What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Computer Restarts when I connect to Internet [Solved]

38 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16 last edited
Hi

Let's see if we can get it to tun from the harddrive.

Download Farbar Recovery Scan Tool 64-Bit and tranfer it to the sick computer. Save it directly to C:\.

Enter the System Recovery Options using the instructions previously posted.


Once you have entered the System Recovery Options screen:

On the System Recovery Options menu you will get the following options:
  • Startup Repair
    System Restore
    Windows Complete PC Restore
    Windows Memory Diagnostic Tool
    Command Prompt
  • Select Command Prompt
  • In the command window type c:\frst64 and press Enter
  • The tool will start to run.
  • When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It should make a log (FRST.txt) on the C:\ drive. Please copy and paste it to your reply.
Post #18
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 11-04-2013 Ran by [removed] at 15-04-2013 02:02:32 Running from C:\ Windows 7 Home Premium (X64) OS Language: English(US) The current controlset is ControlSet001 ==================== Registry (Whitelisted) =================== HKLM\…\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [8306208 2009-10-20] (Realtek Semiconductor) HKLM\…\Run: [ATT-SST_McciTrayApp] "C:\Program Files\ATT-SST\pcTrayApp.exe" [2792448 2013-02-25] (Alcatel-Lucent) HKLM-x32\…\Run: [LogMeIn Hamachi Ui] "C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" –auto-start [2255360 2012-12-14] (LogMeIn Inc.) HKLM-x32\…\Run: [iTunesHelper] "C:\Program Files (x86)\iTunes\iTunesHelper.exe" [152392 2013-02-20] (Apple Inc.) HKLM-x32\…\Run: [IAStorIcon] C:\Program Files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe [284696 2010-03-03] (Intel Corporation) HKLM-x32\…\Run: [Desktop Disc Tool] "c:\Program Files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [498160 2009-10-15] () HKLM-x32\…\Run: [Dell DataSafe Online] "C:\Program Files (x86)\Dell DataSafe Online\DataSafeOnline.exe" /m [1807680 2010-02-09] () HKLM-x32\…\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [59720 2013-01-28] (Apple Inc.) HKLM-x32\…\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [35696 2009-02-27] (Adobe Systems Incorporated) HKU\Miinutes\…\Run: [Skype] "C:\Program Files (x86)\Skype\Phone\Skype.exe" /minimized /regrun [18642024 2013-02-28] (Skype Technologies S.A.) Winlogon\Notify\GoToAssist: C:\Program Files (x86)\Citrix\GoToAssist\514\G2AWinLogon_x64.dll [X] Tcpip\Parameters: [DhcpNameServer] 192.168.1.254 Startup: C:\ProgramData\Start Menu\Programs\Startup\$McRebootA5E6DEAA56$.lnk ShortcutTarget: $McRebootA5E6DEAA56$.lnk -> C:\Windows\System32\cmd.exe (Microsoft Corporation) Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dell Dock First Run.lnk ShortcutTarget: Dell Dock First Run.lnk -> C:\Program Files\Dell\DellDock\DellDock.exe (Stardock Corporation) ==================== Services (Whitelisted) =================== 2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [241456 2013-02-19] (McAfee, Inc.) 2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [218760 2013-02-19] (McAfee, Inc.) 2 mfevtp; "C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe" [182752 2013-02-19] (McAfee, Inc.) 2 pcCMService64; "C:\Program Files\Common Files\Motive\pcCMService.exe" [460288 2013-02-25] (Alcatel-Lucent) 2 0202931365903457mcinstcleanup; C:\Users\Miinutes\AppData\Local\Temp\020293~1.EXE -cleanup -nolog [x] ==================== Drivers (Whitelisted) ===================== 3 cfwids; C:\Windows\System32\Drivers\cfwids.sys [70112 2013-02-19] (McAfee, Inc.) 3 mfeapfk; C:\Windows\System32\Drivers\mfeapfk.sys [179280 2013-02-19] (McAfee, Inc.) 3 mfeavfk; C:\Windows\System32\Drivers\mfeavfk.sys [309840 2013-02-19] (McAfee, Inc.) 3 mfefirek; C:\Windows\System32\Drivers\mfefirek.sys [515968 2013-02-19] (McAfee, Inc.) 0 mfehidk; C:\Windows\System32\Drivers\mfehidk.sys [771536 2013-02-19] (McAfee, Inc.) 3 mferkdet; C:\Windows\System32\Drivers\mferkdet.sys [106552 2013-02-19] (McAfee, Inc.) 0 mfewfpk; C:\Windows\System32\Drivers\mfewfpk.sys [340216 2013-02-19] (McAfee, Inc.) 3 MREMP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS [43008 2013-02-25] (Printing Communications Assoc., Inc. (PCAUSA)) 3 MRESP50a64; \??\C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS [40960 2013-02-25] (Printing Communications Assoc., Inc. (PCAUSA)) 3 51468513; [x] 3 catchme; \??\C:\ComboFix\catchme.sys [x] 3 mfeavfk01; [x] 3 MREMPR5; \??\C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS [x] 3 MRENDIS5; \??\C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS [x] ==================== NetSvcs (Whitelisted) ==================== ==================== One Month Created Files and Folders ======== 2013-04-15 02:02 - 2013-04-15 02:02 - 00000000 ____D C:\FRST 2013-04-15 00:59 - 2013-04-13 11:51 - 01466775 ___RA (Farbar) C:\FRST64.exe 2013-04-14 21:41 - 2013-04-14 21:41 - 00119530 ____A C:\Users\Miinutes\Desktop\OTL.Txt 2013-04-14 21:41 - 2013-04-14 21:41 - 00046778 ____A C:\Users\Miinutes\Desktop\Extras.Txt 2013-04-14 21:34 - 2013-04-13 08:33 - 00001797 ____A C:\Users\Miinutes\Desktop\texting.txt 2013-04-14 21:26 - 2013-04-13 08:23 - 00602112 ____A (OldTimer Tools) C:\Users\Miinutes\Desktop\OTL.exe 2013-04-14 21:22 - 2013-04-14 21:22 - 00001788 ____A C:\Users\Miinutes\Desktop\aswMBR.txt 2013-04-14 21:22 - 2013-04-14 21:22 - 00000512 ____A C:\Users\Miinutes\Desktop\MBR.dat 2013-04-14 21:20 - 2013-04-13 08:17 - 04745728 ____A (AVAST Software) C:\Users\Miinutes\Desktop\aswMBR.exe 2013-04-13 20:48 - 2013-04-13 20:48 - 00016929 ____A C:\Users\Miinutes\Desktop\combofix1.txt 2013-04-13 20:46 - 2013-04-13 20:46 - 00016929 ____A C:\ComboFix.txt 2013-04-13 20:40 - 2013-04-13 20:46 - 00000000 ____D C:\ComboFix 2013-04-13 20:36 - 2013-04-11 19:05 - 05052052 ____R (Swearware) C:\Users\Miinutes\Desktop\ComboFix.exe 2013-04-13 20:07 - 2013-04-13 20:07 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Motive 2013-04-13 20:07 - 2013-04-13 20:07 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Intel Corporation 2013-04-13 20:07 - 2013-04-13 20:07 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Apple Computer 2013-04-13 20:07 - 2013-04-13 20:07 - 00000000 ____D C:\Users\Miinutes\AppData\Local\DataSafeOnline 2013-04-13 20:00 - 2013-04-13 20:00 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Macrovision 2013-04-13 19:49 - 2013-04-13 19:49 - 00000000 ____D C:\TDSSKiller_Quarantine 2013-04-13 19:48 - 2013-04-12 06:41 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\Miinutes\Desktop\tdsskiller.exe 2013-04-13 09:30 - 2013-04-13 09:30 - 00860776 ____A C:\Windows\Minidump\041313-28002-01.dmp 2013-04-13 09:06 - 2013-04-13 09:06 - 00000000 ____D C:\Users\Miinutes\Documents\My Recordings 2013-04-13 09:06 - 2013-04-13 09:06 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Acoustica 2013-04-13 09:06 - 2013-04-13 09:06 - 00000000 ____D C:\ProgramData\Application Data\Acoustica 2013-04-13 09:06 - 2013-04-13 09:06 - 00000000 ____D C:\ProgramData\Acoustica 2013-04-13 09:00 - 2013-04-13 09:00 - 00009200 ____A C:\Users\Miinutes\Desktop\hijackthis1.txt 2013-04-13 08:59 - 2013-04-13 09:00 - 00009200 ____A C:\Users\Miinutes\Desktop\hijackthis.log 2013-04-13 08:58 - 2013-04-11 19:55 - 00388608 ____A (Trend Micro Inc.) C:\Users\Miinutes\Desktop\HiJackThis.exe 2013-04-13 08:36 - 2013-04-13 08:36 - 00016317 ____A C:\Users\Miinutes\Desktop\combo.txt 2013-04-13 08:20 - 2011-06-26 01:45 - 00256000 ____A C:\Windows\PEV.exe 2013-04-13 08:20 - 2010-11-07 12:20 - 00208896 ____A C:\Windows\MBR.exe 2013-04-13 08:20 - 2009-04-19 23:56 - 00060416 ____A (NirSoft) C:\Windows\NIRCMD.exe 2013-04-13 08:20 - 2000-08-30 19:00 - 00518144 ____A (SteelWerX) C:\Windows\SWREG.exe 2013-04-13 08:20 - 2000-08-30 19:00 - 00406528 ____A (SteelWerX) C:\Windows\SWSC.exe 2013-04-13 08:20 - 2000-08-30 19:00 - 00098816 ____A C:\Windows\sed.exe 2013-04-13 08:20 - 2000-08-30 19:00 - 00080412 ____A C:\Windows\grep.exe 2013-04-13 08:20 - 2000-08-30 19:00 - 00068096 ____A C:\Windows\zip.exe 2013-04-13 08:16 - 2013-04-13 20:46 - 00000000 ____D C:\Qoobox 2013-04-13 08:16 - 2013-04-13 08:27 - 00000000 ____D C:\Windows\erdnt 2013-04-13 07:59 - 2013-04-13 07:59 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Macromedia 2013-04-13 07:59 - 2013-04-13 07:59 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Adobe 2013-04-13 07:57 - 2013-04-13 07:57 - 00000000 ____D C:\Users\Miinutes\AppData\Local\Apple 2013-04-13 07:31 - 2013-04-13 07:31 - 00058840 ____A C:\Users\Miinutes\AppData\Local\GDIPFONTCACHEV1.DAT 2013-04-13 07:27 - 2013-04-13 07:27 - 00276920 ____A C:\Windows\Minidump\041313-45427-01.dmp 2013-04-13 07:25 - 2013-04-13 07:26 - 00000000 ____D C:\ProgramData\Motive 2013-04-13 07:25 - 2013-04-13 07:26 - 00000000 ____D C:\ProgramData\Application Data\Motive 2013-03-29 18:34 - 2013-03-29 18:34 - 00695296 ____A (AnjoCaido) C:\Users\Miinutes\Desktop\Minecraft.exe 2013-03-25 18:27 - 2013-03-25 18:27 - 01790654 ____A C:\Users\Miinutes\Downloads\mcpatcher-3.0.3.exe 2013-03-23 21:35 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\Desktop\Old Firefox Data 2013-03-22 23:52 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files (x86)\Lucky Red 2013-03-22 23:52 - 2013-03-22 23:52 - 00001886 ____A C:\Users\Public\Desktop\Lucky Red.lnk 2013-03-22 23:52 - 2013-03-22 23:52 - 00001886 ____A C:\ProgramData\Desktop\Lucky Red.lnk 2013-03-22 23:51 - 2013-03-22 23:51 - 01438360 ____A (RealTimeGaming Software) C:\Users\Miinutes\Downloads\LuckyRed.exe 2013-03-22 23:08 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\Cool Cat Casino 2013-03-22 23:07 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\VTExtra 2013-03-22 23:06 - 2013-03-22 23:06 - 01536664 ____A (RealTimeGaming Software) C:\Users\Miinutes\Downloads\setup.exe 2013-03-22 23:05 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\7Spins 2013-03-22 23:05 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Application Data\7Spins 2013-03-22 23:05 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\7Spins 2013-03-22 23:04 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Local\VTShared 2013-03-22 23:04 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\7Spins 2013-03-22 23:04 - 2013-03-22 23:04 - 00985832 ____A (Topgame) C:\Users\Miinutes\Downloads\installcasino(3).exe 2013-03-22 23:03 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Local\LibertySlotsCasino 2013-03-22 23:02 - 2013-03-22 23:03 - 02942464 ____A C:\Users\Miinutes\Downloads\libertyslotscasino.msi 2013-03-22 01:22 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\Desktop\GGM 2013-03-22 00:40 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\Documents\Fax 2013-03-21 23:56 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\21Dukes 2013-03-21 23:56 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Application Data\21Dukes 2013-03-21 23:56 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\21Dukes 2013-03-21 23:56 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\21Dukes 2013-03-21 23:55 - 2013-03-21 23:55 - 01073240 ____A (Topgame) C:\Users\Miinutes\Downloads\installcasino(2).exe 2013-03-21 23:54 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Diceland 2013-03-21 23:54 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Diceland 2013-03-21 23:54 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Application Data\Diceland 2013-03-21 23:54 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\Diceland 2013-03-21 23:53 - 2013-03-21 23:53 - 00894784 ____A (Topgame) C:\Users\Miinutes\Downloads\installcasino(1).exe 2013-03-21 23:21 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Rialto 2013-03-21 23:21 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Rialto 2013-03-21 23:21 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Application Data\Rialto 2013-03-21 23:21 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files (x86)\Rialto 2013-03-21 23:20 - 2013-03-21 23:20 - 00757024 ____A (Topgame) C:\Users\Miinutes\Downloads\installcasino.exe 2013-03-21 23:15 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-03-21 23:15 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-03-21 23:03 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files (x86)\Slot Madness Casino 2013-03-21 23:03 - 2013-03-21 23:03 - 01535640 ____A (RealTimeGaming Software) C:\Users\Miinutes\Downloads\SlotMadnessCasinoInstaller.exe 2013-03-21 18:28 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\Buzzluck Casino 2013-03-21 18:28 - 2013-03-21 18:28 - 01537176 ____A (RealTimeGaming Software) C:\Users\Miinutes\Downloads\BuzzLuck.exe 2013-03-21 13:54 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\Desktop\Bukkit Server 2013-03-21 12:32 - 2013-04-13 20:45 - 00000000 ____D C:\Users\Miinutes\AppData\Local\LogMeIn Hamachi 2013-03-21 12:31 - 2013-04-13 07:17 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi 2013-03-21 12:30 - 2013-03-21 12:30 - 04295168 ____A C:\Users\Miinutes\Downloads\hamachi.msi 2013-03-21 12:25 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\Desktop\Server 2013-03-21 01:06 - 2013-03-21 01:06 - 00010774 ____A C:\Users\Miinutes\Downloads\dellsystemdetect.application 2013-03-21 00:35 - 2013-04-13 09:30 - 284384065 ____A C:\Windows\MEMORY.DMP 2013-03-21 00:35 - 2013-04-13 09:30 - 00000000 ____D C:\Windows\Minidump 2013-03-21 00:35 - 2013-03-21 00:35 - 00276920 ____A C:\Windows\Minidump\032113-21200-01.dmp 2013-03-21 00:01 - 2013-04-13 20:07 - 00014437 ____A C:\Windows\setupact.log 2013-03-21 00:01 - 2013-03-21 00:01 - 00000000 ____A C:\Windows\setuperr.log 2013-03-20 23:09 - 2013-03-20 23:09 - 00002169 ____A C:\Users\Public\Desktop\AT&T; Troubleshoot & Resolve Tool.lnk 2013-03-20 23:09 - 2013-03-20 23:09 - 00002169 ____A C:\ProgramData\Desktop\AT&T; Troubleshoot & Resolve Tool.lnk 2013-03-20 23:08 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files\ATT-SST 2013-03-20 23:07 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\ATT-SST 2013-03-20 23:03 - 2013-04-13 07:17 - 00000000 ____D C:\Program Files\Common Files\Motive 2013-03-20 23:02 - 2013-03-20 23:02 - 00385904 ____A C:\Users\Miinutes\Downloads\ATT_SST.exe 2013-03-20 16:09 - 2013-03-20 16:09 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-03-20 11:37 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\.technic 2013-03-20 11:23 - 2013-03-20 11:23 - 00001785 ____A C:\Users\Public\Desktop\iTunes.lnk 2013-03-20 11:23 - 2013-03-20 11:23 - 00001785 ____A C:\ProgramData\Desktop\iTunes.lnk 2013-03-20 11:23 - 2012-08-21 13:01 - 00033240 ____A (GEAR Software Inc.) C:\Windows\System32\Drivers\GEARAspiWDM.sys 2013-03-20 11:22 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Application Data\Apple Computer 2013-03-20 11:22 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Application Data\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-03-20 11:22 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\Apple Computer 2013-03-20 11:22 - 2013-04-13 07:12 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-03-20 11:22 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files\iTunes 2013-03-20 11:22 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files\iPod 2013-03-20 11:22 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-03-20 11:21 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2013-03-20 11:20 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files\Common Files\Apple 2013-03-20 11:20 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files\Bonjour 2013-03-20 11:20 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\Bonjour 2013-03-20 11:19 - 2013-04-13 07:24 - 00000000 ____D C:\ProgramData\Application Data\Apple 2013-03-20 11:19 - 2013-04-13 07:24 - 00000000 ____D C:\ProgramData\Apple 2013-03-20 11:00 - 2013-03-20 11:07 - 90130256 ____A (Apple Inc.) C:\Users\Miinutes\Downloads\iTunes64Setup.exe 2013-03-20 10:14 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\Documents\BYOND 2013-03-20 10:14 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\BYOND 2013-03-20 10:13 - 2013-03-20 10:13 - 03450900 ____A C:\Users\Miinutes\Downloads\498.1163_byond.exe 2013-03-20 09:30 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Local\Microsoft Games 2013-03-19 20:36 - 2013-03-19 20:36 - 00001014 ____A C:\Users\Public\Desktop\Mixcraft 5.lnk 2013-03-19 20:36 - 2013-03-19 20:36 - 00001014 ____A C:\ProgramData\Desktop\Mixcraft 5.lnk 2013-03-19 20:36 - 2009-12-14 15:25 - 00057344 ____A (NexiTech, Inc.) C:\Windows\SysWOW64\Wnaspint.dll 2013-03-19 20:34 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\Acoustica Shared Effects 2013-03-19 20:30 - 2013-04-13 07:11 - 00000000 ____D C:\Program Files (x86)\Acoustica Mixcraft 5 2013-03-19 20:29 - 2013-03-19 20:29 - 00526208 ____A