What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

CatByte, Blue Screen Again! [Solved]

4 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #2 last edited
let's take another look

please run the following:

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.
  • Double-click to run it. When the tool opens click Yes to disclaimer.
  • Press Scan button.
  • It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.
  • The first time the tool is run, it makes also another log (Addition.txt). Please attach it to your reply.


NEXT


Please run the following:

Please download Malwarebytes Anti-Rootkit (MBAR) from here http://www.malwarebytes.org/products/mbar/ and save it to your desktop.
Direct link to the file: http://downloads.malwarebytes.org/file/mbar
  • Be sure to print out and follow the instructions provided on that same page.
  • Caution: This is a beta version so please be sure to read the disclaimer and back up any important data before using.
  • Doubleclick on the MBAR file you downloaded.
  • Approve the UAC prompt in Vista and newer operating systems.
  • Click OK on the next screen, to allow the package to extract the contents of the file to it's own folder, mbar.
  • By default, this will be on your desktop, though you can choose another location if you wish. We advise using the default location for simplicity.
  • mbar.exe will launch automatically. On some systems, this may take a few extra seconds. Please be patient and wait for the program to open.
  • After reading the Introduction, click 'Next' if you agree.
  • On the Update Database screen, click on the 'Update' button.
  • Once you see 'Success: Database was successfully updated' click on 'Next'.
  • Click the 'Scan' button.

  • With some infections, you may see two messages boxes.
  • 1.'Could not load protection driver'. Click 'OK'.
  • 2.'Could not load DDA driver'. Click 'Yes' to this message, to allow the driver to load after a restart. Allow the computer to restart. Continue with the rest of these instructions.
  • If malware is found, do NOT press the Cleanup button when the scan completes. Click EXIT.
    Then, please send the following logs as attachments to your reply. These logs are located in the mbar folder on your desktop where the tool extracted itself to.

    mbar-log-2013-xx-xx(xx-xx-xx).txt (where xx-xx(xx-xx-xx) is the date and time of the scan)
    system-log.txt
Post #3
Another symptom: a couple of times I intended to burn audio discs with a number of mp3 files; although windows media player showed burning was successful, I was only able to play some mp3 (e.g. 6 out of 10) with my CD player.

MBAR did not find any infection.

FRST.txt

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-08-2013 03
Ran by [removed] (administrator) on 19-08-2013 18:21:05
Running from C:\Users\[removed]\Desktop
Microsoft® Windows Vista™ Home Premium Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

==================== Processes (Whitelisted) ===================

(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files\MR APP\MRAPP.Event.Service.exe
(Hewlett-Packard Company) C:\Program Files\Common Files\LightScribe\LSSrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS32.exe
(Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccSvcHst.exe
(Sprint Spectrum, L.L.C) C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
(Microsoft Corporation) C:\Program Files\Microsoft\BingBar\SeaPort.EXE
(Microsoft) C:\Program Files\MR APP\MRAPP.Transfer.Service.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(Yahoo! Inc.) C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
(Google Inc.) C:\Program Files\Google\Update\1.3.21.153\GoogleCrashHandler.exe
(Hewlett-Packard) c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
(Symantec Corporation) C:\Program Files\Norton Security Suite\Engine\20.4.0.40\ccSvcHst.exe
(Microsoft) C:\Program Files\MR APP\MRAPP.UI.exe
(Microsoft Corporation) C:\Windows\vVX1000.exe
(RealNetworks, Inc.) C:\Program Files\real\realplayer\Update\realsched.exe
(Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe
(Hewlett-Packard Company) C:\hp\support\hpsysdrv.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(CyberLink Corp.) C:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe
() C:\Program Files\DivX\DivX Update\DivXUpdate.exe
(Vimicro) C:\Windows\Vm_sti.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
(Microsoft Corporation) C:\Program Files\Windows Media Player\wmpnscfg.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
(Hewlett-Packard Co.) C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
(Southwest Airlines) C:\Program Files\Southwest Airlines\Ding\Ding.exe
(Microsoft Corporation) C:\Windows\system32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe
(Affinegy, Inc.) C:\Program Files\Belkin\Router Setup and Monitor\BelkinSetup.exe
(Adobe Systems Incorporated) C:\Windows\system32\Macromed\Flash\FlashUtil32_11_8_800_94_ActiveX.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

HKLM\…\Run: [hpqSRMon] - [x]
HKLM\…\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-20] (Microsoft Corporation)
HKLM\…\Run: [VX1000] - C:\Windows\vVX1000.exe [762736 2010-05-20] (Microsoft Corporation)
HKLM\…\Run: [TkBellExe] - C:\Program Files\real\realplayer\update\realsched.exe [296096 2012-10-02] (RealNetworks, Inc.)
HKLM\…\Run: [SunJavaUpdateReg] - C:\Windows\system32\jureg.exe [54936 2007-04-07] (Sun Microsystems, Inc.)
HKLM\…\Run: [NvMediaCenter] - C:\Windows\system32\NvMcTray.dll [92704 2008-05-22] (NVIDIA Corporation)
HKLM\…\Run: [NvCplDaemon] - C:\Windows\system32\NvCpl.dll [13539872 2008-05-22] (NVIDIA Corporation)
HKLM\…\Run: [LifeCam] - C:\Program Files\Microsoft LifeCam\LifeExp.exe [119152 2010-05-20] (Microsoft Corporation)
HKLM\…\Run: [InstaLAN] - C:\Program Files\Belkin\Router Setup and Monitor\BelkinRouterMonitor.exe [2015136 2011-05-27] (Affinegy, Inc.)
HKLM\…\Run: [hpsysdrv] - c:\hp\support\hpsysdrv.exe [65536 2007-04-18] (Hewlett-Packard Company)
HKLM\…\Run: [HP Software Update] - C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49152 2007-03-11] (Hewlett-Packard Co.)
HKLM\…\Run: [HP Health Check Scheduler] - c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [75008 2008-06-02] (Hewlett-Packard)
HKLM\…\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\…\Run: [DVDAgent] - c:\Program Files\Hewlett-Packard\Media\DVD\DVDAgent.exe [1148200 2009-09-09] (CyberLink Corp.)
HKLM\…\Run: [DivXUpdate] - C:\Program Files\DivX\DivX Update\DivXUpdate.exe [1259376 2011-07-28] ()
HKLM\…\Run: [BigDogPath] - C:\Windows\VM_STI.EXE [40960 2004-12-15] (Vimicro)
HKLM\…\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-01-28] (Apple Inc.)
HKLM\…\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\…\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKCU\…\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [39408 2011-03-26] (Google Inc.)
HKCU\…\Run: [WMPNSCFG] - C:\Program Files\Windows Media Player\WMPNSCFG.exe [202240 2008-01-20] (Microsoft Corporation)
HKCU\…\Run: [iCloudServices] - C:\Program Files\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-04-05] (Apple Inc.)
HKCU\…\Run: [HPAdvisor] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW [x]
HKCU\…\Run: [Google Update] - C:\Users\Vickie\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2012-01-30] (Google Inc.)
HKCU\…\Run: [Facebook Update] - C:\Users\Vickie\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-03-19] (Facebook Inc.)
HKCU\…\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-20] (Microsoft Corporation)
HKCU\…\Run: [ApplePhotoStreams] - C:\Program Files\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-04-05] (Apple Inc.)
HKCU\…\Run: [A961CD7DCC68AB4B38BBA6DAE28510E911EA5EF4._service_run] - C:\Program Files\Google\Chrome\Application\chrome.exe [846288 2013-07-24] (Google Inc.)
HKCU\…\Run: [Skype] - C:\Program Files\Skype\Phone\Skype.exe [20684656 2013-07-25] (Skype Technologies S.A.)
MountPoints2: {509a0fa4-f5f1-11dd-9c0c-002354608e79} - F:\LiteAuto.exe
MountPoints2: {ae7cc331-f854-11dd-bade-002354608e79} - G:\LaunchU3.exe -a
HKU\Default\…\Run: [HPADVISOR] - [x]
HKU\Default User\…\Run: [HPADVISOR] - [x]
HKU\Guest\…\Run: [HPADVISOR] - C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autorun=AUTORUN [x]
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\PictureMover.lnk
ShortcutTarget: PictureMover.lnk -> C:\Program Files\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
Startup: C:\Users\Vickie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DING!.lnk
ShortcutTarget: DING!.lnk -> C:\Program Files\Southwest Airlines\Ding\Ding.exe (Southwest Airlines)

==================== Internet (Whitelisted) ====================

ProxyEnable: Internet Explorer proxy is enabled.
ProxyServer: http=127.0.0.1:16110;https=127.0.0.1:16110
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://tw.yahoo.com/
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKCU - DefaultScope {9BEAA305-2F4C-482D-A551-502F47ADD456} URL = http://www.bing.com/search?q={searchTerms}&form;=OSDSRC
SearchScopes: HKCU - {160C2CF3-06A5-4099-8E6A-46EBCA05D43C} URL = http://search.yahoo.com/search?p={searchTe…&fr;=hp-psdt
SearchScopes: HKCU - {422E3F9F-4E3E-4942-A2EF-1D231A0CC393} URL = http://tw.rd.yahoo.com/referurl/download/s…p={searchTerms}
SearchScopes: HKCU - {77BE5BC5-2B23-4074-8E08-78DFE8829D55} URL = http://tw.rd.yahoo.com/referurl/download/s…p={searchTerms}
SearchScopes: HKCU - {9BEAA305-2F4C-482D-A551-502F47ADD456} URL = http://www.bing.com/search?q={searchTerms}&form;=OSDSRC
SearchScopes: HKCU - {CDBF4DED-1ACD-47C2-8C3B-8A2124E60D8D} URL = http://tw.rd.yahoo.com/referurl/download/s…p={searchTerms}
SearchScopes: HKCU - {FEF89856-0783-44B0-8451-8A32A16FBE7D} URL = http://tw.rd.yahoo.com/referurl/download/s…ms}&ei;=utf8
BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll ()
BHO: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
Toolbar: HKLM - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM - WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU -Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU -WOT - {71576546-354D-41C9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll ()
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler: msdaipp - No CLSID Value -
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll ()
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Vickie\AppData\Roaming\Mozilla\Firefox\Profiles\u5yir1s5.default
FF Homepage: hxxp://www.bing.com/?pc=MOZO
FF Keyword.URL: hxxp://www.bing.com/search?form=MOZFLB&pc;=MOZO&q;=
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @google.com/npPicasa3,version=3.0.0 - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=10.25.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=10.25.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nppl3260;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprjplug;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprpplugin;version=15.0.6.14 - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @movenetworks.com/Quantum Media Player - C:\Users\Vickie\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll (Move Networks)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Vickie\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Users\Vickie\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Users\Vickie\AppData\Roaming\Mozilla\plugins\npo1d.dll (Google)
FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Users\Vickie\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Vickie\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Vickie\AppData\Local\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF SearchPlugin: C:\Users\Vickie\AppData\Roaming\Mozilla\Firefox\Profiles\u5yir1s5.default\searchplugins\bing-.xml
FF Extension: No Name - C:\Users\Vickie\AppData\Roaming\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
FF Extension: No Name - C:\Users\Vickie\AppData\Roaming\Mozilla\Firefox\Profiles\u5yir1s5.default\Extensions\[removed]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF Extension: Default - C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
FF HKLM\…\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF HKLM\…\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\coFFPlgn\
FF HKLM\…\Firefox\Extensions: [{0153E448-190B-4987-BDE1-F256CADA672F}] C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF Extension: RealPlayer Browser Record Plugin - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
FF HKLM\…\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\IPSFFPlgn\
FF HKCU\…\Firefox\Extensions: [[removed]] C:\Users\Vickie\AppData\Roaming\Move Networks
FF Extension: Move Media Player - C:\Users\Vickie\AppData\Roaming\Move Networks

Chrome:
=======
CHR HomePage: hxxp://google.com/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\28.0.1500.95\gcswf32.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\Vickie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.9.0.9216_0\npSkypeChromePlugin.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Google Talk Plugin) - C:\Users\Vickie\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Vickie\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll No File
CHR Plugin: (Java™ Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (RealNetworks™ Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer™ HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer™ G2 LiveConnect-Enabled Plug-In (32-bit) ) - c:\program files\real\realplayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
CHR Plugin: (RealPlayer Download Plugin) - c:\program files\real\realplayer\Netscape6\nprpplugin.dll (RealPlayer)
CHR Plugin: (Move Streaming Media Player) - C:\Users\Vickie\AppData\Roaming\Move Networks\plugins\npqmp071705000014.dll (Move Networks)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Plugin: (RealJukebox NS Plugin) - c:\program files\real\realplayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (WOT) - C:\Users\Vickie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhmmomiinigofkjcapegjjndpbikblnp\1.4.13_0
CHR Extension: (RealPlayer HTML5Video Downloader Extension) - C:\Users\Vickie\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmjfhklogoienhpfnppmbcbjfjnkonk\1.5_0
CHR Extension: (Norton Identity Protection) - C:\Users\Vickie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mkfokfffehpeedafpekjeddnmnjhmcmk\2013.4.0.10_0
CHR Extension: (Gmail) - C:\Users\Vickie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0
CHR HKLM\…\Chrome\Extension: [jfmjfhklogoienhpfnppmbcbjfjnkonk] - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\Chrome\Ext\rphtml5video.crx
CHR HKLM\…\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx
CHR HKLM\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files\Norton Security Suite\Engine\20.4.0.40\Exts\Chrome.crx

========================== Services (Whitelisted) =================

R2 AffinegyService; C:\Program Files\Belkin\Router Setup and Monitor\BelkinService.exe [562592 2011-05-27] (Affinegy, Inc.)
R2 EventService; C:\Program Files\MR APP\MRAPP.Event.Service.exe [31744 2013-03-12] ()
R2 HP Health Check Service; c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe [94208 2008-06-02] (Hewlett-Packard)
R2 N360; C:\Program Files\Norton Security Suite\Engine\20.4.0.40\diMaster.dll [556336 2013-05-29] (Symantec Corporation)
R2 OSCM Utility Service; C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe [155648 2007-12-12] (Sprint Spectrum, L.L.C)
R2 TransferService; C:\Program Files\MR APP\MRAPP.Transfer.Service.exe [31232 2013-03-12] (Microsoft)

