WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. Join 93083 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!

Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

malsign.systweak.44F - keeps coming back? [Solved]

Started by Bally , Jul 30 2014 01:15 PM

This topic is locked

47 replies to this topic

#1 Bally

Authentic Member

Authentic Member
56 posts

Posted 30 July 2014 - 01:15 PM

Downloaded a program, Systweak that once deleted the file (Malsign.Systweak.44F) keeps replicating itself as AVG continues to locate it, offers to remove it, but an hour later its back? How can I relieve my computer of this Virus?? Thanks, and have run the programs OTL, HiJackThis, and DDS, and have attached hereto for anyone's review.

Appreciate ANY help or suggestions to resolve this issue. Thx. Curt

P.S. For some unknown reason HiJackThis and DDS won't attach hereto and receive the following message when attempted; and, even changing the file name does not pass?

hijackthis.log
You aren't permitted to upload this kind of file

DDS.doc
You aren't permitted to upload this kind of file

Attached Files

OTL.Txt 846.19KB 1980 downloads
Extras.Txt 54.53KB 351 downloads

Advertisements

Register to Remove

#2 ken545

Forum God

Retired Classroom Teacher
23,225 posts

Interests:Fighting Malware and cooking some great Italian and TexMex food

Posted 01 August 2014 - 12:01 PM

:welcome:

I see in your logs your using the torrents to download music and files and whatever else. P2P ( File Sharing ) is very dangerous, your downloading that file from and unknown source and not all but a better percentage of them are infected, this is most likely how you infected your system.

Lets see whats going on with them

Download CKScanner by askey127 from Here & save it to your Desktop.

Doubleclick CKScanner.exe then click Search For Files

When the cursor hourglass disappears, click Save List To File

A message box will verify the file saved

Please Run this program only once

Double-click the CKFiles.txt icon on your desktop then copy/paste the contents in your next reply

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.

Find us on Facebook
Please LIKE and SHARE

Just a reminder that threads will be closed if no reply in 3 days.

#3 Bally

Authentic Member

Authentic Member
56 posts

Posted 01 August 2014 - 02:13 PM

Hi... "WHAT THE TECH"... thx. for replying to my post. Firstly, don't think the virus/malware/trojan (or, whatever it is) came from dwnld. of a torrent, as I only dwnld. from www.torrentday.com, and they scan all uploads before posting. I installed a free pgrm. that performed some cleaning features from Systweak. . .

http://fix-kit.com/O...CFSLjcgod40sAjA

. . . it was this program that left behind the replicating file that AVG keeps identifying and I delete it or quarantine it, but like the saying from the movie... "Its back!" Below is a copy of the report from CKfiles, but doesn't appear to provide any information?

CKScanner 2.4 - Additional Security Risks - These are not necessarily bad

scanner sequence 3.RP.11.FBNAXZ

----- EOF -----

Because you ask I only run the program once, therefore, the above is ALL the program has provided.

Thanks again for coming to my aid, will await your reply. Thx. Curt

-END-

Attached Files

ckfiles.txt 127bytes 246 downloads

#4 ken545

Forum God

Retired Classroom Teacher
23,225 posts

Interests:Fighting Malware and cooking some great Italian and TexMex food

Posted 01 August 2014 - 02:20 PM

Ok, log looks good , thanks

-AdwCleaner-by Xplode

Click on this link to download : ADWCleaner

Click on ONE of the Two Blue Download Now buttons That have a blue arrow beside them and save it to your desktop.

Do not click on any links in the top Advertisment.

Close all open programs and internet browsers.

Double click on AdwCleaner.exe to run the tool.

Click on Scan.

After the scan is complete click on "Clean"

Confirm each time with Ok.

Your computer will be rebooted automatically. A text file will open after the restart.

Please post the content of that logfile with your next reply.

You can find the logfile at C:\AdwCleaner[S1].txt as well.

===============================================================================

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.

Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".

The tool will open and start scanning your system.

Please be patient as this can take a while to complete depending on your system's specifications.

On completion, a log (JRT.txt) is saved to your desktop and will automatically open.

Post the contents of JRT.txt into your next message.

===============================================================================

Download Malwarebytes' Anti-Malware to your desktop.

Windows XP : Double click on the icon to run it.

Windows Vista, Windows 7 & 8 : Right click and select "Run as Administrator"

On the Dashboard click on Update Now

Go to the Setting Tab

Under Setting go to Detection and Protection

Under PUP and PUM make sure both are set to show Treat Detections as Malware

Go to Advanced setting and make sure Automatically Quarantine Detected Items is checked

Then on the Dashboard click on Scan

Make sure to select THREAT SCAN

Then click on Scan

When the scan is finished and the log pops up...select Copy to Clipboard

Please paste the log back into this thread for review

Exit Malwarebytes

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.

Find us on Facebook
Please LIKE and SHARE

Just a reminder that threads will be closed if no reply in 3 days.

#5 Bally

Authentic Member

Authentic Member
56 posts

Posted 01 August 2014 - 05:32 PM

WHAT THE TECH... well, that was interesting... dwnld. ADWCleaner and ran the program... nothing happened after running the SCAN after waiting several minutes I hit CLEAN... then my Anti-Virus Program (AVG) detected a problem and alerted me with the PROTECT ME... whereas, I clicked on it... wallah, the ADWCleaner program disappeared from my desktop! Apparently, AVG saw ADWCleaner as a threat.

Now the next program JRT (Junkware Removal Tool) I have already used and it found nothing. Am going to dwnld. the Malwarebytes Anti-Malware program, but be advised I have used before and my "free trial" period had expired, therefore, is probably unusable? Appears I spoke too soon, as scan was completed and being attached hereto.

Question is... should I... APPLY ACTIONS and QUARANTINE ALL??

Will await your reply before proceeding. Contents of Malwarebytes Anti-Malware.Inken266 clipboard is pasted below. Thx. Curt

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 8/1/2014

Scan Time: 11:27:00 PM

Logfile: Malwarebytes Anti-Malware.lnkem266.txt

Administrator: Yes

Version: 2.00.2.1012

Malware Database: v2014.08.01.05

Rootkit Database: v2014.07.17.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows XP Service Pack 3

CPU: x86

File System: NTFS

User: Richard

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 429616

Time Elapsed: 45 min, 12 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 14

PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\CLASSES\APPID\{CA5CAA63-B27C-4963-9BEC-CB16A36D56F8}, , [5e0b744d0873ab8b336452475fa316ea],

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-280907462-213740653-3875255159-1148-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{3004627E-F8E9-4E8B-909D-316753CBA923}, , [68010fb290ebe94d0c419bfecc36e21e],

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-280907462-213740653-3875255159-1148-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{3004627E-F8E9-4E8B-909D-316753CBA923}, , [68010fb290ebe94d0c419bfecc36e21e],

PUP.Optional.MegaBrowse.A, HKU\S-1-5-21-280907462-213740653-3875255159-1148-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{4E6CD411-CE62-4584-97FF-6AFBCF6900AF}, , [54158e333f3c989eb726fa69bf43817f],

PUP.Optional.MegaBrowse.A, HKU\S-1-5-21-280907462-213740653-3875255159-1148-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{4E6CD411-CE62-4584-97FF-6AFBCF6900AF}, , [54158e333f3c989eb726fa69bf43817f],

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-280907462-213740653-3875255159-1148-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}, , [57125a67631816209eae5049c53d7b85],

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-280907462-213740653-3875255159-1148-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{EF5625A3-37AB-4BDB-9875-2A3D91CD0DFD}, , [57125a67631816209eae5049c53d7b85],

PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{77AA745B-F4F8-45DA-9B14-61D2D95054C8}, , [de8bd9e87b00e15578d172eeed151ce4],

PUP.Optional.MindSpark.A, HKLM\SOFTWARE\QuotationCafe_45, , [e9809f225c1f11256029ac7f21e33dc3],

PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, , [6cfd1ba6b3c87eb8fb122ea8b64ca55b],

PUP.Optional.MindSpark.A, HKLM\SOFTWARE\MOZILLAPLUGINS\@QuotationCafe_45.com/Plugin, , [3336338e0c6fa98da63701e3ac566898],

PUP.Optional.Incredibar.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\dlnembnfbcpjnepmfjmngjenhhajpdfd, , [0663477aeb90b28457a0dc0bc83a8977],

PUP.Optional.MindSpark.A, HKU\S-1-5-21-280907462-213740653-3875255159-1148-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\QuotationCafe_45, , [5d0cb20f1368e45288021e0d07fd15eb],

PUP.Optional.MySearchDial.A, HKU\S-1-5-21-280907462-213740653-3875255159-1148-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, , [95d44d745823b77f5bb366700df5649c],

Registry Values: 4

PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS\{336D0C35-8A85-403a-B9D2-65C292C39087}, , [482110b1dc9f93a3f0ccafb09d6510f0],

PUP.Optional.StartPage.A, HKLM\SOFTWARE\WOW6432NODE\MOZILLA\FIREFOX\EXTENSIONS|{336D0C35-8A85-403A-B9D2-65C292C39087}, C:\Program\Web Assistant\Firefox, , [482110b1dc9f93a3f0ccafb09d6510f0]

PUP.Optional.MySearchDial.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHSCOPES\{0633EE93-D776-472F-A0FF-E1416B8B2E3A}, Mysearchdial, , [6cfd1ba6b3c87eb8fb122ea8b64ca55b]

Registry Data: 0

(No malicious items detected)

Folders: 87

PUP.Optional.MindSpark.A, C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\t91cmnax.default\extensions\45ffxtbr@QuotationCafe_45.com, , [a5c4aa17b7c481b5c764fcb813ef6f91],

