WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93084 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

problems with adchoices [Solved]

Started by lookingforaname , Jun 04 2014 02:07 PM

This topic is locked

25 replies to this topic

#16 lookingforaname

Authentic Member

Authentic Member
147 posts

Posted 11 June 2014 - 05:03 PM

No MBAM log - it didn't detect anything.

I am still seeing "adchoices" on some websites. Is this actually a virus or is it legit? I'm seeing it on my kids' laptop too I am now noticing. The only other weird thing that was happening earlier today is that a CPU usage alert popped up and my CPU usage was at 100 and not going down - when I opened task manager to look at what was going on, it was only avast and firefox that had high processes. It didn't stop on its own, so I restarted the computer and it's been fine. I don't know if this is relevant or not, just thought I'd mention it.

This is the ESAT report:

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.16.100.4_0\plugins\ConduitChromeApiPlugin.dll   a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.20.1.508_0\plugins\ConduitChromeApiPlugin.dll   a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.22.0.588_0\nativeMessaging\TBMessagingHost.exe   a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.22.0.588_0\plugins\ConduitChromeApiPlugin.dll   a variant of Win32/Toolbar.Conduit.AH potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.22.0.588_0\TBHostSupport\TBHostSupport.dll   a variant of Win32/Toolbar.Conduit.AA potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2J5Y6B2I\genfix-e[1]   Win32/Toolbar.Zugo.D potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OPUN7TMO\genfix-e[1]   Win32/Toolbar.Zugo.D potentially unwanted application
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OPUN7TMO\search-update-d[1]   Win32/Toolbar.Zugo.D potentially unwanted application
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DivX_Browser_Bar\hk64tbDivX.dll.vir   Win64/Toolbar.Conduit.A potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DivX_Browser_Bar\hktbDivX.dll.vir   Win32/Toolbar.Conduit.W potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DivX_Browser_Bar\ldrtbDivX.dll.vir   a variant of Win32/Toolbar.Conduit.P potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DivX_Browser_Bar\prxtbDivX.dll.vir   Win32/Toolbar.Conduit.W potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files (x86)\DivX_Browser_Bar\tbDivX.dll.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Program Files (x86)\Mozilla Firefox\browser\nsprotector.js.vir   Win32/Conduit.SearchProtect.A potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Users\Emily Angehr\AppData\LocalLow\DivX_Browser_Bar\hk64tbDivX.dll.vir   Win64/Toolbar.Conduit.A potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Users\Emily Angehr\AppData\LocalLow\DivX_Browser_Bar\hktbDivX.dll.vir   Win32/Toolbar.Conduit.W potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Users\Emily Angehr\AppData\LocalLow\DivX_Browser_Bar\ldrtbDivX.dll.vir   a variant of Win32/Toolbar.Conduit.P potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Users\Emily Angehr\AppData\LocalLow\DivX_Browser_Bar\tbDivX.dll.vir   a variant of Win32/Toolbar.Conduit.X potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Users\family - Jessie\AppData\Roaming\SearchProtect\ffprotect\application.js.vir   Win32/Conduit.SearchProtect.A potentially unwanted application   deleted - quarantined
C:\AdwCleaner\Quarantine\C\Users\family - Jessie\AppData\Roaming\SearchProtect\ffprotect\nsprotector.js.vir   Win32/Conduit.SearchProtect.A potentially unwanted application   deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.16.100.4_0\plugins\ConduitChromeApiPlugin.dll   a variant of Win32/Toolbar.Conduit.AH potentially unwanted application   deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.20.1.508_0\plugins\ConduitChromeApiPlugin.dll   a variant of Win32/Toolbar.Conduit.AH potentially unwanted application   deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.22.0.588_0\nativeMessaging\TBMessagingHost.exe   a variant of Win32/Toolbar.Conduit.AH potentially unwanted application   deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.22.0.588_0\plugins\ConduitChromeApiPlugin.dll   a variant of Win32/Toolbar.Conduit.AH potentially unwanted application   deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Google\Chrome\User Data\Default\Extensions\pkmpcdbgnfjfeelcpebpkflcmbkclfho\10.22.0.588_0\TBHostSupport\TBHostSupport.dll   a variant of Win32/Toolbar.Conduit.AA potentially unwanted application   deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2J5Y6B2I\genfix-e[1]   Win32/Toolbar.Zugo.D potentially unwanted application   deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OPUN7TMO\genfix-e[1]   Win32/Toolbar.Zugo.D potentially unwanted application   deleted - quarantined
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OPUN7TMO\search-update-d[1]   Win32/Toolbar.Zugo.D potentially unwanted application   deleted - quarantined

Advertisements

Register to Remove

#17 OCD

SuperHelper

Malware Team
5,574 posts

Posted 11 June 2014 - 08:00 PM

Hi lookingforaname,

I am still seeing "adchoices" on some websites. Is this actually a virus or is it legit?

What is AdChoices?

There is no need to worry about the AdChoices advertisements, which are displayed by yahoo.com, msn.com and other websites, because they are generated by the website that you are browsing through. AdChoices is an advertising service which allows the well-known websites to provide their users with ads that are relevant to them. It is also known as online behavioral advertising or interest-bases advertising which uses information collected across different websites.

I would tend to believe that the AdChoices you are seeing are legit.

=========================

Avast has been know to be somewhat of a resource hog at times. You could always try a different free Anti-Virus program and see if the problems persists.

=========================

Re-run Farbar Recovery Scan Tool it should be on your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

=========================

In your next post please provide the following:

FRST.txt
Any remaining issues we haven't addressed yet?

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#18 lookingforaname

Authentic Member

Authentic Member
147 posts

Posted 12 June 2014 - 04:49 AM

Sounds good - thank you for your work in making sure I was 100% clear, sorry if I was overly jumpy about something that wasn't actually a problem! Past problems have contributed to me being a little jumpy.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 01
Ran by Emily Angehr (administrator) on ANGEHR-HP on 12-06-2014 06:47:41
Running from C:\Users\Emily Angehr\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingc...can-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingc...can-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\SysWOW64\authServer.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CinemaNow, Inc.) C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe
(Verizon) C:\Program Files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe
(LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Lexmark International, Inc.) C:\Windows\System32\spool\drivers\x64\3\lxebserv.exe
( ) C:\Windows\System32\lxebcoms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(SupportSoft, Inc.) C:\Program Files (x86)\VERIZONDM\bin\sprtsvc.exe
(SupportSoft, Inc.) C:\Program Files (x86)\VERIZONDM\bin\tgsrvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Verizon) C:\Program Files (x86)\Verizon\IHA_MessageCenter\Bin\VzDetectAgent.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-05] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-05-27] (Hewlett-Packard)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2476127409-1960277300-1013031263-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-2476127409-1960277300-1013031263-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://g.msn.com/HPDSK/1
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {63140ECF-C629-BE59-8F0E-90B4FF340C03} URL = http://www.bing.com/...eferrer:source}
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 08 C:\Windows\SysWOW64\nmNsp.dll [241912] ()
Winsock: Catalog5-x64 08 %SystemRoot%\System32\nmNsp.dll [279040] ()
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Emily Angehr\AppData\Roaming\Mozilla\Firefox\Profiles\om40z5p6.default
FF NewTab: hxxp://www.google.com/firefox
FF SearchEngineOrder.1: Google
FF Homepage: google.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Invenda Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Extension: Add to Amazon Wish List Button - C:\Users\Emily Angehr\AppData\Roaming\Mozilla\Firefox\Profiles\om40z5p6.default\Extensions\amznUWL2@amazon.com.xpi [2012-11-18]
FF Extension: Exif Viewer - C:\Users\Emily Angehr\AppData\Roaming\Mozilla\Firefox\Profiles\om40z5p6.default\Extensions\exif_viewer@mozilla.doslash.org.xpi [2012-08-27]
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-12]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-12]

Chrome:
=======
CHR HomePage: https://isearch.avg.com/?cid={C8CABF31-91D5-439E-80D5-53422C38407E}&mid=76ddee94b0b24b40a88d297f8ac694a3-1a242fe8c48b2b9776ae40f83710e4d1b966d437&lang=en&ds=hk013&pr=sa&d=2012-06-29 16:51:23&v=12.2.5.32&sap=hp
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.2.464\_platform_specific\win_x86\widevinecdmadapter.dll ()
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.114\pdf.dll ()
CHR Plugin: (E-centives Coupon Activator Netscape Plugin v. 4.0.0.0) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll (Invenda Corporation)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (NPCIG.dll) - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java Deployment Toolkit 7.0.550.14) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Java™ Platform SE 7 U55) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
CHR Extension: (Entanglement Web App) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2011-05-18]
CHR Extension: (Raindrops) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcipapbfhdnmgihoimbjiadmhpcgcnil [2012-07-18]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24]
CHR Extension: (Poppit) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-05-18]
CHR Extension: (Google Wallet) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

==================== Services (Whitelisted) =================

R2 Auth Service; C:\Windows\system32\authServer.exe [290816 2011-07-28] () [File not signed]
R2 Auth Service; C:\Windows\SysWOW64\authServer.exe [290816 2010-10-25] () [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-06] (AVAST Software)
S4 CCALib8; C:\Program Files (x86)\Canon\CAL\CALMAIN.exe [96341 2005-09-30] (Canon Inc.) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2010-09-24] (Macrovision Europe Ltd.) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 IHA_MessageCenter; C:\Program Files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [354888 2014-04-28] (Verizon)
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-01-22] (Hewlett-Packard Company) [File not signed]
R2 lxebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [45736 2010-04-14] (Lexmark International, Inc.)
R2 lxeb_device; C:\Windows\system32\lxebcoms.exe [1052328 2010-04-14] ( )
R2 lxeb_device; C:\Windows\SysWOW64\lxebcoms.exe [598696 2010-04-14] ( )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 sprtsvc_verizondm; C:\Program Files (x86)\VERIZONDM\bin\sprtsvc.exe [206120 2012-08-07] (SupportSoft, Inc.)
R2 tgsrvc_verizondm; C:\Program Files (x86)\VERIZONDM\bin\tgsrvc.exe [185640 2012-08-07] (SupportSoft, Inc.)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-06] ()
R0 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-06] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-02-24] (AVG Technologies)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-12] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [233488 2010-03-29] (PC Tools)
R1 pctgntdi; C:\Windows\system32\drivers\pctgntdi64.sys [306648 2010-02-05] (PC Tools)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-06-11 18:58 - 2014-06-11 18:58 - 00005962 _____ () C:\Users\Emily Angehr\Desktop\esetscan611.txt
2014-06-11 15:13 - 2014-06-11 15:13 - 02347384 _____ (ESET) C:\Users\Emily Angehr\Downloads\esetsmartinstaller_enu(1).exe
2014-06-10 17:28 - 2014-06-10 17:28 - 00000573 _____ () C:\Users\Emily Angehr\Desktop\liberti cwood website changes.txt
2014-06-10 16:16 - 2014-06-10 18:10 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\2014 fellowship house
2014-06-10 15:24 - 2014-06-10 15:24 - 00000000 __SHD () C:\Users\Emily Angehr\AppData\Local\EmieUserList
2014-06-10 15:24 - 2014-06-10 15:24 - 00000000 __SHD () C:\Users\Emily Angehr\AppData\Local\EmieSiteList
2014-06-10 07:59 - 2014-06-12 06:47 - 00019111 _____ () C:\Users\Emily Angehr\Desktop\FRST.txt
2014-06-09 21:15 - 2014-06-09 21:15 - 00000780 _____ () C:\Users\Emily Angehr\Desktop\JRT.txt
2014-06-09 20:59 - 2014-06-09 20:59 - 01016261 _____ (Thisisu) C:\Users\Emily Angehr\Desktop\JRT.exe
2014-06-09 19:43 - 2014-06-09 19:43 - 01333465 _____ () C:\Users\Emily Angehr\Desktop\adwcleaner_3.212.exe
2014-06-09 19:39 - 2014-06-12 06:47 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\FRST-OlderVersion
2014-06-08 23:02 - 2014-06-08 23:03 - 00050024 _____ () C:\Users\Emily Angehr\Desktop\Addition.txt
2014-06-08 23:01 - 2014-06-12 06:47 - 00000000 ____D () C:\FRST
2014-06-08 23:00 - 2014-06-12 06:47 - 02081792 _____ (Farbar) C:\Users\Emily Angehr\Desktop\FRST64.exe
2014-06-08 22:56 - 2014-06-08 22:56 - 00000526 _____ () C:\Users\Emily Angehr\Desktop\MBR.zip
2014-06-08 22:55 - 2014-06-08 22:55 - 00001910 _____ () C:\Users\Emily Angehr\Desktop\aswMBR.txt
2014-06-08 22:55 - 2014-06-08 22:55 - 00000512 _____ () C:\Users\Emily Angehr\Desktop\MBR.dat
2014-06-08 20:07 - 2014-06-08 20:08 - 04745728 _____ (AVAST Software) C:\Users\Emily Angehr\Desktop\aswMBR.exe
2014-06-08 20:05 - 2014-06-08 20:05 - 00854367 _____ () C:\Users\Emily Angehr\Desktop\SecurityCheck.exe
2014-06-04 16:02 - 2014-06-04 16:02 - 00012017 _____ () C:\Users\Emily Angehr\Downloads\hijackthis.log
2014-06-04 16:01 - 2014-06-04 16:02 - 00388608 _____ (Trend Micro Inc.) C:\Users\Emily Angehr\Downloads\HiJackThis.exe
2014-06-04 15:27 - 2014-06-12 06:28 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-04 15:27 - 2014-06-04 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-04 15:26 - 2014-06-04 15:27 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-04 15:26 - 2014-06-04 15:26 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Emily Angehr\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-04 15:26 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-04 15:26 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-31 11:29 - 2014-05-31 11:29 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(9).exe
2014-05-30 19:13 - 2014-05-30 19:13 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(8).exe
2014-05-30 14:29 - 2014-05-30 14:29 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(7).exe
2014-05-29 16:16 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-29 12:13 - 2014-05-29 12:13 - 00000070 _____ () C:\Users\Emily Angehr\AppData\Roaming\mbam.context.scan
2014-05-28 18:09 - 2014-05-28 18:09 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(6).exe
2014-05-28 18:04 - 2014-05-28 18:04 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(5).exe
2014-05-26 19:20 - 2014-05-26 19:21 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(4).exe
2014-05-26 19:14 - 2014-05-26 19:14 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(3).exe
2014-05-22 19:56 - 2014-06-11 19:59 - 00000360 _____ () C:\Windows\Tasks\HPCeeScheduleForEmily Angehr.job
2014-05-22 19:56 - 2014-05-29 20:00 - 00003228 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForEmily Angehr
2014-05-16 21:25 - 2014-05-16 21:28 - 02347384 _____ (ESET) C:\Users\Emily Angehr\Downloads\esetsmartinstaller_enu (1).exe
2014-05-16 07:49 - 2014-06-04 09:31 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\DropboxMaster
2014-05-15 23:56 - 2014-05-06 00:40 - 23544320 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-15 23:56 - 2014-05-06 00:17 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-15 23:56 - 2014-05-05 23:25 - 17382912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-15 23:56 - 2014-05-05 23:07 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-15 23:56 - 2014-05-05 23:00 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-15 23:56 - 2014-05-05 22:10 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-15 08:05 - 2014-05-09 02:14 - 00477184 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-05-15 08:05 - 2014-05-09 02:11 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-05-15 08:05 - 2014-03-24 22:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 08:05 - 2014-03-24 22:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 08:03 - 2014-04-11 22:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 08:03 - 2014-04-11 22:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 08:03 - 2014-04-11 22:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 08:03 - 2014-04-11 22:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 08:03 - 2014-04-11 22:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 08:03 - 2014-04-11 22:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 08:03 - 2014-04-11 22:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 08:03 - 2014-04-11 22:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 08:03 - 2014-04-11 22:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 08:03 - 2014-03-04 05:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 08:03 - 2014-03-04 05:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 08:03 - 2014-03-04 05:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 08:03 - 2014-03-04 05:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 08:03 - 2014-03-04 05:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 08:03 - 2014-03-04 05:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 08:03 - 2014-03-04 05:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll
2014-05-13 21:54 - 2014-05-13 21:54 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe

==================== One Month Modified Files and Folders =======

2014-06-12 06:48 - 2014-06-10 07:59 - 00019111 _____ () C:\Users\Emily Angehr\Desktop\FRST.txt
2014-06-12 06:48 - 2010-07-20 05:38 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Local\Temp
2014-06-12 06:47 - 2014-06-09 19:39 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\FRST-OlderVersion
2014-06-12 06:47 - 2014-06-08 23:01 - 00000000 ____D () C:\FRST
2014-06-12 06:47 - 2014-06-08 23:00 - 02081792 _____ (Farbar) C:\Users\Emily Angehr\Desktop\FRST64.exe
2014-06-12 06:42 - 2010-07-19 17:57 - 00000910 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-12 06:39 - 2013-01-30 08:54 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-12 06:28 - 2014-06-04 15:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-12 06:27 - 2010-07-19 17:57 - 00000906 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-12 06:27 - 2009-07-14 00:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-12 06:27 - 2009-07-14 00:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-12 06:19 - 2013-12-17 12:11 - 00019225 _____ () C:\Windows\setupact.log
2014-06-12 06:19 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-11 22:27 - 2013-12-17 12:17 - 01993720 _____ () C:\Windows\WindowsUpdate.log
2014-06-11 19:59 - 2014-05-22 19:56 - 00000360 _____ () C:\Windows\Tasks\HPCeeScheduleForEmily Angehr.job
2014-06-11 18:58 - 2014-06-11 18:58 - 00005962 _____ () C:\Users\Emily Angehr\Desktop\esetscan611.txt
2014-06-11 15:13 - 2014-06-11 15:13 - 02347384 _____ (ESET) C:\Users\Emily Angehr\Downloads\esetsmartinstaller_enu(1).exe
2014-06-11 12:50 - 2013-12-17 12:11 - 00233914 _____ () C:\Windows\PFRO.log
2014-06-10 18:10 - 2014-06-10 16:16 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\2014 fellowship house
2014-06-10 17:28 - 2014-06-10 17:28 - 00000573 _____ () C:\Users\Emily Angehr\Desktop\liberti cwood website changes.txt
2014-06-10 15:27 - 2014-01-25 15:41 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-06-10 15:24 - 2014-06-10 15:24 - 00000000 __SHD () C:\Users\Emily Angehr\AppData\Local\EmieUserList
2014-06-10 15:24 - 2014-06-10 15:24 - 00000000 __SHD () C:\Users\Emily Angehr\AppData\Local\EmieSiteList
2014-06-09 21:15 - 2014-06-09 21:15 - 00000780 _____ () C:\Users\Emily Angehr\Desktop\JRT.txt
2014-06-09 20:59 - 2014-06-09 20:59 - 01016261 _____ (Thisisu) C:\Users\Emily Angehr\Desktop\JRT.exe
2014-06-09 20:38 - 2014-03-01 11:28 - 00000000 ____D () C:\AdwCleaner
2014-06-09 19:43 - 2014-06-09 19:43 - 01333465 _____ () C:\Users\Emily Angehr\Desktop\adwcleaner_3.212.exe
2014-06-08 23:03 - 2014-06-08 23:02 - 00050024 _____ () C:\Users\Emily Angehr\Desktop\Addition.txt
2014-06-08 22:56 - 2014-06-08 22:56 - 00000526 _____ () C:\Users\Emily Angehr\Desktop\MBR.zip
2014-06-08 22:55 - 2014-06-08 22:55 - 00001910 _____ () C:\Users\Emily Angehr\Desktop\aswMBR.txt
2014-06-08 22:55 - 2014-06-08 22:55 - 00000512 _____ () C:\Users\Emily Angehr\Desktop\MBR.dat
2014-06-08 20:08 - 2014-06-08 20:07 - 04745728 _____ (AVAST Software) C:\Users\Emily Angehr\Desktop\aswMBR.exe
2014-06-08 20:05 - 2014-06-08 20:05 - 00854367 _____ () C:\Users\Emily Angehr\Desktop\SecurityCheck.exe
2014-06-08 09:14 - 2012-11-09 13:22 - 00000000 ____D () C:\Users\family - Jessie\AppData\Local\Temp
2014-06-07 21:19 - 2012-11-09 13:23 - 00000000 ___RD () C:\Users\family - Jessie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-07 21:19 - 2012-11-09 13:23 - 00000000 ___RD () C:\Users\family - Jessie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-06-05 19:34 - 2010-07-25 16:29 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-06-05 19:33 - 2011-11-10 10:45 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-04 16:02 - 2014-06-04 16:02 - 00012017 _____ () C:\Users\Emily Angehr\Downloads\hijackthis.log
2014-06-04 16:02 - 2014-06-04 16:01 - 00388608 _____ (Trend Micro Inc.) C:\Users\Emily Angehr\Downloads\HiJackThis.exe
2014-06-04 15:47 - 2012-07-24 11:43 - 00000000 ___RD () C:\Users\Emily Angehr\Dropbox
2014-06-04 15:27 - 2014-06-04 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-04 15:27 - 2014-06-04 15:26 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-04 15:27 - 2010-08-21 10:47 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\Malwarebytes
2014-06-04 15:27 - 2010-08-21 10:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 15:26 - 2014-06-04 15:26 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Emily Angehr\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-04 09:41 - 2011-12-09 09:11 - 00000000 ____D () C:\Windows\pss
2014-06-04 09:41 - 2010-07-20 05:43 - 00000000 ___RD () C:\Users\Emily Angehr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-04 09:41 - 2009-07-13 23:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-04 09:31 - 2014-05-16 07:49 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\DropboxMaster
2014-06-04 09:31 - 2012-07-24 10:57 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\Dropbox
2014-06-04 09:30 - 2010-07-23 10:47 - 00180918 _____ () C:\ProgramData\lxebscan.log
2014-05-31 11:29 - 2014-05-31 11:29 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(9).exe
2014-05-31 11:29 - 2012-11-22 14:38 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\.minecraft
2014-05-31 10:41 - 2010-07-20 05:39 - 00000544 _____ () C:\Windows\Tasks\PCDRScheduledMaintenance.job
2014-05-30 19:13 - 2014-05-30 19:13 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(8).exe
2014-05-30 14:29 - 2014-05-30 14:29 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(7).exe
2014-05-29 20:00 - 2014-05-22 19:56 - 00003228 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForEmily Angehr
2014-05-29 12:13 - 2014-05-29 12:13 - 00000070 _____ () C:\Users\Emily Angehr\AppData\Roaming\mbam.context.scan
2014-05-28 21:12 - 2010-11-30 11:10 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\Skype
2014-05-28 18:09 - 2014-05-28 18:09 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(6).exe
2014-05-28 18:04 - 2014-05-28 18:04 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(5).exe
2014-05-26 19:21 - 2014-05-26 19:20 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(4).exe
2014-05-26 19:14 - 2014-05-26 19:14 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(3).exe
2014-05-24 10:17 - 2009-07-14 01:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-24 10:16 - 2012-07-24 11:43 - 00001043 _____ () C:\Users\Emily Angehr\Desktop\Dropbox.lnk
2014-05-24 10:16 - 2012-07-24 10:59 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-24 10:13 - 2013-08-17 21:02 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-17 15:24 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
2014-05-16 21:28 - 2014-05-16 21:25 - 02347384 _____ (ESET) C:\Users\Emily Angehr\Downloads\esetsmartinstaller_enu (1).exe
2014-05-16 07:47 - 2010-07-20 05:43 - 00000000 ___RD () C:\Users\Emily Angehr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-16 07:30 - 2014-05-06 22:06 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-05-15 23:55 - 2013-08-15 03:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-05-15 23:52 - 2010-07-22 15:12 - 93223848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-15 08:00 - 2014-01-01 22:01 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 08:00 - 2012-01-12 17:15 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-15 08:00 - 2012-01-12 17:13 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2014-05-13 21:54 - 2014-05-13 21:54 - 17938608 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerInstaller.exe
2014-05-13 21:54 - 2013-01-30 08:54 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-05-13 21:54 - 2012-03-30 09:16 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-05-13 21:54 - 2011-05-27 09:15 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-05-13 07:50 - 2013-08-23 10:21 - 00001119 _____ () C:\Users\Public\Desktop\Vz In-Home Agent.lnk

Some content of TEMP:
====================
C:\Users\Emily Angehr\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpbhypzr.dll
C:\Users\Emily Angehr\AppData\Local\Temp\Quarantine.exe
C:\Users\family - Jessie\AppData\Local\Temp\msvcp100.dll
C:\Users\family - Jessie\AppData\Local\Temp\msvcr100.dll

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-06-08 00:16

==================== End Of Log ============================

#19 OCD

SuperHelper

Malware Team
5,574 posts

Posted 12 June 2014 - 09:45 AM

Hi lookingforaname,

Reset / Change Homepage in Chrome

Click the Chrome menu on the browser toolbar.
Select Settings.
- Add the home button to the browser toolbar
  Home page button is off by default. Select the "Show Home button" checkbox in the "Appearance" section to show it on the browser toolbar.
- Set your home page
  When the "Show Home button" checkbox is selected, a web address appears below it. This is the address you will want to change. (hxxp://isearch.avg.com/)
  Click Change to enter a link (i.e. http://www.google.com). You can also choose the New Tab page as your home page.

=========================

FRST Fix Script

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the desktop as fixlist.txt

SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR HomePage: https://isearch.avg.com/?cid={C8CABF31-91D5-439E-80D5-53422C38407E}&mid=76ddee94b0b24b40a88d297f8ac694a3-1a242fe8c48b2b9776ae40f83710e4d1b966d437&lang=en&ds=hk013&pr=sa&d=2012-06-29 16:51:23&v=12.2.5.32&sap=hp

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

Run FRST and press the Fix button just once and wait.
The tool will make a log (Fixlog.txt) please post it to your reply.

=========================

TFC

Download TFC to your desktop

Close any open windows.
Double click the TFC icon to run the program
- Vista, Windows 7 & 8 Right click and select "Run as Administrator"
TFC will close all open programs itself in order to run,
Click the Start button to begin the process.
Allow TFC to run uninterrupted.
The program should not take long to finish it's job
Once its finished it should automatically reboot your machine,
if it doesn't, manually reboot to ensure a complete clean

=========================

In your next post please provide the following:

Fixlog.txt
TFC log
How is the computer running?

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#20 lookingforaname

Authentic Member

Authentic Member
147 posts

Posted 13 June 2014 - 10:06 AM

Computer is fine. TFC froze the firs time I ran it - walked away for a few hours, and it wasn't doing anything. Had to force reboot, and then ran it again just now, and it was fine, except I closed it, and now I can't find a log for it? Is there something I should search for? Here's the other log.

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 12-06-2014 01
Ran by Emily Angehr at 2014-06-12 12:36:29 Run:3
Running from C:\Users\Emily Angehr\Desktop
Boot Mode: Normal
==============================================

Content of fixlist:
*****************
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope value is missing.
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
CHR HomePage: https://isearch.avg.com/?cid={C8CABF31-91D5-439E-80D5-53422C38407E}&mid=76ddee94b0b24b40a88d297f8ac694a3-1a242fe8c48b2b9776ae40f83710e4d1b966d437&lang=en&ds=hk013&pr=sa&d=2012-06-29 16:51:23&v=12.2.5.32&sap=hp
*****************

'HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}' => Key deleted successfully.
'HKCR\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}'=> Key not found.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\DefaultScope => Value was restored successfully.
'HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}' => Error deleting key. The key could be protected.
'HKCR\Wow6432Node\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}'=> Key not found.
CHR HomePage: https://isearch.avg.com/?cid={C8CABF31-91D5-439E-80D5-53422C38407E}&mid=76ddee94b0b24b40a88d297f8ac694a3-1a242fe8c48b2b9776ae40f83710e4d1b966d437&lang=en&ds=hk013&pr=sa&d=2012-06-29 16:51:23&v=12.2.5.32&sap=hp ==> The Chrome "Settings" can be used to fix the entry.

==== End of Fixlog ====

#21 OCD

SuperHelper

Malware Team
5,574 posts

Posted 13 June 2014 - 07:55 PM

Hi lookingforaname ,

TFC will do that sometimes. I don't really need to see the log, just knowing it ran to completion is fine.

=========================

Reset / Change Homepage in Chrome

Click the Chrome menu on the browser toolbar.
Select Settings.
- Add the home button to the browser toolbar
  Home page button is off by default. Select the "Show Home button" checkbox in the "Appearance" section to show it on the browser toolbar.
- Set your home page
  When the "Show Home button" checkbox is selected, a web address appears below it. This is the address you will want to change. (hxxp://isearch.avg.com/)
  Click Change to enter a link (i.e. http://www.google.com). You can also choose the New Tab page as your home page.

=========================

One last FRST scan to make sure we didn't overlook anything and we will do some housekeeping and get you on your way.

Re-run Farbar Recovery Scan Tool it should be on your desktop.

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
When the tool opens click Yes to disclaimer.
Press Scan button.
It will make a log (FRST.txt) in the same directory the tool is run. Please copy and paste it to your reply.

=========================

In your next post please provide the following:

FRST.txt
Any remaining issues?

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#22 lookingforaname

Authentic Member

Authentic Member
147 posts

Posted 13 June 2014 - 08:07 PM

Everything seems good - thanks so much for your help!

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 12-06-2014 01
Ran by Emily Angehr (administrator) on ANGEHR-HP on 13-06-2014 22:05:28
Running from C:\Users\Emily Angehr\Desktop
Platform: Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 11
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingc...can-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingc...can-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
() C:\Windows\SysWOW64\authServer.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CinemaNow, Inc.) C:\Program Files (x86)\CinemaNow\CinemaNow Media Manager\CinemaNowSvc.exe
(Verizon) C:\Program Files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe
(LeapFrog Enterprises, Inc.) C:\Program Files (x86)\LeapFrog\LeapFrog Connect\CommandService.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Lexmark International, Inc.) C:\Windows\System32\spool\drivers\x64\3\lxebserv.exe
( ) C:\Windows\System32\lxebcoms.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Microsoft Corporation) C:\Program Files\Microsoft LifeCam\MSCamS64.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe
(SupportSoft, Inc.) C:\Program Files (x86)\VERIZONDM\bin\sprtsvc.exe
(SupportSoft, Inc.) C:\Program Files (x86)\VERIZONDM\bin\tgsrvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Verizon) C:\Program Files (x86)\Verizon\IHA_MessageCenter\Bin\VzDetectAgent.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe

==================== Registry (Whitelisted) ==================

HKLM-x32\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3890208 2014-06-05] (AVAST Software)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-06-10] (Hewlett-Packard)
Winlogon\Notify\SDWinLogon-x32: SDWinLogon.dll [X]
HKU\S-1-5-21-2476127409-1960277300-1013031263-1001\...\Run: [iCloudServices] => C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe [59720 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-2476127409-1960277300-1013031263-1001\...\Run: [ApplePhotoStreams] => C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe [59720 2013-11-20] (Apple Inc.)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPDSK/1
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Restore = http://g.msn.com/HPDSK/1
HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {63140ECF-C629-BE59-8F0E-90B4FF340C03} URL = http://www.bing.com/...eferrer:source}
BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
DPF: HKLM-x32 {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset...lineScanner.cab
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 08 C:\Windows\SysWOW64\nmNsp.dll [241912] ()
Winsock: Catalog5-x64 08 %SystemRoot%\System32\nmNsp.dll [279040] ()
Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\Emily Angehr\AppData\Roaming\Mozilla\Firefox\Profiles\om40z5p6.default
FF NewTab: hxxp://www.google.com/firefox
FF SearchEngineOrder.1: Google
FF Homepage: google.com
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_13_0_0_214.dll ()
FF Plugin: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin: @microsoft.com/GENUINE - disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @divx.com/DivX Web Player Plug-In,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.55.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE - disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPcol400.dll (Invenda Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin6.dll (Apple Inc.)
FF Extension: Add to Amazon Wish List Button - C:\Users\Emily Angehr\AppData\Roaming\Mozilla\Firefox\Profiles\om40z5p6.default\Extensions\amznUWL2@amazon.com.xpi [2012-11-18]
FF Extension: Exif Viewer - C:\Users\Emily Angehr\AppData\Roaming\Mozilla\Firefox\Profiles\om40z5p6.default\Extensions\exif_viewer@mozilla.doslash.org.xpi [2012-08-27]
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-12]
FF HKLM-x32\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2012-01-12]

Chrome:
=======
CHR HomePage: https://www.google.com/
CHR StartupUrls: "hxxp://www.google.com/"
CHR Plugin: (Widevine Content Decryption Module) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\WidevineCDM\1.4.2.464\_platform_specific\win_x86\widevinecdmadapter.dll No File
CHR Plugin: (Shockwave Flash) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files (x86)\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
CHR Plugin: (E-centives Coupon Activator Netscape Plugin v. 4.0.0.0) - C:\Program Files (x86)\Mozilla Firefox\plugins\NPcol400.dll (Invenda Corporation)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files (x86)\QuickTime\plugins\npqtplugin6.dll (Apple Inc.)
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (NPCIG.dll) - C:\Program Files (x86)\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
CHR Plugin: (DivX VOD Helper Plug-in) - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
CHR Plugin: (DivX Plus Web Player) - C:\Program Files (x86)\DivX\DivX Web Player\npdivx32.dll (DivX, LLC)
CHR Plugin: (Google Earth Plugin) - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
CHR Plugin: (Google Update) - C:\Program Files (x86)\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
CHR Plugin: (Java Deployment Toolkit 7.0.550.14) - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
CHR Plugin: (Java™ Platform SE 7 U55) - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Windows Live Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (iTunes Application Detector) - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Plugin: (Shockwave Flash) - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
CHR Extension: (Entanglement Web App) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2011-05-18]
CHR Extension: (Raindrops) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\bcipapbfhdnmgihoimbjiadmhpcgcnil [2012-07-18]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-24]
CHR Extension: (Poppit) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-05-18]
CHR Extension: (Google Wallet) - C:\Users\Emily Angehr\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

==================== Services (Whitelisted) =================

R2 Auth Service; C:\Windows\system32\authServer.exe [290816 2011-07-28] () [File not signed]
R2 Auth Service; C:\Windows\SysWOW64\authServer.exe [290816 2010-10-25] () [File not signed]
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2014-05-06] (AVAST Software)
S4 CCALib8; C:\Program Files (x86)\Canon\CAL\CALMAIN.exe [96341 2005-09-30] (Canon Inc.) [File not signed]
S3 FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [651720 2010-09-24] (Macrovision Europe Ltd.) [File not signed]
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 IHA_MessageCenter; C:\Program Files (x86)\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [354888 2014-04-28] (Verizon)
R2 LightScribeService; c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [73728 2010-01-22] (Hewlett-Packard Company) [File not signed]
R2 lxebCATSCustConnectService; C:\Windows\system32\spool\DRIVERS\x64\3\\lxebserv.exe [45736 2010-04-14] (Lexmark International, Inc.)
R2 lxeb_device; C:\Windows\system32\lxebcoms.exe [1052328 2010-04-14] ( )
R2 lxeb_device; C:\Windows\SysWOW64\lxebcoms.exe [598696 2010-04-14] ( )
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1738200 2014-04-25] (Safer-Networking Ltd.)
R2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [2081752 2014-04-25] (Safer-Networking Ltd.)
R2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2014-04-25] (Safer-Networking Ltd.)
R2 sprtsvc_verizondm; C:\Program Files (x86)\VERIZONDM\bin\sprtsvc.exe [206120 2012-08-07] (SupportSoft, Inc.)
R2 tgsrvc_verizondm; C:\Program Files (x86)\VERIZONDM\bin\tgsrvc.exe [185640 2012-08-07] (SupportSoft, Inc.)

==================== Drivers (Whitelisted) ====================

R2 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [29208 2014-05-06] ()
R0 aswKbd; C:\Windows\System32\Drivers\aswKbd.sys [22600 2013-05-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [79184 2014-05-06] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [93568 2014-05-06] (AVAST Software)
R0 aswRvrt; C:\Windows\System32\Drivers\aswRvrt.sys [65776 2014-05-06] ()
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [1039096 2014-05-15] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [423240 2014-05-15] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [85328 2014-05-15] (AVAST Software)
R0 aswVmm; C:\Windows\System32\Drivers\aswVmm.sys [208416 2014-05-06] ()
R1 avgtp; C:\Windows\system32\drivers\avgtpx64.sys [50976 2014-02-24] (AVG Technologies)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-06-13] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
R0 PCTCore; C:\Windows\System32\drivers\PCTCore64.sys [233488 2010-03-29] (PC Tools)
R1 pctgntdi; C:\Windows\system32\drivers\pctgntdi64.sys [306648 2010-02-05] (PC Tools)
S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-13] (Brother Industries Ltd.)

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2014-06-13 12:00 - 2014-06-13 12:00 - 00448512 _____ (OldTimer Tools) C:\Users\Emily Angehr\Desktop\TFC.exe
2014-06-12 06:34 - 2014-05-30 06:21 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-06-12 06:34 - 2014-05-30 06:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-06-12 06:34 - 2014-05-30 06:02 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-06-12 06:34 - 2014-05-30 05:45 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-06-12 06:34 - 2014-05-30 05:39 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-06-12 06:34 - 2014-05-30 05:39 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-06-12 06:34 - 2014-05-30 05:38 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-06-12 06:34 - 2014-05-30 05:28 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-06-12 06:34 - 2014-05-30 05:27 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-06-12 06:34 - 2014-05-30 05:24 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-06-12 06:34 - 2014-05-30 05:21 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-06-12 06:34 - 2014-05-30 05:21 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-06-12 06:34 - 2014-05-30 05:20 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-06-12 06:34 - 2014-05-30 05:18 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-06-12 06:34 - 2014-05-30 05:11 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-06-12 06:34 - 2014-05-30 05:08 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-06-12 06:34 - 2014-05-30 05:06 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-06-12 06:34 - 2014-05-30 05:02 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-06-12 06:34 - 2014-05-30 04:55 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-06-12 06:34 - 2014-05-30 04:49 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-06-12 06:34 - 2014-05-30 04:46 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-06-12 06:34 - 2014-05-30 04:44 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-06-12 06:34 - 2014-05-30 04:44 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-06-12 06:34 - 2014-05-30 04:43 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-06-12 06:34 - 2014-05-30 04:42 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-06-12 06:34 - 2014-05-30 04:38 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-06-12 06:34 - 2014-05-30 04:35 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-06-12 06:34 - 2014-05-30 04:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-06-12 06:34 - 2014-05-30 04:33 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-06-12 06:34 - 2014-05-30 04:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-06-12 06:34 - 2014-05-30 04:29 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-06-12 06:34 - 2014-05-30 04:28 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-06-12 06:34 - 2014-05-30 04:27 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-06-12 06:34 - 2014-05-30 04:24 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-06-12 06:34 - 2014-05-30 04:23 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-06-12 06:34 - 2014-05-30 04:16 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-06-12 06:34 - 2014-05-30 04:10 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-06-12 06:34 - 2014-05-30 04:06 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-06-12 06:34 - 2014-05-30 04:04 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-06-12 06:34 - 2014-05-30 04:02 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-06-12 06:34 - 2014-05-30 03:56 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-06-12 06:34 - 2014-05-30 03:56 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-06-12 06:34 - 2014-05-30 03:54 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-06-12 06:34 - 2014-05-30 03:50 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-06-12 06:34 - 2014-05-30 03:49 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-06-12 06:34 - 2014-05-30 03:43 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-06-12 06:34 - 2014-05-30 03:40 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-06-12 06:34 - 2014-05-30 03:30 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-06-12 06:34 - 2014-05-30 03:21 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-06-12 06:34 - 2014-05-30 03:15 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-06-12 06:34 - 2014-05-30 03:13 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-06-12 06:34 - 2014-05-30 03:13 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-06-12 06:34 - 2014-04-24 22:34 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll
2014-06-12 06:34 - 2014-04-24 22:06 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll
2014-06-12 06:33 - 2014-06-08 05:13 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-12 06:33 - 2014-06-08 05:08 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-12 06:33 - 2014-04-04 22:47 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2014-06-12 06:33 - 2014-04-04 22:47 - 00288192 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS
2014-06-12 06:33 - 2014-03-26 10:44 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll
2014-06-12 06:33 - 2014-03-26 10:44 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll
2014-06-12 06:33 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml6r.dll
2014-06-12 06:33 - 2014-03-26 10:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll
2014-06-12 06:33 - 2014-03-26 10:27 - 01389056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll
2014-06-12 06:33 - 2014-03-26 10:27 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll
2014-06-12 06:33 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6r.dll
2014-06-12 06:33 - 2014-03-26 10:25 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll
2014-06-11 18:58 - 2014-06-11 18:58 - 00005962 _____ () C:\Users\Emily Angehr\Desktop\esetscan611.txt
2014-06-11 15:13 - 2014-06-11 15:13 - 02347384 _____ (ESET) C:\Users\Emily Angehr\Downloads\esetsmartinstaller_enu(1).exe
2014-06-10 17:28 - 2014-06-10 17:28 - 00000573 _____ () C:\Users\Emily Angehr\Desktop\liberti cwood website changes.txt
2014-06-10 16:16 - 2014-06-10 18:10 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\2014 fellowship house
2014-06-10 15:24 - 2014-06-10 15:24 - 00000000 __SHD () C:\Users\Emily Angehr\AppData\Local\EmieUserList
2014-06-10 15:24 - 2014-06-10 15:24 - 00000000 __SHD () C:\Users\Emily Angehr\AppData\Local\EmieSiteList
2014-06-10 07:59 - 2014-06-13 22:05 - 00019054 _____ () C:\Users\Emily Angehr\Desktop\FRST.txt
2014-06-09 21:15 - 2014-06-09 21:15 - 00000780 _____ () C:\Users\Emily Angehr\Desktop\JRT.txt
2014-06-09 19:43 - 2014-06-09 19:43 - 01333465 _____ () C:\Users\Emily Angehr\Desktop\adwcleaner_3.212.exe
2014-06-09 19:39 - 2014-06-12 06:47 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\FRST-OlderVersion
2014-06-08 23:02 - 2014-06-08 23:03 - 00050024 _____ () C:\Users\Emily Angehr\Desktop\Addition.txt
2014-06-08 23:01 - 2014-06-13 22:05 - 00000000 ____D () C:\FRST
2014-06-08 23:00 - 2014-06-12 06:47 - 02081792 _____ (Farbar) C:\Users\Emily Angehr\Desktop\FRST64.exe
2014-06-08 22:55 - 2014-06-08 22:55 - 00001910 _____ () C:\Users\Emily Angehr\Desktop\aswMBR.txt
2014-06-08 22:55 - 2014-06-08 22:55 - 00000512 _____ () C:\Users\Emily Angehr\Desktop\MBR.dat
2014-06-08 20:07 - 2014-06-08 20:08 - 04745728 _____ (AVAST Software) C:\Users\Emily Angehr\Desktop\aswMBR.exe
2014-06-08 20:05 - 2014-06-08 20:05 - 00854367 _____ () C:\Users\Emily Angehr\Desktop\SecurityCheck.exe
2014-06-04 16:02 - 2014-06-04 16:02 - 00012017 _____ () C:\Users\Emily Angehr\Downloads\hijackthis.log
2014-06-04 16:01 - 2014-06-04 16:02 - 00388608 _____ (Trend Micro Inc.) C:\Users\Emily Angehr\Downloads\HiJackThis.exe
2014-06-04 15:27 - 2014-06-13 16:29 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-04 15:27 - 2014-06-04 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-04 15:26 - 2014-06-04 15:27 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-04 15:26 - 2014-06-04 15:26 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Emily Angehr\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-04 15:26 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-06-04 15:26 - 2014-05-12 07:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-05-31 11:29 - 2014-05-31 11:29 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(9).exe
2014-05-30 19:13 - 2014-05-30 19:13 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(8).exe
2014-05-30 14:29 - 2014-05-30 14:29 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(7).exe
2014-05-29 16:16 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-05-29 12:13 - 2014-05-29 12:13 - 00000070 _____ () C:\Users\Emily Angehr\AppData\Roaming\mbam.context.scan
2014-05-28 18:09 - 2014-05-28 18:09 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(6).exe
2014-05-28 18:04 - 2014-05-28 18:04 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(5).exe
2014-05-26 19:20 - 2014-05-26 19:21 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(4).exe
2014-05-26 19:14 - 2014-05-26 19:14 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(3).exe
2014-05-22 19:56 - 2014-06-13 10:01 - 00000360 _____ () C:\Windows\Tasks\HPCeeScheduleForEmily Angehr.job
2014-05-22 19:56 - 2014-06-12 19:17 - 00003228 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForEmily Angehr
2014-05-16 21:25 - 2014-05-16 21:28 - 02347384 _____ (ESET) C:\Users\Emily Angehr\Downloads\esetsmartinstaller_enu (1).exe
2014-05-16 07:49 - 2014-06-04 09:31 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\DropboxMaster
2014-05-15 08:05 - 2014-03-24 22:43 - 14175744 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2014-05-15 08:05 - 2014-03-24 22:09 - 12874240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2014-05-15 08:03 - 2014-04-11 22:22 - 00155072 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2014-05-15 08:03 - 2014-04-11 22:22 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2014-05-15 08:03 - 2014-04-11 22:19 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-05-15 08:03 - 2014-04-11 22:19 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2014-05-15 08:03 - 2014-04-11 22:19 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2014-05-15 08:03 - 2014-04-11 22:19 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2014-05-15 08:03 - 2014-04-11 22:19 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2014-05-15 08:03 - 2014-04-11 22:12 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-05-15 08:03 - 2014-04-11 22:10 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-05-15 08:03 - 2014-03-04 05:47 - 05550016 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2014-05-15 08:03 - 2014-03-04 05:44 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00722944 _____ (Microsoft Corporation) C:\Windows\system32\objsel.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00424960 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-05-15 08:03 - 2014-03-04 05:44 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\wincredprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-05-15 08:03 - 2014-03-04 05:43 - 00057344 _____ (Microsoft Corporation) C:\Windows\system32\cngprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\adprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\capiprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00052736 _____ (Microsoft Corporation) C:\Windows\system32\dpapiprovider.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\dimsroam.dll
2014-05-15 08:03 - 2014-03-04 05:43 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-05-15 08:03 - 2014-03-04 05:20 - 03969984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2014-05-15 08:03 - 2014-03-04 05:20 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2014-05-15 08:03 - 2014-03-04 05:17 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00538112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\objsel.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cngprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00049664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\capiprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpapiprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dimsroam.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wincredprovider.dll
2014-05-15 08:03 - 2014-03-04 05:17 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-05-15 08:03 - 2014-03-04 05:16 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll

==================== One Month Modified Files and Folders =======

2014-06-13 22:06 - 2014-06-10 07:59 - 00019054 _____ () C:\Users\Emily Angehr\Desktop\FRST.txt
2014-06-13 22:06 - 2010-07-20 05:38 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Local\Temp
2014-06-13 22:05 - 2014-06-08 23:01 - 00000000 ____D () C:\FRST
2014-06-13 21:39 - 2013-01-30 08:54 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-06-13 21:38 - 2010-07-19 17:57 - 00000910 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-06-13 16:29 - 2014-06-04 15:27 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-06-13 14:22 - 2010-08-09 12:21 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\Adobe
2014-06-13 14:22 - 2010-07-19 17:57 - 00000906 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-06-13 13:17 - 2009-07-13 23:20 - 00000000 ____D () C:\Windows\rescache
2014-06-13 12:22 - 2009-07-14 00:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-06-13 12:22 - 2009-07-14 00:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-06-13 12:19 - 2013-12-17 12:17 - 01190198 _____ () C:\Windows\WindowsUpdate.log
2014-06-13 12:13 - 2013-12-17 12:11 - 00019841 _____ () C:\Windows\setupact.log
2014-06-13 12:13 - 2009-07-14 01:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-06-13 12:01 - 2012-11-09 13:22 - 00000000 ____D () C:\Users\family - Jessie\AppData\Local\Temp
2014-06-13 12:00 - 2014-06-13 12:00 - 00448512 _____ (OldTimer Tools) C:\Users\Emily Angehr\Desktop\TFC.exe
2014-06-13 10:01 - 2014-05-22 19:56 - 00000360 _____ () C:\Windows\Tasks\HPCeeScheduleForEmily Angehr.job
2014-06-12 23:57 - 2013-08-15 03:03 - 00000000 ____D () C:\Windows\system32\MRT
2014-06-12 23:55 - 2010-07-22 15:12 - 95414520 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-06-12 23:52 - 2014-05-06 22:06 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-06-12 19:17 - 2014-05-22 19:56 - 00003228 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForEmily Angehr
2014-06-12 19:16 - 2011-11-10 10:45 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-06-12 19:16 - 2010-07-25 16:29 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-06-12 06:47 - 2014-06-09 19:39 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\FRST-OlderVersion
2014-06-12 06:47 - 2014-06-08 23:00 - 02081792 _____ (Farbar) C:\Users\Emily Angehr\Desktop\FRST64.exe
2014-06-11 18:58 - 2014-06-11 18:58 - 00005962 _____ () C:\Users\Emily Angehr\Desktop\esetscan611.txt
2014-06-11 15:13 - 2014-06-11 15:13 - 02347384 _____ (ESET) C:\Users\Emily Angehr\Downloads\esetsmartinstaller_enu(1).exe
2014-06-11 12:50 - 2013-12-17 12:11 - 00233914 _____ () C:\Windows\PFRO.log
2014-06-10 18:10 - 2014-06-10 16:16 - 00000000 ____D () C:\Users\Emily Angehr\Desktop\2014 fellowship house
2014-06-10 17:28 - 2014-06-10 17:28 - 00000573 _____ () C:\Users\Emily Angehr\Desktop\liberti cwood website changes.txt
2014-06-10 15:27 - 2014-01-25 15:41 - 00000000 ____D () C:\ProgramData\McAfee Security Scan
2014-06-10 15:24 - 2014-06-10 15:24 - 00000000 __SHD () C:\Users\Emily Angehr\AppData\Local\EmieUserList
2014-06-10 15:24 - 2014-06-10 15:24 - 00000000 __SHD () C:\Users\Emily Angehr\AppData\Local\EmieSiteList
2014-06-09 21:15 - 2014-06-09 21:15 - 00000780 _____ () C:\Users\Emily Angehr\Desktop\JRT.txt
2014-06-09 20:38 - 2014-03-01 11:28 - 00000000 ____D () C:\AdwCleaner
2014-06-09 19:43 - 2014-06-09 19:43 - 01333465 _____ () C:\Users\Emily Angehr\Desktop\adwcleaner_3.212.exe
2014-06-08 23:03 - 2014-06-08 23:02 - 00050024 _____ () C:\Users\Emily Angehr\Desktop\Addition.txt
2014-06-08 22:55 - 2014-06-08 22:55 - 00001910 _____ () C:\Users\Emily Angehr\Desktop\aswMBR.txt
2014-06-08 22:55 - 2014-06-08 22:55 - 00000512 _____ () C:\Users\Emily Angehr\Desktop\MBR.dat
2014-06-08 20:08 - 2014-06-08 20:07 - 04745728 _____ (AVAST Software) C:\Users\Emily Angehr\Desktop\aswMBR.exe
2014-06-08 20:05 - 2014-06-08 20:05 - 00854367 _____ () C:\Users\Emily Angehr\Desktop\SecurityCheck.exe
2014-06-08 05:13 - 2014-06-12 06:33 - 00506368 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-06-08 05:08 - 2014-06-12 06:33 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-06-07 21:19 - 2012-11-09 13:23 - 00000000 ___RD () C:\Users\family - Jessie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-07 21:19 - 2012-11-09 13:23 - 00000000 ___RD () C:\Users\family - Jessie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-06-04 16:02 - 2014-06-04 16:02 - 00012017 _____ () C:\Users\Emily Angehr\Downloads\hijackthis.log
2014-06-04 16:02 - 2014-06-04 16:01 - 00388608 _____ (Trend Micro Inc.) C:\Users\Emily Angehr\Downloads\HiJackThis.exe
2014-06-04 15:47 - 2012-07-24 11:43 - 00000000 ___RD () C:\Users\Emily Angehr\Dropbox
2014-06-04 15:27 - 2014-06-04 15:27 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-06-04 15:27 - 2014-06-04 15:26 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-04 15:27 - 2010-08-21 10:47 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\Malwarebytes
2014-06-04 15:27 - 2010-08-21 10:47 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-04 15:26 - 2014-06-04 15:26 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Emily Angehr\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-04 09:41 - 2011-12-09 09:11 - 00000000 ____D () C:\Windows\pss
2014-06-04 09:41 - 2010-07-20 05:43 - 00000000 ___RD () C:\Users\Emily Angehr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-04 09:41 - 2009-07-13 23:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
2014-06-04 09:31 - 2014-05-16 07:49 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\DropboxMaster
2014-06-04 09:31 - 2012-07-24 10:57 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\Dropbox
2014-06-04 09:30 - 2010-07-23 10:47 - 00180918 _____ () C:\ProgramData\lxebscan.log
2014-05-31 11:29 - 2014-05-31 11:29 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(9).exe
2014-05-31 11:29 - 2012-11-22 14:38 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\.minecraft
2014-05-31 10:41 - 2010-07-20 05:39 - 00000544 _____ () C:\Windows\Tasks\PCDRScheduledMaintenance.job
2014-05-30 19:13 - 2014-05-30 19:13 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(8).exe
2014-05-30 14:29 - 2014-05-30 14:29 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(7).exe
2014-05-30 06:21 - 2014-06-12 06:34 - 23414784 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-05-30 06:02 - 2014-06-12 06:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-05-30 06:02 - 2014-06-12 06:34 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-05-30 05:45 - 2014-06-12 06:34 - 02768384 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-05-30 05:39 - 2014-06-12 06:34 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-05-30 05:39 - 2014-06-12 06:34 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-05-30 05:38 - 2014-06-12 06:34 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-05-30 05:28 - 2014-06-12 06:34 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-05-30 05:27 - 2014-06-12 06:34 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-05-30 05:24 - 2014-06-12 06:34 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-05-30 05:21 - 2014-06-12 06:34 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-05-30 05:21 - 2014-06-12 06:34 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-05-30 05:20 - 2014-06-12 06:34 - 00752640 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-05-30 05:18 - 2014-06-12 06:34 - 17271296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-05-30 05:11 - 2014-06-12 06:34 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-05-30 05:08 - 2014-06-12 06:34 - 05782528 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-05-30 05:06 - 2014-06-12 06:34 - 00452096 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-05-30 05:02 - 2014-06-12 06:34 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-05-30 04:55 - 2014-06-12 06:34 - 00038400 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-05-30 04:49 - 2014-06-12 06:34 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-05-30 04:46 - 2014-06-12 06:34 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-05-30 04:44 - 2014-06-12 06:34 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-05-30 04:44 - 2014-06-12 06:34 - 00295424 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-05-30 04:43 - 2014-06-12 06:34 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-05-30 04:42 - 2014-06-12 06:34 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-05-30 04:38 - 2014-06-12 06:34 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-05-30 04:35 - 2014-06-12 06:34 - 00608768 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-05-30 04:34 - 2014-06-12 06:34 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-05-30 04:33 - 2014-06-12 06:34 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-05-30 04:30 - 2014-06-12 06:34 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-05-30 04:29 - 2014-06-12 06:34 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-05-30 04:28 - 2014-06-12 06:34 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-05-30 04:27 - 2014-06-12 06:34 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-05-30 04:24 - 2014-06-12 06:34 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-05-30 04:23 - 2014-06-12 06:34 - 02040832 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-05-30 04:16 - 2014-06-12 06:34 - 00368128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-05-30 04:10 - 2014-06-12 06:34 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-05-30 04:06 - 2014-06-12 06:34 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-05-30 04:04 - 2014-06-12 06:34 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-05-30 04:02 - 2014-06-12 06:34 - 00242688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-05-30 03:56 - 2014-06-12 06:34 - 04244992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-05-30 03:56 - 2014-06-12 06:34 - 02266112 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-05-30 03:54 - 2014-06-12 06:34 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-05-30 03:50 - 2014-06-12 06:34 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-05-30 03:49 - 2014-06-12 06:34 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-05-30 03:43 - 2014-06-12 06:34 - 13522944 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-05-30 03:40 - 2014-06-12 06:34 - 11725312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-05-30 03:30 - 2014-06-12 06:34 - 01398272 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-05-30 03:21 - 2014-06-12 06:34 - 01790976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-05-30 03:15 - 2014-06-12 06:34 - 01143296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-05-30 03:13 - 2014-06-12 06:34 - 00846336 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-05-30 03:13 - 2014-06-12 06:34 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-05-29 12:13 - 2014-05-29 12:13 - 00000070 _____ () C:\Users\Emily Angehr\AppData\Roaming\mbam.context.scan
2014-05-28 21:12 - 2010-11-30 11:10 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\Skype
2014-05-28 18:09 - 2014-05-28 18:09 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(6).exe
2014-05-28 18:04 - 2014-05-28 18:04 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(5).exe
2014-05-26 19:21 - 2014-05-26 19:20 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(4).exe
2014-05-26 19:14 - 2014-05-26 19:14 - 00675988 _____ () C:\Users\Emily Angehr\Downloads\Minecraft(3).exe
2014-05-24 10:17 - 2009-07-14 01:13 - 00782510 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-24 10:16 - 2012-07-24 11:43 - 00001043 _____ () C:\Users\Emily Angehr\Desktop\Dropbox.lnk
2014-05-24 10:16 - 2012-07-24 10:59 - 00000000 ____D () C:\Users\Emily Angehr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-24 10:13 - 2013-08-17 21:02 - 00004182 _____ () C:\Windows\System32\Tasks\avast! Emergency Update
2014-05-16 21:28 - 2014-05-16 21:25 - 02347384 _____ (ESET) C:\Users\Emily Angehr\Downloads\esetsmartinstaller_enu (1).exe
2014-05-16 07:47 - 2010-07-20 05:43 - 00000000 ___RD () C:\Users\Emily Angehr\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
2014-05-15 08:00 - 2014-01-01 22:01 - 00085328 _____ (AVAST Software) C:\Windows\system32\Drivers\aswstm.sys
2014-05-15 08:00 - 2012-01-12 17:15 - 00423240 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2014-05-15 08:00 - 2012-01-12 17:13 - 01039096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-06-08 00:16

==================== End Of Log ============================

#23 OCD

SuperHelper

Malware Team
5,574 posts

Posted 13 June 2014 - 09:34 PM

Hi lookingforaname,

Your log appears to be clean. :thumbup:

We have a few items to take care of before we get to the All Clean Speech.

=========================

Remove Disinfection Tools

Download Delfix
Tick the following boxes:
- Remove disinfection tools
- Create registry backup
- Purge system restore
Click Run

= = = = = = = = = = = = = = = = = = = =

Removing/Uninstalling AdwCleaner:

- Windows XP : Double click on the icon to run it.
- Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"
Click on the Uninstall button.
Click Yes when asked are you sure you want to uninstall.
Both AdwCleaner.exe, its folder and all logs will be removed.

=========================

You can now delete any tools and/or logs remaining on your desktop.

=========================

With the above items taken care of let's move on to the All Clean part of the process.

The following procedures are recommendations for helping to keep your system running smoothly. If you are currently satisfied with how your system is running some or all of these may not pertain to you. Implement what you need.

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Make your Mozilla Firefox more secure - This can be done by adding these add-ons:

Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

Free Anti-Virus

Free Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here.

Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers. For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

#24 lookingforaname

Authentic Member

Authentic Member
147 posts

Posted 14 June 2014 - 06:11 AM

Thanks so much! I appreciate all of your time and the knowledge represented.

#25 OCD

SuperHelper

Malware Team
5,574 posts

Posted 14 June 2014 - 08:26 AM

Hi lookingforaname,

You're very welcome. Glad I was able to help. :thumbup:

Have a great day.

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

Advertisements

Register to Remove

#26 OCD

SuperHelper

Malware Team
5,574 posts

Posted 14 June 2014 - 08:27 AM

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatth...ed_t106388.html
and start a New Topic.

OCD

Proud Graduate of WTT Classroom
Member of UNITE

Threads will be closed if no response after 5 days

If you are satisfied with the help you have received, please consider making a donation.

Body Background

skin color theme