| ayrtonsenna | 21.08.2013 06:42 |
Code:
SETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=383f4c64946689488c00dd87160759f5
# engine=14839
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=false
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2013-08-21 12:01:06
# local_time=2013-08-21 02:01:06 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7600 NT
# compatibility_mode=3591 16777213 100 91 399189 139639851 0 0
# compatibility_mode=5893 16776574 100 94 141304 128673116 0 0
# scanned=610853
# found=10
# cleaned=0
# scan_time=41952
sh=FDCDA02C55AD075BF48E8CCC6300CFE06B1ECE41 ft=0 fh=0000000000000000 vn="multiple threats" ac=I fn="C:\Users\ayrtonsenna\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\25\7deb1f19-2adefc19"
sh=32AC72466374706A4C49C8204072D9FD867E8819 ft=1 fh=82232db6af9a4275 vn="multiple threats" ac=I fn="I:\Appsler_HTC_samsung\Samsung\9100\vlc-1.1.1.exe"
sh=1D435CA0C4BA455742225989F95CC529198E86DB ft=1 fh=946105595146a1d1 vn="Win32/StartPage.OIE trojan" ac=I fn="I:\download\vlc-1.1.9-win32.exe"
sh=32AC72466374706A4C49C8204072D9FD867E8819 ft=1 fh=82232db6af9a4275 vn="multiple threats" ac=I fn="I:\Downloads\vlc-1.1.1.exe"
sh=CA5FBAEFE7F0923A65CA47B86013D7ED9AEBBF2F ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.AK trojan" ac=I fn="I:\efekadirden\Appsler_HTC_samsung\Samsung\S9000\Exploits\psneuter"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="Win32/Viking.BT virus" ac=I fn="I:\pencereler_yediler_Vs\winiso\yedimultidegistirildi\MLW7199.iso"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="Win32/Viking.BT virus" ac=I fn="I:\pencereler_yediler_Vs\winiso\yedimultidegistirildi\MLW77.iso"
sh=0000000000000000000000000000000000000000 ft=- fh=0000000000000000 vn="Win32/Viking.BT virus" ac=I fn="I:\pencereler_yediler_Vs\winiso\Yedi_multi_dil\MLW7199.iso"
sh=CA5FBAEFE7F0923A65CA47B86013D7ED9AEBBF2F ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.AK trojan" ac=I fn="I:\verbatimden\efe_kadir\1 NTFS_010\Appsler_HTC_samsung\Samsung\S9000\Exploits\psneuter"
sh=CA5FBAEFE7F0923A65CA47B86013D7ED9AEBBF2F ft=0 fh=0000000000000000 vn="Android/Exploit.Lotoor.AK trojan" ac=I fn="I:\verbatimden\efe_kadir\1 NTFS_013\Appsler_HTC_samsung\Samsung\S9000\Exploits\psneuter"
Code:
Results of screen317's Security Check version 0.99.72
Windows 7 x64 (UAC is disabled!)
Out of date service pack!!
Internet Explorer 10
``````````````Antivirus/Firewall Check:``````````````
Norton Internet Security
WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
Malwarebytes Anti-Malware Version 1.75.0.1300
Java 7 Update 21
Java version out of Date!
Adobe Flash Player 11.8.800.94
Adobe Reader 10.1.7 Adobe Reader out of Date!
Mozilla Firefox (23.0.1)
Mozilla Thunderbird (17.0.8)
Google Chrome 28.0.1500.72
Google Chrome 28.0.1500.95
````````Process Check: objlist.exe by Laurent````````
Norton ccSvcHst.exe
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````
FRST Logfile:
FRST Logfile: Code:
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-08-2013
Ran by ayrtonsenna (administrator) on 21-08-2013 07:41:21
Running from C:\Users\ayrtonsenna\Desktop
Windows 7 Ultimate (X64) OS Language: German Standard
Internet Explorer Version 9
Boot Mode: Normal
==================== Processes (Whitelisted) =================
(AMD) C:\Windows\system32\atiesrxx.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\logishrd\LVMVFM\UMVPFSrv.exe
(AMD) C:\Windows\system32\atieclxx.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
() C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe
(CyberLink) C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe
(Acresso Corporation) C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe
(Skype Technologies S.A.) C:\Program Files (x86)\Skype\Phone\Skype.exe
() C:\Program Files (x86)\i-Funbox DevTeam\ifb_conn.exe
() C:\Program Files (x86)\EZ-RC\ez-rc-tray.exe
(PowerISO Computing, Inc.) C:\Program Files (x86)\PowerISO\PWRISOVM.EXE
(Nero AG) C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
(CyberLink Corp.) C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe
() C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
(Hewlett-Packard Company) C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
(Logitech Inc.) C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Logitech Inc.) C:\Program Files (x86)\Common Files\LogiShrd\LVMVFM\LVPrS64H.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe
(Pandora.TV) C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfPro5Hook.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Nullsoft, Inc.) C:\Program Files (x86)\Winamp\winampa.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Nuance Communications, Inc.) C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe
() C:\Program Files\CyberLink\Shared files\RichVideo64.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
() C:\Program Files (x86)\Common Files\Logishrd\LQCVFX\COCIManager.exe
(Rocket Division Software) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe
(VMware, Inc.) C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\TeamViewer.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_w32.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version8\tv_x64.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_8_800_94.exe
==================== Registry (Whitelisted) ==================
HKLM\...\Run: [BCSSync] - C:\Program Files\Microsoft Office\Office14\BCSSync.exe [112512 2010-03-13] (Microsoft Corporation)
HKLM\...\Run: [Ocs_SM] - C:\Users\ayrtonsenna\AppData\Roaming\OCS\SM\SearchAnonymizer.exe [x]
HKCU\...\Run: [AlcoholAutomount] - C:\Program Files (x86)\Alcohol Soft\Alcohol 120\axcmd.exe [205976 2009-09-18] (Alcohol Soft Development Team)
HKCU\...\Run: [LightScribe Control Panel] - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe [2363392 2009-06-17] (Hewlett-Packard Company)
HKCU\...\Run: [ISUSPM] - C:\ProgramData\FLEXnet\Connect\11\ISUSPM.exe [222496 2009-05-05] (Acresso Corporation)
HKCU\...\Run: [Facebook Update] - C:\Users\ayrtonsenna\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-07-06] (Facebook Inc.)
HKCU\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [19875432 2013-06-21] (Skype Technologies S.A.)
HKCU\...\Run: [iFunBoxConnector] - C:\Program Files (x86)\i-Funbox DevTeam\ifb_conn.exe [812544 2012-11-20] ()
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [PWRISOVM.EXE] - C:\Program Files (x86)\PowerISO\PWRISOVM.EXE [180224 2009-07-27] (PowerISO Computing, Inc.)
HKLM-x32\...\Run: [NBAgent] - C:\Program Files (x86)\Nero\Nero 10\Nero BackItUp\NBAgent.exe [1234216 2010-04-03] (Nero AG)
HKLM-x32\...\Run: [vmware-tray] - C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [129584 2010-09-21] (VMware, Inc.)
HKLM-x32\...\Run: [RemoteControl11] - C:\Program Files (x86)\CyberLink\PowerDVD11\PDVD11Serv.exe [230696 2011-08-24] (CyberLink Corp.)
HKLM-x32\...\Run: [APSDaemon] - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM-x32\...\Run: [LogitechQuickCamRibbon] - C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe [2793304 2009-10-14] ()
HKLM-x32\...\Run: [StartCCC] - C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641704 2012-06-11] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [MPlayerForWindows_UpdateReminder] - C:\Program Files (x86)\MPlayer für Windows\AutoUpdate.exe [235002 2011-06-09] ()
HKLM-x32\...\Run: [] - [x]
HKLM-x32\...\Run: [IndexSearch] - C:\Program Files (x86)\Nuance\PaperPort\IndexSearch.exe [46368 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PaperPort PTD] - C:\Program Files (x86)\Nuance\PaperPort\pptd40nt.exe [29984 2010-03-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PPort12reminder] - C:\Program Files (x86)\Nuance\PaperPort\Ereg\Ereg.exe [328992 2010-02-09] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDFHook] - C:\Program Files (x86)\Nuance\PDF Viewer Plus\pdfpro5hook.exe [636192 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [PDF5 Registry Controller] - C:\Program Files (x86)\Nuance\PDF Viewer Plus\RegistryController.exe [62752 2010-03-05] (Nuance Communications, Inc.)
HKLM-x32\...\Run: [ControlCenter4] - C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [139264 2011-04-20] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] - C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [2629632 2010-12-23] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [253816 2013-03-12] (Oracle Corporation)
HKLM-x32\...\Run: [WinampAgent] - C:\Program Files (x86)\Winamp\winampa.exe [74752 2012-06-20] (Nullsoft, Inc.)
HKLM-x32\...\Run: [iTunesHelper] - C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2013-05-31] (Apple Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\EZ-RC System Tray.lnk
ShortcutTarget: EZ-RC System Tray.lnk -> C:\Program Files (x86)\EZ-RC\ez-rc-tray.exe ()
Startup: C:\Users\ayrtonsenna\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Turkcell 3G VINN.lnk
ShortcutTarget: Turkcell 3G VINN.lnk -> C:\Program Files (x86)\Turkcell\Turkcell 3G VINN\Turkcell 3G VINN.exe (Turkcell Teknoloji)
==================== Internet (Whitelisted) ====================
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.symantec.com/redirects/security_response/fix_homepage/index.jsp?lg=de&pid=NIS&pvid=20.3.0.36
HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - DefaultScope value is missing.
BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: PlusIEEventHelper Class - {551A852F-39A6-44A7-9C13-AFBEC9185A9D} - C:\Program Files (x86)\Nuance\PDF Viewer Plus\Bin\PlusIEContextMenu.dll (Zeon Corporation)
BHO-x32: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
BHO-x32: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~4\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~4\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Winsock: Catalog9 11 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346672] (VMware, Inc.)
Winsock: Catalog9 12 C:\Program Files (x86)\VMware\VMware Workstation\vsocklib.dll [346672] (VMware, Inc.)
Winsock: Catalog9-x64 11 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446512] (VMware, Inc.)
Winsock: Catalog9-x64 12 C:\Program Files (x86)\VMware\VMware Workstation\x64\vsocklib.dll [446512] (VMware, Inc.)
Tcpip\..\Interfaces\{D7BCC13E-14D1-4A28-9863-451F9C086F1B}: [NameServer]192.168.0.1
FireFox:
========
FF ProfilePath: C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default
FF Homepage: hxxp://beceriksizler.beep.to/forum.php|hxxp://www.ulusalkanal.com.tr/|hxxp://www.sat-ulc.eu/index.php|hxxp://www.odatv.com/
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_11_8_800_94.dll ()
FF Plugin: @java.com/JavaPlugin - C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @java.com/DTPlugin,version=10.21.2 - C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.21.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3555.0308 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\ayrtonsenna\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF Extension: Default Manager - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\DefaultManager@Microsoft
FF Extension: FT SleekDark - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\{a21cd440-41d6-11e0-9207-0800200c9a66}
FF Extension: Green-Fox - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\Green-Fox@loic.com.xpi
FF Extension: nasanightlaunch - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\nasanightlaunch@example.com.xpi
FF Extension: utopia_ffse_white_options - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\utopia_ffse_white_options@www.theme-oasis.org.xpi
FF Extension: No Name - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\{20C3BDFF-DA68-468d-8D9A-F5A6C76B0F9E}.xpi
FF Extension: No Name - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\{535531f0-c4f8-11df-851a-0800200c9a66}.xpi
FF Extension: No Name - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\{6C4BAFB6-2AC2-4405-A98D-546B55B3AE92}.xpi
FF Extension: No Name - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\{c7b3cf78-9cbc-47b9-ba47-bb84a56069dd}.xpi
FF Extension: No Name - C:\Users\ayrtonsenna\AppData\Roaming\Mozilla\Firefox\Profiles\lb7m3u3d.default\Extensions\{f36c6cd1-da73-491d-b290-8fc9115bfa55}.xpi
FF Extension: No Name - C:\Program Files (x86)\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
FF Extension: Java Console - C:\Program Files (x86)\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
FF Extension: Default - C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF HKLM-x32\...\Firefox\Extensions: [fmconverter@gmail.com] C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF Extension: Freemake Video Converter Plugin - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Firefox\
FF HKLM-x32\...\Firefox\Extensions: [{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\
FF Extension: Norton Toolbar - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\coFFPlgn\
FF HKLM-x32\...\Firefox\Extensions: [{BBDA0591-3099-440a-AA10-41764D9DB4DB}] C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFFPlgn\
FF Extension: Norton Vulnerability Protection - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\IPSFFPlgn\
Chrome:
=======
CHR HKLM-x32\...\Chrome\Extension: [jbolfgndggfhhpbnkgnpjkfhinclbigj] - C:\Program Files (x86)\Freemake\Freemake Video Converter\BrowserPlugin\Chrome\Freemake.Plugin.Chrome.crx
CHR HKLM-x32\...\Chrome\Extension: [mkfokfffehpeedafpekjeddnmnjhmcmk] - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\Exts\Chrome.crx
==================== Services (Whitelisted) =================
R2 CLHNServiceForPowerDVD; C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\CLHNServiceForPowerDVD.exe [83240 2011-08-24] ()
R2 CyberLink PowerDVD 11.0 Monitor Service; C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSMonitorService.exe [75048 2011-09-02] (CyberLink)
R2 CyberLink PowerDVD 11.0 Service; C:\Program Files (x86)\CyberLink\PowerDVD11\Common\MediaServer\CLMSServerForPDVD11.exe [292136 2011-09-02] (CyberLink)
S2 Freemake Improver; C:\ProgramData\Freemake\FreemakeUtilsService\FreemakeUtilsService.exe [101888 2013-06-13] (Freemake)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation)
R2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe [144368 2013-05-21] (Symantec Corporation)
R2 PanService; C:\Program Files (x86)\PANDORA.TV\PanService\PandoraService.exe [625816 2012-06-22] (Pandora.TV)
R2 PDFProFiltSrvPP; C:\Program Files (x86)\Nuance\PaperPort\PDFProFiltSrvPP.exe [144672 2010-03-09] (Nuance Communications, Inc.)
R2 RichVideo64; C:\Program Files\CyberLink\Shared files\RichVideo64.exe [386344 2010-08-19] ()
R2 StarWindServiceAE; C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software)
S4 TlntSvr; C:\Windows\System32\tlntsvr.exe [81920 2009-07-14] (Microsoft Corporation)
S3 ufad-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vmware-ufad.exe [191024 2010-08-19] (VMware, Inc.)
S2 BstHdAndroidSvc; "C:\Program Files (x86)\BlueStacks\HD-Service.exe" BstHdAndroidSvc Android [x]
S2 BstHdLogRotatorSvc; C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe [x]
==================== Drivers (Whitelisted) ====================
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-07-15] (Symantec Corporation)
R1 BHDrvx64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\BASHDefs\20130715.001\BHDrvx64.sys [1393240 2013-07-15] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1404000.028\ccSetx64.sys [169048 2013-04-16] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-20] (Symantec Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [484952 2013-08-20] (Symantec Corporation)
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2010-07-15] ()
S3 epmntdrv; C:\Windows\system32\epmntdrv.sys [16776 2010-07-15] ()
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [139864 2013-08-20] (Symantec Corporation)
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2010-07-15] ()
S3 EuGdiDrv; C:\Windows\system32\EuGdiDrv.sys [9096 2010-07-15] ()
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20130820.006\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 IDSVia64; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\IPSDefs\20130820.006\IDSvia64.sys [520280 2013-08-21] (Symantec Corporation)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115600 2009-02-10] (EZB Systems, Inc.)
R1 ISODrive; C:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys [115600 2009-02-10] (EZB Systems, Inc.)
R3 LVPr2M64; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
S3 LVPr2Mon; C:\Windows\System32\DRIVERS\LVPr2M64.sys [30232 2009-10-07] ()
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130820.002\ENG64.SYS [126040 2013-08-14] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130820.002\ENG64.SYS [126040 2013-08-14] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130820.002\EX64.SYS [2098776 2013-08-14] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.3.0.36\Definitions\VirusDefs\20130820.002\EX64.SYS [2098776 2013-08-14] (Symantec Corporation)
R2 ntk_PowerDVD; C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys [75248 2011-08-24] (Cyberlink Corp.)
R2 ntk_PowerDVD; C:\Program Files (x86)\CyberLink\PowerDVD11\Kernel\DMP\ntk_PowerDVD_64.sys [75248 2011-08-24] (Cyberlink Corp.)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [868848 2011-08-25] ()
S3 SRTSP; C:\Windows\System32\Drivers\NISx64\1404000.028\SRTSP64.SYS [796760 2013-05-16] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1404000.028\SRTSPX64.SYS [36952 2013-03-05] (Symantec Corporation)
R0 SymDS; C:\Windows\System32\drivers\NISx64\1404000.028\SYMDS64.SYS [493656 2013-05-21] (Symantec Corporation)
R0 SymEFA; C:\Windows\System32\drivers\NISx64\1404000.028\SYMEFA64.SYS [1139800 2013-05-23] (Symantec Corporation)
R3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [177312 2013-08-13] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1404000.028\Ironx64.SYS [224416 2013-03-05] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1404000.028\SYMNETS.SYS [433752 2013-04-25] (Symantec Corporation)
R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.)
R2 vstor2-ws60; C:\Program Files (x86)\VMware\VMware Workstation\vstor2-ws60.sys [32816 2010-08-19] (VMware, Inc.)
R3 WinDriver6; C:\Windows\System32\drivers\windrvr6.sys [254976 2010-07-15] (Jungo)
R2 WinisoCDBus; C:\Windows\System32\drivers\WinisoCDBus.sys [204032 2013-01-22] (WinISO.com)
R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [148976 2011-09-02] (CyberLink Corp.)
R2 {329F96B6-DF1E-4328-BFDA-39EA953C1312}; C:\Program Files (x86)\CyberLink\PowerDVD11\Common\NavFilter\000.fcl [148976 2011-09-02] (CyberLink Corp.)
S2 BstHdDrv; \??\C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys [x]
S3 catchme; \??\C:\ComboFix\catchme.sys [x]
S3 EraserUtilDrv11220; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11220.sys [x]
==================== NetSvcs (Whitelisted) ===================
==================== One Month Created Files and Folders ========
2013-08-21 07:36 - 2013-08-20 14:22 - 00891115 _____ C:\Users\ayrtonsenna\Desktop\SecurityCheck.exe
2013-08-20 14:20 - 2013-08-20 14:19 - 02347384 _____ (ESET) C:\Users\ayrtonsenna\Desktop\esetsmartinstaller_enu.exe
2013-08-20 14:05 - 2013-08-20 14:05 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-08-20 14:05 - 2013-08-20 14:05 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\Malwarebytes
2013-08-20 14:05 - 2013-08-20 14:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-20 14:05 - 2013-08-20 14:05 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-20 14:05 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-20 12:22 - 2013-08-20 12:23 - 00027219 _____ C:\AdwCleaner[S1].txt
2013-08-20 12:22 - 2013-08-20 12:20 - 00666633 _____ C:\Users\ayrtonsenna\Desktop\adwcleaner.exe
2013-08-19 16:33 - 2013-08-21 07:34 - 00001794 _____ C:\Windows\SysWOW64\debug.log
2013-08-19 10:55 - 2013-08-19 10:55 - 00756408 _____ C:\ComboFix.txt
2013-08-19 10:20 - 2011-06-26 08:45 - 00256000 _____ C:\Windows\PEV.exe
2013-08-19 10:20 - 2010-11-07 19:20 - 00208896 _____ C:\Windows\MBR.exe
2013-08-19 10:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2013-08-19 10:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2013-08-19 10:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2013-08-19 10:20 - 2000-08-31 02:00 - 00098816 _____ C:\Windows\sed.exe
2013-08-19 10:20 - 2000-08-31 02:00 - 00080412 _____ C:\Windows\grep.exe
2013-08-19 10:20 - 2000-08-31 02:00 - 00068096 _____ C:\Windows\zip.exe
2013-08-19 10:18 - 2013-08-19 10:55 - 00000000 ____D C:\Qoobox
2013-08-19 10:18 - 2013-08-19 10:53 - 00000000 ____D C:\Windows\erdnt
2013-08-19 10:18 - 2013-08-19 10:17 - 05105231 ____R (Swearware) C:\Users\ayrtonsenna\Desktop\ComboFix.exe
2013-08-19 09:32 - 2013-08-19 09:06 - 01575812 _____ (Farbar) C:\Users\ayrtonsenna\Desktop\FRST64.exe
2013-08-19 09:07 - 2013-08-19 09:07 - 00000000 ____D C:\FRST
2013-08-18 12:04 - 2013-08-19 10:46 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-17 18:40 - 2013-08-17 18:42 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\CrashDumps
2013-08-16 21:59 - 2013-08-16 21:59 - 00000000 ____D C:\bfdbdffdfd
2013-08-14 15:19 - 2013-08-14 15:19 - 00002086 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-08-14 15:19 - 2013-08-14 15:19 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\Thunderbird
2013-08-14 15:19 - 2013-08-14 15:19 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\Thunderbird
2013-08-14 15:19 - 2013-08-14 15:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-14 07:40 - 2013-08-14 07:40 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security
2013-08-14 02:04 - 2013-08-14 07:31 - 00067632 _____ (Symantec Corporation) C:\Windows\system32\msln.exe
2013-08-13 21:08 - 2013-08-14 07:33 - 00003234 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2013-08-13 21:08 - 2013-08-13 23:06 - 00177312 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2013-08-13 21:08 - 2013-08-13 23:06 - 00007631 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2013-08-13 21:08 - 2013-08-13 21:08 - 00000000 ____D C:\Program Files\Symantec
2013-08-13 21:08 - 2013-08-13 21:08 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-08-13 21:07 - 2013-08-14 07:34 - 00000000 ____D C:\Windows\system32\Drivers\NISx64
2013-08-13 21:07 - 2013-08-14 07:33 - 00002501 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2013-08-13 21:07 - 2013-08-13 21:17 - 00000000 ____D C:\ProgramData\Norton
2013-08-13 21:07 - 2013-08-13 21:07 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2013-08-13 20:58 - 2013-08-20 14:13 - 00000000 ___HD C:\Users\ayrtonsenna\AppData\Roaming\Fcnyrocpnr
2013-08-01 15:58 - 2013-08-01 15:58 - 00002212 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-01 09:51 - 2013-08-01 09:51 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\Avg2013
2013-08-01 09:44 - 2013-08-01 09:44 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-08-01 09:44 - 2013-08-01 09:44 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-01 09:44 - 2013-08-01 09:44 - 00000000 ____D C:\Program Files\iTunes
2013-08-01 09:44 - 2013-08-01 09:44 - 00000000 ____D C:\Program Files\iPod
2013-08-01 09:44 - 2013-08-01 09:44 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-01 08:45 - 2013-08-01 08:45 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2013-08-01 08:45 - 2013-08-01 08:45 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
==================== One Month Modified Files and Folders =======
2013-08-21 07:38 - 2011-08-25 11:32 - 01175492 _____ C:\Windows\WindowsUpdate.log
2013-08-21 07:35 - 2011-09-17 18:00 - 00000000 ____D C:\Users\ayrtonsenna\Documents\VINN
2013-08-21 07:34 - 2013-08-19 16:33 - 00001794 _____ C:\Windows\SysWOW64\debug.log
2013-08-21 07:34 - 2011-08-25 17:06 - 00000000 ____D C:\ProgramData\VMware
2013-08-21 07:33 - 2011-08-31 11:09 - 00001116 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-21 07:33 - 2011-08-25 14:01 - 00389732 _____ C:\Windows\PFRO.log
2013-08-21 07:33 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-21 07:33 - 2009-07-14 06:51 - 00040253 _____ C:\Windows\setupact.log
2013-08-21 01:56 - 2011-08-31 11:09 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-21 01:53 - 2012-04-03 12:25 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-21 01:16 - 2013-01-13 12:27 - 00000952 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3863859204-721055020-1558023407-1001UA.job
2013-08-20 14:23 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-20 14:23 - 2009-07-14 06:45 - 00016944 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-20 14:22 - 2013-08-21 07:36 - 00891115 _____ C:\Users\ayrtonsenna\Desktop\SecurityCheck.exe
2013-08-20 14:19 - 2013-08-20 14:20 - 02347384 _____ (ESET) C:\Users\ayrtonsenna\Desktop\esetsmartinstaller_enu.exe
2013-08-20 14:13 - 2013-08-13 20:58 - 00000000 ___HD C:\Users\ayrtonsenna\AppData\Roaming\Fcnyrocpnr
2013-08-20 14:05 - 2013-08-20 14:05 - 00001109 _____ C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2013-08-20 14:05 - 2013-08-20 14:05 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\Malwarebytes
2013-08-20 14:05 - 2013-08-20 14:05 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-20 14:05 - 2013-08-20 14:05 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-20 12:23 - 2013-08-20 12:22 - 00027219 _____ C:\AdwCleaner[S1].txt
2013-08-20 12:20 - 2013-08-20 12:22 - 00666633 _____ C:\Users\ayrtonsenna\Desktop\adwcleaner.exe
2013-08-20 11:53 - 2013-01-14 23:33 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\Skype
2013-08-19 19:39 - 2013-02-24 11:17 - 00002888 _____ C:\wakeuptoken.info
2013-08-19 16:37 - 2009-07-14 19:58 - 00699554 _____ C:\Windows\system32\perfh007.dat
2013-08-19 16:37 - 2009-07-14 19:58 - 00149344 _____ C:\Windows\system32\perfc007.dat
2013-08-19 16:37 - 2009-07-14 07:13 - 01620602 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-19 10:55 - 2013-08-19 10:55 - 00756408 _____ C:\ComboFix.txt
2013-08-19 10:55 - 2013-08-19 10:18 - 00000000 ____D C:\Qoobox
2013-08-19 10:55 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Default
2013-08-19 10:53 - 2013-08-19 10:18 - 00000000 ____D C:\Windows\erdnt
2013-08-19 10:52 - 2009-07-14 04:34 - 00000215 _____ C:\Windows\system.ini
2013-08-19 10:46 - 2013-08-18 12:04 - 00000000 ____D C:\Program Files (x86)\Mozilla Firefox
2013-08-19 10:46 - 2011-09-02 21:29 - 00000000 ____D C:\Program Files\world atlas
2013-08-19 10:46 - 2011-08-25 14:50 - 00000000 ____D C:\Jdownload
2013-08-19 10:46 - 2011-08-25 12:32 - 00000000 ____D C:\ATI
2013-08-19 10:46 - 2011-08-25 12:21 - 00000000 ____D C:\swsetup
2013-08-19 10:46 - 2011-08-25 12:20 - 00000000 ____D C:\Intel
2013-08-19 10:46 - 2011-08-25 11:37 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\Mozilla
2013-08-19 10:46 - 2011-08-25 11:37 - 00000000 ____D C:\Program Files (x86)\FileZilla FTP Client
2013-08-19 10:46 - 2011-08-25 11:37 - 00000000 ____D C:\Program Files (x86)\Adobe
2013-08-19 10:46 - 2011-08-25 11:36 - 00000000 ____D C:\ProgramData\Adobe
2013-08-19 10:46 - 2011-08-25 11:31 - 00000000 ____D C:\Users\ayrtonsenna
2013-08-19 10:46 - 2011-08-25 11:31 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\VirtualStore
2013-08-19 10:46 - 2011-08-25 11:30 - 00000000 ____D C:\Recovery
2013-08-19 10:46 - 2009-07-14 20:18 - 00000000 ____D C:\Program Files\Windows Journal
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Sidebar
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Portable Devices
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Photo Viewer
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Windows Defender
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Reference Assemblies
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\MSBuild
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\Microsoft Games
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files\DVD Maker
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Sidebar
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Portable Devices
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Photo Viewer
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Windows Defender
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\Reference Assemblies
2013-08-19 10:46 - 2009-07-14 07:32 - 00000000 ____D C:\Program Files (x86)\MSBuild
2013-08-19 10:46 - 2009-07-14 05:20 - 00000000 __RHD C:\Users\Public\Libraries
2013-08-19 10:46 - 2009-07-14 05:20 - 00000000 ____D C:\Program Files (x86)\Windows NT
2013-08-19 10:17 - 2013-08-19 10:18 - 05105231 ____R (Swearware) C:\Users\ayrtonsenna\Desktop\ComboFix.exe
2013-08-19 10:16 - 2013-01-13 12:27 - 00000930 _____ C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3863859204-721055020-1558023407-1001Core.job
2013-08-19 09:07 - 2013-08-19 09:07 - 00000000 ____D C:\FRST
2013-08-19 09:06 - 2013-08-19 09:32 - 01575812 _____ (Farbar) C:\Users\ayrtonsenna\Desktop\FRST64.exe
2013-08-19 08:58 - 2012-04-26 14:23 - 00000000 ____D C:\Program Files (x86)\Mozilla Maintenance Service
2013-08-17 18:51 - 2013-04-26 09:42 - 00001090 _____ C:\Users\Public\Desktop\TeamViewer 8.lnk
2013-08-17 18:42 - 2013-08-17 18:40 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\CrashDumps
2013-08-16 21:59 - 2013-08-16 21:59 - 00000000 ____D C:\bfdbdffdfd
2013-08-14 18:08 - 2011-08-25 11:37 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\FileZilla
2013-08-14 15:19 - 2013-08-14 15:19 - 00002086 _____ C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
2013-08-14 15:19 - 2013-08-14 15:19 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\Thunderbird
2013-08-14 15:19 - 2013-08-14 15:19 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\Thunderbird
2013-08-14 15:19 - 2013-08-14 15:19 - 00000000 ____D C:\Program Files (x86)\Mozilla Thunderbird
2013-08-14 07:40 - 2013-08-14 07:40 - 00000000 ____D C:\Windows\System32\Tasks\Norton Internet Security
2013-08-14 07:34 - 2013-08-13 21:07 - 00000000 ____D C:\Windows\system32\Drivers\NISx64
2013-08-14 07:33 - 2013-08-13 21:08 - 00003234 _____ C:\Windows\System32\Tasks\Norton WSC Integration
2013-08-14 07:33 - 2013-08-13 21:07 - 00002501 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2013-08-14 07:31 - 2013-08-14 02:04 - 00067632 _____ (Symantec Corporation) C:\Windows\system32\msln.exe
2013-08-13 23:06 - 2013-08-13 21:08 - 00177312 _____ (Symantec Corporation) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
2013-08-13 23:06 - 2013-08-13 21:08 - 00007631 _____ C:\Windows\system32\Drivers\SYMEVENT64x86.CAT
2013-08-13 22:14 - 2013-06-02 21:06 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\Winamp
2013-08-13 21:17 - 2013-08-13 21:07 - 00000000 ____D C:\ProgramData\Norton
2013-08-13 21:08 - 2013-08-13 21:08 - 00000000 ____D C:\Program Files\Symantec
2013-08-13 21:08 - 2013-08-13 21:08 - 00000000 ____D C:\Program Files\Common Files\Symantec Shared
2013-08-13 21:07 - 2013-08-13 21:07 - 00000000 ____D C:\Program Files (x86)\Norton Internet Security
2013-08-12 18:10 - 2009-07-14 07:08 - 00032632 _____ C:\Windows\Tasks\SCHEDLGU.TXT
2013-08-04 15:15 - 2012-12-30 17:31 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\Xorion
2013-08-03 19:29 - 2013-02-24 11:17 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\iFunbox_UserCache
2013-08-01 15:58 - 2013-08-01 15:58 - 00002212 _____ C:\Users\Public\Desktop\Google Earth.lnk
2013-08-01 09:51 - 2013-08-01 09:51 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\Avg2013
2013-08-01 09:51 - 2013-07-16 19:53 - 00000000 ____D C:\ProgramData\MFAData
2013-08-01 09:44 - 2013-08-01 09:44 - 00001783 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-08-01 09:44 - 2013-08-01 09:44 - 00000000 ____D C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-08-01 09:44 - 2013-08-01 09:44 - 00000000 ____D C:\Program Files\iTunes
2013-08-01 09:44 - 2013-08-01 09:44 - 00000000 ____D C:\Program Files\iPod
2013-08-01 09:44 - 2013-08-01 09:44 - 00000000 ____D C:\Program Files (x86)\iTunes
2013-08-01 08:57 - 2011-08-31 11:09 - 00002183 _____ C:\Users\Public\Desktop\Google Chrome.lnk
2013-08-01 08:45 - 2013-08-01 08:45 - 00000000 ____D C:\Users\Default\AppData\Roaming\TuneUp Software
2013-08-01 08:45 - 2013-08-01 08:45 - 00000000 ____D C:\Users\Default User\AppData\Roaming\TuneUp Software
2013-07-31 10:10 - 2012-07-24 22:41 - 00000000 ____D C:\Users\ayrtonsenna\AppData\Roaming\GHISLER
2013-07-29 15:52 - 2011-08-25 14:05 - 00000000 ____D C:\Users\AYRTON~1\AppData\Local\Adobe
2013-07-29 15:51 - 2012-04-03 12:25 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-07-29 15:51 - 2012-04-03 12:25 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-07-29 15:51 - 2011-08-25 12:31 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
==================== Bamital & volsnap Check =================
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit
LastRegBack: 2013-08-14 03:37
==================== End Of Log ============================
--- --- ---
--- --- --- |