==================== Drivers (Whitelisted) ====================

R1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360\1404000.028\ccSetx86.sys [134744 2013-04-15] (Symantec Corporation)
R0 CLFS; C:\Windows\System32\CLFS.sys [245736 2009-04-10] (Microsoft Corporation)
S2 DgiVecp; C:\Windows\System32\Drivers\DgiVecp.sys [41984 2006-09-05] (Samsung Electronics Co., Ltd.)
R1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376920 2013-08-19] (Symantec Corporation)
U3 EraserUtilDrv11310; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11310.sys [108120 2013-08-19] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2013-02-18] (Symantec Corporation)
R3 HSXHWBS3; C:\Windows\System32\DRIVERS\HSXHWBS3.sys [207360 2008-02-12] (Conexant Systems, Inc.)
R1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130813.001\IDSvix86.sys [386720 2013-02-15] (Symantec Corporation)
R3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130819.017\NAVENG.SYS [93272 2013-08-13] (Symantec Corporation)
R3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130819.017\NAVEX15.SYS [1611992 2013-08-13] (Symantec Corporation)
S3 NWUSBCDFIL; C:\Windows\System32\DRIVERS\NwUsbCdFil.sys [13824 2007-09-06] (Novatel Wireless Inc.)
S3 NWUSBPort2; C:\Windows\System32\DRIVERS\nwusbser2.sys [99200 2007-10-12] (Novatel Wireless Inc.)
R1 SRTSP; C:\Windows\System32\Drivers\N360\1404000.028\SRTSP.SYS [603224 2013-05-15] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360\1404000.028\SRTSPX.SYS [32344 2013-03-04] (Symantec Corporation)
R2 SSPORT; C:\Windows\system32\Drivers\SSPORT.sys [5120 2006-11-22] (Samsung Electronics)
R0 SymDS; C:\Windows\System32\drivers\N360\1404000.028\SYMDS.SYS [367704 2013-05-20] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360\1404000.028\SYMEFA.SYS [934488 2013-05-22] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [142496 2013-07-16] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360\1404000.028\Ironx86.SYS [175264 2012-07-27] (Symantec Corporation)
R1 SYMTDIv; C:\Windows\System32\Drivers\N360\1404000.028\SYMTDIV.SYS [352344 2013-04-24] (Symantec Corporation)
S3 VX1000; C:\Windows\System32\DRIVERS\VX1000.sys [1961072 2010-05-20] (Microsoft Corporation)
S3 ZSMC301b; C:\Windows\System32\Drivers\usbVM31b.sys [195299 2006-04-03] (VM)
S3 IpInIp; system32\DRIVERS\ipinip.sys [x]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [x]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [x]
S3 SBRE; \??\C:\Windows\system32\drivers\SBREdrv.sys [x]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-19 18:18 - 2013-08-19 18:18 - 01070241 _____ (Farbar) C:\Users\Vickie\Desktop\FRST.exe
2013-08-17 17:51 - 2013-08-17 17:51 - 00002487 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-17 17:51 - 2013-08-17 17:51 - 00000000 ___RD C:\Program Files\Skype
2013-08-17 17:51 - 2013-08-17 17:51 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-08-17 17:48 - 2013-08-17 17:49 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Vickie\Downloads\SkypeSetup.exe
2013-08-16 22:31 - 2013-08-16 22:36 - 00000000 ____D C:\Users\Vickie\Desktop\最新诗歌
2013-08-15 10:59 - 2013-08-15 11:03 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 10:43 - 2013-07-24 19:40 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-15 10:43 - 2013-07-24 19:32 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-15 10:43 - 2013-07-24 19:30 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-15 10:43 - 2013-07-24 19:26 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-15 10:43 - 2013-07-24 19:26 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-15 10:43 - 2013-07-24 19:25 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-08-15 10:43 - 2013-07-24 19:24 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-08-15 10:43 - 2013-07-24 19:24 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-15 10:43 - 2013-07-24 19:23 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-15 10:43 - 2013-07-24 19:23 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-15 10:43 - 2013-07-24 19:23 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-15 10:43 - 2013-07-24 19:23 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-08-15 10:43 - 2013-07-24 19:23 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-08-15 10:43 - 2013-07-24 19:22 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-15 10:43 - 2013-07-24 19:22 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-15 10:43 - 2013-07-24 19:22 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-08-15 00:14 - 2013-08-15 00:14 - 00144552 _____ C:\Windows\Minidump\Mini081513-02.dmp
2013-08-15 00:06 - 2013-08-15 00:06 - 00144552 _____ C:\Windows\Minidump\Mini081513-01.dmp
2013-08-14 17:04 - 2013-07-17 12:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-14 17:04 - 2013-07-10 02:47 - 00783360 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-14 17:04 - 2013-07-09 05:10 - 01205168 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll
2013-08-14 17:04 - 2013-07-07 21:55 - 03603904 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2013-08-14 17:04 - 2013-07-07 21:55 - 03551680 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2013-08-14 17:04 - 2013-07-07 21:20 - 00172544 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-14 17:04 - 2013-07-07 21:16 - 00992768 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-14 17:04 - 2013-07-07 21:16 - 00133120 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-14 17:04 - 2013-07-07 21:16 - 00098304 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-14 17:04 - 2013-07-04 21:53 - 00905664 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-14 17:04 - 2013-06-15 06:22 - 00015872 _____ (Microsoft Corporation) C:\Windows\system32\icaapi.dll
2013-08-14 17:04 - 2013-06-15 04:23 - 00024064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-14 10:54 - 2013-08-14 10:54 - 00000000 ____D C:\Users\Vickie\AppData\Local\{8731665D-9E54-47BA-B681-729514567447}
2013-08-14 10:53 - 2013-08-14 10:53 - 03432398 _____ C:\Users\Vickie\Downloads\Pics.zip
2013-08-11 15:37 - 2013-08-11 15:37 - 00000000 ____D C:\Program Files\WOT
2013-08-10 00:15 - 2013-08-10 00:15 - 00144552 _____ C:\Windows\Minidump\Mini081013-02.dmp
2013-08-10 00:06 - 2013-08-10 00:06 - 00144552 _____ C:\Windows\Minidump\Mini081013-01.dmp
2013-08-09 19:23 - 2013-08-09 19:23 - 00001977 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-09 18:14 - 2013-08-09 18:14 - 00000000 ____D C:\Windows\ERUNT
2013-08-08 20:04 - 2013-08-08 20:31 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-08-08 20:03 - 2013-08-08 20:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 20:02 - 2013-08-08 20:02 - 12081912 _____ (Malwarebytes Corp.) C:\Users\Vickie\Downloads\mbar-1.06.1.1005.exe
2013-08-08 15:59 - 2013-08-08 15:59 - 00144552 _____ C:\Windows\Minidump\Mini080813-02.dmp
2013-08-08 15:50 - 2013-08-08 15:50 - 00144552 _____ C:\Windows\Minidump\Mini080813-01.dmp
2013-08-06 08:27 - 2013-08-06 08:27 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-05 23:54 - 2013-08-06 00:03 - 179872424 _____ C:\Users\Vickie\Downloads\setup_11.0.0.1245.x01_2013_08_06_09_13.exe
2013-08-04 15:21 - 2013-08-04 15:21 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-04 15:21 - 2013-08-04 15:20 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-04 15:21 - 2013-08-04 15:20 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-04 15:20 - 2013-08-04 15:20 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-04 15:20 - 2013-08-04 15:20 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-04 15:20 - 2013-08-04 15:20 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-04 15:12 - 2013-08-04 15:12 - 00000000 ____D C:\ProgramData\McAfee
2013-08-04 08:24 - 2013-08-04 08:24 - 00144552 _____ C:\Windows\Minidump\Mini080413-01.dmp
2013-08-04 08:07 - 2013-08-04 08:17 - 00000000 ____D C:\Windows\pss
2013-08-04 01:49 - 2013-08-08 15:49 - 00000000 ____D C:\Users\Vickie\AppData\Local\SkypeRS
2013-08-03 23:24 - 2013-08-03 23:24 - 00000928 _____ C:\{8C3EB991-4669-4D08-A334-5BD00287436E}
2013-08-03 22:51 - 2013-08-15 00:14 - 376659685 _____ C:\Windows\MEMORY.DMP
2013-08-03 22:51 - 2013-08-03 22:51 - 00144552 _____ C:\Windows\Minidump\Mini080313-01.dmp

==================== One Month Modified Files and Folders =======

2013-08-19 18:20 - 2013-08-19 18:20 - 00000000 ____D C:\FRST
2013-08-19 18:18 - 2013-08-19 18:18 - 01070241 _____ (Farbar) C:\Users\Vickie\Desktop\FRST.exe
2013-08-19 18:12 - 2009-02-16 11:02 - 00000000 ____D C:\Users\Vickie\AppData\Roaming\Skype
2013-08-19 17:16 - 2013-03-19 20:11 - 00000932 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000UA.job
2013-08-19 17:14 - 2011-03-26 02:08 - 00000886 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-19 17:04 - 2012-06-25 20:35 - 00000830 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-19 17:00 - 2012-01-31 18:19 - 00000912 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000UA.job
2013-08-19 16:55 - 2008-11-20 14:36 - 01385868 _____ C:\Windows\WindowsUpdate.log
2013-08-19 16:40 - 2006-11-02 05:47 - 00005184 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-19 16:40 - 2006-11-02 05:47 - 00005184 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-19 15:13 - 2011-03-26 02:08 - 00000882 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-19 10:40 - 2006-11-02 06:01 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-18 23:47 - 2006-11-02 06:01 - 00032552 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-18 22:00 - 2012-01-31 18:19 - 00000860 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000Core.job
2013-08-18 20:16 - 2013-03-19 20:11 - 00000910 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000Core.job
2013-08-18 16:04 - 2009-01-02 22:30 - 00000000 ____D C:\Users\Vickie\Desktop\Business Yahoo
2013-08-17 17:51 - 2013-08-17 17:51 - 00002487 _____ C:\Users\Public\Desktop\Skype.lnk
2013-08-17 17:51 - 2013-08-17 17:51 - 00000000 ___RD C:\Program Files\Skype
2013-08-17 17:51 - 2013-08-17 17:51 - 00000000 ____D C:\Program Files\Common Files\Skype
2013-08-17 17:51 - 2009-02-16 11:01 - 00000000 ____D C:\ProgramData\Skype
2013-08-17 17:49 - 2013-08-17 17:48 - 01492848 _____ (Skype Technologies S.A.) C:\Users\Vickie\Downloads\SkypeSetup.exe
2013-08-17 16:44 - 2010-05-03 21:31 - 00000000 ____D C:\Users\Vickie\AppData\Roaming\HpUpdate
2013-08-17 13:39 - 2008-12-30 11:21 - 00000000 ____D C:\Users\Vickie\AppData\Local\Google
2013-08-16 22:36 - 2013-08-16 22:31 - 00000000 ____D C:\Users\Vickie\Desktop\最新诗歌
2013-08-15 11:40 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\rescache
2013-08-15 11:37 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\Microsoft.NET
2013-08-15 11:03 - 2013-08-15 10:59 - 00000000 ____D C:\Windows\system32\MRT
2013-08-15 10:59 - 2006-11-02 03:24 - 75778376 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2013-08-15 10:55 - 2008-12-29 00:20 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-08-15 10:48 - 2006-11-02 03:33 - 00718584 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-15 00:14 - 2013-08-15 00:14 - 00144552 _____ C:\Windows\Minidump\Mini081513-02.dmp
2013-08-15 00:14 - 2013-08-03 22:51 - 376659685 _____ C:\Windows\MEMORY.DMP
2013-08-15 00:14 - 2009-03-29 18:54 - 00000000 ____D C:\Windows\Minidump
2013-08-15 00:06 - 2013-08-15 00:06 - 00144552 _____ C:\Windows\Minidump\Mini081513-01.dmp
2013-08-14 16:28 - 2008-12-31 17:25 - 00000052 _____ C:\Windows\system32\DOErrors.log
2013-08-14 10:54 - 2013-08-14 10:54 - 00000000 ____D C:\Users\Vickie\AppData\Local\{8731665D-9E54-47BA-B681-729514567447}
2013-08-14 10:53 - 2013-08-14 10:53 - 03432398 _____ C:\Users\Vickie\Downloads\Pics.zip
2013-08-11 15:37 - 2013-08-11 15:37 - 00000000 ____D C:\Program Files\WOT
2013-08-11 11:22 - 2008-12-27 23:47 - 00111760 _____ C:\Users\Vickie\AppData\Local\GDIPFONTCACHEV1.DAT
2013-08-11 11:01 - 2008-01-20 19:47 - 00897432 _____ C:\Windows\PFRO.log
2013-08-11 11:01 - 2006-11-02 05:47 - 00410824 _____ C:\Windows\system32\FNTCACHE.DAT
2013-08-10 00:15 - 2013-08-10 00:15 - 00144552 _____ C:\Windows\Minidump\Mini081013-02.dmp
2013-08-10 00:06 - 2013-08-10 00:06 - 00144552 _____ C:\Windows\Minidump\Mini081013-01.dmp
2013-08-09 19:23 - 2013-08-09 19:23 - 00001977 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-09 19:23 - 2008-12-30 11:21 - 00000000 ____D C:\Program Files\Google
2013-08-09 18:14 - 2013-08-09 18:14 - 00000000 ____D C:\Windows\ERUNT
2013-08-09 00:21 - 2012-12-11 15:02 - 00017657 _____ C:\Users\Vickie\Desktop\freeshipping.xlsx
2013-08-08 20:31 - 2013-08-08 20:04 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-08-08 20:03 - 2013-08-08 20:03 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-08 20:02 - 2013-08-08 20:02 - 12081912 _____ (Malwarebytes Corp.) C:\Users\Vickie\Downloads\mbar-1.06.1.1005.exe
2013-08-08 15:59 - 2013-08-08 15:59 - 00144552 _____ C:\Windows\Minidump\Mini080813-02.dmp
2013-08-08 15:50 - 2013-08-08 15:50 - 00144552 _____ C:\Windows\Minidump\Mini080813-01.dmp
2013-08-08 15:49 - 2013-08-04 01:49 - 00000000 ____D C:\Users\Vickie\AppData\Local\SkypeRS
2013-08-07 16:53 - 2008-12-27 23:48 - 00000326 _____ C:\Windows\Tasks\HPCeeScheduleForVickie.job
2013-08-06 09:02 - 2010-10-31 16:53 - 00000000 ____D C:\Users\Vickie\AppData\Roaming\Mozilla
2013-08-06 08:27 - 2013-08-06 08:27 - 00000000 ____D C:\ProgramData\Kaspersky Lab
2013-08-06 00:03 - 2013-08-05 23:54 - 179872424 _____ C:\Users\Vickie\Downloads\setup_11.0.0.1245.x01_2013_08_06_09_13.exe
2013-08-04 15:21 - 2013-08-04 15:21 - 00000000 ____D C:\Program Files\Common Files\Java
2013-08-04 15:20 - 2013-08-04 15:21 - 00867240 _____ (Oracle Corporation) C:\Windows\system32\npDeployJava1.dll
2013-08-04 15:20 - 2013-08-04 15:21 - 00263592 _____ (Oracle Corporation) C:\Windows\system32\javaws.exe
2013-08-04 15:20 - 2013-08-04 15:20 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\javaw.exe
2013-08-04 15:20 - 2013-08-04 15:20 - 00175016 _____ (Oracle Corporation) C:\Windows\system32\java.exe
2013-08-04 15:20 - 2013-08-04 15:20 - 00094632 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2013-08-04 15:20 - 2010-09-14 23:01 - 00789416 _____ (Oracle Corporation) C:\Windows\system32\deployJava1.dll
2013-08-04 15:19 - 2012-03-20 13:06 - 00000000 ____D C:\Program Files\Java
2013-08-04 15:12 - 2013-08-04 15:12 - 00000000 ____D C:\ProgramData\McAfee
2013-08-04 08:57 - 2008-12-29 02:26 - 00000000 ____D C:\ProgramData\HP Product Assistant
2013-08-04 08:57 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\system32\spool
2013-08-04 08:57 - 2006-11-02 04:18 - 00000000 ____D C:\Windows\registration
2013-08-04 08:24 - 2013-08-04 08:24 - 00144552 _____ C:\Windows\Minidump\Mini080413-01.dmp
2013-08-04 08:17 - 2013-08-04 08:07 - 00000000 ____D C:\Windows\pss
2013-08-03 23:24 - 2013-08-03 23:24 - 00000928 _____ C:\{8C3EB991-4669-4D08-A334-5BD00287436E}
2013-08-03 22:51 - 2013-08-03 22:51 - 00144552 _____ C:\Windows\Minidump\Mini080313-01.dmp
2013-07-24 19:40 - 2013-08-15 10:43 - 12334080 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-24 19:32 - 2013-08-15 10:43 - 01800704 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-24 19:30 - 2013-08-15 10:43 - 09738752 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-24 19:26 - 2013-08-15 10:43 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-24 19:26 - 2013-08-15 10:43 - 01104384 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-24 19:25 - 2013-08-15 10:43 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2013-07-24 19:24 - 2013-08-15 10:43 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2013-07-24 19:24 - 2013-08-15 10:43 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-24 19:23 - 2013-08-15 10:43 - 01796096 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-24 19:23 - 2013-08-15 10:43 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-24 19:23 - 2013-08-15 10:43 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-24 19:23 - 2013-08-15 10:43 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2013-07-24 19:23 - 2013-08-15 10:43 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2013-07-24 19:22 - 2013-08-15 10:43 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-24 19:22 - 2013-08-15 10:43 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-24 19:22 - 2013-08-15 10:43 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2013-07-24 09:49 - 2008-12-27 23:43 - 00000000 ____D C:\Users\Vickie\AppData\Local\Adobe
2013-07-24 09:47 - 2012-06-25 20:35 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2013-07-24 09:47 - 2011-06-12 10:15 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-19 10:55

==================== End Of Log ============================

Addition.txt

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-08-2013 03
Ran by [removed] at 2013-08-19 18:22:08
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================


==================== Installed Programs =======================

Update for Microsoft Office 2007 (KB2508958)
AC3Filter (remove only)
ActiveCheck component for HP Active Support Library (Version: 3.0.0.2)
Adobe AIR (Version: 3.1.0.4880)
Adobe Flash Player 11 ActiveX (Version: 11.8.800.94)
Adobe Reader X (10.1.7) (Version: 10.1.7)
Adobe Shockwave Player 11.5 (Version: 11.5.2.602)
Apple Application Support (Version: 2.3.3)
Apple Software Update (Version: 2.1.3.127)
Belkin Setup and Router Monitor
Bing Bar (Version: 7.0.619.0)
Bonjour (Version: 3.0.0.10)
BufferChm (Version: 90.0.146.000)
CameraDrivers (Version: 9.0.0.163)
CameraUserGuides (Version: 9.0.0.163)
Canon MF Toolbox 4.9.1.1.mf12 (Version: 4.9.1.1.mf12)
Canon MF3010 (Version: 3.9.0.0)
Cards_Calendar_OrderGift_DoMorePlugout (Version: 2.03.0000)
Chinese Simplified Fonts Support For Adobe Reader 8 (Version: 8.0.0)
Compatibility Pack for the 2007 Office system (Version: 12.0.6612.1000)
Coupon Printer for Windows (Version: 5.0.0.1)
CyberLink DVD Suite Deluxe (Version: .1707)
D3DX10 (Version: 15.4.2368.0902)
DeviceDiscovery (Version: 110.0.180.000)
DeviceManagementQFolder (Version: 1.00.0000)
DING! (Version: 1.05.005)
DivX Converter (Version: 7.1.0)
DivX Setup (Version: 2.6.0.34)
DivX Version Checker (Version: 7.1.0.9)
EasyBits GO
e-Rewards Notify (Version: 1.1.0.83)
eSupportQFolder (Version: 1.00.0000)
Facebook Video Calling 1.2.0.287 (Version: 1.2.287)
Google Chrome (Version: 28.0.1500.95)
Google Talk Plugin (Version: 4.4.2.14502)
Google Toolbar for Internet Explorer (Version: 1.0.0)
Google Toolbar for Internet Explorer (Version: 7.5.4413.1752)
Google Update Helper (Version: 1.3.21.153)
Hardware Diagnostic Tools (Version: 5.1.4861.15)
HP Active Support Library (Version: 3.1.6.1)
HP Customer Experience Enhancements (Version: 5.6.0.2510)
HP Customer Feedback (Version: 1.0.0)
HP Demo (Version: 1.00.0000)
HP Imaging Device Functions 9.0 (Version: 9.0)
HP MediaSmart DVD (Version: 2.2.3309)
HP Photosmart Cameras 9.0 (Version: 9.0)
HP Photosmart Essential 2.5 (Version: 1.03.0000)
HP Photosmart Essential 3.0 (Version: 3.0)
HP Product Assistant (Version: 100.000.001.000)
HP Recovery Manager RSS (Version: 84.0.0.7)
HP Solution Center 9.0 (Version: 9.0)
HP Update (Version: 5.005.000.002)
HPAsset component for HP Active Support Library (Version: 3.0.2.2)
hpicamDrvQFolder (Version: 1.00.0000)
HPPhotoSmartPhotobookWebPack1 (Version: 2.03.0000)
HPProductAssistant (Version: 90.0.146.000)
HPTCSSetup (Version: 1.0.964.2626)
iCloud (Version: 2.1.2.8)
InstantShareAlert (Version: 1.00.0000)
InstantShareDevicesMFC (Version: 90.0.146.000)
Java 7 Update 25 (Version: 7.0.250)
Java Auto Updater (Version: 2.1.9.5)
Junk Mail filter update (Version: 15.4.3502.0922)
LabelPrint (Version: 2.2.2913)
LightScribe System Software (Version: 1.18.3.2)
LightScribeTemplateLabeler (Version: 1.10.23.1)
LINE (Version: 3.1.4.76)
Mesh Runtime (Version: 15.4.5722.2)
Messenger Companion (Version: 15.4.3502.0922)
Messenger 分享元件 (Version: 15.4.3502.0922)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6012.5000)
Microsoft Corporation (Version: 9.1.0.0)
Microsoft LifeCam (Version: 3.22.270.0)
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Access Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Enterprise 2007 (Version: 12.0.6612.1000)
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office File Validation Add-In (Version: 14.0.5130.5003)
Microsoft Office Groove MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Groove Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office InfoPath MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Outlook Connector (Version: 14.0.5118.5000)
Microsoft Office Outlook MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000)
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014)
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Works (Version: 9.7.0621)
Move Media Player
Mozilla Firefox 8.0 (x86 en-US) (Version: 8.0)
MSN
MSVCRT (Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0)
muvee autoProducer 6.1 (Version: 6.10.050)
My HP Games (Version: 1.0.0.52)
Norton Security Suite (Version: 20.4.0.40)
NVIDIA Drivers
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0)
PanoStandAlone (Version: 90.0.146.000)
PCIe Soft Data Fax Modem with SmartCP (Version: 7.71.00.50)
Picasa 3 (Version: 3.1)
PictureMover (Version: 3.0.1.52)
Power2Go (Version: 5.6.4109)
PowerDirector (Version: 6.5.2926)
PSSWCORE (Version: 2.03.0000)
Python 2.5.2 (Version: 2.5.2150)
RealNetworks - Microsoft Visual C++ 2008 Runtime (Version: 9.0)
RealPlayer (Version: 15.0.6)
Realtek High Definition Audio Driver (Version: 6.0.1.5789)
RealUpgrade 1.1 (Version: 1.1.0)
Segoe UI (Version: 15.4.2271.0615)
Skype™ 6.7 (Version: 6.7.102)
SolutionCenter (Version: 90.0.146.000)
sp44626
Spelling Dictionaries Support For Adobe Reader 8 (Version: 8.0.0)
SPORE Creature Creator Trial Edition (Version: 1.00.0000)
Sprint Mobile Broadband (Novatel Wireless) - Lite (Version: 3.10.014)
Status (Version: 110.0.180.000)
TrayApp (Version: 110.0.180.000)
UnloadSupport (Version: 9.0.0)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596660) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596848) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2687404) 32-Bit Edition
Update for Microsoft Office Outlook 2007 (KB2768023) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2817642) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.6195 (Version: 1.2.0)
VideoToolkit01 (Version: 110.0.171.000)
VIMICRO USB PC Camera(ZC0301PL) (Version: 1.00.000)
WebReg (Version: 90.0.146.000)
Windows Live Communications Platform (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3502.0922)
Windows Live Essentials (Version: 15.4.3555.0308)
Windows Live Family Safety (Version: 15.4.3502.0922)
Windows Live Family Safety (Version: 15.4.3555.0308)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (Version: 15.4.3502.0922)
Windows Live Mail (Version: 15.4.3502.0922)
Windows Live Mesh (Version: 15.4.3502.0922)
Windows Live Mesh ActiveX Control for Remote Connections (Version: 15.4.5722.2)
Windows Live Messenger (Version: 15.4.3502.0922)
Windows Live Messenger (Version: 15.4.3538.0513)
Windows Live Messenger Companion Core (Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (Version: 15.4.3502.0922)
Windows Live Photo Common (Version: 15.4.3502.0922)
Windows Live Photo Gallery (Version: 15.4.3502.0922)
Windows Live PIMT Platform (Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (Version: 15.4.3502.0922)
Windows Live SOXE Definitions (Version: 15.4.3502.0922)
Windows Live Sync (Version: 14.0.8089.726)
Windows Live UX Platform (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (Version: 15.4.3508.1109)
Windows Live Writer (Version: 15.4.3502.0922)
Windows Live Writer Resources (Version: 15.4.3502.0922)
Windows Live 影像中心 (Version: 15.4.3502.0922)
Windows Live 程式集 (Version: 15.4.3502.0922)
WinRAR archiver
WOT for Internet Explorer (Version: 12.8.2.0)
Yahoo! Software Update
Yahoo! Toolbar
適用遠端連線的 Windows Live Mesh ActiveX 控制項 (Version: 15.4.5722.2)


==================== Restore Points =========================

04-08-2013 15:52:03 Restore Operation
04-08-2013 22:16:52 Removed Java™ 6 Update 31
04-08-2013 22:19:37 Installed Java 7 Update 25
05-08-2013 20:29:38 Scheduled Checkpoint
06-08-2013 18:11:24 Scheduled Checkpoint
07-08-2013 05:08:45 OTL Restore Point - 8/6/2013 10:08:45 PM
08-08-2013 23:43:25 Scheduled Checkpoint
09-08-2013 20:21:25 Scheduled Checkpoint
10-08-2013 02:10:04 Removed Skype™ 6.6
10-08-2013 02:12:06 Removed Skype Click to Call
10-08-2013 02:13:23 Removed Skype Click to Call
10-08-2013 02:17:25 Removed Skype Click to Call
10-08-2013 02:20:51 Removed Skype Click to Call
10-08-2013 18:03:55 Scheduled Checkpoint
11-08-2013 19:40:46 Scheduled Checkpoint
11-08-2013 22:37:07 Installed WOT for Internet Explorer
12-08-2013 19:23:40 Scheduled Checkpoint
13-08-2013 18:00:22 Scheduled Checkpoint
15-08-2013 17:40:31 Windows Update
16-08-2013 21:26:15 Scheduled Checkpoint
19-08-2013 00:49:08 Scheduled Checkpoint
19-08-2013 19:10:23 Scheduled Checkpoint

==================== Hosts content: ==========================

2006-11-02 03:23 - 2006-09-18 14:41 - 00000761 ____N C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
::1 localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {00F527DB-2856-4BDC-AA09-F56B0290AB2C} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\schtasks.exe [2008-01-20] (Microsoft Corporation)
Task: {148CF22C-E1AA-4AB3-A56C-9AB1B86A4FCE} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1094609499-526271581-1756929269-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1D52BD78-2099-495A-90E2-B572C53D40EA} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {21DF2BDA-B8D4-4EE7-B1C9-B8EB3E7BE02F} - System32\Tasks\Microsoft\Windows\Defrag\ManualDefrag => C:\Windows\system32\defrag.exe [2008-01-20] (Microsoft Corp.)
Task: {320124A7-D70F-41DE-A9D1-D5E8E19D5D91} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-20] (Microsoft Corporation)
Task: {48F74AB5-E811-4267-BB00-254865E2B265} - System32\Tasks\HP Health Check => c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe [2008-06-02] (Hewlett-Packard)
Task: {4B9CA307-269D-4B39-90FA-7C550B3B25EE} - System32\Tasks\PC-Doctor\Scheduled Maintenance Swap => C:\Program Files\PC-Doctor for Windows\task_swap.exe [2008-03-13] (PC-Doctor, Inc.)
Task: {4E735884-5EED-4A8A-B056-AD342BB79B45} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000UA => C:\Users\Vickie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-03-19] (Facebook Inc.)
Task: {5DC216C9-212C-451C-9883-D9237E97B830} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2013-07-24] (Adobe Systems Incorporated)
Task: {696E6DF0-FEDB-419A-AE77-358CF77557E1} - System32\Tasks\User_Feed_Synchronization-{4D6803BA-78A8-4535-9DDF-0A6A426C316B} => C:\Windows\system32\msfeedssync.exe [2011-05-22] (Microsoft Corporation)
Task: {7CC8230C-C28F-433B-A14B-F6441B790580} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {8DE43F42-A207-45E7-B61D-50D37A666890} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000UA => C:\Users\Vickie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-30] (Google Inc.)
Task: {9642EC5A-26D8-435F-AE2F-920E58F5CC82} - System32\Tasks\PC-Doctor\Scheduled Maintenance => C:\Program Files\PC-Doctor for Windows\RunProfiler.exe [2008-04-09] (PC-Doctor, Inc.)
Task: {9D03B083-3F8B-4E34-827A-3D501099351B} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000Core => C:\Users\Vickie\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-03-19] (Facebook Inc.)
Task: {9FB91E28-5D25-44F6-8893-2D5B288B5D2C} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1094609499-526271581-1756929269-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe [2012-07-27] (RealNetworks, Inc.)
Task: {A5F83B51-F7B0-4A02-A1B2-D18FCF08EEB8} - System32\Tasks\Norton WSC Integration => C:\Program Files\Norton Security Suite\Engine\20.4.0.40\WSCStub.exe [2013-06-03] (Symantec Corporation)
Task: {A61555D3-7840-45C1-A5A9-0D49851DE37A} - System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program\OptinNotification => C:\Windows\System32\wsqmcons.exe [2008-01-20] (Microsoft Corporation)
Task: {B3555326-CDA9-40EE-A20C-ACB92A3367C9} - System32\Tasks\HPCeeScheduleForVickie => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2007-12-17] (Hewlett-Packard)
Task: {B3FA1FB7-4030-4620-929B-2C9D41E14ADC} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000Core => C:\Users\Vickie\AppData\Local\Google\Update\GoogleUpdate.exe [2012-01-30] (Google Inc.)
Task: {BFF4A38B-83DE-4284-96BD-4BC72D1D16A6} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-03-26] (Google Inc.)
Task: {C146AC5B-3925-40E7-A24D-1D009FCD0C86} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2011-03-26] (Google Inc.)
Task: {D4AD1998-7E1F-43A3-A2FA-53502928A0D0} - System32\Tasks\Norton Security Suite\Norton Error Processor => C:\Program Files\Norton Security Suite\Engine\20.4.0.40\SymErr.exe [2013-06-03] (Symantec Corporation)
Task: {DCAC2015-376F-4692-A047-4AC93D0EB048} - System32\Tasks\{8EE74891-C3C4-4E29-B77E-6A095C3330FE} => C:\Program Files\Internet Explorer\iexplore.exe [2013-07-24] (Microsoft Corporation)
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-20] ()
Task: {EF8FF992-9738-4BB3-9DE6-EC07A1E92F84} - System32\Tasks\Norton Security Suite\Norton Error Analyzer => C:\Program Files\Norton Security Suite\Engine\20.4.0.40\SymErr.exe [2013-06-03] (Symantec Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000Core.job => C:\Users\Vickie\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000UA.job => C:\Users\Vickie\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000Core.job => C:\Users\Vickie\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1094609499-526271581-1756929269-1000UA.job => C:\Users\Vickie\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HPCeeScheduleForVickie.job => C:\Program Files\Hewlett-Packard\SDP\Ceement\HPCEE.exe

==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (08/19/2013 11:33:44 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 1014

Error: (08/19/2013 11:33:44 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 1014

Error: (08/19/2013 11:33:44 AM) (Source: Bonjour Service) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (08/19/2013 10:53:30 AM) (Source: Perflib) (User: )
Description: WmiApRplC:\Windows\system32\wbem\wmiaprpl.dll4

Error: (08/19/2013 10:53:30 AM) (Source: Perflib) (User: )
Description: PNRPsvcC:\Windows\system32\pnrpperf.dll4

Error: (08/19/2013 10:53:29 AM) (Source: Perflib) (User: )
Description: MSDTCC:\Windows\system32\msdtcuiu.DLL4

Error: (08/19/2013 10:53:29 AM) (Source: Perflib) (User: )
Description: LsaC:\Windows\system32\Secur32.dll4

Error: (08/19/2013 10:53:29 AM) (Source: Perflib) (User: )
Description: ESENTC:\Windows\system32\esentprf.dll4

Error: (08/19/2013 10:53:29 AM) (Source: Perflib) (User: )
Description: EmdCacheC:\Windows\system32\emdmgmt.dll4

Error: (08/19/2013 10:53:29 AM) (Source: Perflib) (User: )
Description: BITSC:\Windows\system32\bitsperf.dll4


System errors:
=============
Error: (08/19/2013 10:41:53 AM) (Source: Service Control Manager) (User: )
Description: HP CUE DeviceDiscovery Service

Error: (08/19/2013 10:41:32 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (08/18/2013 04:00:51 PM) (Source: Service Control Manager) (User: )
Description: HP CUE DeviceDiscovery Service

Error: (08/18/2013 03:59:28 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (08/17/2013 11:30:56 AM) (Source: Service Control Manager) (User: )
Description: HP CUE DeviceDiscovery Service

Error: (08/17/2013 11:28:10 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (08/16/2013 06:40:49 PM) (Source: nvstor32) (User: )
Description: A parity error was detected on \Device\RaidPort0.

Error: (08/16/2013 01:38:43 PM) (Source: Service Control Manager) (User: )
Description: HP CUE DeviceDiscovery Service

Error: (08/16/2013 01:37:10 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (08/15/2013 11:26:09 AM) (Source: Service Control Manager) (User: )
Description: HP CUE DeviceDiscovery Service


Microsoft Office Sessions:
=========================
Error: (07/17/2012 08:33:19 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6661.5000, Microsoft Office Version: 12.0.6612.1000. This session lasted 13 seconds with 0 seconds of active time. This session ended with a crash.

Error: (08/31/2011 10:48:48 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/23/2011 01:03:03 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/12/2011 11:13:39 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/12/2011 11:13:25 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.

Error: (05/12/2011 11:13:11 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 2 seconds with 0 seconds of active time. This session ended with a crash.

Error: (04/30/2011 11:33:57 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6425.1000, Microsoft Office Version: 12.0.6425.1000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash.


CodeIntegrity Errors:
===================================
Date: 2013-08-19 18:21:49.405
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

Date: 2013-08-19 18:21:48.812
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

Date: 2013-08-19 18:21:48.205
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

Date: 2013-08-19 18:21:47.566
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\Windows\System32\drivers\SYMEVENT.SYS because the set of per-page image hashes could not be found on the system.

Date: 2013-08-19 18:21:41.711
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-19 18:21:41.135
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-19 18:21:40.523
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-19 18:21:39.879
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-15 10:51:12.201
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys because the set of per-page image hashes could not be found on the system.

Date: 2013-08-15 10:51:11.375
Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume1\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys because the set of per-page image hashes could not be found on the system.


==================== Memory info ===========================

Percentage of memory in use: 49%
Total physical RAM: 2941.76 MB
Available physical RAM: 1477.71 MB
Total Pagefile: 6107.98 MB
Available Pagefile: 4060.85 MB
Total Virtual: 2047.88 MB
Available Virtual: 1888.74 MB

==================== Drives ================================

Drive c: (COMPAQ) (Fixed) (Total:286.94 GB) (Free:182.47 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (FACTORY_IMAGE) (Fixed) (Total:11.15 GB) (Free:1.08 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 1549F232)
Partition 1: (Active) - (Size=287 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=11 GB) - (Type=07 NTFS)

==================== End Of Log ============================

mbar-log

Malwarebytes Anti-Rootkit BETA 1.06.1.1005
www.malwarebytes.org

Database version: v2013.08.19.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Vickie :: VICKIE-PC [administrator]

8/19/2013 6:30:13 PM
mbar-log-2013-08-19 (18-30-13).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 254025
Time elapsed: 14 minute(s), 49 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

System-log.txt

—————————————
Malwarebytes Anti-Rootkit BETA 1.06.1.1005

© Malwarebytes Corporation 2011-2012

OS version: 6.0.6002 Windows Vista Service Pack 2 x86

Account is Administrative

Internet Explorer version: 9.0.8112.16421

File system is: NTFS
Disk drives: C:\ DRIVE_FIXED, D:\ DRIVE_FIXED
CPU speed: 2.511000 GHz
Memory total: 3084656640, free: 1508306944

Downloaded database version: v2013.08.19.06
Initializing…
———— Kernel report ————
08/19/2013 18:30:07
———— Loaded modules ———–
\SystemRoot\system32\ntkrnlpa.exe
\SystemRoot\system32\hal.dll
\SystemRoot\system32\kdcom.dll
\SystemRoot\system32\PSHED.dll
\SystemRoot\system32\BOOTVID.dll
\SystemRoot\system32\CLFS.SYS
\SystemRoot\system32\CI.dll
\SystemRoot\system32\drivers\Wdf01000.sys
\SystemRoot\system32\drivers\WDFLDR.SYS
\SystemRoot\system32\drivers\acpi.sys
\SystemRoot\system32\drivers\WMILIB.SYS
\SystemRoot\system32\drivers\msisadrv.sys
\SystemRoot\system32\drivers\pci.sys
\SystemRoot\System32\drivers\partmgr.sys
\SystemRoot\system32\drivers\volmgr.sys
\SystemRoot\System32\drivers\volmgrx.sys
\SystemRoot\system32\drivers\pciide.sys
\SystemRoot\system32\drivers\PCIIDEX.SYS
\SystemRoot\System32\drivers\mountmgr.sys
\SystemRoot\system32\drivers\nvraid.sys
\SystemRoot\system32\drivers\CLASSPNP.SYS
\SystemRoot\system32\drivers\atapi.sys
\SystemRoot\system32\drivers\ataport.SYS
\SystemRoot\system32\DRIVERS\nvstor32.sys
\SystemRoot\system32\DRIVERS\storport.sys
\SystemRoot\system32\drivers\fltmgr.sys
\SystemRoot\system32\drivers\N360\1404000.028\SYMDS.SYS
\SystemRoot\system32\drivers\fileinfo.sys
\SystemRoot\system32\drivers\N360\1404000.028\SYMEFA.SYS
\SystemRoot\System32\Drivers\ksecdd.sys
\SystemRoot\system32\drivers\ndis.sys
\SystemRoot\system32\drivers\msrpc.sys
\SystemRoot\system32\drivers\NETIO.SYS
\SystemRoot\System32\drivers\tcpip.sys
\SystemRoot\System32\drivers\fwpkclnt.sys
\SystemRoot\System32\Drivers\Ntfs.sys
\SystemRoot\system32\drivers\volsnap.sys
\SystemRoot\System32\Drivers\spldr.sys
\SystemRoot\System32\Drivers\mup.sys
\SystemRoot\System32\drivers\ecache.sys
\SystemRoot\system32\drivers\disk.sys
\SystemRoot\system32\drivers\crcdisk.sys
\SystemRoot\system32\DRIVERS\tunnel.sys
\SystemRoot\system32\DRIVERS\tunmp.sys
\SystemRoot\system32\DRIVERS\amdk8.sys
\SystemRoot\system32\DRIVERS\i8042prt.sys
\SystemRoot\system32\DRIVERS\mouclass.sys
\SystemRoot\system32\DRIVERS\kbdclass.sys
\SystemRoot\system32\DRIVERS\usbohci.sys
\SystemRoot\system32\DRIVERS\USBPORT.SYS
\SystemRoot\system32\DRIVERS\usbehci.sys
\SystemRoot\system32\DRIVERS\HDAudBus.sys
\SystemRoot\system32\DRIVERS\nvmfdx32.sys
\SystemRoot\system32\DRIVERS\cdrom.sys
\SystemRoot\system32\DRIVERS\HSXHWBS3.sys
\SystemRoot\system32\DRIVERS\ks.sys
\SystemRoot\system32\DRIVERS\HSX_DP.sys
\SystemRoot\system32\DRIVERS\HSX_CNXT.sys
\SystemRoot\system32\drivers\modem.sys
\SystemRoot\system32\DRIVERS\nvlddmkm.sys
\SystemRoot\System32\drivers\dxgkrnl.sys
\SystemRoot\System32\drivers\watchdog.sys
\SystemRoot\system32\DRIVERS\msiscsi.sys
\SystemRoot\system32\DRIVERS\TDI.SYS
\SystemRoot\system32\DRIVERS\rasl2tp.sys
\SystemRoot\system32\DRIVERS\ndistapi.sys
\SystemRoot\system32\DRIVERS\ndiswan.sys
\SystemRoot\system32\DRIVERS\raspppoe.sys
\SystemRoot\system32\DRIVERS\raspptp.sys
\SystemRoot\system32\DRIVERS\rassstp.sys
\SystemRoot\system32\DRIVERS\termdd.sys
\SystemRoot\system32\DRIVERS\swenum.sys
\SystemRoot\system32\DRIVERS\NWADIenum.sys
\SystemRoot\system32\DRIVERS\mssmbios.sys
\SystemRoot\system32\DRIVERS\umbus.sys
\SystemRoot\system32\DRIVERS\usbhub.sys
\SystemRoot\System32\Drivers\NDProxy.SYS
\SystemRoot\system32\drivers\RTKVHDA.sys
\SystemRoot\system32\drivers\portcls.sys
\SystemRoot\system32\drivers\drmk.sys
\SystemRoot\system32\drivers\N360\1404000.028\ccSetx86.sys
\SystemRoot\System32\Drivers\N360\1404000.028\SRTSP.SYS
\SystemRoot\system32\DRIVERS\usbccgp.sys
\SystemRoot\system32\DRIVERS\USBD.SYS
\SystemRoot\system32\DRIVERS\usbscan.sys
\SystemRoot\system32\drivers\N360\1404000.028\SRTSPX.SYS
\SystemRoot\system32\DRIVERS\usbprint.sys
\SystemRoot\system32\drivers\N360\1404000.028\Ironx86.SYS
\??\C:\Windows\system32\Drivers\SYMEVENT.SYS
\SystemRoot\System32\Drivers\Fs_Rec.SYS
\SystemRoot\System32\Drivers\Null.SYS
\SystemRoot\System32\Drivers\Beep.SYS
\SystemRoot\System32\drivers\vga.sys
\SystemRoot\System32\drivers\VIDEOPRT.SYS
\SystemRoot\System32\DRIVERS\RDPCDD.sys
\SystemRoot\system32\drivers\rdpencdd.sys
\SystemRoot\System32\Drivers\Msfs.SYS
\SystemRoot\System32\Drivers\Npfs.SYS
\SystemRoot\System32\DRIVERS\rasacd.sys
\SystemRoot\system32\DRIVERS\tdx.sys
\SystemRoot\System32\Drivers\N360\1404000.028\SYMTDIV.SYS
\SystemRoot\system32\DRIVERS\smb.sys
\SystemRoot\system32\drivers\afd.sys
\SystemRoot\System32\DRIVERS\netbt.sys
\SystemRoot\system32\DRIVERS\pacer.sys
\SystemRoot\system32\DRIVERS\netbios.sys
\SystemRoot\system32\DRIVERS\wanarp.sys
\SystemRoot\system32\DRIVERS\rdbss.sys
\SystemRoot\system32\drivers\nsiproxy.sys
\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\IPSDefs\20130813.001\IDSvix86.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
\SystemRoot\System32\Drivers\dfsc.sys
\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx86.sys
\SystemRoot\System32\Drivers\crashdmp.sys
\SystemRoot\System32\Drivers\dump_diskdump.sys
\SystemRoot\System32\Drivers\dump_nvstor32.sys
\SystemRoot\System32\win32k.sys
\SystemRoot\System32\drivers\Dxapi.sys
\SystemRoot\system32\DRIVERS\monitor.sys
\SystemRoot\System32\TSDDD.dll
\SystemRoot\System32\cdd.dll
\SystemRoot\system32\drivers\luafv.sys
\SystemRoot\system32\drivers\WudfPf.sys
\SystemRoot\system32\drivers\spsys.sys
\SystemRoot\system32\DRIVERS\lltdio.sys
\SystemRoot\system32\DRIVERS\nwifi.sys
\SystemRoot\system32\DRIVERS\ndisuio.sys
\SystemRoot\system32\DRIVERS\rspndr.sys
\SystemRoot\system32\DRIVERS\asyncmac.sys
\SystemRoot\system32\drivers\HTTP.sys
\SystemRoot\System32\DRIVERS\srvnet.sys
\SystemRoot\system32\DRIVERS\bowser.sys
\SystemRoot\System32\drivers\mpsdrv.sys
\SystemRoot\system32\drivers\mrxdav.sys
\SystemRoot\system32\DRIVERS\mrxsmb.sys
\SystemRoot\system32\DRIVERS\mrxsmb10.sys
\SystemRoot\system32\DRIVERS\mrxsmb20.sys
\SystemRoot\System32\DRIVERS\srv2.sys
\SystemRoot\System32\DRIVERS\srv.sys
\SystemRoot\system32\DRIVERS\mdmxsdk.sys
\SystemRoot\system32\drivers\peauth.sys
\SystemRoot\System32\Drivers\secdrv.SYS
\??\C:\Windows\system32\Drivers\SSPORT.sys
\SystemRoot\System32\drivers\tcpipreg.sys
\SystemRoot\system32\DRIVERS\xaudio.sys
\SystemRoot\system32\DRIVERS\cdfs.sys
\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130819.017\NAVEX15.SYS
\??\C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_20.1.0.24\Definitions\VirusDefs\20130819.017\NAVENG.SYS
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys
\??\C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11310.sys
\??\C:\Windows\system32\drivers\mbamchameleon.sys
\??\C:\Windows\system32\drivers\mbamswissarmy.sys
\Windows\System32\ntdll.dll
———– End ———–
Done!
<<<1>>>
Upper Device Name: \Device\Harddisk0\DR0
Upper Device Object: 0xffffffff866d9190
Upper Device Driver Name: \Driver\disk\
Lower Device Name: \Device\0000005e\
Lower Device Object: 0xffffffff852b5b88
Lower Device Driver Name: \Driver\nvstor32\
<<<2>>>
Device number: 0, partition: 1
Physical Sector Size: 512
Drive: 0, DevicePointer: 0xffffffff866d9190, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
——— Disk Stack ——
DevicePointer: 0xffffffff867dcd18, DeviceName: Unknown, DriverName: \Driver\partmgr\
DevicePointer: 0xffffffff866d9190, DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
DevicePointer: 0xffffffff86088b68, DeviceName: Unknown, DriverName: \Driver\ACPI\
DevicePointer: 0xffffffff852b5b88, DeviceName: \Device\0000005e\, DriverName: \Driver\nvstor32\
———— End ———-
Alternate DeviceName: \Device\Harddisk0\DR0\, DriverName: \Driver\disk\
Upper DeviceData: 0x0, 0x0, 0x0
Lower DeviceData: 0x0, 0x0, 0x0
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Scanning drivers directory: C:\Windows\system32\drivers…
<<<2>>>
Device number: 0, partition: 1
<<<3>>>
Volume: C:
File system type: NTFS
SectorSize = 512, ClusterSize = 4096, MFTRecordSize = 1024, MFTIndexSize = 4096 bytes
Done!
Drive 0
Scanning MBR on drive 0…
Inspecting partition table:
MBR Signature: 55AA
Disk Signature: 1549F232

Partition information:

Partition 0 type is Primary (0x7)
Partition is ACTIVE.
Partition starts at LBA: 63 Numsec = 601762707
Partition file system is NTFS
Partition is bootable

Partition 1 type is Primary (0x7)
Partition is NOT ACTIVE.
Partition starts at LBA: 601762770 Numsec = 23374575

Partition 2 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Partition 3 type is Empty (0x0)
Partition is NOT ACTIVE.
Partition starts at LBA: 0 Numsec = 0

Disk Size: 320072933376 bytes
Sector size: 512 bytes

Scanning physical sectors of unpartitioned space on drive 0 (1-62-625122448-625142448)…
Done!
Scan finished
=======================================


Removal queue found; removal started
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_i.mbam…
Removing c:\programdata\malwarebytes' anti-malware (portable)\bootstrap_0_0_63_i.mbam…
Removing c:\programdata\malwarebytes' anti-malware (portable)\mbr_0_r.mbam…
Removal finished
Post #4
Hello,

There are no obvious signs of any malware in the logs.

Please run the following:

Please download Windows Repair (all in one) from here
  • Install the program then run it
  • Go to step 2 and allow it to run Disk check
  • Once that is done then go to step 3 and allow it to run SFC
  • On the the Start Repairs tab => Click the Start
  • Click on the select all check box and then click on Start
  • DON'T use the computer while each scan is in progress.
  • Restart may be needed to finish the repair procedure.
Post #6
There should be a Logs folder in the program folder, but if you can't find it, that's ok

how is the computer running now?

Try running a defrag

First open an elevated Command Prompt
  • Go to Start > All Programs > Accessories
  • right click on the Command Prompt and choose “Run as administrator”
  • Type the following see how much your hard drive is fragmented (in this example, your C:\ drive):
  • defrag c: -a (be patient, this can take a while)
  • The resulting analysis will tell you a “Percent file fragmentation” and at the bottom, if you need to defragment the drive or not.
  • To fully defragment your C:\ drive type the following:
  • defrag c: -w
  • Give it time to run (it can take a while, best to leave the computer alone) and then you’re done!
Post #7
So far no more "blue screen". It's running pretty smoothly. The analysis indicated that no need to defrag. How do I know the previous issue with mp3 burning has been fixed?
Post #8
I suspect that issue is unrelated, but the windows repair tool may have helped, the only way to know is to try it again.

If you still have the issue, then try posting in our other software forum to see if the techs can figure out the cause.

http://forums.whatthetech.com/index.php?showforum=124

Please right click and delete the MBAR, windows Repair and FRST logs and programs from your desktop.

Let me know how it goes.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI