still possibly infected [Closed]

Yesturday or so I went to enter my password into Windows 7, to only find out that the screen went black after I had successfully entered a correct password. I rebooted the computer and tried doing a Windows Repair, but it reported no errors. I then tried going back to a previous system restore point which, the first said it was not successfull in fully restoring the previous point. Down below the error, my options were I could retry chosing another restore point, or, actually I forget the second choice was, but that is not important since I chosed to retry another restore point. When clicking on this, it rebooted the computer and went to Windows configuartion setup, which I had to tell Windows the time zone, I speek english etc… Once that was completed, I was able to pick my screenname, but to choose my screen name, it was in a drop down list as oppose to the original style icons. The third odd thing was, I could not access Google Chrome. I kept receiving… "Unable to find the locale data files", After that, Norton started barking at me with a bunch of errors, stating everything from live updates to live monitoring was disabled. Once this happened, I decided to see if MBAM could catch anything, which it did but kept on only finding 1 object per scan out of 2 scans. The first scan found trojan.bho which it said it was successfull in cleaning. I then restarted the computer, did the second scan, and that reported trojan.attack.ck. So after MBAM, I had uninstalled Google Chrome, which that was not so simple either due to some sort of problem causing file association with Chrome stopping me from uninstalling it the simple way. So pretty much this is where I lye. My operating system is Windows 7 64bit Home Premium, and my computer is stilll somewhat unstable DDS rerport: . DDS (Ver_11-03-05.01) - NTFS_AMD64 Run by [removed] at 14:41:30.35 on Sat 02/02/2013 Internet Explorer: 9.0.8112.16421 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4009.1582 [GMT -5:00] . AV: Norton 360 *Enabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} FW: Norton 360 *Enabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} . ============== Running Processes =============== . C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k RPCSS C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe C:\Program Files (x86)\Connectify\ConnectifyService.exe C:\Program Files (x86)\Connectify\ConnectifyD.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe C:\Windows\system32\conhost.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe C:\Windows\system32\taskhost.exe C:\Windows\System32\alg.exe C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\System32\WUDFHost.exe C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\STService.exe C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\igfxpers.exe C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe C:\Program Files (x86)\Connectify\Connectify.exe C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe C:\Program Files (x86)\Roxio\OEM\Roxio Burn\Roxio Burn.exe C:\Program Files (x86)\Dell Stage\Dell Stage\stage_secondary.exe C:\Program Files\Windows Media Player\wmpnetwk.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\svchost.exe -k SDRSVC C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\System32\svchost.exe -k LocalServicePeerNet C:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_2_202_228_ActiveX.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\DllHost.exe C:\Program Files\Autodesk\Maya2012\bin\maya.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Windows\system32\igfxsrvc.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\BigPapa\Desktop\dds.scr C:\Windows\system32\conhost.exe C:\Windows\system32\wbem\wmiprvse.exe . ============== Pseudo HJT Report =============== . uStart Page = hxxp://www.google.com/ mWinlogon: Userinit=userinit.exe, BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll BHO: Babylon toolbar helper: {2eecd738-5844-4a99-b4b6-146bf802613b} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\coIEPlg.dll BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\IPS\IPSBHO.DLL BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\coIEPlg.dll TB: Babylon Toolbar: {98889811-442d-49dd-99d7-dc866be87dbc} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll EB: Developer Tools: {1a6fe369-f28c-4ad9-a3e6-2bcb50807cf1} - C:\Program Files (x86)\Internet Explorer\iedvtool.dll uRun: [Connectify] C:\Program Files (x86)\Connectify\Connectify.exe uRun: [AdobeBridge] mRun: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot mRun: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" mRun: [] mRun: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" mRun: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" mRun: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" –startup mRun: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe mRun: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" mRun: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime mRunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe StartupFolder: C:\Users\BigPapa\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\PDANET~1.LNK - C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe mPolicies-explorer: NoActiveDesktop = 1 (0x1) mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1) mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5) mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Trusted Zone: dell.com DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {C1F8FC10-E5DB-4112-9DBF-6C3FF728D4E3} - hxxp://support.dell.com/systemprofiler/DellSystemLite.CAB DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll BHO-X64: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll BHO-X64: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll EB-X64: {1A6FE369-F28C-4AD9-A3E6-2BCB50807CF1} - No File mRun-x64: [IgfxTray] C:\Windows\system32\igfxtray.exe mRun-x64: [HotKeysCmds] C:\Windows\system32\hkcmd.exe mRun-x64: [Persistence] C:\Windows\system32\igfxpers.exe mRun-x64: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" –startup mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" . ============= SERVICES / DRIVERS =============== . R0 PxHlpa64;PxHlpa64;C:\WINDOWS\System32\drivers\PxHlpa64.sys [2011-6-21 55856] R0 SymDS;Symantec Data Store;C:\WINDOWS\System32\drivers\N360x64\0502020.003\symds64.sys [2012-6-11 450680] R0 SymEFA;Symantec Extended File Attributes;C:\WINDOWS\System32\drivers\N360x64\0502020.003\symefa64.sys [2012-6-11 912504] R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20130116.013\BHDrvx64.sys [2013-1-15 1388120] R1 cnnctfy2;Connectify LightWeight Filter;C:\WINDOWS\System32\drivers\cnnctfy2.sys [2012-3-11 31344] R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20130201.001\IDSviA64.sys [2013-2-1 513184] R1 SymIRON;Symantec Iron Driver;C:\WINDOWS\System32\drivers\N360x64\0502020.003\ironx64.sys [2012-6-11 171128] R1 SymNetS;Symantec Network Security WFP Driver;C:\WINDOWS\System32\drivers\N360x64\0502020.003\symnets.sys [2012-6-11 386168] R1 vwififlt;Virtual WiFi Filter Driver;C:\WINDOWS\System32\drivers\vwififlt.sys [2009-7-13 59904] R2 AdobeARMservice;Adobe Acrobat Update Service;C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-12-18 65192] R2 Connectify;Connectify;C:\Program Files (x86)\Connectify\ConnectifyService.exe [2011-9-29 69632] R2 MBAMScheduler;MBAMScheduler;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-10-7 398184] R2 MBAMService;MBAMService;C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-10-7 682344] R2 N360;Norton 360;C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccsvchst.exe [2012-6-11 130008] R2 SftService;SoftThinks Agent Service;C:\Program Files (x86)\Dell DataSafe Local Backup\SftService.exe [2011-6-21 1692480] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-8-15 138912] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-3-2 1431888] R3 IntcDAud;Intel® Display Audio;C:\WINDOWS\System32\drivers\IntcDAud.sys [2011-6-21 317440] R3 MBAMProtector;MBAMProtector;C:\WINDOWS\System32\drivers\mbam.sys [2012-10-7 24176] R3 MEIx64;Intel® Management Engine Interface;C:\WINDOWS\System32\drivers\HECIx64.sys [2011-6-21 56344] R3 RTL8167;Realtek 8167 NT Driver;C:\WINDOWS\System32\drivers\Rt64win7.sys [2011-6-21 413800] S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384] S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576] S2 gupdate;Google Update Service (gupdate);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-9-5 116648] S2 RoxWatch12;Roxio Hard Drive Watcher 12;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2012-7-13 160944] S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;C:\WINDOWS\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-4-12 253600] S3 androidusb;SAMSUNG Android Composite ADB Interface Driver;C:\WINDOWS\System32\drivers\ssadadb.sys [2012-3-3 36256] S3 cphs;Intel® Content Protection HECI Service;C:\WINDOWS\SysWOW64\IntelCpHeciSvc.exe [2012-2-14 276248] S3 gupdatem;Google Update Service (gupdatem);C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-9-5 116648] S3 RoxMediaDB12OEM;RoxMediaDB12OEM;C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] S3 SwitchBoard;Adobe SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096] S3 TsUsbFlt;TsUsbFlt;C:\WINDOWS\System32\drivers\TsUsbFlt.sys [2010-11-20 59392] S3 TsUsbGD;Remote Desktop Generic USB Device;C:\WINDOWS\System32\drivers\TsUsbGD.sys [2010-11-20 31232] S3 vwifimp;Microsoft Virtual WiFi Miniport Service;C:\WINDOWS\System32\drivers\vwifimp.sys [2009-7-13 17920] S3 WatAdminSvc;Windows Activation Technologies Service;C:\WINDOWS\System32\Wat\WatAdminSvc.exe [2012-5-28 1255736] S4 wlcrasvc;Windows Live Mesh remote connections service;C:\Program Files\Windows Live\Mesh\wlcrasvc.exe [2010-9-22 57184] . =============== Created Last 30 ================ . 2013-02-02 07:05:51 ——– d—–w- C:\Users\BigPapa\AppData\Local\Programs 2013-02-02 01:03:38 ——– d—–w- C:\Users\BigPapa\AppData\Local\Symantec 2013-01-31 21:13:14 ——– d—–w- C:\OSM2WORLD 2013-01-26 11:55:18 ——– d—–w- C:\UDK 2013-01-09 20:56:27 424448 —-a-w- C:\Windows\System32\KernelBase.dll 2013-01-09 20:55:58 750592 —-a-w- C:\Windows\System32\win32spl.dll 2013-01-09 20:55:58 492032 —-a-w- C:\Windows\SysWow64\win32spl.dll 2013-01-09 20:43:56 2002432 —-a-w- C:\Windows\System32\msxml6.dll 2013-01-09 20:43:56 1882624 —-a-w- C:\Windows\System32\msxml3.dll 2013-01-09 20:43:56 1389568 —-a-w- C:\Windows\SysWow64\msxml6.dll 2013-01-09 20:43:56 1236992 —-a-w- C:\Windows\SysWow64\msxml3.dll 2013-01-09 20:43:39 307200 —-a-w- C:\Windows\System32\ncrypt.dll 2013-01-09 20:43:39 220160 —-a-w- C:\Windows\SysWow64\ncrypt.dll 2013-01-09 20:43:38 800768 —-a-w- C:\Windows\System32\usp10.dll 2013-01-09 20:43:38 626688 —-a-w- C:\Windows\SysWow64\usp10.dll 2013-01-09 20:39:44 68608 —-a-w- C:\Windows\System32\taskhost.exe 2013-01-09 20:39:43 3149824 —-a-w- C:\Windows\System32\win32k.sys . ==================== Find3M ==================== . 2012-12-16 17:11:22 46080 —-a-w- C:\Windows\System32\atmlib.dll 2012-12-16 14:45:03 367616 —-a-w- C:\Windows\System32\atmfd.dll 2012-12-16 14:13:28 295424 —-a-w- C:\Windows\SysWow64\atmfd.dll 2012-12-16 14:13:20 34304 —-a-w- C:\Windows\SysWow64\atmlib.dll 2012-12-14 21:49:28 24176 —-a-w- C:\Windows\System32\drivers\mbam.sys 2012-12-07 13:20:16 441856 —-a-w- C:\Windows\System32\Wpc.dll 2012-12-07 13:15:31 2746368 —-a-w- C:\Windows\System32\gameux.dll 2012-12-07 12:26:17 308736 —-a-w- C:\Windows\SysWow64\Wpc.dll 2012-12-07 12:20:43 2576384 —-a-w- C:\Windows\SysWow64\gameux.dll 2012-12-07 11:20:04 30720 —-a-w- C:\Windows\System32\usk.rs 2012-12-07 11:20:03 43520 —-a-w- C:\Windows\System32\csrr.rs 2012-12-07 11:20:03 23552 —-a-w- C:\Windows\System32\oflc.rs 2012-12-07 11:20:01 45568 —-a-w- C:\Windows\System32\oflc-nz.rs 2012-12-07 11:20:01 44544 —-a-w- C:\Windows\System32\pegibbfc.rs 2012-12-07 11:20:01 20480 —-a-w- C:\Windows\System32\pegi-fi.rs 2012-12-07 11:20:00 20480 —-a-w- C:\Windows\System32\pegi-pt.rs 2012-12-07 11:19:59 20480 —-a-w- C:\Windows\System32\pegi.rs 2012-12-07 11:19:58 46592 —-a-w- C:\Windows\System32\fpb.rs 2012-12-07 11:19:57 40960 —-a-w- C:\Windows\System32\cob-au.rs 2012-12-07 11:19:57 21504 —-a-w- C:\Windows\System32\grb.rs 2012-12-07 11:19:57 15360 —-a-w- C:\Windows\System32\djctq.rs 2012-12-07 11:19:56 55296 —-a-w- C:\Windows\System32\cero.rs 2012-12-07 11:19:55 51712 —-a-w- C:\Windows\System32\esrb.rs 2012-11-30 05:45:35 362496 —-a-w- C:\Windows\System32\wow64win.dll 2012-11-30 05:45:35 243200 —-a-w- C:\Windows\System32\wow64.dll 2012-11-30 05:45:35 13312 —-a-w- C:\Windows\System32\wow64cpu.dll 2012-11-30 05:45:14 215040 —-a-w- C:\Windows\System32\winsrv.dll 2012-11-30 05:43:12 16384 —-a-w- C:\Windows\System32\ntvdm64.dll 2012-11-30 04:54:00 5120 —-a-w- C:\Windows\SysWow64\wow32.dll 2012-11-30 04:53:59 274944 —-a-w- C:\Windows\SysWow64\KernelBase.dll 2012-11-30 03:23:48 338432 —-a-w- C:\Windows\System32\conhost.exe 2012-11-30 02:44:06 25600 —-a-w- C:\Windows\SysWow64\setup16.exe 2012-11-30 02:44:04 7680 —-a-w- C:\Windows\SysWow64\instnm.exe 2012-11-30 02:44:04 14336 —-a-w- C:\Windows\SysWow64\ntvdm64.dll 2012-11-30 02:44:03 2048 —-a-w- C:\Windows\SysWow64\user.exe 2012-11-30 02:38:59 6144 —ha-w- C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll 2012-11-30 02:38:59 4608 —ha-w- C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll 2012-11-30 02:38:59 3584 —ha-w- C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll 2012-11-30 02:38:59 3072 —ha-w- C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll 2012-11-14 06:11:44 2312704 —-a-w- C:\Windows\System32\jscript9.dll 2012-11-14 06:04:11 1392128 —-a-w- C:\Windows\System32\wininet.dll 2012-11-14 06:02:49 1494528 —-a-w- C:\Windows\System32\inetcpl.cpl 2012-11-14 05:57:46 599040 —-a-w- C:\Windows\System32\vbscript.dll 2012-11-14 05:57:35 173056 —-a-w- C:\Windows\System32\ieUnatt.exe 2012-11-14 05:52:40 2382848 —-a-w- C:\Windows\System32\mshtml.tlb 2012-11-14 02:09:22 1800704 —-a-w- C:\Windows\SysWow64\jscript9.dll 2012-11-14 01:58:15 1427968 —-a-w- C:\Windows\SysWow64\inetcpl.cpl 2012-11-14 01:57:37 1129472 —-a-w- C:\Windows\SysWow64\wininet.dll 2012-11-14 01:49:25 142848 —-a-w- C:\Windows\SysWow64\ieUnatt.exe 2012-11-14 01:48:27 420864 —-a-w- C:\Windows\SysWow64\vbscript.dll 2012-11-14 01:44:42 2382848 —-a-w- C:\Windows\SysWow64\mshtml.tlb 2012-11-09 05:45:09 2048 —-a-w- C:\Windows\System32\tzres.dll 2012-11-09 04:42:49 2048 —-a-w- C:\Windows\SysWow64\tzres.dll . ============= FINISH: 14:42:37.59 ===============

Ok!!! so at least on scan made it through…. Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 06-02-2013 Ran by [removed] at 06-02-2013 19:58:41 Running from F:\ Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\…\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" –startup [483424 2012-02-01] () HKLM\…\Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [499608 2011-03-15] (Adobe Systems Incorporated) HKLM\…\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe /t [309376 2011-03-03] (Conexant Systems, Inc.) HKLM\…\Run: [cAudioFilterAgent] C:\Program Files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe [519296 2011-02-25] (Conexant Systems, Inc.) HKLM-x32\…\Run: [Dell Registration] C:\Program Files (x86)\System Registration\prodreg.exe /boot [4144448 2010-11-10] (Dell, Inc.) HKLM-x32\…\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [38112 2012-12-18] (Adobe Systems Incorporated)HKLM-x32\…\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated) HKLM-x32\…\Run: [] [x] HKLM-x32\…\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-11-25] (Sonic Solutions) HKLM-x32\…\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [514544 2010-11-17] () HKLM-x32\…\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.) HKLM-x32\…\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" –startup [2835443 2012-02-01] () HKLM-x32\…\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated) HKLM-x32\…\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin [1523360 2011-01-12] (Adobe Systems Incorporated) HKLM-x32\…\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59240 2012-02-20] (Apple Inc.) HKLM-x32\…\Run: [QuickTime Task] "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime [421888 2012-10-10] (Apple Inc.) HKU\BigPapa\…\Run: [Connectify] C:\Program Files (x86)\Connectify\Connectify.exe [2967368 2011-09-29] (Connectify) HKU\BigPapa\…\Run: [AdobeBridge] [x] HKU\BigPapa\…\Run: [DriverMax] "C:\Program Files (x86)\Innovative Solutions\DriverMax\drivermax.exe" -agent [11325304 2013-01-16] (Innovative Solutions) HKU\BigPapa\…\Run: [DriverMax_RESTART] [x] HKU\BigPapa\…\Run: [Akamai NetSession Interface] "C:\Users\BigPapa\AppData\Local\Akamai\netsession_win.exe" [4441920 2012-10-09] (Akamai Technologies, Inc.) HKU\BigPapa\…\Policies\system: [DisableLockWorkstation] 0 HKU\User2\…\Run: [Best Buy pc app] C:\Users\User2\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Best Buy\Best Buy pc app.appref-ms [398 2012-08-25] () HKU\User2\…\RunOnce: [Application Restart #0] C:\WINDOWS\System32\calc.exe /restart [918528 2009-07-13] (Microsoft Corporation) HKU\User2\…\RunOnce: [Application Restart #1] C:\Program Files (x86)\Internet Explorer\iexplore.exe -restart /WERRESTART [757296 2012-11-13] (Microsoft Corporation) HKLM-x32\…\RunOnce: [Launcher] C:\Program Files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe [165184 2011-08-01] (Softthinks) Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 Startup: C:\Users\BigPapa\Start Menu\Programs\Startup\PdaNet Desktop.lnk ShortcutTarget: PdaNet Desktop.lnk -> C:\Program Files (x86)\PdaNet for Android\PdaNetPC.exe () Startup: C:\Users\Default\Start Menu\Programs\Startup\Best Buy pc app.lnk ShortcutTarget: Best Buy pc app.lnk -> C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft) Startup: C:\Users\Default User\Start Menu\Programs\Startup\Best Buy pc app.lnk ShortcutTarget: Best Buy pc app.lnk -> C:\ProgramData\Best Buy pc app\ClickOnceSetup.exe (Microsoft) ==================== Services (Whitelisted) =================== 2 Connectify; C:\Program Files (x86)\Connectify\ConnectifyService.exe [69632 2011-09-29] () 2 MBAMScheduler; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe" [398184 2012-12-14] (Malwarebytes Corporation) 2 MBAMService; "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe" [682344 2012-12-14] (Malwarebytes Corporation) 2 N360; "C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe" /s "N360" /m "C:\Program Files (x86)\Norton 360\Engine\5.2.2.3\diMaster.dll" /prefetch:1 [262584 2011-03-31] (Symantec Corporation) ==================== Drivers (Whitelisted) ===================== 1 BHDrvx64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20130116.013\BHDrvx64.sys [1388120 2013-01-15] (Symantec Corporation) 1 cnnctfy2; C:\Windows\System32\Drivers\cnnctfy2.sys [31344 2012-03-11] (Connectify) 1 eeCtrl; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484512 2012-08-09] (Symantec Corporation) 3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [138912 2012-08-09] (Symantec Corporation) 1 IDSVia64; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20130205.001\IDSvia64.sys [513184 2013-02-01] (Symantec Corporation) 3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [24176 2012-12-14] (Malwarebytes Corporation) 3 NAVENG; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20130206.006\ENG64.SYS [126192 2013-02-01] (Symantec Corporation) 3 NAVEX15; \??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\VirusDefs\20130206.006\EX64.SYS [2087664 2013-02-01] (Symantec Corporation) 3 SRTSP; C:\Windows\System32\Drivers\N360x64\0502020.003\SRTSP64.SYS [744568 2011-03-30] (Symantec Corporation) 1 SRTSPX; C:\Windows\system32\drivers\N360x64\0502020.003\SRTSPX64.SYS [40568 2011-03-30] (Symantec Corporation) 0 SymDS; C:\Windows\System32\drivers\N360x64\0502020.003\SYMDS64.SYS [450680 2011-01-27] (Symantec Corporation) 0 SymEFA; C:\Windows\System32\drivers\N360x64\0502020.003\SYMEFA64.SYS [912504 2011-03-14] (Symantec Corporation) 3 SymEvent; \??\C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [174200 2012-04-17] (Symantec Corporation) 1 SymIRON; C:\Windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [171128 2011-01-26] (Symantec Corporation) 1 SymNetS; C:\Windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [386168 2011-04-20] (Symantec Corporation) ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2013-02-05 19:18 - 2013-02-05 19:18 - 00278536 ____A C:\Windows\Minidump\020513-24195-01.dmp 2013-02-05 19:08 - 2013-02-05 19:09 - 04732416 ____A (AVAST Software) C:\Users\BigPapa\Desktop\aswMBR.exe 2013-02-05 15:06 - 2013-02-06 19:51 - 00000000 ____D C:\Users\BigPapa\Application Data\JOSM 2013-02-05 15:06 - 2013-02-06 19:51 - 00000000 ____D C:\Users\BigPapa\AppData\Roaming\JOSM 2013-02-05 15:06 - 2013-02-05 15:06 - 00001871 ____A C:\Users\User2\Desktop\JOSM.lnk 2013-02-05 15:06 - 2013-02-05 15:06 - 00001871 ____A C:\Users\BigPapa\Desktop\JOSM.lnk 2013-02-05 15:06 - 2013-02-05 15:06 - 00000000 ____D C:\Program Files (x86)\JOSM 2013-02-05 15:01 - 2013-02-05 15:01 - 16612943 ____A C:\Users\BigPapa\Downloads\josm-setup.exe 2013-02-05 11:51 - 2013-02-05 11:51 - 00000000 ____D C:\Users\BigPapa\Downloads\osmosis-latest 2013-02-05 10:26 - 2013-02-05 10:26 - 00000000 ____D C:\Users\BigPapa\Downloads\massachusettsOSM 2013-02-05 08:09 - 2013-02-05 08:09 - 08619239 ____A C:\Users\BigPapa\Downloads\osmosis-latest.zip 2013-02-05 08:02 - 2013-02-05 08:06 - 154221628 ____A C:\Users\BigPapa\Downloads\massachusetts.osm.bz2 2013-02-05 07:36 - 2013-02-05 07:36 - 00000000 ____D C:\Users\BigPapa\.jnlp-applet 2013-02-04 13:51 - 2013-02-04 13:51 - 00048239 ____A C:\Users\BigPapa\Downloads\woodbury-testmap.osm 2013-02-04 11:30 - 2013-02-04 11:30 - 00528535 ____A C:\Users\BigPapa\Downloads\germ-test.osm 2013-02-04 10:46 - 2013-02-04 10:46 - 00000000 ____D C:\OSM2World-019 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\BigPapa\Local Settings\Conexant 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Conexant 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Conexant 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\All Users\Conexant 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\All Users\Application Data\Conexant 2013-02-04 09:01 - 2013-02-04 09:02 - 00000000 ____D C:\Users\BigPapa\Downloads\pc driver updates 2013-02-03 20:27 - 2013-02-04 08:54 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Akamai 2013-02-03 20:27 - 2013-02-04 08:54 - 00000000 ____D C:\Users\BigPapa\Local Settings\Akamai 2013-02-03 20:27 - 2013-02-04 08:54 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Akamai 2013-02-03 20:13 - 2013-02-03 20:27 - 11064264 ____A (Akamai Technologies, Inc.) C:\Users\BigPapa\Downloads\Dell_Download_Manager_Setup.exe 2013-02-03 19:51 - 2013-02-03 19:51 - 00001236 ____A C:\Users\BigPapa\Desktop\DriverMax.lnk 2013-02-03 19:51 - 2013-02-03 19:51 - 00000000 ____D C:\Users\BigPapa\Local Settings\Innovative Solutions 2013-02-03 19:51 - 2013-02-03 19:51 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Innovative Solutions 2013-02-03 19:51 - 2013-02-03 19:51 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Innovative Solutions 2013-02-03 19:51 - 2013-02-03 19:51 - 00000000 ____D C:\Program Files (x86)\Innovative Solutions 2013-02-03 14:56 - 2013-02-03 19:50 - 10711008 ____A (Innovative Solutions ) C:\Users\BigPapa\Downloads\drivermax.exe 2013-02-02 13:37 - 2013-02-02 13:38 - 00625664 ____A C:\Users\BigPapa\Desktop\dds.scr 2013-02-02 13:22 - 2013-02-02 13:23 - 00881914 ____A C:\Users\BigPapa\Desktop\SecurityCheck.exe 2013-02-01 19:03 - 2013-02-01 19:03 - 00000000 ____D C:\Users\BigPapa\Local Settings\Symantec 2013-02-01 19:03 - 2013-02-01 19:03 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Symantec 2013-02-01 19:03 - 2013-02-01 19:03 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Symantec 2013-01-31 15:50 - 2013-01-31 15:50 - 00333765 ____A C:\Users\BigPapa\Downloads\map (4).osm 2013-01-31 15:41 - 2013-01-31 15:41 - 00234317 ____A C:\Users\BigPapa\Downloads\map (3).osm 2013-01-31 15:18 - 2013-01-31 15:18 - 01880195 ____A C:\Users\BigPapa\Downloads\map (2).osm 2013-01-31 14:39 - 2013-01-31 14:51 - 11457680 ____A C:\Users\BigPapa\Downloads\OSM2World-0.1.9-bin.zip 2013-01-30 22:03 - 2013-01-30 22:03 - 00002600 ____A C:\{EC3F0508-ECA0-4BF9-8802-98A5E25C4DFD} 2013-01-30 21:58 - 2013-01-30 21:58 - 00002528 ____A C:\{91C86FCE-4339-43DB-9991-C02228EA9B6C} 2013-01-30 21:55 - 2013-01-30 21:55 - 00002464 ____A C:\{A051F5A8-A17B-4ADA-94E5-854BA72A4002} 2013-01-30 21:54 - 2013-01-30 21:54 - 00002320 ____A C:\{AABDF2EC-ECCF-4EF8-A12A-74FE24BD4E42} 2013-01-30 21:52 - 2013-01-30 21:52 - 00002440 ____A C:\{386C5091-4BBA-424C-A99F-FBB913D386B0} 2013-01-26 05:55 - 2013-01-26 05:55 - 00000000 ____D C:\UDK 2013-01-25 21:56 - 2013-01-25 22:47 - 91741884 ____A C:\Users\BigPapa\Downloads\terrain.zip 2013-01-25 21:48 - 2013-01-25 21:54 - 00587856 ____A C:\Users\BigPapa\Downloads\user_interface.zip 2013-01-25 21:41 - 2013-01-26 04:43 - 1915145448 ____A (Epic Games, Inc.) C:\Users\BigPapa\Downloads\UDKInstall-2012-11-BETA2 (1).exe 2013-01-25 21:33 - 2013-01-25 21:38 - 00585991 ____A C:\Users\BigPapa\Downloads\UDKInstall-2012-11-BETA2.exe 2013-01-25 17:22 - 2013-01-25 17:22 - 00010566 ____A C:\Users\BigPapa\Downloads\dellsystemdetect.application 2013-01-20 15:38 - 2013-01-20 15:38 - 00000000 ____D C:\Users\BigPapa\Downloads\lightmapping-demo 2013-01-20 15:33 - 2013-01-20 15:33 - 00296614 ____A C:\Users\BigPapa\Downloads\lightmapping-demo.rar 2013-01-15 19:12 - 2013-01-15 19:12 - 00002336 ____A C:\{05940A61-2816-4B1F-AE96-D8F4815C63A4} 2013-01-15 19:10 - 2013-01-15 19:10 - 00002456 ____A C:\{7BA0F268-6EE0-4AF1-A6E5-4247379435A2} 2013-01-15 19:07 - 2013-01-15 19:07 - 00002440 ____A C:\{B5D56F34-C417-480F-9EB0-0A796EA74138} 2013-01-15 19:01 - 2013-01-15 19:01 - 00002320 ____A C:\{ED42D095-80F7-40F8-A9BC-4E249031212A} 2013-01-09 14:57 - 2012-12-07 07:20 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\Wpc.dll 2013-01-09 14:57 - 2012-12-07 07:15 - 02746368 ____A (Microsoft Corporation) C:\Windows\System32\gameux.dll 2013-01-09 14:57 - 2012-12-07 06:26 - 00308736 ____A (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll 2013-01-09 14:57 - 2012-12-07 06:20 - 02576384 ____A (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll 2013-01-09 14:57 - 2012-12-07 05:20 - 00045568 ____A (Microsoft) C:\Windows\System32\oflc-nz.rs 2013-01-09 14:57 - 2012-12-07 05:20 - 00044544 ____A (Microsoft) C:\Windows\System32\pegibbfc.rs 2013-01-09 14:57 - 2012-12-07 05:20 - 00043520 ____A (Microsoft) C:\Windows\System32\csrr.rs 2013-01-09 14:57 - 2012-12-07 05:20 - 00030720 ____A (Microsoft) C:\Windows\System32\usk.rs 2013-01-09 14:57 - 2012-12-07 05:20 - 00023552 ____A (Microsoft) C:\Windows\System32\oflc.rs 2013-01-09 14:57 - 2012-12-07 05:20 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi-pt.rs 2013-01-09 14:57 - 2012-12-07 05:20 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi-fi.rs 2013-01-09 14:57 - 2012-12-07 05:19 - 00055296 ____A (Microsoft) C:\Windows\System32\cero.rs 2013-01-09 14:57 - 2012-12-07 05:19 - 00051712 ____A (Microsoft) C:\Windows\System32\esrb.rs 2013-01-09 14:57 - 2012-12-07 05:19 - 00046592 ____A (Microsoft) C:\Windows\System32\fpb.rs 2013-01-09 14:57 - 2012-12-07 05:19 - 00040960 ____A (Microsoft) C:\Windows\System32\cob-au.rs 2013-01-09 14:57 - 2012-12-07 05:19 - 00021504 ____A (Microsoft) C:\Windows\System32\grb.rs 2013-01-09 14:57 - 2012-12-07 05:19 - 00020480 ____A (Microsoft) C:\Windows\System32\pegi.rs 2013-01-09 14:57 - 2012-12-07 05:19 - 00015360 ____A (Microsoft) C:\Windows\System32\djctq.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00055296 ____A (Microsoft) C:\Windows\SysWOW64\cero.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00051712 ____A (Microsoft) C:\Windows\SysWOW64\esrb.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00046592 ____A (Microsoft) C:\Windows\SysWOW64\fpb.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00045568 ____A (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00044544 ____A (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00043520 ____A (Microsoft) C:\Windows\SysWOW64\csrr.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00040960 ____A (Microsoft) C:\Windows\SysWOW64\cob-au.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00030720 ____A (Microsoft) C:\Windows\SysWOW64\usk.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00023552 ____A (Microsoft) C:\Windows\SysWOW64\oflc.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00021504 ____A (Microsoft) C:\Windows\SysWOW64\grb.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00020480 ____A (Microsoft) C:\Windows\SysWOW64\pegi.rs 2013-01-09 14:57 - 2012-12-07 04:46 - 00015360 ____A (Microsoft) C:\Windows\SysWOW64\djctq.rs 2013-01-09 14:56 - 2012-11-29 23:45 - 00362496 ____A (Microsoft Corporation) C:\Windows\System32\wow64win.dll 2013-01-09 14:56 - 2012-11-29 23:45 - 00243200 ____A (Microsoft Corporation) C:\Windows\System32\wow64.dll 2013-01-09 14:56 - 2012-11-29 23:45 - 00215040 ____A (Microsoft Corporation) C:\Windows\System32\winsrv.dll 2013-01-09 14:56 - 2012-11-29 23:45 - 00013312 ____A (Microsoft Corporation) C:\Windows\System32\wow64cpu.dll 2013-01-09 14:56 - 2012-11-29 23:43 - 00016384 ____A (Microsoft Corporation) C:\Windows\System32\ntvdm64.dll 2013-01-09 14:56 - 2012-11-29 23:41 - 01161216 ____A (Microsoft Corporation) C:\Windows\System32\kernel32.dll 2013-01-09 14:56 - 2012-11-29 23:41 - 00424448 ____A (Microsoft Corporation) C:\Windows\System32\KernelBase.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00006144 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00005120 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 23:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:54 - 00005120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2013-01-09 14:56 - 2012-11-29 22:53 - 01114112 ____A (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll 2013-01-09 14:56 - 2012-11-29 22:53 - 00274944 ____A (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00005120 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 22:45 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 21:23 - 00338432 ____A (Microsoft Corporation) C:\Windows\System32\conhost.exe 2013-01-09 14:56 - 2012-11-29 20:44 - 00025600 ____A (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2013-01-09 14:56 - 2012-11-29 20:44 - 00014336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2013-01-09 14:56 - 2012-11-29 20:44 - 00007680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2013-01-09 14:56 - 2012-11-29 20:44 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2013-01-09 14:56 - 2012-11-29 20:38 - 00006144 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 20:38 - 00004608 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 20:38 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 20:38 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2013-01-09 14:56 - 2012-11-29 17:17 - 00420064 ____A C:\Windows\SysWOW64\locale.nls 2013-01-09 14:56 - 2012-11-29 17:15 - 00420064 ____A C:\Windows\System32\locale.nls 2013-01-09 14:55 - 2012-11-08 23:45 - 00750592 ____A (Microsoft Corporation) C:\Windows\System32\win32spl.dll 2013-01-09 14:55 - 2012-11-08 22:43 - 00492032 ____A (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2013-01-09 14:43 - 2012-11-21 23:44 - 00800768 ____A (Microsoft Corporation) C:\Windows\System32\usp10.dll 2013-01-09 14:43 - 2012-11-21 22:45 - 00626688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2013-01-09 14:43 - 2012-11-19 23:48 - 00307200 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll 2013-01-09 14:43 - 2012-11-19 22:51 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2013-01-09 14:43 - 2012-10-31 23:43 - 02002432 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll 2013-01-09 14:43 - 2012-10-31 23:43 - 01882624 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll 2013-01-09 14:43 - 2012-10-31 22:47 - 01389568 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2013-01-09 14:43 - 2012-10-31 22:47 - 01236992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2013-01-09 14:39 - 2012-11-22 21:26 - 03149824 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys 2013-01-09 14:39 - 2012-11-22 21:13 - 00068608 ____A (Microsoft Corporation) C:\Windows\System32\taskhost.exe 2013-01-07 21:13 - 2013-01-07 21:13 - 00002336 ____A C:\{31DB37F6-F8F7-47CD-8638-7201A6CBFB9C} 2013-01-07 21:12 - 2013-01-07 21:12 - 00002456 ____A C:\{F6ABD6F1-FE1C-4E91-95BE-46C35A3DB458} 2013-01-07 21:10 - 2013-01-07 21:10 - 00002456 ____A C:\{34F392C8-E311-45FC-B8A7-7C0FA146E16E} 2013-01-07 21:07 - 2013-01-07 21:07 - 00002320 ____A C:\{CFEC71FB-26EF-4419-8737-456DA1D53B8A} 2013-01-07 21:05 - 2013-01-07 21:05 - 00002440 ____A C:\{2C3DE9B3-ADE4-4A67-A287-550443437449} ==================== One Month Modified Files and Folders ======= 2013-02-06 19:56 - 2013-02-06 19:56 - 00000000 ____D C:\FRST 2013-02-06 19:51 - 2013-02-05 15:06 - 00000000 ____D C:\Users\BigPapa\Application Data\JOSM 2013-02-06 19:51 - 2013-02-05 15:06 - 00000000 ____D C:\Users\BigPapa\AppData\Roaming\JOSM 2013-02-06 19:51 - 2011-06-21 12:46 - 01854022 ____A C:\Windows\WindowsUpdate.log 2013-02-06 19:48 - 2009-07-13 23:13 - 00778834 ____A C:\Windows\System32\PerfStringBackup.INI 2013-02-06 19:46 - 2012-09-05 19:15 - 00000900 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2013-02-06 19:46 - 2012-04-12 00:00 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job 2013-02-06 13:25 - 2012-09-05 19:15 - 00000896 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2013-02-05 19:26 - 2009-07-13 22:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-02-05 19:26 - 2009-07-13 22:45 - 00021296 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-02-05 19:19 - 2011-06-21 13:18 - 00000000 ____D C:\Users\Default\Local Settings\SoftThinks 2013-02-05 19:19 - 2011-06-21 13:18 - 00000000 ____D C:\Users\Default\Local Settings\Application Data\SoftThinks 2013-02-05 19:19 - 2011-06-21 13:18 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks 2013-02-05 19:19 - 2011-06-21 13:18 - 00000000 ____D C:\Users\Default User\Local Settings\SoftThinks 2013-02-05 19:19 - 2011-06-21 13:18 - 00000000 ____D C:\Users\Default User\Local Settings\Application Data\SoftThinks 2013-02-05 19:19 - 2011-06-21 13:18 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks 2013-02-05 19:19 - 2011-06-21 12:45 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup 2013-02-05 19:18 - 2013-02-05 19:18 - 00278536 ____A C:\Windows\Minidump\020513-24195-01.dmp 2013-02-05 19:18 - 2012-03-13 16:44 - 625692583 ____A C:\Windows\MEMORY.DMP 2013-02-05 19:18 - 2012-03-13 16:44 - 00000000 ____D C:\Windows\Minidump 2013-02-05 19:18 - 2012-02-28 16:43 - 00000439 ____A C:\Windows\System32\Drivers\etc\hosts.ics 2013-02-05 19:18 - 2010-11-20 21:47 - 00190676 ____A C:\Windows\PFRO.log 2013-02-05 19:18 - 2009-07-13 23:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-02-05 19:18 - 2009-07-13 22:51 - 00040400 ____A C:\Windows\setupact.log 2013-02-05 19:10 - 2012-10-22 13:46 - 00000000 ____D C:\tmp 2013-02-05 19:09 - 2013-02-05 19:08 - 04732416 ____A (AVAST Software) C:\Users\BigPapa\Desktop\aswMBR.exe 2013-02-05 15:06 - 2013-02-05 15:06 - 00001871 ____A C:\Users\User2\Desktop\JOSM.lnk 2013-02-05 15:06 - 2013-02-05 15:06 - 00001871 ____A C:\Users\BigPapa\Desktop\JOSM.lnk 2013-02-05 15:06 - 2013-02-05 15:06 - 00000000 ____D C:\Program Files (x86)\JOSM 2013-02-05 15:01 - 2013-02-05 15:01 - 16612943 ____A C:\Users\BigPapa\Downloads\josm-setup.exe 2013-02-05 11:51 - 2013-02-05 11:51 - 00000000 ____D C:\Users\BigPapa\Downloads\osmosis-latest 2013-02-05 10:26 - 2013-02-05 10:26 - 00000000 ____D C:\Users\BigPapa\Downloads\massachusettsOSM 2013-02-05 08:09 - 2013-02-05 08:09 - 08619239 ____A C:\Users\BigPapa\Downloads\osmosis-latest.zip 2013-02-05 08:06 - 2013-02-05 08:02 - 154221628 ____A C:\Users\BigPapa\Downloads\massachusetts.osm.bz2 2013-02-05 07:36 - 2013-02-05 07:36 - 00000000 ____D C:\Users\BigPapa\.jnlp-applet 2013-02-05 07:36 - 2012-02-25 19:36 - 00000000 ____D C:\users\BigPapa 2013-02-04 13:51 - 2013-02-04 13:51 - 00048239 ____A C:\Users\BigPapa\Downloads\woodbury-testmap.osm 2013-02-04 13:05 - 2012-03-02 14:49 - 00000000 ____D C:\Users\All Users\boost_interprocess 2013-02-04 13:05 - 2012-03-02 14:49 - 00000000 ____D C:\Users\All Users\Application Data\boost_interprocess 2013-02-04 11:30 - 2013-02-04 11:30 - 00528535 ____A C:\Users\BigPapa\Downloads\germ-test.osm 2013-02-04 10:46 - 2013-02-04 10:46 - 00000000 ____D C:\OSM2World-019 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\BigPapa\Local Settings\Conexant 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Conexant 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Conexant 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\All Users\Conexant 2013-02-04 10:16 - 2013-02-04 10:16 - 00000000 ____D C:\Users\All Users\Application Data\Conexant 2013-02-04 10:16 - 2011-06-21 14:39 - 00000000 ____D C:\Program Files\CONEXANT 2013-02-04 09:02 - 2013-02-04 09:01 - 00000000 ____D C:\Users\BigPapa\Downloads\pc driver updates 2013-02-04 08:58 - 2012-03-26 16:22 - 00000000 ____D C:\Users\BigPapa\Downloads\my computer updates 2013-02-04 08:54 - 2013-02-03 20:27 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Akamai 2013-02-04 08:54 - 2013-02-03 20:27 - 00000000 ____D C:\Users\BigPapa\Local Settings\Akamai 2013-02-04 08:54 - 2013-02-03 20:27 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Akamai 2013-02-03 20:27 - 2013-02-03 20:13 - 11064264 ____A (Akamai Technologies, Inc.) C:\Users\BigPapa\Downloads\Dell_Download_Manager_Setup.exe 2013-02-03 20:05 - 2012-02-25 19:40 - 00000000 ____D C:\Users\BigPapa\Local Settings\Deployment 2013-02-03 20:05 - 2012-02-25 19:40 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Deployment 2013-02-03 20:05 - 2012-02-25 19:40 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Deployment 2013-02-03 19:51 - 2013-02-03 19:51 - 00001236 ____A C:\Users\BigPapa\Desktop\DriverMax.lnk 2013-02-03 19:51 - 2013-02-03 19:51 - 00000000 ____D C:\Users\BigPapa\Local Settings\Innovative Solutions 2013-02-03 19:51 - 2013-02-03 19:51 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Innovative Solutions 2013-02-03 19:51 - 2013-02-03 19:51 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Innovative Solutions 2013-02-03 19:51 - 2013-02-03 19:51 - 00000000 ____D C:\Program Files (x86)\Innovative Solutions 2013-02-03 19:50 - 2013-02-03 14:56 - 10711008 ____A (Innovative Solutions ) C:\Users\BigPapa\Downloads\drivermax.exe 2013-02-03 13:01 - 2011-06-21 13:02 - 00000000 ____D C:\Users\All Users\Sonic 2013-02-03 13:01 - 2011-06-21 13:02 - 00000000 ____D C:\Users\All Users\Application Data\Sonic 2013-02-02 13:38 - 2013-02-02 13:37 - 00625664 ____A C:\Users\BigPapa\Desktop\dds.scr 2013-02-02 13:23 - 2013-02-02 13:22 - 00881914 ____A C:\Users\BigPapa\Desktop\SecurityCheck.exe 2013-02-02 12:26 - 2012-08-27 17:48 - 00000000 ____D C:\Users\BigPapa\Local Settings\Google 2013-02-02 12:26 - 2012-08-27 17:48 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Google 2013-02-02 12:26 - 2012-08-27 17:48 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Google 2013-02-02 01:07 - 2012-10-07 00:45 - 00001111 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk 2013-02-02 01:07 - 2012-10-07 00:45 - 00001111 ____A C:\Users\All Users\Desktop\Malwarebytes Anti-Malware.lnk 2013-02-02 01:07 - 2012-03-03 12:52 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware 2013-02-01 19:50 - 2012-10-21 03:36 - 00000000 ____D C:\Users\BigPapa\Application Data\vlc 2013-02-01 19:50 - 2012-10-21 03:36 - 00000000 ____D C:\Users\BigPapa\AppData\Roaming\vlc 2013-02-01 19:50 - 2012-08-25 09:00 - 00000000 ____D C:\users\User2 2013-02-01 19:50 - 2012-04-17 13:33 - 00000000 ____D C:\Users\All Users\Norton 2013-02-01 19:50 - 2012-04-17 13:33 - 00000000 ____D C:\Users\All Users\Application Data\Norton 2013-02-01 19:50 - 2012-02-29 06:17 - 00000000 ____D C:\Users\All Users\FLEXnet 2013-02-01 19:50 - 2012-02-29 06:17 - 00000000 ____D C:\Users\All Users\Application Data\FLEXnet 2013-02-01 19:50 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\System32\NDF 2013-02-01 19:50 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\registration 2013-02-01 19:50 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\AppCompat 2013-02-01 19:03 - 2013-02-01 19:03 - 00000000 ____D C:\Users\BigPapa\Local Settings\Symantec 2013-02-01 19:03 - 2013-02-01 19:03 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\Symantec 2013-02-01 19:03 - 2013-02-01 19:03 - 00000000 ____D C:\Users\BigPapa\AppData\Local\Symantec 2013-01-31 15:50 - 2013-01-31 15:50 - 00333765 ____A C:\Users\BigPapa\Downloads\map (4).osm 2013-01-31 15:41 - 2013-01-31 15:41 - 00234317 ____A C:\Users\BigPapa\Downloads\map (3).osm 2013-01-31 15:18 - 2013-01-31 15:18 - 01880195 ____A C:\Users\BigPapa\Downloads\map (2).osm 2013-01-31 14:51 - 2013-01-31 14:39 - 11457680 ____A C:\Users\BigPapa\Downloads\OSM2World-0.1.9-bin.zip 2013-01-31 02:14 - 2012-06-05 18:02 - 00000000 ____D C:\Users\BigPapa\Local Settings\CrashDumps 2013-01-31 02:14 - 2012-06-05 18:02 - 00000000 ____D C:\Users\BigPapa\Local Settings\Application Data\CrashDumps 2013-01-31 02:14 - 2012-06-05 18:02 - 00000000 ____D C:\Users\BigPapa\AppData\Local\CrashDumps 2013-01-30 22:03 - 2013-01-30 22:03 - 00002600 ____A C:\{EC3F0508-ECA0-4BF9-8802-98A5E25C4DFD} 2013-01-30 21:58 - 2013-01-30 21:58 - 00002528 ____A C:\{91C86FCE-4339-43DB-9991-C02228EA9B6C} 2013-01-30 21:55 - 2013-01-30 21:55 - 00002464 ____A C:\{A051F5A8-A17B-4ADA-94E5-854BA72A4002} 2013-01-30 21:54 - 2013-01-30 21:54 - 00002320 ____A C:\{AABDF2EC-ECCF-4EF8-A12A-74FE24BD4E42} 2013-01-30 21:52 - 2013-01-30 21:52 - 00002440 ____A C:\{386C5091-4BBA-424C-A99F-FBB913D386B0} 2013-01-30 09:51 - 2012-07-15 22:01 - 00000132 ____A C:\Users\BigPapa\Application Data\Adobe PNG Format CS5 Prefs 2013-01-30 09:51 - 2012-07-15 22:01 - 00000132 ____A C:\Users\BigPapa\AppData\Roaming\Adobe PNG Format CS5 Prefs 2013-01-27 18:22 - 2012-08-08 21:31 - 00001456 ____A C:\Users\BigPapa\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs 2013-01-27 18:22 - 2012-08-08 21:31 - 00001456 ____A C:\Users\BigPapa\Local Settings\Adobe Save for Web 12.0 Prefs 2013-01-27 18:22 - 2012-08-08 21:31 - 00001456 ____A C:\Users\BigPapa\AppData\Local\Adobe Save for Web 12.0 Prefs 2013-01-27 18:22 - 2012-04-18 23:58 - 00000132 ____A C:\Users\BigPapa\Application Data\Adobe Targa Format CS5 Prefs 2013-01-27 18:22 - 2012-04-18 23:58 - 00000132 ____A C:\Users\BigPapa\AppData\Roaming\Adobe Targa Format CS5 Prefs 2013-01-26 05:56 - 2011-06-21 12:51 - 00216234 ____A C:\Windows\DirectX.log 2013-01-26 05:55 - 2013-01-26 05:55 - 00000000 ____D C:\UDK 2013-01-26 04:43 - 2013-01-25 21:41 - 1915145448 ____A (Epic Games, Inc.) C:\Users\BigPapa\Downloads\UDKInstall-2012-11-BETA2 (1).exe 2013-01-25 22:47 - 2013-01-25 21:56 - 91741884 ____A C:\Users\BigPapa\Downloads\terrain.zip 2013-01-25 21:54 - 2013-01-25 21:48 - 00587856 ____A C:\Users\BigPapa\Downloads\user_interface.zip 2013-01-25 21:38 - 2013-01-25 21:33 - 00585991 ____A C:\Users\BigPapa\Downloads\UDKInstall-2012-11-BETA2.exe 2013-01-25 17:22 - 2013-01-25 17:22 - 00010566 ____A C:\Users\BigPapa\Downloads\dellsystemdetect.application 2013-01-20 15:38 - 2013-01-20 15:38 - 00000000 ____D C:\Users\BigPapa\Downloads\lightmapping-demo 2013-01-20 15:33 - 2013-01-20 15:33 - 00296614 ____A C:\Users\BigPapa\Downloads\lightmapping-demo.rar 2013-01-15 19:12 - 2013-01-15 19:12 - 00002336 ____A C:\{05940A61-2816-4B1F-AE96-D8F4815C63A4} 2013-01-15 19:10 - 2013-01-15 19:10 - 00002456 ____A C:\{7BA0F268-6EE0-4AF1-A6E5-4247379435A2} 2013-01-15 19:07 - 2013-01-15 19:07 - 00002440 ____A C:\{B5D56F34-C417-480F-9EB0-0A796EA74138} 2013-01-15 19:01 - 2013-01-15 19:01 - 00002320 ____A C:\{ED42D095-80F7-40F8-A9BC-4E249031212A} 2013-01-10 06:37 - 2012-03-24 12:11 - 00002021 ____A C:\Users\Public\Desktop\Adobe Reader X.lnk 2013-01-10 06:37 - 2012-03-24 12:11 - 00002021 ____A C:\Users\All Users\Desktop\Adobe Reader X.lnk 2013-01-10 06:27 - 2009-07-13 21:20 - 00000000 ____D C:\Windows\rescache 2013-01-10 02:35 - 2009-07-13 22:45 - 04877896 ____A C:\Windows\System32\FNTCACHE.DAT 2013-01-10 02:15 - 2011-02-10 10:10 - 00772558 ____A C:\Windows\SysWOW64\PerfStringBackup.INI 2013-01-07 21:13 - 2013-01-07 21:13 - 00002336 ____A C:\{31DB37F6-F8F7-47CD-8638-7201A6CBFB9C} 2013-01-07 21:12 - 2013-01-07 21:12 - 00002456 ____A C:\{F6ABD6F1-FE1C-4E91-95BE-46C35A3DB458} 2013-01-07 21:10 - 2013-01-07 21:10 - 00002456 ____A C:\{34F392C8-E311-45FC-B8A7-7C0FA146E16E} 2013-01-07 21:07 - 2013-01-07 21:07 - 00002320 ____A C:\{CFEC71FB-26EF-4419-8737-456DA1D53B8A} 2013-01-07 21:05 - 2013-01-07 21:05 - 00002440 ____A C:\{2C3DE9B3-ADE4-4A67-A287-550443437449} ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-01-17 23:00:29 Restore point made on: 2013-01-25 00:01:54 Restore point made on: 2013-01-27 02:00:48 Restore point made on: 2013-02-02 02:00:32 ==================== Memory info =========================== Percentage of memory in use: 14% Total physical RAM: 4008.63 MB Available physical RAM: 3411.71 MB Total Pagefile: 4006.83 MB Available Pagefile: 3407.61 MB Total Virtual: 8192 MB Available Virtual: 8191.9 MB ==================== Partitions ============================= 1 Drive c: (OS) (Fixed) (Total:919.22 GB) (Free:831.36 GB) NTFS 2 Drive d: () (CDROM) (Total:0.22 GB) (Free:0 GB) CDFS 4 Drive f: (Lexar) (Removable) (Total:7.45 GB) (Free:0.01 GB) FAT32 5 Drive g: (RECOVERY) (Fixed) (Total:12.25 GB) (Free:5.53 GB) NTFS ==>[System with boot components (obtained from reading drive)] 6 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 931 GB 0 B Disk 1 No Media 0 B 0 B Disk 2 Online 7648 MB 0 B Partitions of Disk 0: =============== Disk ID: FBC8DE29 Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 OEM 39 MB 31 KB Partition 2 Primary 12 GB 40 MB Partition 3 Primary 919 GB 12 GB ================================================================================ == Disk: 0 Partition 1 Type : DE Hidden: Yes Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 5 FAT Partition 39 MB Healthy Hidden ========================================================= Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 G RECOVERY NTFS Partition 12 GB Healthy ========================================================= Disk: 0 Partition 3 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 2 C OS NTFS Partition 919 GB Healthy ========================================================= Partitions of Disk 2: =============== Disk ID: 00000000 Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 Primary 7646 MB 1096 KB ================================================================================ == Disk: 2 Partition 1 Type : 0B Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 4 F Lexar FAT32 Removable 7646 MB Healthy ========================================================= Last Boot: 2013-02-03 08:12 ==================== End Of Log =============================

Please run the following:

Please download Junkware Removal Tool to your desktop.

• Shutdown your antivirus to avoid any conflicts.
• Right-mouse click JRT.exe and select Run as administrator
• The tool will open and start scanning your system.
• Please be patient as this can take a while to complete.
• On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
• Post the contents of JRT.txt into your next message

NEXT


Download AdwCleaner from here and save it to your desktop.

• Run AdwCleaner and select Delete
• Once done it will ask to reboot, allow the reboot
• On reboot a log will be produced, please attach the content of the log to your next reply

NEXT

• Please open your MalwareBytes AntiMalware Program
• Click the Update Tab and search for updates
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish, so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected. <– very important
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.



NEXT


Go here to run an online scanner from ESET.

• Turn off the real time scanner of any existing antivirus program while performing the online scan
• Tick the box next to YES, I accept the Terms of Use.
• Click Start
• When asked, allow the activeX control to install
• Click Start
• Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
• Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
• Click Scan
• Wait for the scan to finish
• When the scan completes, press the LIST OF THREATS FOUND button
• Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
• Include the contents of this report in your next reply.
• Press the BACK button.
• Press Finish

Well, I cannot believe what I did. it must of been something I had over kookedm but, ESET was set to clean infected files. I know you said not to have this ticked, but I had over looked it. other than that here are my reports…. JRT… ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Junkware Removal Tool (JRT) by Thisisu Version: 4.6.2 (02.02.2013:2) OS: Windows 7 Home Premium x64 Ran by [removed] on Sat 02/09/2013 at 0:01:46.22 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ~~~ Services ~~~ Registry Values Successfully deleted: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\toolbar\\{98889811-442d-49dd-99d7-dc866be87dbc} Successfully repaired: [Registry Value] hkey_current_user\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_local_machine\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\.default\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\s-1-5-18\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\s-1-5-19\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\s-1-5-20\software\microsoft\internet explorer\searchscopes\\DefaultScope Successfully repaired: [Registry Value] hkey_users\S-1-5-21-1653179536-2399911319-13676569-1000\software\microsoft\internet explorer\searchscopes\\DefaultScope ~~~ Registry Keys Successfully deleted: [Registry Key] hkey_classes_root\escort.escortiepane Successfully deleted: [Registry Key] hkey_classes_root\escort.escortiepane.1 Successfully deleted: [Registry Key] hkey_classes_root\esrv.babylonesrvc Successfully deleted: [Registry Key] hkey_classes_root\esrv.babylonesrvc.1 Successfully deleted: [Registry Key] hkey_local_machine\software\babylon Successfully deleted: [Registry Key] hkey_current_user\software\babylontoolbar Successfully deleted: [Registry Key] hkey_local_machine\software\babylontoolbar Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\babylon Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escort.dll Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escortapp.dll Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escorteng.dll Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\escortlbr.dll Successfully deleted: [Registry Key] hkey_local_machine\software\classes\appid\esrv.exe Successfully deleted: [Registry Key] hkey_local_machine\software\classes\b Successfully deleted: [Registry Key] hkey_local_machine\software\classes\babylon.dskbnd Successfully deleted: [Registry Key] hkey_local_machine\software\classes\babylon.dskbnd.1 Successfully deleted: [Registry Key] hkey_local_machine\software\classes\bbylnapp.appcore Successfully deleted: [Registry Key] hkey_local_machine\software\classes\bbylnapp.appcore.1 Successfully deleted: [Registry Key] hkey_local_machine\software\classes\escort.escrtbtn.1 Successfully deleted: [Registry Key] hkey_local_machine\software\classes\installer\products\3192aa38321c641458dbdaf83979d193 Successfully deleted: [Registry Key] hkey_local_machine\software\classes\prod.cap Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\mybabylontb_rasapi32 Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\tracing\mybabylontb_rasmancs Successfully deleted: [Registry Key] hkey_current_user\software\microsoft\internet explorer\searchscopes\{0ecdf796-c2dc-4d79-a620-cce0c0a66cc9} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{291bccc1-6890-484a-89d3-318c928dac1b} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{2eecd738-5844-4a99-b4b6-146bf802613b} Successfully deleted: [Registry Key] hkey_local_machine\software\microsoft\windows\currentversion\explorer\browser helper objects\{2eecd738-5844-4a99-b4b6-146bf802613b} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{97f2ff5b-260c-4ccf-834a-2dda4e29e39e} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{98889811-442d-49dd-99d7-dc866be87dbc} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{b8276a94-891d-453c-9ff3-715c042a2575} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{e46c8196-b634-44a1-af6e-957c64278ab1} Successfully deleted: [Registry Key] hkey_classes_root\clsid\{ffb9adcb-8c79-4c29-81d3-74d46a93d370} ~~~ Files ~~~ Folders Successfully deleted: [Folder] "C:\ProgramData\babylon" Successfully deleted: [Folder] "C:\ProgramData\best buy pc app" Successfully deleted: [Folder] "C:\ProgramData\boost_interprocess" Successfully deleted: [Folder] "C:\Users\BigPapa\AppData\Roaming\babylon" Successfully deleted: [Folder] "C:\Users\BigPapa\AppData\Roaming\babylontoolbar" Successfully deleted: [Folder] "C:\Users\BigPapa\appdata\local\best buy pc app" Failed to delete: [Folder] "C:\Program Files (x86)\babylontoolbar" Successfully deleted: [Folder] "C:\Program Files (x86)\oapps" ~~~ Event Viewer Logs were cleared ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Scan was completed on Sat 02/09/2013 at 0:07:55.11 End of JRT log ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ MBAM… reported no malicious code ESet reported 30 infections…. C:\Pat Leaf project\RNEILEN-PC\Backup Set 2012-02-25 163307\Backup Files 2012-02-25 163307\Backup files 25.zip a variant of Win32/Packed.MoleboxVS.G application deleted - quarantined C:\Pat Leaf project\RNEILEN-PC\Backup Set 2012-02-25 163307\Backup Files 2012-02-25 163307\Backup files 5.zip multiple threats deleted - quarantined C:\Pat Leaf project\RNEILEN-PC\Backup Set 2012-02-25 163307\Backup Files 2012-02-25 163307\Backup files 6.zip Win32/DownloadAdmin.A.Gen application deleted - quarantined C:\Pat Leaf project\RNEILEN-PC\Backup Set 2012-02-25 163307\Backup Files 2012-02-25 163307\Backup files 7.zip a variant of Win32/Packed.MoleboxVS.G application deleted - quarantined C:\Program Files (x86)\Dell DataSafe Local Backup\hstart.exe a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\Backup\DSLUpdate\hstart.exe.bak a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\Backup\DSLUpdate\hstart.exe.bk1 a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\UpdateWorkingDirectory\DSL\hstart.exe a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\UpdateWorkingDirectory\DSL\Components\DSUpdate\hstart.exe a variant of Win32/HiddenStart.A application cleaned by deleting - quarantined C:\Program Files (x86)\Google\Update\Download\{74AF07D8-FB8F-4D51-8AC7-927721D56EBB}\0.0.0.0\GoogleEarth-Win-Bundle-6.2.2.6613.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\Temp\Maya 2012 extract\maya2012_x64.iso Win32/Keygen.BL application deleted - quarantined C:\Temp\Maya 2012 extract\iso extract\maya2012_x64.iso Win32/Keygen.BL application deleted - quarantined C:\Users\BigPapa\C\Users\RNeilen\Downloads\gimp-setup.exe Win32/DownloadAdmin.A.Gen application cleaned by deleting - quarantined C:\Users\BigPapa\C\Users\RNeilen\Downloads\UrbanPADSetup_2011_12_13_v3.0.12a.1 (1).exe a variant of Win32/Packed.MoleboxVS.G application cleaned by deleting - quarantined C:\Users\BigPapa\C\Users\RNeilen\Downloads\UrbanPADSetup_2011_12_13_v3.0.12a.1 (2).exe a variant of Win32/Packed.MoleboxVS.G application cleaned by deleting - quarantined C:\Users\BigPapa\C\Users\RNeilen\Downloads\UrbanPADSetup_2011_12_13_v3.0.12a.1.exe a variant of Win32/Packed.MoleboxVS.G application cleaned by deleting - quarantined C:\Users\RNeilen\Downloads\gimp-setup.exe Win32/DownloadAdmin.A.Gen application cleaned by deleting - quarantined C:\WINDOWS\Installer\22f85c6c.msi Win32/Toolbar.Widgi application deleted - quarantined C:\WINDOWS\Installer\6ad65fd6.msi Win32/Toolbar.Widgi application deleted - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\ARPPRODUCTICON.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\googleearth.exe1_F6A848FB884248E6A4CDCBDCF41F6A74.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\googleearth.exe_F6A848FB884248E6A4CDCBDCF41F6A74.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\ShortcutDX_EB071909B9884F8CBF3D6115D4ADEE5E.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\ShortcutOGL_EB071909B9884F8CBF3D6115D4ADEE5E.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\UNINST_Uninstall_G_F6A848FB884248E6A4CDCBDCF41F6A74_1.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\_7EA1FFEF_B7AE_43A5_8841_DBB045C2D037 Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{28E82311-8616-11E1-BEB0-B8AC6F97B88E}\_A86D6FCA_B61A_4DF3_A911_587A28753A8E Win32/Toolbar.Widgi application cleaned by deleting - quarantined C:\WINDOWS\Installer\{FACF1CAE-8996-4FA9-BE83-654B312E59C4}\ARPPRODUCTICON.exe Win32/Toolbar.Widgi application cleaned by deleting - quarantined

ComboFix 13-02-07.02 - BigPapa 02/09/2013 19:03:41.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.1.1033.18.4009.2737 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe AV: Norton 360 *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF} FW: Norton 360 *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4} SP: Norton 360 *Enabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202} SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-01-10 to 2013-02-10 ))))))))))))))))))))))))))))))) . . 2013-02-10 00:10 . 2013-02-10 00:10 ——– d—–w- c:\users\User2\AppData\Local\temp 2013-02-10 00:10 . 2013-02-10 00:10 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-02-09 14:35 . 2013-02-09 14:35 ——– d—–w- c:\programdata\boost_interprocess 2013-02-09 14:12 . 2013-02-09 14:12 ——– d—–w- c:\program files (x86)\ESET 2013-02-09 05:01 . 2013-02-09 05:01 ——– d—–w- c:\windows\ERUNT 2013-02-09 04:58 . 2013-02-09 04:58 ——– d—–w- C:\JRT 2013-02-07 01:56 . 2013-02-07 01:56 ——– d—–w- C:\FRST 2013-02-05 21:06 . 2013-02-08 10:46 ——– d—–w- c:\users\BigPapa\AppData\Roaming\JOSM 2013-02-05 21:06 . 2013-02-05 21:06 ——– d—–w- c:\program files (x86)\JOSM 2013-02-05 13:36 . 2013-02-05 13:36 ——– d—–w- c:\users\BigPapa\.jnlp-applet 2013-02-04 16:46 . 2013-02-04 16:46 ——– d—–w- C:\OSM2World-019 2013-02-04 16:16 . 2013-02-04 16:16 ——– d—–w- c:\programdata\Conexant 2013-02-04 16:16 . 2013-02-04 16:16 ——– d—–w- c:\users\BigPapa\AppData\Local\Conexant 2013-02-04 02:27 . 2013-02-04 14:54 ——– d—–w- c:\users\BigPapa\AppData\Local\Akamai 2013-02-04 01:51 . 2013-02-04 01:51 ——– d—–w- c:\users\BigPapa\AppData\Local\Innovative Solutions 2013-02-04 01:51 . 2013-02-04 01:51 ——– d—–w- c:\program files (x86)\Innovative Solutions 2013-02-02 07:05 . 2013-02-02 07:05 ——– d—–w- c:\users\BigPapa\AppData\Local\Programs 2013-02-02 01:03 . 2013-02-02 01:03 ——– d—–w- c:\users\BigPapa\AppData\Local\Symantec 2013-01-26 11:55 . 2013-01-26 11:55 ——– d—–w- C:\UDK . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-16 17:11 . 2012-12-31 08:00 46080 —-a-w- c:\windows\system32\atmlib.dll 2012-12-16 14:45 . 2012-12-31 08:00 367616 —-a-w- c:\windows\system32\atmfd.dll 2012-12-16 14:13 . 2012-12-31 08:00 295424 —-a-w- c:\windows\SysWow64\atmfd.dll 2012-12-16 14:13 . 2012-12-31 08:00 34304 —-a-w- c:\windows\SysWow64\atmlib.dll 2012-12-14 21:49 . 2012-10-07 06:45 24176 —-a-w- c:\windows\system32\drivers\mbam.sys 2012-12-07 13:20 . 2013-01-09 20:57 441856 —-a-w- c:\windows\system32\Wpc.dll 2012-12-07 13:15 . 2013-01-09 20:57 2746368 —-a-w- c:\windows\system32\gameux.dll 2012-12-07 12:26 . 2013-01-09 20:57 308736 —-a-w- c:\windows\SysWow64\Wpc.dll 2012-12-07 12:20 . 2013-01-09 20:57 2576384 —-a-w- c:\windows\SysWow64\gameux.dll 2012-12-07 11:20 . 2013-01-09 20:57 30720 —-a-w- c:\windows\system32\usk.rs 2012-12-07 11:20 . 2013-01-09 20:57 43520 —-a-w- c:\windows\system32\csrr.rs 2012-12-07 11:20 . 2013-01-09 20:57 23552 —-a-w- c:\windows\system32\oflc.rs 2012-12-07 11:20 . 2013-01-09 20:57 45568 —-a-w- c:\windows\system32\oflc-nz.rs 2012-12-07 11:20 . 2013-01-09 20:57 44544 —-a-w- c:\windows\system32\pegibbfc.rs 2012-12-07 11:20 . 2013-01-09 20:57 20480 —-a-w- c:\windows\system32\pegi-fi.rs 2012-12-07 11:20 . 2013-01-09 20:57 20480 —-a-w- c:\windows\system32\pegi-pt.rs 2012-12-07 11:19 . 2013-01-09 20:57 20480 —-a-w- c:\windows\system32\pegi.rs 2012-12-07 11:19 . 2013-01-09 20:57 46592 —-a-w- c:\windows\system32\fpb.rs 2012-12-07 11:19 . 2013-01-09 20:57 40960 —-a-w- c:\windows\system32\cob-au.rs 2012-12-07 11:19 . 2013-01-09 20:57 21504 —-a-w- c:\windows\system32\grb.rs 2012-12-07 11:19 . 2013-01-09 20:57 15360 —-a-w- c:\windows\system32\djctq.rs 2012-12-07 11:19 . 2013-01-09 20:57 55296 —-a-w- c:\windows\system32\cero.rs 2012-12-07 11:19 . 2013-01-09 20:57 51712 —-a-w- c:\windows\system32\esrb.rs 2012-12-07 10:46 . 2013-01-09 20:57 43520 —-a-w- c:\windows\SysWow64\csrr.rs 2012-12-07 10:46 . 2013-01-09 20:57 30720 —-a-w- c:\windows\SysWow64\usk.rs 2012-12-07 10:46 . 2013-01-09 20:57 45568 —-a-w- c:\windows\SysWow64\oflc-nz.rs 2012-12-07 10:46 . 2013-01-09 20:57 44544 —-a-w- c:\windows\SysWow64\pegibbfc.rs 2012-12-07 10:46 . 2013-01-09 20:57 23552 —-a-w- c:\windows\SysWow64\oflc.rs 2012-12-07 10:46 . 2013-01-09 20:57 20480 —-a-w- c:\windows\SysWow64\pegi-pt.rs 2012-12-07 10:46 . 2013-01-09 20:57 20480 —-a-w- c:\windows\SysWow64\pegi-fi.rs 2012-12-07 10:46 . 2013-01-09 20:57 46592 —-a-w- c:\windows\SysWow64\fpb.rs 2012-12-07 10:46 . 2013-01-09 20:57 20480 —-a-w- c:\windows\SysWow64\pegi.rs 2012-12-07 10:46 . 2013-01-09 20:57 21504 —-a-w- c:\windows\SysWow64\grb.rs 2012-12-07 10:46 . 2013-01-09 20:57 40960 —-a-w- c:\windows\SysWow64\cob-au.rs 2012-12-07 10:46 . 2013-01-09 20:57 15360 —-a-w- c:\windows\SysWow64\djctq.rs 2012-12-07 10:46 . 2013-01-09 20:57 55296 —-a-w- c:\windows\SysWow64\cero.rs 2012-12-07 10:46 . 2013-01-09 20:57 51712 —-a-w- c:\windows\SysWow64\esrb.rs 2012-11-30 05:45 . 2013-01-09 20:56 362496 —-a-w- c:\windows\system32\wow64win.dll 2012-11-30 05:45 . 2013-01-09 20:56 243200 —-a-w- c:\windows\system32\wow64.dll 2012-11-30 05:45 . 2013-01-09 20:56 13312 —-a-w- c:\windows\system32\wow64cpu.dll 2012-11-30 05:45 . 2013-01-09 20:56 215040 —-a-w- c:\windows\system32\winsrv.dll 2012-11-30 05:43 . 2013-01-09 20:56 16384 —-a-w- c:\windows\system32\ntvdm64.dll 2012-11-30 05:41 . 2013-01-09 20:56 424448 —-a-w- c:\windows\system32\KernelBase.dll 2012-11-30 05:41 . 2013-01-09 20:56 1161216 —-a-w- c:\windows\system32\kernel32.dll 2012-11-30 05:38 . 2013-01-09 20:56 6144 —ha-w- c:\windows\system32\api-ms-win-security-base-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 4608 —ha-w- c:\windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 4608 —ha-w- c:\windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 4096 —ha-w- c:\windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 4096 —ha-w- c:\windows\system32\api-ms-win-core-synch-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3584 —ha-w- c:\windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-util-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-string-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-profile-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3584 —ha-w- c:\windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3584 —ha-w- c:\windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3584 —ha-w- c:\windows\system32\api-ms-win-core-misc-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 5120 —ha-w- c:\windows\system32\api-ms-win-core-file-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 4096 —ha-w- c:\windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3584 —ha-w- c:\windows\system32\api-ms-win-core-memory-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3584 —ha-w- c:\windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3584 —ha-w- c:\windows\system32\api-ms-win-core-heap-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-io-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-handle-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 4096 —ha-w- c:\windows\system32\api-ms-win-core-localization-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-debug-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2012-11-30 05:38 . 2013-01-09 20:56 3072 —ha-w- c:\windows\system32\api-ms-win-core-console-l1-1-0.dll 2012-11-30 04:54 . 2013-01-09 20:56 5120 —-a-w- c:\windows\SysWow64\wow32.dll 2012-11-30 04:53 . 2013-01-09 20:56 274944 —-a-w- c:\windows\SysWow64\KernelBase.dll 2012-11-30 04:45 . 2013-01-09 20:56 4608 —ha-w- c:\windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-string-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3584 —ha-w- c:\windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-io-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 4096 —ha-w- c:\windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 5120 —ha-w- c:\windows\SysWow64\api-ms-win-core-file-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 3072 —ha-w- c:\windows\SysWow64\api-ms-win-core-console-l1-1-0.dll 2012-11-30 04:45 . 2013-01-09 20:56 44032 —-a-w- c:\windows\apppatch\acwow64.dll 2012-11-30 03:23 . 2013-01-09 20:56 338432 —-a-w- c:\windows\system32\conhost.exe . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Connectify"="c:\program files (x86)\Connectify\Connectify.exe" [2011-09-29 2967368] "DriverMax"="c:\program files (x86)\Innovative Solutions\DriverMax\drivermax.exe" [2013-01-16 11325304] "Akamai NetSession Interface"="c:\users\BigPapa\AppData\Local\Akamai\netsession_win.exe" [2012-10-09 4441920] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "Dell Registration"="c:\program files (x86)\System Registration\prodreg.exe" [2010-11-10 4144448] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2012-12-18 38112] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352] "RoxWatchTray"="c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [2010-11-25 240112] "Desktop Disc Tool"="c:\program files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [2010-11-17 514544] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696] "AccuWeatherWidget"="c:\program files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" [2012-02-01 968048] "SwitchBoard"="c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096] "AdobeCS5.5ServiceManager"="c:\program files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" [2011-01-12 1523360] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240] "QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2012-10-11 421888] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "Launcher"="c:\program files (x86)\Dell DataSafe Local Backup\Components\Scheduler\Launcher.exe" [2011-08-01 165184] . c:\users\BigPapa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ PdaNet Desktop.lnk - c:\program files (x86)\PdaNet for Android\PdaNetPC.exe [2012-3-10 480880] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 RoxWatch12;Roxio Hard Drive Watcher 12;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe [2010-11-25 219632] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-01-06 36256] R3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64;c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2012-03-02 1431888] R3 RoxMediaDB12OEM;RoxMediaDB12OEM;c:\program files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe [2010-11-25 1116656] R3 SwitchBoard;Adobe SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2012-05-28 1255736] R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2010-03-19 55856] S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\N360x64\0502020.003\SYMDS64.SYS [2011-01-27 450680] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360x64\0502020.003\SYMEFA64.SYS [2011-03-15 912504] S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\BASHDefs\20130116.013\BHDrvx64.sys [2013-01-16 1388120] S1 cnnctfy2;Connectify LightWeight Filter;c:\windows\system32\DRIVERS\cnnctfy2.sys [2012-03-11 31344] S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_5.1.0.29\Definitions\IPSDefs\20130208.004\IDSvia64.sys [2013-02-01 513184] S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\N360x64\0502020.003\Ironx64.SYS [2011-01-27 171128] S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\N360x64\0502020.003\SYMNETS.SYS [2011-04-21 386168] S2 Connectify;Connectify;c:\program files (x86)\Connectify\ConnectifyService.exe [2011-09-29 69632] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-12-14 398184] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-12-14 682344] S2 N360;Norton 360;c:\program files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe [2011-04-17 130008] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480] S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-08-10 138912] S3 IntcDAud;Intel® Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-10-15 317440] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-12-14 24176] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-01-14 413800] . . Contents of the 'Scheduled Tasks' folder . 2013-02-10 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-12 05:59] . 2013-02-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-06 01:15] . 2013-02-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-09-06 01:15] . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-02-14 170264] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-02-14 398616] "Persistence"="c:\windows\system32\igfxpers.exe" [2012-02-14 440600] "DellStage"="c:\program files (x86)\Dell Stage\Dell Stage\stage_primary.exe" [2012-02-01 2195824] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608] "SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2011-03-03 309376] "cAudioFilterAgent"="c:\program files\Conexant\cAudioFilterAgent\cAudioFilterAgent64.exe" [2011-02-25 519296] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm uStart Page = hxxp://www.google.com/ mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = Trusted Zone: dell.com TCP: DhcpNameServer = 192.168.1.1 . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) Wow6432Node-HKCU-Run-AdobeBridge - (no file) Wow6432Node-HKCU-Run-DriverMax_RESTART - (no file) Wow6432Node-HKLM-Run- - (no file) Toolbar-Locked - (no file) AddRemove-vfd-adk - c:\program files (x86)\OApps\vfd-adk_uninstall.exe AddRemove-48e4cff94f039634 - c:\programdata\Best Buy pc app\ClickOnceUninstaller.exe AddRemove-UnityWebPlayer - c:\users\BigPapa\AppData\Local\Unity\WebPlayer\Uninstall.exe . . . [HKEY_LOCAL_MACHINE\system\ControlSet001\services\N360] "ImagePath"="\"c:\program files (x86)\Norton 360\Engine\5.2.2.3\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files (x86)\Norton 360\Engine\5.2.2.3\diMaster.dll\" /prefetch:1" . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_2_202_228_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_2_202_228.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}] @Denied: (A 2) (Everyone) @="IFlashBroker4" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-02-09 19:13:05 ComboFix-quarantined-files.txt 2013-02-10 00:13 . Pre-Run: 888,448,065,536 bytes free Post-Run: 888,315,850,752 bytes free . - - End Of File - - D42FA5D8598DED7BA56CE79F6FFB6D1E