\...\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760631) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{35698CB7-AAA2-4577-B505-DBFF504AEF23}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUS_{82F87E28-B18E-46D6-A399-E2F19CF5949B}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2850079) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0C0A-0000-0000000FF1CE}_Office14.PROPLUS_{5E8EB600-8B94-429E-873E-98369C6DC1BC}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878225) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{EFF5EBA3-40AD-4859-85E7-3C1CF4F297EB}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0409-0000-0000000FF1CE}_Office14.PROPLUS_{DCE104A1-1875-4469-A83D-A5BFA6C4640F}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0409-0000-0000000FF1CE}_Office14.PROPLUS_{334AA0A1-2BB1-4D74-B66A-2B2C4D9C2C87}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUS_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{90140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUS_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)
Ventrilo Client (HKLM-x32\...\{789289CA-F73A-4A16-A331-54D498CE069F}) (Version: 3.0.5 - Flagship Industries, Inc.)
WD Diagnostics (HKLM-x32\...\{0AB76F69-E761-4CFA-B9B0-A1906B4E9E4B}) (Version: 1.09.0002 - Western Digital Technologies)
Web Games Player Plugin (HKLM-x32\...\Web Games Player Plugin) (Version: - Zylom Games)
WebReg (x32 Version: 82.0.173.000 - Hewlett-Packard) Hidden
Windows Live Call (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Communications Platform (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite_Wave3) (Version: 14.0.8117.0416 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (HKLM\...\{9B48B0AC-C813-4174-9042-476A887592C7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Mail (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Messenger (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 14.0.8117.416 - Microsoft Corporation) Hidden
Windows Live Sync (HKLM-x32\...\{B10914FD-8812-47A4-85A1-50FCDE7F1F33}) (Version: 14.0.8117.416 - Microsoft Corporation)
Windows Live Upload Tool (HKLM-x32\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
Windows Live Writer (x32 Version: 14.0.8117.0416 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (HKLM-x32\...\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}) (Version: 1.0.0.8 - Microsoft Corp)
World of Warcraft (HKLM-x32\...\World of Warcraft) (Version: 4.0.0.12911 - Blizzard Entertainment)
Yahoo! Detect (HKLM-x32\...\YTdetect) (Version: - )
Yahoo! Messenger (HKLM-x32\...\Yahoo! Messenger) (Version: - Yahoo! Inc.)
Yahoo! Software Update (HKLM-x32\...\Yahoo! Software Update) (Version: - )
Yahoo! Toolbar (HKLM-x32\...\Yahoo! Companion) (Version: - Yahoo! Inc.)

==================== Restore Points =========================

27-06-2014 07:07:40 Windows Update
27-06-2014 08:00:11 Windows Update
28-06-2014 08:00:11 Windows Update
28-06-2014 23:11:14 Scheduled Checkpoint
29-06-2014 08:00:11 Windows Update
30-06-2014 05:10:52 Scheduled Checkpoint
30-06-2014 08:00:11 Windows Update
01-07-2014 06:51:41 Windows Update
01-07-2014 08:00:11 Windows Update
01-07-2014 20:06:25 Scheduled Checkpoint
02-07-2014 08:00:12 Windows Update
03-07-2014 00:46:19 Scheduled Checkpoint
03-07-2014 08:00:12 Windows Update
04-07-2014 06:46:57 Windows Update
04-07-2014 08:00:11 Windows Update
05-07-2014 03:21:27 Scheduled Checkpoint
05-07-2014 08:00:11 Windows Update
05-07-2014 11:31:16 Removed Adobe Flash Player 11 ActiveX.
06-07-2014 08:00:11 Windows Update
06-07-2014 09:35:33 Removed Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
07-07-2014 08:00:11 Windows Update

==================== Hosts content: ==========================

2006-11-02 07:34 - 2006-09-18 16:37 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0AEAFAF6-F116-4A60-AFB4-C8B755A6E975} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {13C2840A-8C37-477C-9F0D-71ED5C9823D8} - System32\Tasks\APSnotifierPP1 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {192DDA2D-5815-47B8-983F-65744FEEC03A} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {1C5359E5-8C81-4D77-946B-F4A84EFE03D6} - System32\Tasks\APSnotifierPP3 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {254095AE-FB97-48EA-94A5-D8BF2AB79714} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)
Task: {2C31EDAC-F77B-4730-BE7A-752EE4A48C07} - System32\Tasks\{F725B67B-0CBB-41C8-BAF9-65D408AC4F98} => C:\Program Files (x86)\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {32E05D2A-CB66-4904-B46E-B3378E0DB34B} - System32\Tasks\APSnotifierPP2 => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: {36B9AFB0-8621-4618-8094-391084EA30A9} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000UA => C:\Users\Michael and Anna\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-28] (Google Inc.)
Task: {42212AF6-9D7D-4E46-AB1C-D099C5D9B9DB} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-05] (Adobe Systems Incorporated)
Task: {4E946E6C-49EC-4FD9-8F58-EB5AF1752C5D} - System32\Tasks\Microsoft\Windows\PLA\System\ConvertLogEntries => Rundll32.exe %windir%\system32\pla.dll,PlaConvertLogEntries
Task: {55D115CB-CEFC-4578-99E7-BD4FF63D8561} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000Core => C:\Users\Michael and Anna\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {63E91DF0-7C6F-42D5-8821-7B0BFD6F41CA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {6CCA5C52-6571-42EF-B754-69D059B99A75} - System32\Tasks\Rocket Updater => C:\Users\Michael and Anna\AppData\Roaming\RocketUpdater\UpdateProc\UpdateTask.exe [2013-04-12] ()
Task: {72F2EA39-3311-4FD7-9003-F7773C7B5A83} - System32\Tasks\Acer\Burn Notification => C:\Program Files\Gateway\Gateway Recovery Management\NotificationCenter\Notification.exe [2009-02-25] (Acer)
Task: {79598885-C558-43F5-B5B7-0E238CFFBBD4} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-3014262171-891651165-3714923240-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-03-06] (RealNetworks, Inc.)
Task: {7C638E5B-ECE5-4424-A7E5-2C913CA682E9} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {8352F802-C2C3-4EB3-9F85-52545F31CD74} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-3014262171-891651165-3714923240-1000 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe [2013-03-06] (RealNetworks, Inc.)
Task: {847711D6-61D1-47CC-9FA9-693B41EDA914} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000UA => C:\Users\Michael and Anna\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-07-12] (Facebook Inc.)
Task: {90A75A6D-E6D4-45FA-A97E-724299671B02} - System32\Tasks\RunAsStdUser Task => C:\Users\Michael and Anna\Desktop\iWin Games\iWinGames.exe
Task: {D7C70CAD-BB53-4EAD-8109-E31AF0AA76FF} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000Core => C:\Users\Michael and Anna\AppData\Local\Google\Update\GoogleUpdate.exe [2010-01-28] (Google Inc.)
Task: {E91D6474-70CC-42BE-80FF-8BED8AF557ED} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()
Task: {FE729E00-D28E-4133-BFB4-9E6F73061300} - System32\Tasks\MHotkey => C:\Windows\MHotKey.exe [2008-05-30] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\APSnotifierPP1.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP2.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\APSnotifierPP3.job => C:\Program Files (x86)\AnyProtectEx\AnyProtect.exe <==== ATTENTION
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000Core.job => C:\Users\Michael and Anna\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000UA.job => C:\Users\Michael and Anna\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000Core.job => C:\Users\Michael and Anna\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3014262171-891651165-3714923240-1000UA.job => C:\Users\Michael and Anna\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\Rocket Updater.job => C:\Users\MICHAE~1\AppData\Roaming\ROCKET~1\UPDATE~1\UPDATE~1.EXE <==== ATTENTION

==================== Loaded Modules (whitelisted) =============

2010-06-24 03:28 - 2010-06-24 03:28 - 00066872 _____ () C:\Windows\SysWOW64\PnkBstrA.exe
2013-03-06 02:21 - 2013-03-06 02:21 - 00039056 _____ () C:\Program Files (x86)\RealNetworks\RealDownloader\rndlresolversvc.exe
2014-07-05 06:12 - 2014-05-08 11:45 - 00018944 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\WindowsUpdater.exe
2013-09-05 01:17 - 2013-09-05 01:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:23 - 2010-10-20 15:23 - 08801632 _____ () C:\Program Files\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2009-04-02 03:22 - 2008-05-30 12:50 - 00581120 _____ () C:\Windows\MHotKey.exe
2014-07-05 05:10 - 2014-07-02 15:41 - 00988160 _____ () C:\Program Files (x86)\Open JDK Explorer\ywnmon32.exe
2014-04-23 16:05 - 2014-04-23 16:05 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-04-23 16:04 - 2014-04-23 16:04 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-07-05 06:12 - 2014-05-08 11:45 - 00061952 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\InstallerLibrary.dll
2014-07-05 06:12 - 2014-05-08 11:45 - 00016896 _____ () C:\Windows\Microsoft\SystemUpdatekb70007\Installer.dll
2014-07-05 06:12 - 2014-07-07 10:05 - 00086528 _____ () C:\Program Files (x86)\MSR\Privoxy\mgwz.dll
2009-02-26 15:11 - 2009-02-26 15:11 - 00031744 _____ () C:\Program Files (x86)\Gateway Photo Frame\IOIUSBLib.dll
2009-02-26 15:11 - 2009-02-26 15:11 - 00025088 _____ () C:\Program Files (x86)\Gateway Photo Frame\IOIHIDLib.dll
2008-08-27 18:32 - 2008-08-27 18:32 - 00619816 ____N () C:\Program Files (x86)\Cyberlink\Power2Go\CLMediaLibrary.dll
2008-06-09 11:55 - 2008-06-09 11:55 - 00013096 ____N () C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll
2014-07-07 10:05 - 2014-07-07 10:05 - 00580701 _____ () C:\Users\Michael and Anna\AppData\Local\Temp\tmpCBF5.tmp
2011-07-26 23:41 - 2011-07-26 23:41 - 00112416 _____ () C:\Program Files (x86)\Java\jre6\bin\jp2iexp.dll
2011-07-26 23:41 - 2011-07-26 23:41 - 00008192 _____ () C:\Program Files (x86)\Java\jre6\bin\jp2native.dll
2006-12-10 21:51 - 2006-12-10 21:51 - 00065536 ____R () C:\Program Files (x86)\HP\Digital Imaging\bin\crm\xmlparse.dll
2006-12-10 21:51 - 2006-12-10 21:51 - 00077824 ____R () C:\Program Files (x86)\HP\Digital Imaging\bin\crm\xmltok.dll
2009-07-13 22:21 - 2010-06-01 10:17 - 00929792 _____ () C:\Program Files (x86)\Yahoo!\Messenger\yui.dll
2013-09-05 01:14 - 2013-09-05 01:14 - 04300456 _____ () C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Cultures\OFFICE.ODF
2010-10-20 15:45 - 2010-10-20 15:45 - 08801120 _____ () C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveIntlResource.dll
2014-06-25 22:19 - 2014-06-05 08:58 - 04217672 _____ () C:\Users\Michael and Anna\AppData\Local\Google\Chrome\Application\35.0.1916.153\pdf.dll
2014-06-25 22:19 - 2014-06-05 08:58 - 00414536 _____ () C:\Users\Michael and Anna\AppData\Local\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll
2014-06-25 22:19 - 2014-06-05 08:58 - 01732424 _____ () C:\Users\Michael and Anna\AppData\Local\Google\Chrome\Application\35.0.1916.153\ffmpegsumo.dll
2014-06-25 22:19 - 2014-06-05 08:58 - 14612296 _____ () C:\Users\Michael and Anna\AppData\Local\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:68F81F4B
AlternateDataStreams: C:\Users\Michael and Anna\Downloads\Test.eml:OECustomProperty

==================== Safe Mode (whitelisted) ===================

==================== EXE Association (whitelisted) =============

==================== MSCONFIG/TASK MANAGER disabled items =========

==================== Faulty Device Manager Devices =============

Name: Microsoft 6to4 Adapter #2
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #4
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #5
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #7
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #8
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #9
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #11
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #12
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #14
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #16
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #18
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #20
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #21
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #22
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

Name: Microsoft 6to4 Adapter #28
Description: Microsoft 6to4 Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device is not working properly because Windows cannot load the drivers required for this device. (Code 31)
Resolution: Update the driver

==================== Event log errors: =========================

Application errors:
==================
Error: (07/07/2014 10:06:28 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2014 10:05:16 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (07/07/2014 05:36:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application explorer.exe, version 6.0.6001.18164, time stamp 0x4907e791, faulting module kernel32.dll, version 6.0.6001.18631, time stamp 0x4da46d09, exception code 0xc0000005, fault offset 0x0000000000029d90,
process id 0x11b8, application start time 0xexplorer.exe0.

Error: (07/07/2014 05:36:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application Explorer.EXE, version 6.0.6001.18164, time stamp 0x4907e791, faulting module kernel32.dll, version 6.0.6001.18631, time stamp 0x4da46d09, exception code 0xc0000005, fault offset 0x0000000000029d90,
process id 0xac0, application start time 0xExplorer.EXE0.

Error: (07/07/2014 05:04:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2014 05:03:10 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (07/07/2014 03:01:36 AM) (Source: MsiInstaller) (EventID: 1023) (User: NT AUTHORITY)
Description: Product: Microsoft .NET Framework 1.1 - Update '{2F6EFCE6-10DF-49F9-9E64-9AE3775B2588}' could not be installed. Error code 1603. Additional information is available in the log file C:\Windows\TEMP\NDP1.1sp1-KB2416447-X86\NDP1.1sp1-KB2416447-X86-msi.0.log.

Error: (07/07/2014 03:01:36 AM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)
Description: Product: Microsoft .NET Framework 1.1 -- Error 1606.Could not access network location %APPDATA%\.

Error: (07/07/2014 03:01:36 AM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)
Description: Product: Microsoft .NET Framework 1.1 -- Error 1606.Could not access network location %APPDATA%\.

Error: (07/07/2014 02:55:22 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

System errors:
=============
Error: (07/07/2014 10:06:29 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (07/07/2014 10:04:51 AM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (07/07/2014 05:04:26 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (07/07/2014 05:02:45 AM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (07/07/2014 03:01:53 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT AUTHORITY)
Description: 0x80070643Security Update for Microsoft .NET Framework 1.1 SP1 on Windows XP, Windows Server 2003, Windows Vista, and Windows Server 2008 for x64-based Systems (KB2416447){64EE3E39-6FCC-4611-A108-282375710B1E}102

Error: (07/06/2014 02:55:05 PM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (07/06/2014 02:54:24 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {7F6316B4-4D69-4765-B0A3-B2598F2FA80A}

Error: (07/06/2014 02:53:23 PM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Error: (07/06/2014 09:55:28 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: i8042prt

Error: (07/06/2014 09:53:46 AM) (Source: HTTP) (EventID: 15016) (User: )
Description: \Device\Http\ReqQueueKerberos

Microsoft Office Sessions:
=========================
Error: (07/07/2014 10:06:28 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2014 10:05:16 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (07/07/2014 05:36:38 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: explorer.exe6.0.6001.181644907e791kernel32.dll6.0.6001.186314da46d09c00000050000000000029d9011b801cf99cf5085b36c

Error: (07/07/2014 05:36:26 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Explorer.EXE6.0.6001.181644907e791kernel32.dll6.0.6001.186314da46d09c00000050000000000029d90ac001cf99cad97a9f0c

Error: (07/07/2014 05:04:26 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (07/07/2014 05:03:10 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Error: (07/07/2014 03:01:36 AM) (Source: MsiInstaller) (EventID: 1023) (User: NT AUTHORITY)
Description: Microsoft .NET Framework 1.1{2F6EFCE6-10DF-49F9-9E64-9AE3775B2588}1603C:\Windows\TEMP\NDP1.1sp1-KB2416447-X86\NDP1.1sp1-KB2416447-X86-msi.0.log(NULL)

Error: (07/07/2014 03:01:36 AM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)
Description: Product: Microsoft .NET Framework 1.1 -- Error 1606.Could not access network location %APPDATA%\.(NULL)(NULL)(NULL)(NULL)

Error: (07/07/2014 03:01:36 AM) (Source: MsiInstaller) (EventID: 11606) (User: NT AUTHORITY)
Description: Product: Microsoft .NET Framework 1.1 -- Error 1606.Could not access network location %APPDATA%\.(NULL)(NULL)(NULL)(NULL)

Error: (07/07/2014 02:55:22 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 11) (User: )
Description: www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabA required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

CodeIntegrity Errors:
===================================
Date: 2014-07-07 17:41:18.987
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-07-07 17:41:18.866
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-07-07 17:41:18.757
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-07-07 17:41:18.645
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-07-07 17:41:18.409
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-07-07 17:41:18.273
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-07-07 17:41:18.059
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-07-07 17:41:17.906
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-06-04 02:01:57.133
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

Date: 2014-06-04 02:01:57.039
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\drivers\tcpip.sys because the set of per-page image hashes could not be found on the system.

==================== Memory info ===========================

Percentage of memory in use: 52%
Total physical RAM: 4060.26 MB
Available physical RAM: 1943.28 MB
Total Pagefile: 8335.8 MB
Available Pagefile: 5934.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:583.17 GB) (Free:22.5 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 596 GB) (Disk ID: CD6556B4)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=583 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Quads Malware Removalists In New Zealand Posts: 9,387	Search Protect #? Jul 7, 2014 16:15:54 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Quads on Jul 7, 2014 16:15:54 GMT -8 Just so you know you have more than what you reported as a problem. You also have something that is pretending to be Windows files but are not. Maybe the Tepfer family Quads

lh New Helpee Posts: 36	Search Protect #? Jul 7, 2014 17:07:50 GMT -8 Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by lh on Jul 7, 2014 17:07:50 GMT -8 What do I do now, then?

Search Protect #?

Post by lh on Jul 6, 2014 9:58:53 GMT -8

Post by Quads on Jul 6, 2014 10:26:31 GMT -8

Post by lh on Jul 6, 2014 12:00:59 GMT -8

Post by Quads on Jul 6, 2014 14:09:16 GMT -8

Post by lh on Jul 7, 2014 2:19:19 GMT -8

Post by Quads on Jul 7, 2014 10:45:15 GMT -8

Post by lh on Jul 7, 2014 15:04:16 GMT -8

Post by lh on Jul 7, 2014 15:06:23 GMT -8

Post by Quads on Jul 7, 2014 16:15:54 GMT -8

Post by lh on Jul 7, 2014 17:07:50 GMT -8