Ok thanks for letting me know.
If it still has not stopped by morning go ahead and reboot your system >> look in
C:\ComboFix.txt and post that if created.
If the ComboFix.txt was not made try to run it again with the same set of instructions as I gave you before.
OK, it looks like it finally finished at 12:45am this morning.
Here is the log.
ComboFix 12-12-17.02 - Kristen 12/17/2012 20:06:12.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.3893.1759 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\users\Kristen\Desktop\CFScript.txt
AV: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
FW: ZoneAlarm Free Firewall *Enabled* {E6380B7E-D4B2-19F1-083E-56486607704B}
SP: AVG Anti-Virus Free Edition 2013 *Disabled/Updated* {B5F5C120-2089-702E-0001-553BB0D5A664}
SP: Spybot - Search and Destroy *Disabled/Updated* {9BC38DF1-3CCA-732D-A930-C1CA5F20A4B0}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\D-Link Toolbar\dlinktb.dll
c:\users\Kristen\AppData\Roaming\OpenCandy
c:\users\Kristen\AppData\Roaming\OpenCandy\2E406DC9B60B45F6B3AE9DDD15175967\SendoriSetupx10403.exe
.
.
((((((((((((((((((((((((( Files Created from 2012-11-18 to 2012-12-18 )))))))))))))))))))))))))))))))
.
.
2012-12-18 01:38 . 2012-12-18 01:38 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2012-12-18 01:38 . 2012-12-18 01:38 ——– d—–w- c:\users\Default\AppData\Local\temp
2012-12-17 19:36 . 2012-12-17 19:36 ——– d—–w- c:\users\Guest\AppData\Roaming\AVG2013
2012-12-17 19:36 . 2012-12-17 19:36 ——– d—–w- c:\users\Guest\AppData\Local\Avg2013
2012-12-17 17:57 . 2012-12-18 01:38 ——– d—–w- c:\users\Guest\AppData\Local\temp
2012-12-17 14:10 . 2012-12-17 14:19 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2012-12-17 14:10 . 2009-01-25 17:14 17272 —-a-w- c:\windows\system32\sdnclean64.exe
2012-12-17 14:10 . 2012-12-17 14:10 ——– d—–w- c:\program files (x86)\Spybot - Search & Destroy 2
2012-12-17 03:29 . 2012-12-17 03:29 ——– d—–w- c:\program files (x86)\Common Files\Adobe
2012-12-17 03:22 . 2012-12-17 03:22 ——– d—–w- c:\program files (x86)\Common Files\Java
2012-12-17 03:21 . 2012-12-17 03:21 95208 —-a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2012-12-17 02:39 . 2012-12-17 02:39 ——– d—–w- c:\program files\WOT
2012-12-17 02:39 . 2012-12-17 02:39 ——– d—–w- c:\program files (x86)\WOT
2012-12-17 02:07 . 2012-12-17 02:07 ——– d—–w- c:\users\Kristen\AppData\Roaming\AVG2013
2012-12-17 02:07 . 2012-12-17 02:07 ——– d—–w- c:\users\Kristen\AppData\Roaming\TuneUp Software
2012-12-17 02:04 . 2012-12-17 02:07 ——– d—–w- c:\programdata\AVG2013
2012-12-17 02:04 . 2012-12-17 02:23 ——– d—–w- c:\windows\system32\config\systemprofile\AppData\Local\Avg2013
2012-12-17 02:01 . 2012-12-17 02:01 ——– d—–w- c:\users\Kristen\AppData\Local\MFAData
2012-12-17 02:01 . 2012-12-17 02:01 ——– d—–w- c:\users\Kristen\AppData\Local\Avg2013
2012-12-15 20:25 . 2012-11-05 21:35 46080 —-a-w- c:\windows\system32\atmlib.dll
2012-12-15 20:25 . 2012-11-05 20:41 367616 —-a-w- c:\windows\system32\atmfd.dll
2012-12-15 20:25 . 2012-11-05 20:32 295424 —-a-w- c:\windows\SysWow64\atmfd.dll
2012-12-15 20:25 . 2012-11-05 20:32 34304 —-a-w- c:\windows\SysWow64\atmlib.dll
2012-12-15 19:21 . 2012-11-09 05:45 2048 —-a-w- c:\windows\system32\tzres.dll
2012-12-15 19:20 . 2012-11-02 05:59 478208 —-a-w- c:\windows\system32\dpnet.dll
2012-12-15 19:20 . 2012-11-02 05:11 376832 —-a-w- c:\windows\SysWow64\dpnet.dll
2012-12-15 18:34 . 2012-12-15 18:34 73696 —-a-w- c:\program files (x86)\Mozilla Firefox\breakpadinjector.dll
2012-12-15 18:34 . 2012-12-15 18:34 96224 —-a-w- c:\program files (x86)\Mozilla Firefox\webapprt-stub.exe
2012-12-15 18:34 . 2012-12-15 18:34 157272 —-a-w- c:\program files (x86)\Mozilla Firefox\webapp-uninstaller.exe
2012-12-15 17:15 . 2012-05-04 11:00 366592 —-a-w- c:\windows\system32\qdvd.dll
2012-12-15 17:15 . 2012-05-04 09:59 514560 —-a-w- c:\windows\SysWow64\qdvd.dll
2012-12-15 17:15 . 2012-08-24 18:13 154480 —-a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-12-15 17:15 . 2012-08-24 18:09 458712 —-a-w- c:\windows\system32\drivers\cng.sys
2012-12-15 17:15 . 2012-08-24 18:05 340992 —-a-w- c:\windows\system32\schannel.dll
2012-12-15 17:15 . 2012-08-24 18:04 307200 —-a-w- c:\windows\system32\ncrypt.dll
2012-12-15 17:15 . 2012-08-24 18:03 1448448 —-a-w- c:\windows\system32\lsasrv.dll
2012-12-15 17:15 . 2012-08-24 16:57 247808 —-a-w- c:\windows\SysWow64\schannel.dll
2012-12-15 17:15 . 2012-08-24 16:57 22016 —-a-w- c:\windows\SysWow64\secur32.dll
2012-12-15 17:15 . 2012-08-24 16:57 220160 —-a-w- c:\windows\SysWow64\ncrypt.dll
2012-12-15 17:15 . 2012-08-24 16:53 96768 —-a-w- c:\windows\SysWow64\sspicli.dll
2012-12-07 19:28 . 2012-12-07 19:28 ——– d—–w- c:\users\Kristen\AppData\Local\Symantec
2012-12-07 18:58 . 2008-04-17 21:12 126312 —-a-r- c:\windows\system32\GEARAspi64.dll
2012-12-07 18:58 . 2008-04-17 21:12 107368 —-a-r- c:\windows\SysWow64\GEARAspi.dll
2012-12-07 18:58 . 2009-05-18 22:17 34152 —-a-r- c:\windows\system32\drivers\GEARAspiWDM.sys
2012-12-07 18:57 . 2012-12-07 18:57 ——– d—–w- c:\program files (x86)\Common Files\Skype
2012-12-02 21:13 . 2012-12-02 21:13 ——– d—–w- c:\program files (x86)\Common Files\Software Update Utility
2012-11-22 01:12 . 2012-08-22 18:12 950128 —-a-w- c:\windows\system32\drivers\ndis.sys
2012-11-22 01:12 . 2012-07-04 20:26 41472 —-a-w- c:\windows\system32\drivers\RNDISMP.sys
2012-11-22 01:12 . 2012-08-02 17:58 574464 —-a-w- c:\windows\system32\d3d10level9.dll
2012-11-22 01:12 . 2012-08-02 16:57 490496 —-a-w- c:\windows\SysWow64\d3d10level9.dll
2012-11-22 00:52 . 2012-07-26 04:55 785512 —-a-w- c:\windows\system32\drivers\Wdf01000.sys
2012-11-22 00:52 . 2012-07-26 04:55 54376 —-a-w- c:\windows\system32\drivers\WdfLdr.sys
2012-11-22 00:52 . 2012-07-26 04:47 2560 —-a-w- c:\windows\system32\drivers\en-US\wdf01000.sys.mui
2012-11-22 00:52 . 2012-07-26 02:36 9728 —-a-w- c:\windows\system32\Wdfres.dll
2012-11-22 00:41 . 2012-07-26 02:26 87040 —-a-w- c:\windows\system32\drivers\WUDFPf.sys
2012-11-22 00:41 . 2012-07-26 02:26 198656 —-a-w- c:\windows\system32\drivers\WUDFRd.sys
2012-11-22 00:41 . 2012-07-26 03:08 229888 —-a-w- c:\windows\system32\WUDFHost.exe
2012-11-22 00:41 . 2012-07-26 03:08 84992 —-a-w- c:\windows\system32\WUDFSvc.dll
2012-11-22 00:41 . 2012-07-26 03:08 744448 —-a-w- c:\windows\system32\WUDFx.dll
2012-11-22 00:41 . 2012-07-26 03:08 45056 —-a-w- c:\windows\system32\WUDFCoinstaller.dll
2012-11-22 00:41 . 2012-07-26 03:08 194048 —-a-w- c:\windows\system32\WUDFPlatform.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-12-17 18:49 . 2012-02-15 01:06 22368 —-a-w- c:\windows\system32\drivers\AFD.SYS
2012-12-17 18:49 . 2009-07-14 00:10 22368 —-a-w- c:\windows\system32\drivers\WS2IFSL.SYS
2012-12-17 03:21 . 2012-08-06 19:56 821736 —-a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-12-17 03:21 . 2011-02-21 00:24 746984 —-a-w- c:\windows\SysWow64\deployJava1.dll
2012-12-15 20:13 . 2011-03-03 03:09 67413224 —-a-w- c:\windows\system32\MRT.exe
2012-12-15 16:40 . 2012-04-29 21:18 697272 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-12-15 16:40 . 2011-05-16 10:27 73656 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-11-08 20:16 . 2012-08-30 18:18 30568 —-a-w- c:\windows\system32\drivers\avgtpx64.sys
2012-10-22 18:02 . 2012-10-22 18:02 154464 —-a-w- c:\windows\system32\drivers\avgidsdrivera.sys
2012-10-16 08:38 . 2012-11-28 12:40 135168 —-a-w- c:\windows\apppatch\AppPatch64\AcXtrnal.dll
2012-10-16 08:38 . 2012-11-28 12:40 350208 —-a-w- c:\windows\apppatch\AppPatch64\AcLayers.dll
2012-10-16 07:39 . 2012-11-28 12:40 561664 —-a-w- c:\windows\apppatch\AcLayers.dll
2012-10-15 08:48 . 2012-10-15 08:48 63328 —-a-w- c:\windows\system32\drivers\avgidsha.sys
2012-10-09 18:17 . 2012-11-16 13:07 226816 —-a-w- c:\windows\system32\dhcpcore6.dll
2012-10-09 18:17 . 2012-11-16 13:07 55296 —-a-w- c:\windows\system32\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-16 13:07 44032 —-a-w- c:\windows\SysWow64\dhcpcsvc6.dll
2012-10-09 17:40 . 2012-11-16 13:07 193536 —-a-w- c:\windows\SysWow64\dhcpcore6.dll
2012-10-05 08:32 . 2012-10-05 08:32 111456 —-a-w- c:\windows\system32\drivers\avgmfx64.sys
2012-10-04 16:40 . 2012-12-15 19:21 44032 —-a-w- c:\windows\apppatch\acwow64.dll
2012-10-03 17:56 . 2012-11-16 13:07 1914248 —-a-w- c:\windows\system32\drivers\tcpip.sys
2012-10-03 17:44 . 2012-11-16 13:07 303104 —-a-w- c:\windows\system32\nlasvc.dll
2012-10-03 17:44 . 2012-11-16 13:07 70656 —-a-w- c:\windows\system32\nlaapi.dll
2012-10-03 17:44 . 2012-11-16 13:07 246272 —-a-w- c:\windows\system32\netcorehc.dll
2012-10-03 17:44 . 2012-11-16 13:07 18944 —-a-w- c:\windows\system32\netevent.dll
2012-10-03 17:44 . 2012-11-16 13:07 216576 —-a-w- c:\windows\system32\ncsi.dll
2012-10-03 17:42 . 2012-11-16 13:07 569344 —-a-w- c:\windows\system32\iphlpsvc.dll
2012-10-03 16:42 . 2012-11-16 13:07 175104 —-a-w- c:\windows\SysWow64\netcorehc.dll
2012-10-03 16:42 . 2012-11-16 13:07 18944 —-a-w- c:\windows\SysWow64\netevent.dll
2012-10-03 16:42 . 2012-11-16 13:07 156672 —-a-w- c:\windows\SysWow64\ncsi.dll
2012-10-03 16:07 . 2012-11-16 13:07 45568 —-a-w- c:\windows\system32\drivers\tcpipreg.sys
2012-10-02 08:30 . 2012-10-02 08:30 185696 —-a-w- c:\windows\system32\drivers\avgldx64.sys
2012-09-30 00:54 . 2012-07-02 02:21 25928 —-a-w- c:\windows\system32\drivers\mbam.sys
2012-09-25 22:47 . 2012-11-16 13:07 78336 —-a-w- c:\windows\SysWow64\synceng.dll
2012-09-25 22:46 . 2012-11-16 13:07 95744 —-a-w- c:\windows\system32\synceng.dll
2012-09-21 08:46 . 2012-09-21 08:46 200032 —-a-w- c:\windows\system32\drivers\avgtdia.sys
2012-09-21 08:46 . 2012-09-21 08:46 225120 —-a-w- c:\windows\system32\drivers\avgloga.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2012-11-08 20:16 1796552 —-a-w- c:\program files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\program files (x86)\AVG Secure Search\13.2.0.5\AVG Secure Search_toolbar.dll" [2012-11-08 1796552]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"SmileboxTray"="c:\users\Kristen\AppData\Roaming\Smilebox\SmileboxTray.exe" [2012-07-02 305000]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680]
"Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160]
"DellSupportCenter"="c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe" [2009-05-21 206064]
"ArcSoft Connection Service"="c:\program files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-05-31 59280]
"vProt"="c:\program files (x86)\AVG Secure Search\vprot.exe" [2012-11-08 997320]
"ZoneAlarm"="c:\program files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [2012-03-19 73360]
"HF_G_Jul"="c:\program files (x86)\AVG Secure Search\HF_G_Jul.exe" [2012-07-18 36960]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-04-19 421888]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-06-07 421776]
"ROC_ROC_JULY_P1"="c:\program files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" [2012-08-30 1022048]
"AVG_UI"="c:\program files (x86)\AVG\AVG2013\avgui.exe" [2012-11-07 3143800]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-09-24 926896]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2010-08-12 163040]
.
c:\users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
.
c:\users\Kristen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
RCA Detective.lnk - c:\users\Kristen\Documents\RCA Detective\RCADetective.exe [2012-1-24 1069056]
Webshots Daily Features.lnk - c:\program files (x86)\Webshots Daily Features\Webshots Daily Features.exe [N/A]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2009-12-29 1082656]
Kodak EasyShare software.lnk - c:\program files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2011-2-23 323584]
.
c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2010-5-28 1324384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean64.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
.
R2 AVGIDSAgent;AVGIDSAgent;c:\program files (x86)\AVG\AVG2013\avgidsagent.exe [2012-11-07 5814392]
R2 BBSvc;BingBar Service;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\BBSvc.exe [2012-06-11 193616]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [2012-11-13 1103392]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2012-11-13 1369624]
R2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [2012-11-13 168384]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-05-30 3048136]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-11-09 160944]
R3 AVG Security Toolbar Service;AVG Security Toolbar Service;c:\program files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [2011-04-22 984392]
R3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-03-31 53800]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-03-31 35104]
R3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2010-05-07 245792]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-20 59392]
R3 TurboBoost;TurboBoost;c:\program files\Intel\TurboBoost\TurboBoost.exe [2009-11-02 126352]
R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2011-03-04 1255736]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 AVGIDSHA;AVGIDSHA;c:\windows\system32\DRIVERS\avgidsha.sys [2012-10-15 63328]
S0 Avgloga;AVG Logging Driver;c:\windows\system32\DRIVERS\avgloga.sys [2012-09-21 225120]
S0 Avgmfx64;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\DRIVERS\avgmfx64.sys [2012-10-05 111456]
S0 Avgrkx64;AVG Anti-Rootkit Driver;c:\windows\system32\DRIVERS\avgrkx64.sys [2012-09-14 40800]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280]
S1 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\DRIVERS\avgidsdrivera.sys [2012-10-22 154464]
S1 Avgldx64;AVG AVI Loader Driver;c:\windows\system32\DRIVERS\avgldx64.sys [2012-10-02 185696]
S1 Avgtdia;AVG TDI Driver;c:\windows\system32\DRIVERS\avgtdia.sys [2012-09-21 200032]
S1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx64.sys [2012-11-08 30568]
S2 AERTFilters;Andrea RT Filters Service;c:\program files\Realtek\Audio\HDA\AERTSr64.exe [2009-11-18 98208]
S2 avgwd;AVG WatchDog;c:\program files (x86)\AVG\AVG2013\avgwdsvc.exe [2012-10-22 196664]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648]
S2 ISWKL;ZoneAlarm LTD Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2012-03-16 33672]
S2 IswSvc;ZoneAlarm LTD Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\IswSvc.exe [2012-03-16 827520]
S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2010-08-20 689472]
S2 TurboB;Turbo Boost UI Monitor driver;c:\windows\system32\DRIVERS\TurboB.sys [2009-11-02 13784]
S2 UNS;Intel® Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe [2010-07-01 2533400]
S2 vToolbarUpdater13.2.0;vToolbarUpdater13.2.0;c:\program files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [2012-11-08 711112]
S3 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\7.1.391.0\SeaPort.exe [2012-06-11 240208]
S3 BcmVWL;Broadcom Virtual Wireless;c:\windows\system32\DRIVERS\bcmvwl64.sys [2010-02-02 20984]
S3 HECIx64;Intel® Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-17 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976]
S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2009-12-22 74280]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-12-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-29 16:40]
.
.
——— X64 Entries ———–
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-04-14 10144288]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-07-29 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-07-29 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-07-29 415256]
"Broadcom Wireless Manager UI"="c:\program files\Dell\DW WLAN Card\WLTRAY.exe" [2010-02-02 5712896]
"ISW"="c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2012-03-16 1126528]
.
——- Supplementary Scan ——-
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://facebook.com/
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;
TCP: DhcpNameServer = 192.168.1.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\program files (x86)\Common Files\AVG Secure Search\ViProtocolInstaller\13.2.0\ViProtocol.dll
FF - ProfilePath - c:\users\Kristen\AppData\Roaming\Mozilla\Firefox\Profiles\idhp9nz6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.aol.com/search/search?q={searchTerms}&s_it=aimright-ff&s_qt=sb&tb_uuid=20121202211357169&tb_oid=10-10-1010&tb_mrud=10-10-1010
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: network.proxy.type - 0
FF - ExtSQL: 2012-12-16 21:24; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\users\Kristen\AppData\Roaming\Mozilla\Firefox\Profiles\idhp9nz6.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
Wow6432Node-HKCU-Run-Akamai NetSession Interface - c:\users\Kristen\AppData\Local\Akamai\netsession_win.exe
Wow6432Node-HKLM-Run-ROC_roc_dec12 - c:\program files (x86)\AVG Secure Search\ROC_roc_dec12.exe
Notify-SDWinLogon - SDWinLogon.dll
.
.
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_5_502_135_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_5_502_135.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\McAfee]
"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Completion time: 2012-12-18 00:42:53
ComboFix-quarantined-files.txt 2012-12-18 05:41
ComboFix2.txt 2012-12-17 17:57
.
Pre-Run: 429,212,753,920 bytes free
Post-Run: 428,914,880,512 bytes free
.
- - End Of File - - E5C4DAE27249D02F7B1478ABB7FC7B15
How is your system running?
Everything seems OK but it was working well before contacting you. I did the Windows update and all but one optional update installed OK (KB2592687) which failed. Also upgraded AVG to 2013 and installed Spybot S&D with no issues.
Even though it seemed to be running OK, I was concerned that the computer shop found a trojan but I was unable to do the same. That's why I contacted What The Tech. Don't know what trojan name computer shop found they found.
Anyway, still running OK this morning. Computer had shut down sometime this morning between 4:40 and 6:30 but came back up OK when I turned it on.
Good….let's check and make sure nothing is hiding….
See
this page for instructions on how to clear java's cache.
Go into the Control Panel and double-click the Java Icon. (looks like a coffee cup)
Under Temporary Internet Files, click the Delete Files button. There are three options in the window to clear the cache - Leave ALL 3 Checked Downloaded Applets Click OK on Delete Temporary Files WindowNote: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Java Control Panel.
———-
Malwarebytes
Please open Malwarebytes, update it and then run a
Quick Scan . Save the log that is created for your next reply.
———-
ESET Online Scanner
Go
here to run an online scannner from ESET.
Windows Vista/Windows 7 users will need to right click on their Internet Explorer shortcut, and select Run as Administrator Note: For browsers other than Internet Explorer, you will be prompted to download and install esetsmartinstaller_enu.exe. Click on the link and save the file to a convenient location. Double click on it to install and a new window will open. Follow the prompts. Turn off the real time scanner of any existing antivirus program while performing the online scan Tick the box next to YES, I accept the Terms of Use. Click Start When asked, allow the activex control to install Click Start Make sure that the option Remove found threats unticked Scan Archives option is ticked. Click on Advanced Settings, ensure the options Scan for potentially unwanted applications , Scan for potentially unsafe applications , and Enable Anti-Stealth Technology are ticked. Click Scan Wait for the scan to finish When the scan is done, if it shows a screen that says "Threats found!", then click "List of found threats", and then click "Export to text file…" Save that text file on your desktop. Copy and paste the contents of that log as a reply to this topic. Close the ESET online scan, and let me know how things are now. ———-
Malwarebytes Log.
Will run ESET now.
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org
Database version: v2012.12.15.04
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Kristen :: KRISTEN-PC [administrator]
12/18/2012 9:32:01 AM
mbam-log-2012-12-18 (09-32-01).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 232778
Time elapsed: 2 minute(s), 37 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
ESET Log
I researched on-line and saw several others have had the HiddenStart.a in Dell DataSafe also.
C:\Program Files (x86)\Dell DataSafe Local Backup\hstart.exe a variant of Win32/HiddenStart.A application
C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U\00000001.@ Win64/Conedex.D trojan
Hi, Combofix.exe from your desktop and download a new version from here to your desktop.Disable your AntiVirus and AntiSpyware applications. C:\Combofix.txt . Please post this log for further review.
ComboFix has been running about 4 hrs now. It has completed thru stage 4 and been there ever since.
Will continue to let it complete but don't know how long it will take.
Go ahead and reboot. Try to run it again. If you still have problems, reboot to Safe Mode and run it from there.
Rebooted and ran CF again. Went quicker this time. When it started to prepare the report, got the following message:'REGT' is not recognized as an internal or external command, program or batch file
Thanks….I think we need to look at this another way to get a better view.
Did you get your internet back or are you using a different computer?
FRST
Download the
64 bit version for your system of FRST and save it to a flash drive.
Plug the flashdrive into the infected PC.
Enter
System Recovery Options .
To enter System Recovery Options from the Advanced Boot Options: Restart the computer. As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears. Use the arrow keys to select the Repair your computer menu item. Select US as the keyboard language settings, and then click Next . Select the operating system you want to repair, and then click Next . Select your user account an click Next . To enter System Recovery Options by using Windows installation disc: Insert the installation disc. Restart your computer. If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings. Click Repair your computer . Select US as the keyboard language settings, and then click Next . Select the operating system you want to repair, and then click Next . Select your user account and click Next . On the System Recovery Options menu you will get the following options: Startup Repair
[*]Select
Command Prompt [*]In the command window type in
notepad and press
Enter .
[*]The notepad opens. Under File menu select
Open .
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type
e :\frst.exe (for x64 bit version type
e :\frst64) and press
Enter Note: Replace letter
e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.
[*]Press
Scan button.
[*]It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.
———-
Still no internet. Using my home computer. Daughter's computer is a laptop using wireless. I tried hooking up with ethernet cable a still no Internet.
Tried to see if I could boot to Safe Mode but couldn't get it to go to Boot Options nor BIOS.
I'll run FRST per your last post.
After several reboots and attempts at F8, finally got it to work.
Here is the FRST Log.
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 18-12-2012
Ran by [removed] at 19-12-2012 09:20:36
Running from D:\
Windows 7 Home Premium (X64) OS Language: English(US)
The current controlset is ControlSet001
==================== Registry (Whitelisted) ===================
HKLM\…\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2122536 2010-05-07] (Synaptics Incorporated)
HKLM\…\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10144288 2010-04-13] (Realtek Semiconductor)
HKLM\…\Run: [Broadcom Wireless Manager UI] C:\Program Files\Dell\DW WLAN Card\WLTRAY.exe [5712896 2010-02-02] (Dell Inc.)
HKLM\…\Run: [ISW] C:\Program Files\CheckPoint\ZAForceField\ForceField.exe /icon="hidden" [1126528 2012-03-16] (Check Point Software Technologies)
HKLM-x32\…\Run: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m [1807680 2010-02-09] ()
HKLM-x32\…\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [498160 2009-10-15] ()
HKLM-x32\…\Run: [DellSupportCenter] "c:\Program Files (x86)\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter [206064 2009-05-21] (SupportSoft, Inc.)
HKLM-x32\…\Run: [ArcSoft Connection Service] C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe [207424 2010-10-27] (ArcSoft Inc.)
HKLM-x32\…\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59280 2012-05-30] (Apple Inc.)
HKLM-x32\…\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" [997320 2012-11-08] ()
HKLM-x32\…\Run: [ZoneAlarm] "C:\Program Files (x86)\CheckPoint\ZoneAlarm\zatray.exe" [73360 2012-03-19] (Check Point Software Technologies LTD)
HKLM-x32\…\Run: [HF_G_Jul] "C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe" /DoAction [36960 2012-07-18] ()
HKLM-x32\…\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-04-18] (Apple Inc.)
HKLM-x32\…\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [421776 2012-06-07] (Apple Inc.)
HKLM-x32\…\Run: [ROC_ROC_JULY_P1] "C:\Program Files (x86)\AVG Secure Search\ROC_ROC_JULY_P1.exe" / /PROMPT /CMPID=ROC_JULY_P1 [1022048 2012-08-30] ()
HKLM-x32\…\Run: [AVG_UI] "C:\Program Files (x86)\AVG\AVG2013\avgui.exe" /TRAYONLY [3143800 2012-11-06] (AVG Technologies CZ, s.r.o.)
HKLM-x32\…\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [926896 2012-09-23] (Adobe Systems Incorporated)
HKU\Guest\…\Run: [Facebook Update] "C:\Users\Guest\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-11] (Facebook Inc.)
HKU\Guest\…\Run: [Exent_SDM] C:\Users\Guest\AppData\Local\Temp\SDM143\Free Ride Games.exe "l 'Startup' u 'http://www.freeridegames.com/do/SDM?action=config&contentId;=%d' p '143' c '636250'" [x]
HKU\Kristen\…\Run: [SmileboxTray] "C:\Users\Kristen\AppData\Roaming\Smilebox\SmileboxTray.exe" [305000 2012-07-02] (Smilebox, Inc.)
HKLM-x32\…\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [163040 2010-08-11] (Softthinks)
Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X]
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
ShortcutTarget: Kodak EasyShare software.lnk -> C:\Program Files (x86)\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)
Startup: C:\Users\Default\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Default User\Start Menu\Programs\Startup\Dell Dock First Run.lnk
ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Guest\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Kristen\Start Menu\Programs\Startup\Dell Dock.lnk
ShortcutTarget: Dell Dock.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation)
Startup: C:\Users\Kristen\Start Menu\Programs\Startup\RCA Detective.lnk
ShortcutTarget: RCA Detective.lnk -> (No File)
Startup: C:\Users\Kristen\Start Menu\Programs\Startup\Webshots Daily Features.lnk
ShortcutTarget: Webshots Daily Features.lnk -> C:\Program Files (x86)\Webshots Daily Features\Webshots Daily Features.exe (No File)
==================== Services (Whitelisted) ===================
2 ACDaemon; C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe [113152 2010-03-18] (ArcSoft Inc.)
3 AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [984392 2011-04-22] ()
2 AVGIDSAgent; "C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe" [5814392 2012-11-06] (AVG Technologies CZ, s.r.o.)
2 avgwd; "C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe" [196664 2012-10-22] (AVG Technologies CZ, s.r.o.)
2 IswSvc; "C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe" [827520 2012-03-16] (Check Point Software Technologies)
3 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1103392 2012-11-13] (Safer-Networking Ltd.)
3 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1369624 2012-11-13] (Safer-Networking Ltd.)
3 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [168384 2012-11-13] (Safer-Networking Ltd.)
2 vsmon; C:\Program Files (x86)\CheckPoint\ZoneAlarm\vsmon.exe -service [2421640 2012-03-19] (Check Point Software Technologies LTD)
2 vToolbarUpdater13.2.0; C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\13.2.0\ToolbarUpdater.exe [711112 2012-11-08] ()
==================== Drivers (Whitelisted) =====================
1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [154464 2012-10-22] (AVG Technologies CZ, s.r.o. )
0 AVGIDSHA; C:\Windows\System32\Drivers\AVGIDSHA.sys [63328 2012-10-15] (AVG Technologies CZ, s.r.o. )
1 Avgldx64; C:\Windows\System32\Drivers\Avgldx64.sys [185696 2012-10-02] (AVG Technologies CZ, s.r.o.)
0 Avgloga; C:\Windows\System32\Drivers\Avgloga.sys [225120 2012-09-21] (AVG Technologies CZ, s.r.o.)
0 Avgmfx64; C:\Windows\System32\Drivers\Avgmfx64.sys [111456 2012-10-05] (AVG Technologies CZ, s.r.o.)
0 Avgrkx64; C:\Windows\System32\Drivers\Avgrkx64.sys [40800 2012-09-14] (AVG Technologies CZ, s.r.o.)
1 Avgtdia; C:\Windows\System32\Drivers\Avgtdia.sys [200032 2012-09-21] (AVG Technologies CZ, s.r.o.)
1 avgtp; \??\C:\Windows\system32\drivers\avgtpx64.sys [30568 2012-11-08] (AVG Technologies)
3 GEARAspiWDM; C:\Windows\System32\Drivers\GEARAspiWDM.sys [34152 2009-05-18] ()
2 ISWKL; \??\C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys [33672 2012-03-16] (Check Point Software Technologies)
2 TurboB; C:\Windows\System32\Drivers\TurboB.sys [13784 2009-11-02] ()
1 Vsdatant; C:\Windows\System32\Drivers\Vsdatant.sys [454232 2011-05-07] (Check Point Software Technologies LTD)
3 catchme; \??\C:\ComboFix\catchme.sys [x]
3 CtClsFlt; C:\Windows\System32\DRIVERS\CtClsFlt.sys [x]
==================== NetSvcs (Whitelisted) ====================
==================== One Month Created Files and Folders ========
2012-12-19 09:20 - 2012-12-19 09:20 - 00000000 ____D C:\FRST
2012-12-18 19:14 - 2012-12-18 19:14 - 00075713 ____A C:\ComboFix.txt
2012-12-18 12:43 - 2012-12-18 12:43 - 05012571 ____R (Swearware) C:\Users\Kristen\Desktop\ComboFix.exe
2012-12-18 08:45 - 2012-12-18 08:45 - 00000000 ____D C:\Program Files (x86)\ESET
2012-12-18 08:43 - 2012-12-18 08:43 - 02322184 ____A (ESET) C:\Users\Kristen\Desktop\esetsmartinstaller_enu.exe
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\Local Settings\Avg2013
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\Local Settings\Application Data\Avg2013
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\Application Data\AVG2013
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\AppData\Roaming\AVG2013
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\AppData\Local\Avg2013
2012-12-17 12:41 - 2012-12-17 12:41 - 00081432 ____A C:\Users\Kristen\My Documents\combofix2.txt
2012-12-17 12:41 - 2012-12-17 12:41 - 00081432 ____A C:\Users\Kristen\Documents\combofix2.txt
2012-12-17 11:41 - 2011-06-26 00:45 - 00256000 ____A C:\Windows\PEV.exe
2012-12-17 11:41 - 2010-11-07 11:20 - 00208896 ____A C:\Windows\MBR.exe
2012-12-17 11:41 - 2009-04-19 22:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe
2012-12-17 11:41 - 2000-08-30 18:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe
2012-12-17 11:41 - 2000-08-30 18:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe
2012-12-17 11:41 - 2000-08-30 18:00 - 00098816 ____A C:\Windows\sed.exe
2012-12-17 11:41 - 2000-08-30 18:00 - 00080412 ____A C:\Windows\grep.exe
2012-12-17 11:41 - 2000-08-30 18:00 - 00068096 ____A C:\Windows\zip.exe
2012-12-17 11:37 - 2012-12-18 19:17 - 00000000 ____D C:\Qoobox
2012-12-17 11:36 - 2012-12-17 11:56 - 00000000 ____D C:\Windows\erdnt
2012-12-17 11:00 - 2012-12-17 11:00 - 00002052 ____A C:\Users\Kristen\Desktop\aswMBR.txt
2012-12-17 11:00 - 2012-12-17 11:00 - 00000512 ____A C:\Users\Kristen\Desktop\MBR.dat
2012-12-17 10:21 - 2012-12-17 10:21 - 00032469 ____A C:\Users\Kristen\Desktop\dds.txt
2012-12-17 10:21 - 2012-12-17 10:21 - 00012656 ____A C:\Users\Kristen\Desktop\attach.txt
2012-12-17 10:16 - 2012-12-17 10:16 - 04732416 ____A (AVAST Software) C:\Users\Kristen\Desktop\aswMBR.exe
2012-12-17 10:09 - 2012-12-17 10:09 - 00688992 ____R (Swearware) C:\Users\Kristen\Desktop\dds.com
2012-12-17 09:26 - 2012-12-17 09:26 - 00017727 ____A C:\Users\Kristen\Desktop\hijackthis.log
2012-12-17 09:15 - 2012-12-17 09:21 - 00000000 ____D C:\Windows\pss
2012-12-17 09:10 - 2012-12-17 09:10 - 00388608 ____A (Trend Micro Inc.) C:\Users\Kristen\Desktop\HijackThis.exe
2012-12-17 08:10 - 2012-12-17 08:19 - 00000000 ____D C:\Users\All Users\Spybot - Search & Destroy
2012-12-17 08:10 - 2012-12-17 08:19 - 00000000 ____D C:\Users\All Users\Application Data\Spybot - Search & Destroy
2012-12-17 08:10 - 2012-12-17 08:10 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2012-12-17 08:10 - 2009-01-25 11:14 - 00017272 ____A (Safer Networking Limited) C:\Windows\System32\sdnclean64.exe
2012-12-17 08:05 - 2012-12-17 08:05 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{1EABE9FC-BE19-40D5-9666-9B8E24535809}
2012-12-17 08:05 - 2012-12-17 08:05 - 00000000 ____D C:\Users\Kristen\Local Settings\{1EABE9FC-BE19-40D5-9666-9B8E24535809}
2012-12-17 08:05 - 2012-12-17 08:05 - 00000000 ____D C:\Users\Kristen\AppData\Local\{1EABE9FC-BE19-40D5-9666-9B8E24535809}
2012-12-16 21:22 - 2012-12-16 21:21 - 00246760 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2012-12-16 21:21 - 2012-12-16 21:21 - 00095208 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2012-12-16 20:39 - 2012-12-16 20:39 - 00000000 ____D C:\Program Files\WOT
2012-12-16 20:39 - 2012-12-16 20:39 - 00000000 ____D C:\Program Files (x86)\WOT
2012-12-16 20:07 - 2012-12-16 20:07 - 00000000 ____D C:\Users\Kristen\Application Data\TuneUp Software
2012-12-16 20:07 - 2012-12-16 20:07 - 00000000 ____D C:\Users\Kristen\Application Data\AVG2013
2012-12-16 20:07 - 2012-12-16 20:07 - 00000000 ____D C:\Users\Kristen\AppData\Roaming\TuneUp Software
2012-12-16 20:07 - 2012-12-16 20:07 - 00000000 ____D C:\Users\Kristen\AppData\Roaming\AVG2013
2012-12-16 20:04 - 2012-12-16 20:07 - 00000000 ____D C:\Users\All Users\AVG2013
2012-12-16 20:04 - 2012-12-16 20:07 - 00000000 ____D C:\Users\All Users\Application Data\AVG2013
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\Local Settings\MFAData
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\Local Settings\Avg2013
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\MFAData
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\Avg2013
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\AppData\Local\MFAData
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\AppData\Local\Avg2013
2012-12-16 12:24 - 2012-12-16 12:24 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{62AA4ABD-531D-4D67-B294-ED640BC0334E}
2012-12-16 12:24 - 2012-12-16 12:24 - 00000000 ____D C:\Users\Kristen\Local Settings\{62AA4ABD-531D-4D67-B294-ED640BC0334E}
2012-12-16 12:24 - 2012-12-16 12:24 - 00000000 ____D C:\Users\Kristen\AppData\Local\{62AA4ABD-531D-4D67-B294-ED640BC0334E}
2012-12-15 14:25 - 2012-11-05 15:35 - 00046080 ____A (Adobe Systems) C:\Windows\System32\atmlib.dll
2012-12-15 14:25 - 2012-11-05 14:41 - 00367616 ____A (Adobe Systems Incorporated) C:\Windows\System32\atmfd.dll
2012-12-15 14:25 - 2012-11-05 14:32 - 00295424 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2012-12-15 14:25 - 2012-11-05 14:32 - 00034304 ____A (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2012-12-15 13:32 - 2012-11-14 01:06 - 17811968 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-12-15 13:32 - 2012-11-14 00:32 - 10925568 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-12-15 13:32 - 2012-11-14 00:11 - 02312704 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-12-15 13:32 - 2012-11-14 00:04 - 01392128 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-12-15 13:32 - 2012-11-14 00:04 - 01346048 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-12-15 13:32 - 2012-11-14 00:02 - 01494528 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-12-15 13:32 - 2012-11-14 00:02 - 00237056 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-12-15 13:32 - 2012-11-13 23:59 - 00085504 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-12-15 13:32 - 2012-11-13 23:58 - 00816640 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-12-15 13:32 - 2012-11-13 23:57 - 00599040 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2012-12-15 13:32 - 2012-11-13 23:57 - 00173056 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-12-15 13:32 - 2012-11-13 23:55 - 02144768 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-12-15 13:32 - 2012-11-13 23:55 - 00729088 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2012-12-15 13:32 - 2012-11-13 23:53 - 00096768 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-12-15 13:32 - 2012-11-13 23:52 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-12-15 13:32 - 2012-11-13 23:46 - 00248320 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-12-15 13:32 - 2012-11-13 20:48 - 12320256 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2012-12-15 13:32 - 2012-11-13 20:14 - 09738240 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2012-12-15 13:32 - 2012-11-13 20:09 - 01800704 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2012-12-15 13:32 - 2012-11-13 19:58 - 01427968 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2012-12-15 13:32 - 2012-11-13 19:57 - 01129472 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2012-12-15 13:32 - 2012-11-13 19:57 - 01103872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2012-12-15 13:32 - 2012-11-13 19:55 - 00231936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2012-12-15 13:32 - 2012-11-13 19:51 - 00065024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2012-12-15 13:32 - 2012-11-13 19:49 - 00717824 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2012-12-15 13:32 - 2012-11-13 19:49 - 00142848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2012-12-15 13:32 - 2012-11-13 19:48 - 00420864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2012-12-15 13:32 - 2012-11-13 19:47 - 00607744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2012-12-15 13:32 - 2012-11-13 19:46 - 01793024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2012-12-15 13:32 - 2012-11-13 19:45 - 00073216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2012-12-15 13:32 - 2012-11-13 19:44 - 02382848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2012-12-15 13:32 - 2012-11-13 19:41 - 00176640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2012-12-15 13:21 - 2012-11-21 21:26 - 03149824 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-12-15 13:21 - 2012-11-08 23:45 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2012-12-15 13:21 - 2012-11-08 22:42 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2012-12-15 13:21 - 2012-10-04 11:46 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll
2012-12-15 13:21 - 2012-10-04 11:46 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll
2012-12-15 13:21 - 2012-10-04 11:46 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll
2012-12-15 13:21 - 2012-10-04 11:45 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2012-12-15 13:21 - 2012-10-04 11:43 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll
2012-12-15 13:21 - 2012-10-04 11:41 - 01161216 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2012-12-15 13:21 - 2012-10-04 11:41 - 00424960 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 11:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:47 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll
2012-12-15 13:21 - 2012-10-04 10:47 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2012-12-15 13:21 - 2012-10-04 10:47 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 10:40 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 09:21 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe
2012-12-15 13:21 - 2012-10-04 08:46 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe
2012-12-15 13:21 - 2012-10-04 08:46 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll
2012-12-15 13:21 - 2012-10-04 08:46 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe
2012-12-15 13:21 - 2012-10-04 08:46 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe
2012-12-15 13:21 - 2012-10-04 08:41 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 08:41 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 08:41 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll
2012-12-15 13:21 - 2012-10-04 08:41 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll
2012-12-15 13:20 - 2012-11-01 23:59 - 00478208 ____A (Microsoft Corporation) C:\Windows\System32\dpnet.dll
2012-12-15 13:20 - 2012-11-01 23:11 - 00376832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll
2012-12-15 11:44 - 2012-12-15 11:44 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{6A3617E7-EA83-460A-AA8A-49CAB68E30AB}
2012-12-15 11:44 - 2012-12-15 11:44 - 00000000 ____D C:\Users\Kristen\Local Settings\{6A3617E7-EA83-460A-AA8A-49CAB68E30AB}
2012-12-15 11:44 - 2012-12-15 11:44 - 00000000 ____D C:\Users\Kristen\AppData\Local\{6A3617E7-EA83-460A-AA8A-49CAB68E30AB}
2012-12-15 11:15 - 2012-08-24 12:13 - 00154480 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-12-15 11:15 - 2012-08-24 12:09 - 00458712 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-12-15 11:15 - 2012-08-24 12:05 - 00340992 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-12-15 11:15 - 2012-08-24 12:04 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-12-15 11:15 - 2012-08-24 12:03 - 01448448 ____A (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2012-12-15 11:15 - 2012-08-24 10:57 - 00247808 ____A (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2012-12-15 11:15 - 2012-08-24 10:57 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2012-12-15 11:15 - 2012-08-24 10:57 - 00022016 ____A (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2012-12-15 11:15 - 2012-08-24 10:53 - 00096768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2012-12-15 11:15 - 2012-05-04 05:00 - 00366592 ____A (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2012-12-15 11:15 - 2012-05-04 03:59 - 00514560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2012-12-14 17:20 - 2012-12-14 17:20 - 00011962 ____A C:\Users\Kristen\My Documents\Norton Scan.txt
2012-12-14 17:20 - 2012-12-14 17:20 - 00011962 ____A C:\Users\Kristen\Documents\Norton Scan.txt
2012-12-14 17:14 - 2012-12-14 17:14 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{791A6351-6163-4B72-BD30-384D8ADE834E}
2012-12-14 17:14 - 2012-12-14 17:14 - 00000000 ____D C:\Users\Kristen\Local Settings\{791A6351-6163-4B72-BD30-384D8ADE834E}
2012-12-14 17:14 - 2012-12-14 17:14 - 00000000 ____D C:\Users\Kristen\AppData\Local\{791A6351-6163-4B72-BD30-384D8ADE834E}
2012-12-07 13:28 - 2012-12-07 13:28 - 00000000 ____D C:\Users\Kristen\Local Settings\Symantec
2012-12-07 13:28 - 2012-12-07 13:28 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\Symantec
2012-12-07 13:28 - 2012-12-07 13:28 - 00000000 ____D C:\Users\Kristen\AppData\Local\Symantec
2012-12-07 13:05 - 2012-12-07 13:06 - 00272216 ____A C:\Windows\Minidump\120712-54381-01.dmp
2012-12-07 12:58 - 2009-05-18 16:17 - 00034152 ___RA C:\Windows\System32\Drivers\GEARAspiWDM.sys
2012-12-07 12:58 - 2008-04-17 15:12 - 00126312 ___RA C:\Windows\System32\GEARAspi64.dll
2012-12-07 12:58 - 2008-04-17 15:12 - 00107368 ___RA (GEAR Software Inc.) C:\Windows\SysWOW64\GEARAspi.dll
2012-12-07 12:57 - 2012-12-07 12:57 - 00002515 ____A C:\Users\Public\Desktop\Skype.lnk
2012-12-07 12:57 - 2012-12-07 12:57 - 00002515 ____A C:\Users\All Users\Desktop\Skype.lnk
2012-12-07 12:52 - 2012-12-07 12:52 - 00279032 ____A C:\Windows\Minidump\120712-41933-01.dmp
2012-12-07 12:34 - 2012-12-07 12:34 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{2AF9E10C-BC0F-4042-B3A8-84FC9B4F8714}
2012-12-07 12:34 - 2012-12-07 12:34 - 00000000 ____D C:\Users\Kristen\Local Settings\{2AF9E10C-BC0F-4042-B3A8-84FC9B4F8714}
2012-12-07 12:34 - 2012-12-07 12:34 - 00000000 ____D C:\Users\Kristen\AppData\Local\{2AF9E10C-BC0F-4042-B3A8-84FC9B4F8714}
2012-12-03 18:56 - 2012-12-05 12:46 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{6E7A6280-6A47-4F92-A9FA-BE43FE92BD5B}
2012-12-03 18:56 - 2012-12-05 12:46 - 00000000 ____D C:\Users\Kristen\Local Settings\{6E7A6280-6A47-4F92-A9FA-BE43FE92BD5B}
2012-12-03 18:56 - 2012-12-05 12:46 - 00000000 ____D C:\Users\Kristen\AppData\Local\{6E7A6280-6A47-4F92-A9FA-BE43FE92BD5B}
2012-12-03 18:43 - 2012-12-03 18:43 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{283E5275-F16B-4DF3-BCB4-E78C1F3C04AC}
2012-12-03 18:43 - 2012-12-03 18:43 - 00000000 ____D C:\Users\Kristen\Local Settings\{283E5275-F16B-4DF3-BCB4-E78C1F3C04AC}
2012-12-03 18:43 - 2012-12-03 18:43 - 00000000 ____D C:\Users\Kristen\AppData\Local\{283E5275-F16B-4DF3-BCB4-E78C1F3C04AC}
2012-12-03 18:29 - 2012-12-03 18:29 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{1BC3E69D-76EE-4A58-9F0D-68A5F0B8075C}
2012-12-03 18:29 - 2012-12-03 18:29 - 00000000 ____D C:\Users\Kristen\Local Settings\{1BC3E69D-76EE-4A58-9F0D-68A5F0B8075C}
2012-12-03 18:29 - 2012-12-03 18:29 - 00000000 ____D C:\Users\Kristen\AppData\Local\{1BC3E69D-76EE-4A58-9F0D-68A5F0B8075C}
2012-12-03 08:17 - 2012-12-03 08:17 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{C2EAB0B9-282B-4D08-AD5D-1D92607F624B}
2012-12-03 08:17 - 2012-12-03 08:17 - 00000000 ____D C:\Users\Kristen\Local Settings\{C2EAB0B9-282B-4D08-AD5D-1D92607F624B}
2012-12-03 08:17 - 2012-12-03 08:17 - 00000000 ____D C:\Users\Kristen\AppData\Local\{C2EAB0B9-282B-4D08-AD5D-1D92607F624B}
2012-12-02 20:16 - 2012-12-02 20:16 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{8F918CA7-4DCA-488F-9445-4870369F867A}
2012-12-02 20:16 - 2012-12-02 20:16 - 00000000 ____D C:\Users\Kristen\Local Settings\{8F918CA7-4DCA-488F-9445-4870369F867A}
2012-12-02 20:16 - 2012-12-02 20:16 - 00000000 ____D C:\Users\Kristen\AppData\Local\{8F918CA7-4DCA-488F-9445-4870369F867A}
2012-12-02 18:25 - 2012-12-02 18:25 - 00000000 ___SD C:\Users\Guest\My Documents\My Data Sources
2012-12-02 18:25 - 2012-12-02 18:25 - 00000000 ___SD C:\Users\Guest\Documents\My Data Sources
2012-11-27 20:13 - 2012-12-02 07:28 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{101F40DF-D307-415E-B954-A949726898AF}
2012-11-27 20:13 - 2012-12-02 07:28 - 00000000 ____D C:\Users\Kristen\Local Settings\{101F40DF-D307-415E-B954-A949726898AF}
2012-11-27 20:13 - 2012-12-02 07:28 - 00000000 ____D C:\Users\Kristen\AppData\Local\{101F40DF-D307-415E-B954-A949726898AF}
2012-11-25 17:25 - 2012-11-27 08:12 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{DDE5EE2C-945B-4A96-81D0-1D9B978F1AF2}
2012-11-25 17:25 - 2012-11-27 08:12 - 00000000 ____D C:\Users\Kristen\Local Settings\{DDE5EE2C-945B-4A96-81D0-1D9B978F1AF2}
2012-11-25 17:25 - 2012-11-27 08:12 - 00000000 ____D C:\Users\Kristen\AppData\Local\{DDE5EE2C-945B-4A96-81D0-1D9B978F1AF2}
2012-11-24 09:22 - 2012-11-24 09:22 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{57A78C2F-23DE-4851-8237-52750E59FCBC}
2012-11-24 09:22 - 2012-11-24 09:22 - 00000000 ____D C:\Users\Kristen\Local Settings\{57A78C2F-23DE-4851-8237-52750E59FCBC}
2012-11-24 09:22 - 2012-11-24 09:22 - 00000000 ____D C:\Users\Kristen\AppData\Local\{57A78C2F-23DE-4851-8237-52750E59FCBC}
2012-11-22 07:10 - 2012-11-23 20:59 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{018F460A-C51D-4083-983F-4D5165886BA5}
2012-11-22 07:10 - 2012-11-23 20:59 - 00000000 ____D C:\Users\Kristen\Local Settings\{018F460A-C51D-4083-983F-4D5165886BA5}
2012-11-22 07:10 - 2012-11-23 20:59 - 00000000 ____D C:\Users\Kristen\AppData\Local\{018F460A-C51D-4083-983F-4D5165886BA5}
2012-11-21 19:12 - 2012-08-22 12:12 - 00950128 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ndis.sys
2012-11-21 19:12 - 2012-08-02 11:58 - 00574464 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2012-11-21 19:12 - 2012-08-02 10:57 - 00490496 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2012-11-21 19:12 - 2012-07-04 14:26 - 00041472 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\RNDISMP.sys
2012-11-21 18:52 - 2012-07-25 22:55 - 00785512 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\Wdf01000.sys
2012-11-21 18:52 - 2012-07-25 22:55 - 00054376 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WdfLdr.sys
2012-11-21 18:52 - 2012-07-25 20:36 - 00009728 ____A (Microsoft Corporation) C:\Windows\System32\Wdfres.dll
2012-11-21 18:52 - 2012-06-02 08:35 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf
2012-11-21 18:41 - 2012-07-25 21:08 - 00744448 ____A (Microsoft Corporation) C:\Windows\System32\WUDFx.dll
2012-11-21 18:41 - 2012-07-25 21:08 - 00229888 ____A (Microsoft Corporation) C:\Windows\System32\WUDFHost.exe
2012-11-21 18:41 - 2012-07-25 21:08 - 00194048 ____A (Microsoft Corporation) C:\Windows\System32\WUDFPlatform.dll
2012-11-21 18:41 - 2012-07-25 21:08 - 00084992 ____A (Microsoft Corporation) C:\Windows\System32\WUDFSvc.dll
2012-11-21 18:41 - 2012-07-25 21:08 - 00045056 ____A (Microsoft Corporation) C:\Windows\System32\WUDFCoinstaller.dll
2012-11-21 18:41 - 2012-07-25 20:26 - 00198656 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFRd.sys
2012-11-21 18:41 - 2012-07-25 20:26 - 00087040 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\WUDFPf.sys
2012-11-21 18:41 - 2012-06-02 08:57 - 00000003 ____A C:\Windows\System32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf
==================== One Month Modified Files and Folders =======
2012-12-19 09:20 - 2012-12-19 09:20 - 00000000 ____D C:\FRST
2012-12-19 08:16 - 2011-03-03 20:11 - 00000000 ____D C:\Program Files (x86)\D-Link Toolbar
2012-12-19 08:16 - 2009-07-13 23:08 - 00032630 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-12-19 08:16 - 2009-07-13 23:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-12-19 08:15 - 2009-07-13 22:51 - 00064190 ____A C:\Windows\setupact.log
2012-12-19 07:48 - 2009-07-13 22:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-12-19 07:48 - 2009-07-13 22:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-12-19 07:46 - 2011-03-02 12:45 - 00000000 ____D C:\Users\All Users\MFAData
2012-12-19 07:46 - 2011-03-02 12:45 - 00000000 ____D C:\Users\All Users\Application Data\MFAData
2012-12-19 07:43 - 2009-07-13 23:10 - 01967493 ____A C:\Windows\WindowsUpdate.log
2012-12-19 07:41 - 2011-03-02 11:57 - 00000000 ____D C:\Users\Kristen\Local Settings\SoftThinks
2012-12-19 07:41 - 2011-03-02 11:57 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\SoftThinks
2012-12-19 07:41 - 2011-03-02 11:57 - 00000000 ____D C:\Users\Kristen\AppData\Local\SoftThinks
2012-12-18 20:40 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\System32\NDF
2012-12-18 20:34 - 2009-07-13 23:13 - 00726444 ____A C:\Windows\System32\PerfStringBackup.INI
2012-12-18 20:25 - 2012-02-14 19:06 - 00022368 ____A (AVG Technologies CZ, s.r.o. ) C:\Windows\System32\Drivers\AFD.SYS
2012-12-18 20:25 - 2009-07-13 18:10 - 00022368 ____A (AVG Technologies CZ, s.r.o. ) C:\Windows\System32\Drivers\WS2IFSL.SYS
2012-12-18 19:17 - 2012-12-17 11:37 - 00000000 ____D C:\Qoobox
2012-12-18 19:16 - 2009-07-13 23:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2012-12-18 19:14 - 2012-12-18 19:14 - 00075713 ____A C:\ComboFix.txt
2012-12-18 18:00 - 2009-07-13 20:34 - 00000215 ____A C:\Windows\system.ini
2012-12-18 17:57 - 2011-02-20 20:16 - 00470850 ____A C:\Windows\PFRO.log
2012-12-18 16:36 - 2012-04-29 15:18 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-12-18 12:43 - 2012-12-18 12:43 - 05012571 ____R (Swearware) C:\Users\Kristen\Desktop\ComboFix.exe
2012-12-18 08:45 - 2012-12-18 08:45 - 00000000 ____D C:\Program Files (x86)\ESET
2012-12-18 08:43 - 2012-12-18 08:43 - 02322184 ____A (ESET) C:\Users\Kristen\Desktop\esetsmartinstaller_enu.exe
2012-12-17 13:56 - 2012-05-07 13:58 - 00000000 ____D C:\Users\Guest\Desktop\Taylor's Folder
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\Local Settings\Avg2013
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\Local Settings\Application Data\Avg2013
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\Application Data\AVG2013
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\AppData\Roaming\AVG2013
2012-12-17 13:36 - 2012-12-17 13:36 - 00000000 ____D C:\Users\Guest\AppData\Local\Avg2013
2012-12-17 13:32 - 2011-11-08 15:05 - 00000000 ____D C:\Users\Kristen\Desktop\greg
2012-12-17 12:41 - 2012-12-17 12:41 - 00081432 ____A C:\Users\Kristen\My Documents\combofix2.txt
2012-12-17 12:41 - 2012-12-17 12:41 - 00081432 ____A C:\Users\Kristen\Documents\combofix2.txt
2012-12-17 11:57 - 2009-07-13 21:20 - 00000000 __RHD C:\users\Default
2012-12-17 11:56 - 2012-12-17 11:36 - 00000000 ____D C:\Windows\erdnt
2012-12-17 11:00 - 2012-12-17 11:00 - 00002052 ____A C:\Users\Kristen\Desktop\aswMBR.txt
2012-12-17 11:00 - 2012-12-17 11:00 - 00000512 ____A C:\Users\Kristen\Desktop\MBR.dat
2012-12-17 10:21 - 2012-12-17 10:21 - 00032469 ____A C:\Users\Kristen\Desktop\dds.txt
2012-12-17 10:21 - 2012-12-17 10:21 - 00012656 ____A C:\Users\Kristen\Desktop\attach.txt
2012-12-17 10:16 - 2012-12-17 10:16 - 04732416 ____A (AVAST Software) C:\Users\Kristen\Desktop\aswMBR.exe
2012-12-17 10:09 - 2012-12-17 10:09 - 00688992 ____R (Swearware) C:\Users\Kristen\Desktop\dds.com
2012-12-17 09:26 - 2012-12-17 09:26 - 00017727 ____A C:\Users\Kristen\Desktop\hijackthis.log
2012-12-17 09:25 - 2011-03-15 20:40 - 00000000 ____D C:\Users\Kristen\Tracing
2012-12-17 09:21 - 2012-12-17 09:15 - 00000000 ____D C:\Windows\pss
2012-12-17 09:10 - 2012-12-17 09:10 - 00388608 ____A (Trend Micro Inc.) C:\Users\Kristen\Desktop\HijackThis.exe
2012-12-17 08:19 - 2012-12-17 08:10 - 00000000 ____D C:\Users\All Users\Spybot - Search & Destroy
2012-12-17 08:19 - 2012-12-17 08:10 - 00000000 ____D C:\Users\All Users\Application Data\Spybot - Search & Destroy
2012-12-17 08:10 - 2012-12-17 08:10 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2012-12-17 08:05 - 2012-12-17 08:05 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{1EABE9FC-BE19-40D5-9666-9B8E24535809}
2012-12-17 08:05 - 2012-12-17 08:05 - 00000000 ____D C:\Users\Kristen\Local Settings\{1EABE9FC-BE19-40D5-9666-9B8E24535809}
2012-12-17 08:05 - 2012-12-17 08:05 - 00000000 ____D C:\Users\Kristen\AppData\Local\{1EABE9FC-BE19-40D5-9666-9B8E24535809}
2012-12-16 21:29 - 2011-05-08 07:37 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\Adobe
2012-12-16 21:29 - 2011-05-08 07:37 - 00000000 ____D C:\Users\Kristen\Local Settings\Adobe
2012-12-16 21:29 - 2011-05-08 07:37 - 00000000 ____D C:\Users\Kristen\AppData\Local\Adobe
2012-12-16 21:29 - 2011-02-20 18:44 - 00000000 ____D C:\Users\All Users\Application Data\Adobe
2012-12-16 21:29 - 2011-02-20 18:44 - 00000000 ____D C:\Users\All Users\Adobe
2012-12-16 21:29 - 2011-02-20 18:44 - 00000000 ____D C:\Program Files (x86)\Adobe
2012-12-16 21:23 - 2011-03-02 16:51 - 00000000 ____D C:\Users\Kristen\Application Data\Adobe
2012-12-16 21:23 - 2011-03-02 16:51 - 00000000 ____D C:\Users\Kristen\AppData\Roaming\Adobe
2012-12-16 21:21 - 2012-12-16 21:22 - 00246760 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2012-12-16 21:21 - 2012-12-16 21:21 - 00095208 ____A (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2012-12-16 21:21 - 2012-08-06 13:56 - 00821736 ____A (Oracle Corporation) C:\Windows\SysWOW64\npdeployJava1.dll
2012-12-16 21:21 - 2012-08-06 13:56 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2012-12-16 21:21 - 2012-08-06 13:56 - 00174056 ____A (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2012-12-16 21:21 - 2011-02-20 18:24 - 00746984 ____A (Oracle Corporation) C:\Windows\SysWOW64\deployJava1.dll
2012-12-16 21:21 - 2011-02-20 18:24 - 00000000 ____D C:\Program Files (x86)\Java
2012-12-16 20:39 - 2012-12-16 20:39 - 00000000 ____D C:\Program Files\WOT
2012-12-16 20:39 - 2012-12-16 20:39 - 00000000 ____D C:\Program Files (x86)\WOT
2012-12-16 20:19 - 2011-09-24 06:50 - 00000000 ____D C:\Users\All Users\AVG2012
2012-12-16 20:19 - 2011-09-24 06:50 - 00000000 ____D C:\Users\All Users\Application Data\AVG2012
2012-12-16 20:09 - 2012-05-14 19:27 - 00000000 ____D C:\$AVG
2012-12-16 20:07 - 2012-12-16 20:07 - 00000000 ____D C:\Users\Kristen\Application Data\TuneUp Software
2012-12-16 20:07 - 2012-12-16 20:07 - 00000000 ____D C:\Users\Kristen\Application Data\AVG2013
2012-12-16 20:07 - 2012-12-16 20:07 - 00000000 ____D C:\Users\Kristen\AppData\Roaming\TuneUp Software
2012-12-16 20:07 - 2012-12-16 20:07 - 00000000 ____D C:\Users\Kristen\AppData\Roaming\AVG2013
2012-12-16 20:07 - 2012-12-16 20:04 - 00000000 ____D C:\Users\All Users\AVG2013
2012-12-16 20:07 - 2012-12-16 20:04 - 00000000 ____D C:\Users\All Users\Application Data\AVG2013
2012-12-16 20:04 - 2011-03-02 12:47 - 00000000 ____D C:\Program Files (x86)\AVG
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\Local Settings\MFAData
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\Local Settings\Avg2013
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\MFAData
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\Avg2013
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\AppData\Local\MFAData
2012-12-16 20:01 - 2012-12-16 20:01 - 00000000 ____D C:\Users\Kristen\AppData\Local\Avg2013
2012-12-16 18:08 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\rescache
2012-12-16 12:49 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2012-12-16 12:24 - 2012-12-16 12:24 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{62AA4ABD-531D-4D67-B294-ED640BC0334E}
2012-12-16 12:24 - 2012-12-16 12:24 - 00000000 ____D C:\Users\Kristen\Local Settings\{62AA4ABD-531D-4D67-B294-ED640BC0334E}
2012-12-16 12:24 - 2012-12-16 12:24 - 00000000 ____D C:\Users\Kristen\AppData\Local\{62AA4ABD-531D-4D67-B294-ED640BC0334E}
2012-12-15 14:29 - 2009-07-13 22:45 - 00288760 ____A C:\Windows\System32\FNTCACHE.DAT
2012-12-15 14:13 - 2011-03-02 21:09 - 67413224 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-12-15 13:31 - 2009-07-13 20:34 - 00000499 ____A C:\Windows\win.ini
2012-12-15 12:44 - 2012-07-01 17:30 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2012-12-15 12:44 - 2011-09-13 16:29 - 00000000 ____D C:\Users\All Users\Norton
2012-12-15 12:44 - 2011-09-13 16:29 - 00000000 ____D C:\Users\All Users\Application Data\Norton
2012-12-15 12:39 - 2011-09-13 16:29 - 00000000 ____D C:\Program Files (x86)\Norton PC Checkup
2012-12-15 12:38 - 2011-04-30 11:16 - 00000000 ____D C:\Users\All Users\Yahoo!
2012-12-15 12:38 - 2011-04-30 11:16 - 00000000 ____D C:\Users\All Users\Application Data\Yahoo!
2012-12-15 12:38 - 2011-04-30 11:03 - 00000000 ____D C:\Program Files (x86)\Yahoo!
2012-12-15 12:34 - 2012-06-04 17:13 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2012-12-15 12:27 - 2011-04-30 11:17 - 00000000 ____D C:\Users\Kristen\Local Settings\Yahoo
2012-12-15 12:27 - 2011-04-30 11:17 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\Yahoo
2012-12-15 12:27 - 2011-04-30 11:17 - 00000000 ____D C:\Users\Kristen\AppData\Local\Yahoo
2012-12-15 11:44 - 2012-12-15 11:44 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{6A3617E7-EA83-460A-AA8A-49CAB68E30AB}
2012-12-15 11:44 - 2012-12-15 11:44 - 00000000 ____D C:\Users\Kristen\Local Settings\{6A3617E7-EA83-460A-AA8A-49CAB68E30AB}
2012-12-15 11:44 - 2012-12-15 11:44 - 00000000 ____D C:\Users\Kristen\AppData\Local\{6A3617E7-EA83-460A-AA8A-49CAB68E30AB}
2012-12-15 10:40 - 2012-04-29 15:18 - 00697272 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2012-12-15 10:40 - 2011-05-16 04:27 - 00073656 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2012-12-14 17:20 - 2012-12-14 17:20 - 00011962 ____A C:\Users\Kristen\My Documents\Norton Scan.txt
2012-12-14 17:20 - 2012-12-14 17:20 - 00011962 ____A C:\Users\Kristen\Documents\Norton Scan.txt
2012-12-14 17:14 - 2012-12-14 17:14 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{791A6351-6163-4B72-BD30-384D8ADE834E}
2012-12-14 17:14 - 2012-12-14 17:14 - 00000000 ____D C:\Users\Kristen\Local Settings\{791A6351-6163-4B72-BD30-384D8ADE834E}
2012-12-14 17:14 - 2012-12-14 17:14 - 00000000 ____D C:\Users\Kristen\AppData\Local\{791A6351-6163-4B72-BD30-384D8ADE834E}
2012-12-07 13:28 - 2012-12-07 13:28 - 00000000 ____D C:\Users\Kristen\Local Settings\Symantec
2012-12-07 13:28 - 2012-12-07 13:28 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\Symantec
2012-12-07 13:28 - 2012-12-07 13:28 - 00000000 ____D C:\Users\Kristen\AppData\Local\Symantec
2012-12-07 13:28 - 2011-09-13 16:29 - 00000000 ____D C:\Users\Kristen\Application Data\Tific
2012-12-07 13:28 - 2011-09-13 16:29 - 00000000 ____D C:\Users\Kristen\AppData\Roaming\Tific
2012-12-07 13:06 - 2012-12-07 13:05 - 00272216 ____A C:\Windows\Minidump\120712-54381-01.dmp
2012-12-07 13:05 - 2011-04-18 15:50 - 00000000 ____D C:\Windows\Minidump
2012-12-07 13:05 - 2011-04-18 15:49 - 243042138 ____A C:\Windows\MEMORY.DMP
2012-12-07 12:58 - 2011-03-19 18:51 - 00000000 ____D C:\Users\Kristen\Application Data\Skype
2012-12-07 12:58 - 2011-03-19 18:51 - 00000000 ____D C:\Users\Kristen\AppData\Roaming\Skype
2012-12-07 12:57 - 2012-12-07 12:57 - 00002515 ____A C:\Users\Public\Desktop\Skype.lnk
2012-12-07 12:57 - 2012-12-07 12:57 - 00002515 ____A C:\Users\All Users\Desktop\Skype.lnk
2012-12-07 12:57 - 2011-12-18 20:50 - 00000000 ___RD C:\Program Files (x86)\Skype
2012-12-07 12:57 - 2011-02-20 19:04 - 00000000 ____D C:\Users\All Users\Skype
2012-12-07 12:57 - 2011-02-20 19:04 - 00000000 ____D C:\Users\All Users\Application Data\Skype
2012-12-07 12:52 - 2012-12-07 12:52 - 00279032 ____A C:\Windows\Minidump\120712-41933-01.dmp
2012-12-07 12:34 - 2012-12-07 12:34 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{2AF9E10C-BC0F-4042-B3A8-84FC9B4F8714}
2012-12-07 12:34 - 2012-12-07 12:34 - 00000000 ____D C:\Users\Kristen\Local Settings\{2AF9E10C-BC0F-4042-B3A8-84FC9B4F8714}
2012-12-07 12:34 - 2012-12-07 12:34 - 00000000 ____D C:\Users\Kristen\AppData\Local\{2AF9E10C-BC0F-4042-B3A8-84FC9B4F8714}
2012-12-05 15:19 - 2012-06-22 22:49 - 00000022 ____A C:\Users\Guest\Downloads\setup.zip
2012-12-05 12:58 - 2011-11-30 16:57 - 00000000 ____D C:\users\Guest
2012-12-05 12:46 - 2012-12-03 18:56 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{6E7A6280-6A47-4F92-A9FA-BE43FE92BD5B}
2012-12-05 12:46 - 2012-12-03 18:56 - 00000000 ____D C:\Users\Kristen\Local Settings\{6E7A6280-6A47-4F92-A9FA-BE43FE92BD5B}
2012-12-05 12:46 - 2012-12-03 18:56 - 00000000 ____D C:\Users\Kristen\AppData\Local\{6E7A6280-6A47-4F92-A9FA-BE43FE92BD5B}
2012-12-03 18:53 - 2011-03-02 11:57 - 00000000 ____D C:\users\Kristen
2012-12-03 18:51 - 2012-07-01 20:21 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2012-12-03 18:51 - 2011-08-13 18:46 - 00000000 ____D C:\Users\Kristen\Application Data\Arcsoft
2012-12-03 18:51 - 2011-08-13 18:46 - 00000000 ____D C:\Users\Kristen\AppData\Roaming\Arcsoft
2012-12-03 18:51 - 2011-08-13 18:46 - 00000000 ____D C:\Users\All Users\ArcSoft
2012-12-03 18:51 - 2011-08-13 18:46 - 00000000 ____D C:\Users\All Users\Application Data\ArcSoft
2012-12-03 18:51 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\registration
2012-12-03 18:51 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\AppCompat
2012-12-03 18:43 - 2012-12-03 18:43 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{283E5275-F16B-4DF3-BCB4-E78C1F3C04AC}
2012-12-03 18:43 - 2012-12-03 18:43 - 00000000 ____D C:\Users\Kristen\Local Settings\{283E5275-F16B-4DF3-BCB4-E78C1F3C04AC}
2012-12-03 18:43 - 2012-12-03 18:43 - 00000000 ____D C:\Users\Kristen\AppData\Local\{283E5275-F16B-4DF3-BCB4-E78C1F3C04AC}
2012-12-03 18:29 - 2012-12-03 18:29 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{1BC3E69D-76EE-4A58-9F0D-68A5F0B8075C}
2012-12-03 18:29 - 2012-12-03 18:29 - 00000000 ____D C:\Users\Kristen\Local Settings\{1BC3E69D-76EE-4A58-9F0D-68A5F0B8075C}
2012-12-03 18:29 - 2012-12-03 18:29 - 00000000 ____D C:\Users\Kristen\AppData\Local\{1BC3E69D-76EE-4A58-9F0D-68A5F0B8075C}
2012-12-03 08:17 - 2012-12-03 08:17 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{C2EAB0B9-282B-4D08-AD5D-1D92607F624B}
2012-12-03 08:17 - 2012-12-03 08:17 - 00000000 ____D C:\Users\Kristen\Local Settings\{C2EAB0B9-282B-4D08-AD5D-1D92607F624B}
2012-12-03 08:17 - 2012-12-03 08:17 - 00000000 ____D C:\Users\Kristen\AppData\Local\{C2EAB0B9-282B-4D08-AD5D-1D92607F624B}
2012-12-02 20:16 - 2012-12-02 20:16 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{8F918CA7-4DCA-488F-9445-4870369F867A}
2012-12-02 20:16 - 2012-12-02 20:16 - 00000000 ____D C:\Users\Kristen\Local Settings\{8F918CA7-4DCA-488F-9445-4870369F867A}
2012-12-02 20:16 - 2012-12-02 20:16 - 00000000 ____D C:\Users\Kristen\AppData\Local\{8F918CA7-4DCA-488F-9445-4870369F867A}
2012-12-02 18:25 - 2012-12-02 18:25 - 00000000 ___SD C:\Users\Guest\My Documents\My Data Sources
2012-12-02 18:25 - 2012-12-02 18:25 - 00000000 ___SD C:\Users\Guest\Documents\My Data Sources
2012-12-02 17:52 - 2012-09-16 18:57 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\AOL
2012-12-02 17:52 - 2012-09-16 18:57 - 00000000 ____D C:\Users\Kristen\Local Settings\AOL
2012-12-02 17:52 - 2012-09-16 18:57 - 00000000 ____D C:\Users\Kristen\AppData\Local\AOL
2012-12-02 17:20 - 2012-03-17 21:50 - 00000000 ____D C:\Users\Guest\Local Settings\Microsoft Games
2012-12-02 17:20 - 2012-03-17 21:50 - 00000000 ____D C:\Users\Guest\Local Settings\Application Data\Microsoft Games
2012-12-02 17:20 - 2012-03-17 21:50 - 00000000 ____D C:\Users\Guest\AppData\Local\Microsoft Games
2012-12-02 14:56 - 2012-07-04 08:52 - 00000000 ____D C:\Users\Guest\My Documents\Social Studies
2012-12-02 14:56 - 2012-07-04 08:52 - 00000000 ____D C:\Users\Guest\Documents\Social Studies
2012-12-02 07:28 - 2012-11-27 20:13 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{101F40DF-D307-415E-B954-A949726898AF}
2012-12-02 07:28 - 2012-11-27 20:13 - 00000000 ____D C:\Users\Kristen\Local Settings\{101F40DF-D307-415E-B954-A949726898AF}
2012-12-02 07:28 - 2012-11-27 20:13 - 00000000 ____D C:\Users\Kristen\AppData\Local\{101F40DF-D307-415E-B954-A949726898AF}
2012-11-27 08:12 - 2012-11-25 17:25 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{DDE5EE2C-945B-4A96-81D0-1D9B978F1AF2}
2012-11-27 08:12 - 2012-11-25 17:25 - 00000000 ____D C:\Users\Kristen\Local Settings\{DDE5EE2C-945B-4A96-81D0-1D9B978F1AF2}
2012-11-27 08:12 - 2012-11-25 17:25 - 00000000 ____D C:\Users\Kristen\AppData\Local\{DDE5EE2C-945B-4A96-81D0-1D9B978F1AF2}
2012-11-25 10:08 - 2011-03-15 19:39 - 00000000 ____D C:\Users\Kristen\Local Settings\Microsoft Games
2012-11-25 10:08 - 2011-03-15 19:39 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\Microsoft Games
2012-11-25 10:08 - 2011-03-15 19:39 - 00000000 ____D C:\Users\Kristen\AppData\Local\Microsoft Games
2012-11-25 09:51 - 2011-02-20 18:55 - 00000000 ____D C:\Users\All Users\WildTangent
2012-11-25 09:51 - 2011-02-20 18:55 - 00000000 ____D C:\Users\All Users\Application Data\WildTangent
2012-11-24 09:22 - 2012-11-24 09:22 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{57A78C2F-23DE-4851-8237-52750E59FCBC}
2012-11-24 09:22 - 2012-11-24 09:22 - 00000000 ____D C:\Users\Kristen\Local Settings\{57A78C2F-23DE-4851-8237-52750E59FCBC}
2012-11-24 09:22 - 2012-11-24 09:22 - 00000000 ____D C:\Users\Kristen\AppData\Local\{57A78C2F-23DE-4851-8237-52750E59FCBC}
2012-11-23 20:59 - 2012-11-22 07:10 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{018F460A-C51D-4083-983F-4D5165886BA5}
2012-11-23 20:59 - 2012-11-22 07:10 - 00000000 ____D C:\Users\Kristen\Local Settings\{018F460A-C51D-4083-983F-4D5165886BA5}
2012-11-23 20:59 - 2012-11-22 07:10 - 00000000 ____D C:\Users\Kristen\AppData\Local\{018F460A-C51D-4083-983F-4D5165886BA5}
2012-11-22 18:40 - 2011-11-30 16:58 - 00063544 ____A C:\Users\Guest\Local Settings\GDIPFONTCACHEV1.DAT
2012-11-22 18:40 - 2011-11-30 16:58 - 00063544 ____A C:\Users\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2012-11-22 18:40 - 2011-11-30 16:58 - 00063544 ____A C:\Users\Guest\AppData\Local\GDIPFONTCACHEV1.DAT
2012-11-21 21:26 - 2012-12-15 13:21 - 03149824 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-11-21 19:04 - 2011-03-02 11:57 - 00063544 ____A C:\Users\Kristen\Local Settings\GDIPFONTCACHEV1.DAT
2012-11-21 19:04 - 2011-03-02 11:57 - 00063544 ____A C:\Users\Kristen\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2012-11-21 19:04 - 2011-03-02 11:57 - 00063544 ____A C:\Users\Kristen\AppData\Local\GDIPFONTCACHEV1.DAT
2012-11-21 18:29 - 2012-11-18 07:23 - 00000000 ____D C:\Users\Kristen\Local Settings\Application Data\{3F96EAC3-81BA-4678-8E59-3DDDF29CA38F}
2012-11-21 18:29 - 2012-11-18 07:23 - 00000000 ____D C:\Users\Kristen\Local Settings\{3F96EAC3-81BA-4678-8E59-3DDDF29CA38F}
2012-11-21 18:29 - 2012-11-18 07:23 - 00000000 ____D C:\Users\Kristen\AppData\Local\{3F96EAC3-81BA-4678-8E59-3DDDF29CA38F}
ZeroAccess:
C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}
C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\@
C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\L
C:\Windows\Installer\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U
ZeroAccess:
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\@
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\L
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U
C:\Users\Kristen\AppData\Local\{c614d3bf-243a-3fd7-a4fd-36cd3756874b}\U\00000001.@
==================== Known DLLs (Whitelisted) =================
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
==================== EXE ASSOCIATION =====================
HKLM\…\.exe: exefile => OK
HKLM\…\exefile\DefaultIcon: %1 => OK
HKLM\…\exefile\open\command: "%1" %* => OK
==================== Restore Points =========================
Restore point made on: 2012-12-03 18:14:46
Restore point made on: 2012-12-15 11:15:39
Restore point made on: 2012-12-15 11:50:22
Restore point made on: 2012-12-15 12:41:48
Restore point made on: 2012-12-15 13:25:36
Restore point made on: 2012-12-15 13:27:17
Restore point made on: 2012-12-15 13:29:30
Restore point made on: 2012-12-15 13:30:41
Restore point made on: 2012-12-15 13:31:56
Restore point made on: 2012-12-15 13:40:49
Restore point made on: 2012-12-15 13:50:34
Restore point made on: 2012-12-15 13:52:53
Restore point made on: 2012-12-15 14:01:51
Restore point made on: 2012-12-15 14:10:47
Restore point made on: 2012-12-15 14:13:19
Restore point made on: 2012-12-15 14:25:47
Restore point made on: 2012-12-16 12:31:19
Restore point made on: 2012-12-16 12:44:00
Restore point made on: 2012-12-16 13:07:11
Restore point made on: 2012-12-16 20:04:15
Restore point made on: 2012-12-16 20:05:17
Restore point made on: 2012-12-16 20:39:16
Restore point made on: 2012-12-16 21:21:23
Restore point made on: 2012-12-16 21:32:06
Restore point made on: 2012-12-17 09:02:05
==================== Memory info ===========================
Percentage of memory in use: 15%
Total physical RAM: 3892.52 MB
Available physical RAM: 3291.16 MB
Total Pagefile: 3890.67 MB
Available Pagefile: 3277.21 MB
Total Virtual: 8192 MB
Available Virtual: 8191.9 MB
==================== Partitions =============================
1 Drive c: (OS) (Fixed) (Total:451.01 GB) (Free:398.67 GB) NTFS
2 Drive d: () (Removable) (Total:7.45 GB) (Free:4.86 GB) FAT32
3 Drive e: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:6.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Disk ### Status Size Free Dyn Gpt
——– ————- ——- ——- — —
Disk 0 Online 465 GB 0 B
Disk 1 Online 7633 MB 0 B
Partitions of Disk 0:
===============
Partition ### Type Size Offset
————- —————- ——- ——-
Partition 1 OEM 101 MB 31 KB
Partition 2 Primary 14 GB 101 MB
Partition 3 Primary 451 GB 14 GB
================================================================================
==
Disk: 0
Partition 1
Type : DE
Hidden: Yes
Active: No
Volume ### Ltr Label Fs Type Size Status Info
———- — ———– —– ———- ——- ——— ——–
* Volume 4 FAT Partition 101 MB Healthy Hidden
=========================================================
Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes
Volume ### Ltr Label Fs Type Size Status Info
———- — ———– —– ———- ——- ——— ——–
* Volume 1 E RECOVERY NTFS Partition 14 GB Healthy
=========================================================
Disk: 0
Partition 3
Type : 07
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
———- — ———– —– ———- ——- ——— ——–
* Volume 2 C OS NTFS Partition 451 GB Healthy
=========================================================
Partitions of Disk 1:
===============
Partition ### Type Size Offset
————- —————- ——- ——-
Partition 1 Primary 7633 MB 16 KB
================================================================================
==
Disk: 1
Partition 1
Type : 0B
Hidden: No
Active: No
Volume ### Ltr Label Fs Type Size Status Info
———- — ———– —– ———- ——- ——— ——–
* Volume 3 D FAT32 Removable 7633 MB Healthy
=========================================================
Last Boot: 2012-12-16 18:00
==================== End Of Log =============================
