Virus EXP/ASF.GetCodec.Gen auf Vista-Rechner (32 bit) mit englischem Betriebssystem

Avira Free Antivirus
Report file date: 10 February 2014  16:54


The program is running as an unrestricted full version.
Online services are available.

Licensee        : Avira Antivirus Free
Serial number   : 0000149996-AVHOE-0000001
Platform        : Windows Vista (TM) Home Premium
Windows version : (Service Pack 2)  [6.0.6002]
Boot mode       : Normally booted
Username        : SYSTEM
Computer name   : MY-COMPUTER

Version information:
BUILD.DAT       : 14.0.2.286     55547 Bytes  09/12/2013 11:37:00
AVSCAN.EXE      : 14.0.2.254   1032760 Bytes  09/12/2013 10:37:19
AVSCANRC.DLL    : 14.0.2.180     52280 Bytes  09/12/2013 10:37:19
LUKE.DLL        : 14.0.2.234     65592 Bytes  09/12/2013 10:37:20
AVSCPLR.DLL     : 14.0.2.254    124472 Bytes  09/12/2013 10:37:19
AVREG.DLL       : 14.0.2.212    250424 Bytes  09/12/2013 10:37:19
avlode.dll      : 14.0.2.254    540216 Bytes  09/12/2013 10:37:19
avlode.rdf      : 13.0.1.70      56974 Bytes  10/02/2014 15:36:42
VBASE000.VDF    : 7.11.70.0   66736640 Bytes  04/04/2013 10:37:22
VBASE001.VDF    : 7.11.74.226  2201600 Bytes  30/04/2013 10:37:22
VBASE002.VDF    : 7.11.80.60   2751488 Bytes  28/05/2013 10:37:22
VBASE003.VDF    : 7.11.85.214  2162688 Bytes  21/06/2013 10:37:22
VBASE004.VDF    : 7.11.91.176  3903488 Bytes  23/07/2013 10:37:22
VBASE005.VDF    : 7.11.98.186  6822912 Bytes  29/08/2013 10:37:22
VBASE006.VDF    : 7.11.103.230  2293248 Bytes  24/09/2013 10:37:22
VBASE007.VDF    : 7.11.116.38  5485568 Bytes  28/11/2013 10:37:22
VBASE008.VDF    : 7.11.126.50  3615744 Bytes  22/01/2014 15:36:36
VBASE009.VDF    : 7.11.128.174  2030080 Bytes  03/02/2014 15:36:37
VBASE010.VDF    : 7.11.128.175     2048 Bytes  03/02/2014 15:36:37
VBASE011.VDF    : 7.11.128.176     2048 Bytes  03/02/2014 15:36:37
VBASE012.VDF    : 7.11.128.177     2048 Bytes  03/02/2014 15:36:37
VBASE013.VDF    : 7.11.128.178     2048 Bytes  03/02/2014 15:36:37
VBASE014.VDF    : 7.11.129.9    211456 Bytes  04/02/2014 15:36:37
VBASE015.VDF    : 7.11.129.163   215040 Bytes  06/02/2014 15:36:38
VBASE016.VDF    : 7.11.130.21   220672 Bytes  08/02/2014 15:36:38
VBASE017.VDF    : 7.11.130.99   230400 Bytes  10/02/2014 15:36:38
VBASE018.VDF    : 7.11.130.100     2048 Bytes  10/02/2014 15:36:38
VBASE019.VDF    : 7.11.130.101     2048 Bytes  10/02/2014 15:36:38
VBASE020.VDF    : 7.11.130.102     2048 Bytes  10/02/2014 15:36:38
VBASE021.VDF    : 7.11.130.103     2048 Bytes  10/02/2014 15:36:38
VBASE022.VDF    : 7.11.130.104     2048 Bytes  10/02/2014 15:36:38
VBASE023.VDF    : 7.11.130.105     2048 Bytes  10/02/2014 15:36:38
VBASE024.VDF    : 7.11.130.106     2048 Bytes  10/02/2014 15:36:38
VBASE025.VDF    : 7.11.130.107     2048 Bytes  10/02/2014 15:36:38
VBASE026.VDF    : 7.11.130.108     2048 Bytes  10/02/2014 15:36:38
VBASE027.VDF    : 7.11.130.109     2048 Bytes  10/02/2014 15:36:38
VBASE028.VDF    : 7.11.130.110     2048 Bytes  10/02/2014 15:36:38
VBASE029.VDF    : 7.11.130.111     2048 Bytes  10/02/2014 15:36:38
VBASE030.VDF    : 7.11.130.112     2048 Bytes  10/02/2014 15:36:38
VBASE031.VDF    : 7.11.130.146   163840 Bytes  10/02/2014 15:36:39
Engine version  : 8.2.14.2  
AEVDF.DLL       : 8.1.3.4       102774 Bytes  09/12/2013 10:37:18
AESCRIPT.DLL    : 8.1.4.186     520574 Bytes  10/02/2014 15:36:41
AESCN.DLL       : 8.1.10.6      131447 Bytes  10/02/2014 15:36:41
AESBX.DLL       : 8.2.20.6     1331575 Bytes  10/02/2014 15:36:42
AERDL.DLL       : 8.2.0.138     704888 Bytes  09/12/2013 10:37:18
AEPACK.DLL      : 8.3.3.12      774521 Bytes  10/02/2014 15:36:41
AEOFFICE.DLL    : 8.1.2.76      205181 Bytes  09/12/2013 10:37:18
AEHEUR.DLL      : 8.1.4.904    6455674 Bytes  10/02/2014 15:36:41
AEHELP.DLL      : 8.1.27.10     266618 Bytes  09/12/2013 10:37:18
AEGEN.DLL       : 8.1.7.22      446839 Bytes  10/02/2014 15:36:39
AEEXP.DLL       : 8.4.1.202     434552 Bytes  10/02/2014 15:36:42
AEEMU.DLL       : 8.1.3.2       393587 Bytes  09/12/2013 10:37:18
AECORE.DLL      : 8.1.34.0      229753 Bytes  10/02/2014 15:36:39
AEBB.DLL        : 8.1.1.4        53619 Bytes  09/12/2013 10:37:18
AVWINLL.DLL     : 14.0.2.180     23608 Bytes  09/12/2013 10:37:19
AVPREF.DLL      : 14.0.2.180     48696 Bytes  09/12/2013 10:37:19
AVREP.DLL       : 14.0.2.180    175672 Bytes  09/12/2013 10:37:19
AVARKT.DLL      : 14.0.2.254    256056 Bytes  09/12/2013 10:37:18
AVEVTLOG.DLL    : 14.0.2.180    165944 Bytes  09/12/2013 10:37:18
SQLITE3.DLL     : 3.7.0.1       394808 Bytes  09/12/2013 10:37:21
AVSMTP.DLL      : 14.0.2.180     60472 Bytes  09/12/2013 10:37:19
NETNT.DLL       : 14.0.2.180     13368 Bytes  09/12/2013 10:37:20
RCIMAGE.DLL     : 14.0.2.180   4788792 Bytes  09/12/2013 10:37:21
RCTEXT.DLL      : 14.0.2.236     72760 Bytes  09/12/2013 10:37:21

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\program files\avira\antivir desktop\sysscan.avp
Reporting...........................: default
Primary action......................: Interactive
Secondary action....................: Ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:, 
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Limit recursion depth...............: 20
Smart extensions....................: on
Macrovirus heuristic................: on
File heuristic......................: extended

Start of the scan: 10 February 2014  16:54

Start scanning boot sectors:
Boot sector 'HDD0(C:, D:)'
    [INFO]      No virus was found!

Starting search for hidden objects.
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots
  [NOTE]      The registry entry is invisible.
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0MRUListEx
  [NOTE]      The registry entry is invisible.
Hidden driver
  [NOTE]      A memory modification has been detected, which could potentially be used to hide file access attempts.

The scan of running processes will be started:
Scan process 'DllHost.exe' - '22' Module(s) have been scanned
Scan process 'SearchFilterHost.exe' - '33' Module(s) have been scanned
Scan process 'SearchProtocolHost.exe' - '62' Module(s) have been scanned
Scan process 'SearchIndexer.exe' - '62' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'vssvc.exe' - '49' Module(s) have been scanned
Scan process 'avscan.exe' - '106' Module(s) have been scanned
Scan process 'avscan.exe' - '47' Module(s) have been scanned
Scan process 'avcenter.exe' - '86' Module(s) have been scanned
Scan process 'armsvc.exe' - '24' Module(s) have been scanned
Scan process 'svchost.exe' - '21' Module(s) have been scanned
Scan process 'conime.exe' - '16' Module(s) have been scanned
Scan process 'Apntex.exe' - '21' Module(s) have been scanned
Scan process 'HidFind.exe' - '23' Module(s) have been scanned
Scan process 'ApMsgFwd.exe' - '16' Module(s) have been scanned
Scan process 'taskeng.exe' - '49' Module(s) have been scanned
Scan process 'avshadow.exe' - '33' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '34' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '25' Module(s) have been scanned
Scan process 'pwsafe.exe' - '45' Module(s) have been scanned
Scan process 'ONENOTEM.EXE' - '18' Module(s) have been scanned
Scan process 'quickset.exe' - '80' Module(s) have been scanned
Scan process 'DLG.exe' - '22' Module(s) have been scanned
Scan process 'BTTray.exe' - '54' Module(s) have been scanned
Scan process 'daemon.exe' - '47' Module(s) have been scanned
Scan process 'ehmsas.exe' - '19' Module(s) have been scanned
Scan process 'ehtray.exe' - '26' Module(s) have been scanned
Scan process 'xaudio.exe' - '14' Module(s) have been scanned
Scan process 'avgnt.exe' - '77' Module(s) have been scanned
Scan process 'svchost.exe' - '25' Module(s) have been scanned
Scan process 'svchost.exe' - '44' Module(s) have been scanned
Scan process 'STacSV.exe' - '35' Module(s) have been scanned
Scan process 'SeaPort.exe' - '56' Module(s) have been scanned
Scan process 'RegSrvc.exe' - '23' Module(s) have been scanned
Scan process 'svchost.exe' - '42' Module(s) have been scanned
Scan process 'Iaantmon.exe' - '36' Module(s) have been scanned
Scan process 'sttray.exe' - '36' Module(s) have been scanned
Scan process 'hpwuschd2.exe' - '16' Module(s) have been scanned
Scan process 'PCMService.exe' - '55' Module(s) have been scanned
Scan process 'IAAnotif.exe' - '38' Module(s) have been scanned
Scan process 'igfxpers.exe' - '20' Module(s) have been scanned
Scan process 'hkcmd.exe' - '23' Module(s) have been scanned
Scan process 'OEM02Mon.exe' - '30' Module(s) have been scanned
Scan process 'Apoint.exe' - '33' Module(s) have been scanned
Scan process 'EvtEng.exe' - '88' Module(s) have been scanned
Scan process 'svchost.exe' - '30' Module(s) have been scanned
Scan process 'avguard.exe' - '94' Module(s) have been scanned
Scan process 'aestsrv.exe' - '5' Module(s) have been scanned
Scan process 'svchost.exe' - '58' Module(s) have been scanned
Scan process 'sched.exe' - '59' Module(s) have been scanned
Scan process 'taskeng.exe' - '83' Module(s) have been scanned
Scan process 'spoolsv.exe' - '90' Module(s) have been scanned
Scan process 'WLANExt.exe' - '92' Module(s) have been scanned
Scan process 'Explorer.EXE' - '136' Module(s) have been scanned
Scan process 'svchost.exe' - '94' Module(s) have been scanned
Scan process 'Dwm.exe' - '31' Module(s) have been scanned
Scan process 'svchost.exe' - '80' Module(s) have been scanned
Scan process 'SLsvc.exe' - '23' Module(s) have been scanned
Scan process 'svchost.exe' - '37' Module(s) have been scanned
Scan process 'svchost.exe' - '154' Module(s) have been scanned
Scan process 'svchost.exe' - '114' Module(s) have been scanned
Scan process 'svchost.exe' - '70' Module(s) have been scanned
Scan process 'svchost.exe' - '35' Module(s) have been scanned
Scan process 'svchost.exe' - '40' Module(s) have been scanned
Scan process 'winlogon.exe' - '30' Module(s) have been scanned
Scan process 'lsm.exe' - '22' Module(s) have been scanned
Scan process 'lsass.exe' - '60' Module(s) have been scanned
Scan process 'services.exe' - '33' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'wininit.exe' - '26' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned

Starting to scan executable files (registry):
The registry was scanned ( '1595' files ).


Starting the file scan:

Begin scan in 'C:\' <OS>
C:\Users\Leah\Videos\12 Years a Slave (2013) BRRip XviD-SV\12 Years a Slave (2013) BRRip XviD-SV.avi
  [DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
Begin scan in 'D:\' <RECOVERY>

Beginning disinfection:
C:\Users\Leah\Videos\12 Years a Slave (2013) BRRip XviD-SV\12 Years a Slave (2013) BRRip XviD-SV.avi
  [DETECTION] Contains recognition pattern of the EXP/ASF.GetCodec.Gen exploit
  [NOTE]      The file was moved to the quarantine directory under the name '5c3baf53.qua'!


End of the scan: 10 February 2014  18:41
Used time:  1:41:36 Hour(s)

The scan has been done completely.

  30791 Scanned directories
 370259 Files were scanned
      1 Viruses and/or unwanted programs were found
      0 Files were classified as suspicious
      0 Files were deleted
      0 Viruses and unwanted programs were repaired
      1 Files were moved to quarantine
      0 Files were renamed
      0 Files cannot be scanned
 370258 Files not concerned
   3986 Archives were scanned
      0 Warnings
      4 Notes
 659128 Objects were scanned with rootkit scan
      3 Hidden objects were found
         

Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org

Database version: v2014.02.10.04

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Leah :: MY-COMPUTER [administrator]

10/02/2014 18:48:07
14-02-10_Malwarebytes.txt

Scan type: Full scan (C:\|D:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 393156
Time elapsed: 1 hour(s), 50 minute(s), 53 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\dark (Trojan.Banker) -> No action taken.

Registry Values Detected: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Windows Explorer (Backdoor.Bot) -> Data: c:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\\explorer.exe -> No action taken.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
         

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 10-02-2014 01
Ran by Leah (administrator) on MY-COMPUTER on 11-02-2014 09:29:09
Running from C:\Users\Leah\Downloads
Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(Microsoft Corporation) C:\Windows\system32\SLsvc.exe
(Microsoft Corporation) C:\Windows\system32\WLANExt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Andrea Electronics Corporation) C:\Windows\system32\aestsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
(Intel Corporation) C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
(Microsoft Corporation) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
(IDT, Inc.) C:\Windows\system32\STacSV.exe
(Conexant Systems, Inc.) C:\Windows\system32\DRIVERS\xaudio.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apoint.exe
(Creative Technology Ltd.) C:\Windows\OEM02Mon.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Intel Corporation) C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
(CyberLink Corp.) C:\Program Files\Dell\MediaDirect\PCMService.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(IDT, Inc.) C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
(Intel Corporation) C:\Windows\system32\igfxsrvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Broadcom Corporation.) C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Avanquest Software ) C:\Program Files\Digital Line Detect\DLG.exe
(Dell Inc.) C:\Program Files\Dell\QuickSet\quickset.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
(SourceForge.net) C:\Program Files\Password Safe\pwsafe.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\ApMsgFwd.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\HidFind.exe
(Alps Electric Co., Ltd.) C:\Program Files\DellTPad\Apntex.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Don HO don.h@free.fr) C:\Program Files\Notepad++\notepad++.exe
(Microsoft Corporation) C:\Windows\system32\conime.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [Windows Defender] - C:\Program Files\Windows Defender\MSASCui.exe [1008184 2008-01-19] (Microsoft Corporation)
HKLM\...\Run: [ECenter] - C:\Dell\E-Center\EULALauncher.exe [17920 2007-05-25] ( )
HKLM\...\Run: [Apoint] - C:\Program Files\DellTPad\Apoint.exe [167936 2007-10-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [OEM02Mon.exe] - C:\Windows\OEM02Mon.exe [36864 2007-08-28] (Creative Technology Ltd.)
HKLM\...\Run: [DELL Webcam Manager] - C:\Program Files\Dell\Dell Webcam Manager\DellWMgr.exe [118784 2007-07-27] (Creative Technology Ltd.)
HKLM\...\Run: [IAAnotif] - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe [174872 2007-03-21] (Intel Corporation)
HKLM\...\Run: [PCMService] - C:\Program Files\Dell\MediaDirect\PCMService.exe [189736 2007-11-01] (CyberLink Corp.)
HKLM\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
HKLM\...\Run: [HP Software Update] - C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-10-28] (Hewlett-Packard)
HKLM\...\Run: [] - [X]
HKLM\...\Run: [SigmatelSysTrayApp] - C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [405504 2007-11-12] (IDT, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM\...\Run: [avgnt] - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [684600 2013-12-09] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-19\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-20\...\Run: [WindowsWelcomeCenter] - rundll32.exe oobefldr.dll,ShowWelcomeCenter
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [DellSupportCenter] - "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [ehTray.exe] - C:\Windows\ehome\ehTray.exe [125952 2008-01-19] (Microsoft Corporation)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [Windows Explorer] - c:\SYSTEM\S-3-7-89-2225458569-9856321456-454423558-8896\\explorer.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\Run: [Google Update] - C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [133104 2009-04-22] (Google Inc.)
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: F - F:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: G - G:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: H - H:\LaunchU3.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {0e7e00eb-7e3f-11dd-9c33-001e4ce0d111} - H:\LaunchU3.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {9354534d-866d-11dd-a618-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {93545352-866d-11dd-a618-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {b9c2bde6-08e9-11e3-bebe-001d093e98c4} - F:\LaunchU3.exe -a
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {ba24b8ea-82b5-11e2-aa43-001d093e98c4} - F:\setup_vmb_lite.exe /checkApplicationPresence
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {bf0648d4-7749-11dd-9c5a-001e4ce0d111} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {bfd30cf4-7aae-11dd-a31d-806e6f6e6963} - F:\AutoRun.exe
HKU\S-1-5-21-1871219732-4251423289-448879728-1000\...\MountPoints2: {c5a5d575-e94d-11dc-afe6-001e4ce0d111} - F:\LaunchU3.exe -a
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
ShortcutTarget: OneNote 2007 Screen Clipper and Launcher.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
Startup: C:\Users\Leah\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Password Safe.lnk
ShortcutTarget: Password Safe.lnk -> C:\Program Files\Password Safe\pwsafe.exe (SourceForge.net)

==================== Internet (Whitelisted) ====================

ProxyServer: proxy.dcu.ie:8080
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = hxxp://websearch.ask.com/redirect?client=ie&tb=BT5&o=15443&src=crm&q={searchTerms}&locale=en_EU&apn_ptnrs=GX&apn_dtid=YYYYYYB3IE&apn_uid=7B29C92D-8B36-4E4E-BBF9-03BF71713D7E&apn_sauid=83B80E4B-912D-4A0A-86A0-579A31F81DC8
BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
BHO: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Toolbar: HKCU - No Name - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} -  No File
Toolbar: HKCU - No Name - {21FA44EF-376D-4D53-9B0F-8A89D3229068} -  No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} -  No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default
FF DefaultSearchEngine: Bing 
FF SearchEngineOrder.1: Ask.com
FF SearchEngineOrder.3: Bing 
FF SelectedSearchEngine: Bing 
FF Homepage: https://www.google.de/?gws_rd=cr&ei=Vd34UrDfMIOktAbEhoD4Cg
FF Keyword.URL: hxxp://www.bing.com/search?FORM=UP97DF&PC=UP97&q=
FF NetworkProxy: "ftp", "proxy.dcu.ie"
FF NetworkProxy: "ftp_port", 8080
FF NetworkProxy: "gopher", "proxy.dcu.ie"
FF NetworkProxy: "gopher_port", 8080
FF NetworkProxy: "http", "proxy.dcu.ie"
FF NetworkProxy: "http_port", 8080
FF NetworkProxy: "no_proxies_on", "localho,t,127.0.0.1,*.local"
FF NetworkProxy: "share_proxy_settings", true
FF NetworkProxy: "socks", "proxy.dcu.ie"
FF NetworkProxy: "socks_port", 8080
FF NetworkProxy: "ssl", "proxy.dcu.ie"
FF NetworkProxy: "ssl_port", 8080
FF NetworkProxy: "type", 4
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_12_0_0_44.dll ()
FF Plugin: @java.com/DTPlugin - C:\Program Files\Java\jre6\bin\dtplugin\npDeployJava1.dll No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF Plugin: @microsoft.com/WPF,version=3.5 - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF Plugin: @real.com/nprpchromebrowserrecordext;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
FF Plugin: @real.com/nprphtml5videoshim;version=15.0.6.14 - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @facebook.com/FBPlugin,version=1.0.3 - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Leah\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\np-mswmp.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\amazon-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\chambers-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\eBay-en-GB.xml
FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\yahoo-en-GB.xml
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-06-10]
FF Extension: Adblock Plus - C:\Users\Leah\AppData\Roaming\Mozilla\Firefox\Profiles\iteqiltt.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-02-10]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ []
FF HKLM\...\Firefox\Extensions: [{ABDE892B-13A8-4d1b-88E6-365A6E755758}] - C:\ProgramData\RealNetworks\RealDownloader\BrowserPlugins\Firefox\Ext

Chrome: 
=======
CHR HomePage: hxxp://ie.msn.com/?pc=UP97&ocid=UP97DHP
CHR DefaultSearchKeyword: bing.com
CHR DefaultSearchProvider: Bing
CHR DefaultSearchURL: hxxp://www.bing.com/search?setmkt=en-IE&q={searchTerms}
CHR DefaultNewTabURL: 
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Leah\AppData\Local\Google\Chrome\Application\32.0.1700.107\gcswf32.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll No File
CHR Plugin: (Microsoft® Windows Media Player Firefox Plugin) - C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll (Microsoft Corporation)
CHR Plugin: (Java Deployment Toolkit 6.0.310.5) - C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U31) - C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll No File
CHR Plugin: (RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit) ) - C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll No File
CHR Plugin: (RealPlayer Download Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprpplugin.dll No File
CHR Plugin: (RealPlayer(tm) HTML5VideoShim Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll No File
CHR Plugin: (QuickTime Plug-in 7.7.2) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll No File
CHR Plugin: (RealJukebox NS Plugin) - C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll No File
CHR Plugin: (Google Talk Plugin) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll No File
CHR Plugin: (Google Talk Plugin Video Accelerator) - C:\Users\Leah\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll No File
CHR Plugin: (CANON iMAGE GATEWAY Album Plugin Utility) - C:\Program Files\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL No File
CHR Plugin: (Microsoft Office Live Plug-in for Firefox) - C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
CHR Plugin: (iTunes Application Detector) - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll No File
CHR Plugin: (RealNetworks(tm) Chrome Background Extension Plug-In (32-bit) ) - C:\ProgramData\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprpchromebrowserrecordext.dll (RealNetworks, Inc.)
CHR Plugin: (Google Update) - C:\Users\Leah\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll No File
CHR Plugin: (Facebook Plugin) - C:\Users\Leah\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll No File
CHR Plugin: (Windows Presentation Foundation) - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
CHR Extension: (Entanglement Web App) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\aciahcmjmecflokailenpkdchphgkefd [2011-02-06]
CHR Extension: (Poppit) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\mcbkbpnkkkipelfledbfocopglifcfmi [2011-02-06]
CHR Extension: (Google Wallet) - C:\Users\Leah\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-09-01]
CHR StartMenuInternet: Google Chrome - C:\Users\Leah\AppData\Local\Google\Chrome\Application\chrome.exe

========================== Services (Whitelisted) =================

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [440376 2013-12-09] (Avira Operations GmbH & Co. KG)
S4 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [1011768 2013-12-09] (Avira Operations GmbH & Co. KG)
S2 sprtsvc_dellsupportcenter; C:\Program Files\Dell Support Center\bin\sprtsvc.exe /service /p dellsupportcenter [X]

==================== Drivers (Whitelisted) ====================

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [90400 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [135648 2013-12-09] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-12-09] (Avira Operations GmbH & Co. KG)
S3 huawei_cdcacm; C:\Windows\System32\DRIVERS\ew_jucdcacm.sys [95616 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_cdcecm; C:\Windows\System32\DRIVERS\ew_jucdcecm.sys [67584 2012-06-25] (Huawei Technologies Co., Ltd.)
S3 huawei_ext_ctrl; C:\Windows\System32\DRIVERS\ew_juextctrl.sys [27520 2012-06-25] (Huawei Technologies Co., Ltd.)
S4 sptd; C:\Windows\System32\Drivers\sptd.sys [717296 2012-01-09] (Duplex Secure Ltd.)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-12-09] (Avira GmbH)
S4 blbdrive; \SystemRoot\system32\drivers\blbdrive.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 nmwcd; system32\drivers\ccdcmb.sys [X]
S3 nmwcdc; system32\drivers\ccdcmbo.sys [X]
S3 nmwcdnsu; system32\drivers\nmwcdnsu.sys [X]
S3 nmwcdnsuc; system32\drivers\nmwcdnsuc.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]
S3 PcdrNdisuio; system32\DRIVERS\pcdrndisuio.sys [X]
S3 upperdev; system32\DRIVERS\usbser_lowerflt.sys [X]
S3 USBAAPL; System32\Drivers\usbaapl.sys [X]
S3 UsbserFilt; system32\DRIVERS\usbser_lowerfltj.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-02-11 09:29 - 2014-02-11 09:29 - 00019649 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-11 09:28 - 2014-02-11 09:29 - 00000000 ____D () C:\FRST
2014-02-11 09:28 - 2014-02-11 09:28 - 01139712 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:33 - 2014-02-10 17:34 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:33 - 2013-04-04 14:50 - 00022856 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2014-02-10 17:30 - 2014-02-10 17:31 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:23 - 2014-02-10 17:24 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:34 - 2013-12-09 11:37 - 00135648 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00090400 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2014-02-10 16:34 - 2013-12-09 11:37 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:30 - 2014-02-10 16:37 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk

==================== One Month Modified Files and Folders =======

2014-02-11 09:29 - 2014-02-11 09:29 - 00019649 _____ () C:\Users\Leah\Downloads\FRST.txt
2014-02-11 09:29 - 2014-02-11 09:28 - 00000000 ____D () C:\FRST
2014-02-11 09:28 - 2014-02-11 09:28 - 01139712 _____ (Farbar) C:\Users\Leah\Downloads\FRST.exe
2014-02-11 09:27 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2014-02-11 09:27 - 2006-11-02 13:47 - 00003568 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2014-02-11 09:26 - 2006-11-02 11:33 - 00703516 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-02-11 09:24 - 2008-02-24 10:32 - 01851787 _____ () C:\Windows\WindowsUpdate.log
2014-02-11 09:21 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\AppData\Local\PasswordSafe
2014-02-11 09:20 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-02-11 09:19 - 2014-02-11 09:19 - 00000700 _____ () C:\Users\Leah\Downloads\defogger_disable.log
2014-02-11 09:19 - 2014-02-11 09:19 - 00000176 _____ () C:\Users\Leah\defogger_reenable
2014-02-11 09:19 - 2012-08-14 20:57 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-02-11 09:19 - 2008-03-03 01:26 - 00000000 ____D () C:\Users\Leah
2014-02-11 09:19 - 2008-02-24 10:33 - 00000012 _____ () C:\Windows\bthservsdp.dat
2014-02-11 09:19 - 2006-11-02 14:01 - 00032530 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-02-11 09:17 - 2014-02-11 09:17 - 00050477 _____ () C:\Users\Leah\Downloads\Defogger.exe
2014-02-10 20:44 - 2009-07-01 19:24 - 00000904 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job
2014-02-10 17:34 - 2014-02-10 17:34 - 00000908 _____ () C:\Users\Public\Desktop\Malwarebytes.lnk
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:34 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-02-10 17:34 - 2014-02-10 17:33 - 00000000 ____D () C:\Program Files\Malwarebytes' Anti-Malware
2014-02-10 17:31 - 2014-02-10 17:30 - 10285040 _____ (Malwarebytes Corporation ) C:\Users\Leah\Downloads\mbam-setup-1.75.0.1300.exe
2014-02-10 17:24 - 2014-02-10 17:23 - 00001172 _____ () C:\Users\Leah\Desktop\_Jims Documents.lnk
2014-02-10 16:50 - 2013-12-30 13:53 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-02-10 16:48 - 2008-07-10 15:51 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Skype
2014-02-10 16:45 - 2008-02-24 10:55 - 00000000 ____D () C:\ProgramData\Adobe
2014-02-10 16:44 - 2008-02-24 11:04 - 00218752 _____ () C:\Windows\PFRO.log
2014-02-10 16:37 - 2014-02-10 16:37 - 00000879 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2014-02-10 16:37 - 2014-02-10 16:37 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\ProgramData\Avira
2014-02-10 16:37 - 2014-02-10 16:30 - 00000000 ____D () C:\Program Files\Avira
2014-02-10 16:30 - 2014-02-10 16:30 - 04011240 _____ (Avira Operations GmbH & Co. KG) C:\Users\Leah\Downloads\avira_oe_client_antivirus_en.exe
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Symantec
2014-02-10 16:29 - 2011-06-21 22:59 - 00000000 ____D () C:\ProgramData\Norton
2014-02-10 16:29 - 2011-03-19 11:51 - 00001945 _____ () C:\Windows\epplauncher.mif
2014-02-10 16:22 - 2014-02-10 16:22 - 00000408 _____ () C:\Users\Leah\Desktop\Videos.lnk
2014-02-10 16:22 - 2008-03-03 19:51 - 00154112 _____ () C:\Users\Leah\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2014-02-10 16:02 - 2008-03-21 15:13 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Adobe
2014-02-10 16:01 - 2008-08-16 11:41 - 00000000 ____D () C:\Users\Leah\Documents\My Received Files
2014-02-10 15:58 - 2008-08-16 11:30 - 00000000 ____D () C:\Program Files\Windows Live
2014-02-10 15:57 - 2006-11-02 12:18 - 00000000 ____D () C:\Program Files\Common Files\microsoft shared
2014-02-10 15:56 - 2008-08-16 11:41 - 00049152 _____ () C:\Windows\DPINST.LOG
2014-02-10 15:43 - 2008-03-03 01:27 - 00060248 _____ () C:\Users\Leah\AppData\Local\GDIPFONTCACHEV1.DAT
2014-02-10 15:42 - 2008-02-24 10:55 - 00000000 ____D () C:\Program Files\Google
2014-02-10 15:42 - 2006-11-02 13:47 - 00270608 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-02-10 15:37 - 2009-11-18 15:04 - 00000000 ____D () C:\ProgramData\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Real
2014-02-10 15:37 - 2009-06-07 16:31 - 00000000 ____D () C:\Program Files\Real
2014-02-10 15:36 - 2013-08-08 19:39 - 00000000 ____D () C:\Program Files\QuickTime
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Leah\Desktop\Notepad++.lnk
2014-02-10 15:31 - 2013-10-11 13:58 - 00000862 _____ () C:\Users\Guest\Desktop\Notepad++.lnk
2014-02-10 15:26 - 2008-02-24 10:41 - 00000000 ____D () C:\Program Files\Java
2014-02-10 15:22 - 2013-01-19 13:52 - 00000000 ____D () C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-02-10 15:22 - 2008-06-12 23:00 - 00000000 ____D () C:\Program Files\Common Files\Apple
2014-02-10 15:16 - 2013-08-18 10:49 - 00000000 ____D () C:\Program Files\HP
2014-02-10 15:15 - 2012-06-07 16:01 - 00000000 ____D () C:\Program Files\Citrix
2014-02-10 15:15 - 2009-04-22 11:03 - 00000000 ____D () C:\Users\Leah\AppData\Roaming\Mozilla
2014-02-10 15:15 - 2008-03-03 01:27 - 00000000 ____D () C:\Users\Leah\AppData\Local\Google
2014-02-10 15:14 - 2009-05-26 22:31 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-02-10 15:09 - 2006-11-02 11:23 - 00000144 _____ () C:\Windows\win.ini
2014-02-10 15:06 - 2008-02-24 10:43 - 00000000 ____D () C:\Program Files\Dell
2014-02-10 14:54 - 2009-07-01 19:24 - 00000852 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job
2014-02-07 14:20 - 2013-12-16 19:10 - 00000000 ____D () C:\Users\Leah\Documents\My Safes
2014-02-07 12:41 - 2012-08-14 20:57 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-02-07 12:41 - 2012-08-14 20:57 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-02-05 17:10 - 2010-12-14 00:50 - 00002082 _____ () C:\Users\Leah\Desktop\Google Chrome.lnk
2014-02-05 16:19 - 2012-05-22 11:44 - 00000000 ____D () C:\Program Files\Common Files\Symantec Shared
2014-02-05 15:58 - 2008-09-09 08:18 - 00005648 _____ () C:\Users\Leah\AppData\Local\d3d9caps.dat
2014-02-03 21:34 - 2010-12-13 23:13 - 00000000 ____D () C:\ProgramData\PCDr
2014-02-03 21:30 - 2014-02-03 21:30 - 00000946 _____ () C:\Users\Leah\Desktop\Windows Media Player.lnk
2014-02-03 20:44 - 2006-11-02 13:52 - 00235301 _____ () C:\Windows\setupact.log
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ___RD () C:\Program Files\Skype
2014-01-19 15:28 - 2008-07-10 15:50 - 00000000 ____D () C:\ProgramData\Skype
2014-01-19 08:32 - 2010-02-01 11:08 - 00231584 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-01-17 18:59 - 2008-02-24 10:52 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-01-17 18:58 - 2013-08-15 11:13 - 00000000 ____D () C:\Windows\system32\MRT
2014-01-17 18:55 - 2006-11-02 11:24 - 83425928 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe

Some content of TEMP:
====================
C:\Users\Guest\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Leah\AppData\Local\Temp\.gbas.dll
C:\Users\Leah\AppData\Local\Temp\AdobeUpdater12345.exe
C:\Users\Leah\AppData\Local\Temp\AskInstallChecker.exe
C:\Users\Leah\AppData\Local\Temp\avgnt.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate01.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate02.exe
C:\Users\Leah\AppData\Local\Temp\FlashPlayerUpdate03.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u17-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u19-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u20-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u21-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u22-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u31-windows-i586-iftw-rv.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u33-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\jre-7u9-windows-i586-iftw.exe
C:\Users\Leah\AppData\Local\Temp\lowproc.exe
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{5D15CCF0-4C97-4a47-BCF5-08A11A9CD40D}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{9BFE0D57-FD50-4a53-A826-91EA55449E63}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{A4CDF389-D003-47d1-AC47-2DBFBF94C119}.dll
C:\Users\Leah\AppData\Local\Temp\mpeg2lib_{A7808FEE-F897-49f6-BB6C-FE4BD5DAA9BD}.dll
C:\Users\Leah\AppData\Local\Temp\MSETUP4.EXE
C:\Users\Leah\AppData\Local\Temp\MSN623D.exe
C:\Users\Leah\AppData\Local\Temp\NEventMessages.dll
C:\Users\Leah\AppData\Local\Temp\npp.6.5.2.Installer.exe
C:\Users\Leah\AppData\Local\Temp\SearchWithGoogleUpdate.exe
C:\Users\Leah\AppData\Local\Temp\SkypeSetup.exe
C:\Users\Leah\AppData\Local\Temp\stubhelper.dll
C:\Users\Leah\AppData\Local\Temp\swt-awt-win32-3346.dll
C:\Users\Leah\AppData\Local\Temp\swt-win32-3346.dll
C:\Users\Leah\AppData\Local\Temp\wlsetup-cvr.exe
C:\Users\Leah\AppData\Local\Temp\xmlUpdater.exe


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-02-11 09:26

==================== End Of Log ============================
         

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 10-02-2014 01
Ran by Leah at 2014-02-11 09:29:38
Running from C:\Users\Leah\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: Avira Desktop (Enabled - Up to date) {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
AS: Avira Desktop (Enabled - Up to date) {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

 Update for Microsoft Office 2007 (KB2508958) (Version:  - Microsoft)
Adobe Flash Player 12 ActiveX (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Flash Player 12 Plugin (Version: 12.0.0.44 - Adobe Systems Incorporated)
Adobe Reader X (10.1.9) (Version: 10.1.9 - Adobe Systems Incorporated)
Advanced Audio FX Engine (Version:  - )
Advanced Video FX Engine (Version:  - )
Avira Free Antivirus (Version: 14.0.2.286 - Avira)
Conexant HDA D330 MDC V.92 Modem (Version:  - )
Dell Getting Started Guide (Version: 1.00.0000 - Dell Inc.)
Dell Touchpad (Version: 7.1.103.4 - Alps Electric)
Dell Webcam Center (Version:  - )
Dell Webcam Manager (Version:  - )
Digital Line Detect (Version: 1.21 - BVRP Software, Inc)
Google Chrome (HKCU Version: 32.0.1700.107 - Google Inc.)
Highlight Viewer (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
HP Update (Version: 5.003.003.001 - Hewlett-Packard)
Intel(R) Matrix Storage Manager (Version:  - )
Intel(R) PROSet/Wireless Software (Version: 11.01.0000 - Intel Corporation)
Iomega Product Registration (Version: 7.24.0000 - Iomega Corporation)
Laptop Integrated Webcam Driver (1.04.01.1011)   (Version:  - )
Live! Cam Avatar Creator (Version: 4.6.0817.1 - Creative Technology Ltd.)
Live! Cam Avatar v1.0 (Version: 1.0 - Creative Technology Ltd.)
Malwarebytes Anti-Malware version 1.75.0.1300 (Version: 1.75.0.1300 - Malwarebytes Corporation)
mCore (Version: 9.24.0000 - Intel Corporation) Hidden
MediaDirect (Version: 3.5 - Dell)
mHelp (Version: 9.24.0000 - Intel) Hidden
Microsoft .NET Framework 3.5 SP1 (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (Version: 3.5.30729 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30319 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft Office 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Excel MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Live Add-in 1.5 (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office OneNote MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint Viewer 2007 (English) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Proof (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Spanish) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3) (Version:  - Microsoft) Hidden
Microsoft Office Shared MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (English) 2007 (Version: 12.0.6612.1000 - Microsoft Corporation) Hidden
Microsoft Search Enhancement Pack (Version: 3.0.133.0 - Microsoft Corporation) Hidden
Microsoft Silverlight (Version: 5.1.20913.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (Version: 10.0.40219 - Microsoft Corporation)
mMHouse (Version: 9.24.0000 - Intel Corporation) Hidden
Modem Diagnostic Tool (Version: 1.0.20.0 - Dell)
Mozilla Firefox 26.0 (x86 en-GB) (Version: 26.0 - Mozilla)
Mozilla Maintenance Service (Version: 26.0 - Mozilla)
mPfMgr (Version: 9.24.0000 - Intel Corporation) Hidden
MSVC80_x86 (Version: 1.0.1.0 - Nokia) Hidden
MSXML 4.0 SP2 (KB927978) (Version: 4.20.9841.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB954430) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (Version: 4.20.9876.0 - Microsoft Corporation)
mWMI (Version: 9.24.0000 - Intel Corporation) Hidden
My Dell (Version: 3.4.6422.14 - PC-Doctor, Inc.)
NetWaiting (Version: 2.5.44 - BVRP Software, Inc)
Notepad++ (Version: 6.5.2 - Notepad++ Team)
OGA Notifier 2.0.0048.0 (Version: 2.0.0048.0 - Microsoft Corporation) Hidden
OutlookAddinSetup (Version: 1.0.0 - CyberLink)
Password Safe (Version:  - )
PC Connectivity Solution (Version: 10.18.0.0 - Nokia)
QuickSet (Version: 8.2.17 - Dell Inc.)
Roxio Creator Audio (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Copy (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Data (Version: 3.7.0 - Roxio) Hidden
Roxio Creator DE (Version: 10.1 - )
Roxio Creator DE (Version: 3.7.0 - Roxio) Hidden
Roxio Creator Tools (Version: 3.7.0 - Roxio) Hidden
Roxio Express Labeler 3 (Version: 3.2.1 - Roxio) Hidden
Roxio Update Manager (Version: 6.0.0 - Roxio) Hidden
Skype Toolbars (Version: 5.0.4137 - Skype Technologies S.A.)
Skype™ 6.11 (Version: 6.11.102 - Skype Technologies S.A.)
Smart Menus (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
Update for 2007 Microsoft Office System (KB967642) (Version:  - Microsoft)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939) (Version: 1 - Microsoft Corporation)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3) (Version: 3 - Microsoft Corporation)
Update for Microsoft Office 2007 Help for Common Features (KB963673) (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2596620) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2687493) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767849) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office 2007 suites (KB2767916) 32-Bit Edition (Version:  - Microsoft)
Update for Microsoft Office Excel 2007 Help (KB963678) (Version:  - Microsoft)
Update for Microsoft Office OneNote 2007 Help (KB963670) (Version:  - Microsoft)
Update for Microsoft Office Powerpoint 2007 Help (KB963669) (Version:  - Microsoft)
Update for Microsoft Office Script Editor Help (KB963671) (Version:  - Microsoft)
Update for Microsoft Office Word 2007 Help (KB963665) (Version:  - Microsoft)
User's Guides (Version:  - )
WIDCOMM Bluetooth Software 6.0.1.3100 (Version: 6.0.1.3100 - Dell)
Windows Live Toolbar Extension (Windows Live Toolbar) (Version: 03.01.0146 - Microsoft Corporation) Hidden
Windows Media Player Firefox Plugin (Version: 1.0.0.8 - Microsoft Corp)

==================== Restore Points  =========================

05-01-2014 14:54:02 Windows Update
08-01-2014 11:36:51 Scheduled Checkpoint
17-01-2014 12:23:01 Windows Update
17-01-2014 17:54:44 Windows Update
19-01-2014 15:42:00 Removed HP Deskjet 1000 J110 series Basic Device Software
26-01-2014 17:15:22 Windows Update
27-01-2014 19:34:24 Scheduled Checkpoint
31-01-2014 13:01:03 Windows Update
01-02-2014 18:05:14 Scheduled Checkpoint
03-02-2014 17:31:29 Windows Update
05-02-2014 15:28:25 Scheduled Checkpoint
07-02-2014 11:53:32 Windows Update
10-02-2014 13:53:20 Removed Apple Application Support
10-02-2014 13:55:23 Removed Apple Mobile Device Support
10-02-2014 13:56:46 Removed Apple Software Update
10-02-2014 13:58:39 Removed Bonjour
10-02-2014 14:01:19 Windows Update
10-02-2014 14:06:09 Removed Browser Address Error Redirector.
10-02-2014 14:06:24 Removed Bonjour
10-02-2014 14:12:27 Removed Feedback Tool
10-02-2014 14:15:01 Removed Google Talk Plugin
10-02-2014 14:15:49 Removed HP Deskjet 1000 J110 series Basic Device Software
10-02-2014 14:17:13 Removed HP Deskjet 1000 J110 series Help
10-02-2014 14:18:30 Removed iTunes
10-02-2014 14:22:22 Removed Java 7 Update 45
10-02-2014 14:23:47 Removed Java(TM) 6 Update 35
10-02-2014 14:25:04 Removed Java(TM) SE Runtime Environment 6
10-02-2014 14:26:46 Removido Miniaurélio
10-02-2014 14:34:13 Removed QuickTime
10-02-2014 14:38:10 Removed Retrospect 7.5
10-02-2014 14:40:09 Removed Skype Toolbars
10-02-2014 14:47:17 Removed Feedback Tool
10-02-2014 14:48:33 Removed Skype Toolbars
10-02-2014 14:53:22 Removed Spelling Dictionaries Support For Adobe Reader 8
10-02-2014 14:56:51 Windows Live Essentials
10-02-2014 14:58:28 Removed Windows Live Favorites for Windows Live Toolbar

==================== Hosts content: ==========================

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {06DBA3A5-144B-4A03-9521-7CC720DE6165} - System32\Tasks\{E72283E4-1774-42B8-B8FF-304A4E5DA9B8} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {0C003265-4905-48AB-BEDC-510CC00AF517} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22] (Google Inc.)
Task: {0EE9C2FC-7C71-4D55-8B83-429FBF2A5AE3} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-12-07] (PC-Doctor, Inc.)
Task: {1CC81347-6204-4B83-900C-01E02F50F067} - System32\Tasks\Microsoft\Windows\MobilePC\TMM
Task: {1E80B85F-473D-4157-BDD5-21ED0AD186A7} - System32\Tasks\Microsoft\Windows\NetworkAccessProtection\NAPStatus UI
Task: {2D63378D-EE90-4DE4-BE6C-52705345E0AC} - System32\Tasks\SystemToolsDailyTest => uaclauncher.exe
Task: {2FF92470-CDA0-4AE6-9506-AA6CE98C6EFD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-02-07] (Adobe Systems Incorporated)
Task: {3BCDF251-CA5C-4045-A1FC-8FCEF9FBDC93} - System32\Tasks\Microsoft\Windows\Shell\CrawlStartPages
Task: {44980BEE-7809-44A9-AC24-D6E578A3B7DF} - System32\Tasks\Microsoft\Windows\RAC\RACAgent => C:\Windows\system32\RacAgent.exe [2008-01-19] (Microsoft Corporation)
Task: {44F1C48E-75D3-409A-B6DC-78643828A7C4} - System32\Tasks\RealUpgradeLogonTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {5FD0005F-67BE-4377-993A-3164E355E880} - System32\Tasks\Microsoft\Windows\WindowsCalendar\Reminders - Leah => C:\Program Files\Windows Calendar\WinCal.exe [2009-04-11] (Microsoft Corporation)
Task: {62ED58DC-65F8-4EB2-AB4B-8D55875A1A93} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe [2009-04-22] (Google Inc.)
Task: {77F6DEAA-077F-4A8E-A989-710146F9603F} - System32\Tasks\{86F4E43F-1BBB-4F2B-A302-E694F21AC20E} => C:\Program Files\Skype\Phone\Skype.exe [2013-11-14] (Skype Technologies S.A.)
Task: {B43B4946-2DF2-424B-978F-09723934A10A} - System32\Tasks\RealUpgradeScheduledTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {C0E06D20-DE13-4D4E-A4C8-B5AE08EA3332} - System32\Tasks\RealPlayerRealUpgradeScheduledTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {D5B7A726-E835-4C53-8922-443BBADAF95B} - System32\Tasks\Microsoft\Windows\Tcpip\WSHReset => C:\Windows\system32\netsh.exe [2006-11-02] (Microsoft Corporation)
Task: {D68D82DB-ED91-44FE-8A48-7B95C5CB7BCA} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-09-06] (PC-Doctor, Inc.)
Task: {DF32DA4A-B92B-4F92-9A9A-FC9D603347B9} - System32\Tasks\RealPlayerRealUpgradeLogonTaskS-1-5-21-1871219732-4251423289-448879728-1000 => C:\Program Files\Real\RealUpgrade\RealUpgrade.exe
Task: {E5150B95-F9B4-4D5D-95A2-7EC1ACBA95F8} - System32\Tasks\Microsoft\Windows\Wireless\GatherWirelessInfo => C:\Windows\system32\gatherWirelessInfo.vbs [2008-01-05] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000Core.job => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1871219732-4251423289-448879728-1000UA.job => C:\Users\Leah\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-06-18 16:24 - 2012-06-18 16:24 - 00260096 _____ () C:\Program Files\Notepad++\NppShell_05.dll
2006-11-03 18:46 - 2006-11-03 18:46 - 00126976 _____ () C:\Program Files\WIDCOMM\Bluetooth Software\btkeyind.dll
2008-02-24 18:26 - 2007-12-15 04:54 - 00249856 _____ () C:\Windows\system32\igfxTMM.dll
2006-11-03 18:25 - 2006-11-03 18:25 - 00389120 _____ () C:\Windows\system32\btwhidcs.DLL
2013-12-30 13:46 - 2013-12-05 20:36 - 03559024 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll
2011-07-18 22:07 - 2011-07-18 22:07 - 00014336 _____ () C:\Program Files\Notepad++\plugins\NppExport.dll
2011-09-21 21:46 - 2011-09-21 21:46 - 01673728 _____ () C:\Program Files\Notepad++\plugins\NppFTP.dll

==================== Alternate Data Streams (whitelisted) =========


==================== Safe Mode (whitelisted) ===================

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys => ""="Driver"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wdf01000.sys => ""="Driver"

==================== Disabled items from MSCONFIG ==============


==================== Faulty Device Manager Devices =============


==================== Event log errors: =========================

Application errors:
==================
Error: (02/10/2014 04:27:36 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS\FAVORITES> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog


Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (02/10/2014 04:27:36 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS\FAVORITES> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog


Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (02/10/2014 04:27:35 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog


Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (02/10/2014 04:27:35 PM) (Source: Windows Search Service) (User: )
Description: The entry <C:\USERS\LEAH\DESKTOP\LEAH\ALL DESKTOP FOLDERS> in the hash map cannot be updated.

Context:  Application, SystemIndex Catalog


Details:
	A device attached to the system is not functioning.   (0x8007001f)

Error: (02/10/2014 03:56:50 PM) (Source: VSS) (User: )
Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface.  hr = 0x80070005.
This is often caused by incorrect security settings in either the writer or requestor process.


Operation:
   Gathering Writer Data

Context:
   Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}
   Writer Name: System Writer
   Writer Instance ID: {dd9e3a75-a637-4f9d-b74c-502f538b2fed}

Error: (02/10/2014 03:49:29 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Skype Toolbars -- The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2738. The arguments are: , ,

Error: (02/10/2014 03:40:22 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Skype Toolbars -- The installer has encountered an unexpected error installing this package. This may indicate a problem with this package. The error code is 2738. The arguments are: , ,

Error: (02/10/2014 03:39:40 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Roxio Update Manager -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: DWUS_Unregister.C3A146F5_4B48_11D5_A819_00B0D0428C0C, location: C:\Program Files\Common Files\InstallShield\UpdateService\, command: C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe /u{30465B6C-B53F-49A1-9EBA-A3F187AD502E}

Error: (02/10/2014 03:39:23 PM) (Source: MsiInstaller) (User: My-Computer)
Description: Product: Roxio Update Manager -- Error 1721. There is a problem with this Windows Installer package. A program required for this install to complete could not be run. Contact your support personnel or package vendor. Action: DWUS_Unregister.C3A146F5_4B48_11D5_A819_00B0D0428C0C, location: C:\Program Files\Common Files\InstallShield\UpdateService\, command: C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe /u{30465B6C-B53F-49A1-9EBA-A3F187AD502E}

Error: (02/10/2014 03:37:58 PM) (Source: Microsoft-Windows-RestartManager) (User: My-Computer)
Description: 0rndlresolversvc.exeRealNetworks Downloader Resolver Service03026217828200


System errors:
=============
Error: (02/11/2014 09:21:49 AM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/11/2014 09:21:49 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/11/2014 08:50:33 AM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/11/2014 08:50:33 AM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/10/2014 04:50:10 PM) (Source: Service Control Manager) (User: )
Description: Windows Search%%1053

Error: (02/10/2014 04:50:10 PM) (Source: Service Control Manager) (User: )
Description: 30000Windows Search

Error: (02/10/2014 04:50:10 PM) (Source: DCOM) (User: )
Description: 1053WSearch{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}

Error: (02/10/2014 04:45:35 PM) (Source: Service Control Manager) (User: )
Description: SupportSoft Sprocket Service (dellsupportcenter)%%2

Error: (02/10/2014 04:45:35 PM) (Source: Service Control Manager) (User: )
Description: Parallel port driver%%1058

Error: (02/10/2014 03:57:04 PM) (Source: Service Control Manager) (User: )
Description: Windows Search%%1053


Microsoft Office Sessions:
=========================
Error: (12/05/2009 04:42:08 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.6500.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 6 seconds with 0 seconds of active time.  This session ended with a crash.

Error: (08/10/2009 07:20:47 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7308 seconds with 4920 seconds of active time.  This session ended with a crash.

Error: (07/25/2009 05:46:00 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 15612 seconds with 7080 seconds of active time.  This session ended with a crash.

Error: (07/09/2009 09:45:54 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 4397 seconds with 1500 seconds of active time.  This session ended with a crash.

Error: (06/22/2009 00:51:51 AM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.6504.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 31569 seconds with 3540 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-02-10 20:38:33.825
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:33.544
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:33.248
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.967
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.671
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:38:32.374
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\winsxs\x86_microsoft-windows-securestartup-core_31bf3856ad364e35_6.0.6000.16386_none_32a3e3ecf533e7fe\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:32.585
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:32.304
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:31.992
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.

  Date: 2014-02-10 20:35:31.711
  Description: Code Integrity is unable to verify the image integrity of the file \Device\HarddiskVolume2\Windows\System32\fveapi.dll because the set of per-page image hashes could not be found on the system.


==================== Memory info =========================== 

Percentage of memory in use: 44%
Total physical RAM: 3061.31 MB
Available physical RAM: 1698.58 MB
Total Pagefile: 6326.89 MB
Available Pagefile: 4830.39 MB
Total Virtual: 2047.88 MB
Available Virtual: 1897.41 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:220.29 GB) (Free:110.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (RECOVERY) (Fixed) (Total:10 GB) (Free:5.39 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 233 GB) (Disk ID: 88000000)
Partition 1: (Not Active) - (Size=94 MB) - (Type=DE)
Partition 2: (Not Active) - (Size=10 GB) - (Type=07 NTFS)
Partition 3: (Active) - (Size=220 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=3 GB) - (Type=OF Extended)

==================== End Of Log ============================