Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Arestocrat Virus! [Closed]

Started by Ineedhelp100 , Apr 23 2013 04:19 PM

This topic is locked

#1
Ineedhelp100

Posted 23 April 2013 - 04:19 PM

New Member

Member
8 posts

Hey, I believe I have the Arestocrat virus! When i get on my computer this thing pops up and says if I don't pay a certain amount of money im going to get arrested or something like that. I have noticed that a lot of people have had some success as to getting rid of this virus on this site! I don't know a whole lot about computers but I just really want to get rid of this thing! I'll take any help I can get, thank you!

#2
gringo_pr

Posted 23 April 2013 - 05:01 PM

Trusted Helper

Malware Removal
7,268 posts

Hello Ineedhelp100

I would like to welcome you to the Malware Removal section of the forum.

Around here they call me Gringo and I will be glad to help you with your malware problems.

Very Important --> Please read this post completely, I have spent my time to put together somethings for you to keep in mind while I am helping you to make things go easier, faster and smoother for both of us!

Please do not run any tools unless instructed to do so.
- We ask you to run different tools in a specific order to ensure the malware is completely removed from your machine, and running any additional tools may detect false positives, interfere with our tools, or cause unforeseen damage or system instability.
Please do not attach logs or use code boxes, just copy and paste the text.
- Due to the high volume of logs we receive it helps to receive everything in the same format, and code boxes make the logs very difficult to read. Also, attachments require us to download and open the reports when it is easier to just read the reports in your post.
Please read every post completely before doing anything.
- Pay special attention to the NOTE: lines, these entries identify an individual issue or important step in the cleanup process.
Please provide feedback about your experience as we go.
- A short statement describing how the computer is working helps us understand where to go next, for example: I am still getting redirected, the computer is running normally, etc. Please do not describe the computer as "the same", this requires the extra step of looking back at your previous post.

NOTE: At the top of your post, click on the "Follow This Topic" Button, make sure that the "Receive notification" box is checked and that it is set to "Instantly" - This will send you an e-mail as soon as I reply to your topic, allowing us to resolve the issue faster.

NOTE: Backup any files that cannot be replaced. Removing malware can be unpredictable and this step can save a lot of heartaches if things don't go as planed. You can put them on a CD/DVD, external drive or a pen drive, anywhere except on the computer.

NOTE: It is good practice to copy and paste the instructions into notepad and print them in case it is necessary for you to go offline during the cleanup process. To open notepad, navigate to Start Menu > All Programs > Accessories > Notepad. Please remember to copy the entire post so you do not miss any instructions.

For x32 (x86) bit systems download Farbar Recovery Scan Tool and save it to a flash drive.

For x64 bit systems download Farbar Recovery Scan Tool x64 and save it to a flash drive.

How to tell > 32 or 64 bit

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

To enter System Recovery Options from the Advanced Boot Options:

Restart the computer.
As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.
Use the arrow keys to select the Repair your computer menu item.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account an click Next.

To enter System Recovery Options by using Windows installation disc:

Insert the installation disc.
Restart your computer.
If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.
Click Repair your computer.
Select US as the keyboard language settings, and then click Next.
Select the operating system you want to repair, and then click Next.
Select your user account and click Next.

On the System Recovery Options menu you will get the following options:
Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt[*]Select Command Prompt
[*]In the command window type in notepad and press Enter.
[*]The notepad opens. Under File menu select Open.
[*]Select "Computer" and find your flash drive letter and close the notepad.
[*]In the command window type e:\frst64.exe or e:\frst.exe and press Enter
Note: Replace letter e with the drive letter of your flash drive.
[*]The tool will start to run.
[*]When the tool opens click Yes to disclaimer.

[*]First Press the Scan button.
[*]It will make a log (FRST.txt)

[*]Second Type the following in the edit box after "Search:". services.exe
[*]Click the Search button
[*]It will make a log (Search.txt)
[/list]
I want you to poste Both the FRST.txt report and the Search.txt into your reply to me

Gringo

#3
Ineedhelp100

Posted 23 April 2013 - 06:39 PM

New Member

Topic Starter
Member
8 posts

Thank you Gringo for helping me through this. I am currently on my infected laptop through safe mode with networking. I just downloaded what I believe is what you told me the Farbar recovery scan tool. It took me to a page called Reimage. Is this the right download?

#4
Ineedhelp100

Posted 23 April 2013 - 06:50 PM

New Member

Topic Starter
Member
8 posts

Never mind I got it figured out. Here is the FRST.txt! Thanks again!

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 23-04-2013 03
Ran by Owner (administrator) on 23-04-2013 19:44:57
Running from C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ZWYCHAL
Windows 7 Home Premium Service Pack 1 (X64) OS Language: English(US)
Internet Explorer Version 9
Boot Mode: Network
==================== Processes (Whitelisted) =================

(Microsoft Corporation) [1552] C:\windows\system32\ctfmon.exe
(Microsoft Corporation) [1284] C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) [2220] C:\windows\System32\MsSpellCheckingFacility.exe
(Farbar) [2052] C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ZWYCHAL\FRST64.exe

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] "C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe" [7982112 2009-07-28] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [1815848 2009-07-20] (Synaptics Incorporated)
HKLM\...\Run: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE [497504 2009-08-21] (TOSHIBA Corporation)
HKLM\...\Run: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe [52600 2009-03-09] (TOSHIBA Corporation)
HKLM\...\Run: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe [508216 2009-07-28] (TOSHIBA Corporation)
HKLM\...\Run: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe [909624 2009-08-05] (TOSHIBA Corporation)
HKLM\...\Run: [Teco] "%ProgramFiles%\TOSHIBA\TECO\Teco.exe" /r [1482080 2009-08-11] (TOSHIBA Corporation)
HKLM\...\Run: [TosSENotify] "C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe" [709976 2009-08-03] (TOSHIBA Corporation)
HKLM\...\Run: [TosNC] %ProgramFiles%\Toshiba\BulletinBoard\TosNcCore.exe [595816 2009-10-28] (TOSHIBA Corporation)
HKLM\...\Run: [TosReelTimeMonitor] %ProgramFiles%\TOSHIBA\ReelTime\TosReelTimeMonitor.exe [34648 2009-10-28] (TOSHIBA Corporation)
HKLM\...\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2320752 2009-11-05] (Microsoft Corporation)
HKLM\...\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey [1281512 2013-01-27] (Microsoft Corporation)
HKLM-x32\...\Runonce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/w...&"ver=10.0.1424 [x]
HKLM-x32\...\Winlogon: [Shell] C:\ProgramData\f34rfcdsfwe.exe [x ] ()
HKCU\...\Run: [Google Update] "C:\Users\Owner\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2010-09-26] (Google Inc.)
HKCU\...\Run: [Facebook Update] "C:\Users\Owner\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver [138096 2012-07-31] (Facebook Inc.)
HKCU\...\RunOnce: [FlashPlayerUpdate] C:\windows\SysWOW64\Macromed\Flash\FlashUtil32_11_4_402_287_ActiveX.exe -update activex [692152 2012-10-29] (Adobe Systems Incorporated)
HKLM-x32\...\Runonce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/w...&"ver=10.0.1424 [x]
MountPoints2: {40b2a756-156e-11e1-a83d-ca7afa0ae56b} - E:\LaunchU3.exe -a
MountPoints2: {fc8c8f14-a673-11df-ae65-00266c6dd99d} - E:\LaunchU3.exe -a
HKLM-x32\...\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun [98304 2009-07-30] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [] [x]
HKLM-x32\...\Run: [EverioService] "C:\Program Files (x86)\CyberLink\PCM4Everio\EverioService.exe" [151552 2007-11-01] (CyberLink Corp.)
HKLM-x32\...\Run: [ROC_roc_dec12] "C:\Program Files (x86)\AVG Secure Search\ROC_roc_dec12.exe" /PROMPT /CMPID=roc_dec12 [x]
HKLM-x32\...\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [37296 2012-03-27] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [946352 2012-12-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SoundDrivers] "C:\ProgramData\f34rfcdsfwe.exe" [64512 2013-04-20] (Hilgraeve, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
URLSearchHook: (No Name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - No File
URLSearchHook: (No Name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKCU - {171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E} URL = http://websearch.ask...09-F0014E851333
SearchScopes: HKCU - {1BBDA657-2B8D-48AE-BF75-CB06B00A1204} URL =
SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.c...pa&d=2011-12-03 10:00:59&v=9.0.0.18&sap=dsp&q={searchTerms}
SearchScopes: HKCU - {C5E625A6-4162-44E6-816F-A24BF48C6BA2} URL =
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~2\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
BHO-x32: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
BHO-x32: Adobe PDF Link Helper - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Skype Plug-In - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO-x32: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MIF5BA~1\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Dictionary.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
BHO-x32: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
BHO-x32: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.)
Toolbar: HKLM-x32 - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKLM-x32 - Dictionary.com Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
Toolbar: HKLM-x32 - Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
Toolbar: HKCU - No Name - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File
PDF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.ad...Plus/1.6/gp.cab
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - No File
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - No File
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - No File
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - No File
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - No File
Handler: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - No File
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - No File
Handler-x32: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
Handler-x32: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files (x86)\Common Files\Microsoft Shared\Information Retrieval\msitss.dll (Microsoft Corporation)
Handler-x32: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files (x86)\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Handler-x32: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
Handler-x32: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
Winsock: Catalog5-x64 05 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [170880] (Microsoft Corp.)
Winsock: Catalog5-x64 06 C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL [170880] (Microsoft Corp.)
Tcpip\Parameters: [DhcpNameServer] 192.168.10.1

Chrome:
=======
CHR HomePage: hxxp://www.google.com
CHR DefaultSearchURL: (Google) - {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter}
CHR Plugin: (Remoting Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\26.0.1410.64\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\26.0.1410.64\pdf.dll ()
CHR Plugin: (Shockwave Flash) - C:\Users\Owner\AppData\Local\Google\Chrome\Application\26.0.1410.64\gcswf32.dll No File
CHR Plugin: (Skype Toolbars) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.0.0.6778_0\npSkypeChromePlugin.dll (Skype Technologies S.A.)
CHR Plugin: (AVG Internet Security) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmfkcklnlgedgbglfkkgedjfmejoahla\10.0.0.1409_0\plugins/avgnpss.dll No File
CHR Plugin: (Adobe Acrobat) - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Java Deployment Toolkit 6.0.240.7) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java™ Platform SE 6 U24) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
CHR Plugin: (Microsoft Office 2010) - C:\PROGRA~2\MIF5BA~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Owner\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
CHR Plugin: (Google Update) - C:\Users\Owner\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll No File
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (YouTube) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1
CHR Extension: (Google Search) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0
CHR Extension: (AdBlock) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.61_0
CHR Extension: (Skype Extension) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.0.0.6778_0
CHR Extension: (Gmail) - C:\Users\Owner\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1

==================== Services (Whitelisted) =================

S2 HitmanProScheduler; C:\Program Files\HitmanPro\hmpsched.exe [109352 2013-04-13] (SurfRight B.V.)
S3 McComponentHostService; C:\Program Files (x86)\McAfee Security Scan\2.1.121\McCHSvc.exe [227232 2010-09-03] (McAfee, Inc.)
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [22056 2013-01-27] (Microsoft Corporation)
S3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [379360 2013-01-27] (Microsoft Corporation)
S2 RichVideo; C:\Program Files (x86)\CyberLink\Shared Files\RichVideo.exe [272024 2006-12-19] ()
S3 AVG Security Toolbar Service; C:\Program Files (x86)\AVG\AVG10\Toolbar\ToolbarBroker.exe [x]

==================== Drivers (Whitelisted) ====================

S3 hitmanpro37; C:\windows\system32\drivers\hitmanpro37.sys [32152 2013-04-20] ()
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [230320 2013-01-20] (Microsoft Corporation)
S2 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [130008 2013-01-20] (Microsoft Corporation)
S3 RtsUIR; system32\DRIVERS\Rts516xIR.sys [x]
S3 USBCCID; system32\DRIVERS\RtsUCcid.sys [x]

==================== NetSvcs (Whitelisted) ===================

==================== One Month Created Files and Folders ========

2013-04-23 19:42 - 2013-04-23 19:42 - 00000000 ____D C:\FRST
2013-04-23 19:28 - 2013-04-23 19:29 - 00000000 ____D C:\rei
2013-04-23 19:28 - 2013-04-23 19:28 - 00001912 ____A C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
2013-04-23 19:28 - 2013-04-23 19:28 - 00000428 ____A C:\Windows\Tasks\Reimage ScanAgent.job
2013-04-23 19:28 - 2013-04-23 19:28 - 00000000 ____D C:\Program Files\Reimage
2013-04-23 19:26 - 2013-04-23 19:29 - 00000162 ____A C:\Windows\Reimage.ini
2013-04-23 19:07 - 2010-12-18 13:03 - 00002661 ____A C:\Users\Owner\Documents\Microsoft Word 2010.lnk
2013-04-23 19:05 - 2013-04-23 19:05 - 00275216 ____A C:\Windows\Minidump\042313-31340-01.dmp
2013-04-22 19:56 - 2013-04-22 19:56 - 00275216 ____A C:\Windows\Minidump\042213-30529-01.dmp
2013-04-21 12:15 - 2013-04-21 12:15 - 00275216 ____A C:\Windows\Minidump\042113-31403-01.dmp
2013-04-20 19:55 - 2013-04-20 19:55 - 00275216 ____A C:\Windows\Minidump\042013-28672-01.dmp
2013-04-20 19:49 - 2013-04-23 19:05 - 368795473 ____A C:\Windows\MEMORY.DMP
2013-04-20 19:49 - 2013-04-23 19:05 - 00000000 ____D C:\Windows\Minidump
2013-04-20 19:49 - 2013-04-20 19:49 - 00275216 ____A C:\Windows\Minidump\042013-19437-01.dmp
2013-04-20 19:28 - 2013-04-20 19:50 - 00032152 ____A C:\Windows\System32\Drivers\hitmanpro37.sys
2013-04-12 21:03 - 2013-02-21 05:30 - 01766912 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-04-12 21:03 - 2013-02-21 05:30 - 01129984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 14323200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 02046464 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 00039424 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-04-12 21:03 - 2013-02-21 05:29 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-04-12 21:03 - 2013-02-21 05:15 - 02240512 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-04-12 21:03 - 2013-02-21 05:15 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-04-12 21:03 - 2013-02-21 05:14 - 19230208 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 15404544 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 00053248 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-04-12 21:03 - 2013-02-21 05:14 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-04-12 21:03 - 2013-02-19 07:01 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-04-12 21:03 - 2013-02-19 06:42 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-04-12 21:03 - 2013-02-19 06:10 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-04-12 21:03 - 2013-02-19 05:51 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-04-10 15:24 - 2013-03-19 01:04 - 05550424 ____A (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-04-10 15:24 - 2013-03-02 01:04 - 01655656 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ntfs.sys
2013-04-10 15:24 - 2013-02-28 22:36 - 03153408 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-04-10 15:24 - 2013-02-15 01:08 - 00044032 ____A (Microsoft Corporation) C:\Windows\System32\tsgqec.dll
2013-04-10 15:24 - 2013-02-15 01:06 - 03717632 ____A (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2013-04-10 15:24 - 2013-02-15 01:02 - 00158720 ____A (Microsoft Corporation) C:\Windows\System32\aaclient.dll
2013-04-10 15:24 - 2013-02-14 23:37 - 03217408 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2013-04-10 15:24 - 2013-02-14 23:34 - 00131584 ____A (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2013-04-10 15:24 - 2013-02-14 22:25 - 00036864 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2013-04-10 15:24 - 2013-01-24 01:01 - 00223752 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\fvevol.sys
2013-04-10 15:23 - 2013-03-19 00:46 - 00043520 ____A (Microsoft Corporation) C:\Windows\System32\csrsrv.dll
2013-04-10 15:23 - 2013-03-19 00:04 - 03968856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2013-04-10 15:23 - 2013-03-19 00:04 - 03913560 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2013-04-10 15:23 - 2013-03-18 23:47 - 00006656 ____A (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2013-04-10 15:23 - 2013-03-18 22:06 - 00112640 ____A (Microsoft Corporation) C:\Windows\System32\smss.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-03-24 13:16 - 2013-03-24 13:16 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-03-24 13:16 - 2013-03-24 13:16 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-03-24 13:16 - 2013-03-24 13:16 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-03-24 13:16 - 2013-03-24 13:16 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-03-24 13:16 - 2013-03-24 13:16 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-03-24 13:16 - 2013-03-24 13:16 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-03-24 13:16 - 2013-03-24 13:16 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-03-24 13:16 - 2013-03-24 13:16 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-03-24 13:13 - 2013-03-24 13:13 - 03928064 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 03419136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 02776576 ____A (Microsoft Corporation) C:\Windows\System32\msmpeg2vdec.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 02565120 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 02284544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01988096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01682432 ____A (Microsoft Corporation) C:\Windows\System32\XpsPrint.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01643520 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01504768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01238528 ____A (Microsoft Corporation) C:\Windows\System32\d3d10.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01175552 ____A (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01158144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01080832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00648192 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00604160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00522752 ____A (Microsoft Corporation) C:\Windows\System32\XpsGdiConverter.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00465920 ____A (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00417792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00364544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00363008 ____A (Microsoft Corporation) C:\Windows\System32\dxgi.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00333312 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00296960 ____A (Microsoft Corporation) C:\Windows\System32\d3d10core.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00293376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00249856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00245248 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecsExt.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00221184 ____A (Microsoft Corporation) C:\Windows\System32\UIAnimation.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00207872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00194560 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00187392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00010752 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00010752 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00009728 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00009728 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00002560 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00002560 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-03-24 13:10 - 2013-03-24 13:19 - 00007988 ____A C:\Windows\IE10_main.log

==================== One Month Modified Files and Folders =======

2013-04-23 19:42 - 2013-04-23 19:42 - 00000000 ____D C:\FRST
2013-04-23 19:29 - 2013-04-23 19:28 - 00000000 ____D C:\rei
2013-04-23 19:29 - 2013-04-23 19:26 - 00000162 ____A C:\Windows\Reimage.ini
2013-04-23 19:28 - 2013-04-23 19:28 - 00001912 ____A C:\Users\Public\Desktop\PC Scan & Repair by Reimage.lnk
2013-04-23 19:28 - 2013-04-23 19:28 - 00000428 ____A C:\Windows\Tasks\Reimage ScanAgent.job
2013-04-23 19:28 - 2013-04-23 19:28 - 00000000 ____D C:\Program Files\Reimage
2013-04-23 19:16 - 2010-04-30 15:37 - 01534048 ____A C:\Windows\WindowsUpdate.log
2013-04-23 19:09 - 2009-07-14 00:13 - 00730448 ____A C:\Windows\System32\PerfStringBackup.INI
2013-04-23 19:05 - 2013-04-23 19:05 - 00275216 ____A C:\Windows\Minidump\042313-31340-01.dmp
2013-04-23 19:05 - 2013-04-20 19:49 - 368795473 ____A C:\Windows\MEMORY.DMP
2013-04-23 19:05 - 2013-04-20 19:49 - 00000000 ____D C:\Windows\Minidump
2013-04-23 19:03 - 2011-08-28 17:44 - 00000928 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1634739895-1740860278-1454614856-1000UA.job
2013-04-23 19:03 - 2011-08-28 17:44 - 00000906 ____A C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1634739895-1740860278-1454614856-1000Core.job
2013-04-23 19:03 - 2010-09-26 13:44 - 00000908 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1634739895-1740860278-1454614856-1000UA.job
2013-04-23 19:03 - 2010-09-26 13:44 - 00000856 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1634739895-1740860278-1454614856-1000Core.job
2013-04-22 20:52 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-04-22 20:52 - 2009-07-13 23:51 - 00063159 ____A C:\Windows\setupact.log
2013-04-22 19:56 - 2013-04-22 19:56 - 00275216 ____A C:\Windows\Minidump\042213-30529-01.dmp
2013-04-21 12:15 - 2013-04-21 12:15 - 00275216 ____A C:\Windows\Minidump\042113-31403-01.dmp
2013-04-20 19:55 - 2013-04-20 19:55 - 00275216 ____A C:\Windows\Minidump\042013-28672-01.dmp
2013-04-20 19:50 - 2013-04-20 19:28 - 00032152 ____A C:\Windows\System32\Drivers\hitmanpro37.sys
2013-04-20 19:49 - 2013-04-20 19:49 - 00275216 ____A C:\Windows\Minidump\042013-19437-01.dmp
2013-04-20 19:31 - 2010-07-12 19:42 - 00000000 ____D C:\Users\Owner\Documents\Quicken
2013-04-20 17:55 - 2011-12-03 20:31 - 00000040 ____A C:\Users\Owner\jagex_cl_runescape_LIVE.dat
2013-04-15 21:15 - 2009-07-13 23:45 - 00015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-04-15 21:15 - 2009-07-13 23:45 - 00015792 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-04-12 22:22 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\NDF
2013-04-12 21:38 - 2009-07-13 23:45 - 00431672 ____A C:\Windows\System32\FNTCACHE.DAT
2013-04-12 21:06 - 2010-07-05 17:29 - 72702784 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-04-02 05:34 - 2010-07-05 15:40 - 00282744 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2013-03-24 14:08 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\rescache
2013-03-24 13:19 - 2013-03-24 13:10 - 00007988 ____A C:\Windows\IE10_main.log
2013-03-24 13:19 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\zh-HK
2013-03-24 13:19 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\SysWOW64\tr-TR
2013-03-24 13:19 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\zh-HK
2013-03-24 13:19 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\tr-TR
2013-03-24 13:19 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\PolicyDefinitions
2013-03-24 13:16 - 2013-03-24 13:16 - 01509376 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2013-03-24 13:16 - 2013-03-24 13:16 - 01441280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2013-03-24 13:16 - 2013-03-24 13:16 - 01400416 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat
2013-03-24 13:16 - 2013-03-24 13:16 - 01400416 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dat
2013-03-24 13:16 - 2013-03-24 13:16 - 01054720 ____A (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00905728 ____A (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00762368 ____A (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00719360 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00629248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00599552 ____A (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00523264 ____A (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00452096 ____A (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00441856 ____A (Microsoft Corporation) C:\Windows\System32\html.iec
2013-03-24 13:16 - 2013-03-24 13:16 - 00361984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2013-03-24 13:16 - 2013-03-24 13:16 - 00357888 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00281600 ____A (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00270848 ____A (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00247296 ____A (Microsoft Corporation) C:\Windows\System32\webcheck.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00242200 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00235008 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00232960 ____A (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00226816 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00226304 ____A (Microsoft Corporation) C:\Windows\System32\elshyph.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00216064 ____A (Microsoft Corporation) C:\Windows\System32\msls31.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00204800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00197120 ____A (Microsoft Corporation) C:\Windows\System32\msrating.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00185344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00173568 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00167424 ____A (Microsoft Corporation) C:\Windows\System32\iexpress.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00163840 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00158720 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00150528 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00149504 ____A (Microsoft Corporation) C:\Windows\System32\occache.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00144896 ____A (Microsoft Corporation) C:\Windows\System32\wextract.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00138752 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00137216 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00136192 ____A (Microsoft Corporation) C:\Windows\System32\iepeers.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00135680 ____A (Microsoft Corporation) C:\Windows\System32\IEAdvpack.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00125440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00117248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00110592 ____A (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00102912 ____A (Microsoft Corporation) C:\Windows\System32\inseng.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00097280 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00092160 ____A (Microsoft Corporation) C:\Windows\System32\SetIEInstalledDate.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00082432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00081408 ____A (Microsoft Corporation) C:\Windows\System32\icardie.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00079872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00077312 ____A (Microsoft Corporation) C:\Windows\System32\tdc.ocx
2013-03-24 13:16 - 2013-03-24 13:16 - 00073728 ____A (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00069120 ____A (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00062976 ____A (Microsoft Corporation) C:\Windows\System32\pngfilt.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00061952 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx
2013-03-24 13:16 - 2013-03-24 13:16 - 00057344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00052224 ____A (Microsoft Corporation) C:\Windows\System32\msfeedsbs.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00051200 ____A (Microsoft Corporation) C:\Windows\System32\imgutil.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00048640 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00048640 ____A (Microsoft Corporation) C:\Windows\System32\mshtmler.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00041984 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00038400 ____A (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00027648 ____A (Microsoft Corporation) C:\Windows\System32\licmgr10.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00023040 ____A (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll
2013-03-24 13:16 - 2013-03-24 13:16 - 00013824 ____A (Microsoft Corporation) C:\Windows\System32\mshta.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00012800 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00012800 ____A (Microsoft Corporation) C:\Windows\System32\msfeedssync.exe
2013-03-24 13:16 - 2013-03-24 13:16 - 00011776 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2013-03-24 13:13 - 2013-03-24 13:13 - 03928064 ____A (Microsoft Corporation) C:\Windows\System32\d2d1.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 03419136 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 02776576 ____A (Microsoft Corporation) C:\Windows\System32\msmpeg2vdec.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 02565120 ____A (Microsoft Corporation) C:\Windows\System32\d3d10warp.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 02284544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01988096 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01887232 ____A (Microsoft Corporation) C:\Windows\System32\d3d11.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01682432 ____A (Microsoft Corporation) C:\Windows\System32\XpsPrint.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01643520 ____A (Microsoft Corporation) C:\Windows\System32\DWrite.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01504768 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01424384 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecs.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01247744 ____A (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01238528 ____A (Microsoft Corporation) C:\Windows\System32\d3d10.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01230336 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01175552 ____A (Microsoft Corporation) C:\Windows\System32\FntCache.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01158144 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 01080832 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00648192 ____A (Microsoft Corporation) C:\Windows\System32\d3d10level9.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00604160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00522752 ____A (Microsoft Corporation) C:\Windows\System32\XpsGdiConverter.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00465920 ____A (Microsoft Corporation) C:\Windows\System32\WMPhoto.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00417792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00364544 ____A (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00363008 ____A (Microsoft Corporation) C:\Windows\System32\dxgi.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00333312 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1core.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00296960 ____A (Microsoft Corporation) C:\Windows\System32\d3d10core.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00293376 ____A (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00249856 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00245248 ____A (Microsoft Corporation) C:\Windows\System32\WindowsCodecsExt.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00221184 ____A (Microsoft Corporation) C:\Windows\System32\UIAnimation.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00220160 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00207872 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00194560 ____A (Microsoft Corporation) C:\Windows\System32\d3d10_1.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00187392 ____A (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00161792 ____A (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00010752 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00010752 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00009728 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00009728 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00005632 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00005632 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-ole32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00004096 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00004096 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003584 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003584 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003072 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-version-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00003072 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-shell32-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00002560 ___AH (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-03-24 13:13 - 2013-03-24 13:13 - 00002560 ___AH (Microsoft Corporation) C:\Windows\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll
2013-03-24 00:00 - 2009-11-12 22:08 - 00385100 ____A C:\Windows\PFRO.log

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

Last Boot: 2013-04-07 16:15

==================== End Of Log ============================

#5
Ineedhelp100

Posted 23 April 2013 - 06:56 PM

New Member

Topic Starter
Member
8 posts

I believe this is the Search txt.

Farbar Recovery Scan Tool (x64) Version: 23-04-2013 03
Ran by Owner at 2013-04-23 19:51:17
Running from C:\Users\Owner\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6ZWYCHAL
Boot Mode: Network

================== Search: "services.exe" ===================

C:\Windows\winsxs\amd64_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_2b54b20ee6fa07b1\services.exe
[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

C:\Windows\System32\services.exe
[2009-07-13 18:19] - [2009-07-13 20:39] - 0328704 ____A (Microsoft Corporation) 24ACB7E5BE595468E3B9AA488B9B4FCB

====== End Of Search ======

#6
Ineedhelp100

Posted 23 April 2013 - 06:59 PM

New Member

Topic Starter
Member
8 posts

If I did something wrong I am sorry. Just let me know, and thanks again!

#7
gringo_pr

Posted 23 April 2013 - 07:33 PM

Trusted Helper

Malware Removal
7,268 posts

Hello Ineedhelp100

Open notepad. Please copy the contents of the code box below. To do this highlight the contents of the box and right click on it. Paste this into the open notepad. Save it on the flash drive as fixlist.txt

HKLM-x32\...\Winlogon: [Shell] C:\ProgramData\f34rfcdsfwe.exe [x ] ()
HKLM-x32\...\Run: [SoundDrivers] "C:\ProgramData\f34rfcdsfwe.exe" [64512 2013-04-20] (Hilgraeve, Inc.)
C:\ProgramData\f34rfcdsfwe.exe

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.

Run FRST again like we did before but this time press the Fix button just once and wait.
The tool will make a log on the flash drive (Fixlog.txt) please post it to your reply.

Also boot the computer into normal mode and let me know how things are looking.

Gringo

#8
Ineedhelp100

Posted 23 April 2013 - 09:20 PM

New Member

Topic Starter
Member
8 posts

Sorry I don't want to mess this up. I am on my infected computer in safe mode. I just saved the new text on my flash drive under fixlist.txt! What do you want me to do with the System recovery options, and do I have to open this new text on my flash drive before I do the next download? Thanks

#9
gringo_pr

Posted 23 April 2013 - 09:41 PM

Trusted Helper

Malware Removal
7,268 posts

run first the way you did last time but this time press the fix button (save the fixlist next to the frst program)

#10
Ineedhelp100

Posted 23 April 2013 - 10:30 PM

New Member

Topic Starter
Member
8 posts

Gringo, I am having problems downloading this fixlist, did I do it right earlier? Are there more details you can give me for this specific job? I can't seem to get this one to work out right! I am currently on my computer in safe mode. Thanks again for all your time and help!

#11
gringo_pr

Posted 23 April 2013 - 11:00 PM

Trusted Helper

Malware Removal
7,268 posts

Hello Ineedhelp100

I Would like you to do the following you can do it in safe mode.

Please print out or make a copy in notepad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.
Link 1
Link 2
Link 3
1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you receive an error "Illegal operation attempted on a registry key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following
Log from Combofix
let me know of any problems you may have had
How is the computer doing now?

Gringo

#12
Ineedhelp100

Posted 24 April 2013 - 07:52 PM

New Member

Topic Starter
Member
8 posts

Alright Gringo, I have not gotten the opportunity today to follow that last post yet. I just got home today, got on my computer in the regular mode and it said it detected a problem or something and asked if I wanted it to try to solve it. So it worked some magic i guess and it eventually restarted and now the popup virus is gone! For all I can tell I've gotten rid of this thing but I'm scared it could still be infecting me somehow! I can now operate my computer in normal mode! Do i still need to follow your previous instructions or does this change things quite a bit? Thanks for all your time!

#13
gringo_pr

Posted 24 April 2013 - 08:37 PM

Trusted Helper

Malware Removal
7,268 posts

go ahead and run combofix in normal mode

gringo

#14
gringo_pr

Posted 26 April 2013 - 11:44 PM

Trusted Helper

Malware Removal
7,268 posts

Hello

48 Hour bump

It has been more than 48 hours since my last post.

do you still need help with this?
do you need more time?
are you having problems following my instructions?
if after 48hrs you have not replied to this thread then it will have to be closed!

Gringo

#15
gringo_pr

Posted 30 April 2013 - 12:09 AM

Trusted Helper

Malware Removal
7,268 posts

Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.