What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Various Windows problems [Solved]

44 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31
I don't see a malware issue here so would like you to try and restore your settings back to the last restore point that you mentioned, (27/8)

If you need information on how to do this please look here.

After you’ve done that, please run OTL again and tell me how your computer is behaving.

Satchfan
Post #34
Did the system restore …. DISASTER! After the restore procedure it went to restart and crashed on starting windows. Ever since unable to launch windows not even in safe mode. Windows repair fails with System files integrity check and repair Result: Failed. Error code: 0x57 Root cause found: Unknown Bug check: Bugcheck 6b. Parameters = 0x0 0x0 0x0 0x0nn Windows memory check. No errors found Anyway I really don't know what to do - this was the last thing I expected . jensaxel
Post #35
Well its a strange and beautiful world…
In the middle of my desperation, restarting in various modes, fiddling about with whatever I could think of … all of a sudden
I get the login to Windows, I log in and everything works just fine! Now can anyone explain that??
Anyway, I ran the OTL, and here is the logfile. It did not produce an extra file for some reason whatsoever though.

OTL logfile created on: 16/09/2013 19:28:09 - Run 3
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Sheana\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16686)
Locale: 0000040A | Country: Spain | Language: ESP | Date Format: dd/MM/yyyy

3,91 Gb Total Physical Memory | 2,21 Gb Available Physical Memory | 56,70% Memory free
7,81 Gb Paging File | 5,97 Gb Available in Paging File | 76,47% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 279,45 Gb Total Space | 154,89 Gb Free Space | 55,42% Space Free | Partition Type: NTFS
Drive D: | 394,18 Gb Total Space | 394,07 Gb Free Space | 99,97% Space Free | Partition Type: NTFS

Computer Name: SHEANA-PC | User Name: Sheana | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/09/11 00:02:35 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Sheana\Desktop\OTL.exe
PRC - [2013/07/15 23:09:24 | 000,554,384 | —- | M] (Lavasoft) – C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
PRC - [2013/07/05 09:52:10 | 001,104,384 | —- | M] (Spotify Ltd) – C:\Users\Sheana\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2013/06/13 02:27:38 | 001,236,336 | —- | M] (Lavasoft Limited) – C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe
PRC - [2013/06/13 02:27:36 | 018,834,784 | —- | M] (Lavasoft Limited) – C:\Program Files (x86)\Ad-Aware Antivirus\AdAware.exe
PRC - [2013/05/25 02:47:30 | 027,776,968 | —- | M] (Dropbox, Inc.) – C:\Users\Sheana\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012/09/20 05:39:12 | 003,677,000 | —- | M] (GFI Software) – C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe
PRC - [2012/08/13 11:57:02 | 010,376,704 | —- | M] (OpenOffice.org) – C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2012/08/13 11:57:02 | 010,368,512 | —- | M] (OpenOffice.org) – C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2012/06/20 18:21:46 | 001,556,640 | —- | M] (ASUSTeK Computer Inc.) – C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe
PRC - [2012/04/15 12:27:31 | 003,058,304 | —- | M] (ASUS) – C:\Windows\AsScrPro.exe
PRC - [2012/02/21 23:49:04 | 000,102,568 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\Splendid\ACMON.exe
PRC - [2012/02/21 23:49:00 | 000,162,456 | —- | M] (ASUSTeK) – C:\Windows\SysWOW64\ACEngSvr.exe
PRC - [2012/02/17 03:04:20 | 000,289,408 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnWMI.exe
PRC - [2012/02/17 03:04:18 | 000,277,120 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe
PRC - [2012/02/17 01:01:36 | 000,473,728 | —- | M] (ASUSTek Computer Inc.) – C:\Program Files (x86)\ASUS\FaceLogon\sensorsrv.exe
PRC - [2011/12/24 01:39:38 | 000,174,720 | —- | M] (ASUSTek Computer Inc.) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControl.exe
PRC - [2011/12/23 04:58:42 | 000,318,080 | —- | M] (ASUSTek Computer Inc.) – C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe
PRC - [2011/11/21 23:22:08 | 000,080,512 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe
PRC - [2011/11/21 23:19:50 | 000,096,896 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe
PRC - [2011/10/25 02:20:38 | 000,174,720 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe
PRC - [2010/12/21 03:24:38 | 002,656,280 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe
PRC - [2010/12/21 03:24:36 | 000,325,656 | —- | M] (Intel Corporation) – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe
PRC - [2010/08/20 18:57:06 | 000,107,816 | —- | M] (CyberLink) – C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2010/07/10 07:45:00 | 000,984,400 | —- | M] (Virage Logic Corporation / Sonic Focus) – C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe
PRC - [2009/06/19 19:29:42 | 000,105,016 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe
PRC - [2009/06/19 19:29:26 | 002,488,888 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\ATKOSD.exe
PRC - [2008/12/23 02:15:34 | 000,174,648 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\WDC.exe
PRC - [2008/08/14 06:00:08 | 000,113,208 | —- | M] (ASUS) – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\KBFiltr.exe


========== Modules (No Company Name) ==========

MOD - [2013/09/07 23:42:18 | 014,340,096 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\370a29ddbc4bd792aac2278cf29ed99f\PresentationFramework.ni.dll
MOD - [2013/09/07 23:42:02 | 012,436,480 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\28ea347a952d20959ac6ae02d7457d39\System.Windows.Forms.ni.dll
MOD - [2013/09/07 23:41:55 | 001,593,344 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\5aa44bce7933e4de09d935848f868a4b\System.Drawing.ni.dll
MOD - [2013/09/07 23:41:52 | 012,238,336 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\585b8f6cc7ba86886462d0dc9753c98f\PresentationCore.ni.dll
MOD - [2013/09/07 23:41:42 | 003,348,480 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\1f6f220f9efe936d1158c79b9d4b451f\WindowsBase.ni.dll
MOD - [2013/09/07 23:41:35 | 005,464,064 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\09db78d6068543df01862a023aca785a\System.Xml.ni.dll
MOD - [2013/09/07 23:41:28 | 000,978,432 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\64e708397430ac6e5179433d2bb0ffdf\System.Configuration.ni.dll
MOD - [2013/09/07 23:41:27 | 007,989,760 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5d22a30e587e2cac106b81fb351e7c08\System.ni.dll
MOD - [2013/07/11 14:32:53 | 000,368,128 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a2920ed81e097f8551231a9350697bbd\PresentationFramework.Aero.ni.dll
MOD - [2013/07/11 14:31:30 | 011,499,520 | —- | M] () – C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll
MOD - [2013/03/13 22:48:52 | 024,978,944 | —- | M] () – C:\Users\Sheana\AppData\Roaming\Dropbox\bin\libcef.dll
MOD - [2012/11/14 01:32:50 | 003,558,400 | —- | M] () – C:\Users\Sheana\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2012/08/10 17:51:32 | 000,985,088 | —- | M] () – C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2012/02/21 23:49:00 | 000,009,216 | —- | M] () – C:\Program Files (x86)\ASUS\Splendid\GLCDdll.dll
MOD - [2010/08/20 18:57:06 | 000,619,816 | —- | M] () – C:\Program Files (x86)\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2010/08/20 18:57:00 | 000,013,096 | —- | M] () – C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvcPS.dll


========== Services (SafeList) ==========

SRV:64bit: - [2013/05/27 07:50:47 | 001,011,712 | —- | M] (Microsoft Corporation) [On_Demand | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV:64bit: - [2011/03/04 01:57:58 | 000,379,520 | —- | M] (ASUSTeK Computer Inc.) [Auto | Running] – C:\Windows\SysNative\FBAgent.exe – (AFBAgent)
SRV:64bit: - [2010/09/23 03:10:10 | 000,057,184 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Program Files\Windows Live\Mesh\wlcrasvc.exe – (wlcrasvc)
SRV - [2013/09/16 17:31:28 | 000,257,416 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe – (AdobeFlashPlayerUpdateSvc)
SRV - [2013/08/14 19:55:29 | 000,117,656 | —- | M] (Mozilla Foundation) [On_Demand | Stopped] – C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe – (MozillaMaintenance)
SRV - [2013/06/21 09:53:36 | 000,162,408 | R— | M] (Skype Technologies) [Auto | Stopped] – C:\Program Files (x86)\Skype\Updater\Updater.exe – (SkypeUpdate)
SRV - [2013/06/13 02:27:38 | 001,236,336 | —- | M] (Lavasoft Limited) [Auto | Running] – C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareService.exe – (Ad-Aware Service)
SRV - [2012/09/20 05:39:12 | 003,677,000 | —- | M] (GFI Software) [Auto | Running] – C:\Program Files (x86)\Ad-Aware Antivirus\SBAMSvc.exe – (SBAMSvc)
SRV - [2012/02/17 03:04:18 | 000,277,120 | —- | M] (ASUS) [Auto | Running] – C:\Program Files (x86)\ASUS\InstantOn for NB\InsOnSrv.exe – (ASUS InstantOn)
SRV - [2011/11/21 23:22:08 | 000,080,512 | —- | M] (ASUS) [Auto | Running] – C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\AsLdrSrv.exe – (ASLDRService)
SRV - [2011/11/21 23:19:50 | 000,096,896 | —- | M] (ASUS) [Auto | Running] – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\GFNEXSrv.exe – (ATKGFNEXSrv)
SRV - [2010/12/21 03:24:38 | 002,656,280 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe – (UNS)
SRV - [2010/12/21 03:24:36 | 000,325,656 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe – (LMS)
SRV - [2010/03/18 22:16:28 | 000,130,384 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe – (clr_optimization_v4.0.30319_32)
SRV - [2009/06/10 23:23:09 | 000,066,384 | —- | M] (Microsoft Corporation) [Disabled | Stopped] – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32)


========== Driver Services (SafeList) ==========

DRV:64bit: - File not found [Kernel | On_Demand | Stopped] – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys – (esgiguard)
DRV:64bit: - [2013/09/08 11:41:07 | 000,014,456 | —- | M] (GFI Software) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\gfibto.sys – (gfibto)
DRV:64bit: - [2013/04/11 11:06:54 | 000,039,504 | —- | M] (ThreatTrack Security) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\gfiark.sys – (gfiark)
DRV:64bit: - [2012/09/12 20:19:38 | 000,082,872 | —- | M] (GFI Software) [File_System | Auto | Running] – C:\Windows\SysNative\drivers\sbapifs.sys – (sbapifs)
DRV:64bit: - [2012/03/01 08:46:16 | 000,023,408 | —- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] – C:\Windows\SysNative\drivers\fs_rec.sys – (Fs_Rec)
DRV:64bit: - [2012/02/04 06:57:58 | 001,838,656 | —- | M] (Ralink Technology, Corp.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\netr28x.sys – (netr28x)
DRV:64bit: - [2011/11/23 00:21:46 | 000,395,752 | —- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\asmtxhci.sys – (asmtxhci)
DRV:64bit: - [2011/11/23 00:21:46 | 000,130,024 | —- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\asmthub3.sys – (asmthub3)
DRV:64bit: - [2011/11/03 12:09:48 | 000,317,440 | —- | M] (Intel® Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\IntcDAud.sys – (IntcDAud)
DRV:64bit: - [2011/11/03 12:09:22 | 012,310,112 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\igdkmd64.sys – (igfx)
DRV:64bit: - [2011/10/19 04:56:00 | 000,107,904 | —- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsata.sys – (amdsata)
DRV:64bit: - [2011/10/19 04:56:00 | 000,027,008 | —- | M] (Advanced Micro Devices) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\amdxata.sys – (amdxata)
DRV:64bit: - [2011/05/14 00:37:54 | 000,048,488 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\fssfltr.sys – (fssfltr)
DRV:64bit: - [2011/05/05 14:32:56 | 001,439,792 | —- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\SynTP.sys – (SynTP)
DRV:64bit: - [2011/04/26 05:07:36 | 000,557,848 | —- | M] (Intel Corporation) [Kernel | Boot | Running] – C:\Windows\SysNative\drivers\iaStor.sys – (iaStor)
DRV:64bit: - [2011/03/18 07:36:18 | 000,074,840 | —- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\AmUStor.sys – (AmUStor)
DRV:64bit: - [2010/11/20 15:33:36 | 000,078,720 | —- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\HpSAMD.sys – (HpSAMD)
DRV:64bit: - [2010/11/20 13:07:06 | 000,059,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbFlt.sys – (TsUsbFlt)
DRV:64bit: - [2010/11/20 13:07:06 | 000,031,232 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\TsUsbGD.sys – (TsUsbGD)
DRV:64bit: - [2010/10/20 01:34:26 | 000,056,344 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\HECIx64.sys – (MEIx64)
DRV:64bit: - [2010/08/24 11:55:44 | 000,076,912 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\L1C62x64.sys – (L1C)
DRV:64bit: - [2009/10/05 03:34:00 | 001,542,656 | —- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\athrx.sys – (athr)
DRV:64bit: - [2009/07/20 11:29:40 | 000,015,416 | —- | M] ( ) [Kernel | On_Demand | Running] – C:\Windows\SysNative\drivers\kbfiltr.sys – (kbfiltr)
DRV:64bit: - [2009/07/14 03:52:20 | 000,194,128 | —- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\amdsbs.sys – (amdsbs)
DRV:64bit: - [2009/07/14 03:48:04 | 000,065,600 | —- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\lsi_sas2.sys – (LSI_SAS2)
DRV:64bit: - [2009/07/14 03:45:55 | 000,024,656 | —- | M] (Promise Technology) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\stexstor.sys – (stexstor)
DRV:64bit: - [2009/07/14 01:21:48 | 000,038,400 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\tpm.sys – (TPM)
DRV:64bit: - [2009/06/10 22:35:57 | 000,056,832 | —- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\SiSG664.sys – (SiSGbeLH)
DRV:64bit: - [2009/06/10 22:34:33 | 003,286,016 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\evbda.sys – (ebdrv)
DRV:64bit: - [2009/06/10 22:34:28 | 000,468,480 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\bxvbda.sys – (b06bdrv)
DRV:64bit: - [2009/06/10 22:34:23 | 000,270,848 | —- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\b57nd60a.sys – (b57nd60a)
DRV:64bit: - [2009/06/10 22:31:59 | 000,031,232 | —- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\SysNative\drivers\hcw85cir.sys – (hcw85cir)
DRV:64bit: - [2008/05/24 02:27:28 | 000,154,168 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysNative\drivers\WimFltr.sys – (WimFltr)
DRV - [2011/09/07 18:55:04 | 000,017,536 | —- | M] (ASUS) [Kernel | System | Running] – C:\Program Files (x86)\ASUS\ATK Package\ATK WMIACPI\atkwmiacpi64.sys – (ATKWMIACPIIO)
DRV - [2009/07/14 03:19:10 | 000,019,008 | —- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] – C:\Windows\SysWOW64\drivers\wimmount.sys – (WIMMount)
DRV - [2009/07/03 02:36:14 | 000,015,416 | —- | M] (ASUS) [Kernel | Auto | Running] – C:\Program Files (x86)\ASUS\ATK Package\ATKGFNEX\ASMMAP64.sys – (ASMMAP64)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope =
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…rc=IE-SearchBox
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =

IE - HKU\S-1-5-21-449824696-1012907402-3947539949-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://securedsearch2.lavasoft.com/index.p…4EB4C522C4761BC
IE - HKU\S-1-5-21-449824696-1012907402-3947539949-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-449824696-1012907402-3947539949-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "SecureSearch"
FF - prefs.js..browser.search.defaulturl: "http://securesearch.lavasoft.com/?source=f439e2c0&tbp=homepage&toolbarid=adawaretb&v=2_5&u=AAE4A23EF706D93AB4EB4C51626C1DA6"
FF - prefs.js..browser.search.selectedEngine: "SecureSearch"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.google.es/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:23.0.1
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q="
FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_168.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_168.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.25.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.25.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\ZEON/PDF,version=2.0: C:\Program Files (x86)\Nuance\PDF Reader\bin\nppdf.dll (Zeon Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 23.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2012/12/02 15:24:29 | 000,000,000 | —D | M] (No name found) – C:\Users\Sheana\AppData\Roaming\Mozilla\Extensions
[2013/09/17 02:38:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Sheana\AppData\Roaming\Mozilla\Firefox\Profiles\eldxg9nf.default-1359108170852\extensions
[2013/09/17 02:45:16 | 000,000,000 | —D | M] (Ad-Aware Security Add-on) – C:\Users\Sheana\AppData\Roaming\Mozilla\Firefox\Profiles\eldxg9nf.default-1359108170852\extensions\{87934c42-161d-45bc-8cef-ef18abe2a30c}
[2013/03/12 14:59:22 | 000,000,000 | —D | M] (Lavasoft Search Plugin) – C:\Users\Sheana\AppData\Roaming\Mozilla\Firefox\Profiles\eldxg9nf.default-1359108170852\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2013/01/09 06:24:50 | 000,000,000 | —D | M] (No name found) – C:\Users\Sheana\AppData\Roaming\Mozilla\Firefox\Profiles\vcg5dmud.default\extensions
[2013/01/09 06:24:48 | 000,000,000 | —D | M] (No name found) – C:\Users\Sheana\AppData\Roaming\Mozilla\Firefox\Profiles\vcg5dmud.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2013/08/18 13:36:03 | 000,000,000 | —D | M] (No name found) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013/09/11 01:42:12 | 000,000,000 | —D | M] (Default) – C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

O1 HOSTS File: ([2013/03/09 21:01:48 | 000,000,027 | —- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [AmIcoSinglun64] C:\Program Files (x86)\AmIcoSingLun\AmIcoSinglun64.exe (Alcor Micro Corp.)
O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [SynAsusAcpi] C:\Program Files\Synaptics\SynTP\SynAsusAcpi.exe (Synaptics Incorporated)
O4 - HKLM..\Run: [Ad-Aware Antivirus] C:\Program Files (x86)\Ad-Aware Antivirus\AdAwareLauncher.exe (Lavasoft Limited)
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [ASUSPRP] C:\Program Files (x86)\ASUS\APRP\APRP.EXE (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [ASUSWebStorage] C:\Program Files (x86)\ASUS\ASUS WebStorage\3.0.108.222\AsusWSPanel.exe (ecareme)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files (x86)\ASUS\ATK Package\ATK Media\DMedia.exe (ASUS)
O4 - HKLM..\Run: [ATKOSD2] C:\Program Files (x86)\ASUS\ATK Package\ATKOSD2\ATKOSD2.exe (ASUSTek Computer Inc.)
O4 - HKLM..\Run: [HControlUser] C:\Program Files (x86)\ASUS\ATK Package\ATK Hotkey\HControlUser.exe (ASUS)
O4 - HKLM..\Run: [Nuance PDF Reader-reminder] C:\Program Files (x86)\Nuance\PDF Reader\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SonicMasterTray] C:\Program Files (x86)\ASUS\Sonic Focus\SonicFocusTray.exe (Virage Logic Corporation / Sonic Focus)
O4 - HKU\S-1-5-21-449824696-1012907402-3947539949-1000..\Run: [Spotify] C:\Users\Sheana\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKU\S-1-5-21-449824696-1012907402-3947539949-1000..\Run: [Spotify Web Helper] C:\Users\Sheana\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - Startup: C:\Users\Sheana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Sheana\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Sheana\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-449824696-1012907402-3947539949-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-449824696-1012907402-3947539949-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8B7FA8E4-BC8D-4F9D-81AF-A6ADBDCCB094}: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D3341E02-3932-4EEA-BA2A-8926DB93F3D1}: DhcpNameServer = [removed] [removed]
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/01/09 03:05:47 | 000,000,000 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)


CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/09/16 17:51:47 | 000,526,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ieui.dll
[2013/09/16 17:51:47 | 000,391,168 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ieui.dll
[2013/09/16 17:51:46 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2013/09/16 17:51:45 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2013/09/16 17:51:45 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2013/09/16 17:51:45 | 000,089,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\RegisterIEPKEYs.exe
[2013/09/16 17:51:45 | 000,071,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\RegisterIEPKEYs.exe
[2013/09/16 17:51:45 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2013/09/16 17:51:45 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2013/09/16 17:51:45 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2013/09/16 17:51:45 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2013/09/16 17:51:43 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2013/09/16 17:51:42 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2013/09/16 17:51:42 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2013/09/16 17:51:41 | 003,959,296 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2013/09/16 17:26:45 | 000,155,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\ataport.sys
[2013/09/16 17:26:44 | 003,968,960 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntkrnlpa.exe
[2013/09/16 17:26:43 | 005,550,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl.exe
[2013/09/16 17:26:43 | 003,913,664 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntoskrnl.exe
[2013/09/16 17:26:43 | 001,732,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntdll.dll
[2013/09/16 17:26:42 | 001,161,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\kernel32.dll
[2013/09/16 17:26:42 | 000,424,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\KernelBase.dll
[2013/09/16 17:26:42 | 000,362,496 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64win.dll
[2013/09/16 17:26:42 | 000,338,432 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\conhost.exe
[2013/09/16 17:26:42 | 000,243,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64.dll
[2013/09/16 17:26:42 | 000,215,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\winsrv.dll
[2013/09/16 17:26:42 | 000,112,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\smss.exe
[2013/09/16 17:26:42 | 000,043,520 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\csrsrv.dll
[2013/09/16 17:26:41 | 000,016,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntvdm64.dll
[2013/09/16 17:26:41 | 000,014,336 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\ntvdm64.dll
[2013/09/16 17:26:41 | 000,013,312 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wow64cpu.dll
[2013/09/16 17:26:41 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-security-base-l1-1-0.dll
[2013/09/16 17:26:41 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-file-l1-1-0.dll
[2013/09/16 17:26:41 | 000,005,120 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-file-l1-1-0.dll
[2013/09/16 17:26:41 | 000,005,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wow32.dll
[2013/09/16 17:26:41 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-threadpool-l1-1-0.dll
[2013/09/16 17:26:41 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processthreads-l1-1-0.dll
[2013/09/16 17:26:41 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processthreads-l1-1-0.dll
[2013/09/16 17:26:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/09/16 17:26:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-sysinfo-l1-1-0.dll
[2013/09/16 17:26:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-synch-l1-1-0.dll
[2013/09/16 17:26:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-synch-l1-1-0.dll
[2013/09/16 17:26:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-misc-l1-1-0.dll
[2013/09/16 17:26:41 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localregistry-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-processenvironment-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-namedpipe-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-misc-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-memory-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-memory-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-xstate-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-util-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-string-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-string-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-rtlsupport-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-profile-l1-1-0.dll
[2013/09/16 17:26:41 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-profile-l1-1-0.dll
[2013/09/16 17:26:40 | 000,006,144 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-security-base-l1-1-0.dll
[2013/09/16 17:26:40 | 000,004,608 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-threadpool-l1-1-0.dll
[2013/09/16 17:26:40 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localregistry-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-xstate-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-libraryloader-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-interlocked-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-heap-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,584 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-heap-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-util-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-io-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-io-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-interlocked-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-handle-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-handle-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-fibers-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-fibers-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-errorhandling-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-delayload-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-delayload-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-debug-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-debug-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-datetime-l1-1-0.dll
[2013/09/16 17:26:40 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-datetime-l1-1-0.dll
[2013/09/16 17:26:39 | 000,025,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\setup16.exe
[2013/09/16 17:26:39 | 000,007,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\instnm.exe
[2013/09/16 17:26:39 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\apisetschema.dll
[2013/09/16 17:26:39 | 000,006,656 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\apisetschema.dll
[2013/09/16 17:26:39 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-localization-l1-1-0.dll
[2013/09/16 17:26:39 | 000,004,096 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-localization-l1-1-0.dll
[2013/09/16 17:26:39 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysWow64\api-ms-win-core-console-l1-1-0.dll
[2013/09/16 17:26:39 | 000,003,072 | -H– | C] (Microsoft Corporation) – C:\Windows\SysNative\api-ms-win-core-console-l1-1-0.dll
[2013/09/16 17:26:39 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\user.exe
[2013/09/16 17:26:24 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\shdocvw.dll
[2013/09/15 02:48:41 | 000,000,000 | —D | C] – C:\Users\Sheana\AppData\Local\{AF49E87F-E921-4F8B-9E10-C730D08E3A3D}
[2013/09/11 01:42:12 | 000,000,000 | —D | C] – C:\Program Files (x86)\Mozilla Maintenance Service
[2013/09/11 00:03:22 | 004,745,728 | —- | C] (AVAST Software) – C:\Users\Sheana\Desktop\aswMBR.exe
[2013/09/11 00:02:34 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Sheana\Desktop\OTL.exe
[2013/09/10 23:55:59 | 000,000,000 | —D | C] – C:\AdwCleaner
[2013/09/10 18:03:01 | 000,000,000 | —D | C] – C:\Users\Sheana\Desktop\RK_Quarantine
[2013/09/08 20:34:13 | 000,000,000 | —D | C] – C:\Users\Sheana\AppData\Local\ElevatedDiagnostics
[2013/09/08 11:46:53 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
[2013/09/08 11:46:30 | 000,000,000 | —D | C] – C:\Users\Sheana\AppData\Local\adawarebp
[2013/09/08 11:46:20 | 000,000,000 | —D | C] – C:\Program Files (x86)\Toolbar Cleaner
[2013/09/07 23:49:55 | 005,550,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ntoskrnl(131).exe
[2013/09/07 19:59:00 | 001,472,512 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\crypt32.dll
[2013/09/07 19:59:00 | 000,224,256 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wintrust.dll
[2013/09/07 19:59:00 | 000,139,776 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cryptnet.dll
[2013/09/07 19:47:35 | 001,888,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WMVDECOD.DLL
[2013/09/07 19:47:34 | 001,620,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\WMVDECOD.DLL
[2013/09/07 19:47:30 | 001,217,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rpcrt4.dll
[2013/08/29 16:43:43 | 000,000,000 | —D | C] – C:\Program Files (x86)\Lavasoft
[2013/08/24 14:28:20 | 000,000,000 | —D | C] – C:\Users\Sheana\Desktop\Campanet valley house
[2013/08/19 13:45:08 | 000,000,000 | R–D | C] – C:\Users\Sheana\Dropbox

========== Files - Modified Within 30 Days ==========

[2013/09/16 19:10:57 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/09/16 19:10:57 | 000,009,920 | -H– | M] () – C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/09/16 19:04:31 | 000,001,870 | —- | M] () – C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
[2013/09/16 19:04:24 | 000,000,380 | —- | M] () – C:\Users\Sheana\AppData\Roaming\sp_data.sys
[2013/09/16 19:03:23 | 000,067,584 | —- | M] () – C:\Windows\bootstat.dat
[2013/09/16 19:03:10 | 3145,826,304 | -HS- | M] () – C:\hiberfil.sys
[2013/09/16 18:31:05 | 000,000,830 | —- | M] () – C:\Windows\tasks\Adobe Flash Player Updater.job
[2013/09/16 18:01:28 | 000,293,840 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2013/09/16 17:31:27 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2013/09/16 17:31:27 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013/09/16 17:15:11 | 199,178,828 | —- | M] () – C:\Windows\MEMORY.DMP
[2013/09/11 18:57:22 | 002,218,636 | —- | M] () – C:\Users\Sheana\Desktop\tdsskiller.zip
[2013/09/11 11:24:32 | 003,787,776 | —- | M] () – C:\Users\Sheana\Desktop\RogueKillerX64.exe
[2013/09/11 01:42:13 | 000,001,149 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/09/11 01:30:08 | 000,794,214 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2013/09/11 01:30:08 | 000,663,560 | —- | M] () – C:\Windows\SysNative\perfh009(132).dat
[2013/09/11 01:30:08 | 000,124,832 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2013/09/11 01:00:20 | 000,891,144 | —- | M] () – C:\Users\Sheana\Desktop\SecurityCheck.exe
[2013/09/11 00:04:03 | 004,745,728 | —- | M] (AVAST Software) – C:\Users\Sheana\Desktop\aswMBR.exe
[2013/09/11 00:02:35 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Sheana\Desktop\OTL.exe
[2013/09/10 23:53:59 | 001,037,278 | —- | M] () – C:\Users\Sheana\Desktop\adwcleaner.exe
[2013/09/10 10:45:54 | 000,000,694 | —- | M] () – C:\Users\Sheana\Documents\Libraries - Shortcut.lnk
[2013/09/08 12:45:25 | 000,002,172 | —- | M] () – C:\Windows\SysNative\AutoRunFilter.ini
[2013/09/08 11:41:07 | 000,014,456 | —- | M] (GFI Software) – C:\Windows\SysNative\drivers\gfibto.sys
[2013/08/23 19:19:11 | 000,663,560 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2013/08/19 13:45:09 | 000,001,045 | —- | M] () – C:\Users\Sheana\Desktop\Dropbox.lnk

========== Files Created - No Company Name ==========

[2013/09/11 18:57:08 | 002,218,636 | —- | C] () – C:\Users\Sheana\Desktop\tdsskiller.zip
[2013/09/11 11:23:40 | 003,787,776 | —- | C] () – C:\Users\Sheana\Desktop\RogueKillerX64.exe
[2013/09/11 01:42:13 | 000,001,161 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2013/09/11 01:42:13 | 000,001,149 | —- | C] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2013/09/11 01:00:19 | 000,891,144 | —- | C] () – C:\Users\Sheana\Desktop\SecurityCheck.exe
[2013/09/10 23:53:57 | 001,037,278 | —- | C] () – C:\Users\Sheana\Desktop\adwcleaner.exe
[2013/09/10 10:45:54 | 000,000,694 | —- | C] () – C:\Users\Sheana\Documents\Libraries - Shortcut.lnk
[2013/09/08 11:46:54 | 000,001,870 | —- | C] () – C:\Users\Public\Desktop\Ad-Aware Antivirus.lnk
[2013/08/19 13:45:09 | 000,001,045 | —- | C] () – C:\Users\Sheana\Desktop\Dropbox.lnk
[2013/03/09 19:10:13 | 000,000,355 | —- | C] () – C:\Users\Sheana\Computer - Shortcut.lnk
[2013/01/08 23:50:45 | 000,007,605 | —- | C] () – C:\Users\Sheana\AppData\Local\Resmon.ResmonCfg
[2012/11/15 00:49:42 | 000,000,380 | —- | C] () – C:\Users\Sheana\AppData\Roaming\sp_data.sys
[2012/04/15 12:26:26 | 000,014,119 | —- | C] () – C:\Windows\SysWow64\RaCoInst.dat
[2012/03/05 03:24:03 | 000,066,856 | —- | C] () – C:\Windows\SysWow64\SynTPEnhPS.dll
[2012/03/05 03:23:54 | 000,963,116 | —- | C] () – C:\Windows\SysWow64\igkrng600.bin
[2012/03/05 03:23:53 | 000,217,536 | —- | C] () – C:\Windows\SysWow64\igfcg600m.bin
[2012/03/05 03:23:53 | 000,056,832 | —- | C] () – C:\Windows\SysWow64\igdde32.dll
[2012/03/05 03:23:52 | 013,903,872 | —- | C] () – C:\Windows\SysWow64\ig4icd32.dll
[2012/03/05 03:23:52 | 000,145,804 | —- | C] () – C:\Windows\SysWow64\igcompkrng600.bin
[2011/10/19 06:11:04 | 000,780,126 | —- | C] () – C:\Windows\SysWow64\PerfStringBackup.INI

========== ZeroAccess Check ==========

[2009/07/14 06:55:00 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2013/07/26 04:24:57 | 014,172,672 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2013/07/26 03:55:59 | 012,872,704 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2009/07/14 03:40:51 | 000,909,312 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2010/11/20 14:19:04 | 000,606,208 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2009/07/14 03:41:56 | 000,505,856 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >

< MD5 for: EXPLORER.EXE >
[2011/10/19 04:54:37 | 002,870,272 | —- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/10/19 04:54:37 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/14 03:14:20 | 002,613,248 | —- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/10/19 04:54:37 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2011/10/19 04:54:37 | 002,614,784 | —- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/10/19 04:54:37 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\erdnt\cache86\explorer.exe
[2011/10/19 04:54:37 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\explorer.exe
[2011/10/19 04:54:37 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/10/19 04:54:37 | 002,871,808 | —- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 14:17:10 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2011/10/19 04:54:37 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\SysWOW64\explorer.exe
[2011/10/19 04:54:37 | 002,616,320 | —- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E – C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/11/20 15:24:46 | 002,872,320 | —- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2009/07/14 03:39:10 | 002,868,224 | —- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2011/10/19 04:54:37 | 002,870,784 | —- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D – C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe

< MD5 for: SERVICES.EXE >
[2009/07/14 03:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\erdnt\cache64\services.exe
[2009/07/14 03:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\SysNative\services.exe
[2009/07/14 03:39:37 | 000,328,704 | —- | M] (Microsoft Corporation) MD5=24ACB7E5BE595468E3B9AA488B9B4FCB – C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe

< MD5 for: SVCHOST.EXE >
[2009/07/14 03:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\erdnt\cache86\svchost.exe
[2009/07/14 03:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\SysWOW64\svchost.exe
[2009/07/14 03:14:41 | 000,020,992 | —- | M] (Microsoft Corporation) MD5=54A47F6B5E09A77E61649109C6A08866 – C:\Windows\winsxs\x86_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_b591afc466a15356\svchost.exe
[2009/07/14 03:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\erdnt\cache64\svchost.exe
[2009/07/14 03:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\SysNative\svchost.exe
[2009/07/14 03:39:46 | 000,027,136 | —- | M] (Microsoft Corporation) MD5=C78655BC80301D76ED4FEF1C1EA40A7D – C:\Windows\winsxs\amd64_microsoft-windows-services-svchost_31bf3856ad364e35_6.1.7600.16385_none_11b04b481efec48c\svchost.exe

< MD5 for: USERINIT.EXE >
[2010/11/20 14:17:50 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\erdnt\cache86\userinit.exe
[2010/11/20 14:17:50 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\SysWOW64\userinit.exe
[2010/11/20 14:17:50 | 000,026,624 | —- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | —- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 – C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/14 03:39:48 | 000,030,208 | —- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 15:25:26 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\erdnt\cache64\userinit.exe
[2010/11/20 15:25:26 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\SysNative\userinit.exe
[2010/11/20 15:25:26 | 000,030,720 | —- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 – C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe

< MD5 for: WINLOGON.EXE >
[2010/11/20 15:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\erdnt\cache64\winlogon.exe
[2010/11/20 15:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\SysNative\winlogon.exe
[2010/11/20 15:25:32 | 000,390,656 | —- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009/07/14 03:39:52 | 000,389,120 | —- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A – C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe

< %systemroot%\*. /rp /s >

========== Drive Information ==========

Physical Drives
—————

Drive: \\\\.\\PHYSICALDRIVE0 - Fixed hard disk media
Interface type: IDE
Media Type: Fixed hard disk media
Model: Hitachi HTS547575A9E384
Partitions: 3
Status: OK
Status Info: 0

Partitions
—————

DeviceID: Disk #0, Partition #0
PartitionType: Unknown
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 25,00GB
Starting Offset: 1048576
Hidden sectors: 0


DeviceID: Disk #0, Partition #1
PartitionType: Installable File System
Bootable: True
BootPartition: True
PrimaryPartition: True
Size: 279,00GB
Starting Offset: 26844594176
Hidden sectors: 0


DeviceID: Disk #0, Partition #2
PartitionType: Installable File System
Bootable: False
BootPartition: False
PrimaryPartition: True
Size: 394,00GB
Starting Offset: 326906150912
Hidden sectors: 0


< End of report >


jensaxel
Post #36
It appears that your problem may be caused by a file called "bootcat.cache" located in "c:\windows\system32\codeintegrity" which has been corrupted.

Let’s delete bootcache.cat and see if that solves the problem.

First:

Show hidden Files and Folders
  • open Windows Explorer, (Windows key+E)
  • at the top, click on Organise, >Folder and search options
  • click on the “View” tab
  • under “Files and Folders”, place a check in Show hidden files, folders and drives
Next

Delete this file:

C:\Windows\system32\CodeIntegrity\bootcat.cache
  • open Windows Explorer, (Windows key+E)
  • in the left window, click on C:\
  • in the right window, double-click on each of these in turn: Windows > System32 > CodeIntegrity
  • right-click on the file bootcat.cache and then on Delete

Reboot and let me know how that goes.

Satchfan
Post #37
You are sure that it is safe to delete it? I only ask you because since yesterday afternoon it has run beautifully without any startup or login problems whatsoever.. jensaxel
Post #38
If all is well, leave well alone: we'll do a couple of extra scans and make sure there are no problems left.

Please download SystemLook from one of the links below and save it to your Desktop.

SystemLook (32-bit)
SystemLook (64-bit)
  • double-click SystemLook.exe to run it.
  • copy the content of the following codebox into the main textfield - please make sure you include the colon, (:), at the beginning.:

    :file
C:\Windows\system32\CodeIntegrity\bootcat.cache

  • click the Look button to start the scan.
  • when finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
Note: The log can also be found on your Desktop entitled SystemLook.txt

================================================

Download Malwarebytes-Anti-Malware

Click here.
  • double-click mbam-setup.exe and follow the prompts to install the program – (Note: Vista & Windows 7 users, please right-click and select “Run as Administrator”)
  • at the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware. and Launch Malwarebytes' Anti-Malware, then click Finish..
  • if an update is found, it will download and install the latest version.
  • once the program has loaded, select Perform quick scan, then click Scan.
  • when the scan is complete, click OK, then Show Results to view the results.
  • be sure that everything is checked, and click Remove Selected.
  • when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
  • the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

================================================

Run ESET Online Scan

IMPORTANT Please make sure you uncheck the box next to Remove found threats. Eset will detect anything that looks even slightly suspicious, which could include legitimate program files. If you do not uncheck the box, Eset will automatically remove all suspicious files which could leave some of your software inoperable.

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan
  • click the Eset online Scanner button.
  • for alternate browsers only: (Microsoft Internet Explorer users can skip these steps)


    o click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
    o double click on the Eset installer icon on your desktop.

  • check Yes, I accept the Terms of Use
  • click the Start button.
  • accept any security warnings from your browser.
  • check Scan archives and Remove found threats.
  • click Advanced settings and select the following:


    o Scan potentially unwanted applications
    o Scan for potentially unsafe applications
    o Enable Anti-Stealth technology

  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • when the scan completes, push List of found threats
  • push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

    Note - if ESET doesn't find any threats, no report will be created.
  • push the back button.
  • push Finish
When the scan is complete:

If no threats were found:o put a checkmark in "Uninstall application on close"
o close program
o report to me that nothing was found
If threats were found:o click on "list of threats found"
o click on "export to text file" and save it as ESET results and save to the desktop
o Click on back
o put a checkmark in "Uninstall application on close"
o click on finish
o close program
o copy and paste the report here
Logs to include with the next post:

checkup.txt
Mbam.txt
Results of the Eset scan (if a log was produced)

Can you tell me how your computer is behaving and if there are any outstanding problems.

Satchfan
Post #39
Hi again Limited success The SystemLook log is here SystemLook 04.09.10 by jpshortstuff Log created at 17:34 on 17/09/2013 by Sheana Administrator - Elevation successful ========== file ========== C:\Windows\system32\CodeIntegrity\bootcat.cache - Unable to find/read file. -= EOF =- MalWareBytes seems to have problems downloading - going on forever with nothing being downloaded. :( Eset scanner taking forever - 120 files scanned after 4 min. and finally no movement at all… :angry: I may try both again later.
Post #40
Well got Malwarebytes downloaded and ran a scan Came up with 2 threats, which I asked to remove. Was asked to reboot, which I did. When the computer had rebooted, I got the message that my computer was no longer protected by Malwarebytes as the trial period had expired (??) - and there was no logfile or anything. As for the two threats one was a Trojan of some kind, the other I think was PUP optional but as I expected documentation I didnt take too much notice. Suppose it has done its job The computer as such is behaving flawlessly jensaxel
Post #42
Hi Sorry - yes, there it was: Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Database version: v2013.09.17.08 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 10.0.9200.16686 Sheana :: SHEANA-PC [administrator] 17/09/2013 18:31:28 mbam-log-2013-09-17 (18-31-28).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 230202 Time elapsed: 8 minute(s), 28 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 0 (No malicious items detected) Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 2 C:\Users\Sheana\AppData\Local\Temp\1dVgDyzh.exe.part (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Users\Sheana\Downloads\rcpsetup_softonic_300_250_util_sd.exe (PUP.Optional.RegCleanerPro) -> Quarantined and deleted successfully. (end) Thanx jensaxel
Post #44
Phew it took its time! 1 threat found here is the log C:\Users\Sheana\Downloads\WinZip175.exe a variant of Win32/OpenInstall application cleaned by deleting - quarantined jensaxel

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI