Pop up ads, malware, slow pc [Solved]

Hi,

I am having a lot of problems with my pc.

• internet explorer constantly freezing not responding
• on web pages words are underlined appears to be ads
• fly in ads on web pages
• I run Norton on the computer but this doesn't seam to help..

I ran the scan through OTL see below - Please help!

OTL logfile created on: 31/08/2014 8:06:22 AM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\Megan\Desktop
64bit- An unknown product  (Version = 6.2.9200) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.17054)
Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: dd/MM/yyyy
 
7.19 Gb Total Physical Memory | 5.58 Gb Available Physical Memory | 77.64% Memory free
8.32 Gb Paging File | 6.68 Gb Available in Paging File | 80.34% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 907.12 Gb Total Space | 550.75 Gb Free Space | 60.71% Space Free | Partition Type: NTFS
Drive D: | 23.62 Gb Total Space | 0.36 Gb Free Space | 1.53% Space Free | Partition Type: NTFS
Drive E: | 2.05 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
 
Computer Name: PENNINGHPC | User Name: Megan | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Megan\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\n360.exe (Symantec Corporation)
PRC - C:\Users\Megan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
PRC - C:\Program Files (x86)\Media_Play_AIR+_1.1\Media_Play_AIR+_1.1-bg.exe (enter)
PRC - C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe (PriceMeter)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
PRC - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe (IVT Corporation)
PRC - C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe (CyberLink)
PRC - C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe (IVT Corporation)
PRC - C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe (Hewlett-Packard Development Company, L.P.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\BsProfileFunc.dll ()
MOD - C:\Windows\SysWOW64\BsTrace.dll ()
MOD - C:\Windows\SysWOW64\BsExtendFunc.dll ()
MOD - C:\Windows\SysWOW64\SCChangeMonitor.dll ()
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - (OutfoxTvService) – C:\Program Files\OutfoxTV\OutfoxTvService.exe File not found
SRV:64bit: - (ClickToRunSvc) – C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe (Microsoft Corporation)
SRV:64bit: - (RtkAudioService) – C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE (Realtek Semiconductor)
SRV:64bit: - (LSM) – C:\Windows\SysNative\lsm.dll (Microsoft Corporation)
SRV:64bit: - (WinDefend) – C:\Program Files\Windows Defender\MsMpEng.exe (Microsoft Corporation)
SRV:64bit: - (WSService) – C:\Windows\SysNative\WSService.dll (Microsoft Corporation)
SRV:64bit: - (wlidsvc) – C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
SRV:64bit: - (fhsvc) – C:\Windows\SysNative\fhsvc.dll (Microsoft Corporation)
SRV:64bit: - (Wcmsvc) – C:\Windows\SysNative\wcmsvc.dll (Microsoft Corporation)
SRV:64bit: - (DsmSvc) – C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
SRV:64bit: - (netprofm) – C:\Windows\SysNative\netprofmsvc.dll (Microsoft Corporation)
SRV:64bit: - (BrokerInfrastructure) – C:\Windows\SysNative\bisrv.dll (Microsoft Corporation)
SRV:64bit: - (AMD External Events Utility) – C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (AMD FUEL Service) – C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe (Advanced Micro Devices, Inc.)
SRV:64bit: - (AudioEndpointBuilder) – C:\Windows\SysNative\AudioEndpointBuilder.dll (Microsoft Corporation)
SRV:64bit: - (TimeBroker) – C:\Windows\SysNative\TimeBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (SystemEventsBroker) – C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
SRV:64bit: - (hpsrv) – C:\Windows\SysNative\hpservice.exe (Hewlett-Packard Company)
SRV:64bit: - (PrintNotify) – C:\Windows\SysNative\spool\drivers\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV:64bit: - (WiaRpc) – C:\Windows\SysNative\wiarpc.dll (Microsoft Corporation)
SRV:64bit: - (VaultSvc) – C:\Windows\SysNative\vaultsvc.dll (Microsoft Corporation)
SRV:64bit: - (svsvc) – C:\Windows\SysNative\svsvc.dll (Microsoft Corporation)
SRV:64bit: - (Netlogon) – C:\Windows\SysNative\netlogon.dll (Microsoft Corporation)
SRV:64bit: - (NcaSvc) – C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
SRV:64bit: - (NcdAutoSetup) – C:\Windows\SysNative\NcdAutoSetup.dll (Microsoft Corporation)
SRV:64bit: - (KeyIso) – C:\Windows\SysNative\keyiso.dll (Microsoft Corporation)
SRV:64bit: - (EFS) – C:\Windows\SysNative\efssvc.dll (Microsoft Corporation)
SRV:64bit: - (DeviceAssociationService) – C:\Windows\SysNative\das.dll (Microsoft Corporation)
SRV:64bit: - (AllUserInstallAgent) – C:\Windows\SysNative\AUInstallAgent.dll (Microsoft Corporation)
SRV:64bit: - (vmicvss) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmictimesync) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicshutdown) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicrdv) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmickvpexchange) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV:64bit: - (vmicheartbeat) – C:\Windows\SysNative\icsvc.dll (Microsoft Corporation)
SRV - (N360) – C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\N360.exe (Symantec Corporation)
SRV - (globalUpdatem) – C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe (globalUpdate)
SRV - (globalUpdate) – C:\Program Files (x86)\globalUpdate\Update\GoogleUpdate.exe (globalUpdate)
SRV - (pricemeterliveUpdatem) – C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe (PriceMeter)
SRV - (pricemeterliveUpdate) – C:\Program Files (x86)\PriceMeterLiveUpdate\Update\PriceMeterLiveUpdate.exe (PriceMeter)
SRV - (HP Support Assistant Service) – C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe (Hewlett-Packard Company)
SRV - (HPWMISVC) – c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe (Hewlett-Packard Development Company, L.P.)
SRV - (BlueSoleilCS) – C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe (IVT Corporation)
SRV - (BsHelpCS) – C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe (IVT Corporation)
SRV - (PrintNotify) – C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll (Microsoft Corporation)
SRV - (StorSvc) – C:\Windows\SysWOW64\StorSvc.dll (Microsoft Corporation)
SRV - (WAS) – C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) – C:\Windows\SysWOW64\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (GamesAppService) – C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe (WildTangent, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (esgiguard) – C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys File not found
DRV:64bit: - (SymEvent) – C:\Windows\SysNative\Drivers\SYMEVENT64x86.SYS (Symantec Corporation)
DRV:64bit: - ({a3f28269-ad17-41a8-b032-3e0313ef8979}Gw64) – C:\Windows\SysNative\Drivers\{a3f28269-ad17-41a8-b032-3e0313ef8979}Gw64.sys (StdLib)
DRV:64bit: - (WdBoot) – C:\Windows\SysNative\Drivers\WdBoot.sys (Microsoft Corporation)
DRV:64bit: - (WdFilter) – C:\Windows\SysNative\Drivers\WdFilter.sys (Microsoft Corporation)
DRV:64bit: - (SWDUMon) – C:\Windows\SysNative\Drivers\SWDUMon.sys ()
DRV:64bit: - (SymEFA) – C:\Windows\SysNative\Drivers\N360x64\1505000.013\symefa64.sys (Symantec Corporation)
DRV:64bit: - (ccSet_N360) – C:\Windows\SysNative\Drivers\N360x64\1505000.013\ccsetx64.sys (Symantec Corporation)
DRV:64bit: - (SymNetS) – C:\Windows\SysNative\Drivers\N360x64\1505000.013\symnets.sys (Symantec Corporation)
DRV:64bit: - (SRTSP) – C:\Windows\SysNative\Drivers\N360x64\1505000.013\srtsp64.sys (Symantec Corporation)
DRV:64bit: - (netr28x) – C:\Windows\SysNative\Drivers\netr28x.sys (Ralink Technology, Corp.)
DRV:64bit: - (rtbth) – C:\Windows\SysNative\Drivers\rtbth.sys (Ralink Technology, Corp.)
DRV:64bit: - (SymELAM) – C:\Windows\SysNative\Drivers\N360x64\1505000.013\symelam.sys (Symantec Corporation)
DRV:64bit: - (SymDS) – C:\Windows\SysNative\Drivers\N360x64\1505000.013\symds64.sys (Symantec Corporation)
DRV:64bit: - (SymIRON) – C:\Windows\SysNative\Drivers\N360x64\1505000.013\ironx64.sys (Symantec Corporation)
DRV:64bit: - (SRTSPX) – C:\Windows\SysNative\Drivers\N360x64\1505000.013\srtspx64.sys (Symantec Corporation)
DRV:64bit: - (SynTP) – C:\Windows\SysNative\Drivers\SynTP.sys (Synaptics Incorporated)
DRV:64bit: - (WFPLWFS) – C:\Windows\SysNative\Drivers\wfplwfs.sys (Microsoft Corporation)
DRV:64bit: - (spaceport) – C:\Windows\SysNative\Drivers\spaceport.sys (Microsoft Corporation)
DRV:64bit: - (USBHUB3) – C:\Windows\SysNative\Drivers\USBHUB3.SYS (Microsoft Corporation)
DRV:64bit: - (dam) – C:\Windows\SysNative\Drivers\dam.sys (Microsoft Corporation)
DRV:64bit: - (TPM) – C:\Windows\SysNative\Drivers\tpm.sys (Microsoft Corporation)
DRV:64bit: - (GPIOClx0101) – C:\Windows\SysNative\Drivers\msgpioclx.sys (Microsoft Corporation)
DRV:64bit: - (hidi2c) – C:\Windows\SysNative\Drivers\hidi2c.sys (Microsoft Corporation)
DRV:64bit: - (msgpiowin32) – C:\Windows\SysNative\Drivers\msgpiowin32.sys (Microsoft Corporation)
DRV:64bit: - (bthhfhid) – C:\Windows\SysNative\Drivers\BthhfHid.sys (Microsoft Corporation)
DRV:64bit: - (FxPPM) – C:\Windows\SysNative\Drivers\fxppm.sys (Microsoft Corporation)
DRV:64bit: - (sdstor) – C:\Windows\SysNative\Drivers\sdstor.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) – C:\Windows\SysNative\Drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (ebdrv) – C:\Windows\SysNative\Drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) – C:\Windows\SysNative\Drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (USBXHCI) – C:\Windows\SysNative\Drivers\USBXHCI.SYS (Microsoft Corporation)
DRV:64bit: - (UCX01000) – C:\Windows\SysNative\Drivers\UCX01000.SYS (Microsoft Corporation)
DRV:64bit: - (sdbus) – C:\Windows\SysNative\Drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (BthAvrcpTg) – C:\Windows\SysNative\Drivers\BthAvrcpTg.sys (Microsoft Corporation)
DRV:64bit: - (BthA2DP) – C:\Windows\SysNative\Drivers\BthA2DP.sys (Microsoft Corporation)
DRV:64bit: - (amdkmdag) – C:\Windows\SysNative\Drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) – C:\Windows\SysNative\Drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (storahci) – C:\Windows\SysNative\Drivers\storahci.sys (Microsoft Corporation)
DRV:64bit: - (pdc) – C:\Windows\SysNative\Drivers\pdc.sys (Microsoft Corporation)
DRV:64bit: - (Accelerometer) – C:\Windows\SysNative\Drivers\Accelerometer.sys (Hewlett-Packard)
DRV:64bit: - (hpdskflt) – C:\Windows\SysNative\Drivers\hpdskflt.sys (Hewlett-Packard)
DRV:64bit: - (btUrbFilterDrv) – C:\Windows\SysNative\Drivers\IvtUrbBtFlt.sys (Ralink Corporation)
DRV:64bit: - (AtiHDAudioService) – C:\Windows\SysNative\Drivers\AtihdW86.sys (Advanced Micro Devices)
DRV:64bit: - (amdkmpfd) – C:\Windows\SysNative\Drivers\amdkmpfd.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (SmbDrvI) – C:\Windows\SysNative\Drivers\Smb_driver_Intel.sys (Synaptics Incorporated)
DRV:64bit: - (SmbDrv) – C:\Windows\SysNative\Drivers\Smb_driver_AMDASF.sys (Synaptics Incorporated)
DRV:64bit: - (RTSPER) – C:\Windows\SysNative\Drivers\RtsPer.sys (RTS Corporation)
DRV:64bit: - (RSP2STOR) – C:\Windows\SysNative\Drivers\RtsP2Stor.sys (Realtek Semiconductor Corp.)
DRV:64bit: - (RTL8168) – C:\Windows\SysNative\Drivers\Rt630x64.sys (Realtek                                            )
DRV:64bit: - (amd_xata) – C:\Windows\SysNative\Drivers\amd_xata.sys (Advanced Micro Devices)
DRV:64bit: - (amd_sata) – C:\Windows\SysNative\Drivers\amd_sata.sys (Advanced Micro Devices)
DRV:64bit: - (WirelessButtonDriver) – C:\Windows\SysNative\Drivers\WirelessButtonDriver64.sys (Hewlett-Packard Development Company, L.P.)
DRV:64bit: - (usbfilter) – C:\Windows\SysNative\Drivers\usbfilter.sys (Advanced Micro Devices)
DRV:64bit: - (Fs_Rec) – C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (condrv) – C:\Windows\SysNative\Drivers\condrv.sys (Microsoft Corporation)
DRV:64bit: - (VSTXRAID) – C:\Windows\SysNative\Drivers\VSTXRAID.SYS (VIA Corporation)
DRV:64bit: - (VerifierExt) – C:\Windows\SysNative\Drivers\VerifierExt.sys (Microsoft Corporation)
DRV:64bit: - (UASPStor) – C:\Windows\SysNative\Drivers\uaspstor.sys (Microsoft Corporation)
DRV:64bit: - (acpiex) – C:\Windows\SysNative\Drivers\acpiex.sys (Microsoft Corporation)
DRV:64bit: - (mvumis) – C:\Windows\SysNative\Drivers\mvumis.sys (Marvell Semiconductor, Inc.)
DRV:64bit: - (stexstor) – C:\Windows\SysNative\Drivers\stexstor.sys (Promise Technology, Inc.)
DRV:64bit: - (LSI_SAS2) – C:\Windows\SysNative\Drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (LSI_SSS) – C:\Windows\SysNative\Drivers\lsi_sss.sys (LSI Corporation)
DRV:64bit: - (HpSAMD) – C:\Windows\SysNative\Drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (EhStorTcgDrv) – C:\Windows\SysNative\Drivers\EhStorTcgDrv.sys (Microsoft Corporation)
DRV:64bit: - (EhStorClass) – C:\Windows\SysNative\Drivers\EhStorClass.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) – C:\Windows\SysNative\Drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (3ware) – C:\Windows\SysNative\Drivers\3ware.sys (LSI)
DRV:64bit: - (amdsata) – C:\Windows\SysNative\Drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) – C:\Windows\SysNative\Drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (CLFS) – C:\Windows\SysNative\Drivers\clfs.sys (Microsoft Corporation)
DRV:64bit: - (vpci) – C:\Windows\SysNative\Drivers\vpci.sys (Microsoft Corporation)
DRV:64bit: - (terminpt) – C:\Windows\SysNative\Drivers\terminpt.sys (Microsoft Corporation)
DRV:64bit: - (mshidumdf) – C:\Windows\SysNative\Drivers\mshidumdf.sys (Microsoft Corporation)
DRV:64bit: - (BasicDisplay) – C:\Windows\SysNative\Drivers\BasicDisplay.sys (Microsoft Corporation)
DRV:64bit: - (HyperVideo) – C:\Windows\SysNative\Drivers\HyperVideo.sys (Microsoft Corporation)
DRV:64bit: - (BasicRender) – C:\Windows\SysNative\Drivers\BasicRender.sys (Microsoft Corporation)
DRV:64bit: - (gencounter) – C:\Windows\SysNative\Drivers\vmgencounter.sys (Microsoft Corporation)
DRV:64bit: - (kdnic) – C:\Windows\SysNative\Drivers\kdnic.sys (Microsoft Corporation)
DRV:64bit: - (acpitime) – C:\Windows\SysNative\Drivers\acpitime.sys (Microsoft Corporation)
DRV:64bit: - (npsvctrig) – C:\Windows\SysNative\Drivers\npsvctrig.sys (Microsoft Corporation)
DRV:64bit: - (WpdUpFltr) – C:\Windows\SysNative\Drivers\WpdUpFltr.sys (Microsoft Corporation)
DRV:64bit: - (acpipagr) – C:\Windows\SysNative\Drivers\acpipagr.sys (Microsoft Corporation)
DRV:64bit: - (hyperkbd) – C:\Windows\SysNative\Drivers\hyperkbd.sys (Microsoft Corporation)
DRV:64bit: - (SerCx) – C:\Windows\SysNative\Drivers\SerCx.sys (Microsoft Corporation)
DRV:64bit: - (SpbCx) – C:\Windows\SysNative\Drivers\SpbCx.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) – C:\Windows\SysNative\Drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (BthHFEnum) – C:\Windows\SysNative\Drivers\bthhfenum.sys (Microsoft Corporation)
DRV:64bit: - (dmvsc) – C:\Windows\SysNative\Drivers\dmvsc.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) – C:\Windows\SysNative\Drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (wpcfltr) – C:\Windows\SysNative\Drivers\wpcfltr.sys (Microsoft Corporation)
DRV:64bit: - (BthLEEnum) – C:\Windows\SysNative\Drivers\BthLEEnum.sys (Microsoft Corporation)
DRV:64bit: - (NdisImPlatform) – C:\Windows\SysNative\Drivers\NdisImPlatform.sys (Microsoft Corporation)
DRV:64bit: - (MsLldp) – C:\Windows\SysNative\Drivers\mslldp.sys (Microsoft Corporation)
DRV:64bit: - (Ndu) – C:\Windows\SysNative\Drivers\Ndu.sys (Microsoft Corporation)
DRV:64bit: - (BthL2caScoIfSrv) – C:\Windows\SysNative\Drivers\BtL2caScoIf.sys (Ralink Corporation)
DRV:64bit: - (BtAudioBusSrv) – C:\Windows\SysNative\Drivers\BtAudioBus.sys (IVT Corporation)
DRV:64bit: - (igfx) – C:\Windows\SysNative\Drivers\igdkmd64.sys (Intel Corporation)
DRV:64bit: - (AODDriver4.2) – C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys (Advanced Micro Devices)
DRV - (IDSVia64) – C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.3.0.12\Definitions\IPSDefs\20140829.001\IDSviA64.sys (Symantec Corporation)
DRV - (NAVEX15) – C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.3.0.12\Definitions\VirusDefs\20140829.018\ex64.sys (Symantec Corporation)
DRV - (NAVENG) – C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.3.0.12\Definitions\VirusDefs\20140829.018\eng64.sys (Symantec Corporation)
DRV - (BHDrvx64) – C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.3.0.12\Definitions\BASHDefs\20140821.007\BHDrvx64.sys (Symantec Corporation)
DRV - (EraserUtilRebootDrv) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys (Symantec Corporation)
DRV - (eeCtrl) – C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys (Symantec Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.sweet-page.com/web/?type=ds&ts=1402008051&from=cor&uid=ST1000LM024XHN-M101MBB_S2Y9J9FD805064&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.sweet-page.com/web/?type=ds&ts=1402008051&from=cor&uid=ST1000LM024XHN-M101MBB_S2Y9J9FD805064&q={searchTerms}
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
IE:64bit: - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = about:newtab
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid=N360&pvid=20.5.0.28
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://www.bing.com/search?q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.bing.com/search?q={searchTerms}
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = about:newtab
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = about:newtab
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
IE - HKLM\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Default_Page_URL = about:newtab
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Bar = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Search Page = http://search.certified-toolbar.com?si=80415&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&st=chrome&q=
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Start Default_Page_URL = about:newtab
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = about:newtab
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\..\SearchScopes\{014DB5FA-EAFB-4592-A95B-F44D3EE87FA9}: "URL" = http://www.trovigo.com/Results.aspx?gd=&ctid=CT3314958&octid=EB_ORIGINAL_CTID&SearchSource=58&CUI=&UM=4&UP=SPDA75F7BE-82E3-4EDC-BF4F-CDEED031B643&q={searchTerms}&SSPV=
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&form=IE10TR&src=IE10TR&pc=HPNTDFJS
IE - HKCU\..\SearchScopes\{AFBCB7E0-F91A-4951-9F31-58FEE57A25C4}: "URL" = http://nortonsafe.search.ask.com/web?q={SEARCHTERMS}&o=APN10506&l=dis&prt=360&chn=retail&geo=AU&ver=20&locale=en_AU&gct=kwd&qsrc=2869
IE - HKCU\..\SearchScopes\{D944BB61-2E34-4DBF-A683-47E505C587DC}: "URL" = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@staging.google.com/globalUpdate Update;version=10: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)
FF - HKLM\Software\MozillaPlugins\@staging.google.com/globalUpdate Update;version=4: C:\Program Files (x86)\globalUpdate\Update\1.3.25.0\npGoogleUpdate4.dll (globalUpdate)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.3: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@WildTangent.com/GamesAppPresenceDetector,Version=1.0: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\coFFPlgn\ [2014/08/31 07:55:38 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\IPSFF [2014/06/29 16:25:26 | 000,000,000 | —D | M]
 
[2013/10/22 19:50:15 | 000,000,000 | —D | M] (No name found) – C:\Users\Megan\AppData\Roaming\mozilla\Firefox\extensions
[2013/10/22 19:50:17 | 000,000,000 | —D | M] (WhiteSmoke New V.12) – C:\Users\Megan\AppData\Roaming\mozilla\Firefox\extensions\{4db0f392-c7b5-4669-8bbc-4ed98606c6b1}
[2014/06/06 21:15:52 | 000,000,000 | —D | M] (No name found) – C:\Users\Megan\AppData\Roaming\mozilla\Firefox\Profiles\extensions
[2014/06/06 20:53:03 | 000,000,000 | —D | M] (CouponDownloader) – C:\Users\Megan\AppData\Roaming\mozilla\Firefox\Profiles\extensions\CouponDownloader@jetpack
 
O1 HOSTS File: ([2012/07/26 15:26:49 | 000,000,824 | —- | M]) - C:\Windows\SysNative\Drivers\etc\hosts
O2:64bit: - BHO: (Media_Play_AIR+_1.1) - {11111111-1111-1111-1111-110511841188} - C:\Program Files (x86)\Media_Play_AIR+_1.1\Media_Play_AIR+_1.1-bho64.dll (enter)
O2:64bit: - BHO: (Lync Browser Helper) - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O2:64bit: - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\coieplg.dll (Symantec Corporation)
O2:64bit: - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
O2 - BHO: (no name) - {10AD2C61-0898-4348-8600-14A342F22AC3} - No CLSID value found.
O2 - BHO: (Media_Play_AIR+_1.1) - {11111111-1111-1111-1111-110511841188} - C:\Program Files (x86)\Media_Play_AIR+_1.1\Media_Play_AIR+_1.1-bho.dll (enter)
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\coieplg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\ips\ipsbho.dll (Symantec Corporation)
O2 - BHO: (HP Network Check Helper) - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
O3:64bit: - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\coieplg.dll (Symantec Corporation)
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {00000000-0000-0000-0000-000000000000} - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\coieplg.dll (Symantec Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\coieplg.dll (Symantec Corporation)
O4 - HKLM..\Run: [AccelerometerSysTrayApplet] C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [BtTray] C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe (IVT Corporation)
O4 - HKLM..\Run: [fst_au_68]  File not found
O4 - HKLM..\Run: [HPMessageService] C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [mobilegeni daemon] C:\Program Files (x86)\Mobogenie\DaemonProcess.exe File not found
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKCU..\Run: [Itibiti.exe] C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe File not found
O4 - HKCU..\Run: [OutfoxTV] C:\Program Files\OutfoxTV\OutfoxTV\DesktopContainer.exe File not found
O4 - HKCU..\Run: [Spotify] C:\Users\Megan\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Spotify Web Helper] C:\Users\Megan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd)
O4 - HKCU..\Run: [uTorrent] C:\Users\Megan\AppData\Roaming\uTorrent\uTorrent.exe (BitTorrent Inc.)
O4:64bit: - HKLM..\RunOnce: [NCPluginUpdater] C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe (Hewlett-Packard)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableCursorSuppression = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)
O8:64bit: - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office 15\Root\Office15\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Se&nd to OneNote - C:\Program Files\Microsoft Office 15\Root\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9:64bit: - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9:64bit: - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
O9:64bit: - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesX64\Microsoft Office\Office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-103 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra 'Tools' menuitem : @C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll,-102 - {25510184-5A38-4A99-B273-DCA8EEF6CD08} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\NCLauncherFromIE.exe (Hewlett-Packard)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office 15\root\office15\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.1.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E980B3E3-ED55-4DF8-8212-50BB31420BD0}: DhcpNameServer = 10.1.1.1
O18:64bit: - Protocol\Handler\osf - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\osf {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\office15\MSOSB.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\skype4com.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O30 - LSA: Security Packages - (livessp) -  File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2014/08/31 00:14:18 | 000,000,000 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2012/09/19 06:37:09 | 000,000,184 | R— | M] () - E:\autorun.inf – [ UDF ]
O33 - MountPoints2\{04d8610d-2fdd-11e3-be77-70188be301f8}\Shell - "" = AutoRun
O33 - MountPoints2\{04d8610d-2fdd-11e3-be77-70188be301f8}\Shell\AutoRun\command - "" = "F:\HTC_Sync_Manager_PC.exe"
O33 - MountPoints2\{2168b7e6-0893-11e3-be72-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{2168b7e6-0893-11e3-be72-806e6f6e6963}\Shell\AutoRun\command - "" = E:\setup.EXE – [2012/11/24 07:54:35 | 000,216,640 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{2168b7e6-0893-11e3-be72-806e6f6e6963}\Shell\configure\command - "" = E:\setup.exe – [2012/11/24 07:54:35 | 000,216,640 | R— | M] (Microsoft Corporation)
O33 - MountPoints2\{2168b7e6-0893-11e3-be72-806e6f6e6963}\Shell\install\command - "" = E:\setup.exe – [2012/11/24 07:54:35 | 000,216,640 | R— | M] (Microsoft Corporation)
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] – "%1" %*
O35:64bit: - HKLM\..exefile [open] – "%1" %*
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37:64bit: - HKLM\…com [@ = comfile] – "%1" %*
O37:64bit: - HKLM\…exe [@ = exefile] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: wlidsvc - C:\Windows\SysNative\wlidsvc.dll (Microsoft Corporation)
NetSvcs:64bit: DsmSvc - C:\Windows\SysNative\DeviceSetupManager.dll (Microsoft Corporation)
NetSvcs:64bit: NcaSvc - C:\Windows\SysNative\NcaSvc.dll (Microsoft Corporation)
NetSvcs:64bit: SystemEventsBroker - C:\Windows\SysNative\SystemEventsBrokerServer.dll (Microsoft Corporation)
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2014/08/31 08:04:08 | 000,602,112 | —- | C] (OldTimer Tools) – C:\Users\Megan\Desktop\OTL.exe
[2014/08/31 07:48:02 | 000,000,000 | -HSD | C] – C:\Config.Msi
[2014/08/31 00:13:21 | 000,000,000 | —D | C] – C:\Program Files\Enigma Software Group
[2014/08/31 00:12:37 | 000,000,000 | —D | C] – C:\Program Files (x86)\Common Files\Wise Installation Wizard
[2014/08/31 00:08:04 | 000,000,000 | —D | C] – C:\Users\Megan\AppData\Roaming\Tuneup Pro
[2014/08/30 10:06:57 | 001,300,992 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\gdi32.dll
[2014/08/23 15:13:52 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\storewuauth.dll
[2014/08/23 15:13:52 | 000,100,352 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wudriver.dll
[2014/08/23 15:13:52 | 000,086,528 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wudriver.dll
[2014/08/23 15:13:51 | 000,253,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\WUSettingsProvider.dll
[2014/08/23 15:13:51 | 000,059,416 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuauclt.exe
[2014/08/23 15:13:47 | 001,623,040 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wucltux.dll
[2014/08/23 15:13:47 | 000,773,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapi.dll
[2014/08/23 15:13:47 | 000,629,248 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuapi.dll
[2014/08/23 15:13:39 | 000,144,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuwebv.dll
[2014/08/23 15:13:39 | 000,128,000 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuwebv.dll
[2014/08/23 15:13:39 | 000,040,448 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\wuapp.exe
[2014/08/23 15:13:39 | 000,035,328 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\wuapp.exe
[2014/08/22 19:38:52 | 000,035,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\TsWpfWrp.exe
[2014/08/22 19:38:52 | 000,035,480 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\TsWpfWrp.exe
[2014/08/22 19:31:53 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\cdd.dll
[2014/08/22 19:31:22 | 003,959,296 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript9.dll
[2014/08/22 19:31:18 | 000,855,552 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\jscript.dll
[2014/08/22 19:31:18 | 000,603,136 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msfeeds.dll
[2014/08/22 19:31:18 | 000,451,584 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtmsft.dll
[2014/08/22 19:31:18 | 000,281,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\dxtrans.dll
[2014/08/22 19:31:17 | 001,508,864 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\inetcpl.cpl
[2014/08/22 19:31:17 | 001,440,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\inetcpl.cpl
[2014/08/22 19:31:17 | 000,915,968 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\uxtheme.dll
[2014/08/22 19:31:17 | 000,690,688 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\jscript.dll
[2014/08/22 19:31:17 | 000,136,704 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesysprep.dll
[2014/08/22 19:31:17 | 000,109,056 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesysprep.dll
[2014/08/22 19:31:17 | 000,097,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\mshtmled.dll
[2014/08/22 19:31:17 | 000,080,384 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\mshtmled.dll
[2014/08/22 19:31:16 | 000,163,840 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msrating.dll
[2014/08/22 19:31:16 | 000,051,712 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\ie4uinit.exe
[2014/08/22 19:31:15 | 000,197,120 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msrating.dll
[2014/08/22 19:31:15 | 000,039,936 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iernonce.dll
[2014/08/22 19:31:14 | 000,053,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\UXInit.dll
[2014/08/22 19:31:14 | 000,044,032 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\UXInit.dll
[2014/08/22 19:31:14 | 000,033,280 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iernonce.dll
[2014/08/22 19:31:13 | 000,067,072 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\iesetup.dll
[2014/08/22 19:31:13 | 000,061,440 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\iesetup.dll
[2014/08/22 19:30:56 | 010,116,608 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\twinui.dll
[2014/08/22 19:30:55 | 008,857,600 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\twinui.dll
[2014/08/22 19:30:54 | 002,885,632 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msi.dll
[2014/08/22 19:30:54 | 002,306,560 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\authui.dll
[2014/08/22 19:30:54 | 002,146,304 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\actxprxy.dll
[2014/08/22 19:30:52 | 002,037,760 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\authui.dll
[2014/08/22 19:30:51 | 000,393,216 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\msihnd.dll
[2014/08/22 19:30:51 | 000,112,984 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\consent.exe
[2014/08/22 19:30:50 | 000,295,424 | —- | C] (Microsoft Corporation) – C:\Windows\SysWow64\msihnd.dll
[2014/08/22 19:30:43 | 001,312,768 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\rpcrt4.dll
[2014/08/22 19:30:41 | 000,328,024 | —- | C] (Microsoft Corporation) – C:\Windows\SysNative\drivers\Classpnp.sys
[2014/06/06 08:40:35 | 000,815,502 | —- | C] (Click Me In Limited) – C:\Users\Megan\AppData\Local\AnyProtectScannerSetup.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Megan\AppData\Local\*.tmp files -> C:\Users\Megan\AppData\Local\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2014/08/31 08:04:08 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Megan\Desktop\OTL.exe
[2014/08/31 08:02:29 | 000,000,354 | —- | M] () – C:\Windows\tasks\HPCeeScheduleForMegan.job
[2014/08/31 07:57:23 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2014/08/31 07:56:46 | 000,001,524 | —- | M] () – C:\Windows\tasks\cb7f5cd8-7b5e-477e-b472-a69047b1f0b1-5.job
[2014/08/31 07:56:41 | 000,000,920 | —- | M] () – C:\Windows\tasks\globalUpdateUpdateTaskMachineCore.job
[2014/08/31 07:56:37 | 000,000,982 | —- | M] () – C:\Windows\tasks\PriceMeterLiveUpdateUpdateTaskMachineCore.job
[2014/08/31 07:55:32 | 000,000,983 | —- | M] () – C:\Windows\SysWow64\bscs.ini
[2014/08/31 07:55:22 | 000,327,032 | —- | M] () – C:\Windows\SysNative\FNTCACHE.DAT
[2014/08/31 07:54:46 | 268,435,456 | -HS- | M] () – C:\swapfile.sys
[2014/08/31 07:54:21 | 1884,291,071 | -HS- | M] () – C:\hiberfil.sys
[2014/08/31 07:47:00 | 000,000,314 | —- | M] () – C:\Windows\tasks\UpdaterEX.job
[2014/08/31 02:34:03 | 000,000,924 | —- | M] () – C:\Windows\tasks\globalUpdateUpdateTaskMachineUA.job
[2014/08/31 00:14:18 | 000,000,000 | —- | M] () – C:\autoexec.bat
[2014/08/30 10:03:11 | 002,921,529 | —- | M] () – C:\Windows\SysNative\drivers\N360x64\1505000.013\Cat.DB
[2014/08/27 19:47:21 | 000,043,689 | —- | M] () – C:\Windows\SysNative\drivers\N360x64\1505000.013\VT20140827.005
[2014/08/24 17:40:52 | 000,788,176 | —- | M] () – C:\Windows\SysNative\perfh009.dat
[2014/08/24 17:40:52 | 000,162,458 | —- | M] () – C:\Windows\SysNative\perfc009.dat
[2014/08/24 17:40:51 | 000,941,114 | —- | M] () – C:\Windows\SysNative\PerfStringBackup.INI
[2014/08/12 19:25:19 | 000,002,462 | —- | M] () – C:\Users\Public\Desktop\Norton 360.lnk
[2014/08/02 10:15:04 | 000,704,480 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerApp.exe
[2014/08/02 10:15:04 | 000,105,440 | —- | M] (Adobe Systems Incorporated) – C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Megan\AppData\Local\*.tmp files -> C:\Users\Megan\AppData\Local\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2014/08/31 00:14:18 | 000,000,000 | —- | C] () – C:\autoexec.bat
[2014/06/06 08:40:54 | 000,000,320 | —- | C] () – C:\Users\Megan\AppData\Roaming\aps.uninstall.scan.results
[2014/06/06 08:28:07 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2014/03/17 04:47:12 | 000,686,631 | —- | C] () – C:\Users\Megan\AppData\Local\nwhb-v9.4.15.crx
[2014/03/14 16:33:37 | 000,000,536 | —- | C] () – C:\Windows\SysWow64\schtasks.bin
[2014/01/12 19:47:02 | 000,000,269 | —- | C] () – C:\Users\Megan\AppData\Roaming\WB.CFG
[2013/12/03 19:09:53 | 000,001,706 | —- | C] () – C:\Windows\SysWow64\SHORTCUT.INI
[2013/12/03 19:09:09 | 000,000,297 | —- | C] () – C:\Windows\SysWow64\REMOTEDEVICE.INI
[2013/10/12 18:16:41 | 000,083,968 | —- | C] () – C:\Windows\SysWow64\OEMLicense.dll
[2013/08/19 13:59:56 | 000,003,620 | —- | C] () – C:\Windows\SysWow64\LOCALSERVICE.INI
[2013/08/19 13:59:56 | 000,000,043 | —- | C] () – C:\Windows\SysWow64\LOCALDEVICE.INI
[2013/08/19 13:51:25 | 000,369,624 | —- | C] () – C:\Windows\SysWow64\drivers\FW7650.bin
[2013/08/19 13:51:25 | 000,000,313 | —- | C] () – C:\Windows\SysWow64\RaCheckBTDev.ini
[2013/08/19 13:46:14 | 000,000,000 | —- | C] () – C:\Windows\ativpsrm.bin
[2013/04/17 17:44:26 | 000,995,342 | —- | C] () – C:\Windows\SysWow64\amdocl_as32.exe
[2013/04/17 17:44:26 | 000,798,734 | —- | C] () – C:\Windows\SysWow64\amdocl_ld32.exe
[2013/04/17 17:00:24 | 000,204,952 | —- | C] () – C:\Windows\SysWow64\ativvsvl.dat
[2013/04/17 17:00:24 | 000,157,144 | —- | C] () – C:\Windows\SysWow64\ativvsva.dat
[2013/03/05 09:30:20 | 000,000,983 | —- | C] () – C:\Windows\SysWow64\bscs.ini
[2013/02/01 10:04:00 | 000,070,904 | —- | C] () – C:\Windows\SysWow64\BsProfileFunc.dll
[2013/01/11 05:59:24 | 000,019,456 | —- | C] () – C:\Windows\SysWow64\BsTrace.dll
[2013/01/11 04:25:58 | 000,353,280 | —- | C] () – C:\Windows\SysWow64\BsExtendFunc.dll
[2013/01/11 04:25:58 | 000,049,248 | —- | C] () – C:\Windows\SysWow64\BSSkypeAgent.dll
[2013/01/11 04:25:56 | 000,081,920 | —- | C] () – C:\Windows\SysWow64\BsVistaCommon.dll
[2013/01/11 04:25:56 | 000,073,820 | —- | C] () – C:\Windows\SysWow64\BSVoIPComm.dll
[2013/01/11 04:25:56 | 000,049,664 | —- | C] () – C:\Windows\SysWow64\BSWMPPlugin.dll
[2013/01/11 04:25:56 | 000,011,264 | —- | C] () – C:\Windows\SysWow64\SCChangeMonitor.dll
[2012/11/27 18:18:46 | 000,038,912 | —- | C] () – C:\Windows\SysWow64\kdbsdk32.dll
 
========== ZeroAccess Check ==========
 
[2013/07/03 03:47:09 | 000,000,227 | RHS- | M] () – C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll – [2014/03/28 18:23:06 | 019,759,104 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll – [2014/03/28 16:18:26 | 017,562,112 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll – [2012/07/26 13:05:38 | 001,004,544 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2012/07/26 13:18:27 | 000,784,896 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll – [2012/07/26 13:07:41 | 000,455,680 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2014/06/09 14:00:56 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\Activeris
[2014/03/13 21:09:24 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\DownLite
[2014/06/06 08:07:29 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\newnext.me
[2014/03/13 21:32:44 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\PriceMeterUpdater
[2014/08/31 07:57:40 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\Spotify
[2014/06/09 14:00:18 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\sweet-page
[2013/10/08 15:16:01 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\Synaptics
[2014/06/06 21:00:04 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\systweak
[2014/08/31 00:08:10 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\Tuneup Pro
[2014/01/11 19:41:37 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\UpdaterEX
[2014/08/31 07:37:03 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\uTorrent
[2013/11/03 20:25:22 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\WildTangent
[2013/10/22 19:49:44 | 000,000,000 | —D | M] – C:\Users\Megan\AppData\Roaming\WinZip
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %USERPROFILE%\..|smtmp;true;true;true /FP >
 
< %temp%\smtmp\*.* /s > >
 
< MD5 for: EXPLORER.0.LOCALSETTINGUNIT  >
[2014/04/23 21:06:44 | 000,000,362 | -HS- | M] () MD5=38E0E74D0C20BF0B7A571AC047AE298F – C:\Users\Megan\AppData\Local\Microsoft\Windows\Live\Roaming\LocalCache\windows-explorer\Explorer.0.localsettingunit
 
< MD5 for: EXPLORER.ADML  >
[2012/07/26 17:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16384_en-us_7bca26f6f419a854\Explorer.adml
[2012/07/26 17:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16433_en-us_7bff382ef3f2006f\Explorer.adml
[2012/07/26 17:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.16726_en-us_7c0d0eaaf3e727f8\Explorer.adml
[2012/07/26 17:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.20534_en-us_7c89d5440d0eb990\Explorer.adml
[2012/07/26 17:50:44 | 000,003,671 | —- | M] () MD5=007B16AEF3E958080573CDB80648167D – C:\Windows\WinSxS\amd64_microsoft-windows-s..ouppolicy.resources_31bf3856ad364e35_6.2.9200.20837_en-us_7c8cdbd40d0bfd0a\Explorer.adml
 
< MD5 for: EXPLORER.ADMX  >
[2012/06/03 00:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16384_none_6e8451187a9a1607\Explorer.admx
[2012/06/03 00:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16420_none_6ec1315e7a6d062c\Explorer.admx
[2012/06/03 00:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.16433_none_6eb962507a726e22\Explorer.admx
[2012/06/03 00:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.20521_none_6f4bce739389bf4d\Explorer.admx
[2012/06/03 00:32:35 | 000,003,836 | —- | M] () MD5=AD131A834808E6AFF4A3918DE05BFCF6 – C:\Windows\WinSxS\amd64_microsoft-windows-shell-grouppolicy_31bf3856ad364e35_6.2.9200.20534_none_6f43ff65938f2743\Explorer.admx
 
< MD5 for: EXPLORER.EXE  >
[2013/11/11 22:00:43 | 000,220,310 | —- | M] () MD5=005CEA18D150397BEC7E46AE554EF4B8 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_aab35faf0358fcd1\explorer.exe
[2013/11/11 22:00:48 | 000,220,321 | —- | M] () MD5=06C47A52AEA4AD4457612864B3A7DD7A – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_ab3dfcc41c75b5f2\explorer.exe
[2013/11/11 22:00:53 | 000,217,360 | —- | M] () MD5=095CD9C4EDF2637760058D166F504F71 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20733_none_ab3d00461c7696e9\explorer.exe
[2013/06/01 21:34:21 | 002,391,280 | —- | M] (Microsoft Corporation) MD5=0E8E6463F81C80AFBED533E0F1F8895D – C:\Windows\explorer.exe
[2013/06/01 21:34:21 | 002,391,280 | —- | M] (Microsoft Corporation) MD5=0E8E6463F81C80AFBED533E0F1F8895D – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16628_none_aac334d9034c59e1\explorer.exe
[2014/01/11 19:16:28 | 000,191,929 | —- | M] () MD5=1F8E5C6161EFC21ACD62FE807E43306F – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20534_none_b592a71650d677ed\explorer.exe
[2014/01/11 19:16:07 | 000,193,351 | —- | M] () MD5=953962388F2CBC4CF73875D98A1662F5 – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_b4d2f8c937e166b1\explorer.exe
[2013/11/11 22:00:38 | 000,221,955 | —- | M] () MD5=ABF6D1D37A2C431C416CD0977EDFC561 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16384_none_aa7e4e770380a4b6\explorer.exe
[2014/01/11 19:16:18 | 000,191,911 | —- | M] () MD5=B4A4A39F682D501BCD3514D26049A1FF – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16433_none_b5080a0137b9becc\explorer.exe
[2014/01/11 19:16:37 | 000,190,101 | —- | M] () MD5=EAD55D5967EF92218CDB63D6BA312F4C – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.20733_none_b591aa9850d758e4\explorer.exe
[2013/06/01 20:24:46 | 002,106,176 | —- | M] (Microsoft Corporation) MD5=EAFE46B0292D2BD2467835E2ACF717CC – C:\Windows\SysWOW64\explorer.exe
[2013/06/01 20:24:46 | 002,106,176 | —- | M] (Microsoft Corporation) MD5=EAFE46B0292D2BD2467835E2ACF717CC – C:\Windows\WinSxS\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.2.9200.16628_none_b517df2b37ad1bdc\explorer.exe
 
< MD5 for: EXPLORER.EXE.MUI  >
[2012/07/26 17:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\en-US\explorer.exe.mui
[2012/07/26 17:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\SysWOW64\en-US\explorer.exe.mui
[2012/07/26 17:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\WinSxS\amd64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.2.9200.16384_en-us_5ebc2e81fd6600eb\explorer.exe.mui
[2012/07/26 17:50:36 | 000,020,480 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\WinSxS\wow64_microsoft-windows-explorer.resources_31bf3856ad364e35_6.2.9200.16384_en-us_6910d8d431c6c2e6\explorer.exe.mui
 
< MD5 for: EXPLORER.EXE-03C49D11.PF  >
[2014/08/31 07:56:49 | 000,213,494 | —- | M] () MD5=BB890DC5A88D262F9284BE9638E7722F – C:\Windows\Prefetch\EXPLORER.EXE-03C49D11.pf
 
< MD5 for: IEXPLORE.EXE  >
[2014/07/20 18:43:51 | 000,003,577 | —- | M] () MD5=00738FE81E4B473A7E27ACA78C74C250 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16921_none_37c1d874ec4e220d\iexplore.exe
[2014/07/20 18:43:43 | 000,006,931 | —- | M] () MD5=05014D61B6E9E45D50716A3558996314 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16384_none_38087560ec185f54\iexplore.exe
[2014/07/20 19:12:46 | 000,003,601 | —- | M] () MD5=055A91043DA619FB12CE665CE978027D – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16921_none_421682c720aee408\iexplore.exe
[2014/07/20 19:12:40 | 000,006,437 | —- | M] () MD5=06924088D664F13B7021755FEF3BA407 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16433_none_424d651d2085a4ec\iexplore.exe
[2014/07/20 18:43:46 | 000,006,957 | —- | M] () MD5=076943860EB0475D903236FF5E9FCE61 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16442_none_37f9d1dcec23e2a7\iexplore.exe
[2014/07/20 19:12:38 | 000,006,831 | —- | M] () MD5=195D9E39A471E26C5F5A517DD9C94467 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16384_none_425d1fb32079214f\iexplore.exe
[2014/07/20 19:12:41 | 000,006,445 | —- | M] () MD5=213DEC0F1A29882B9B085BF9F5E21719 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16442_none_424e7c2f2084a4a2\iexplore.exe
[2014/07/24 23:48:04 | 000,775,312 | —- | M] (Microsoft Corporation) MD5=2A2F3E1CE8550B215117081CAFA3C2CE – C:\Program Files\Internet Explorer\iexplore.exe
[2014/07/24 23:48:04 | 000,775,312 | —- | M] (Microsoft Corporation) MD5=2A2F3E1CE8550B215117081CAFA3C2CE – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.17054_none_3825e62cec02bca3\iexplore.exe
[2014/07/20 18:43:50 | 000,006,966 | —- | M] () MD5=34FCCDA348FFB6532D9EF09BB59F0048 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20544_none_21212dc505d3918f\iexplore.exe
[2014/07/24 23:30:50 | 000,775,312 | —- | M] (Microsoft Corporation) MD5=53FBCDD9440A4C3822DADDECB29F5B29 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.21173_none_214f870105b05156\iexplore.exe
[2014/07/20 18:43:45 | 000,006,981 | —- | M] () MD5=5A8166DBA0C638EA20AE1B60C910BBB7 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.16433_none_37f8bacaec24e2f1\iexplore.exe
[2012/10/31 17:41:12 | 000,034,744 | —- | M] () MD5=786CE12596C641AB3AEF0F3EDDB13C80 – C:\Program Files (x86)\Advanced System Protector\Troubleshooter\iexplore.exe
[2014/07/20 18:43:53 | 000,004,062 | —- | M] () MD5=7A8D3FAF56B8B25369DBE6F3636417D7 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.21145_none_214c589305b33893\iexplore.exe
[2014/07/24 21:06:04 | 000,770,704 | —- | M] (Microsoft Corporation) MD5=AB2A8186FBD0B6931AF36CB5699DC583 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.21173_none_2ba431533a111351\iexplore.exe
[2014/06/19 14:18:02 | 000,775,320 | —- | M] (Microsoft Corporation) MD5=B606732D1F1948DF9CE9E30517E17268 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.17028_none_38228a2eec05d722\iexplore.exe
[2014/07/24 21:06:12 | 000,770,704 | —- | M] (Microsoft Corporation) MD5=D50CB4EBA5FC732AB919AFC1F61F889B – C:\Program Files (x86)\Internet Explorer\iexplore.exe
[2014/07/24 21:06:12 | 000,770,704 | —- | M] (Microsoft Corporation) MD5=D50CB4EBA5FC732AB919AFC1F61F889B – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.17054_none_427a907f20637e9e\iexplore.exe
[2014/07/20 19:12:48 | 000,005,047 | —- | M] () MD5=D6C74574CC4991D446FC7C23E5ECF99E – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.21145_none_2ba102e53a13fa8e\iexplore.exe
[2014/07/20 19:12:43 | 000,006,428 | —- | M] () MD5=DB41A7CE1BBC34C2A6BF8298C23EE424 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20534_none_2b74d7cd3a353a33\iexplore.exe
[2014/07/20 18:43:49 | 000,006,974 | —- | M] () MD5=E20DCD4BF20F5C431938A4C01624A020 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20534_none_21202d7b05d47838\iexplore.exe
[2014/06/19 11:13:09 | 000,770,704 | —- | M] (Microsoft Corporation) MD5=F37633EA6056B7F7DE685FB7F6DFB1FC – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.17028_none_427734812066991d\iexplore.exe
[2014/06/18 17:51:14 | 000,005,049 | —- | M] () MD5=F563710F10D43581B2DCF82A1D906465 – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.21044_none_2babe9993a0bc4fc\iexplore.exe
[2014/06/18 17:34:37 | 000,003,494 | —- | M] () MD5=F70E86C7C3ABE5950114557AC731DE77 – C:\Windows\WinSxS\amd64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.21044_none_21573f4705ab0301\iexplore.exe
[2014/07/20 19:12:45 | 000,006,411 | —- | M] () MD5=F7661DE18CD946CED7DB7C3F02B265AA – C:\Windows\WinSxS\wow64_microsoft-windows-i..etexplorer-optional_31bf3856ad364e35_10.0.9200.20544_none_2b75d8173a34538a\iexplore.exe
 
< MD5 for: IEXPLORE.EXE.10040.DMP  >
[2014/08/23 15:43:12 | 004,861,005 | —- | M] () MD5=8D4C04D698712C92E86A288FA475D031 – C:\ProgramData\Norton\LocalDumps\iexplore.exe.10040.dmp
[2014/08/23 15:43:12 | 004,861,005 | —- | M] () MD5=8D4C04D698712C92E86A288FA475D031 – C:\Users\All Users\Norton\LocalDumps\iexplore.exe.10040.dmp
 
< MD5 for: IEXPLORE.EXE.10244.DMP  >
[2014/06/08 10:36:12 | 004,839,295 | —- | M] () MD5=9C4B08510F216C16407ED6F82D64D8BC – C:\Users\Megan\AppData\Local\CrashDumps\iexplore.exe.10244.dmp
 
< MD5 for: IEXPLORE.EXE.11036.DMP  >
[2014/06/08 10:27:07 | 003,910,588 | —- | M] () MD5=E18E71201CB11343333E4E75FE309EB9 – C:\Users\Megan\AppData\Local\CrashDumps\iexplore.exe.11036.dmp
 
< MD5 for: IEXPLORE.EXE.11168.DMP  >
[2014/06/08 10:19:23 | 004,011,264 | —- | M] () MD5=709A380757685120E51E25AB0172565C – C:\Users\Megan\AppData\Local\CrashDumps\iexplore.exe.11168.dmp
 
< MD5 for: IEXPLORE.EXE.1456.DMP  >
[2014/06/08 10:36:16 | 004,866,894 | —- | M] () MD5=FF8B78F7174DD71A18ED064D08FE068B – C:\Users\Megan\AppData\Local\CrashDumps\iexplore.exe.1456.dmp
 
< MD5 for: IEXPLORE.EXE.14676.DMP  >
[2014/08/31 07:39:58 | 005,247,093 | —- | M] () MD5=A9214E42FE8EEFBA370422BED94A97FE – C:\ProgramData\Norton\LocalDumps\iexplore.exe.14676.dmp
[2014/08/31 07:39:58 | 005,247,093 | —- | M] () MD5=A9214E42FE8EEFBA370422BED94A97FE – C:\Users\All Users\Norton\LocalDumps\iexplore.exe.14676.dmp
[2014/08/31 07:39:58 | 005,247,093 | —- | M] () Unable to obtain MD5 – C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\ErrMgmt\Queue\Incoming\SQ_{5B00C36D-C22B-46BA-843E-B776E0283738}\iexplore.exe.14676.dmp
[2014/08/31 07:39:58 | 005,247,093 | —- | M] () Unable to obtain MD5 – C:\Users\All Users\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\ErrMgmt\Queue\Incoming\SQ_{5B00C36D-C22B-46BA-843E-B776E0283738}\iexplore.exe.14676.dmp
 
< MD5 for: IEXPLORE.EXE.2284.DMP  >
[2014/06/08 10:36:15 | 004,928,539 | —- | M] () MD5=0A9EC6BFA3D880DE12CE5F0977765B9A – C:\Users\Megan\AppData\Local\CrashDumps\iexplore.exe.2284.dmp
 
< MD5 for: IEXPLORE.EXE.5116.DMP  >
[2014/06/08 10:32:09 | 004,692,249 | —- | M] () MD5=E430ED55870F60A037D1B40B2C5D48EE – C:\Users\Megan\AppData\Local\CrashDumps\iexplore.exe.5116.dmp
 
< MD5 for: IEXPLORE.EXE.6668.DMP  >
[2014/06/08 10:28:27 | 005,222,281 | —- | M] () MD5=F07956F4B3703159A8853CDEE7C8E0C7 – C:\Users\Megan\AppData\Local\CrashDumps\iexplore.exe.6668.dmp
 
< MD5 for: IEXPLORE.EXE.6764.DMP  >
[2014/06/08 10:14:34 | 006,307,539 | —- | M] () MD5=CC47CB3C8F0854C6DF756FB0A621FA4D – C:\Users\Megan\AppData\Local\CrashDumps\iexplore.exe.6764.dmp
 
< MD5 for: IEXPLORE.EXE.7128.DMP  >
[2014/08/24 11:04:28 | 007,541,302 | —- | M] () MD5=12FD9107712D6845586321DEB93481B3 – C:\ProgramData\Norton\LocalDumps\iexplore.exe.7128.dmp
[2014/08/24 11:04:28 | 007,541,302 | —- | M] () MD5=12FD9107712D6845586321DEB93481B3 – C:\Users\All Users\Norton\LocalDumps\iexplore.exe.7128.dmp
 
< MD5 for: IEXPLORE.EXE.9432.DMP  >
[2014/08/23 15:46:48 | 009,397,720 | —- | M] () MD5=64A787EEDB217C9D967F6C08AF66F0D1 – C:\ProgramData\Norton\LocalDumps\iexplore.exe.9432.dmp
[2014/08/23 15:46:48 | 009,397,720 | —- | M] () MD5=64A787EEDB217C9D967F6C08AF66F0D1 – C:\Users\All Users\Norton\LocalDumps\iexplore.exe.9432.dmp
 
< MD5 for: IEXPLORE.EXE.MUI  >
[2012/07/26 17:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Program Files (x86)\Internet Explorer\en-US\iexplore.exe.mui
[2012/07/26 17:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2012/07/26 17:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\WinSxS\amd64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.0.9200.16384_en-us_31b50ad823c5a03b\iexplore.exe.mui
[2012/07/26 17:50:45 | 000,005,632 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\WinSxS\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_10.0.9200.16384_en-us_3c09b52a58266236\iexplore.exe.mui
 
< MD5 for: IEXPLORE.EXE-6C28DB75.PF  >
[2014/08/08 08:05:56 | 000,170,042 | —- | M] () MD5=27BD83059425E5BF9BE80DC8E2CDA2B9 – C:\Windows\Prefetch\IEXPLORE.EXE-6C28DB75.pf
 
< MD5 for: IEXPLORE.EXE-6C28DB76.PF  >
[2014/08/08 08:05:57 | 000,358,084 | —- | M] () MD5=3DD6F6242096A3AFED691EC1EEFDFCFD – C:\Windows\Prefetch\IEXPLORE.EXE-6C28DB76.pf
 
< MD5 for: IEXPLORE.EXE-7A9337F2.PF  >
[2014/08/31 07:58:24 | 000,113,188 | —- | M] () MD5=79525DEFF43A0F1A9A62AD8B31A0DA84 – C:\Windows\Prefetch\IEXPLORE.EXE-7A9337F2.pf
 
< MD5 for: IEXPLORE.EXE-F4FB5D2F.PF  >
[2014/08/31 08:04:10 | 000,410,018 | —- | M] () MD5=0C344606FF306265E7A9965A4FAD4966 – C:\Windows\Prefetch\IEXPLORE.EXE-F4FB5D2F.pf
 
< MD5 for: IEXPLORE.LNK  >
[2014/03/13 21:33:55 | 000,001,139 | —- | M] () MD5=33C916FA133FC9B31E27653DE40281FB – C:\Program Files (x86)\Advanced System Protector\Troubleshooter\iexplore.lnk
 
< MD5 for: SERVICES  >
[2012/07/26 15:26:47 | 000,017,463 | —- | M] () MD5=D9E1A01B480D961B7CF0509D597A92D6 – C:\Windows\WinSxS\amd64_microsoft-windows-w..ucture-other-minwin_31bf3856ad364e35_6.2.9200.16384_none_8e0944daeed62829\services
 
< MD5 for: SERVICES.EXE  >
[2013/12/05 20:36:03 | 000,001,252 | —- | M] () MD5=0674510A86CAC7B196034AE93ADEAD5C – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.20521_none_98a9ea2e9f571eb2\services.exe
[2013/12/05 20:36:02 | 000,038,189 | —- | M] () MD5=3E109452C6B396A268E8243819DF4D7C – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16384_none_97e26cd38667756c\services.exe
[2013/07/03 03:26:06 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE – C:\Windows\SysNative\services.exe
[2013/07/03 03:26:06 | 000,410,624 | —- | M] (Microsoft Corporation) MD5=8F226143046435C75C033B0C52E90FFE – C:\Windows\WinSxS\amd64_microsoft-windows-s..cecontroller-minwin_31bf3856ad364e35_6.2.9200.16420_none_981f4d19863a6591\services.exe
 
< MD5 for: SERVICES.EXE.MUI  >
[2012/07/26 17:50:12 | 000,018,944 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\SysNative\en-US\services.exe.mui
[2012/07/26 17:50:12 | 000,018,944 | —- | M] (Microsoft Corporation) Unable to obtain MD5 – C:\Windows\WinSxS\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.2.9200.16384_en-us_c2c6ee7bafb963b8\services.exe.mui
 
< MD5 for: SERVICES.HEARSTMAGS[1].XML  >
[2014/04/19 23:54:10 | 000,000,213 | —- | M] () MD5=BC2E997D36295C3B1221043009B71CA5 – C:\Users\Megan\AppData\LocalLow\Microsoft\Internet Explorer\DOMStore\Z8DUQDSA\services.hearstmags[1].xml
 
< MD5 for: SERVICES.JS  >
[2013/10/09 18:44:18 | 000,052,388 | —- | M] () MD5=170AC4B9F3DC60E0D38D7CC307CEFD12 – C:\Program Files\WindowsApps\Microsoft.BingFinance_2.0.0.308_x64__8wekyb3d8bbwe\common\js\services.js
[2013/10/09 18:42:10 | 000,052,388 | —- | M] () MD5=170AC4B9F3DC60E0D38D7CC307CEFD12 – C:\Program Files\WindowsApps\Microsoft.BingNews_2.0.0.308_x64__8wekyb3d8bbwe\common\js\services.js
[2013/10/09 18:45:03 | 000,052,388 | —- | M] () MD5=170AC4B9F3DC60E0D38D7CC307CEFD12 – C:\Program Files\WindowsApps\Microsoft.BingSports_2.0.0.310_x64__8wekyb3d8bbwe\common\js\services.js
[2013/10/09 18:41:21 | 000,052,388 | —- | M] () MD5=170AC4B9F3DC60E0D38D7CC307CEFD12 – C:\Program Files\WindowsApps\Microsoft.BingTravel_2.0.0.319_x64__8wekyb3d8bbwe\common\js\services.js
[2013/10/09 18:45:17 | 000,052,388 | —- | M] () MD5=170AC4B9F3DC60E0D38D7CC307CEFD12 – C:\Program Files\WindowsApps\Microsoft.BingWeather_2.0.0.310_x64__8wekyb3d8bbwe\common\js\services.js
[2012/07/26 17:53:58 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingFinance_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 17:53:49 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingNews_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 17:53:45 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingSports_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 17:54:27 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingTravel_1.2.0.145_x64__8wekyb3d8bbwe\platform\js\services.js
[2012/07/26 17:53:53 | 000,056,775 | —- | M] () MD5=33C1E65B760A9589F6DE37F64941E449 – C:\Program Files\WindowsApps\Microsoft.BingWeather_1.2.0.135_x64__8wekyb3d8bbwe\platform\js\services.js
 
< MD5 for: SERVICES.LNK  >
[2012/07/26 06:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2012/07/26 06:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\services.lnk
[2012/07/26 06:19:37 | 000,001,158 | —- | M] () MD5=5C11B0E362D426FD6E99B07705BA4A48 – C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_282d8a08cf7f1ada\services.lnk
 
< MD5 for: SERVICES.MOF  >
[2012/06/03 00:35:05 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\SysNative\wbem\services.mof
[2012/06/03 00:35:05 | 000,002,866 | —- | M] () MD5=26A11C895A7F0B6D32105EBE127D8500 – C:\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.2.9200.16384_none_282967cc570d3701\services.mof
 
< MD5 for: SERVICES.MSC  >
[2012/07/26 17:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysNative\en-US\services.msc
[2012/06/03 00:31:20 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysNative\services.msc
[2012/07/26 17:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysWOW64\en-US\services.msc
[2012/06/03 00:31:13 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\SysWOW64\services.msc
[2012/07/26 17:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\amd64_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.2.9200.16384_en-us_fd08be678622fdab\services.msc
[2012/06/03 00:31:20 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\amd64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_282d8a08cf7f1ada\services.msc
[2012/06/03 00:31:13 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\wow64_microsoft-windows-servicessnapin_31bf3856ad364e35_6.2.9200.16384_none_3282345b03dfdcd5\services.msc
[2012/07/26 17:50:36 | 000,092,746 | —- | M] () MD5=2D8D95469EC26AAA986AAD1CE424E631 – C:\Windows\WinSxS\x86_microsoft-windows-s..cessnapin.resources_31bf3856ad364e35_6.2.9200.16384_en-us_a0ea22e3cdc58c75\services.msc
 
< MD5 for: SERVICES.PTXML  >
[2012/07/26 06:30:54 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\SysNative\wdi\perftrack\Services.ptxml
[2012/07/26 06:30:54 | 000,001,061 | —- | M] () MD5=640D7DD61B1CFA6C96F80F68F78CDFA7 – C:\Windows\WinSxS\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.2.9200.16384_none_282967cc570d3701\Services.ptxml
 
< MD5 for: WINLOGON.ADML  >
[2012/07/26 17:50:44 | 000,008,017 | —- | M] () MD5=C270056255498A723E7331EFF1AA162F – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_6.2.9200.16384_en-us_edcdb8ec66a62fc0\WinLogon.adml
 
< MD5 for: WINLOGON.ADMX  >
[2012/06/03 00:34:22 | 000,005,237 | —- | M] () MD5=89D8F50E186A16C2CED3CF36DBBC0B2C – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-adm_31bf3856ad364e35_6.2.9200.16384_none_d3d704270306719d\WinLogon.admx
 
< MD5 for: WINLOGON.EXE  >
[2013/12/30 10:42:59 | 000,053,889 | —- | M] () MD5=234E847D7CEFB6F249F6D7514A4143A7 – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16384_none_c88ca87b5eb5b1ec\winlogon.exe
[2014/04/12 19:10:31 | 000,578,048 | —- | M] (Microsoft Corporation) MD5=75DD70A14145499C9F7D903CF9A8C91B – C:\Windows\SysNative\winlogon.exe
[2014/04/12 19:10:31 | 000,578,048 | —- | M] (Microsoft Corporation) MD5=75DD70A14145499C9F7D903CF9A8C91B – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16891_none_c87ee12f5ec0739b\winlogon.exe
[2014/04/12 19:10:31 | 000,578,048 | —- | M] (Microsoft Corporation) MD5=75DD70A14145499C9F7D903CF9A8C91B – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.17014_none_c8d83b755e7d1081\winlogon.exe
[2014/05/25 09:18:24 | 000,082,423 | —- | M] () MD5=8B0B613B33B8314E353B8503EE2CA68D – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16433_none_c8c1b9b35e8e0a07\winlogon.exe
[2013/12/30 10:43:00 | 000,053,876 | —- | M] () MD5=9155E44DC7ECBC9E7A9DF6C2349B5116 – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.16420_none_c8c988c15e88a211\winlogon.exe
[2013/12/30 10:43:01 | 000,001,620 | —- | M] () MD5=B27D37AB215A383498FFC169411E291F – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20534_none_c94c56c877aac328\winlogon.exe
[2014/05/25 09:18:25 | 000,072,808 | —- | M] () MD5=B74C7D0F8C2D6BAC4B3B9829C196E584 – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.21012_none_c95fd5c6779c8076\winlogon.exe
[2013/12/30 10:43:00 | 000,053,884 | —- | M] () MD5=E358F667DE619B2B077EEEF667F842E6 – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.20521_none_c95425d677a55b32\winlogon.exe
[2014/07/20 19:08:20 | 000,072,808 | —- | M] () MD5=E86DCE3CC81BC9B070ECCB2AC8E67176 – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.2.9200.21133_none_c94b381e77abced6\winlogon.exe
 
< MD5 for: WINLOGON.EXE.MUI  >
[2012/07/26 17:50:31 | 000,024,064 | —- | M] (Microsoft Corporation) MD5=B9094B7088CD579E5AED57A693F9BFBD – C:\Windows\SysNative\en-US\winlogon.exe.mui
[2012/07/26 17:50:31 | 000,024,064 | —- | M] (Microsoft Corporation) MD5=B9094B7088CD579E5AED57A693F9BFBD – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_6.2.9200.16384_en-us_23c238ef8ddaa831\winlogon.exe.mui
 
< MD5 for: WINLOGON.MFL  >
[2012/07/26 17:50:31 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\SysNative\wbem\en-US\winlogon.mfl
[2012/07/26 17:50:31 | 000,001,080 | —- | M] () MD5=2783ED50691284F7EAE6BE9729337E1A – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof.resources_31bf3856ad364e35_6.2.9200.16384_en-us_81848abaa91301c6\winlogon.mfl
 
< MD5 for: WINLOGON.MOF  >
[2012/07/26 06:30:16 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\SysNative\wbem\winlogon.mof
[2012/07/26 06:30:16 | 000,003,192 | —- | M] () MD5=DF722B96F32A61783BC310FACF10240B – C:\Windows\WinSxS\amd64_microsoft-windows-winlogon-mof_31bf3856ad364e35_6.2.9200.16384_none_d9027134ffac135f\winlogon.mof
 
< %SYSTEMDRIVE%\*.* >
[2014/08/31 00:14:18 | 000,000,000 | —- | M] () – C:\autoexec.bat
[2012/07/26 13:44:30 | 000,398,156 | RHS- | M] () – C:\bootmgr
[2012/06/03 00:30:55 | 000,000,001 | -HS- | M] () – C:\BOOTNXT
[2012/08/04 09:21:37 | 000,008,192 | RHS- | M] () – C:\BOOTSECT.BAK
[2014/06/06 08:27:02 | 000,000,000 | —- | M] () – C:\END
[2014/08/31 07:54:21 | 1884,291,071 | -HS- | M] () – C:\hiberfil.sys
[2013/12/25 12:02:39 | 000,001,944 | —- | M] () – C:\logFileUI.txt
[2014/08/31 07:54:45 | 1207,959,552 | -HS- | M] () – C:\pagefile.sys
[2014/08/31 07:54:46 | 268,435,456 | -HS- | M] () – C:\swapfile.sys
 
< %systemroot%\Fonts\*.com >
[2012/08/04 08:37:24 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2012/08/04 08:37:24 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2012/08/04 08:37:24 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2012/08/04 08:37:24 | 000,043,318 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont
 
< %systemroot%\Fonts\*.dll >
 
< %systemroot%\Fonts\*.ini >
[2012/07/26 18:11:41 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini
 
< %systemroot%\Fonts\*.ini2 >
 
< %systemroot%\Fonts\*.exe >
 
< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
 
< %systemroot%\REPAIR\*.bak1 >
 
< %systemroot%\REPAIR\*.ini >
 
< %systemroot%\system32\*.jpg >
 
< %systemroot%\*.jpg >
 
< %systemroot%\*.png >
 
< %systemroot%\*.scr >
[2012/09/13 08:57:44 | 000,322,048 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
< %systemroot%\*._sy >
 
< %APPDATA%\Adobe\Update\*.* >
 
< %ALLUSERSPROFILE%\Favorites\*.* >
 
< %APPDATA%\Microsoft\*.* >
 
< %PROGRAMFILES%\*.* >
[2012/07/26 18:11:35 | 000,000,174 | -HS- | M] () – C:\Program Files (x86)\desktop.ini
 
< %APPDATA%\Update\*.* >
 
< %systemroot%\*. /mp /s >
 
< dir "%systemdrive%\*" /S /A:L /C >
 Volume in drive C is Windows
 Volume Serial Number is B084-B251
 Directory of C:\
26/07/2012  05:22 PM         Documents and Settings [C:\Users]
               0 File(s)              0 bytes
 Directory of C:\ProgramData
26/07/2012  05:22 PM         Application Data [C:\ProgramData]
26/07/2012  05:22 PM         Desktop [C:\Users\Public\Desktop]
26/07/2012  05:22 PM         Documents [C:\Users\Public\Documents]
26/07/2012  05:22 PM         Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
26/07/2012  05:22 PM         Templates [C:\ProgramData\Microsoft\Windows\Templates]
               0 File(s)              0 bytes
 Directory of C:\Users
26/07/2012  05:22 PM         All Users [C:\ProgramData]
26/07/2012  05:22 PM         Default User [C:\Users\Default]
               0 File(s)              0 bytes
 Directory of C:\Users\All Users
26/07/2012  05:22 PM         Application Data [C:\ProgramData]
26/07/2012  05:22 PM         Desktop [C:\Users\Public\Desktop]
26/07/2012  05:22 PM         Documents [C:\Users\Public\Documents]
26/07/2012  05:22 PM         Start Menu [C:\ProgramData\Microsoft\Windows\Start Menu]
26/07/2012  05:22 PM         Templates [C:\ProgramData\Microsoft\Windows\Templates]
               0 File(s)              0 bytes
 Directory of C:\Users\Default
26/07/2012  05:22 PM         Application Data [C:\Users\Default\AppData\Roaming]
26/07/2012  05:22 PM         Cookies [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Cookies]
26/07/2012  05:22 PM         Local Settings [C:\Users\Default\AppData\Local]
26/07/2012  05:22 PM         My Documents [C:\Users\Default\Documents]
26/07/2012  05:22 PM         NetHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
26/07/2012  05:22 PM         PrintHood [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
26/07/2012  05:22 PM         Recent [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Recent]
26/07/2012  05:22 PM         SendTo [C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo]
26/07/2012  05:22 PM         Start Menu [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu]
26/07/2012  05:22 PM         Templates [C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates]
               0 File(s)              0 bytes
 Directory of C:\Users\Default\AppData\Local
26/07/2012  05:22 PM         Application Data [C:\Users\Default\AppData\Local]
26/07/2012  05:22 PM         History [C:\Users\Default\AppData\Local\Microsoft\Windows\History]
26/07/2012  05:22 PM         Temporary Internet Files [C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files]
               0 File(s)              0 bytes
 Directory of C:\Users\Default\Documents
26/07/2012  05:22 PM         My Music [C:\Users\Default\Music]
26/07/2012  05:22 PM         My Pictures [C:\Users\Default\Pictures]
26/07/2012  05:22 PM         My Videos [C:\Users\Default\Videos]
               0 File(s)              0 bytes
 Directory of C:\Users\Megan
08/10/2013  03:13 PM         Application Data [C:\Users\Megan\AppData\Roaming]
08/10/2013  03:13 PM         Cookies [C:\Users\Megan\AppData\Roaming\Microsoft\Windows\Cookies]
08/10/2013  03:13 PM         Local Settings [C:\Users\Megan\AppData\Local]
08/10/2013  03:13 PM         My Documents [C:\Users\Megan\Documents]
08/10/2013  03:13 PM         NetHood [C:\Users\Megan\AppData\Roaming\Microsoft\Windows\Network Shortcuts]
08/10/2013  03:13 PM         PrintHood [C:\Users\Megan\AppData\Roaming\Microsoft\Windows\Printer Shortcuts]
08/10/2013  03:13 PM         Recent [C:\Users\Megan\AppData\Roaming\Microsoft\Windows\Recent]
08/10/2013  03:13 PM         SendTo [C:\Users\Megan\AppData\Roaming\Microsoft\Windows\SendTo]
08/10/2013  03:13 PM         Start Menu [C:\Users\Megan\AppData\Roaming\Microsoft\Windows\Start Menu]
08/10/2013  03:13 PM         Templates [C:\Users\Megan\AppData\Roaming\Microsoft\Windows\Templates]
               0 File(s)              0 bytes
 Directory of C:\Users\Megan\AppData\Local
08/10/2013  03:13 PM         Application Data [C:\Users\Megan\AppData\Local]
08/10/2013  03:13 PM         History [C:\Users\Megan\AppData\Local\Microsoft\Windows\History]
08/10/2013  03:13 PM         Temporary Internet Files [C:\Users\Megan\AppData\Local\Microsoft\Windows\Temporary Internet Files]
               0 File(s)              0 bytes
 Directory of C:\Users\Megan\Documents
08/10/2013  03:13 PM         My Music [C:\Users\Megan\Music]
08/10/2013  03:13 PM         My Pictures [C:\Users\Megan\Pictures]
08/10/2013  03:13 PM         My Videos [C:\Users\Megan\Videos]
               0 File(s)              0 bytes
 Directory of C:\Users\Public\Documents
26/07/2012  05:22 PM         My Music [C:\Users\Public\Music]
26/07/2012  05:22 PM         My Pictures [C:\Users\Public\Pictures]
26/07/2012  05:22 PM         My Videos [C:\Users\Public\Videos]
               0 File(s)              0 bytes
     Total Files Listed:
               0 File(s)              0 bytes
              48 Dir(s)  591,129,739,264 bytes free
 
< %systemroot%\System32\config\*.sav >
 
< %PROGRAMFILES%\bak. /s >
 
< %systemroot%\system32\bak. /s >
 
< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
 
< %systemroot%\system32\config\systemprofile\*.dat /x >
 
< %systemroot%\*.config >
 
< %systemroot%\system32\*.db >
 
< %PROGRAMFILES%\Internet Explorer\*.dat >
 
< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2013/10/08 15:21:35 | 000,000,223 | -HS- | M] () – C:\Users\Megan\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini
 
< %USERPROFILE%\Desktop\*.exe >
[2014/08/31 08:04:08 | 000,602,112 | —- | M] (OldTimer Tools) – C:\Users\Megan\Desktop\OTL.exe
 
< %PROGRAMFILES%\Common Files\*.* >
 
< %systemroot%\*.src >
 
< %systemroot%\install\*.* >
 
< %systemroot%\system32\DLL\*.* >
 
< %systemroot%\system32\HelpFiles\*.* >
 
< %systemroot%\system32\rundll\*.* >
 
< %systemroot%\winn32\*.* >
 
< %systemroot%\Java\*.* >
 
< %systemroot%\system32\test\*.* >
 
< %systemroot%\system32\Rundll32\*.* >
 
< %systemroot%\AppPatch\Custom\*.* >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >
 
< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 118 bytes -> C:\ProgramData\Temp:373E1720

< End of report >

# AdwCleaner v3.308 - Report created 31/08/2014 at 16:09:18
# Updated 20/08/2014 by Xplode
# Operating System : Windows 8  (64 bits)
# Username : Megan - PENNINGHPC
# Running from : C:\Users\Megan\Desktop\AdwCleaner (1).exe
# Option : Clean

***** [ Services ] *****

***** [ Files / Folders ] *****

***** [ Scheduled Tasks ] *****

***** [ Shortcuts ] *****

***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\PriceMeterLiveUpdate

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.17054

-\\ Mozilla Firefox v

[ File : C:\Users\Megan\AppData\Roaming\Mozilla\Firefox\Profiles\extensions\prefs.js ]

-\\ Google Chrome v

*************************

AdwCleaner[R0].txt - [21598 octets] - [31/08/2014 15:29:47]
AdwCleaner[R1].txt - [962 octets] - [31/08/2014 16:08:00]
AdwCleaner[S0].txt - [18596 octets] - [31/08/2014 15:30:57]
AdwCleaner[S1].txt - [886 octets] - [31/08/2014 16:09:18]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [945 octets] ##########

Malwarebytes Anti-Malware
www.malwarebytes.org

Scan Date: 31/08/2014
Scan Time: 4:16:11 PM
Logfile:
Administrator: Yes

Version: 2.00.2.1012
Malware Database: v2014.08.31.01
Rootkit Database: v2014.08.21.01
License: Trial
Malware Protection: Enabled
Malicious Website Protection: Enabled
Self-protection: Disabled

OS: Windows 8
CPU: x64
File System: NTFS
User: Megan

Scan Type: Threat Scan
Result: Completed
Objects Scanned: 293849
Time Elapsed: 13 min, 6 sec

Memory: Enabled
Startup: Enabled
Filesystem: Enabled
Archives: Enabled
Rootkits: Disabled
Heuristics: Enabled
PUP: Enabled
PUM: Enabled

Processes: 0
(No malicious items detected)

Modules: 0
(No malicious items detected)

Registry Keys: 6
PUP.Optional.NewHub.A, HKLM\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\aoejbmmillcdifgagjpdlaamnalbielp, , [d14ce7e64239132337694311ee16c937],
PUP.Optional.NewHub.A, HKLM\SOFTWARE\WOW6432NODE\GOOGLE\CHROME\EXTENSIONS\aoejbmmillcdifgagjpdlaamnalbielp, , [e13c0fbe7b00b0868a1601531ce80cf4],
PUP.Optional.CouponDownloader.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Coupon Downloader, , [1607bb12e398af8758cd1fe8fb08659b],
PUP.Optional.CouponDownloader.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\CouponDownloader, , [f32a5c71b7c41125091dfb0c699a45bb],
PUP.Optional.MediaPlayerPlus.A, HKU\S-1-5-18-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\APPDATALOW\SOFTWARE\Media_Play_AIR+_1.1, , [56c70cc1fa8148ee35f7e31d2bd81de3],
PUP.Optional.NewHub.A, HKU\S-1-5-21-1601758659-1066206950-3557107692-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\GOOGLE\CHROME\EXTENSIONS\aoejbmmillcdifgagjpdlaamnalbielp, , [a5788d4034477fb77a272133867e8d73],

Registry Values: 2
PUP.Optional.SearchCertified.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\SEARCHURI, http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&q=%s, , [65b8c00d1a61e0568651b745877b4bb5]
PUP.Optional.FirstSeenToday.A, HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN|fst_au_68, , [be5ffbd2b5c694a2a5632cde16ed8080],

Registry Data: 2
PUP.Optional.SimplyTech.A, HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\ABOUTURLS|newtab, %appdata%\SimplyTech\home\home.htm, Good: (www.google.com), Bad: (%appdata%\SimplyTech\home\home.htm),,[e23b12bb1f5c9a9c8a03efec08fc936d]
PUP.Optional.SearchCertifiedTB.A, HKU\S-1-5-21-1601758659-1066206950-3557107692-1002-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SEARCHURI, http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&q=%s, Good: (www.google.com), Bad: (http://search.certified-toolbar.com?si=80415&st=bs&tid=23890&ver=6.3&ts=1401976800000.000009&tguid=80415-23890-1402007339611-DD95A5509E2B1856F3BB27BAE6FB4D0C&q=%s),,[a5789a337dfec571df264c9bc440c739]

Folders: 20
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\Main, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\Main\bin, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\Main\Logs, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\Main\rep, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\SearchProtect, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\SearchProtect\bin, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\SearchProtect\Logs, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\SearchProtect\rep, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\bin, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\bubble, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\libs, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protection, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protectionDS, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\settings, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\uninstall, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\rep, , [1d00ca03f784bc7a07bdd6f3679b10f0],

Files: 69
PUP.Optional.InstallCore.A, C:\$Recycle.Bin\S-1-5-21-1601758659-1066206950-3557107692-1002\$RLVVJON.exe, , [bb62d3fa9ddea294338a48675fa52dd3],
PUP.Optional.CouponDownloader.A, C:\temp\t_ie.exe, , [e439309db4c73afc224fd3700af618e8],
PUP.Optional.Conduit.A, C:\Users\Megan\Downloads\WhiteSmoke_brie_cid6667.exe, , [938a6469e794a492e3e57fd830d1629e],
PUP.Optional.AirAdInstaller, C:\Users\Megan\Downloads\Spotify Setup.exe, , [77a654794338072f72c952e821df0ff1],
PUP.Optional.NewHub.A, C:\Users\Megan\AppData\Local\nwhb-v9.4.15.crx, , [a07d5b727b007cba7a250054cd3705fb],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\EULA.txt, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\Main\bin\SPtool.dll_1389856822494, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\Main\bin\uninstall.exe, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\Main\rep\SystemRepository.dat, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\settings.html, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\style.css, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\bubble\bubble.css, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\bubble\bubble.html, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\bubble\bubble.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\bubble\defaults.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\Apply-default.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\Apply-onclick.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\Apply-Rollover.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\bg-with-logo.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\bg.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\bgNotif.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\bgSettings.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\bgUninstall.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\btnBlue.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\btnClose.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\btnSilver.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\checkbox.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\checkbox_checked.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\checkbox_def.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\close-win-def.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\close-win-over-click.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\gray-bg.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\hez-def.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\hez-selected.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\hez.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\icon-win.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\info-icon.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\menu-rollover.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\menu-selected.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\radio-button-def.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\radio-button-selected.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\radio-button.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\radio-button2.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\Settings-icon.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\text-field.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\v.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\Images\x.png, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\libs\defaults.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\libs\dialogUtils.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\libs\jquery.1.7.1.min.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\libs\json2.min.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\libs\main.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\libs\SPDialogAPI.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protection\defaults.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protection\protection.css, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protection\protection.html, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protection\protection.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protectionDS\defaults.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protectionDS\protectionDS.css, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protectionDS\protectionDS.html, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\protectionDS\protectionDS.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\settings\defaults.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\settings\settings.css, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\settings\settings.html, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\settings\settings.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\uninstall\defaults.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\uninstall\uninstall.css, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\uninstall\uninstall.html, , [1d00ca03f784bc7a07bdd6f3679b10f0],
PUP.Optional.SearchProtect.A, C:\Program Files (x86)\SearchProtect1595781\UI\dialogs\uninstall\uninstall.js, , [1d00ca03f784bc7a07bdd6f3679b10f0],

Physical Sectors: 0
(No malicious items detected)

(end)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 8 x64
Ran by [removed] on 31/08/2014 at 16:31:33.09
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\theseaapp

~~~ Files

~~~ Folders

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31/08/2014 at 16:46:06.08
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 03-09-2014 01
Ran by [removed] (administrator) on PENNINGHPC on 03-09-2014 21:25:44
Running from C:\Users\[removed]\Desktop
Platform: Windows 8 (X64) OS Language: English (United States)
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(Hewlett-Packard Company) C:\Windows\System32\hpservice.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RTKAUDIOSERVICE64.EXE
(Advanced Micro Devices, Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe
(Microsoft Corporation) C:\Windows\System32\dasHost.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\n360.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSA_Service.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
(Symantec Corporation) C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\n360.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_17.0.1119.516_x64__8wekyb3d8bbwe\LiveComm.exe
(CyberLink) C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe
(Spotify Ltd) C:\Users\Megan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
(IVT Corporation) C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe
(Hewlett-Packard Development Company, L.P.) C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerSt.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil_ActiveX.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Microsoft Corporation) C:\Windows\System32\WWAHost.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM-x32\…\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642656 2013-04-17] (Advanced Micro Devices, Inc.)
HKLM-x32\…\Run: [BtTray] => C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BtTray.exe [379904 2013-01-11] (IVT Corporation)
HKLM-x32\…\Run: [HPMessageService] => C:\Program Files (x86)\Hewlett-Packard\HP System Event\HPMSGSVC.exe [1045304 2013-10-08] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\…\Run: [AccelerometerSysTrayApplet] => C:\Program Files (x86)\Hewlett-Packard\HP 3D DriveGuard\AccelerometerST.exe [77088 2013-07-24] (Hewlett-Packard Company)
HKLM-x32\…\Run: [fst_au_68] => [X]
HKLM\…\RunOnce: [NCPluginUpdater] => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\NCPluginUpdater.exe [21720 2014-08-19] (Hewlett-Packard)
HKU\.DEFAULT\…\RunOnce: [SpUninstallDeleteDir] => rmdir /s /q "\SearchProtect"
HKU\S-1-5-21-1601758659-1066206950-3557107692-1002\…\Run: [Itibiti.exe] => C:\Program Files (x86)\Itibiti Soft Phone\Itibiti.exe
HKU\S-1-5-21-1601758659-1066206950-3557107692-1002\…\Run: [OutfoxTV] => C:\Program Files\OutfoxTV\OutfoxTV\DesktopContainer.exe
HKU\S-1-5-21-1601758659-1066206950-3557107692-1002\…\Run: [uTorrent] => C:\Users\Megan\AppData\Roaming\uTorrent\uTorrent.exe [1322832 2014-07-19] (BitTorrent Inc.)
HKU\S-1-5-21-1601758659-1066206950-3557107692-1002\…\Run: [Spotify] => C:\Users\Megan\AppData\Roaming\Spotify\Spotify.exe [6621752 2014-08-31] (Spotify Ltd)
HKU\S-1-5-21-1601758659-1066206950-3557107692-1002\…\Run: [Spotify Web Helper] => C:\Users\Megan\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe [1245752 2014-08-31] (Spotify Ltd)
HKU\S-1-5-21-1601758659-1066206950-3557107692-1002\…\MountPoints2: {04d8610d-2fdd-11e3-be77-70188be301f8} - "F:\HTC_Sync_Manager_PC.exe"
HKU\S-1-5-21-1601758659-1066206950-3557107692-1002\…\MountPoints2: {2168b7e6-0893-11e3-be72-806e6f6e6963} - "E:\setup.EXE" /AUTORUN
ShellIconOverlayIdentifiers: OverlayExcluded -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayPending -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
ShellIconOverlayIdentifiers: OverlayProtected -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\buShell.dll (Symantec Corporation)
GroupPolicy: Group Policy on Chrome detected <======= ATTENTION

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com.au
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=en&pid;=N360&pvid;=20.5.0.28
SearchScopes: HKLM - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKLM-x32 - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
SearchScopes: HKCU - URL http://www.trovigo.com/Results.aspx?gd=&ctid;=CT3314958&octid;=EB_ORIGINAL_CTID&SearchSource;=58&CUI;=&UM;=4&UP;=SPDA75F7BE-82E3-4EDC-BF4F-CDEED031B643&q;={searchTerms}&SSPV;=
SearchScopes: HKCU - SuggestionsURL_JSON http://suggest.search.conduit.com/CSuggestJson.ashx?prefix={searchTerms}
SearchScopes: HKCU - {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = http://rover.ebay.com/rover/1/705-29546-12064-14/4 ?mpre=http%3A%2F%2Fwww.ebay.com%2Fsch%2F%3F_nkw%3D{searchTerms}&keyword;={searchTerms}
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: HP Network Check Helper -> {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} -> C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Toolbar: HKCU - No Name - {00000000-0000-0000-0000-000000000000} -  No File
Toolbar: HKCU - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton 360 Premier Edition\Engine64\21.5.0.19\coIEPlg.dll (Symantec Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL (Microsoft Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWow64\skype4com.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 10.1.1.1

FireFox:
========
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\windows\SysWOW64\Adobe\Director\np32dsw_1166636.dll (Adobe Systems, Inc.)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @videolan.org/vlc,version=2.1.3 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @WildTangent.com/GamesAppPresenceDetector,Version=1.0 -> C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll ()
FF HKLM-x32\…\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\coFFPlgn
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\coFFPlgn [2014-08-31]
FF HKLM-x32\…\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\IPSFF
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\N360_21.3.0.12\IPSFF [2014-06-29]

Chrome:
=======
CHR Profile: C:\Users\Megan\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (No Name) - C:\Users\Megan\AppData\Local\Google\Chrome\User Data\Default\Extensions\gpkdnelacfdbmlcelmaiabghmhaoceef [2014-03-13]
CHR HKLM\…\Chrome\Extension: [aoejbmmillcdifgagjpdlaamnalbielp] - C:\Users\Megan\AppData\Local\nwhb-v9.4.15.crx [2014-03-17]
CHR HKCU\…\Chrome\Extension: [aoejbmmillcdifgagjpdlaamnalbielp] - C:\Users\Megan\AppData\Local\nwhb-v9.4.15.crx [2014-03-17]
CHR HKCU\…\Chrome\Extension: [gpkdnelacfdbmlcelmaiabghmhaoceef] - C:\Users\Megan\AppData\Local\CRE\gpkdnelacfdbmlcelmaiabghmhaoceef.crx [2013-10-11]
CHR HKLM-x32\…\Chrome\Extension: [aoejbmmillcdifgagjpdlaamnalbielp] - C:\Users\Megan\AppData\Local\nwhb-v9.4.15.crx [2014-03-17]
CHR HKLM-x32\…\Chrome\Extension: [gpkdnelacfdbmlcelmaiabghmhaoceef] - C:\Users\Megan\AppData\Local\CRE\gpkdnelacfdbmlcelmaiabghmhaoceef.crx [2013-10-11]
CHR HKLM-x32\…\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\Exts\Chrome.crx [2014-08-12]
CHR HKLM-x32\…\Chrome\Extension: [nppllibpnmahfaklnpggkibhkapjkeob] -  [2014-08-12]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AMD FUEL Service; C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [361984 2013-04-17] (Advanced Micro Devices, Inc.) [File not signed]
R2 BlueSoleilCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BlueSoleilCS.exe [1626872 2013-02-01] (IVT Corporation)
R3 BsHelpCS; C:\Program Files (x86)\Ralink Corporation\Ralink Bluetooth Stack\BsHelpCS.exe [138752 2013-01-11] (IVT Corporation) [File not signed]
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2369720 2014-08-01] (Microsoft Corporation)
R2 HP Support Assistant Service; C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [92160 2013-11-04] (Hewlett-Packard Company) [File not signed]
R2 HPWMISVC; c:\Program Files (x86)\Hewlett-Packard\HP System Event\HPWMISVC.exe [1039160 2013-10-08] (Hewlett-Packard Development Company, L.P.)
R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
R2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
R2 N360; C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\N360.exe [265040 2014-08-01] (Symantec Corporation)
R2 RtkAudioService; C:\Program Files\Realtek\Audio\HDA\RtkAudioService64.exe [239176 2014-07-21] (Realtek Semiconductor)
S3 WinDefend; C:\Program Files\Windows Defender\MsMpEng.exe [16056 2014-03-29] (Microsoft Corporation)
S2 OutfoxTvService; C:\Program Files\OutfoxTV\OutfoxTvService.exe [X]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R0 amdkmpfd; C:\Windows\System32\drivers\amdkmpfd.sys [37472 2013-02-14] (Advanced Micro Devices, Inc.)
R3 AtiHDAudioService; C:\Windows\system32\drivers\AtihdW86.sys [94208 2013-02-15] (Advanced Micro Devices)
R1 BHDrvx64; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.3.0.12\Definitions\BASHDefs\20140821.007\BHDrvx64.sys [1588016 2014-08-19] (Symantec Corporation)
U5 BlueletAudio; C:\Windows\System32\Drivers\BlueletAudio.sys [33968 2012-12-20] (IVT Corporation)
R3 BtAudioBusSrv; C:\Windows\System32\Drivers\BtAudioBus.sys [23136 2012-06-16] (IVT Corporation)
U4 BthA2DP; No ImagePath
U4 BthAvrcpTg; No ImagePath
U4 BthHFEnum; No ImagePath
U4 bthhfhid; No ImagePath
S3 BthL2caScoIfSrv; C:\Windows\System32\Drivers\BtL2caScoIf.sys [56904 2012-07-20] (Ralink Corporation)
S3 BthLEEnum; C:\Windows\system32\DRIVERS\BthLEEnum.sys [202752 2012-07-26] (Microsoft Corporation)
S3 btUrbFilterDrv; C:\Windows\System32\Drivers\IvtUrbBtFlt.sys [49200 2013-02-27] (Ralink Corporation)
R1 ccSet_N360; C:\Windows\system32\drivers\N360x64\1505000.013\ccSetx64.sys [162392 2014-02-21] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-22] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [142128 2014-07-08] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.3.0.12\Definitions\IPSDefs\20140901.001\IDSvia64.sys [633560 2014-08-30] (Symantec Corporation)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-09-03] (Malwarebytes Corporation)
R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [64216 2014-05-12] (Malwarebytes Corporation)
R3 NAVENG; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.3.0.12\Definitions\VirusDefs\20140901.035\ENG64.SYS [129752 2014-08-22] (Symantec Corporation)
R3 NAVEX15; C:\Program Files (x86)\Norton 360 Premier Edition\NortonData\21.3.0.12\Definitions\VirusDefs\20140901.035\EX64.SYS [2137304 2014-08-22] (Symantec Corporation)
R3 RSP2STOR; C:\Windows\system32\DRIVERS\RtsP2Stor.sys [288328 2013-01-24] (Realtek Semiconductor Corp.)
R3 rtbth; C:\Windows\System32\drivers\rtbth.sys [1204424 2013-12-02] (Ralink Technology, Corp.)
S3 RTSPER; C:\Windows\System32\DRIVERS\RtsPer.sys [448072 2013-02-02] (RTS Corporation)
S3 SmbDrv; C:\Windows\System32\drivers\Smb_driver_AMDASF.sys [28400 2013-02-06] (Synaptics Incorporated)
S3 SmbDrvI; C:\Windows\System32\drivers\Smb_driver_Intel.sys [31984 2013-02-06] (Synaptics Incorporated)
R3 SRTSP; C:\Windows\System32\Drivers\N360x64\1505000.013\SRTSP64.SYS [875736 2014-02-13] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\N360x64\1505000.013\SRTSPX64.SYS [36952 2013-10-30] (Symantec Corporation)
S3 SWDUMon; C:\Windows\system32\DRIVERS\SWDUMon.sys [16152 2014-03-15] ()
R0 SymDS; C:\Windows\System32\drivers\N360x64\1505000.013\SYMDS64.SYS [493656 2013-10-30] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\N360x64\1505000.013\SYMEFA64.SYS [1148120 2014-03-04] (Symantec Corporation)
S0 SymELAM; C:\Windows\System32\drivers\N360x64\1505000.013\SymELAM.sys [23568 2013-10-30] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177752 2014-06-23] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\N360x64\1505000.013\Ironx64.SYS [264280 2013-10-30] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\N360x64\1505000.013\SYMNETS.SYS [593112 2014-02-18] (Symantec Corporation)
R3 WirelessButtonDriver; C:\Windows\System32\drivers\WirelessButtonDriver64.sys [20800 2012-09-01] (Hewlett-Packard Development Company, L.P.)
U5 BlueletAudio; C:\Windows\SysWOW64\Drivers\BlueletAudio.sys [33968 2012-12-20] (IVT Corporation)
S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-03 21:25 - 2014-09-03 21:26 - 00019382 _____ () C:\Users\Megan\Desktop\FRST.txt
2014-09-03 21:25 - 2014-09-03 21:25 - 00000000 ____D () C:\FRST
2014-09-03 21:24 - 2014-09-03 21:24 - 02104832 _____ (Farbar) C:\Users\Megan\Desktop\FRST64.exe
2014-09-01 18:57 - 2014-09-01 18:57 - 00000000 _____ () C:\Users\Megan\Desktop\FRST.exe.9jbx256.partial
2014-09-01 18:52 - 2014-09-01 18:52 - 02104832 _____ (Farbar) C:\Users\Megan\Downloads\FRST64.exe
2014-08-31 16:46 - 2014-08-31 16:46 - 00000689 _____ () C:\Users\Megan\Desktop\JRT.txt
2014-08-31 16:03 - 2014-08-31 16:03 - 00000000 ____D () C:\Windows\ERUNT
2014-08-31 15:43 - 2014-09-03 21:18 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-08-31 15:43 - 2014-08-31 15:43 - 00001073 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-31 15:43 - 2014-08-31 15:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-31 15:43 - 2014-08-31 15:43 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-31 15:43 - 2014-08-31 15:43 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-31 15:43 - 2014-05-12 07:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-08-31 15:43 - 2014-05-12 07:26 - 00064216 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2014-08-31 15:43 - 2014-05-12 07:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-08-31 15:30 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-08-31 15:29 - 2014-08-31 16:09 - 00000000 ____D () C:\AdwCleaner
2014-08-31 15:25 - 2014-08-31 15:25 - 00000000 _____ () C:\Users\Megan\Downloads\AdwCleaner.exe.ltcg6wd.partial
2014-08-31 08:50 - 2014-08-31 08:50 - 00000000 ____D () C:\Users\Megan\Downloads\Pretty Little Liars
2014-08-31 08:27 - 2014-08-31 08:27 - 00068724 _____ () C:\Users\Megan\Desktop\Extras.Txt
2014-08-31 08:25 - 2014-08-31 08:25 - 00186584 _____ () C:\Users\Megan\Desktop\OTL.Txt
2014-08-31 08:04 - 2014-08-31 08:04 - 00602112 _____ (OldTimer Tools) C:\Users\Megan\Desktop\OTL.exe
2014-08-31 00:14 - 2014-08-31 00:14 - 00000000 _____ () C:\autoexec.bat
2014-08-31 00:13 - 2014-08-31 00:13 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-08-31 00:12 - 2014-08-31 07:48 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-08-30 23:21 - 2014-08-30 23:26 - 00000000 ____D () C:\Users\Megan\Downloads\Orange is the New Black Season 2 Complete WEBRip x264 [Multi-Sub] [DexzAery & VectoR]
2014-08-30 10:06 - 2014-08-23 16:47 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-30 10:06 - 2014-07-16 09:03 - 01300992 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll
2014-08-30 10:06 - 2014-07-12 12:36 - 01023488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll
2014-08-24 10:47 - 2014-08-24 11:15 - 00000000 ____D () C:\Users\Megan\Downloads\The.Other.Woman.2014.1080p.BluRay.x264.anoXmous
2014-08-23 15:13 - 2014-05-20 12:33 - 00059416 _____ (Microsoft Corporation) C:\Windows\system32\wuauclt.exe
2014-08-23 15:13 - 2014-05-20 09:45 - 00629248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapi.dll
2014-08-23 15:13 - 2014-05-20 09:45 - 00086528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wudriver.dll
2014-08-23 15:13 - 2014-05-20 09:24 - 03286528 _____ (Microsoft Corporation) C:\Windows\system32\wuaueng.dll
2014-08-23 15:13 - 2014-05-20 09:24 - 01623040 _____ (Microsoft Corporation) C:\Windows\system32\wucltux.dll
2014-08-23 15:13 - 2014-05-20 09:24 - 00773632 _____ (Microsoft Corporation) C:\Windows\system32\wuapi.dll
2014-08-23 15:13 - 2014-05-20 09:24 - 00253440 _____ (Microsoft Corporation) C:\Windows\system32\WUSettingsProvider.dll
2014-08-23 15:13 - 2014-05-20 09:24 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\storewuauth.dll
2014-08-23 15:13 - 2014-05-20 09:24 - 00100352 _____ (Microsoft Corporation) C:\Windows\system32\wudriver.dll
2014-08-23 15:13 - 2014-05-15 08:43 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\wuwebv.dll
2014-08-23 15:13 - 2014-05-15 08:43 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\wuapp.exe
2014-08-23 15:13 - 2014-05-15 08:42 - 00128000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuwebv.dll
2014-08-23 15:13 - 2014-05-15 08:42 - 00035328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wuapp.exe
2014-08-22 19:41 - 2014-07-16 08:51 - 00071168 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hdaudbus.sys
2014-08-22 19:38 - 2014-06-11 08:44 - 00035480 _____ (Microsoft Corporation) C:\Windows\system32\TsWpfWrp.exe
2014-08-22 19:38 - 2014-06-11 08:43 - 00035480 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TsWpfWrp.exe
2014-08-22 19:31 - 2014-07-24 22:11 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-08-22 19:31 - 2014-07-24 22:10 - 02240000 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-08-22 19:31 - 2014-07-24 22:10 - 01407488 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-08-22 19:31 - 2014-07-24 22:10 - 00915968 _____ (Microsoft Corporation) C:\Windows\system32\uxtheme.dll
2014-08-22 19:31 - 2014-07-24 22:10 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\UXInit.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 19279872 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 15399936 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 03959296 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 02655232 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 01508864 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-08-22 19:31 - 2014-07-24 22:09 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00451584 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00281600 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00255488 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00097280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-08-22 19:31 - 2014-07-24 22:09 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-08-22 19:31 - 2014-07-24 20:52 - 01766400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-08-22 19:31 - 2014-07-24 20:52 - 01180672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-08-22 19:31 - 2014-07-24 20:52 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UXInit.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 14371328 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 13757440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 02861568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 02054656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 01440768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-08-22 19:31 - 2014-07-24 20:51 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00357888 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00226816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00080384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-08-22 19:31 - 2014-07-24 20:51 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-08-22 19:31 - 2014-07-24 20:33 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-08-22 19:31 - 2014-07-24 20:29 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-08-22 19:31 - 2014-07-24 18:03 - 00534528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\uxtheme.dll
2014-08-22 19:31 - 2014-06-13 11:57 - 01453400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys
2014-08-22 19:31 - 2014-06-13 11:55 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll
2014-08-22 19:30 - 2014-06-20 09:35 - 01312768 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2014-08-22 19:30 - 2014-06-20 08:24 - 00694272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2014-08-22 19:30 - 2014-06-06 03:56 - 00112984 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe
2014-08-22 19:30 - 2014-06-06 03:30 - 10116608 _____ (Microsoft Corporation) C:\Windows\system32\twinui.dll
2014-08-22 19:30 - 2014-06-06 03:29 - 02885632 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-08-22 19:30 - 2014-06-06 03:29 - 00393216 _____ (Microsoft Corporation) C:\Windows\system32\msihnd.dll
2014-08-22 19:30 - 2014-06-06 03:28 - 02306560 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll
2014-08-22 19:30 - 2014-06-06 03:28 - 02146304 _____ (Microsoft Corporation) C:\Windows\system32\actxprxy.dll
2014-08-22 19:30 - 2014-06-05 23:12 - 08857600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\twinui.dll
2014-08-22 19:30 - 2014-06-05 23:11 - 02416128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-08-22 19:30 - 2014-06-05 23:11 - 00295424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msihnd.dll
2014-08-22 19:30 - 2014-06-05 23:10 - 02037760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll
2014-08-22 19:30 - 2014-06-05 23:10 - 00754176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\actxprxy.dll
2014-08-22 19:30 - 2014-05-29 14:04 - 00094552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2014-08-22 19:30 - 2014-05-08 11:34 - 00328024 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Classpnp.sys
2014-08-12 19:31 - 2014-08-12 19:31 - 00000000 ____D () C:\Windows\System32\Tasks\Norton 360
2014-08-08 18:37 - 2014-08-08 18:43 - 530361522 _____ () C:\Users\Megan\Downloads\The.Bachelor.AU.s02e03.PDTV.x264.Hector.mp4

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-09-03 21:26 - 2014-09-03 21:25 - 00019382 _____ () C:\Users\Megan\Desktop\FRST.txt
2014-09-03 21:25 - 2014-09-03 21:25 - 00000000 ____D () C:\FRST
2014-09-03 21:24 - 2014-09-03 21:24 - 02104832 _____ (Farbar) C:\Users\Megan\Desktop\FRST64.exe
2014-09-03 21:23 - 2013-10-09 18:35 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-09-03 21:22 - 2013-10-09 18:34 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-09-03 21:22 - 2013-10-08 15:14 - 01962182 _____ () C:\Windows\WindowsUpdate.log
2014-09-03 21:18 - 2014-08-31 15:43 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-09-03 21:18 - 2014-05-11 14:45 - 00000000 ____D () C:\Users\Megan\AppData\Roaming\Spotify
2014-09-03 21:17 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\system32\sru
2014-09-02 22:06 - 2014-03-15 19:45 - 00000000 ____D () C:\Users\Megan\AppData\Roaming\vlc
2014-09-02 21:54 - 2013-10-08 15:25 - 00003600 _____ () C:\Windows\System32\Tasks\Optimize Start Menu Cache Files-S-1-5-21-1601758659-1066206950-3557107692-1002
2014-09-02 20:39 - 2014-03-15 16:33 - 00003164 _____ () C:\Windows\System32\Tasks\WinZipDriverUpdaterRunAtStartup
2014-09-01 21:06 - 2012-07-26 17:59 - 00000000 ____D () C:\Windows\CbsTemp
2014-09-01 19:41 - 2013-03-05 09:30 - 00000983 _____ () C:\Windows\SysWOW64\bscs.ini
2014-09-01 19:41 - 2012-07-26 17:22 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-09-01 19:40 - 2012-07-26 15:26 - 00262144 ___SH () C:\Windows\system32\config\BBI
2014-09-01 18:57 - 2014-09-01 18:57 - 00000000 _____ () C:\Users\Megan\Desktop\FRST.exe.9jbx256.partial
2014-09-01 18:52 - 2014-09-01 18:52 - 02104832 _____ (Farbar) C:\Users\Megan\Downloads\FRST64.exe
2014-08-31 16:46 - 2014-08-31 16:46 - 00000689 _____ () C:\Users\Megan\Desktop\JRT.txt
2014-08-31 16:10 - 2014-07-02 19:20 - 00000354 _____ () C:\Windows\Tasks\HPCeeScheduleForMegan.job
2014-08-31 16:10 - 2012-08-04 08:23 - 01282286 _____ () C:\Windows\PFRO.log
2014-08-31 16:09 - 2014-08-31 15:29 - 00000000 ____D () C:\AdwCleaner
2014-08-31 16:03 - 2014-08-31 16:03 - 00000000 ____D () C:\Windows\ERUNT
2014-08-31 15:43 - 2014-08-31 15:43 - 00001073 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-08-31 15:43 - 2014-08-31 15:43 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
2014-08-31 15:43 - 2014-08-31 15:43 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-08-31 15:43 - 2014-08-31 15:43 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-08-31 15:41 - 2014-07-02 19:20 - 00003168 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForMegan
2014-08-31 15:41 - 2013-10-08 15:13 - 00000000 ____D () C:\Users\Megan
2014-08-31 15:25 - 2014-08-31 15:25 - 00000000 _____ () C:\Users\Megan\Downloads\AdwCleaner.exe.ltcg6wd.partial
2014-08-31 11:05 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\rescache
2014-08-31 08:50 - 2014-08-31 08:50 - 00000000 ____D () C:\Users\Megan\Downloads\Pretty Little Liars
2014-08-31 08:27 - 2014-08-31 08:27 - 00068724 _____ () C:\Users\Megan\Desktop\Extras.Txt
2014-08-31 08:25 - 2014-08-31 08:25 - 00186584 _____ () C:\Users\Megan\Desktop\OTL.Txt
2014-08-31 08:04 - 2014-08-31 08:04 - 00602112 _____ (OldTimer Tools) C:\Users\Megan\Desktop\OTL.exe
2014-08-31 07:56 - 2012-07-26 15:26 - 00262144 ___SH () C:\Windows\system32\config\ELAM
2014-08-31 07:55 - 2014-07-13 15:09 - 00327032 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-08-31 07:48 - 2014-08-31 00:12 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP
2014-08-31 07:37 - 2014-03-15 09:38 - 00000000 ____D () C:\Users\Megan\AppData\Roaming\uTorrent
2014-08-31 00:27 - 2014-06-15 22:18 - 00000000 ____D () C:\Users\Megan\Desktop\Cycra Racing Powerflow Body Kits_files
2014-08-31 00:14 - 2014-08-31 00:14 - 00000000 _____ () C:\autoexec.bat
2014-08-31 00:13 - 2014-08-31 00:13 - 00000000 ____D () C:\Program Files\Enigma Software Group
2014-08-30 23:26 - 2014-08-30 23:21 - 00000000 ____D () C:\Users\Megan\Downloads\Orange is the New Black Season 2 Complete WEBRip x264 [Multi-Sub] [DexzAery & VectoR]
2014-08-30 10:07 - 2012-07-26 18:12 - 00000000 ____D () C:\Windows\AUInstallAgent
2014-08-26 18:33 - 2014-07-15 18:50 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2014-08-26 18:23 - 2014-07-27 14:54 - 00000000 ____D () C:\Users\Megan\AppData\Local\Spotify
2014-08-24 17:40 - 2012-07-26 17:28 - 00941114 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-08-24 11:29 - 2014-04-21 13:22 - 00000000 ____D () C:\Users\Megan\Downloads\WATCHED
2014-08-24 11:15 - 2014-08-24 10:47 - 00000000 ____D () C:\Users\Megan\Downloads\The.Other.Woman.2014.1080p.BluRay.x264.anoXmous
2014-08-23 16:47 - 2014-08-30 10:06 - 04036096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-08-22 22:22 - 2012-07-26 18:12 - 00000000 ___RD () C:\Windows\ToastData
2014-08-22 22:20 - 2012-07-26 18:12 - 00000000 ___HD () C:\Windows\ELAMBKUP
2014-08-22 19:56 - 2013-10-12 19:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-08-22 19:53 - 2013-10-12 19:11 - 99218768 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-08-12 19:31 - 2014-08-12 19:31 - 00000000 ____D () C:\Windows\System32\Tasks\Norton 360
2014-08-12 19:25 - 2014-06-29 16:23 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton 360 Premier Edition
2014-08-12 19:25 - 2014-06-08 11:10 - 00003238 _____ () C:\Windows\System32\Tasks\Norton WSC Integration
2014-08-12 19:25 - 2014-06-08 11:10 - 00002462 _____ () C:\Users\Public\Desktop\Norton 360.lnk
2014-08-12 19:25 - 2014-06-08 11:07 - 00000000 ____D () C:\Windows\system32\Drivers\N360x64
2014-08-12 13:46 - 2013-10-08 15:55 - 00000000 ____D () C:\Users\Megan\AppData\Local\CrashDumps
2014-08-08 19:45 - 2014-06-09 08:47 - 00000000 ____D () C:\Users\Megan\Downloads\Wentworth
2014-08-08 18:43 - 2014-08-08 18:37 - 530361522 _____ () C:\Users\Megan\Downloads\The.Bachelor.AU.s02e03.PDTV.x264.Hector.mp4

Some content of TEMP:
====================
C:\Users\Megan\AppData\Local\Temp\Extract.exe
C:\Users\Megan\AppData\Local\Temp\OfficeSetup.exe
C:\Users\Megan\AppData\Local\Temp\Quarantine.exe
C:\Users\Megan\AppData\Local\Temp\setup32.exe
C:\Users\Megan\AppData\Local\Temp\SHSetup.exe

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed

LastRegBack: 2014-08-31 03:29

==================== End Of Log ============================

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 03-09-2014 01
Ran by [removed] at 2014-09-03 21:26:45
Running from C:\Users\[removed]\Desktop
Boot Mode: Normal
==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AV: Norton 360 Premier Edition (Disabled - Up to date) {D87FA2C0-F526-77B1-D6EC-0EDF3936CEDB}
AS: Norton 360 Premier Edition (Enabled - Up to date) {631E4324-D31C-783F-EC5C-35AD42B18466}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Norton 360 Premier Edition (Enabled) {E04423E5-BF49-76E9-FDB3-A7EAC7E589A0}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

µTorrent (HKCU\…\uTorrent) (Version: 3.4.2.32239 - BitTorrent Inc.)
4 Elements II (x32 Version: 2.2.0.98 - WildTangent) Hidden
7-Zip 9.20 (x64 edition) (HKLM\…\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Adobe Shockwave Player 11.6 (HKLM-x32\…\Adobe Shockwave Player) (Version: 11.6.6.636 - Adobe Systems, Inc.)
Airport Mania (x32 Version: 2.2.0.95 - WildTangent) Hidden
Aloha TriPeaks (x32 Version: 2.2.0.98 - WildTangent) Hidden
AMD Accelerated Video Transcoding (Version: 12.10.100.30416 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\…\{F436F474-EBF3-3A9C-AA11-6CBB36FED296}) (Version: 8.0.911.0 - Advanced Micro Devices, Inc.)
AMD Fuel (Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
AMD VISION Engine Control Center (x32 Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
Azteca (x32 Version: 2.2.0.97 - WildTangent) Hidden
Bejeweled 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Bonjour (HKLM\…\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
Bounce Symphony (x32 Version: 2.2.0.97 - WildTangent) Hidden
Build-a-lot (x32 Version: 2.2.0.98 - WildTangent) Hidden
Catalyst Control Center - Branding (x32 Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (x32 Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (x32 Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (x32 Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (x32 Version: 2013.0416.2337.40605 - Advanced Micro Devices, Inc.) Hidden
ccc-utility64 (Version: 2013.0416.2338.40605 - Advanced Micro Devices, Inc.) Hidden
Cradle of Rome 2 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Curse at Twilight (x32 Version: 3.0.2.32 - WildTangent) Hidden
CyberLink YouCam (HKLM-x32\…\InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}) (Version: 3.5.6.6117 - CyberLink Corp.)
CyberLink YouCam (x32 Version: 3.5.6.6117 - CyberLink Corp.) Hidden
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Delicious: Emily's Childhood Memories Premium Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Energy Star (HKLM-x32\…\{FC0ADA4D-8FA5-4452-8AFF-F0A0BAC97EF7}) (Version: 1.0.9 - Hewlett-Packard Company)
Farm Frenzy (x32 Version: 2.2.0.98 - WildTangent) Hidden
Google Update Helper (x32 Version: 1.3.25.0 - Google Inc.) Hidden
Governor of Poker 2 Premium Edition (x32 Version: 2.2.0.110 - WildTangent) Hidden
Hewlett-Packard ACLM.NET v1.2.2.3 (x32 Version: 1.00.0000 - Hewlett-Packard Company) Hidden
House of 1000 Doors: Family Secrets (x32 Version: 2.2.0.98 - WildTangent) Hidden
HP 3D DriveGuard (HKLM-x32\…\{07F6DC37-0857-4B68-A675-4E35989E85E3}) (Version: 6.0.15.1 - Hewlett-Packard Company)
HP CoolSense (HKLM-x32\…\{59F8C5AA-91BD-423D-BF05-09A80F39898F}) (Version: 2.10.62 - Hewlett-Packard Company)
HP Customer Experience Enhancements (x32 Version: 6.0.1.8 - Hewlett-Packard) Hidden
HP Documentation (HKLM-x32\…\{F2481209-98FE-4943-8903-90D19E1B7062}) (Version: 1.2.0.0 - Hewlett-Packard)
HP Postscript Converter (Version: 4.0.4100 - Hewlett-Packard) Hidden
HP Quick Start (HKLM-x32\…\{574F0207-8E98-46CD-8F79-318348C98C46}) (Version: 1.0.4660.30220 - Hewlett-Packard)
HP Recovery Manager (x32 Version: 9.00 - Hewlett-Packard) Hidden
HP Registration Service (HKLM\…\{D1E8F2D7-7794-4245-B286-87ED86C1893C}) (Version: 1.2.6317.4309 - Hewlett-Packard)
HP Support Assistant (HKLM-x32\…\{E35A3B13-78CD-4967-8AC8-AA9FDA693EDE}) (Version: 7.4.45.4 - Hewlett-Packard Company)
HP System Event Utility (HKLM-x32\…\{C78E8F51-3EAD-4F0C-83F0-EF371075E0B4}) (Version: 1.0.10 - Hewlett-Packard Company)
HP Utility Center (HKLM\…\{73237EBB-B26F-4628-8754-4EFE563D72E9}) (Version: 2.1.5 - Hewlett-Packard Company)
HP Wireless Button Driver (HKLM-x32\…\{30B2D1D8-0A07-4B71-9553-0710C5D31E35}) (Version: 1.1.2.1 - Hewlett-Packard Company)
Itibiti RTC (x32 Version: 0.0.1 - Itibiti Inc) Hidden
Jewel Match 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Letters from Nowhere 2 (x32 Version: 2.2.0.97 - WildTangent) Hidden
Luxor Evolved (x32 Version: 2.2.0.98 - WildTangent) Hidden
Mah Jong Medley (x32 Version: 2.2.0.95 - WildTangent) Hidden
Mahjongg Dimensions Deluxe: Tiles in Time (x32 Version: 2.2.0.98 - WildTangent) Hidden
Malwarebytes Anti-Malware version 2.0.2.1012 (HKLM-x32\…\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2013 - en-us (HKLM\…\HomeStudentRetail - en-us) (Version: 15.0.4641.1003 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\…\SkyDriveSetup.exe) (Version: 16.4.6012.0828 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\…\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\…\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022 (HKLM\…\{350AA351-21FA-3270-8B7A-835434E766AD}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\…\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\…\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM-x32\…\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\…\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\…\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\…\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319 (HKLM-x32\…\{196BB40D-1578-3D01-B289-BEFC77A11A1E}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 (HKLM-x32\…\{15134cb0-b767-4960-a911-f2d16ae54797}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT110 (x32 Version: 16.4.1108.0727 - Microsoft) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Norton 360 (HKLM-x32\…\N360) (Version: 21.5.0.19 - Symantec Corporation)
OEM Application Profile (HKLM-x32\…\{548083DD-D99B-2CE1-8D2B-D78BEB834F7A}) (Version: 1.00.0000 - Advanced Micro Devices, Inc.)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4641.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4641.1003 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4641.1003 - Microsoft Corporation) Hidden
Peggle Nights (x32 Version: 2.2.0.98 - WildTangent) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Plants vs. Zombies - Game of the Year (x32 Version: 2.2.0.98 - WildTangent) Hidden
Polar Bowler (x32 Version: 2.2.0.97 - WildTangent) Hidden
Ralink Bluetooth Stack64 (HKLM\…\{7B83C685-3EA9-544F-9580-368394C67C3A}) (Version: 11.0.737.2 - Mediatek)
Ralink RT3290 802.11bgn Wi-Fi Adapter (HKLM-x32\…\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 5.0.23.0 - Mediatek)
Realtek Ethernet Controller Driver (HKLM-x32\…\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 8.10.1226.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\…\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6870 - Realtek Semiconductor Corp.)
Realtek PCIE Card Reader (HKLM-x32\…\{BCDA54F6-C4B6-4519-A09E-FA064A6B4098}) (Version: 1.1.9200.007 - Realtek Semiconductor Corp.)
Roads of Rome 3 (x32 Version: 2.2.0.98 - WildTangent) Hidden
Royal Envoy 2 Collector's Edition (x32 Version: 3.0.2.32 - WildTangent) Hidden
Spotify (HKCU\…\Spotify) (Version: 0.9.12.10.g89b2a4fc - Spotify AB)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Synaptics Pointing Device Driver (HKLM\…\SynTPDeinstKey) (Version: 16.5.3.3 - Synaptics Incorporated)
The Treasures of Mystery Island: The Ghost Ship (x32 Version: 2.2.0.98 - WildTangent) Hidden
Trinklit Supreme (x32 Version: 2.2.0.98 - WildTangent) Hidden
Update Installer for WildTangent Games App (x32 Version:  - WildTangent) Hidden
Vacation Quest™ - Australia (x32 Version: 3.0.2.32 - WildTangent) Hidden
VLC media player 2.1.3 (HKLM-x32\…\VLC media player) (Version: 2.1.3 - VideoLAN)
WildTangent Games (HKLM-x32\…\WildTangent wildgames Master Uninstall) (Version: 1.0.4.0 - WildTangent)
WildTangent Games App (HP Games) (x32 Version: 4.0.10.5 - WildTangent) Hidden
Windows Live Communications Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\…\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
WinZip Driver Updater (HKLM-x32\…\{9854A5C4-5BE5-46E2-A989-352DD8B37E20}_is1) (Version: 1.0.648.11339 - WinZip Computing, S.L. (WinZip Computing))
Youda Jewel Shop (x32 Version: 3.0.2.32 - WildTangent) Hidden
Zuma's Revenge (x32 Version: 2.2.0.98 - WildTangent) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-1601758659-1066206950-3557107692-1002_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Megan\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1601758659-1066206950-3557107692-1002_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Megan\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1601758659-1066206950-3557107692-1002_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Megan\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828_1\amd64\SkyDriveShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1601758659-1066206950-3557107692-1002_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Megan\AppData\Local\Microsoft\SkyDrive\16.4.6012.0828_1\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points  =========================

30-08-2014 21:46:20 Removed SpyHunter

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2012-07-26 15:26 - 2012-07-26 15:26 - 00000824 ____N C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0DEF472A-5DC1-48E0-99FA-02D75B4EDC9E} - System32\Tasks\Hewlett-Packard\HP CoolSense\HP CoolSense Start at Logon => C:\Program Files (x86)\Hewlett-Packard\HP CoolSense\CoolSense.exe [2012-11-06] (Hewlett-Packard Development Company, L.P.)
Task: {116762D3-38E4-49BC-9B45-54DB5271D9F2} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater7\HPSFUpdater.exe [2014-05-12] (Hewlett-Packard Company)
Task: {1AAFF332-5C62-4558-9991-DAA649C4C9C5} - System32\Tasks\Microsoft\Windows\Sysmain\WsSwapAssessmentTask => Rundll32.exe sysmain.dll,PfSvWsSwapAssessmentTask
Task: {1D9473F6-AA85-4893-8F0F-7658A5DF4E00} - System32\Tasks\HPCeeScheduleForMegan => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2011-07-15] (Hewlett-Packard)
Task: {23A5D8BE-9196-40EB-BD89-794398B2B073} - System32\Tasks\Microsoft\Windows\WS\WSRefreshBannedAppsListTask => Rundll32.exe WSClient.dll,RefreshBannedAppsList
Task: {3AE01A24-717E-45EA-B068-6415956DF3D5} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2014-08-01] (Microsoft Corporation)
Task: {3DCCDD4C-AE29-4B7F-BAE2-8C3EED942E2D} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1601758659-1066206950-3557107692-1002 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {3F90CB02-BA7F-41BE-8E5D-2CA701BBB913} - System32\Tasks\WinZipDriverUpdaterRunAtStartup => C:\Program Files (x86)\WinZip Driver Updater\winzipdu.exe [2013-02-13] (WinZip Computing, S.L. (WinZip Computing))
Task: {5AF4234A-892A-4473-8EBC-040A1BD70EFF} - System32\Tasks\Norton 360\Norton Error Processor => C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\SymErr.exe [2014-01-31] (Symantec Corporation)
Task: {6E1EDDDD-BD5B-4D2C-9CF3-068652E47F18} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1601758659-1066206950-3557107692-1002 => C:\Program Files (x86)\Real\RealUpgrade\RealUpgrade.exe
Task: {6FA02AA9-8071-4087-B75C-60CCE5B67820} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {82DB59AD-30A7-4B31-B6FC-E6A6C257F231} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\WSCStub.exe [2014-08-01] (Symantec Corporation)
Task: {A72208BF-7A49-4FB8-B684-252375F3443A} - System32\Tasks\Microsoft\Windows\WS\License Validation => Rundll32.exe WSClient.dll,WSpTLR licensing
Task: {AF41CB97-FEF2-43F9-966C-263858D06BEF} - System32\Tasks\MirageAgent => C:\Program Files (x86)\CyberLink\YouCam\YCMMirage.exe [2013-01-18] (CyberLink)
Task: {B15F6633-B2FB-4C4F-A665-F4F19E9DBB5D} - System32\Tasks\Microsoft\Windows\RemovalTools\MRT_HB => C:\Windows\system32\MRT.exe [2014-08-22] (Microsoft Corporation)
Task: {C6A88F2D-53D2-4805-9D69-443738A1847C} - System32\Tasks\Microsoft\Windows\ApplicationData\CleanupTemporaryState => Rundll32.exe Windows.Storage.ApplicationData.dll,CleanupTemporaryState
Task: {C7970D7C-42AE-4EF1-89F6-AC12111EB741} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Ghost Resign Task => c:\program files (x86)\hewlett-packard\hp health check\activecheck\product_line\HPResignFileLoader.exe [2014-08-19] (Microsoft)
Task: {CDEF42F1-41E8-4CFC-BE40-332F9F195C38} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe [2013-11-04] (Hewlett-Packard Company)
Task: {CF1B5B30-ED7E-4922-AB3C-5C50E2D8CE55} - System32\Tasks\Synaptics TouchPad Enhancements => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2013-10-23] (Synaptics Incorporated)
Task: {D397ED04-DD13-4305-B854-415C3198851E} - System32\Tasks\Norton 360\Norton Error Analyzer => C:\Program Files (x86)\Norton 360 Premier Edition\Engine\21.5.0.19\SymErr.exe [2014-01-31] (Symantec Corporation)
Task: {EBF06DEC-4228-4813-AC0C-62821AE4E330} - System32\Tasks\Microsoft\Windows\Application Experience\StartupAppTask => Rundll32.exe Startupscan.dll,SusRunTask
Task: C:\Windows\Tasks\HPCeeScheduleForMegan.job => C:\Program Files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe

==================== Loaded Modules (whitelisted) =============

2013-04-17 16:50 - 2013-04-17 16:50 - 00073728 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Container.Wlan.dll
2014-07-22 16:57 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2013-01-11 06:35 - 2013-01-11 06:35 - 00009728 _____ () C:\Windows\system32\BsHelpCSps.dll
2012-10-31 18:05 - 2012-10-31 18:05 - 00607744 _____ () C:\Windows\system32\spool\DRIVERS\x64\3\JobCapsA.DLL
2014-08-26 18:33 - 2014-08-26 18:33 - 08892576 _____ () C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2013-04-17 16:50 - 2013-04-17 16:50 - 00103424 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
2013-01-11 06:30 - 2013-01-11 06:30 - 00022528 _____ () C:\Windows\system32\BsTrace.dll
2013-01-11 06:30 - 2013-01-11 06:30 - 00022528 _____ () C:\Windows\SYSTEM32\BsTrace.dll
2013-01-11 06:35 - 2013-01-11 06:35 - 00009728 _____ () C:\Windows\SYSTEM32\BsHelpCSps.dll
2013-01-11 06:35 - 2013-01-11 06:35 - 00055296 _____ () C:\Windows\SYSTEM32\BlueSoleilCSps.dll
2013-02-01 10:04 - 2013-02-01 10:04 - 00080120 _____ () C:\Windows\SYSTEM32\BsProfilefunc.dll
2013-01-11 04:25 - 2013-01-11 04:25 - 00364544 _____ () C:\Windows\SYSTEM32\BsExtendFunc.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:373E1720

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

HKCU\…\StartupApproved\StartupFolder: => "DesktopWeatherAlerts.lnk"
HKCU\…\StartupApproved\StartupFolder: => "MyPC Backup.lnk"

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:
==================
Error: (09/02/2014 10:01:48 PM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {27a4d822-9583-46dd-a3f9-09e2f377b921}

Error: (09/02/2014 08:44:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: PENNINGHPC)
Description: App Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo did not launch within its allotted time.

Error: (09/01/2014 09:11:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: PENNINGHPC)
Description: App Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo did not launch within its allotted time.

Error: (09/01/2014 09:06:04 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (09/01/2014 07:39:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PENNINGHPC)
Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/01/2014 07:39:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PENNINGHPC)
Description: Activation of app microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail failed with error: -2144927151 See the Microsoft-Windows-TWinUI/Operational log for additional information.

Error: (09/01/2014 07:31:08 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (09/01/2014 02:03:47 AM) (Source: VSS) (EventID: 8194) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005, Access is denied.
.
This is often caused by incorrect security settings in either the writer or requestor process.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {4073728d-e47c-4076-a197-15e84f573cf9}

System errors:
=============
Error: (09/01/2014 07:41:24 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: The OutfoxTvService service failed to start due to the following error:
%%2

Microsoft Office Sessions:
=========================
Error: (09/02/2014 10:01:48 PM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Access is denied.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {27a4d822-9583-46dd-a3f9-09e2f377b921}

Error: (09/02/2014 08:44:14 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: PENNINGHPC)
Description: Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo

Error: (09/01/2014 09:11:36 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 2486) (User: PENNINGHPC)
Description: Microsoft.ZuneVideo_8wekyb3d8bbwe!Microsoft.ZuneVideo

Error: (09/01/2014 09:06:04 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (09/01/2014 07:39:32 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PENNINGHPC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2144927151

Error: (09/01/2014 07:39:24 PM) (Source: Microsoft-Windows-Immersive-Shell) (EventID: 5973) (User: PENNINGHPC)
Description: microsoft.windowscommunicationsapps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail-2144927151

Error: (09/01/2014 07:31:08 PM) (Source: Customer Experience Improvement Program) (EventID: 1008) (User: )
Description: 80070005

Error: (09/01/2014 02:03:47 AM) (Source: VSS) (EventID: 8194) (User: )
Description: 0x80070005, Access is denied.

Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {4073728d-e47c-4076-a197-15e84f573cf9}

==================== Memory info ===========================

Processor: AMD A8-4500M APU with Radeon™ HD Graphics
Percentage of memory in use: 27%
Total physical RAM: 7366.25 MB
Available physical RAM: 5317.52 MB
Total Pagefile: 8518.25 MB
Available Pagefile: 6436.64 MB
Total Virtual: 8192 MB
Available Virtual: 8191.78 MB

==================== Drives ================================

Drive c: (Windows) (Fixed) (Total:907.12 GB) (Free:536.97 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (RECOVERY) (Fixed) (Total:23.62 GB) (Free:0.36 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (15.0.4433.1508) (CDROM) (Total:2.05 GB) (Free:0 GB) UDF

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: B0C0F406)

Partition: GPT Partition Type.

==================== End Of Log ============================