[Tazdrh]

Naat,

I know you are waiting with patiently. Just to update you Eset is still scanning and is at 87% this scan has not stopped running since last Friday when it started. it says it has fround 4 infected files so far. will get the results as soon as this finishes

 

Thank you

David

[Advertisements]

Hi David!

 

Thanks for letting me know. I don't know what takes it so much time (on my machine is is done in about an hour and a half), but this gives me some light about your remaining issues.

 

Keep me posted

 

Regards,

Minion

[Naathim]

Hi David!

 

Thanks for letting me know. I don't know what takes it so much time (on my machine is is done in about an hour and a half), but this gives me some light about your remaining issues.

 

Keep me posted

 

Regards,

Minion

[Tazdrh]

Hello Naat,

The scan finished  computer shut down and restarted . i can not get past starting windows. I tried safe mode and it loads drivers  to go into safe mode and goes no farther.

 

Thanks

David

[Naathim]

Hi.

I don't know what happened. There wasn't any aggresive procedure which could trigger this kind of issues... I need to take a look from external environment.

Below there are instructions. If you'll have any issues/concernes (it may look overwhelming), let me know and I'll try to provide you more detailed description.

Also please accept my apologies for the delay - yesterday there was some sort of a bug here which prevented me from reviewing your topic.


Scan with Farbar Recovery Scan Tool from the Recovery Environment

We will be working outside of Windows, so I think it would be prudent to save it or print down for further reference.
This instruction is a quite complicated one as it contains multiple steps. We will need a clean machine and a USB stick (thumbdrive).

DOWNLOADS

There will be three things to download on your clean machine:

• RUFUS by Akeo Consulting
•  
• Farbar Recovery Scan Tool x64 by Farbar

Save them preferably to the desktop, as it would make the rest of instructions easier.
Recovery .iso file will be downloaded from my GoogleDrive. You will be notified that the file is too big for Google to scan it with built-in virus scanners - I assure you that it's perfectly safe.

PREPARATIONS

Prepare the tool on your clean machine.

Create bootable USB drive with RUFUS

• Right-click on icon and select Run as Administrator to start the tool.
• Configure it with the settings listed below:
  • Device - make sure that your pendrive is listed;
  • File System - set to NTFS;
  • Make sure that Quick format option is checked;
  • Create a bootable disk using - select ISO Image;
  • Click on the small CD icon next to ISO Image - select the downloaded Recovery Environment .iso file.
• Press Start ant the process should run.

You will be notified on the lower bar when it will be completed.

After that please copy FRST to the root of your pendrive.
Now unplug your pendrive and move it into your corrupted machine.

ACTION

Insert your USB drive to the corrupted machine and start the computer.
Make sure that booting from USB is set. If you don't know how to do it, instructions HERE.

Getting form one step to another during this part will take some time. Please be patient.

Run Recovery Environment

• When the machine boots-up, you will see the Install now window. Instead choose the Repair my computer option.
• You will be presented with the list of operating systems (usually there will be only one). Highlight it by clicking on it and select Next.
• In the Choose Recovery Tool menu select Command Prompt.

You will see a big black window with a blinking cursor (command prompt).

Access the notepad and identify your USB drive

In the Command Prompt please type in:

notepad

and press Enter.

• When the notepad opens, go to File menu.
• Select Open.
• Go to Computer and search there for your USB drive letter.

Note down the letter and close the notepad.

Scan with Farbar Recovery Scan Tool

Once back in the command prompt window, please do the following:

• Type in e:\frst.exe and press Enter.
  You need to replace e with the letter of your USB drive taken from notepad!
• FRST will start to run. Give him a minute or so to load itself.
• Click Yes to Disclaimer.
• In the main console, please click Scan and wait.

When finished it will produce a logfile named FRST.txt in the root of your pendrive and display it. Close that logfile.

Transfer it to your clean machine and include it in your next reply.

[Naathim]

Hi

 

Still with me? Any problems with my instructions?

[Tazdrh]

Hi Naat,

Yes I am still with you I have the flash drive ready. I plan on trying to run it as soon as i can today.

sorry for taking so long to reply.

 

Thanks

David

[Naathim]

Thanks for notifying

 

If you have any doubts about my instructions - please don't hesitate to shout

[Tazdrh]

Hi Naat,

I booted from the usb flash drive it came up and went through the steps   the one place was hightlighted i clicked next as said is scanning for repairing . is as far as i got not got to where i have the option to open command prompt. 

thanks

David

[Naathim]

Let's give it some more time (sometimes it just takes much amount of time). If no joy, reboot and try once more please.

 

Cheers,

Naat

[Naathim]

Hey

 

Still with me?

[Tazdrh]

Hello Naat,

I did as you asked. I still have not gotten anywhere. once it goes a a while then it shuts it self down and restarts.

 

Thanks

David

[Tazdrh]

Hi Naat,

i finally got it to do the scan frst.exe it is in the doings now will post results as soon as it finishes.

 

Thank you

David

[Tazdrh]

Hi Naat,

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 21-07-2014
Ran by SYSTEM on MININT-D96NVNE on 28-07-2014 19:27:25
Running from g:\
Platform: Windows 7 Ultimate (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingc...can-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingc...can-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo...very-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [11613288 2010-11-19] (Realtek Semiconductor)
HKLM\...\Run: [Logitech Download Assistant] => C:\Windows\system32\rundll32.exe C:\Windows\System32\LogiLDA.dll,LogiFetch
HKLM\...\Run: [Kernel and Hardware Abstraction Layer] => KHALMNPR.EXE
HKLM\...\Run: [NvBackend] => C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [2279712 2013-12-09] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap64.dll,ShadowPlayOnSystemStart
HKLM\...\Run: [AdobeAAMUpdater-1.0] => C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [472984 2013-06-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-05-07] (Oracle Corporation)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
Winlogon\Notify\SEP-x32: C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\WinLogoutNotifier.dll [X]
HKU\Dad\...\Run: [Messenger (Yahoo!)] => C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe [6595928 2012-05-25] (Yahoo! Inc.)
HKU\Dad\...\Run: [Akamai NetSession Interface] => "C:\Users\Dad\AppData\Local\Akamai\netsession_win.exe"
HKU\Dad\...\Run: [GarminExpressTrayApp] => C:\Program Files (x86)\Garmin\Express Tray\ExpressTray.exe [122200 2014-06-09] (Garmin Ltd or its subsidiaries)
HKU\Default\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [mctadmin] => C:\Windows\System32\mctadmin.exe [97280 2009-07-13] (Microsoft Corporation)
Startup: C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Launch Jawbone Updater.lnk
ShortcutTarget: Launch Jawbone Updater.lnk -> C:\Program Files (x86)\Jawbone\LaunchJU.exe ()
Startup: C:\Users\Dad\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Verizon Wireless Software Utility Application for Android – Samsung.lnk
ShortcutTarget: Verizon Wireless Software Utility Application for Android – Samsung.lnk ->  (No File)
ShellIconOverlayIdentifiers-x32: EnhancedStorageShell -> {D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 1 (GFS Unread Stub) -> {99FD978C-D287-4F50-827F-B2C658EDA8E7} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2 (GFS Stub) -> {AB5C5600-7E6E-4B06-9197-9ECEF74D31CC} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 2.5 (GFS Unread Folder) -> {920E6DB1-9907-4370-B3A0-BAFC03D81399} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 3 (GFS Folder) -> {16F3DD56-1AF5-4347-846D-7C10C4192619} =>  No File
ShellIconOverlayIdentifiers-x32: Groove Explorer Icon Overlay 4 (GFS Unread Mark) -> {2916C86E-86A6-43FE-8112-43ABE6BF8DCC} =>  No File
ShellIconOverlayIdentifiers-x32: SharingPrivate -> {08244EE6-92F0-47f2-9FC9-929BAA2E7235} =>  No File

==================== Services (Whitelisted) =================

S2 AdobeActiveFileMonitor12.0; C:\Program Files (x86)\Adobe\Elements 12 Organizer\PhotoshopElementsFileAgent.exe [181152 2013-09-03] (Adobe Systems Incorporated)
S2 asComSvc; C:\Program Files (x86)\ASUS\AXSP\1.00.14\atkexComSvc.exe [922240 2011-06-13] ()
S2 asHmComSvc; C:\Program Files (x86)\ASUS\AAHM\1.00.14\aaHMSvc.exe [915584 2010-12-01] ()
S2 AsSysCtrlService; C:\Program Files (x86)\ASUS\AsSysCtrlService\1.00.11\AsSysCtrlService.exe [586880 2010-10-21] ()
S2 Garmin Core Update Service; C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe [435032 2014-06-09] (Garmin Ltd or its subsidiaries)
S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-05-12] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe [860472 2014-05-12] (Malwarebytes Corporation)
S2 NvNetworkService; C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe [1494304 2013-12-09] (NVIDIA Corporation)
S2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [15129376 2013-12-09] (NVIDIA Corporation)
S2 PMBDeviceInfoProvider; C:\Program Files (x86)\Sony\PlayMemories Home\PMBDeviceInfoProvider.exe [483864 2013-04-24] (Sony Corporation)
S2 SepMasterService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin\ccSvcHst.exe [137208 2012-01-27] (Symantec Corporation)
S3 SmcService; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\Smc.exe [2601544 2012-04-19] (Symantec Corporation)
S3 SNAC; C:\Program Files (x86)\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Bin64\snac64.exe [325040 2012-04-18] (Symantec Corporation)

==================== Drivers (Whitelisted) ====================

S3 AE1000; C:\Windows\System32\DRIVERS\ae1000w7.sys [1600064 2012-07-22] (Ralink Technology Corp.)
S0 AiChargerPlus; C:\Windows\System32\DRIVERS\AiChargerPlus.sys [14464 2010-11-08] (ASUSTek Computer Inc.)
S1 AsIO; C:\Windows\SysWow64\drivers\AsIO.sys [13440 2010-08-23] ()
S1 AsUpIO; C:\Windows\SysWow64\drivers\AsUpIO.sys [14464 2010-08-02] ()
S3 ASUSFILTER; C:\Windows\SysWow64\drivers\ASUSFILTER.sys [46152 2011-09-19] (MCCI Corporation)
S1 BHDrvx64; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\BASHDefs\20140612.012\BHDrvx64.sys [1530160 2014-05-09] (Symantec Corporation)
S1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [486192 2014-06-10] (Symantec Corporation)
S1 IDSVia64; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\IPSDefs\20140718.001\IDSvia64.sys [525016 2014-05-12] (Symantec Corporation)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [52320 2012-09-26] (http://libusb-win32.sourceforge.net)
S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2014-05-12] (Malwarebytes Corporation)
S3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [122584 2014-07-10] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2014-05-12] (Malwarebytes Corporation)
S3 NAVENG; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\VirusDefs\20140718.009\ENG64.SYS [126040 2014-07-16] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Symantec\Symantec Endpoint Protection\12.1.1101.401.105\Data\Definitions\VirusDefs\20140718.009\EX64.SYS [2099288 2014-07-16] (Symantec Corporation)
S1 netfilter64; C:\Windows\System32\drivers\netfilter64.sys [46376 2014-06-12] ()
S3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad64v.sys [39200 2013-12-05] (NVIDIA Corporation)
S0 PxHlpa64; C:\Windows\System32\drivers\PxHlpa64.sys [56336 2013-07-18] (Corel Corporation)
S1 SRTSP; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SRTSP64.SYS [678008 2012-03-06] (Symantec Corporation)
S1 SRTSPX; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SRTSPX64.SYS [39032 2012-03-06] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMDS64.SYS [451192 2011-11-15] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMEFA64.SYS [932472 2012-02-26] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT64x86.SYS [175736 2012-07-22] (Symantec Corporation)
S1 SymIRON; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\Ironx64.SYS [171128 2011-11-15] (Symantec Corporation)
S1 SYMNETS; C:\Windows\System32\Drivers\SEP\0C01044D\0191.105\x64\SYMNETS.SYS [386168 2012-03-18] (Symantec Corporation)
S3 EraserUtilDrv11313; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilDrv11313.sys [X]
S3 EraserUtilRebootDrv; \??\C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-28 19:20 - 2014-07-28 19:27 - 00000000 ____D () C:\FRST
2014-07-09 16:27 - 2014-07-09 16:27 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-09 16:12 - 2014-07-09 16:12 - 00029300 _____ () C:\Users\Dad\Desktop\Malwarebytes.txt
2014-07-09 15:39 - 2014-07-09 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dad\Downloads\mbam-setup-2.0.2.1012(3).exe
2014-07-09 15:31 - 2014-07-09 15:32 - 61481016 _____ (MediaFire) C:\Users\Dad\Downloads\MediaFireDesktop-1.0.12.10164-windows-PRODUCTION.exe
2014-07-08 15:26 - 2014-07-08 15:26 - 02214121 _____ () C:\Users\Dad\Desktop\Application.zip
2014-07-08 15:24 - 2014-07-08 15:25 - 18944000 _____ () C:\Users\Dad\Desktop\Application.evtx
2014-07-08 15:07 - 2014-06-29 18:09 - 00519168 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-07-08 15:07 - 2014-06-29 18:04 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-07-08 15:07 - 2014-06-20 12:14 - 00266424 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-07-08 15:07 - 2014-06-20 11:39 - 00240824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-07-08 15:07 - 2014-06-18 17:39 - 23464448 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-07-08 15:07 - 2014-06-18 17:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-07-08 15:07 - 2014-06-18 17:06 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-07-08 15:07 - 2014-06-18 16:48 - 02768384 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-07-08 15:07 - 2014-06-18 16:42 - 00548352 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-07-08 15:07 - 2014-06-18 16:42 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-07-08 15:07 - 2014-06-18 16:41 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-07-08 15:07 - 2014-06-18 16:41 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-07-08 15:07 - 2014-06-18 16:32 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-07-08 15:07 - 2014-06-18 16:31 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-07-08 15:07 - 2014-06-18 16:26 - 00598016 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-07-08 15:07 - 2014-06-18 16:24 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-07-08 15:07 - 2014-06-18 16:24 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-07-08 15:07 - 2014-06-18 16:23 - 00752640 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-07-08 15:07 - 2014-06-18 16:16 - 17276416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-07-08 15:07 - 2014-06-18 16:14 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-07-08 15:07 - 2014-06-18 16:09 - 00452608 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-07-08 15:07 - 2014-06-18 15:59 - 00038400 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-07-08 15:07 - 2014-06-18 15:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-07-08 15:07 - 2014-06-18 15:53 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-07-08 15:07 - 2014-06-18 15:51 - 05721088 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-07-08 15:07 - 2014-06-18 15:50 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-07-08 15:07 - 2014-06-18 15:48 - 00292864 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-07-08 15:07 - 2014-06-18 15:39 - 00608768 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-07-08 15:07 - 2014-06-18 15:38 - 00455168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-07-08 15:07 - 2014-06-18 15:37 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-07-08 15:07 - 2014-06-18 15:36 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-07-08 15:07 - 2014-06-18 15:35 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-07-08 15:07 - 2014-06-18 15:33 - 00631808 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-07-08 15:07 - 2014-06-18 15:32 - 02179072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-07-08 15:07 - 2014-06-18 15:28 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-07-08 15:07 - 2014-06-18 15:28 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-07-08 15:07 - 2014-06-18 15:27 - 02040832 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-07-08 15:07 - 2014-06-18 15:27 - 01249280 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-07-08 15:07 - 2014-06-18 15:25 - 00442368 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-07-08 15:07 - 2014-06-18 15:23 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-07-08 15:07 - 2014-06-18 15:22 - 00592896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-07-08 15:07 - 2014-06-18 15:12 - 00367616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-07-08 15:07 - 2014-06-18 15:06 - 00032256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-07-08 15:07 - 2014-06-18 15:01 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-07-08 15:07 - 2014-06-18 14:59 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-07-08 15:07 - 2014-06-18 14:58 - 02266112 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-07-08 15:07 - 2014-06-18 14:58 - 00239616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-07-08 15:07 - 2014-06-18 14:52 - 04254720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-07-08 15:07 - 2014-06-18 14:51 - 13527040 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-07-08 15:07 - 2014-06-18 14:49 - 00526336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-07-08 15:07 - 2014-06-18 14:46 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-07-08 15:07 - 2014-06-18 14:45 - 01964544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-07-08 15:07 - 2014-06-18 14:35 - 11742208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-07-08 15:07 - 2014-06-18 14:34 - 01393664 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-07-08 15:07 - 2014-06-18 14:15 - 00846336 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-07-08 15:07 - 2014-06-18 14:13 - 01791488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-07-08 15:07 - 2014-06-18 14:09 - 01139200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-07-08 15:07 - 2014-06-18 14:07 - 00704512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-07-08 15:07 - 2014-06-17 18:18 - 00692736 _____ (Microsoft Corporation) C:\Windows\System32\osk.exe
2014-07-08 15:07 - 2014-06-17 17:51 - 00646144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\osk.exe
2014-07-08 15:07 - 2014-06-17 17:10 - 03157504 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-07-08 15:07 - 2014-06-06 02:10 - 00624128 _____ (Microsoft Corporation) C:\Windows\System32\qedit.dll
2014-07-08 15:07 - 2014-06-06 01:44 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll
2014-07-08 15:07 - 2014-05-30 00:08 - 00728064 _____ (Microsoft Corporation) C:\Windows\System32\kerberos.dll
2014-07-08 15:07 - 2014-05-30 00:08 - 00340992 _____ (Microsoft Corporation) C:\Windows\System32\schannel.dll
2014-07-08 15:07 - 2014-05-30 00:08 - 00314880 _____ (Microsoft Corporation) C:\Windows\System32\msv1_0.dll
2014-07-08 15:07 - 2014-05-30 00:08 - 00307200 _____ (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2014-07-08 15:07 - 2014-05-30 00:08 - 00210944 _____ (Microsoft Corporation) C:\Windows\System32\wdigest.dll
2014-07-08 15:07 - 2014-05-30 00:08 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-07-08 15:07 - 2014-05-30 00:08 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-07-08 15:07 - 2014-05-29 23:52 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-07-08 15:07 - 2014-05-29 23:52 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2014-07-08 15:07 - 2014-05-29 23:52 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2014-07-08 15:07 - 2014-05-29 23:52 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2014-07-08 15:07 - 2014-05-29 23:52 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2014-07-08 15:07 - 2014-05-29 23:52 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-07-08 15:07 - 2014-05-29 23:52 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-07-08 15:07 - 2014-05-29 22:45 - 00497152 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\afd.sys
2014-07-08 15:06 - 2014-06-05 06:45 - 01460736 _____ (Microsoft Corporation) C:\Windows\System32\lsasrv.dll
2014-07-08 15:06 - 2014-06-05 06:26 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-07-08 15:06 - 2014-06-05 06:25 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-07-07 15:32 - 2014-07-07 15:33 - 00000000 ____D () C:\Users\Dad\AppData\Roaming\Yahoo!
2014-07-07 15:32 - 2014-07-07 15:32 - 00001141 _____ () C:\Users\Public\Desktop\Yahoo! Messenger.lnk
2014-07-07 15:32 - 2014-07-07 15:32 - 00000000 ____D () C:\ProgramData\Yahoo! Companion
2014-07-07 15:32 - 2014-07-07 15:32 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-07-07 15:31 - 2014-07-07 15:31 - 00691576 _____ (Yahoo! Inc.) C:\Users\Dad\Downloads\msgr11us.exe
2014-07-07 15:27 - 2014-07-07 15:27 - 00197679 _____ () C:\Users\Dad\Downloads\ListChkdskResult.exe
2014-07-07 15:27 - 2014-07-07 15:27 - 00000326 _____ () C:\Users\Dad\Desktop\ListChkdskResult.txt
2014-07-06 04:43 - 2010-08-30 04:34 - 00536576 _____ (SQLite Development Team) C:\Windows\SysWOW64\sqlite3.dll
2014-07-06 04:42 - 2014-07-06 07:47 - 00000000 ____D () C:\AdwCleaner
2014-07-06 04:41 - 2014-07-06 04:41 - 01346519 _____ () C:\Users\Dad\Desktop\AdwCleaner.exe
2014-07-04 06:52 - 2014-07-04 06:06 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-07-04 06:12 - 2014-07-06 04:12 - 00000000 ____D () C:\zoek
2014-07-04 06:06 - 2014-07-03 16:11 - 00048673 _____ () C:\zoek-results2014-07-04-001139.log
2014-07-03 16:03 - 2014-07-03 15:59 - 00048583 _____ () C:\zoek-results2014-07-03-235905.log
2014-07-03 15:48 - 2014-07-06 04:30 - 00050424 _____ () C:\zoek-results.log
2014-07-03 15:42 - 2014-07-03 15:43 - 04235784 _____ () C:\Users\Dad\Downloads\zoek.rar
2014-07-03 15:42 - 2014-07-03 15:42 - 01285120 _____ () C:\Users\Dad\Downloads\zoek(1).exe
2014-07-03 15:40 - 2014-07-03 15:40 - 01285120 _____ () C:\Users\Dad\Downloads\zoek.exe
2014-07-03 15:39 - 2014-07-04 06:21 - 00000000 ____D () C:\zoek_backup
2014-07-03 15:39 - 2014-07-04 05:55 - 00000000 ____D () C:\Users\Dad\Desktop\zoek
2014-07-02 16:53 - 2014-07-02 16:53 - 00602112 _____ (OldTimer Tools) C:\Users\Dad\Downloads\OTL(2).exe
2014-07-01 17:08 - 2014-07-01 17:08 - 00000000 ____D () C:\Users\Dad\AppData\Roaming\No Company Name
2014-07-01 16:57 - 2014-07-01 16:57 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Dad\Downloads\tdsskiller.exe
2014-07-01 16:54 - 2014-07-01 16:58 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-01 16:53 - 2014-07-01 16:53 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Dad\Downloads\revosetup.exe
2014-07-01 16:30 - 2014-07-01 16:30 - 02347384 _____ (ESET) C:\Users\Dad\Downloads\esetsmartinstaller_enu.exe
2014-06-29 05:57 - 2014-06-29 05:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-06-29 05:57 - 2014-06-29 05:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-06-29 05:57 - 2014-06-29 05:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-06-29 05:57 - 2014-06-29 05:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-06-29 05:57 - 2014-06-29 05:57 - 00000000 ____D () C:\Program Files (x86)\Java
2014-06-28 18:18 - 2014-06-28 18:18 - 00072990 _____ () C:\Users\Dad\Downloads\Extras.Txt
2014-06-28 18:17 - 2014-07-02 18:07 - 00103686 _____ () C:\Users\Dad\Downloads\OTL.Txt
2014-06-28 18:07 - 2014-06-28 18:07 - 00602112 _____ (OldTimer Tools) C:\Users\Dad\Downloads\OTL(1).exe
2014-06-28 17:33 - 2014-06-28 17:34 - 00602112 _____ (OldTimer Tools) C:\Users\Dad\Downloads\OTL.exe
2014-06-28 17:14 - 2014-06-28 17:14 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-06-28 15:32 - 2014-07-10 11:39 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-06-28 15:32 - 2014-07-09 15:40 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-06-28 15:32 - 2014-07-09 15:40 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-06-28 15:32 - 2014-06-28 15:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-28 15:32 - 2014-05-12 03:26 - 00091352 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbamchameleon.sys
2014-06-28 15:32 - 2014-05-12 03:26 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mwac.sys
2014-06-28 15:32 - 2014-05-12 03:25 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2014-06-28 15:31 - 2014-06-28 15:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dad\Downloads\mbam-setup-2.0.2.1012(2).exe
2014-06-28 15:20 - 2014-07-02 17:19 - 00000000 ____D () C:\Users\Dad\Desktop\New folder
2014-06-28 15:07 - 2014-06-28 15:07 - 04812672 _____ (Piriform Ltd) C:\Users\Dad\Downloads\ccsetup415.exe
2014-06-28 15:02 - 2014-06-28 15:02 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dad\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-28 14:56 - 2014-06-28 14:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dad\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-28 14:23 - 2014-06-28 14:23 - 00000000 _____ () C:\Windows\System32\MSVCR120.dll
2014-06-28 14:23 - 2014-06-28 14:23 - 00000000 _____ () C:\Windows\System32\MSVCP120.dll
2014-06-28 13:57 - 2014-06-28 13:57 - 02473936 _____ (Trend Micro Inc.) C:\Users\Dad\Downloads\HousecallLauncher64(1).exe
2014-06-28 13:56 - 2014-06-28 13:56 - 02473936 _____ (Trend Micro Inc.) C:\Users\Dad\Downloads\HousecallLauncher64.exe
2014-06-28 13:40 - 2014-06-28 13:40 - 00000000 ____D () C:\MININT
2014-06-28 10:59 - 2014-06-28 11:00 - 00000000 ____D () C:\Users\Dad\AppData\Local\Deployment
2014-06-28 10:59 - 2014-06-28 10:59 - 00000000 ____D () C:\Users\Dad\AppData\Local\Apps\2.0
2014-06-28 05:15 - 2014-06-28 05:15 - 00292240 _____ () C:\Windows\Minidump\062814-73460-01.dmp

==================== One Month Modified Files and Folders =======

2014-07-28 19:27 - 2014-07-28 19:20 - 00000000 ____D () C:\FRST
2014-07-27 10:56 - 2012-07-22 09:23 - 00000000 _____ () C:\Windows\System32\Drivers\lvuvc.hs
2014-07-18 15:51 - 2013-09-14 18:54 - 00000334 _____ () C:\Windows\Tasks\HP Photo Creations Communicator.job
2014-07-18 15:22 - 2012-07-22 17:18 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-07-18 15:19 - 2013-07-20 10:34 - 00000892 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-07-17 17:56 - 2013-07-20 10:34 - 00002183 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-07-17 16:21 - 2013-07-20 10:34 - 00000888 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-07-17 04:33 - 2012-07-22 10:31 - 01359540 _____ () C:\Windows\WindowsUpdate.log
2014-07-16 22:23 - 2012-07-25 16:37 - 00000000 ____D () C:\Users\Dad\AppData\Local\Adobe
2014-07-14 00:37 - 2009-07-13 20:45 - 00013744 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-14 00:37 - 2009-07-13 20:45 - 00013744 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-12 22:27 - 2013-06-12 17:02 - 00000000 ____D () C:\Users\Dad\AppData\Local\CrashDumps
2014-07-10 18:11 - 2009-07-13 21:13 - 00782578 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-07-10 17:52 - 2009-07-13 20:51 - 00072519 _____ () C:\Windows\setupact.log
2014-07-10 17:42 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-07-10 17:41 - 2012-07-22 08:56 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-07-10 11:39 - 2014-06-28 15:32 - 00122584 _____ (Malwarebytes Corporation) C:\Windows\System32\Drivers\MBAMSwissArmy.sys
2014-07-09 16:27 - 2014-07-09 16:27 - 00000000 ____D () C:\Program Files (x86)\ESET
2014-07-09 16:12 - 2014-07-09 16:12 - 00029300 _____ () C:\Users\Dad\Desktop\Malwarebytes.txt
2014-07-09 15:40 - 2014-06-28 15:32 - 00001106 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2014-07-09 15:40 - 2014-06-28 15:32 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes Anti-Malware
2014-07-09 15:39 - 2014-07-09 15:39 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dad\Downloads\mbam-setup-2.0.2.1012(3).exe
2014-07-09 15:32 - 2014-07-09 15:31 - 61481016 _____ (MediaFire) C:\Users\Dad\Downloads\MediaFireDesktop-1.0.12.10164-windows-PRODUCTION.exe
2014-07-09 08:23 - 2012-07-22 17:18 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-07-09 08:23 - 2012-07-22 17:18 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-07-09 08:23 - 2012-07-22 17:18 - 00003768 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-07-08 20:19 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-07-08 16:43 - 2009-07-13 20:45 - 01772632 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-07-08 16:17 - 2014-05-06 23:00 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-07-08 16:17 - 2009-07-13 23:46 - 00000000 ____D () C:\Program Files\Windows Journal
2014-07-08 16:15 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2014-07-08 16:15 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\System32\Dism
2014-07-08 16:00 - 2013-08-13 23:00 - 00000000 ____D () C:\Windows\System32\MRT
2014-07-08 15:58 - 2012-07-22 09:25 - 96441528 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-07-08 15:26 - 2014-07-08 15:26 - 02214121 _____ () C:\Users\Dad\Desktop\Application.zip
2014-07-08 15:25 - 2014-07-08 15:24 - 18944000 _____ () C:\Users\Dad\Desktop\Application.evtx
2014-07-07 15:33 - 2014-07-07 15:32 - 00000000 ____D () C:\Users\Dad\AppData\Roaming\Yahoo!
2014-07-07 15:32 - 2014-07-07 15:32 - 00001141 _____ () C:\Users\Public\Desktop\Yahoo! Messenger.lnk
2014-07-07 15:32 - 2014-07-07 15:32 - 00000000 ____D () C:\ProgramData\Yahoo! Companion
2014-07-07 15:32 - 2014-07-07 15:32 - 00000000 ____D () C:\ProgramData\Yahoo!
2014-07-07 15:32 - 2012-07-22 11:51 - 00000000 ____D () C:\Program Files (x86)\Yahoo!
2014-07-07 15:31 - 2014-07-07 15:31 - 00691576 _____ (Yahoo! Inc.) C:\Users\Dad\Downloads\msgr11us.exe
2014-07-07 15:27 - 2014-07-07 15:27 - 00197679 _____ () C:\Users\Dad\Downloads\ListChkdskResult.exe
2014-07-07 15:27 - 2014-07-07 15:27 - 00000326 _____ () C:\Users\Dad\Desktop\ListChkdskResult.txt
2014-07-06 08:12 - 2012-07-22 11:34 - 00335658 _____ () C:\Windows\PFRO.log
2014-07-06 07:47 - 2014-07-06 04:42 - 00000000 ____D () C:\AdwCleaner
2014-07-06 04:44 - 2012-07-22 07:35 - 00000000 ____D () C:\users\Dad
2014-07-06 04:41 - 2014-07-06 04:41 - 01346519 _____ () C:\Users\Dad\Desktop\AdwCleaner.exe
2014-07-06 04:30 - 2014-07-03 15:48 - 00050424 _____ () C:\zoek-results.log
2014-07-06 04:12 - 2014-07-04 06:12 - 00000000 ____D () C:\zoek
2014-07-04 06:21 - 2014-07-03 15:39 - 00000000 ____D () C:\zoek_backup
2014-07-04 06:06 - 2014-07-04 06:52 - 00024064 _____ () C:\Windows\zoek-delete.exe
2014-07-04 05:55 - 2014-07-03 15:39 - 00000000 ____D () C:\Users\Dad\Desktop\zoek
2014-07-03 16:11 - 2014-07-04 06:06 - 00048673 _____ () C:\zoek-results2014-07-04-001139.log
2014-07-03 15:59 - 2014-07-03 16:03 - 00048583 _____ () C:\zoek-results2014-07-03-235905.log
2014-07-03 15:43 - 2014-07-03 15:42 - 04235784 _____ () C:\Users\Dad\Downloads\zoek.rar
2014-07-03 15:42 - 2014-07-03 15:42 - 01285120 _____ () C:\Users\Dad\Downloads\zoek(1).exe
2014-07-03 15:40 - 2014-07-03 15:40 - 01285120 _____ () C:\Users\Dad\Downloads\zoek.exe
2014-07-03 15:39 - 2014-05-21 04:36 - 01285120 _____ () C:\Users\Dad\Desktop\zoek.exe
2014-07-02 18:07 - 2014-06-28 18:17 - 00103686 _____ () C:\Users\Dad\Downloads\OTL.Txt
2014-07-02 17:19 - 2014-06-28 15:20 - 00000000 ____D () C:\Users\Dad\Desktop\New folder
2014-07-02 16:53 - 2014-07-02 16:53 - 00602112 _____ (OldTimer Tools) C:\Users\Dad\Downloads\OTL(2).exe
2014-07-01 17:08 - 2014-07-01 17:08 - 00000000 ____D () C:\Users\Dad\AppData\Roaming\No Company Name
2014-07-01 17:08 - 2014-05-24 17:11 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2014-07-01 16:58 - 2014-07-01 16:54 - 00000000 ____D () C:\Program Files (x86)\VS Revo Group
2014-07-01 16:57 - 2014-07-01 16:57 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Dad\Downloads\tdsskiller.exe
2014-07-01 16:53 - 2014-07-01 16:53 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Dad\Downloads\revosetup.exe
2014-07-01 16:30 - 2014-07-01 16:30 - 02347384 _____ (ESET) C:\Users\Dad\Downloads\esetsmartinstaller_enu.exe
2014-06-29 18:09 - 2014-07-08 15:07 - 00519168 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-06-29 18:04 - 2014-07-08 15:07 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-06-29 05:58 - 2013-10-23 01:49 - 00000000 ____D () C:\ProgramData\Oracle
2014-06-29 05:57 - 2014-06-29 05:57 - 00264616 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-06-29 05:57 - 2014-06-29 05:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-06-29 05:57 - 2014-06-29 05:57 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-06-29 05:57 - 2014-06-29 05:57 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-06-29 05:57 - 2014-06-29 05:57 - 00000000 ____D () C:\Program Files (x86)\Java
2014-06-28 18:18 - 2014-06-28 18:18 - 00072990 _____ () C:\Users\Dad\Downloads\Extras.Txt
2014-06-28 18:07 - 2014-06-28 18:07 - 00602112 _____ (OldTimer Tools) C:\Users\Dad\Downloads\OTL(1).exe
2014-06-28 17:34 - 2014-06-28 17:33 - 00602112 _____ (OldTimer Tools) C:\Users\Dad\Downloads\OTL.exe
2014-06-28 17:14 - 2014-06-28 17:14 - 00000000 ____D () C:\TDSSKiller_Quarantine
2014-06-28 16:40 - 2012-07-22 09:09 - 00113200 _____ () C:\Users\Dad\AppData\Local\GDIPFONTCACHEV1.DAT
2014-06-28 16:37 - 2012-09-22 15:44 - 00000000 ____D () C:\Users\Dad\Documents\My PSP Files
2014-06-28 16:15 - 2012-07-22 15:16 - 00011395 _____ () C:\ProgramData\hpzinstall.log
2014-06-28 15:48 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\Help
2014-06-28 15:46 - 2013-10-06 06:50 - 00000000 ____D () C:\temp
2014-06-28 15:32 - 2014-06-28 15:32 - 00000000 ____D () C:\ProgramData\Malwarebytes
2014-06-28 15:31 - 2014-06-28 15:31 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dad\Downloads\mbam-setup-2.0.2.1012(2).exe
2014-06-28 15:07 - 2014-06-28 15:07 - 04812672 _____ (Piriform Ltd) C:\Users\Dad\Downloads\ccsetup415.exe
2014-06-28 15:02 - 2014-06-28 15:02 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dad\Downloads\mbam-setup-2.0.2.1012(1).exe
2014-06-28 14:56 - 2014-06-28 14:56 - 17292760 _____ (Malwarebytes Corporation ) C:\Users\Dad\Downloads\mbam-setup-2.0.2.1012.exe
2014-06-28 14:48 - 2013-04-30 16:35 - 01179973 _____ () C:\Users\Dad\AppData\Local\census.cache
2014-06-28 14:48 - 2013-04-30 16:35 - 00193959 _____ () C:\Users\Dad\AppData\Local\ars.cache
2014-06-28 14:23 - 2014-06-28 14:23 - 00000000 _____ () C:\Windows\System32\MSVCR120.dll
2014-06-28 14:23 - 2014-06-28 14:23 - 00000000 _____ () C:\Windows\System32\MSVCP120.dll
2014-06-28 14:04 - 2014-04-16 14:59 - 00000010 _____ () C:\Users\Dad\AppData\Local\sponge.last.runtime.cache
2014-06-28 13:57 - 2014-06-28 13:57 - 02473936 _____ (Trend Micro Inc.) C:\Users\Dad\Downloads\HousecallLauncher64(1).exe
2014-06-28 13:56 - 2014-06-28 13:56 - 02473936 _____ (Trend Micro Inc.) C:\Users\Dad\Downloads\HousecallLauncher64.exe
2014-06-28 13:40 - 2014-06-28 13:40 - 00000000 ____D () C:\MININT
2014-06-28 13:40 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\Resources
2014-06-28 11:00 - 2014-06-28 10:59 - 00000000 ____D () C:\Users\Dad\AppData\Local\Deployment
2014-06-28 10:59 - 2014-06-28 10:59 - 00000000 ____D () C:\Users\Dad\AppData\Local\Apps\2.0
2014-06-28 05:15 - 2014-06-28 05:15 - 00292240 _____ () C:\Windows\Minidump\062814-73460-01.dmp
2014-06-28 05:15 - 2013-03-02 18:09 - 00000000 ____D () C:\Windows\Minidump
2014-06-28 05:14 - 2013-03-02 18:08 - 894707009 _____ () C:\Windows\MEMORY.DMP

Some content of TEMP:
====================
C:\Users\Dad\AppData\Local\Temp\Quarantine.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================


==================== Memory info ===========================

Percentage of memory in use: 9%
Total physical RAM: 8153.36 MB
Available physical RAM: 7345.94 MB
Total Pagefile: 8151.51 MB
Available Pagefile: 7345.71 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:931.41 GB) (Free:840.28 GB) NTFS
Drive g: (Repair disc Windows 7 64-bit) (Removable) (Total:3.76 GB) (Free:3.55 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (System Reserved) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 513A7AA7)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=931 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: 0247CAB9)
Partition 1: (Active) - (Size=4 GB) - (Type=07 NTFS)


LastRegBack: 2014-07-07 20:22

==================== End Of Log ============================

[Naathim]

Hi David,

Based on the data I suspect that some part of your hardware is failing. Before moving any further I strongly recommend to do a backup just in case something will go out of order totally.


Backup your data using Puppy Linux

These instructions come courtesy of phillpower2 from our technical section.

===================
***Required Hardware***
CD Burner (CDRW) Drive,
Blank CD,
Extra Storage Device (USB Flash Drive, External Hard Drive)
===================

1. Save these files to your Desktop/Burn Your Live CD:

• Download Latest Puppy Linux ISO (i.e.: lupu-528.iso)
• Download BurnCDCC ISO Burning Software

There are instructions on how to boot from flash drive with puppy here

• Open BurnCDCC with Windows Explorer
• Extract All files to a location you can remember
• Double Click BurnCDCC
• Click Browse and navigate to the Puppy Linux ISO file you just downloaded
• Open/Double Click that file
  IMPORTANT: Adjust the speed bar to CD: 4x DVD: 1x
• Click Start
• Your CD Burner Tray will open automatically
• Insert a blank CD and close the tray
• Click OK

Puppy Linux Live CD will now be created


2. Set your boot priority in the BIOS to CD-ROM first, Hard Drive Second

• Start the computer/press the power button
• Immediately start tapping the appropriate key to enter the BIOS, aka "Setup"
  (Usually shown during the "Dell" screen, or "Gateway" Screen)
• Once in the BIOS, under Advanced BIOS Options change boot priority to:
  CD-ROM 1st, Hard Drive 2nd
• Open your ROM drive and insert the disk
• Press F10 to save and exit
• Agree with "Y" to continue
• Your computer will restart and boot from the Puppy Linux Live CD
  

3. Recover Your Data
Once Puppy Linux has loaded, it is actually running in your computer's Memory (RAM). You will see a fully functioning Graphical User Interface similar to what you normally call "your computer". Internet access may or may not be available depending on your machine, so it is recommended you print these instructions before beginning. Also, double clicking is not needed in Puppy. To expand, or open folders/icons, just click once. Puppy is very light on resources, so you will quickly notice it is much speedier than you are used to. This is normal. Ready? Let's get started.

3a. Mount Drives

• Click the Mount Icon located at the top left of your desktop.
• A Window will open. By default, the "drive" tab will be forward/highlighted. Click on Mount for your hard drive.
• Assuming you only have one hard drive and/or partition, there may be only one selection to mount.
• USB Flash Drives usually automatically mount upon boot, but click the "usbdrv" tab and make sure it is mounted.
• If using an external hard drive for the data recovery, do this under the "drive" tab. Mount it now.

3b. Transfer Files.

• At the bottom left of your desktop a list of all hard drives/partitions, USB Drives, and Optical Drives are listed with a familiar looking hard drive icon.
• Open your old hard drive i.e. sda1
• Next, open your USB Flash Drive or External Drive. i.e. sdc or sdb1
• If you open the wrong drive, simply X out at the top right corner of the window that opens. (Just like in Windows)
• From your old hard drive, drag and drop whatever files/folders you wish to transfer to your USB Drive's Window.

For The Novice: The common path to your pictures, music, video, and documents folders is: Documents and Settings >> All Users (or each idividual name of each user. CHECK All Names!) >> Documents >> You will now see My Music, My Pictures, and My Videos.
Alternatively search for Main drive >> Users >> Username

Remember to only click once! No double clicking! Once you drag and drop your first folder, you will notice a small menu will appear giving you the option to move or copy. Choose COPY each time you drag and drop.

If you're doing this to recover from a virus or malware infection, (or even if you're not), DO NOT copy executable files (.exe, .scr. etc...) if any of these files are infected you could be copying the corruption over to any new device/computer. Just copy documents, pictures, music, or videos.

YOU ARE DONE!!! Simply click Menu >> Mouse Over Shutdown >> Reboot/Turn Off Computer. Be sure to plug your USB Drive into another working windows machine to verify all data is there and transferred without corruption.
Congratulations!

[Naathim]

Hi Dave,

Got your backup?

Cheers,
Naat