PUP.Optional.MindSpark.A, C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\t91cmnax.default\extensions\45ffxtbr@QuotationCafe_45.com\chrome, , [a5c4aa17b7c481b5c764fcb813ef6f91],

PUP.Optional.MindSpark.A, C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Extensions\pcpehlgijbdajfafffojllcaecaecngb, , [c5a43889d4a7dc5ad67caf078e74f010],

Files: 204

PUP.Optional.Superfish.A, C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Local Storage\http_www.superfish.com_0.localstorage, , [77f2dee31c5f0e28f65ec2205ca6f60a],

PUP.Optional.MindSpark.A, C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pcpehlgijbdajfafffojllcaecaecngb_0.localstorage, , [e584caf72457191db0052dbce31fd62a],

PUP.Optional.MySpeedDial.A, C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Local Storage\chrome-extension_pflphaooapbgpeakohlggbpidpppgdff_0.localstorage, , [b6b3239e6417ab8b0ebb062660a47b85],

PUP.Optional.MySearchDial.A, C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Preferences, Good: (), Bad: ( "startup_urls": [ "http://start.mysearc...r=679293142&ir=" ],), ,[9acf378a4d2e330326c1509d9173dc24]

Physical Sectors: 0

(No malicious items detected)

(end)

#6 ken545

Forum God

Retired Classroom Teacher
23,225 posts

Interests:Fighting Malware and cooking some great Italian and TexMex food

Posted 01 August 2014 - 05:47 PM

You need to read read read my posts as it said when running Malwarebytes to Quarantine it all, you need to run Malwarebytes again and quarantine it all

Then give AdwCleaner another shot

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.

Find us on Facebook
Please LIKE and SHARE

Just a reminder that threads will be closed if no reply in 3 days.

#7 Bally

Authentic Member

Authentic Member
56 posts

Posted 02 August 2014 - 01:16 AM

There was no need to rerun "Malwarebytes Anti-Malware" again as the QUARANTINE was implemented the first time with over 300 items. However, I note that no Malware was detected. Then dwnld. again AdwCleaner allowed AVG to ignore the program as a threat. Below is the contacts of the file after Scan & Clean had been completed. Will await your reply. Thx. Curt

# AdwCleaner v3.302 - Report created 02/08/2014 at 08:58:36

# Updated 30/07/2014 by Xplode

# Operating System : Microsoft Windows XP Service Pack 3 (32 bits)

# Username : Richard - TN

# Running from : C:\Documents and Settings\Richard\Skrivbord\AdwCleaner.exe

# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

Folder Deleted : C:\Documents and Settings\All Users\Application Data\NCH Software

Folder Deleted : C:\Documents and Settings\All Users\Application Data\ParetoLogic

Folder Deleted : C:\Documents and Settings\All Users\Start-meny\Program\eSupport.com

Folder Deleted : C:\Documents and Settings\All Users\Start-meny\Program\PC Cleaner

Folder Deleted : C:\Program\eSupport.com

Folder Deleted : C:\Program\File Type Assistant

Folder Deleted : C:\Program\NCH Software

Folder Deleted : C:\Documents and Settings\All Users\Uniblue

Folder Deleted : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\blekkotb_031

Folder Deleted : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\eSupport.com

Folder Deleted : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\FileTypeAssistant

Folder Deleted : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\genienext

Folder Deleted : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Mobogenie

Folder Deleted : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\visi_coupon

Folder Deleted : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\wiseconvert

Folder Deleted : C:\Documents and Settings\Richard\Application Data\NCH Software

Folder Deleted : C:\Documents and Settings\Richard\Application Data\ParetoLogic

Folder Deleted : C:\Documents and Settings\Richard\Application Data\Uniblue

Folder Deleted : C:\Documents and Settings\Richard\Mina dokument\Mobogenie

File Deleted : C:\Documents and Settings\Richard\daemonprocess.txt

File Deleted : C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\t91cmnax.default\searchplugins\safeguard-secure-search.xml

File Deleted : C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\t91cmnax.default\user.js

File Deleted : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Local Storage\hxxp_www2.delta-search.com_0.localstorage

***** [ Scheduled Tasks ] *****

Task Deleted : ProgramUpdateCheck

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\fjpdnoojnohifgekbkmnfbiobhcbedka

Key Deleted : HKLM\SOFTWARE\Classes\AppID\WLXQuickTimeShellExt.DLL

Key Deleted : HKLM\SOFTWARE\Classes\d

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\MobogenieAdd

Key Deleted : HKLM\SOFTWARE\Classes\AppID\{C292AD0A-C11F-479B-B8DB-743E72D283B0}

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{AF175732-0D59-716D-F757-9F1492D808D9}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7825CFB6-490A-436B-9F26-4A7B5CFC01A9}

Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{02478D38-C3F9-4EFB-9B51-7695ECA05670}

Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{EF99BD32-C1FB-11D2-892F-0090271D4F88}

Value Deleted : HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List [C:\Program\File Type Assistant\tsassist.exe]

Key Deleted : HKCU\Software\ParetoLogic

Key Deleted : HKLM\Software\b1.org

Key Deleted : HKLM\Software\ParetoLogic

Key Deleted : HKLM\Software\Uniblue

Key Deleted : HKLM\Software\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4

***** [ Browsers ] *****

-\\ Internet Explorer v8.0.6001.18702

-\\ Mozilla Firefox v

[ File : C:\Documents and Settings\IVAB\Application Data\Mozilla\Firefox\Profiles\9xjugkxy.default\prefs.js ]

[ File : C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\t91cmnax.default\prefs.js ]

Line Deleted : user_pref("browser.search.defaultenginename", "AVG Secure Search");

-\\ Google Chrome v36.0.1985.125

[ File : C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://search.aol.com/aol/search?q={searchTerms}

Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}

Deleted [Search Provider] : hxxp://search.conduit.com/Results.aspx?ctid=CT3319614&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=2&UP=SP381B894A-7C35-4B94-AE86-80A5D9A67339&q={searchTerms}&SSPV=

Deleted [Search Provider] : hxxp://en.softonic.com/s/{searchTerms}

Deleted [Search Provider] : hxxp://start.mysearchdial.com/results.php?f=4&q={searchTerms}&a=ir_14_14_ch&cd=2XzuyEtN2Y1L1QzutDtDtCyCtCyByD0FyByEyEtByEzz0DyEtN0D0Tzu0SzztByEtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0CyD0EyDtCtA0BtGyC0BtB0CtG0FtD0CzytG0C0D0DtBtGtC0EyC0EyDyCzytCyB0A0A0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0F0Bzz0FtBtAyBtGtBtBzz0BtGtA0AyC0EtGyC0CtCtAtGyB0CyB0B0FtDtA0DzyzzyB0F2Q&cr=679293142&ir=

Deleted [Startup_urls] : hxxp://start.mysearchdial.com/?f=1&a=ir_14_14_ch&cd=2XzuyEtN2Y1L1QzutDtDtCyCtCyByD0FyByEyEtByEzz0DyEtN0D0Tzu0SzztByEtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0CyD0EyDtCtA0BtGyC0BtB0CtG0FtD0CzytG0C0D0DtBtGtC0EyC0EyDyCzytCyB0A0A0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0F0Bzz0FtBtAyBtGtBtBzz0BtGtA0AyC0EtGyC0CtCtAtGyB0CyB0B0FtDtA0DzyzzyB0F2Q&cr=679293142&ir=

Deleted [Homepage] : hxxps://bay179.mail.live.com/mail/?fid=flinbox

Deleted [Extension] : bopakagnckmlgajfccecajhnimjiiedh

Deleted [Extension] : flpcjncodpafbgdpnkljologafpionhb

*************************

AdwCleaner[R0].txt - [22028 octets] - [03/10/2013 16:53:04]

AdwCleaner[R1].txt - [16879 octets] - [03/10/2013 23:08:05]

AdwCleaner[R2].txt - [1260 octets] - [04/10/2013 00:15:05]

AdwCleaner[R3].txt - [2998 octets] - [10/10/2013 21:12:35]

AdwCleaner[R4].txt - [6761 octets] - [01/08/2014 22:56:33]

AdwCleaner[R5].txt - [5604 octets] - [02/08/2014 08:52:15]

AdwCleaner[S0].txt - [16674 octets] - [03/10/2013 23:10:33]

AdwCleaner[S1].txt - [3089 octets] - [10/10/2013 21:17:17]

AdwCleaner[S2].txt - [6457 octets] - [02/08/2014 08:58:36]

########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [6517 octets] ##########

#8 Bally

Authentic Member

Authentic Member
56 posts

Posted 02 August 2014 - 02:01 AM

Decide3d to run "Malwarebytes Anti-Malware" again anyway to confirm that ALL the files located the first-time had been QUARANTINED. It appears that one (1) file was detected and quarantined, but apparently was not considered a threat.

As to my original inquiry it may well be that AVG detected and finally dealt with the replicating file (malsign.systweak.44F) as I clicked on PROTECT ME, but didn't fully recognize the threat being as it wasn't fully displayed in the box for viewing. But will check the HISTORY logs to see if shown therein? The reason I say this is b/c AVG is no longer identifying the threat being as the program runs in the background and has been reporting this threat several times a day, which (as I said) has stopped!

Will await any further feedback from you. Thx. Curt

Malwarebytes Anti-Malware

www.malwarebytes.org

Scan Date: 8/2/2014

Scan Time: 9:28:58 AM

Logfile: Malwarebytes Anti-Malware.txt

Administrator: Yes

Version: 2.00.2.1012

Malware Database: v2014.08.02.02

Rootkit Database: v2014.08.01.01

License: Trial

Malware Protection: Enabled

Malicious Website Protection: Enabled

Self-protection: Disabled

OS: Windows XP Service Pack 3

CPU: x86

File System: NTFS

User: Richard

Scan Type: Threat Scan

Result: Completed

Objects Scanned: 426836

Time Elapsed: 24 min, 42 sec

Memory: Enabled

Startup: Enabled

Filesystem: Enabled

Archives: Enabled

Rootkits: Disabled

Heuristics: Enabled

PUP: Enabled

PUM: Enabled

Processes: 0

(No malicious items detected)

Modules: 0

(No malicious items detected)

Registry Keys: 0

(No malicious items detected)

Registry Values: 0

(No malicious items detected)

Registry Data: 0

(No malicious items detected)

Folders: 0

(No malicious items detected)

Files: 1

Physical Sectors: 0

(No malicious items detected)

(end)

#9 ken545

Forum God

Retired Classroom Teacher
23,225 posts

Interests:Fighting Malware and cooking some great Italian and TexMex food

Posted 02 August 2014 - 06:31 AM

Run this program and lets check for any leftovers that need to be removed

Please download Farbar Recovery Scan Tool and save it to your desktop.

Note: You need to run the version compatible with your system. If you are not sure which version applies to your system download both of them and try to run them. Only one of them will run on your system, that will be the right version.

How to determine whether a computer is running a 32-bit version or 64-bit version of the Windows operating system

A simple way to check your system: Start --> Computer (right click) --> Properties

Right click to run as administrator (XP users click run after receipt of Windows Security Warning - Open File). When the tool opens click Yes to disclaimer.

Please make sure All Users is checked

Do not check

*List BCD

*Drivers MD5

*Shortcut txt

Press Scan button.

It will produce a log called FRST.txt in the same directory the tool is run from.

Please copy and paste log back here.

The first time the tool is run it generates another log (Addition.txt - also located in the same directory as FRST.exe/FRST64.exe). Please also paste that along with the FRST.txt into your reply.

The forum is staffed by volunteers who donate their time and expertise.
If you feel you have been helped, please consider a donation.

Find us on Facebook
Please LIKE and SHARE

Just a reminder that threads will be closed if no reply in 3 days.

#10 Bally

Authentic Member

Authentic Member
56 posts

Posted 02 August 2014 - 12:36 PM

Below is the contents of the FRST file. Also be advised that the scan bar has been stalled for some time now... it reads "Processing Files: Extra Check"! Don't know if I should proceed by hitting the FIX button, or continue to wait and see if the green cursor within the scan-bar will complete its cycle?

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:2-08-2014

Ran by Richard (administrator) on TN on 02-08-2014 19:48:00

Running from C:\Documents and Settings\Richard\Skrivbord

Platform: Microsoft Windows XP Professional Service Pack 3 (X86) OS Language: Svenska

Internet Explorer Version 8

Boot Mode: Normal

The only official download link for FRST:

Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/

Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/

Download link from any site other than Bleeping Computer is unpermitted or outdated.

See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgrsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgcsrvx.exe

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe

(Apple Inc.) C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgfws.exe

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgidsagent.exe

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgwdsvc.exe

(Apple Inc.) C:\Program\Bonjour\mDNSResponder.exe

(ATI Technologies Inc.) C:\WINDOWS\system32\ati2evxx.exe

(Microsoft Corporation) C:\Program\Windows Live\Family Safety\fsssvc.exe

(Oracle Corporation) C:\Program\Java\jre7\bin\jqs.exe

(Malwarebytes Corporation) C:\Program\Malwarebytes Anti-Malware\mbamscheduler.exe

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgnsx.exe

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgemcx.exe

(Malwarebytes Corporation) C:\Program\Malwarebytes Anti-Malware\mbamservice.exe

(AVG) C:\Program\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe

(WinZip Computing, S.L. (WinZip Computing)) C:\Program\WinZip System Utilities Suite\WINZIPSSDefragSrv.exe

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgcsrvx.exe

(Microsoft Corporation.) C:\Program\Microsoft\BingBar\7.3.107.0\SeaPort.EXE

(Malwarebytes Corporation) C:\Program\Malwarebytes Anti-Malware\mbam.exe

(AVG) C:\Program\AVG\AVG PC TuneUp\TuneUpUtilitiesApp32.exe

(Google Inc.) C:\Program\Google\Update\GoogleUpdate.exe

(Hewlett-Packard) C:\Program\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

() C:\Program\HEWLET~1\HPSHAR~1\hpgs2wnf.exe

(ATI Technologies, Inc.) C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe

(Western Digital Technologies, Inc.) C:\WINDOWS\system32\WDBtnMgr.exe

(AVG Technologies CZ, s.r.o.) C:\Program\AVG\AVG2014\avgui.exe

(Apple Inc.) C:\Program\iTunes\iTunesHelper.exe

(Skype Technologies S.A.) C:\Program\Skype\Phone\Skype.exe

(Microsoft Corporation) C:\WINDOWS\system32\rundll32.exe

(Apple Inc.) C:\Program\iPod\bin\iPodService.exe

(Google Inc.) C:\Program\Google\Chrome\Application\chrome.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

Winlogon\Notify\AtiExtEvent: C:\WINDOWS\system32\Ati2evxx.dll (ATI Technologies Inc.)

Winlogon\Notify\LBTWlgn: c:\program\delade filer\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

HKLM\...\Policies\Explorer: [NoWelcomeScreen] 1

HKU\S-1-5-21-280907462-213740653-3875255159-1148\...\Run: [Skype] => C:\Program\Skype\Phone\Skype.exe [21650536 2014-07-02] (Skype Technologies S.A.)

HKU\S-1-5-21-280907462-213740653-3875255159-1148\...\Policies\Explorer: [DisablePersonalDirChange] 1

Startup: C:\Documents and Settings\Richard\Start-meny\Program\Autostart\Övervaka bläckvarningar - HP Deskjet 2510 series.lnk

ShortcutTarget: Övervaka bläckvarningar - HP Deskjet 2510 series.lnk -> C:\Program\HP\HP Deskjet 2510 series\Bin\HPStatusBL.dll (Hewlett-Packard Co.)

ShellIconOverlayIdentifiers: "DropboxExt1" -> {FB314ED9-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\Richard\Application Data\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: "DropboxExt2" -> {FB314EDA-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\Richard\Application Data\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: "DropboxExt3" -> {FB314EDD-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\Richard\Application Data\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: "DropboxExt4" -> {FB314EDE-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\Richard\Application Data\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: "DropboxExt5" -> {FB314EDB-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\Richard\Application Data\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: "DropboxExt6" -> {FB314EDF-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\Richard\Application Data\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: "DropboxExt7" -> {FB314EDC-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\Richard\Application Data\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: "DropboxExt8" -> {FB314EE0-A251-47B7-93E1-CDD82E34AF8B} => C:\Documents and Settings\Richard\Application Data\Dropbox\bin\DropboxExt.24.dll (Dropbox, Inc.)

ShellIconOverlayIdentifiers: a_MiMediaFiles_MonitoredFolder -> {C00213B1-77A8-4F0E-B740-0B36FBF7FAE7} => C:\Program\MiMedia LLC\MiMedia\MiMedia_ShellExtensions.dll (MiMedia)

ShellIconOverlayIdentifiers: a_MiMediaFiles_SynchronizationPending -> {FAD5EA38-2D1D-485D-9B07-D35EB72B922E} => C:\Program\MiMedia LLC\MiMedia\MiMedia_ShellExtensions.dll (MiMedia)

ShellIconOverlayIdentifiers: a_MiMediaFiles_Synchronized -> {69DE75F6-60E6-4E55-B416-171941A5C73E} => C:\Program\MiMedia LLC\MiMedia\MiMedia_ShellExtensions.dll (MiMedia)

BootExecute: autocheck autochk * C:\Program\AVG\AVG2014\avgrsx.exe /sync /restart

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/?...=OIE8HP&PC=UP62

HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=OIE8HP&PC=UP62

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.msn.com/?...=OIE8HP&PC=UP62

HKLM\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages =

URLSearchHook: HKCU - YTNavAssistPlugin Class - {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)

BHO: Bing Bar Helper -> {1dad3af3-ef2f-4f64-ac4b-11789189fcb6} -> C:\Program\Microsoft\BingBar\7.3.107.0\BingExt.dll (Microsoft Corporation.)

BHO: Windows Live Family Safety Browser Helper Class -> {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} -> C:\Program\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)

BHO: Spybot-S&D IE Protection -> {53707962-6F74-2D53-2644-206D7942484F} -> C:\Program\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program\Java\jre7\bin\ssv.dll (Oracle Corporation)

BHO: Windows Live Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program\Delade filer\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

Toolbar: HKLM - Bing Bar - {eec0f710-38b5-4aba-99bf-ec87564a4e13} - C:\Program\Microsoft\BingBar\7.3.107.0\BingExt.dll (Microsoft Corporation.)

Toolbar: HKCU - &Adress - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

Toolbar: HKCU - &Länkar - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\SHELL32.dll (Microsoft Corporation)

Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File

Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No File

Toolbar: HKCU - No Name - {00000000-0000-0000-0000-000000000000} - No File

DPF: {01892B12-4ABE-47E8-B7C1-4692F0B74024} http://viewer.akopia...ravaClientX.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.micr...heckControl.cab

DPF: {485D813E-EE26-4DF8-9FAF-DEDF2885306E} http://server/connec...uter/nshelp.dll

DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.h...hpdetect118.cab

DPF: {8500E785-8A89-4633-BB72-C982B0133501} http://system.arkite...FileUpload2.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab

DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.ma...ash/swflash.cab

DPF: {E76A19A9-B579-4FF7-8857-7D79B22F8D45} http://viewer.byggne...ravaClientX.cab

Handler: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: ipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File

Handler: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program\Delade filer\SYSTEM\Ole DB\msdaipp.dll (Microsoft Corporation)

Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File

Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)

ShellExecuteHooks: Windows Desktop Search Namespace Manager - {56F9679E-7826-4C84-81F3-532071A8BCC5} - No File [ ]

Winsock: Catalog5 04 C:\Program\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)

Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Tcpip\Parameters: [DhcpNameServer] 192.168.1.1

FireFox:

========

FF ProfilePath: C:\Documents and Settings\Richard\Application Data\Mozilla\Firefox\Profiles\t91cmnax.default

FF DefaultSearchEngine: Google

FF SelectedSearchEngine: Google

FF Homepage: hxxp://www.msnbc.msn.com/

FF Keyword.URL: user_pref("keyword.URL", "");

FF Plugin: @adobe.com/FlashPlayer -> C:\WINDOWS\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()

FF Plugin: @Apple.com/iTunes,version=1.0 -> C:\Program\iTunes\Mozilla Plugins\npitunes.dll ()

FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF Plugin: @java.com/DTPlugin,version=10.11.2 -> C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=10.11.2 -> C:\Program\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @microsoft.com/OfficeLive,version=1.3 -> C:\Program\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

FF Plugin: @microsoft.com/WLPG,version=14.0.8117.0416 -> C:\Program\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF Plugin: @rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5 -> C:\Documents and Settings\All Users\Application Data\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.1.3 -> C:\Program\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader -> C:\Program\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKCU: @talk.google.com/GoogleTalkPlugin - C:\Documents and Settings\Richard\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin HKCU: @talk.google.com/O1DPlugin - C:\Documents and Settings\Richard\Application Data\Mozilla\plugins\npo1d.dll (Google)

FF Plugin HKCU: @talk.google.com/O3DPlugin - C:\Documents and Settings\Richard\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()

FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)

FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Richard\Application Data\mozilla\plugins\npgoogletalk.dll (Google)

FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Richard\Application Data\mozilla\plugins\npgtpo3dautoplugin.dll ()

FF Plugin ProgramFiles/Appdata: C:\Documents and Settings\Richard\Application Data\mozilla\plugins\npo1d.dll (Google)

FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF Extension: Microsoft .NET Framework Assistant - c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2014-07-22]

Chrome:

=======

CHR HomePage: https://bay179.mail....il/?fid=flinbox

CHR StartupUrls: "hxxp://start.mysearchdial.com/?f=1&a=ir_14_14_ch&cd=2XzuyEtN2Y1L1QzutDtDtCyCtCyByD0FyByEyEtByEzz0DyEtN0D0Tzu0SzztByEtN1L2XzutBtFtCzztFtBtFtDtN1L1CzutCyEtDtAtDyD1V1StN1L1G1B1V1N2Y1L1Qzu2StA0CyD0EyDtCtA0BtGyC0BtB0CtG0FtD0CzytG0C0D0DtBtGtC0EyC0EyDyCzytCyB0A0A0C2QtN1M1F1B2Z1V1N2Y1L1Qzu2SyD0F0Bzz0FtBtAyBtGtBtBzz0BtGtA0AyC0EtGyC0CtCtAtGyB0CyB0B0FtDtA0DzyzzyB0F2Q&cr=679293142&ir="

CHR NewTab: "chrome-extension://pcpehlgijbdajfafffojllcaecaecngb/spent.html"

CHR Plugin: (Shockwave Flash) - C:\Program\Google\Chrome\Application\36.0.1985.125\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program\Google\Chrome\Application\36.0.1985.125\ppGoogleNaClPluginChrome.dll ()

CHR Plugin: (Chrome PDF Viewer) - C:\Program\Google\Chrome\Application\36.0.1985.125\pdf.dll ()

CHR Plugin: (Google Talk Plugin) - C:\Documents and Settings\Richard\Application Data\Mozilla\plugins\npgoogletalk.dll (Google)

CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Documents and Settings\Richard\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll ()

CHR Plugin: (Google Talk Plugin Video Renderer) - C:\Documents and Settings\Richard\Application Data\Mozilla\plugins\npo1d.dll (Google)

CHR Plugin: (Adobe Acrobat) - C:\Program\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Microsoft® DRM) - C:\Program\Windows Media Player\npdrmv2.dll (Microsoft Corporation)

CHR Plugin: (Windows Media Player Plug-in Dynamic Link Library) - C:\Program\Windows Media Player\npdsplay.dll (Microsoft Corporation (written by Digital Renaissance Inc.))

CHR Plugin: (Microsoft® DRM) - C:\Program\Windows Media Player\npwmsdrm.dll (Microsoft Corporation)

CHR Plugin: (Google Update) - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Update\1.3.21.145\npGoogleUpdate3.dll No File

CHR Plugin: (Google Earth Plugin) - C:\Program\Google\Google Earth\plugin\npgeplugin.dll (Google)

CHR Plugin: (Java™ Platform SE 7 U11) - C:\Program\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (Silverlight Plug-In) - C:\Program\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File

CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)

CHR Plugin: (Windows Live® Photo Gallery) - C:\Program\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)

CHR Plugin: (Windows Presentation Foundation) - C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

CHR Plugin: (Shockwave Flash) - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_7_700_202.dll No File

CHR Plugin: (Java Deployment Toolkit 7.0.110.21) - C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

CHR Extension: (Google Docs) - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-06-06]

CHR Extension: (Google Drive) - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-06-06]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-05-23]

CHR Extension: (YouTube) - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-06-06]

CHR Extension: (Google Search) - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-06-06]

CHR Extension: (Google Wallet) - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-22]

CHR Extension: (Gmail) - C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-06-06]

CHR HKLM\...\Chrome\Extension: [aicjcijfbjpmgnlbojmcnflkgeecpfnn] - C:\Documents and Settings\All Users\Application Data\ADDICT-THING\aicjcijfbjpmgnlbojmcnflkgeecpfnn.crx [2013-06-06]

CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 Apple Mobile Device; C:\Program\Delade filer\Apple\Mobile Device Support\AppleMobileDeviceService.exe [43336 2014-06-12] (Apple Inc.)

R2 Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [602112 2010-02-11] (ATI Technologies Inc.) [File not signed]

S2 ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [593920 2010-02-10] () [File not signed]

R2 avgfws; C:\Program\AVG\AVG2014\avgfws.exe [1417160 2014-07-10] (AVG Technologies CZ, s.r.o.)

R2 AVGIDSAgent; C:\Program\AVG\AVG2014\avgidsagent.exe [3244048 2014-07-10] (AVG Technologies CZ, s.r.o.)

R2 avgwd; C:\Program\AVG\AVG2014\avgwdsvc.exe [289328 2014-07-10] (AVG Technologies CZ, s.r.o.)

S2 BBSvc; C:\Program\Microsoft\BingBar\7.3.107.0\BBSvc.exe [193696 2013-08-30] (Microsoft Corporation.)

R3 BBUpdate; C:\Program\Microsoft\BingBar\7.3.107.0\SeaPort.exe [240288 2013-08-30] (Microsoft Corporation.)

R2 Bonjour Service; C:\Program\Bonjour\mDNSResponder.exe [390504 2011-08-30] (Apple Inc.)

R2 fsssvc; C:\Program\Windows Live\Family Safety\fsssvc.exe [704872 2010-04-28] (Microsoft Corporation)

S2 gupdate; C:\Program\Google\Update\GoogleUpdate.exe [136176 2011-10-21] (Google Inc.)

S3 gupdatem; C:\Program\Google\Update\GoogleUpdate.exe [136176 2011-10-21] (Google Inc.)

S4 HidServ; C:\WINDOWS\System32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)

S3 hpqcxs08; C:\WINDOWS\system32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)

S2 hpqddsvc; C:\WINDOWS\system32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)

R3 iPod Service; C:\Program\iPod\bin\iPodService.exe [553288 2014-07-08] (Apple Inc.)

R2 JavaQuickStarterService; C:\Program\Java\jre7\bin\jqs.exe [170912 2013-01-29] (Oracle Corporation)

S3 LBTServ; C:\Program\Delade filer\LogiShrd\Bluetooth\lbtserv.exe [295192 2011-09-27] (Logitech, Inc.)

R2 MBAMScheduler; C:\Program\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)

R2 MBAMService; C:\Program\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)

S2 MsMpSvc; c:\Program\Microsoft Security Client\MsMpEng.exe [22216 2014-03-11] (Microsoft Corporation)

S2 Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)

S3 ose; C:\Program\Delade filer\Microsoft Shared\Source Engine\OSE.EXE [89136 2003-07-28] (Microsoft Corporation)

S2 Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [14336 2008-04-14] (Microsoft Corporation)

R2 TuneUp.UtilitiesSvc; C:\Program\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe [1858360 2014-07-14] (AVG)

R2 WINZIPSSDiskOptimizer; C:\Program\WinZip System Utilities Suite\WINZIPSSDefragSrv.exe [267384 2013-07-15] (WinZip Computing, S.L. (WinZip Computing))

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 ac97intc; C:\WINDOWS\System32\drivers\ac97intc.sys [96256 2001-08-17] (Intel Corporation)

R3 ALCXWDM; C:\WINDOWS\System32\drivers\ALCXWDM.SYS [2278784 2004-09-21] (Realtek Semiconductor Corp.)

R0 amdide; C:\WINDOWS\System32\DRIVERS\amdide.sys [11944 2012-12-03] (Advanced Micro Devices Inc.)

R1 AmdK8; C:\WINDOWS\System32\DRIVERS\AmdK8.sys [43008 2005-03-09] (Advanced Micro Devices)

R3 ati2mtag; C:\WINDOWS\System32\DRIVERS\ati2mtag.sys [3565056 2010-02-11] (ATI Technologies Inc.) [File not signed]

R1 Avgdiskx; C:\WINDOWS\System32\DRIVERS\avgdiskx.sys [121624 2014-06-30] (AVG Technologies CZ, s.r.o.)

R3 Avgfwdx; C:\WINDOWS\System32\DRIVERS\avgfwdx.sys [30944 2012-01-12] (AVG Technologies CZ, s.r.o.)

S3 Avgfwfd; C:\WINDOWS\System32\DRIVERS\avgfwdx.sys [30944 2012-01-12] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSDriverl; C:\WINDOWS\System32\DRIVERS\avgidsdriverlx.sys [190232 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 AVGIDSHX; C:\WINDOWS\System32\DRIVERS\avgidshx.sys [147736 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 AVGIDSShim; C:\WINDOWS\System32\DRIVERS\avgidsshimx.sys [21272 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 Avgldx86; C:\WINDOWS\System32\DRIVERS\avgldx86.sys [188696 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 Avglogx; C:\WINDOWS\System32\DRIVERS\avglogx.sys [241944 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 Avgmfx86; C:\WINDOWS\System32\DRIVERS\avgmfx86.sys [98584 2014-06-17] (AVG Technologies CZ, s.r.o.)

R0 Avgrkx86; C:\WINDOWS\System32\DRIVERS\avgrkx86.sys [27416 2014-06-17] (AVG Technologies CZ, s.r.o.)

R1 Avgtdix; C:\WINDOWS\System32\DRIVERS\avgtdix.sys [197400 2014-06-17] (AVG Technologies CZ, s.r.o.)

S3 Blfp; C:\WINDOWS\System32\DRIVERS\baspxp32.sys [65664 2005-03-04] (Broadcom Corporation)

R1 cbfs3; C:\WINDOWS\system32\drivers\cbfs3.sys [299280 2012-05-25] (EldoS Corporation)

S3 CCDECODE; C:\WINDOWS\System32\DRIVERS\CCDECODE.sys [17024 2008-04-14] (Microsoft Corporation)

S3 DrvAgent32; C:\WINDOWS\system32\Drivers\DrvAgent32.sys [23456 2013-12-31] (Phoenix Technologies) [File not signed]

R2 fssfltr; C:\WINDOWS\System32\DRIVERS\fssfltr_tdi.sys [54760 2010-04-28] (Microsoft Corporation)

S3 i81x; C:\WINDOWS\System32\DRIVERS\i81xnt5.sys [161020 2004-08-03] (Intel® Corporation)

S3 iAimFP0; C:\WINDOWS\System32\DRIVERS\wADV01nt.sys [12415 2004-08-03] (Intel® Corporation)

S3 iAimFP1; C:\WINDOWS\System32\DRIVERS\wADV02NT.sys [12127 2004-08-03] (Intel® Corporation)

S3 iAimFP2; C:\WINDOWS\System32\DRIVERS\wADV05NT.sys [11775 2004-08-03] (Intel® Corporation)

S3 iAimFP3; C:\WINDOWS\System32\DRIVERS\wSiINTxx.sys [12063 2004-08-03] (Intel® Corporation)

S3 iAimFP4; C:\WINDOWS\System32\DRIVERS\wVchNTxx.sys [19455 2004-08-03] (Intel® Corporation)

S3 iAimFP5; C:\WINDOWS\System32\DRIVERS\wADV07nt.sys [11807 2004-08-03] (Intel® Corporation)

S3 iAimFP6; C:\WINDOWS\System32\DRIVERS\wADV08nt.sys [11295 2004-08-03] (Intel® Corporation)

S3 iAimFP7; C:\WINDOWS\System32\DRIVERS\wADV09nt.sys [11871 2004-08-03] (Intel® Corporation)

S3 iAimTV0; C:\WINDOWS\System32\DRIVERS\wATV01nt.sys [29311 2004-08-03] (Intel® Corporation)

S3 iAimTV1; C:\WINDOWS\System32\DRIVERS\wATV02NT.sys [19551 2004-08-03] (Intel® Corporation)

S3 iAimTV3; C:\WINDOWS\System32\DRIVERS\wATV04nt.sys [33599 2004-08-03] (Intel® Corporation)

S3 iAimTV4; C:\WINDOWS\System32\DRIVERS\wCh7xxNT.sys [23615 2004-08-03] (Intel® Corporation)

S3 iAimTV5; C:\WINDOWS\System32\DRIVERS\wATV10nt.sys [25471 2004-08-03] (Intel® Corporation)

S3 iAimTV6; C:\WINDOWS\System32\DRIVERS\wATV06nt.sys [22271 2004-08-03] (Intel® Corporation)

R3 MBAMProtector; C:\WINDOWS\system32\drivers\mbam.sys [23256 2014-05-12] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys [110296 2014-08-02] (Malwarebytes Corporation)

R0 MpFilter; C:\WINDOWS\System32\DRIVERS\MpFilter.sys [231960 2014-01-25] (Microsoft Corporation)

S3 NdisIP; C:\WINDOWS\System32\DRIVERS\NdisIP.sys [10880 2008-04-14] (Microsoft Corporation)

S3 OmniDrv; C:\WINDOWS\System32\DRIVERS\OmniDrv.sys [30976 2004-01-05] (Ideazon) [File not signed]

S1 P3; C:\WINDOWS\System32\DRIVERS\p3.sys [46720 2008-04-14] (Microsoft Corporation)

R0 SI3112r; C:\WINDOWS\System32\DRIVERS\SI3112r.sys [116264 2007-08-29] (Silicon Image, Inc)

R0 SiFilter; C:\WINDOWS\System32\DRIVERS\SiWinAcc.sys [19240 2007-08-29] (Silicon Image, Inc)

S3 taphss; C:\WINDOWS\System32\DRIVERS\taphss.sys [32768 2012-03-26] (AnchorFree Inc)

R3 TuneUpUtilitiesDrv; C:\Program\AVG\AVG PC TuneUp\TuneUpUtilitiesDriver32.sys [12320 2014-06-23] (TuneUp Software)

R3 XIRLINK; C:\WINDOWS\System32\DRIVERS\C-itnt.sys [443833 2000-05-12] (Xirlink, Inc) [File not signed]

S4 adpu320; \SystemRoot\system32\DRIVERS\adpu320.sys [X]

S3 cpuz134; \??\C:\DOCUME~1\Richard\LOKALA~1\Temp\cpuz134\cpuz134_x32.sys [X]

S3 MFE_RR; \??\C:\DOCUME~1\Richard\LOKALA~1\Temp\mfe_rr.sys [X]

U5 ScsiPort; C:\WINDOWS\system32\drivers\scsiport.sys [96384 2008-04-14] (Microsoft Corporation)

S4 Symmpi; \SystemRoot\system32\DRIVERS\symmpi.sys [X]

U1 WS2IFSL;

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-02 19:48 - 2014-08-02 19:49 - 00027629 _____ () C:\Documents and Settings\Richard\Skrivbord\FRST.txt

2014-08-02 19:46 - 2014-08-02 19:48 - 00000000 ____D () C:\FRST

2014-08-02 19:44 - 2014-08-02 19:45 - 01084928 _____ (Farbar) C:\Documents and Settings\Richard\Skrivbord\FRST.exe

2014-08-02 10:16 - 2014-08-02 10:16 - 00110592 _____ () C:\WINDOWS\Minidump\Mini080214-03.dmp

2014-08-02 09:03 - 2014-08-02 09:03 - 00110592 _____ () C:\WINDOWS\Minidump\Mini080214-02.dmp

2014-08-02 08:53 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\WINDOWS\system32\sqlite3.dll

2014-08-02 08:02 - 2014-08-02 08:03 - 01361309 _____ () C:\Documents and Settings\Richard\Skrivbord\AdwCleaner.exe

2014-08-02 01:51 - 2014-08-02 01:51 - 00110592 _____ () C:\WINDOWS\Minidump\Mini080214-01.dmp

2014-08-01 23:17 - 2014-08-01 23:17 - 00000733 _____ () C:\Documents and Settings\All Users\Skrivbord\Malwarebytes Anti-Malware.lnk

2014-08-01 23:17 - 2014-08-01 23:17 - 00000000 ____D () C:\Program\Malwarebytes Anti-Malware

2014-08-01 23:17 - 2014-08-01 23:17 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\Malwarebytes Anti-Malware

2014-08-01 23:17 - 2014-05-12 07:25 - 00023256 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\mbam.sys

2014-07-31 19:52 - 2014-08-02 09:57 - 00000000 ____D () C:\Documents and Settings\Richard\Skrivbord\Malware Tools

2014-07-31 12:43 - 2014-07-31 12:43 - 00000000 _____ () C:\SophosBootTasks.txt

2014-07-25 23:24 - 2014-07-25 23:24 - 00000000 ____H () C:\Documents and Settings\Richard\Mina dokument\Default.rdp

2014-07-25 10:08 - 2014-07-31 18:25 - 00002227 _____ () C:\Documents and Settings\All Users\Skrivbord\Skype.lnk

2014-07-25 10:08 - 2014-07-25 10:08 - 00000000 ____D () C:\Program\Delade filer\Skype

2014-07-25 10:08 - 2014-07-25 10:08 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Skype

2014-07-25 10:08 - 2014-07-25 10:08 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\Skype

2014-07-22 14:47 - 2010-02-10 21:20 - 00593920 ____N () C:\WINDOWS\system32\ati2sgag.exe

2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\ATI

2014-07-22 07:56 - 2014-07-22 14:56 - 00001084 _____ () C:\WINDOWS\spupdsvc.log

2014-07-22 07:55 - 2014-07-22 07:56 - 00000000 ____D () C:\f18b8596a63f2776389f

2014-07-22 07:22 - 2014-07-22 10:58 - 00000000 ____D () C:\0d608be659421094a8274931cdb6

2014-07-22 00:33 - 2014-07-22 00:33 - 00001510 _____ () C:\Documents and Settings\All Users\Skrivbord\iTunes.lnk

2014-07-22 00:33 - 2014-07-22 00:33 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\iTunes

2014-07-22 00:32 - 2014-07-22 00:33 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-07-22 00:32 - 2014-07-22 00:32 - 00000000 ____D () C:\Program\iPod

2014-07-21 23:53 - 2014-07-24 20:20 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\Apple Computer

2014-07-21 23:53 - 2014-07-21 23:53 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Apple Computer

2014-07-21 23:49 - 2014-07-22 00:33 - 00000000 ____D () C:\Program\iTunes

2014-07-21 23:49 - 2014-07-22 00:32 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Apple Computer

2014-07-21 23:47 - 2014-07-21 23:47 - 00001830 _____ () C:\Documents and Settings\All Users\Start-meny\Program\Apple Software Update.lnk

2014-07-21 23:47 - 2014-07-21 23:47 - 00000272 _____ () C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

2014-07-21 23:47 - 2014-07-21 23:47 - 00000000 ____D () C:\Program\Apple Software Update

2014-07-21 23:47 - 2014-07-21 23:47 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Apple

2014-07-21 23:47 - 2014-07-21 23:47 - 00000000 ____D () C:\Documents and Settings\LocalService\Application Data\Apple Computer

2014-07-21 23:46 - 2013-03-18 16:51 - 06112864 _____ (Apple, Inc.) C:\WINDOWS\system32\usbaaplrc.dll

2014-07-21 23:46 - 2013-03-18 16:51 - 00045056 _____ (Apple, Inc.) C:\WINDOWS\system32\Drivers\usbaapl.sys

2014-07-21 23:45 - 2014-07-22 00:32 - 00000000 ____D () C:\Program\Delade filer\Apple

2014-07-21 23:45 - 2014-07-21 23:47 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Apple

2014-07-21 23:45 - 2014-07-21 23:45 - 00000000 ____D () C:\Program\Bonjour

2014-07-21 22:14 - 2014-07-21 23:01 - 00000000 ____D () C:\d80b9deb1c60777af7

2014-07-21 00:23 - 2014-07-21 00:23 - 00000000 ____D () C:\Documents and Settings\LocalService\Lokala inställningar\Application Data\AVG

2014-07-21 00:23 - 2014-07-21 00:23 - 00000000 ____D () C:\Documents and Settings\LocalService\Application Data\AVG

2014-07-21 00:01 - 2014-08-02 19:18 - 00000626 _____ () C:\WINDOWS\Tasks\AVG_SYS_TASK_0614t_RUN.job

2014-07-21 00:01 - 2014-07-21 00:01 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Avg_Update_0614t

2014-07-20 09:17 - 2014-07-20 09:17 - 00000000 ____D () C:\Documents and Settings\Richard\Mina dokument\Ny mapp

2014-07-20 02:41 - 2014-07-20 02:41 - 00002876 _____ () C:\WINDOWS\DPINST.LOG

2014-07-20 00:43 - 2014-07-21 22:08 - 00000101 _____ () C:\WINDOWS\setupact.log

2014-07-20 00:43 - 2014-07-20 00:43 - 00000000 _____ () C:\WINDOWS\setuperr.log

2014-07-20 00:22 - 2014-08-02 02:44 - 00065536 _____ () C:\WINDOWS\system32\config\TuneUp.evt

2014-07-20 00:22 - 2014-07-20 00:22 - 00001689 _____ () C:\Documents and Settings\All Users\Start-meny\Program\AVG PC TuneUp 2014.lnk

2014-07-20 00:22 - 2014-07-20 00:22 - 00001689 _____ () C:\Documents and Settings\All Users\Skrivbord\AVG 1-Click Maintenance.lnk

2014-07-20 00:22 - 2014-07-20 00:22 - 00001683 _____ () C:\Documents and Settings\All Users\Skrivbord\AVG PC TuneUp 2014.lnk

2014-07-20 00:22 - 2014-07-20 00:22 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\AVG PC TuneUp 2014

2014-07-20 00:22 - 2014-07-14 12:26 - 00036152 _____ (AVG) C:\WINDOWS\system32\TURegOpt.exe

2014-07-20 00:21 - 2014-07-20 00:21 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\AVG

2014-07-20 00:21 - 2014-07-20 00:21 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\AVG

2014-07-20 00:17 - 2014-07-20 00:29 - 00000000 __SHD () C:\Documents and Settings\All Users\Application Data\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}

2014-07-20 00:17 - 2014-07-20 00:22 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVG

2014-07-19 21:23 - 2014-07-19 21:23 - 00000494 _____ () C:\Documents and Settings\Richard\Skrivbord\Data Safe.lnk

2014-07-19 21:22 - 2014-07-19 21:23 - 209715200 _____ () C:\Documents and Settings\Richard\Mina dokument\Data Safe.avgfv

2014-07-19 17:55 - 2014-07-19 17:55 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\AVG2014

2014-07-19 17:54 - 2014-07-19 21:03 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\AVG

2014-07-19 17:54 - 2014-07-19 17:54 - 00000670 _____ () C:\Documents and Settings\All Users\Skrivbord\AVG 2014.lnk

2014-07-19 17:53 - 2014-07-19 17:54 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVG2014

2014-07-19 17:53 - 2014-07-19 17:53 - 00000000 ___HD () C:\$AVG

2014-07-19 17:53 - 2014-07-19 17:53 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\TuneUp Software

2014-07-19 17:52 - 2014-07-20 00:21 - 00000000 ____D () C:\Program\AVG

2014-07-19 17:39 - 2014-08-02 18:51 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\MFAData

2014-07-19 17:39 - 2014-07-19 21:28 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Avg2014

2014-07-19 17:39 - 2014-07-19 17:39 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\MFAData

2014-07-19 02:28 - 2014-07-29 01:01 - 00419473 _____ () C:\WINDOWS\setupapi.log

2014-07-15 14:40 - 2014-07-15 14:40 - 00031768 _____ () C:\Documents and Settings\Richard\Skrivbord\THE FIX'IT MAN.celtx

2014-07-12 23:22 - 2014-07-12 23:22 - 00000427 _____ () C:\Billy Wilder.jpg.lnk5z651

2014-07-12 14:59 - 2014-07-12 14:59 - 00000624 _____ () C:\Robert MacLean, his brief history.pdf.lnky4355

2014-07-12 14:58 - 2014-07-12 14:58 - 00000506 _____ () C:\Romantic comedy Pas de deux.zip.lnkhs605

2014-07-11 17:02 - 2014-07-11 17:02 - 00000384 _____ () C:\agent.pdf.lnk5z1020

2014-07-11 14:03 - 2014-07-11 14:03 - 00000614 _____ () C:\Dancing Israeli's (3-of-the-5).jpeg.lnky4162

2014-07-11 13:26 - 2014-07-11 13:26 - 00000549 _____ () C:\Sword rear Ninga #1.jpg.lnkht318

2014-07-11 13:03 - 2014-07-11 13:03 - 00000584 _____ () C:\Ridley Scott & Camera #02.jpg.lnkyk287

2014-07-11 12:58 - 2014-07-11 12:58 - 00000529 _____ () C:\Film Crew #03.jpeg.lnkhs209

2014-07-11 12:44 - 2014-07-11 12:54 - 00000629 _____ () C:\Film Crew #10 (It's Who You Know).jpeg.lnkui256

2014-07-10 12:38 - 2014-07-10 12:38 - 04181856 _____ (Kaspersky Lab ZAO) C:\Documents and Settings\Richard\Skrivbord\TDSSKiller.exe

2014-07-07 22:20 - 2014-07-07 22:22 - 00000000 ____D () C:\a4d807905df01db0e23d2a1eb4

2014-07-07 18:50 - 2014-07-08 15:49 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\Real

2014-07-07 18:03 - 2014-07-07 18:11 - 00000596 _____ () C:\Curt Butler - Nelnet Discharge (Cover Letter).zip.lnk5z321

2014-07-07 17:50 - 2014-07-08 15:48 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Real

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-08-02 19:50 - 2012-08-06 08:58 - 00000414 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{F881C789-9CA0-4738-AD4E-3E39BFF011E2}.job

2014-08-02 19:50 - 2010-08-24 11:09 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Temp

2014-08-02 19:49 - 2014-08-02 19:48 - 00027629 _____ () C:\Documents and Settings\Richard\Skrivbord\FRST.txt

2014-08-02 19:48 - 2014-08-02 19:46 - 00000000 ____D () C:\FRST

2014-08-02 19:48 - 2010-08-24 11:09 - 00000000 ____D () C:\Documents and Settings\Richard\Skrivbord

2014-08-02 19:46 - 2009-09-03 07:53 - 00000410 ____H () C:\WINDOWS\Tasks\User_Feed_Synchronization-{7B8AB321-E309-49ED-B138-2D1AD3B32EF0}.job

2014-08-02 19:45 - 2014-08-02 19:44 - 01084928 _____ (Farbar) C:\Documents and Settings\Richard\Skrivbord\FRST.exe

2014-08-02 19:36 - 2014-01-23 18:25 - 00110296 _____ (Malwarebytes Corporation) C:\WINDOWS\system32\Drivers\MBAMSwissArmy.sys

2014-08-02 19:30 - 2013-06-10 22:57 - 00000494 _____ () C:\WINDOWS\Tasks\HP Photo Creations Communicator.job

2014-08-02 19:25 - 2012-04-12 06:55 - 00000868 _____ () C:\WINDOWS\Tasks\Adobe Flash Player Updater.job

2014-08-02 19:21 - 2012-06-03 17:20 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\Skype

2014-08-02 19:18 - 2014-07-21 00:01 - 00000626 _____ () C:\WINDOWS\Tasks\AVG_SYS_TASK_0614t_RUN.job

2014-08-02 19:18 - 2014-03-12 02:17 - 00000226 _____ () C:\WINDOWS\Tasks\Microsoft Windows XP - Inloggningsmeddelande gällande när tjänsten upphör.job

2014-08-02 19:18 - 2011-10-21 11:35 - 00000872 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job

2014-08-02 19:17 - 2004-09-06 08:16 - 00001158 _____ () C:\WINDOWS\system32\wpa.dbl

2014-08-02 19:15 - 2011-10-21 11:35 - 00000876 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job

2014-08-02 19:00 - 2012-12-17 20:02 - 00000998 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-280907462-213740653-3875255159-1148UA.job

2014-08-02 19:00 - 2012-12-17 20:02 - 00000946 _____ () C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-280907462-213740653-3875255159-1148Core.job

2014-08-02 18:51 - 2014-07-19 17:39 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\MFAData

2014-08-02 18:25 - 2004-09-06 08:21 - 00032562 _____ () C:\WINDOWS\SchedLgU.Txt

2014-08-02 11:25 - 2004-09-06 08:21 - 01300852 _____ () C:\WINDOWS\WindowsUpdate.log

2014-08-02 10:17 - 2004-09-06 09:46 - 00000159 _____ () C:\WINDOWS\wiadebug.log

2014-08-02 10:17 - 2004-09-06 09:46 - 00000048 _____ () C:\WINDOWS\wiaservc.log

2014-08-02 10:16 - 2014-08-02 10:16 - 00110592 _____ () C:\WINDOWS\Minidump\Mini080214-03.dmp

2014-08-02 10:16 - 2010-09-02 23:53 - 00000000 ____D () C:\WINDOWS\Minidump

2014-08-02 10:16 - 2004-09-06 08:21 - 00000006 ____H () C:\WINDOWS\Tasks\SA.DAT

2014-08-02 09:57 - 2014-07-31 19:52 - 00000000 ____D () C:\Documents and Settings\Richard\Skrivbord\Malware Tools

2014-08-02 09:03 - 2014-08-02 09:03 - 00110592 _____ () C:\WINDOWS\Minidump\Mini080214-02.dmp

2014-08-02 09:01 - 2013-10-03 16:49 - 00000000 ____D () C:\AdwCleaner

2014-08-02 09:00 - 2011-09-12 11:02 - 00000000 ___RD () C:\Documents and Settings\Richard\Mina dokument

2014-08-02 09:00 - 2010-08-24 11:09 - 00000000 ____D () C:\Documents and Settings\Richard

2014-08-02 08:58 - 2006-07-03 22:29 - 00000000 ___RD () C:\Program

2014-08-02 08:58 - 2006-07-03 22:29 - 00000000 ___RD () C:\Documents and Settings\All Users\Start-meny\Program

2014-08-02 08:03 - 2014-08-02 08:02 - 01361309 _____ () C:\Documents and Settings\Richard\Skrivbord\AdwCleaner.exe

2014-08-02 02:44 - 2014-07-20 00:22 - 00065536 _____ () C:\WINDOWS\system32\config\TuneUp.evt

2014-08-02 02:44 - 2010-08-24 11:09 - 00000304 ___SH () C:\Documents and Settings\Richard\ntuser.ini

2014-08-02 01:51 - 2014-08-02 01:51 - 00110592 _____ () C:\WINDOWS\Minidump\Mini080214-01.dmp

2014-08-01 23:17 - 2014-08-01 23:17 - 00000733 _____ () C:\Documents and Settings\All Users\Skrivbord\Malwarebytes Anti-Malware.lnk

2014-08-01 23:17 - 2014-08-01 23:17 - 00000000 ____D () C:\Program\Malwarebytes Anti-Malware

2014-08-01 23:17 - 2014-08-01 23:17 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\Malwarebytes Anti-Malware

2014-08-01 23:17 - 2012-05-18 08:39 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes

2014-08-01 23:17 - 2006-07-03 22:29 - 00000000 ____D () C:\Documents and Settings\All Users\Skrivbord

2014-07-31 19:52 - 2013-09-05 12:36 - 00000000 ____D () C:\Documents and Settings\Richard\Skrivbord\JAGAN (MASTER FILE)

2014-07-31 18:41 - 2006-07-03 13:53 - 00002477 _____ () C:\Documents and Settings\All Users\Start-meny\Program\Microsoft Word.lnk

2014-07-31 18:25 - 2014-07-25 10:08 - 00002227 _____ () C:\Documents and Settings\All Users\Skrivbord\Skype.lnk

2014-07-31 12:43 - 2014-07-31 12:43 - 00000000 _____ () C:\SophosBootTasks.txt

2014-07-30 19:55 - 2012-05-26 12:54 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\uTorrent

2014-07-29 15:35 - 2011-07-05 15:06 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\vlc

2014-07-29 01:01 - 2014-07-19 02:28 - 00419473 _____ () C:\WINDOWS\setupapi.log

2014-07-28 23:20 - 2013-12-30 00:20 - 00000428 _____ () C:\WINDOWS\Tasks\WINZIPSS-WINZIPSSOneClickCare.job

2014-07-28 19:25 - 2014-05-19 12:47 - 00000000 ____D () C:\Documents and Settings\Richard\Skrivbord\SCRIPT DEVELOPMENT

2014-07-28 14:04 - 2013-07-02 10:24 - 00000372 _____ () C:\Documents and Settings\Richard\Mina dokument\spider.sav

2014-07-27 23:20 - 2013-12-30 00:20 - 00000466 _____ () C:\WINDOWS\Tasks\WINZIPSS-WINZIPSSAutoCheckUpdate7Days.job

2014-07-26 22:36 - 2013-09-01 13:11 - 00000000 ____D () C:\Documents and Settings\Richard\Skrivbord\HOLLY FARM PRODUCTIONS

2014-07-25 23:24 - 2014-07-25 23:24 - 00000000 ____H () C:\Documents and Settings\Richard\Mina dokument\Default.rdp

2014-07-25 23:20 - 2010-08-24 11:09 - 00000000 ___RD () C:\Documents and Settings\Richard\Start-meny\Program\Autostart

2014-07-25 21:17 - 2013-05-17 00:54 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\Dropbox

2014-07-25 20:12 - 2012-05-18 00:01 - 00000000 ____D () C:\Documents and Settings\Richard\Skrivbord\My Desktop Photos

2014-07-25 19:55 - 2012-08-05 23:43 - 00000000 ____D () C:\unzipped

2014-07-25 19:20 - 2013-12-28 05:10 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)

2014-07-25 19:20 - 2013-12-27 23:17 - 00000000 ____D () C:\Documents and Settings\Richard\Skrivbord\mbar

2014-07-25 10:37 - 2012-09-30 00:43 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\Audacity

2014-07-25 10:08 - 2014-07-25 10:08 - 00000000 ____D () C:\Program\Delade filer\Skype

2014-07-25 10:08 - 2014-07-25 10:08 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Skype

2014-07-25 10:08 - 2014-07-25 10:08 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\Skype

2014-07-25 10:08 - 2013-01-27 12:03 - 00000000 ___RD () C:\Program\Skype

2014-07-25 10:08 - 2012-06-03 17:19 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Skype

2014-07-25 10:08 - 2006-07-03 22:30 - 00000000 ____D () C:\Program\Delade filer

2014-07-24 20:34 - 2013-07-12 16:44 - 00000000 ___RD () C:\Documents and Settings\Richard\Mina dokument\Mina bilder

2014-07-24 20:20 - 2014-07-21 23:53 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\Apple Computer

2014-07-24 19:50 - 2012-11-16 18:00 - 00000000 ____D () C:\Program\Celtx

2014-07-24 15:30 - 2013-05-17 01:47 - 00001020 _____ () C:\Documents and Settings\Richard\Skrivbord\Dropbox.lnk

2014-07-24 15:30 - 2013-05-17 00:56 - 00000000 ____D () C:\Documents and Settings\Richard\Start-meny\Program\Dropbox

2014-07-24 15:25 - 2013-05-26 09:15 - 00002347 _____ () C:\Documents and Settings\All Users\Start-meny\Program\Adobe Reader XI.lnk

2014-07-24 00:04 - 2013-05-31 09:19 - 00000000 ____D () C:\Program\Microsoft Silverlight

2014-07-23 23:52 - 2013-05-31 09:20 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\Microsoft Silverlight

2014-07-23 19:46 - 2006-07-03 22:30 - 00000000 ____D () C:\WINDOWS\Microsoft.NET

2014-07-23 19:11 - 2004-09-06 08:05 - 00542224 _____ () C:\WINDOWS\system32\PerfStringBackup.INI

2014-07-23 19:11 - 2004-09-06 08:05 - 00413416 _____ () C:\WINDOWS\system32\perfh01D.dat

2014-07-23 19:11 - 2004-09-06 08:05 - 00068066 _____ () C:\WINDOWS\system32\perfc01D.dat

2014-07-23 17:51 - 2010-09-06 09:45 - 00031080 ____C () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\GDIPFONTCACHEV1.DAT

2014-07-22 14:56 - 2014-07-22 07:56 - 00001084 _____ () C:\WINDOWS\spupdsvc.log

2014-07-22 14:53 - 2004-09-06 08:02 - 00153176 _____ () C:\WINDOWS\system32\FNTCACHE.DAT

2014-07-22 14:49 - 2013-07-21 14:15 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\ATI

2014-07-22 14:49 - 2013-07-21 14:15 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\ATI

2014-07-22 14:44 - 2014-07-22 14:44 - 00000000 ____D () C:\ATI

2014-07-22 10:58 - 2014-07-22 07:22 - 00000000 ____D () C:\0d608be659421094a8274931cdb6

2014-07-22 07:57 - 2010-12-22 11:13 - 00000000 ____D () C:\WINDOWS\system32\XPSViewer

2014-07-22 07:56 - 2014-07-22 07:55 - 00000000 ____D () C:\f18b8596a63f2776389f

2014-07-22 00:33 - 2014-07-22 00:33 - 00001510 _____ () C:\Documents and Settings\All Users\Skrivbord\iTunes.lnk

2014-07-22 00:33 - 2014-07-22 00:33 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\iTunes

2014-07-22 00:33 - 2014-07-22 00:32 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1

2014-07-22 00:33 - 2014-07-21 23:49 - 00000000 ____D () C:\Program\iTunes

2014-07-22 00:32 - 2014-07-22 00:32 - 00000000 ____D () C:\Program\iPod

2014-07-22 00:32 - 2014-07-21 23:49 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Apple Computer

2014-07-22 00:32 - 2014-07-21 23:45 - 00000000 ____D () C:\Program\Delade filer\Apple

2014-07-21 23:53 - 2014-07-21 23:53 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Apple Computer

2014-07-21 23:47 - 2014-07-21 23:47 - 00001830 _____ () C:\Documents and Settings\All Users\Start-meny\Program\Apple Software Update.lnk

2014-07-21 23:47 - 2014-07-21 23:47 - 00000272 _____ () C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

2014-07-21 23:47 - 2014-07-21 23:47 - 00000000 ____D () C:\Program\Apple Software Update

2014-07-21 23:47 - 2014-07-21 23:47 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Apple

2014-07-21 23:47 - 2014-07-21 23:47 - 00000000 ____D () C:\Documents and Settings\LocalService\Application Data\Apple Computer

2014-07-21 23:47 - 2014-07-21 23:45 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Apple

2014-07-21 23:45 - 2014-07-21 23:45 - 00000000 ____D () C:\Program\Bonjour

2014-07-21 23:01 - 2014-07-21 22:14 - 00000000 ____D () C:\d80b9deb1c60777af7

2014-07-21 22:09 - 2010-08-26 09:01 - 00000000 ____D () C:\WINDOWS\system32\NtmsData

2014-07-21 22:08 - 2014-07-20 00:43 - 00000101 _____ () C:\WINDOWS\setupact.log

2014-07-21 02:59 - 2012-08-14 23:23 - 00000270 _____ () C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job

2014-07-21 00:23 - 2014-07-21 00:23 - 00000000 ____D () C:\Documents and Settings\LocalService\Lokala inställningar\Application Data\AVG

2014-07-21 00:23 - 2014-07-21 00:23 - 00000000 ____D () C:\Documents and Settings\LocalService\Application Data\AVG

2014-07-21 00:01 - 2014-07-21 00:01 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Avg_Update_0614t

2014-07-20 18:21 - 2014-05-19 19:33 - 00000000 ____D () C:\Documents and Settings\Richard\Mina dokument\CURT'S MEDICAL FILE

2014-07-20 10:09 - 2004-09-06 07:52 - 00000749 ___RH () C:\WINDOWS\WindowsShell.Manifest

2014-07-20 10:09 - 2004-09-06 07:52 - 00000749 ___RH () C:\WINDOWS\system32\wuaucpl.cpl.manifest

2014-07-20 10:09 - 2004-09-06 07:52 - 00000749 ___RH () C:\WINDOWS\system32\sapi.cpl.manifest

2014-07-20 10:09 - 2004-09-06 07:52 - 00000749 ___RH () C:\WINDOWS\system32\nwc.cpl.manifest

2014-07-20 10:09 - 2004-09-06 07:52 - 00000749 ___RH () C:\WINDOWS\system32\ncpa.cpl.manifest

2014-07-20 10:09 - 2004-09-06 07:52 - 00000749 ___RH () C:\WINDOWS\system32\cdplayer.exe.manifest

2014-07-20 09:17 - 2014-07-20 09:17 - 00000000 ____D () C:\Documents and Settings\Richard\Mina dokument\Ny mapp

2014-07-20 09:16 - 2012-10-04 17:16 - 00000000 ____D () C:\Intel Desktop Board

2014-07-20 02:56 - 2010-08-24 11:09 - 00000000 ___RD () C:\Documents and Settings\Richard\Start-meny

2014-07-20 02:41 - 2014-07-20 02:41 - 00002876 _____ () C:\WINDOWS\DPINST.LOG

2014-07-20 00:43 - 2014-07-20 00:43 - 00000000 _____ () C:\WINDOWS\setuperr.log

2014-07-20 00:29 - 2014-07-20 00:17 - 00000000 __SHD () C:\Documents and Settings\All Users\Application Data\{01BD4FC9-2F86-4706-A62E-774BB7E9D308}

2014-07-20 00:29 - 2013-05-18 14:40 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\HpUpdate

2014-07-20 00:28 - 2013-06-14 01:33 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\Plot Control

2014-07-20 00:28 - 2006-07-03 15:44 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\Lotus SmartSuite

2014-07-20 00:22 - 2014-07-20 00:22 - 00001689 _____ () C:\Documents and Settings\All Users\Start-meny\Program\AVG PC TuneUp 2014.lnk

2014-07-20 00:22 - 2014-07-20 00:22 - 00001689 _____ () C:\Documents and Settings\All Users\Skrivbord\AVG 1-Click Maintenance.lnk

2014-07-20 00:22 - 2014-07-20 00:22 - 00001683 _____ () C:\Documents and Settings\All Users\Skrivbord\AVG PC TuneUp 2014.lnk

2014-07-20 00:22 - 2014-07-20 00:22 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\AVG PC TuneUp 2014

2014-07-20 00:22 - 2014-07-20 00:17 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVG

2014-07-20 00:21 - 2014-07-20 00:21 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\AVG

2014-07-20 00:21 - 2014-07-20 00:21 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\AVG

2014-07-20 00:21 - 2014-07-19 17:52 - 00000000 ____D () C:\Program\AVG

2014-07-20 00:14 - 2010-08-24 11:09 - 00000000 ___RD () C:\Documents and Settings\Richard\Start-meny\Program

2014-07-19 22:57 - 2013-06-06 01:08 - 00001753 _____ () C:\Documents and Settings\All Users\Skrivbord\Google Chrome.lnk

2014-07-19 22:44 - 2011-02-11 13:43 - 00000000 ____D () C:\Program\PDFCreator

2014-07-19 22:22 - 2014-04-28 15:36 - 00000000 ____D () C:\Program\Advanced Disk Recovery

2014-07-19 21:59 - 2014-04-28 15:36 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\Advanced Disk Recovery

2014-07-19 21:28 - 2014-07-19 17:39 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\Avg2014

2014-07-19 21:23 - 2014-07-19 21:23 - 00000494 _____ () C:\Documents and Settings\Richard\Skrivbord\Data Safe.lnk

2014-07-19 21:23 - 2014-07-19 21:22 - 209715200 _____ () C:\Documents and Settings\Richard\Mina dokument\Data Safe.avgfv

2014-07-19 21:23 - 2010-08-24 11:09 - 00000000 ___RD () C:\Documents and Settings\Richard\Favoriter

2014-07-19 21:03 - 2014-07-19 17:54 - 00000000 ____D () C:\Documents and Settings\All Users\Start-meny\Program\AVG

2014-07-19 20:54 - 2012-05-13 14:33 - 00001912 _____ () C:\WINDOWS\epplauncher.mif

2014-07-19 20:54 - 2012-05-13 14:32 - 00000000 ____D () C:\Program\Microsoft Security Client

2014-07-19 17:55 - 2014-07-19 17:55 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\AVG2014

2014-07-19 17:54 - 2014-07-19 17:54 - 00000670 _____ () C:\Documents and Settings\All Users\Skrivbord\AVG 2014.lnk

2014-07-19 17:54 - 2014-07-19 17:53 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\AVG2014

2014-07-19 17:53 - 2014-07-19 17:53 - 00000000 ___HD () C:\$AVG

2014-07-19 17:53 - 2014-07-19 17:53 - 00000000 ____D () C:\Documents and Settings\Richard\Application Data\TuneUp Software

2014-07-19 17:39 - 2014-07-19 17:39 - 00000000 ____D () C:\Documents and Settings\Richard\Lokala inställningar\Application Data\MFAData

2014-07-19 03:30 - 2013-06-14 01:32 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Package Cache

2014-07-19 00:09 - 2012-09-30 13:40 - 00000000 ____D () C:\Program\Free Scan to PDF

2014-07-18 23:51 - 2008-11-13 11:00 - 00000000 ____D () C:\Documents and Settings\All Users\Application Data\Norton

2014-07-18 23:50 - 2006-07-03 15:44 - 00000000 ____D () C:\Program\lotus

2014-07-18 23:50 - 2006-07-03 13:40 - 00000000 ____D () C:\Documents and Settings\IVAB\Lokala inställningar\Temp

2014-07-18 16:37 - 2006-07-03 22:29 - 00000000 ____D () C:\Documents and Settings\NetworkService\Lokala inställningar\Temp

2014-07-15 14:40 - 2014-07-15 14:40 - 00031768 _____ () C:\Documents and Settings\Richard\Skrivbord\THE FIX'IT MAN.celtx

2014-07-15 07:23 - 2013-08-02 23:50 - 00000000 ____D () C:\WINDOWS\system32\MRT

2014-07-14 12:26 - 2014-07-20 00:22 - 00036152 _____ (AVG) C:\WINDOWS\system32\TURegOpt.exe