C:\Users\Miinutes\Downloads\Acoustica-Mixcraft-5-Installer.exe 2013-03-19 20:29 - 2009-12-14 15:24 - 00348160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msvcr71.dll 2013-03-19 17:14 - 2013-03-19 17:14 - 00000452 ____A C:\Users\Public\Desktop\Emergency Backup.lnk 2013-03-19 17:14 - 2013-03-19 17:14 - 00000452 ____A C:\ProgramData\Desktop\Emergency Backup.lnk 2013-03-19 17:13 - 2013-04-13 07:11 - 00000000 ____D C:\Emergency 2013-03-19 17:01 - 2013-04-13 07:12 - 00000000 ____D C:\Windows\SMINST 2013-03-19 15:39 - 2013-04-13 21:07 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Skype 2013-03-19 15:35 - 2013-04-13 07:12 - 00000000 ____D C:\Windows\System32\Macromed 2013-03-19 15:35 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files\WinRAR 2013-03-19 15:35 - 2013-03-21 18:33 - 00693976 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-03-19 15:35 - 2013-03-21 18:33 - 00073432 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-03-19 15:35 - 2013-03-19 15:35 - 01656459 ____A C:\Users\Miinutes\Downloads\winrar-x64-420.exe 2013-03-19 15:33 - 2013-03-19 15:34 - 01337960 ____A (Skype Technologies S.A.) C:\Users\Miinutes\Downloads\SkypeSetup.exe 2013-03-19 15:32 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\.minecraft 2013-03-19 15:28 - 2013-04-13 07:33 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Mozilla 2013-03-19 15:28 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Local\Mozilla 2013-03-19 15:28 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-03-19 15:28 - 2013-04-13 07:12 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-03-19 15:28 - 2013-03-19 15:28 - 00001153 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-03-19 15:28 - 2013-03-19 15:28 - 00001153 ____A C:\ProgramData\Desktop\Mozilla Firefox.lnk 2013-03-19 15:27 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\Desktop\Taylor Stuff 2013-03-19 15:27 - 2013-03-19 15:27 - 20564720 ____A (Mozilla) C:\Users\Miinutes\Downloads\Firefox Setup 19.0.2.exe 2013-03-19 15:23 - 2013-04-13 08:58 - 00000000 ____D C:\Users\Miinutes\AppData\Local\VirtualStore 2013-03-19 15:23 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Roxio 2013-03-19 15:23 - 2013-04-13 07:12 - 00000000 ____D C:\Users\Miinutes\AppData\Local\Stardock_Corporation 2013-03-19 15:22 - 2013-03-21 00:50 - 00000073 ____A C:\Windows\SysWOW64\ToasterLauncherLog.log 2013-03-19 15:20 - 2013-04-13 07:28 - 00000000 ____D C:\users\Miinutes 2013-03-19 15:20 - 2013-03-19 15:20 - 00000020 ___SH C:\Users\Miinutes\ntuser.ini ==================== One Month Modified Files and Folders ======= 2013-04-15 02:02 - 2013-04-15 02:02 - 00000000 ____D C:\FRST 2013-04-15 01:00 - 2009-07-14 00:10 - 00121842 ____A C:\Windows\WindowsUpdate.log 2013-04-14 21:41 - 2013-04-14 21:41 - 00119530 ____A C:\Users\Miinutes\Desktop\OTL.Txt 2013-04-14 21:41 - 2013-04-14 21:41 - 00046778 ____A C:\Users\Miinutes\Desktop\Extras.Txt 2013-04-14 21:22 - 2013-04-14 21:22 - 00001788 ____A C:\Users\Miinutes\Desktop\aswMBR.txt 2013-04-14 21:22 - 2013-04-14 21:22 - 00000512 ____A C:\Users\Miinutes\Desktop\MBR.dat 2013-04-13 21:07 - 2013-03-19 15:39 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Skype 2013-04-13 20:48 - 2013-04-13 20:48 - 00016929 ____A C:\Users\Miinutes\Desktop\combofix1.txt 2013-04-13 20:46 - 2013-04-13 20:46 - 00016929 ____A C:\ComboFix.txt 2013-04-13 20:46 - 2013-04-13 20:40 - 00000000 ____D C:\ComboFix 2013-04-13 20:46 - 2013-04-13 08:16 - 00000000 ____D C:\Qoobox 2013-04-13 20:45 - 2013-03-21 12:32 - 00000000 ____D C:\Users\Miinutes\AppData\Local\LogMeIn Hamachi 2013-04-13 20:45 - 2009-07-13 21:34 - 00000215 ____A C:\Windows\system.ini 2013-04-13 20:14 - 2009-07-13 23:45 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2013-04-13 20:14 - 2009-07-13 23:45 - 00014016 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2013-04-13 20:07 - 2013-04-13 20:07 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Motive 2013-04-13 20:07 - 2013-04-13 20:07 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Intel Corporation 2013-04-13 20:07 - 2013-04-13 20:07 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Apple Computer 2013-04-13 20:07 - 2013-04-13 20:07 - 00000000 ____D C:\Users\Miinutes\AppData\Local\DataSafeOnline 2013-04-13 20:07 - 2013-03-21 00:01 - 00014437 ____A C:\Windows\setupact.log 2013-04-13 20:07 - 2010-11-16 20:24 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup 2013-04-13 20:07 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT 2013-04-13 20:00 - 2013-04-13 20:00 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Macrovision 2013-04-13 19:49 - 2013-04-13 19:49 - 00000000 ____D C:\TDSSKiller_Quarantine 2013-04-13 11:51 - 2013-04-15 00:59 - 01466775 ___RA (Farbar) C:\FRST64.exe 2013-04-13 09:30 - 2013-04-13 09:30 - 00860776 ____A C:\Windows\Minidump\041313-28002-01.dmp 2013-04-13 09:30 - 2013-03-21 00:35 - 284384065 ____A C:\Windows\MEMORY.DMP 2013-04-13 09:30 - 2013-03-21 00:35 - 00000000 ____D C:\Windows\Minidump 2013-04-13 09:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\NDF 2013-04-13 09:06 - 2013-04-13 09:06 - 00000000 ____D C:\Users\Miinutes\Documents\My Recordings 2013-04-13 09:06 - 2013-04-13 09:06 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Acoustica 2013-04-13 09:06 - 2013-04-13 09:06 - 00000000 ____D C:\ProgramData\Application Data\Acoustica 2013-04-13 09:06 - 2013-04-13 09:06 - 00000000 ____D C:\ProgramData\Acoustica 2013-04-13 09:00 - 2013-04-13 09:00 - 00009200 ____A C:\Users\Miinutes\Desktop\hijackthis1.txt 2013-04-13 09:00 - 2013-04-13 08:59 - 00009200 ____A C:\Users\Miinutes\Desktop\hijackthis.log 2013-04-13 08:58 - 2013-03-19 15:23 - 00000000 ____D C:\Users\Miinutes\AppData\Local\VirtualStore 2013-04-13 08:46 - 2010-11-16 22:08 - 00017908 ____A C:\Windows\PFRO.log 2013-04-13 08:44 - 2010-11-16 21:43 - 00000000 ____D C:\Windows\Panther 2013-04-13 08:36 - 2013-04-13 08:36 - 00016317 ____A C:\Users\Miinutes\Desktop\combo.txt 2013-04-13 08:33 - 2013-04-14 21:34 - 00001797 ____A C:\Users\Miinutes\Desktop\texting.txt 2013-04-13 08:27 - 2013-04-13 08:16 - 00000000 ____D C:\Windows\erdnt 2013-04-13 08:23 - 2013-04-14 21:26 - 00602112 ____A (OldTimer Tools) C:\Users\Miinutes\Desktop\OTL.exe 2013-04-13 08:17 - 2013-04-14 21:20 - 04745728 ____A (AVAST Software) C:\Users\Miinutes\Desktop\aswMBR.exe 2013-04-13 07:59 - 2013-04-13 07:59 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Macromedia 2013-04-13 07:59 - 2013-04-13 07:59 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Adobe 2013-04-13 07:57 - 2013-04-13 07:57 - 00000000 ____D C:\Users\Miinutes\AppData\Local\Apple 2013-04-13 07:33 - 2013-03-19 15:28 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Mozilla 2013-04-13 07:31 - 2013-04-13 07:31 - 00058840 ____A C:\Users\Miinutes\AppData\Local\GDIPFONTCACHEV1.DAT 2013-04-13 07:31 - 2010-11-16 20:32 - 00000000 ____D C:\ProgramData\McAfee 2013-04-13 07:31 - 2010-11-16 20:32 - 00000000 ____D C:\ProgramData\Application Data\McAfee 2013-04-13 07:28 - 2013-03-19 15:20 - 00000000 ____D C:\users\Miinutes 2013-04-13 07:27 - 2013-04-13 07:27 - 00276920 ____A C:\Windows\Minidump\041313-45427-01.dmp 2013-04-13 07:27 - 2009-07-13 23:45 - 00277616 ____A C:\Windows\System32\FNTCACHE.DAT 2013-04-13 07:26 - 2013-04-13 07:25 - 00000000 ____D C:\ProgramData\Motive 2013-04-13 07:26 - 2013-04-13 07:25 - 00000000 ____D C:\ProgramData\Application Data\Motive 2013-04-13 07:24 - 2013-03-20 11:19 - 00000000 ____D C:\ProgramData\Application Data\Apple 2013-04-13 07:24 - 2013-03-20 11:19 - 00000000 ____D C:\ProgramData\Apple 2013-04-13 07:17 - 2013-03-21 12:31 - 00000000 ____D C:\Program Files (x86)\LogMeIn Hamachi 2013-04-13 07:17 - 2013-03-20 23:03 - 00000000 ____D C:\Program Files\Common Files\Motive 2013-04-13 07:16 - 2009-07-14 02:45 - 00000000 ____D C:\Windows\ShellNew 2013-04-13 07:16 - 2009-07-14 02:45 - 00000000 ____D C:\Program Files\Windows Journal 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\System32\WinBioPlugIns 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\addins 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\Windows Sidebar 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\Windows Portable Devices 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\Windows Defender 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\DVD Maker 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer 2013-04-13 07:16 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 __RSD C:\Windows\Media 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\uk-UA 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\th-TH 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\sr-Latn-CS 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\sppui 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\sl-SI 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\sk-SK 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\Setup 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\ro-RO 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\ras 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\oobe 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\migwiz 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\manifeststore 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\lv-LV 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\lt-LT 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\InstallShield 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\icsxml 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\hr-HR 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\he-IL 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\et-EE 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\Dism 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\com 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\bg-BG 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\ar-SA 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\AdvancedInstallers 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\zh-HK 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\uk-UA 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\tr-TR 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\th-TH 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\sysprep 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\sr-Latn-CS 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\sppui 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\sl-SI 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\sk-SK 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\Setup 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\ro-RO 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\ras 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\oobe 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\migwiz 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\manifeststore 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\lv-LV 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\lt-LT 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\icsxml 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\ias 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\hr-HR 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\he-IL 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\et-EE 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\Dism 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\com 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\bg-BG 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\ar-SA 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\AdvancedInstallers 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\servicing 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PolicyDefinitions 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\L2Schemas 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\IME 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Cursors 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\System 2013-04-13 07:16 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\Services 2013-04-13 07:13 - 2010-11-16 22:10 - 00000000 ____D C:\Windows\SysWOW64\RTCOM 2013-04-13 07:13 - 2010-11-16 22:09 - 00000000 ____D C:\Windows\SysWOW64\x64 2013-04-13 07:13 - 2010-11-16 20:14 - 00000000 ____D C:\Windows\SysWOW64\Macromed 2013-04-13 07:13 - 2009-07-14 00:37 - 00000000 ____D C:\Windows\SysWOW64\winrm 2013-04-13 07:13 - 2009-07-14 00:37 - 00000000 ____D C:\Windows\SysWOW64\WCN 2013-04-13 07:13 - 2009-07-14 00:37 - 00000000 ____D C:\Windows\SysWOW64\slmgr 2013-04-13 07:13 - 2009-07-14 00:37 - 00000000 ____D C:\Windows\SysWOW64\Printing_Admin_Scripts 2013-04-13 07:13 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\SysWOW64\WindowsPowerShell 2013-04-13 07:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\TAPI 2013-04-13 07:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\spp 2013-04-13 07:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\Speech 2013-04-13 07:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\Recovery 2013-04-13 07:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\MUI 2013-04-13 07:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\Msdtc 2013-04-13 07:13 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\IME 2013-04-13 07:12 - 2013-03-23 21:35 - 00000000 ____D C:\Users\Miinutes\Desktop\Old Firefox Data 2013-04-13 07:12 - 2013-03-22 23:52 - 00000000 ____D C:\Program Files (x86)\Lucky Red 2013-04-13 07:12 - 2013-03-22 23:07 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\VTExtra 2013-04-13 07:12 - 2013-03-22 23:05 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\7Spins 2013-04-13 07:12 - 2013-03-22 23:05 - 00000000 ____D C:\ProgramData\Application Data\7Spins 2013-04-13 07:12 - 2013-03-22 23:05 - 00000000 ____D C:\ProgramData\7Spins 2013-04-13 07:12 - 2013-03-22 23:04 - 00000000 ____D C:\Users\Miinutes\AppData\Local\VTShared 2013-04-13 07:12 - 2013-03-22 23:03 - 00000000 ____D C:\Users\Miinutes\AppData\Local\LibertySlotsCasino 2013-04-13 07:12 - 2013-03-22 01:22 - 00000000 ____D C:\Users\Miinutes\Desktop\GGM 2013-04-13 07:12 - 2013-03-22 00:40 - 00000000 ____D C:\Users\Miinutes\Documents\Fax 2013-04-13 07:12 - 2013-03-21 23:56 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\21Dukes 2013-04-13 07:12 - 2013-03-21 23:56 - 00000000 ____D C:\ProgramData\Application Data\21Dukes 2013-04-13 07:12 - 2013-03-21 23:56 - 00000000 ____D C:\ProgramData\21Dukes 2013-04-13 07:12 - 2013-03-21 23:54 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Diceland 2013-04-13 07:12 - 2013-03-21 23:54 - 00000000 ____D C:\ProgramData\Diceland 2013-04-13 07:12 - 2013-03-21 23:54 - 00000000 ____D C:\ProgramData\Application Data\Diceland 2013-04-13 07:12 - 2013-03-21 23:21 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Rialto 2013-04-13 07:12 - 2013-03-21 23:21 - 00000000 ____D C:\ProgramData\Rialto 2013-04-13 07:12 - 2013-03-21 23:21 - 00000000 ____D C:\ProgramData\Application Data\Rialto 2013-04-13 07:12 - 2013-03-21 23:21 - 00000000 ____D C:\Program Files (x86)\Rialto 2013-04-13 07:12 - 2013-03-21 23:15 - 00000000 ____D C:\Program Files\Microsoft Silverlight 2013-04-13 07:12 - 2013-03-21 23:15 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight 2013-04-13 07:12 - 2013-03-21 23:03 - 00000000 ____D C:\Program Files (x86)\Slot Madness Casino 2013-04-13 07:12 - 2013-03-21 13:54 - 00000000 ____D C:\Users\Miinutes\Desktop\Bukkit Server 2013-04-13 07:12 - 2013-03-21 12:25 - 00000000 ____D C:\Users\Miinutes\Desktop\Server 2013-04-13 07:12 - 2013-03-20 23:08 - 00000000 ____D C:\Program Files\ATT-SST 2013-04-13 07:12 - 2013-03-20 11:37 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\.technic 2013-04-13 07:12 - 2013-03-20 11:22 - 00000000 ____D C:\ProgramData\Application Data\Apple Computer 2013-04-13 07:12 - 2013-03-20 11:22 - 00000000 ____D C:\ProgramData\Application Data\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-04-13 07:12 - 2013-03-20 11:22 - 00000000 ____D C:\ProgramData\Apple Computer 2013-04-13 07:12 - 2013-03-20 11:22 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-04-13 07:12 - 2013-03-20 11:22 - 00000000 ____D C:\Program Files\iTunes 2013-04-13 07:12 - 2013-03-20 11:22 - 00000000 ____D C:\Program Files\iPod 2013-04-13 07:12 - 2013-03-20 11:20 - 00000000 ____D C:\Program Files\Common Files\Apple 2013-04-13 07:12 - 2013-03-20 11:20 - 00000000 ____D C:\Program Files\Bonjour 2013-04-13 07:12 - 2013-03-20 10:14 - 00000000 ____D C:\Users\Miinutes\Documents\BYOND 2013-04-13 07:12 - 2013-03-20 09:30 - 00000000 ____D C:\Users\Miinutes\AppData\Local\Microsoft Games 2013-04-13 07:12 - 2013-03-19 17:01 - 00000000 ____D C:\Windows\SMINST 2013-04-13 07:12 - 2013-03-19 15:35 - 00000000 ____D C:\Windows\System32\Macromed 2013-04-13 07:12 - 2013-03-19 15:35 - 00000000 ____D C:\Program Files\WinRAR 2013-04-13 07:12 - 2013-03-19 15:32 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\.minecraft 2013-04-13 07:12 - 2013-03-19 15:28 - 00000000 ____D C:\Users\Miinutes\AppData\Local\Mozilla 2013-04-13 07:12 - 2013-03-19 15:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service 2013-04-13 07:12 - 2013-03-19 15:28 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox 2013-04-13 07:12 - 2013-03-19 15:27 - 00000000 ____D C:\Users\Miinutes\Desktop\Taylor Stuff 2013-04-13 07:12 - 2013-03-19 15:23 - 00000000 ____D C:\Users\Miinutes\AppData\Roaming\Roxio 2013-04-13 07:12 - 2013-03-19 15:23 - 00000000 ____D C:\Users\Miinutes\AppData\Local\Stardock_Corporation 2013-04-13 07:12 - 2010-11-16 22:10 - 00000000 ____D C:\Program Files\Realtek 2013-04-13 07:12 - 2010-11-16 20:35 - 00000000 __HDC C:\ProgramData\Application Data\{D19C2D22-6043-47E7-B400-83A351841204} 2013-04-13 07:12 - 2010-11-16 20:35 - 00000000 __HDC C:\ProgramData\{D19C2D22-6043-47E7-B400-83A351841204} 2013-04-13 07:12 - 2010-11-16 20:32 - 00000000 ____D C:\Program Files\mcafee 2013-04-13 07:12 - 2010-11-16 20:32 - 00000000 ____D C:\Program Files\Common Files\mcafee 2013-04-13 07:12 - 2010-11-16 20:32 - 00000000 ____D C:\Program Files (x86)\mcafee.com 2013-04-13 07:12 - 2010-11-16 20:32 - 00000000 ____D C:\Program Files (x86)\McAfee 2013-04-13 07:12 - 2010-11-16 20:31 - 00000000 ___RD C:\Program Files (x86)\Skype 2013-04-13 07:12 - 2010-11-16 20:30 - 00000000 ____D C:\ProgramData\Skype 2013-04-13 07:12 - 2010-11-16 20:30 - 00000000 ____D C:\ProgramData\Application Data\Skype 2013-04-13 07:12 - 2010-11-16 20:27 - 00000000 ____D C:\Program Files (x86)\Windows Live SkyDrive 2013-04-13 07:12 - 2010-11-16 20:27 - 00000000 ____D C:\Program Files (x86)\Windows Live 2013-04-13 07:12 - 2010-11-16 20:20 - 00000000 ____D C:\ProgramData\WildTangent 2013-04-13 07:12 - 2010-11-16 20:20 - 00000000 ____D C:\ProgramData\Application Data\WildTangent 2013-04-13 07:12 - 2010-11-16 20:20 - 00000000 ____D C:\Program Files (x86)\Microsoft CAPICOM 2.1.0.2 2013-04-13 07:12 - 2010-11-16 20:14 - 00000000 ____D C:\Program Files\Dell Inc 2013-04-13 07:12 - 2009-07-14 02:44 - 00000000 ___RD C:\Users\Public\Recorded TV 2013-04-13 07:12 - 2009-07-14 00:37 - 00000000 ____D C:\Windows\System32\WCN 2013-04-13 07:12 - 2009-07-14 00:37 - 00000000 ____D C:\Windows\System32\slmgr 2013-04-13 07:12 - 2009-07-14 00:37 - 00000000 ____D C:\Windows\System32\Printing_Admin_Scripts 2013-04-13 07:12 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\System32\WindowsPowerShell 2013-04-13 07:12 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\System32\restore 2013-04-13 07:12 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\Offline Web Pages 2013-04-13 07:12 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\Reference Assemblies 2013-04-13 07:12 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\MSBuild 2013-04-13 07:12 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files\Microsoft Games 2013-04-13 07:12 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files (x86)\MSBuild 2013-04-13 07:12 - 2009-07-13 23:45 - 00000000 ____D C:\Windows\Setup 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 __RHD C:\Users\Public\Libraries 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\spp 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\Speech 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\SMI 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\MUI 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\Msdtc 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\IME 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Speech 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\security 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\schemas 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Resources 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PLA 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Help 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Globalization 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Branding 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\AppCompat 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Windows NT 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\Microsoft Shared 2013-04-13 07:12 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files (x86)\Windows NT 2013-04-13 07:11 - 2013-03-22 23:08 - 00000000 ____D C:\Program Files (x86)\Cool Cat Casino 2013-04-13 07:11 - 2013-03-22 23:04 - 00000000 ____D C:\Program Files (x86)\7Spins 2013-04-13 07:11 - 2013-03-21 23:56 - 00000000 ____D C:\Program Files (x86)\21Dukes 2013-04-13 07:11 - 2013-03-21 23:54 - 00000000 ____D C:\Program Files (x86)\Diceland 2013-04-13 07:11 - 2013-03-21 18:28 - 00000000 ____D C:\Program Files (x86)\Buzzluck Casino 2013-04-13 07:11 - 2013-03-20 23:07 - 00000000 ____D C:\Program Files (x86)\ATT-SST 2013-04-13 07:11 - 2013-03-20 11:22 - 00000000 ____D C:\Program Files (x86)\iTunes 2013-04-13 07:11 - 2013-03-20 11:21 - 00000000 ____D C:\Program Files (x86)\Apple Software Update 2013-04-13 07:11 - 2013-03-20 11:20 - 00000000 ____D C:\Program Files (x86)\Bonjour 2013-04-13 07:11 - 2013-03-20 10:14 - 00000000 ____D C:\Program Files (x86)\BYOND 2013-04-13 07:11 - 2013-03-19 20:34 - 00000000 ____D C:\Program Files (x86)\Acoustica Shared Effects 2013-04-13 07:11 - 2013-03-19 20:30 - 00000000 ____D C:\Program Files (x86)\Acoustica Mixcraft 5 2013-04-13 07:11 - 2013-03-19 17:13 - 00000000 ____D C:\Emergency 2013-04-13 07:11 - 2010-11-16 21:35 - 00000000 ____D C:\dell 2013-04-13 07:11 - 2010-11-16 20:20 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Online 2013-04-13 07:11 - 2010-11-16 20:19 - 00000000 ____D C:\Program Files (x86)\Citrix 2013-04-13 07:11 - 2009-07-14 00:08 - 00000000 ____D C:\users\Administrator 2013-04-13 07:07 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration 2013-04-13 06:57 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Web 2013-04-13 06:57 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\Vss 2013-04-13 06:56 - 2010-11-16 22:09 - 00000000 ____D C:\Windows\SysWOW64\Lang 2013-04-13 06:56 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\NetworkList 2013-04-13 06:50 - 2009-07-14 00:37 - 00000000 ____D C:\Windows\System32\winrm 2013-04-13 06:49 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\spool 2013-04-13 06:48 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\NetworkList 2013-04-13 06:40 - 2009-07-14 00:32 - 00000000 ____D C:\Windows\Performance 2013-04-13 06:35 - 2009-07-13 22:20 - 00000000 __RHD C:\users\Default 2013-04-13 06:34 - 2010-11-16 20:32 - 00000000 ____D C:\ProgramData\Uninstall 2013-04-13 06:34 - 2010-11-16 20:32 - 00000000 ____D C:\ProgramData\Application Data\Uninstall 2013-04-13 06:33 - 2010-11-16 20:35 - 00000000 ____D C:\ProgramData\Dell 2013-04-13 06:33 - 2010-11-16 20:35 - 00000000 ____D C:\ProgramData\Application Data\Dell 2013-04-13 06:33 - 2010-11-16 20:31 - 00000000 ____D C:\ProgramData\Macrovision 2013-04-13 06:33 - 2010-11-16 20:31 - 00000000 ____D C:\ProgramData\Application Data\Macrovision 2013-04-13 06:32 - 2010-11-16 20:32 - 00000000 ____D C:\Program Files\mcafee.com 2013-04-13 06:32 - 2010-11-16 20:15 - 00000000 ____D C:\Program Files\Java 2013-04-13 06:31 - 2010-11-16 20:35 - 00000000 ____D C:\Program Files\Dell 2013-04-13 06:31 - 2009-07-13 22:20 - 00000000 ____D C:\Program Files\Common Files\SpeechEngines 2013-04-13 06:30 - 2010-11-16 20:34 - 00000000 ____D C:\Program Files (x86)\Microsoft Office 2013-04-13 06:30 - 2010-11-16 20:31 - 00000000 ____D C:\Program Files (x86)\Roxio 2013-04-13 06:30 - 2010-11-16 20:30 - 00000000 ____D C:\Program Files (x86)\Microsoft Sync Framework 2013-04-13 06:30 - 2010-11-16 20:29 - 00000000 ____D C:\Program Files (x86)\Microsoft SQL Server Compact Edition 2013-04-13 06:30 - 2010-11-16 20:20 - 00000000 ____D C:\Program Files (x86)\WildTangent 2013-04-13 06:30 - 2009-07-14 00:32 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies 2013-04-13 06:29 - 2010-11-16 20:39 - 00000000 ____D C:\Program Files (x86)\Dell 2013-04-13 06:29 - 2010-11-16 20:15 - 00000000 ___HD C:\Program Files (x86)\InstallShield Installation Information 2013-04-13 06:29 - 2010-11-16 20:15 - 00000000 ____D C:\Program Files (x86)\Java 2013-04-13 06:29 - 2010-11-16 20:15 - 00000000 ____D C:\Program Files (x86)\Intel 2013-04-13 06:27 - 2010-11-16 20:18 - 00000000 ____D C:\Program Files (x86)\Adobe 2013-04-12 06:41 - 2013-04-13 19:48 - 02237968 ____A (Kaspersky Lab ZAO) C:\Users\Miinutes\Desktop\tdsskiller.exe 2013-04-11 19:55 - 2013-04-13 08:58 - 00388608 ____A (Trend Micro Inc.) C:\Users\Miinutes\Desktop\HiJackThis.exe 2013-04-11 19:05 - 2013-04-13 20:36 - 05052052 ____R (Swearware) C:\Users\Miinutes\Desktop\ComboFix.exe 2013-03-29 18:34 - 2013-03-29 18:34 - 00695296 ____A (AnjoCaido) C:\Users\Miinutes\Desktop\Minecraft.exe 2013-03-27 07:15 - 2009-07-14 00:13 - 00713888 ____A C:\Windows\System32\PerfStringBackup.INI 2013-03-25 18:27 - 2013-03-25 18:27 - 01790654 ____A C:\Users\Miinutes\Downloads\mcpatcher-3.0.3.exe 2013-03-22 23:52 - 2013-03-22 23:52 - 00001886 ____A C:\Users\Public\Desktop\Lucky Red.lnk 2013-03-22 23:52 - 2013-03-22 23:52 - 00001886 ____A C:\ProgramData\Desktop\Lucky Red.lnk 2013-03-22 23:51 - 2013-03-22 23:51 - 01438360 ____A (RealTimeGaming Software) C:\Users\Miinutes\Downloads\LuckyRed.exe 2013-03-22 23:06 - 2013-03-22 23:06 - 01536664 ____A (RealTimeGaming Software) C:\Users\Miinutes\Downloads\setup.exe 2013-03-22 23:04 - 2013-03-22 23:04 - 00985832 ____A (Topgame) C:\Users\Miinutes\Downloads\installcasino(3).exe 2013-03-22 23:03 - 2013-03-22 23:02 - 02942464 ____A C:\Users\Miinutes\Downloads\libertyslotscasino.msi 2013-03-21 23:55 - 2013-03-21 23:55 - 01073240 ____A (Topgame) C:\Users\Miinutes\Downloads\installcasino(2).exe 2013-03-21 23:53 - 2013-03-21 23:53 - 00894784 ____A (Topgame) C:\Users\Miinutes\Downloads\installcasino(1).exe 2013-03-21 23:20 - 2013-03-21 23:20 - 00757024 ____A (Topgame) C:\Users\Miinutes\Downloads\installcasino.exe 2013-03-21 23:03 - 2013-03-21 23:03 - 01535640 ____A (RealTimeGaming Software) C:\Users\Miinutes\Downloads\SlotMadnessCasinoInstaller.exe 2013-03-21 18:33 - 2013-03-19 15:35 - 00693976 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2013-03-21 18:33 - 2013-03-19 15:35 - 00073432 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2013-03-21 18:28 - 2013-03-21 18:28 - 01537176 ____A (RealTimeGaming Software) C:\Users\Miinutes\Downloads\BuzzLuck.exe 2013-03-21 12:30 - 2013-03-21 12:30 - 04295168 ____A C:\Users\Miinutes\Downloads\hamachi.msi 2013-03-21 01:06 - 2013-03-21 01:06 - 00010774 ____A C:\Users\Miinutes\Downloads\dellsystemdetect.application 2013-03-21 00:50 - 2013-03-19 15:22 - 00000073 ____A C:\Windows\SysWOW64\ToasterLauncherLog.log 2013-03-21 00:35 - 2013-03-21 00:35 - 00276920 ____A C:\Windows\Minidump\032113-21200-01.dmp 2013-03-21 00:01 - 2013-03-21 00:01 - 00000000 ____A C:\Windows\setuperr.log 2013-03-20 23:09 - 2013-03-20 23:09 - 00002169 ____A C:\Users\Public\Desktop\AT&T; Troubleshoot & Resolve Tool.lnk 2013-03-20 23:09 - 2013-03-20 23:09 - 00002169 ____A C:\ProgramData\Desktop\AT&T; Troubleshoot & Resolve Tool.lnk 2013-03-20 23:02 - 2013-03-20 23:02 - 00385904 ____A C:\Users\Miinutes\Downloads\ATT_SST.exe 2013-03-20 16:09 - 2013-03-20 16:09 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_User_WpdMtpDr_01_09_00.Wdf 2013-03-20 11:23 - 2013-03-20 11:23 - 00001785 ____A C:\Users\Public\Desktop\iTunes.lnk 2013-03-20 11:23 - 2013-03-20 11:23 - 00001785 ____A C:\ProgramData\Desktop\iTunes.lnk 2013-03-20 11:07 - 2013-03-20 11:00 - 90130256 ____A (Apple Inc.) C:\Users\Miinutes\Downloads\iTunes64Setup.exe 2013-03-20 10:13 - 2013-03-20 10:13 - 03450900 ____A C:\Users\Miinutes\Downloads\498.1163_byond.exe 2013-03-19 20:36 - 2013-03-19 20:36 - 00001014 ____A C:\Users\Public\Desktop\Mixcraft 5.lnk 2013-03-19 20:36 - 2013-03-19 20:36 - 00001014 ____A C:\ProgramData\Desktop\Mixcraft 5.lnk 2013-03-19 20:29 - 2013-03-19 20:29 - 00526208 ____A C:\Users\Miinutes\Downloads\Acoustica-Mixcraft-5-Installer.exe 2013-03-19 17:14 - 2013-03-19 17:14 - 00000452 ____A C:\Users\Public\Desktop\Emergency Backup.lnk 2013-03-19 17:14 - 2013-03-19 17:14 - 00000452 ____A C:\ProgramData\Desktop\Emergency Backup.lnk 2013-03-19 15:35 - 2013-03-19 15:35 - 01656459 ____A C:\Users\Miinutes\Downloads\winrar-x64-420.exe 2013-03-19 15:34 - 2013-03-19 15:33 - 01337960 ____A (Skype Technologies S.A.) C:\Users\Miinutes\Downloads\SkypeSetup.exe 2013-03-19 15:28 - 2013-03-19 15:28 - 00001153 ____A C:\Users\Public\Desktop\Mozilla Firefox.lnk 2013-03-19 15:28 - 2013-03-19 15:28 - 00001153 ____A C:\ProgramData\Desktop\Mozilla Firefox.lnk 2013-03-19 15:27 - 2013-03-19 15:27 - 20564720 ____A (Mozilla) C:\Users\Miinutes\Downloads\Firefox Setup 19.0.2.exe 2013-03-19 15:20 - 2013-03-19 15:20 - 00000020 ___SH C:\Users\Miinutes\ntuser.ini ==================== Known DLLs (Whitelisted) ================= ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\…\.exe: exefile => OK HKLM\…\exefile\DefaultIcon: %1 => OK HKLM\…\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2013-03-29 18:53:34 Restore point made on: 2013-03-29 18:55:34 Restore point made on: 2013-03-29 19:45:48 Restore point made on: 2013-03-30 00:15:53 Restore point made on: 2013-03-31 13:20:46 Restore point made on: 2013-04-01 19:49:08 Restore point made on: 2013-04-10 11:45:05 ==================== Memory info =========================== Percentage of memory in use: 14% Total physical RAM: 4060.99 MB Available physical RAM: 3490.54 MB Total Pagefile: 4059.14 MB Available Pagefile: 3480.87 MB Total Virtual: 8192 MB Available Virtual: 8191.89 MB ==================== Partitions ============================= 1 Drive c: (OS) (Fixed) (Total:584.69 GB) (Free:470.47 GB) NTFS 3 Drive e: (RECOVERY) (Fixed) (Total:11.44 GB) (Free:3.49 GB) NTFS ==>[System with boot components (obtained from reading drive)] 8 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS Disk ### Status Size Free Dyn Gpt ——– ————- ——- ——- — — Disk 0 Online 596 GB 0 B Disk 1 No Media 0 B 0 B Disk 2 No Media 0 B 0 B Disk 3 No Media 0 B 0 B Disk 4 No Media 0 B 0 B Partitions of Disk 0: =============== Disk ID: 259D4594 Partition ### Type Size Offset ————- —————- ——- ——- Partition 1 OEM 39 MB 31 KB Partition 2 Primary 11 GB 40 MB Partition 3 Primary 584 GB 11 GB ================================================================================ == Disk: 0 Partition 1 Type : DE Hidden: Yes Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 7 FAT Partition 39 MB Healthy Hidden ========================================================= Disk: 0 Partition 2 Type : 07 Hidden: No Active: Yes Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 1 E RECOVERY NTFS Partition 11 GB Healthy ========================================================= Disk: 0 Partition 3 Type : 07 Hidden: No Active: No Volume ### Ltr Label Fs Type Size Status Info ———- — ———– —– ———- ——- ——— ——– * Volume 2 C OS NTFS Partition 584 GB Healthy ========================================================= ============================== MBR Partition Table ================== ============================== Partitions of Disk 0: =============== Disk ID: 259D4594 Partition 1: ========= Hex: 00010100DEFE3F043F00000086390100 Active: NO Type: DE Size: 39 MB Partition 2: ========= Hex: 8019150507FEFFFF0040010000306E01 Active: YES Type: 07 (NTFS) Size: 11 GB Partition 3: ========= Hex: 00FEFFFF07FEFFFF00706F0100081649 Active: NO Type: 07 (NTFS) Size: 585 GB Last Boot: 2010-11-16 22:08 ==================== End Of Log =============================
Post #19 last edited
Hi When you ran aswMBR a log named mbr.dat should have been created on the desktop. Please zip it and attach it to your next reply. Rerun combofix and post the log.
Post #20
ComboFix 13-04-11.01 - Miinutes 04/15/2013 2:46.3.2 - x64 Microsoft Windows 7 Home Premium 6.1.7600.0.1252.1.1033.18.4061.3068 [GMT -5:00] Running from: c:\users\[removed]\Desktop\ComboFix.exe SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((( Files Created from 2013-03-15 to 2013-04-15 ))))))))))))))))))))))))))))))) . . 2013-04-15 07:50 . 2013-04-15 07:50 ——– d—–w- c:\users\Default\AppData\Local\temp 2013-04-15 07:50 . 2013-04-15 07:50 ——– d—–w- c:\users\Administrator\AppData\Local\temp 2013-04-15 07:02 . 2013-04-15 07:02 ——– d—–w- C:\FRST 2013-04-14 00:49 . 2013-04-14 00:49 ——– d—–w- C:\TDSSKiller_Quarantine 2013-04-13 14:06 . 2013-04-13 14:06 ——– d—–w- c:\programdata\Acoustica 2013-04-13 12:25 . 2013-04-13 12:26 ——– d—–w- c:\programdata\Motive 2013-03-23 04:52 . 2013-04-13 12:12 ——– d—–w- c:\program files (x86)\Lucky Red 2013-03-23 04:08 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Cool Cat Casino 2013-03-23 04:05 . 2013-04-13 12:12 ——– d—–w- c:\programdata\7Spins 2013-03-23 04:04 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\7Spins 2013-03-22 04:56 . 2013-04-13 12:12 ——– d—–w- c:\programdata\21Dukes 2013-03-22 04:56 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\21Dukes 2013-03-22 04:54 . 2013-04-13 12:12 ——– d—–w- c:\programdata\Diceland 2013-03-22 04:54 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Diceland 2013-03-22 04:21 . 2013-04-13 12:12 ——– d—–w- c:\programdata\Rialto 2013-03-22 04:21 . 2013-04-13 12:12 ——– d—–w- c:\program files (x86)\Rialto 2013-03-22 04:15 . 2013-04-13 12:12 ——– d—–w- c:\program files\Microsoft Silverlight 2013-03-22 04:15 . 2013-04-13 12:12 ——– d—–w- c:\program files (x86)\Microsoft Silverlight 2013-03-22 04:03 . 2013-04-13 12:12 ——– d—–w- c:\program files (x86)\Slot Madness Casino 2013-03-21 23:28 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Buzzluck Casino 2013-03-21 17:31 . 2013-04-13 12:17 ——– d—–w- c:\program files (x86)\LogMeIn Hamachi 2013-03-21 04:08 . 2013-04-13 12:12 ——– d—–w- c:\program files\ATT-SST 2013-03-21 04:07 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\ATT-SST 2013-03-21 04:03 . 2013-04-13 12:17 ——– d—–w- c:\program files (x86)\Common Files\Motive 2013-03-21 04:03 . 2013-04-13 12:17 ——– d—–w- c:\program files\Common Files\Motive 2013-03-20 16:23 . 2013-04-13 12:12 ——– d—–w- c:\windows\system32\DRVSTORE 2013-03-20 16:23 . 2012-08-21 18:01 33240 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys 2013-03-20 16:22 . 2013-04-13 12:12 ——– d—–w- c:\program files\iPod 2013-03-20 16:22 . 2013-04-13 12:12 ——– d—–w- c:\programdata\Apple Computer 2013-03-20 16:22 . 2013-04-13 12:12 ——– d—–w- c:\programdata\34BE82C4-E596-4e99-A191-52C6199EBF69 2013-03-20 16:22 . 2013-04-13 12:12 ——– d—–w- c:\program files\iTunes 2013-03-20 16:22 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\iTunes 2013-03-20 16:21 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Apple Software Update 2013-03-20 16:20 . 2013-04-13 12:12 ——– d—–w- c:\program files\Common Files\Apple 2013-03-20 16:20 . 2013-04-13 12:12 ——– d—–w- c:\program files\Bonjour 2013-03-20 16:20 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Bonjour 2013-03-20 16:19 . 2013-04-13 12:24 ——– d—–w- c:\programdata\Apple 2013-03-20 16:19 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Common Files\Apple 2013-03-20 15:14 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\BYOND 2013-03-20 01:36 . 2009-12-14 20:25 57344 —-a-w- c:\windows\SysWow64\Wnaspint.dll 2013-03-20 01:34 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Acoustica Shared Effects 2013-03-20 01:30 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Acoustica Mixcraft 5 2013-03-20 01:29 . 2009-12-14 20:24 348160 —-a-w- c:\windows\SysWow64\msvcr71.dll 2013-03-19 22:13 . 2013-04-13 12:11 ——– d—–w- C:\Emergency 2013-03-19 22:01 . 2013-04-13 12:12 ——– d—–w- c:\windows\SMINST 2013-03-19 20:38 . 2013-04-13 12:11 ——– d—–w- c:\program files (x86)\Common Files\Skype 2013-03-19 20:35 . 2013-04-13 12:12 ——– d—–w- c:\program files\WinRAR 2013-03-19 20:35 . 2013-03-21 23:33 73432 —-a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-03-19 20:35 . 2013-03-21 23:33 693976 —-a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2013-03-19 20:35 . 2013-04-13 12:12 ——– d—–w- c:\windows\system32\Macromed 2013-03-19 20:28 . 2013-04-13 12:12 ——– d—–w- c:\program files (x86)\Mozilla Maintenance Service 2013-03-19 20:20 . 2013-04-13 12:28 ——– d—–w- c:\users\Miinutes . . . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2013-02-19 18:59 . 2010-01-06 00:04 70112 —-a-w- c:\windows\system32\drivers\cfwids.sys 2013-02-19 18:56 . 2010-01-06 00:04 340216 —-a-w- c:\windows\system32\drivers\mfewfpk.sys 2013-02-19 18:55 . 2010-11-17 01:32 10728 —-a-w- c:\windows\system32\drivers\mfeclnk.sys 2013-02-19 18:55 . 2010-01-06 00:04 106552 —-a-w- c:\windows\system32\drivers\mferkdet.sys 2013-02-19 18:54 . 2010-01-06 00:04 771536 —-a-w- c:\windows\system32\drivers\mfehidk.sys 2013-02-19 18:53 . 2010-01-06 00:04 515968 —-a-w- c:\windows\system32\drivers\mfefirek.sys 2013-02-19 18:53 . 2010-01-06 00:04 309840 —-a-w- c:\windows\system32\drivers\mfeavfk.sys 2013-02-19 18:52 . 2010-01-06 00:04 179280 —-a-w- c:\windows\system32\drivers\mfeapfk.sys . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2013-02-28 18642024] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "LogMeIn Hamachi Ui"="c:\program files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe" [2012-12-14 2255360] "iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2013-02-20 152392] "IAStorIcon"="c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696] "Desktop Disc Tool"="c:\program files (x86)\Roxio\Roxio Burn\RoxioBurnLauncher.exe" [2009-10-15 498160] "Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2010-02-09 1807680] "APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2013-01-28 59720] "Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] . c:\users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dell Dock First Run.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-12-15 1324384] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS] @="" . R2 0202931365903457mcinstcleanup;McAfee Application Installer Cleanup (0202931365903457);c:\users\Miinutes\AppData\Local\Temp\020293~1.EXE [x] R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2013-01-31 3289208] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-02-28 161384] R3 51468513;51468513; [x] R3 BrSerIb;Brother MFC Serial Interface Driver(WDM);c:\windows\system32\DRIVERS\BrSerIb.sys [2009-07-14 281088] R3 BrUsbSIb;Brother MFC Serial USB Driver(WDM);c:\windows\system32\DRIVERS\BrUsbSIb.sys [2009-06-10 15360] R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2013-02-19 70112] R3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2013-02-19 106552] R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-12-13 54784] S0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2013-02-19 340216] S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [2009-07-09 55280] S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2009-06-09 155648] S2 Hamachi2Svc;LogMeIn Hamachi Tunneling Engine;c:\program files (x86)\LogMeIn Hamachi\hamachi-2.exe [2012-12-14 2466304] S2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files (x86)\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336] S2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\\mfefire.exe [2013-02-19 218760] S2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [2013-02-19 182752] S2 pcCMService;pcCMService;c:\program files (x86)\Common Files\Motive\pcCMService.exe [2013-02-25 369152] S2 pcCMService64;pcCMService64;c:\program files\Common Files\Motive\pcCMService.exe [2013-02-25 460288] S2 pcServiceHost;pcServiceHost;c:\program files (x86)\Common Files\Motive\pcServiceHost.exe [2013-02-25 342528] S2 SftService;SoftThinks Agent Service;c:\program files (x86)\Dell DataSafe Local Backup\sftservice.EXE [2011-08-18 1692480] S3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2009-05-26 138752] S3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2013-02-19 515968] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-07-31 236544] . . . ——— X64 Entries ———– . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-10-21 8306208] "Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-12 365592] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-12 165912] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-12 387608] "ATT-SST_McciTrayApp"="c:\program files\ATT-SST\pcTrayApp.exe" [2013-02-25 2792448] . ——- Supplementary Scan ——- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm uInternet Settings,ProxyOverride = *.local Trusted Zone: $talisma_url$ TCP: DhcpNameServer = 192.168.1.254 FF - ProfilePath - c:\users\Miinutes\AppData\Roaming\Mozilla\Firefox\Profiles\gkimmklz.default-1364092547519\ . - - - - ORPHANS REMOVED - - - - . Toolbar-Locked - (no file) . . . ——————— LOCKED REGISTRY KEYS ——————— . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.11" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\McAfee] "SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,6d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,6f,00,66,00,\ . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Completion time: 2013-04-15 02:52:12 ComboFix-quarantined-files.txt 2013-04-15 07:52 ComboFix2.txt 2013-04-14 01:46 ComboFix3.txt 2013-04-13 13:29 . Pre-Run: 505,156,145,152 bytes free Post-Run: 504,854,052,864 bytes free . - - End Of File - - 1F9B4CA037F4E259E4B0014268E72D04

Attachments:

Post #23
Now I just need a way to keep malware viruses and other things off my computer or my teenage boys are gonna drive me insane any suggestions
Post #24 last edited
Hi miinutes,

I'll give you some recommendations when we finished.

Rerun TDSSK and when presented with this line select delete.

20:08:37.0543 3356 \Device\Harddisk0\DR0 ( TDSS File System )



Next

Download and save to your desktop Malwarebytes Anti-Malware

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.


Next

  • Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browsers.
  • Right Click AdwCleaner and click "Run as Administrator" to run AdwCleaner.exe
  • Click on Search.
  • Please post the content of that logfile with your next answer.
  • You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please post back with
  • MBAM log
  • AdwCleaner log
Computer still ok?
Post #25
Malwarebytes Anti-Malware (Trial) 1.75.0.1300 www.malwarebytes.org Database version: v2013.04.13.05 Windows 7 x64 NTFS Internet Explorer 8.0.7600.16385 Miinutes :: MIINUTES-PC [administrator] Protection: Enabled 4/15/2013 4:59:30 AM mbam-log-2013-04-15 (04-59-30).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 235591 Time elapsed: 1 minute(s), 51 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end) # AdwCleaner v2.200 - Logfile created 04/15/2013 at 05:04:53 # Updated 02/04/2013 by Xplode # Operating system : Windows 7 Home Premium (64 bits) # User : Miinutes - MIINUTES-PC # Boot Mode : Normal # Running from : C:\Users\Miinutes\Downloads\AdwCleaner.exe # Option [Search] ***** [Services] ***** ***** [Files / Folders] ***** ***** [Registry] ***** ***** [Internet Browsers] ***** -\\ Internet Explorer v8.0.7600.16385 [OK] Registry is clean. -\\ Mozilla Firefox v19.0.2 (en-US) File : C:\Users\Miinutes\AppData\Roaming\Mozilla\Firefox\Profiles\gkimmklz.default-1364092547519\prefs.js [OK] File is clean. ************************* AdwCleaner[R1].txt - [810 octets] - [15/04/2013 05:04:35] AdwCleaner[R2].txt - [742 octets] - [15/04/2013 05:04:53] ########## EOF - C:\AdwCleaner[R2].txt - [801 octets] ########## AND COMPUTER STILL CONNECTING FINE!
Post #26 last edited
Hi miinutes,

You have some old vulnerable java.


Click on the Start button > Control Panel

  • click on the Uninstall a program option under the Programs category.
Uninstall the following programs


Java™ 6 Update 20 (64-bit)
Java™ 6 Update 20

You can get the newest versions of Java from HERE.

Accept the licencing agreement amd scroll down to the bottom of the list. The files you want are jre-7u17-windows-i586.exe and jre-7u17-windows-x64.exe

Download them to your desktop. Right click and run as Adminstrator to install them. Decline any other install that may be offered.


Next

Right click on OTL.exe and chose Run as Administrator to run it
  • Under the Custom Scans/Fixes box at the bottom, paste in the following
  • Do Not copy the word CODE
  • please note the fix starts with the :
:Services

:Commands
[purity]
[emptytemp]
[createrestorepoint]

Then click the Run Fix button at the top
  • Let the program run unhindered
  • Please save the resulting log to be posted in your next reply.
Please post the fix OTL log.


Next
Let's see if the infection damaged any services.

Please download Farbar Service Scanner and save it to your desktop.
  • Right click FSS.exe and click "Run as Administrator" to run it.
  • Press "Scan".
  • It will create a log (FSS.txt) in the same directory the tool is run.
  • Please copy and paste the log to your reply.

Please post back with
  • OTL fix log
  • FSS log
Post #27
All processes killed ========== SERVICES/DRIVERS ========== ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Miinutes ->Temp folder emptied: 1501194 bytes ->Temporary Internet Files folder emptied: 891068 bytes ->FireFox cache emptied: 349582328 bytes ->Flash cache emptied: 2100 bytes User: Public ->Temp folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 11590 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes %systemroot%\sysnative\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 666 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 336.00 mb System Restore Service not available. OTL by OldTimer - Version 3.2.69.0 log created on 04152013_085727 Files\Folders moved on Reboot… C:\Users\Miinutes\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files… Registry entries deleted on Reboot… Farbar Service Scanner Version: 03-03-2013 Ran by [removed] (administrator) on 15-04-2013 at 09:02:56 Running from "C:\Users\Miinutes\Desktop" Windows 7 Home Premium (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Attempt to access Yahoo IP returned error. Yahoo IP is offline Yahoo.com is accessible. Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcore.dll => MD5 is legit C:\Windows\System32\drivers\afd.sys => MD5 is legit C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit C:\Windows\System32\dnsrslvr.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit **** End of log ****
Post #29
Farbar Service Scanner Version: 03-03-2013 Ran by [removed] (administrator) on 16-04-2013 at 00:22:37 Running from "C:\Users\Miinutes\Desktop" Windows 7 Home Premium (X64) Boot Mode: Normal **************************************************************** Internet Services: ============ Connection Status: ============== Localhost is accessible. LAN connected. Google IP is accessible. Google.com is accessible. Attempt to access Yahoo IP returned error. Yahoo IP is offline Yahoo.com is accessible. Windows Firewall: ============= Firewall Disabled Policy: ================== System Restore: ============ VSS Service is not running. Checking service configuration: The start type of VSS service is OK. The ImagePath of VSS service is OK. System Restore Disabled Policy: ======================== Action Center: ============ Windows Update: ============ Windows Autoupdate Disabled Policy: ============================ Windows Defender: ============== RpcSs Service is not running. Checking service configuration: The start type of RpcSs service is OK. The ImagePath of RpcSs service is OK. Other Services: ============== File Check: ======== C:\Windows\System32\nsisvc.dll => MD5 is legit C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit C:\Windows\System32\dhcpcore.dll => MD5 is legit C:\Windows\System32\drivers\afd.sys => MD5 is legit C:\Windows\System32\drivers\tdx.sys => MD5 is legit C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit C:\Windows\System32\dnsrslvr.dll => MD5 is legit C:\Windows\System32\mpssvc.dll => MD5 is legit C:\Windows\System32\bfe.dll => MD5 is legit C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit C:\Windows\System32\SDRSVC.dll => MD5 is legit C:\Windows\System32\vssvc.exe => MD5 is legit C:\Windows\System32\wscsvc.dll => MD5 is legit C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit C:\Windows\System32\wuaueng.dll => MD5 is legit C:\Windows\System32\qmgr.dll => MD5 is legit C:\Windows\System32\es.dll => MD5 is legit C:\Windows\System32\cryptsvc.dll => MD5 is legit C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit C:\Windows\System32\ipnathlp.dll => MD5 is legit C:\Windows\System32\iphlpsvc.dll => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit **** End of log ****
Post #30 last edited
Hi miinutes,

One more scan yo check for stragglers.


*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.


Go here to run an online scannner from
ESET

(Note: You can use Internet Explorer or FireFox for this scan. If you use FireFox you will be asked to install an additional component. Please allow this.)

  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Disable your Antivirus software. You can usually do this with its Notfication Tray icon near the clock
  • Click Start
  • Make sure that the option "Remove found threats" is Unchecked, and the option "Scan unwanted applications" is Checked.
  • Click Scan.
  • Wait for the scan to finish.
  • When the scan completes, click List of found threats
  • click Export to Text file and save the file to your desktop using a unique name, such as ESETScan.
  • Include the contents of this report in your next reply

    Note - when ESET doesn't find any threats, no report will be created.
  • Push the back button.
  • Push Finish
  • Re-enable your Antivirus software.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI