Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Browser Hijacked [Solved]

Started by trucker , Jan 25 2015 07:09 AM

This topic is locked

#46
pystryker

Posted 03 February 2015 - 03:49 PM

Trusted Helper

Malware Removal
3,912 posts

Hello :-)

There should be another log Addition.txt log produced with the last FRST scan. Please post that log. The other item you posted was the fixlist. I'm going to consult with a colleague regarding your machine and will post further instructions as soon as possible.

#47
trucker

Posted 04 February 2015 - 08:26 AM

Member

Topic Starter
Member
233 posts

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 31-01-2015

Ran by Lonnie at 2015-02-04 09:24:19

Running from C:\Users\Lonnie\Desktop

Boot Mode: Normal

==========================================================

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: COMODO Antivirus (Enabled - Up to date) {F0BC89B2-8937-0933-021B-B17D981F2A71}

AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

AS: Comodo Defense+ (Enabled - Up to date) {4BDD6856-AF0D-06BD-38AB-8A0FE39860CC}

FW: COMODO Firewall (Enabled) {C8870897-C358-086B-2944-184866CC6D0A}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.296 - Adobe Systems Incorporated)

Adobe Reader XI (11.0.10) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)

aioscnnr (Version: 7.6.13.10 - Your Company Name) Hidden

Apple Application Support (HKLM\...\{A83279FD-CA4B-4206-9535-90974DE76654}) (Version: 2.1.5 - Apple Inc.)

Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)

Assassins Creed Revelations 1.0 (HKLM\...\Assassins Creed Revelations_is1) (Version: 1.0 - Ubisoft)

BoneLab (HKLM\...\{D16CBD59-07B3-4F98-A404-01B6D87A90F2}) (Version: 1.4.0.2 - Next Dimension Imaging)

C4USelfUpdater (Version: 1.00.0000 - Your Company Name) Hidden

center (Version: 7.8.0.0 - Eastman Kodak Company) Hidden

CleanUp! (HKLM\...\CleanUp!) (Version: - )

Comodo Dragon (HKLM\...\Comodo Dragon) (Version: 36.1.1.21 - Comodo)

COMODO Internet Security Premium (HKLM\...\{18F14F4B-D8A9-4309-817E-3BC0B7664E53}) (Version: 8.0.0.4344 - COMODO Security Solutions Inc.)

ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version: - )

essentials (Version: 7.8.0.0 - Eastman Kodak Company) Hidden

Firestorm-Beta (remove only) (HKLM\...\Firestorm-Beta) (Version: 4.5.1.38838 - The Phoenix Firestorm Project, Inc.)

Firestorm-Release (remove only) (HKLM\...\Firestorm-Release) (Version: 4.6.9.42969 - The Phoenix Firestorm Project, Inc.)

GameSpy Arcade (HKLM\...\GameSpy Arcade) (Version: - )

GeekBuddy (HKLM\...\{79B9250E-3714-4877-A2B0-D6C1E93E471A}) (Version: 4.18.121 - Comodo Security Solutions Inc)

GeForce Experience NvStream Client Components (Version: 1.6.28 - NVIDIA Corporation) Hidden

GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)

G'MIC for GIMP version 1.5.8.2 (HKLM\...\G'MIC for GIMP_is1) (Version: 1.5.8.2 - )

Google Books Downloader version 2.3 (HKLM\...\{216729B6-014A-F413-814F-F17F74FBA113}_is1) (Version: 2.3 - GBOOKSDOWNLOADER.COM)

Google Chrome (HKLM\...\Google Chrome) (Version: 40.0.2214.94 - Google Inc.)

Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden

Google+ Auto Backup (HKLM\...\{A50DE037-B5C0-4C8A-8049-B0C576B313D1}) (Version: 1.0.21.81 - Google)

grillaprice (HKLM\...\grillaprice) (Version: - )

Java 7 Update 71 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F03217071FF}) (Version: 7.0.710 - Oracle)

Java 8 Update 25 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)

Kodak AIO Printer (Version: 7.8.1.0 - Eastman Kodak Company) Hidden

KODAK AiO Software (HKLM\...\{E0F274B7-592B-4669-8FB8-8D9825A09858}) (Version: 7.8.5.2 - Eastman Kodak Company)

LEGO Batman 3 - Beyond Gotham (HKLM\...\LEGO Batman 3 - Beyond Gotham_R.G. Mechanics_is1) (Version: - R.G. Mechanics, markfiter)

magicJack (HKU\S-1-5-21-4227807349-2635072203-767282089-1001\...\magicJack) (Version: 4.1.7574.5297 - magicJack L.P.)

Malwarebytes Anti-Malware version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)

Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)

Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.31211.0 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)

Microsoft Visual C++ 2010 Redistributable - x86 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)

Morrowind (HKLM\...\{C325F588-D6B1-4A7F-B6A2-914C75DDA348}) (Version: - )

Mozilla Firefox 35.0.1 (x86 en-US) (HKLM\...\Mozilla Firefox 35.0.1 (x86 en-US)) (Version: 35.0.1 - Mozilla)

Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 25.0.1 - Mozilla)

Mozilla Thunderbird 31.4.0 (x86 en-US) (HKLM\...\Mozilla Thunderbird 31.4.0 (x86 en-US)) (Version: 31.4.0 - Mozilla)

NVIDIA 3D Vision Controller Driver 331.82 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB) (Version: 331.82 - NVIDIA Corporation)

NVIDIA 3D Vision Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 340.52 - NVIDIA Corporation)

NVIDIA GeForce Experience 1.8 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 1.8 - NVIDIA Corporation)

NVIDIA Graphics Driver 340.52 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 340.52 - NVIDIA Corporation)

NVIDIA PhysX System Software 9.13.0725 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.13.0725 - NVIDIA Corporation)

NVIDIA Virtual Audio 1.2.12 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver) (Version: 1.2.12 - NVIDIA Corporation)

ocr (Version: 6.2.3.50 - Eastman Kodak Company) Hidden

OpenOffice 4.1.0 (HKLM\...\{C87EF11D-36E9-479D-9898-7541EA1E8A6A}) (Version: 4.10.9764 - Apache Software Foundation)

Pegasus Mail (HKLM\...\Pegasus Mail) (Version: - David Harris)

Pegasus Mail HTML Renderer 2.4.9.2 (HKLM\...\{A9F5E1E1-1281-4862-90B4-6CF8E6AF83CE}_is1) (Version: - Micha's Midnight Manufacture)

Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)

PreReq (Version: 6.2.4.0 - Eastman Kodak Company) Hidden

PrintProjects (HKLM\...\PrintProjects) (Version: 1.0.0.9282 - RocketLife Inc.)

PrivDog (HKLM\...\PrivDog) (Version: 1.8.0.15 - privdog.com)

Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.7083 - Realtek Semiconductor Corp.)

Samsung Kies (HKLM\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.5.0.12094_27 - Samsung Electronics Co., Ltd.)

Samsung Kies (Version: 2.5.0.12094_27 - Samsung Electronics Co., Ltd.) Hidden

Samsung Story Album Viewer (HKLM\...\InstallShield_{698BBAD8-B116-495D-B879-0F07A533E57F}) (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.)

Samsung Story Album Viewer (Version: 1.0.0.13054_1 - Samsung Electronics Co., Ltd.) Hidden

SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)

SHIELD Streaming (Version: 1.6.75 - NVIDIA Corporation) Hidden

Sweet Home 3D version 4.3 (HKLM\...\Sweet Home 3D_is1) (Version: - eTeks)

System Requirements Lab (HKLM\...\{AC369A7C-2E0D-4925-BFB1-AB50BF825CCC}) (Version: 6.0.8.0 - Husdawg, LLC)

TESV Skyrim LE version 1.9.32.0 (HKLM\...\TESV Skyrim LE_is1) (Version: 1.9.32.0 - Lyxer_Loader)

Tweaking.com - Registry Backup (HKLM\...\Tweaking.com - Registry Backup) (Version: 2.1.0 - Tweaking.com)

Unity Web Player (HKU\S-1-5-21-4227807349-2635072203-767282089-1001\...\UnityWebPlayer) (Version: 4.6.0f2 - Unity Technologies ApS)

VLC media player (HKLM\...\VLC media player) (Version: 2.1.5 - VideoLAN)

Vuze (HKLM\...\8461-7759-5462-8226) (Version: 5.5.0.0 - Azureus Software, Inc.)

Windows Phone app for desktop (HKLM\...\{5F71448B-88EB-4357-9A98-8658D4C49C48}) (Version: 1.1.2726.0 - Microsoft Corporation)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-4227807349-2635072203-767282089-1001_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\Lonnie\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)

==================== Restore Points =========================

03-02-2015 12:30:14 Scheduled Checkpoint

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-13 21:04 - 2015-01-29 22:40 - 00000035 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0612857A-4D96-4A80-80A6-144442BF83C9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2015-01-04] (Apple Inc.)

Task: {08E826DF-7983-4D33-AC73-520F8D7D04B0} - \PastaQuotes No Task File <==== ATTENTION

Task: {1127E81B-ADF1-4EE9-B675-33A29DAF81AC} - System32\Tasks\{41A3FD47-AC06-4610-8451-A76D5A0D7F2F} => pcalua.exe -a C:\Users\Lonnie\Downloads\FirmwareFlashLauncher.exe -d C:\Users\Lonnie\Desktop

Task: {1C0D753B-E868-40BF-BCDD-5C0E1B51C8FF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-01-25] (Adobe Systems Incorporated)

Task: {3D705851-57CD-4512-8100-49D69CD5B55D} - System32\Tasks\{B3C33E76-D92C-4C87-8BA0-F6F6C0B1A367} => pcalua.exe -a "C:\Users\Lonnie\Downloads\erunt (2)\ERUNT.EXE" -d "C:\Users\Lonnie\Downloads\erunt (2)"

Task: {8ACFA7E6-9369-4009-BDAB-490273617C25} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-12-28] (Google Inc.)

Task: {A017A1F5-B136-454F-88AB-D5C404F3C54B} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-12-28] (Google Inc.)

Task: {B09F53FC-4A33-4BD4-B889-EAA07699C650} - System32\Tasks\COMODO\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-04] (COMODO)

Task: {B6573E58-A8CE-4337-9DF1-1A5EDDCD86B8} - System32\Tasks\COMODO\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-04] (COMODO)

Task: {BC797AF4-FBA2-4CBE-8435-561FACA9ABBF} - System32\Tasks\COMODO\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-04] (COMODO)

Task: {D20A8D01-F90F-4C11-8279-55328EDCA369} - System32\Tasks\COMODO\COMODO Autostart {D5EFF3B3-E126-4AF6-BCE9-852A72129E10} => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [2015-02-04] (COMODO)

Task: {E705D62B-0188-4E1F-8F81-CA96B6192A7E} - System32\Tasks\COMODO\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59} => C:\Program Files\COMODO\COMODO Internet Security\cfpconfg.exe [2015-02-04] (COMODO)

Task: {F1E1FAEF-DC7C-4586-AB96-95A7AE31048C} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2013-11-23 09:01 - 2014-07-02 14:42 - 00107992 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll

2014-09-25 07:04 - 2014-09-25 07:04 - 00976080 _____ () C:\Program Files\Comodo\GeekBuddy\QtNetwork4.dll

2014-09-25 07:04 - 2014-09-25 07:04 - 02254544 _____ () C:\Program Files\Comodo\GeekBuddy\QtCore4.dll

2015-01-30 04:25 - 2015-01-26 22:44 - 01117512 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.94\libglesv2.dll

2015-01-30 04:25 - 2015-01-26 22:44 - 00211272 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.94\libegl.dll

2015-01-30 04:25 - 2015-01-26 22:44 - 09171272 _____ () C:\Program Files\Google\Chrome\Application\40.0.2214.94\pdf.dll

2014-09-25 07:04 - 2014-09-25 07:04 - 08024784 _____ () C:\Program Files\Comodo\GeekBuddy\QtGui4.dll

2014-09-25 07:04 - 2014-09-25 07:04 - 00032976 _____ () C:\Program Files\Comodo\GeekBuddy\imageformats\qgif4.dll

2014-09-25 07:04 - 2014-09-25 07:04 - 01299664 _____ () C:\Program Files\Comodo\GeekBuddy\QtScript4.dll

2014-07-04 12:00 - 2014-07-04 12:00 - 00084344 _____ () C:\Users\Lonnie\AppData\Roaming\mjusbsp\octvqem_apiw.DLL

2013-04-15 17:39 - 2013-04-15 17:39 - 00070352 _____ () C:\Program Files\COMODO\COMODO Internet Security\scanners\smart.cav

2014-11-27 08:42 - 2014-11-27 08:42 - 00879808 _____ () C:\Program Files\Comodo\Dragon\libglesv2.dll

2014-11-27 08:33 - 2014-11-27 08:33 - 00134848 _____ () C:\Program Files\Comodo\Dragon\libegl.dll

2014-11-27 08:34 - 2014-11-27 08:34 - 00956608 _____ () C:\Program Files\Comodo\Dragon\ffmpegsumo.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Lonnie\Desktop\Constitutional_amendment_process_(USA).png:$CmdZnID

AlternateDataStreams: C:\Users\Lonnie\Desktop\mbam-setup-2.0.4.1028.exe:$CmdZnID

AlternateDataStreams: C:\Users\Lonnie\Desktop\SecurityCheck.exe:$CmdZnID

AlternateDataStreams: C:\Users\Lonnie\Downloads\esetsmartinstaller_enu.exe:$CmdZnID

AlternateDataStreams: C:\Users\Lonnie\Downloads\FH12MAR_MOSTEP_09.pdf:$CmdZnID

AlternateDataStreams: C:\Users\Lonnie\Downloads\FH12MAR_MOSTEP_CL.pdf:$CmdZnID

AlternateDataStreams: C:\Users\Lonnie\Downloads\hunter-engagement-470x705.jpg:$CmdZnID

AlternateDataStreams: C:\Users\Lonnie\Downloads\tweaking.com_registry_backup_setup.exe:$CmdTcID

AlternateDataStreams: C:\Users\Lonnie\Downloads\tweaking.com_registry_backup_setup.exe:$CmdZnID

AlternateDataStreams: C:\Users\Lonnie\Downloads\unicorn-6.2.1.91.iso:$CmdZnID

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)

==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)

========================= Accounts: ==========================

Administrator (S-1-5-21-4227807349-2635072203-767282089-500 - Administrator - Disabled)

Guest (S-1-5-21-4227807349-2635072203-767282089-501 - Limited - Disabled)

Lonnie (S-1-5-21-4227807349-2635072203-767282089-1001 - Administrator - Enabled) => C:\Users\Lonnie

==================== Faulty Device Manager Devices =============

==================== Event log errors: =========================

Application errors:

==================

Error: (02/04/2015 08:32:51 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: svchost.exe_StiSvc, version: 6.1.7600.16385, time stamp: 0x4a5bc100

Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea91c

Exception code: 0xc0000374

Fault offset: 0x000c3873

Faulting process id: 0x8c4

Faulting application start time: 0xsvchost.exe_StiSvc0

Faulting application path: svchost.exe_StiSvc1

Faulting module path: svchost.exe_StiSvc2

Report Id: svchost.exe_StiSvc3

Error: (02/03/2015 08:57:49 AM) (Source: VSS) (EventID: 8194) (User: )

Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.

This is often caused by incorrect security settings in either the writer or requestor process.

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {c45a6cb7-af53-4660-b5b5-a9750d679111}

Error: (02/01/2015 07:12:35 AM) (Source: VSS) (EventID: 8194) (User: )

Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.

This is often caused by incorrect security settings in either the writer or requestor process.

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {66354274-4a95-422a-8d76-bff4208742b0}

Error: (01/31/2015 07:38:25 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: svchost.exe_StiSvc, version: 6.1.7600.16385, time stamp: 0x4a5bc100

Faulting module name: ntdll.dll, version: 6.1.7601.18247, time stamp: 0x521ea91c

Exception code: 0xc0000374

Fault offset: 0x000c3873

Faulting process id: 0x944

Faulting application start time: 0xsvchost.exe_StiSvc0

Faulting application path: svchost.exe_StiSvc1

Faulting module path: svchost.exe_StiSvc2

Report Id: svchost.exe_StiSvc3

Error: (01/30/2015 08:45:21 PM) (Source: VSS) (EventID: 8194) (User: )

Description: Volume Shadow Copy Service error: Unexpected error querying for the IVssWriterCallback interface. hr = 0x80070005, Access is denied.

This is often caused by incorrect security settings in either the writer or requestor process.

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {bff8e0e3-6b70-4119-8543-4c38cf8578c9}

Error: (01/30/2015 09:34:16 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: Faulting application name: gimp-2.8.exe, version: 2.8.14.0, time stamp: 0x00000000

Faulting module name: libpixman-1-0.dll, version: 0.0.0.0, time stamp: 0x0072a5f0

Exception code: 0xc0000005

Fault offset: 0x00084b3b

Faulting process id: 0xa4c

Faulting application start time: 0xgimp-2.8.exe0

Faulting application path: gimp-2.8.exe1

Faulting module path: gimp-2.8.exe2

Report Id: gimp-2.8.exe3

Error: (01/30/2015 06:27:15 AM) (Source: WinMgmt) (EventID: 24) (User: )

Description: CisWmiSELECT * FROM CisStatusChangeCisStatusChange//./root/cis

Error: (01/30/2015 06:27:15 AM) (Source: WinMgmt) (EventID: 24) (User: )

Description: CisWmiSELECT * FROM CisNotificationCisNotification//./root/cis

Error: (01/30/2015 06:27:15 AM) (Source: WinMgmt) (EventID: 24) (User: )

Description: CisWmiSELECT * FROM FwAlertFwAlert//./root/cis

Error: (01/30/2015 06:27:15 AM) (Source: WinMgmt) (EventID: 24) (User: )

Description: CisWmiSELECT * FROM DfAlertDfAlert//./root/cis

System errors:

=============

Error: (02/04/2015 08:32:56 AM) (Source: Service Control Manager) (EventID: 7034) (User: )

Description: The Windows Image Acquisition (WIA) service terminated unexpectedly. It has done this 1 time(s).

Error: (02/03/2015 09:03:06 AM) (Source: BugCheck) (EventID: 1001) (User: )

Description: 0x0000000a (0x00000074, 0x00000002, 0x00000001, 0x83085f02)C:\Windows\MEMORY.DMP020315-185641-01

Error: (02/03/2015 09:02:56 AM) (Source: volsnap) (EventID: 25) (User: )

Description: The shadow copies of volume C: were deleted because the shadow copy storage could not grow in time. Consider reducing the IO load on the system or choose a shadow copy storage volume that is not being shadow copied.

Error: (02/03/2015 09:02:58 AM) (Source: EventLog) (EventID: 6008) (User: )

Description: The previous system shutdown at 8:57:51 AM on ‎2/‎3/‎2015 was unexpected.

Error: (02/03/2015 08:43:03 AM) (Source: Service Control Manager) (EventID: 7026) (User: )

Description: The following boot-start or system-start driver(s) failed to load:

cdrom

Error: (02/01/2015 07:06:04 AM) (Source: atapi) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Ide\IdePort0.

Error: (02/01/2015 07:05:31 AM) (Source: cdrom) (EventID: 15) (User: )

Description: The device, \Device\CdRom0, is not ready for access yet.

Error: (02/01/2015 07:05:31 AM) (Source: atapi) (EventID: 11) (User: )

Description: The driver detected a controller error on \Device\Ide\IdePort0.

Error: (02/01/2015 07:05:31 AM) (Source: cdrom) (EventID: 15) (User: )

Description: The device, \Device\CdRom0, is not ready for access yet.

Error: (02/01/2015 07:05:31 AM) (Source: cdrom) (EventID: 15) (User: )

Description: The device, \Device\CdRom0, is not ready for access yet.

Microsoft Office Sessions:

=========================

Error: (02/04/2015 08:32:51 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: svchost.exe_StiSvc6.1.7600.163854a5bc100ntdll.dll6.1.7601.18247521ea91cc0000374000c38738c401d0407f0ed9dfb3C:\Windows\system32\svchost.exeC:\Windows\SYSTEM32\ntdll.dll50c71715-ac72-11e4-9233-001a4d4ff044

Error: (02/03/2015 08:57:49 AM) (Source: VSS) (EventID: 8194) (User: )

Description: 0x80070005, Access is denied.

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {c45a6cb7-af53-4660-b5b5-a9750d679111}

Error: (02/01/2015 07:12:35 AM) (Source: VSS) (EventID: 8194) (User: )

Description: 0x80070005, Access is denied.

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {66354274-4a95-422a-8d76-bff4208742b0}

Error: (01/31/2015 07:38:25 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: svchost.exe_StiSvc6.1.7600.163854a5bc100ntdll.dll6.1.7601.18247521ea91cc0000374000c387394401d03d52c9e3171cC:\Windows\system32\svchost.exeC:\Windows\SYSTEM32\ntdll.dll0c2e6a2a-a946-11e4-9237-001a4d4ff044

Error: (01/30/2015 08:45:21 PM) (Source: VSS) (EventID: 8194) (User: )

Description: 0x80070005, Access is denied.

Operation:

Gathering Writer Data

Context:

Writer Class Id: {e8132975-6f93-4464-a53e-1050253ae220}

Writer Name: System Writer

Writer Instance ID: {bff8e0e3-6b70-4119-8543-4c38cf8578c9}

Error: (01/30/2015 09:34:16 AM) (Source: Application Error) (EventID: 1000) (User: )

Description: gimp-2.8.exe2.8.14.000000000libpixman-1-0.dll0.0.0.00072a5f0c000000500084b3ba4c01d03c994b5dc736C:\Program Files\GIMP 2\bin\gimp-2.8.exeC:\Program Files\GIMP 2\bin\libpixman-1-0.dll10c2a5db-a88d-11e4-bd92-001a4d4ff044

Error: (01/30/2015 06:27:15 AM) (Source: WinMgmt) (EventID: 24) (User: )

Description: CisWmiSELECT * FROM CisStatusChangeCisStatusChange//./root/cis

Error: (01/30/2015 06:27:15 AM) (Source: WinMgmt) (EventID: 24) (User: )

Description: CisWmiSELECT * FROM CisNotificationCisNotification//./root/cis

Error: (01/30/2015 06:27:15 AM) (Source: WinMgmt) (EventID: 24) (User: )

Description: CisWmiSELECT * FROM FwAlertFwAlert//./root/cis

Error: (01/30/2015 06:27:15 AM) (Source: WinMgmt) (EventID: 24) (User: )

Description: CisWmiSELECT * FROM DfAlertDfAlert//./root/cis

==================== Memory info ===========================

Processor: Intel® Core™2 Duo CPU E6750 @ 2.66GHz

Percentage of memory in use: 44%

Total physical RAM: 3582.49 MB

Available physical RAM: 1995.54 MB

Total Pagefile: 7163.27 MB

Available Pagefile: 5120.45 MB

Total Virtual: 2047.88 MB

Available Virtual: 1916.14 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:233.02 GB) (Free:75.5 GB) NTFS ==>[Drive with boot components (obtained from BCD)]

Drive d: () (Fixed) (Total:116.53 GB) (Free:86.83 GB) NTFS

==================== MBR & Partition Table ==================

========================================================

Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: 36363636)

Partition 1: (Active) - (Size=233 GB) - (Type=07 NTFS)

Partition 2: (Not Active) - (Size=116.5 GB) - (Type=07 NTFS)

Partition 3: (Not Active) - (Size=116.2 GB) - (Type=05)

Attempted reading MBR returned 0 bytes.

Could not read MBR for disk 1.

==================== End Of Log ============================

#48
trucker

Posted 04 February 2015 - 08:27 AM

Member

Topic Starter
Member
233 posts

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-01-2015

Ran by Lonnie (administrator) on LONNIE-PC on 04-02-2015 09:22:42

Running from C:\Users\Lonnie\Desktop

Loaded Profiles: Lonnie (Available profiles: Lonnie)

Platform: Microsoft Windows 7 Home Premium Service Pack 1 (X86) OS Language: English (United States)

Internet Explorer Version 11 (Default browser: IE)

Boot Mode: Normal

Tutorial for Farbar Recovery Scan Tool: http://www.geekstogo...very-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Comodo Security Solutions, Inc.) C:\Program Files\Common Files\COMODO\launcher_service.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe

(Comodo Security Solutions, Inc.) C:\Program Files\Comodo\Dragon\dragon_updater.exe

(Teruten) C:\Windows\System32\FsUsbExService.Exe

(Comodo Security Solutions, Inc.) C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe

(Eastman Kodak Company) C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe

(Eastman Kodak Company) C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(Malwarebytes Corporation) C:\Program Files\Malwarebytes Anti-Malware\mbam.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe

(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cistray.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe

(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\NvTmru.exe

(Samsung Electronics Co., Ltd.) C:\Program Files\Samsung\Kies\KiesTrayAgent.exe

(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe

(Eastman Kodak Company) C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe

(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cis.exe

(Comodo Security Solutions, Inc.) C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Comodo Security Solutions, Inc.) C:\Program Files\Comodo\GeekBuddy\unit_manager.exe

(Google Inc.) C:\Program Files\Google\Chrome\Application\chrome.exe

(Comodo Security Solutions, Inc.) C:\Program Files\Comodo\GeekBuddy\unit.exe

(magicJack L.P.) C:\Users\Lonnie\AppData\Roaming\mjusbsp\magicJack.exe

(COMODO) C:\Program Files\Comodo\COMODO Internet Security\cavwp.exe

(Comodo) C:\Program Files\Comodo\Dragon\dragon.exe

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [12017368 2013-10-24] (Realtek Semiconductor)

HKLM\...\Run: [Nvtmru] => C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\nvtmru.exe [1028384 2013-11-14] (NVIDIA Corporation)

HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\rundll32.exe C:\Windows\system32\nvspcap.dll,ShadowPlayOnSystemStart

HKLM\...\Run: [KiesTrayAgent] => C:\Program Files\Samsung\Kies\KiesTrayAgent.exe [311152 2013-11-05] (Samsung Electronics Co., Ltd.)

HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2273056 2013-11-29] (NVIDIA Corporation)

HKLM\...\Run: [Conime] => %windir%\system32\conime.exe

HKLM\...\Run: [EKStatusMonitor] => C:\Program Files\Kodak\AiO\StatusMonitor\EKStatusMonitor.exe [2750840 2013-12-11] (Eastman Kodak Company)

HKLM\...\Run: [APSDaemon] => C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59240 2015-01-04] (Apple Inc.)

HKLM\...\Run: [ComodoFSChrome] => "C:\Program Files\AdTrustMedia\PrivDog\FinalizeSetup.exe" /c

HKLM\...\Run: [COMODO Internet Security] => C:\Program Files\COMODO\COMODO Internet Security\cistray.exe [1243864 2015-02-04] (COMODO)

HKLM\...\Run: [tvncontrol] => C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe [2327248 2015-01-30] (Comodo Security Solutions, Inc.)

HKU\S-1-5-21-4227807349-2635072203-767282089-1001\...\Run: [GoogleChromeAutoLaunch_A4AAD752A94AD0D07B3FA88181A919F9] => C:\Program Files\Comodo\Dragon\dragon.exe [725696 2014-12-28] (Comodo)

HKU\S-1-5-21-4227807349-2635072203-767282089-1001\...\Run: [cdloader] => C:\Users\Lonnie\AppData\Roaming\mjusbsp\cdloader2.exe [51592 2015-02-04] (magicJack L.P.)

HKU\S-1-5-21-4227807349-2635072203-767282089-1001\...\Run: [GoogleChromeAutoLaunch_5090660AF80758FEEBA1A8C0C9DF7D80] => C:\Program Files\Google\Chrome\Application\chrome.exe [843592 2015-01-26] (Google Inc.)

HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-11-21] (Microsoft Corporation)

HKU\S-1-5-18\...\RunOnce: [KodakHomeCenter] => C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe [2234064 2014-05-06] (Eastman Kodak Company)

Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Start GeekBuddy.lnk

ShortcutTarget: Start GeekBuddy.lnk -> C:\Program Files\Comodo\GeekBuddy\launcher.exe (Comodo Security Solutions, Inc.)

BootExecute: autocheck autochk * bootdelete

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com

HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =

HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =

HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

HKU\S-1-5-21-4227807349-2635072203-767282089-1001\Software\Microsoft\Internet Explorer\Main,Start Page = http://us.yahoo.com?fr=fp-comodo

HKU\S-1-5-21-4227807349-2635072203-767282089-1001\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/?ocid=iehp

HKU\S-1-5-21-4227807349-2635072203-767282089-1001\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie

SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =

SearchScopes: HKU\S-1-5-21-4227807349-2635072203-767282089-1001 -> DefaultScope {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = http://us.search.yah...}&fr=chr-comodo

SearchScopes: HKU\S-1-5-21-4227807349-2635072203-767282089-1001 -> {8EEAC88A-079B-4b2c-80C1-7836F79EB40A} URL = http://us.search.yah...}&fr=chr-comodo

BHO: Java™ Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll (Oracle Corporation)

BHO: Java™ Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll (Oracle Corporation)

Tcpip\Parameters: [DhcpNameServer] 209.18.47.61 209.18.47.62

Tcpip\..\Interfaces\{8270EF4F-3060-4E70-871D-BC3BABF46597}: [NameServer] 156.154.70.22,156.154.71.22

FireFox:

========

FF ProfilePath: C:\Users\Lonnie\AppData\Roaming\Mozilla\Firefox\Profiles\0937xwmn.default

FF Homepage: about:home

FF Keyword.URL: hxxp://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=994519&p=

FF NetworkProxy: "type", 4

FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_296.dll ()

FF Plugin: @google.com/npPicasa3,version=3.0.0 -> C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll (Oracle Corporation)

FF Plugin: @microsoft.com/GENUINE -> disabled No File

FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.31211.0\npctrl.dll ( Microsoft Corporation)

FF Plugin: @nvidia.com/3DVision -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF Plugin: @nvidia.com/3DVisionStreaming -> C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.25.11\npGoogleUpdate3.dll (Google Inc.)

FF Plugin: @videolan.org/vlc,version=2.1.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF Plugin HKU\S-1-5-21-4227807349-2635072203-767282089-1001: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Lonnie\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF SearchPlugin: C:\Program Files\mozilla firefox\browser\searchplugins\.xml

Chrome:

=======

CHR HomePage: Default -> hxxp://www.google.com/ig

CHR StartupUrls: Default -> "https://www.google.com/", "hxxp://isearch.omiga?type=hppppppppppppppppppppppppppppp", "hxxp://isearch.omiga?type=hppppppppppppppppppppppppppppppppp"

CHR DefaultSearchKeyword: Default ->

CHR DefaultSearchURL: Default -> http://isearch.omiga...q={searchTerms}

CHR DefaultSuggestURL: Default -> http://ssmsp.ask.com...q={searchTerms}

CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\40.0.2214.94\PepperFlash\pepflashplayer.dll ()

CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer

CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\40.0.2214.94\ppGoogleNaClPluginChrome.dll No File

CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\40.0.2214.94\pdf.dll ()

CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

CHR Plugin: (Picasa) - C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)

CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.23.9\npGoogleUpdate3.dll No File

CHR Plugin: (Java Deployment Toolkit 7.0.510.13) - C:\Program Files\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)

CHR Plugin: (Java™ Platform SE 7 U51) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

CHR Plugin: (NVIDIA 3D Vision) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

CHR Plugin: (NVIDIA 3D VISION) - C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_182.dll No File

CHR Profile: C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default

CHR Extension: (Bejeweled) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\adpkifcfcacgmnggcbpbjbkdijciiigm [2014-12-28]

CHR Extension: (Ancient History Encyclopedia) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\ahggffalhoajbhlaogbplamaaghnncle [2014-12-28]

CHR Extension: (Angry Birds) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj [2014-12-28]

CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-26]

CHR Extension: (Facebook) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\boeajhmfdjldchidhphikilcgdacljfm [2014-12-28]

CHR Extension: (AdBlock Plus) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\cbjmhchkipehceidlknhjhbgaipcnafm [2014-12-29]

CHR Extension: (Calculator) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\decmldkknaaemlafplkkdmmmelbdnlja [2014-12-28]

CHR Extension: (A Space Shooter for FREE) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\epbeobdmeddlnkokfiaijkfabecpmifa [2014-12-28]

CHR Extension: (Typing Lessons) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\heehkcnmhmdicclbnofindfmokhfnjag [2014-12-28]

CHR Extension: (Kindle Cloud Reader) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\icdipabjmbhpdkjaihfjoikhjjeneebd [2014-12-28]

CHR Extension: (sixty second shooter) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\idnlbhjpainpnikdjnmcmiaombhhchkg [2014-12-28]

CHR Extension: (Jamstash) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\jccdpflnecheidefpofmlblgebobbloc [2014-12-28]

CHR Extension: (WordPress.com) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\khjnjifipfkgglficmipimgjpbmlbemd [2014-12-28]

CHR Extension: (Coloring Pages) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\kmhphoobahjckipglphjghghlgodanfj [2014-12-28]

CHR Extension: (Fieldrunners) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\lkpikhjbfbffdblahfidklcohlaeabak [2014-12-28]

CHR Extension: (Chain Rxn) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\mhkdlfmoglbdpomddljgapccmlognoaf [2014-12-28]

CHR Extension: (Search Helper: Preview, Note, Tag, Hide etc) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\naddbmiihfcdfaeencbcmbpioghcjlje [2015-01-30]

CHR Extension: (Google Wallet) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-04-19]

CHR Extension: (Sidekick by HubSpot) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\oiiaigjnkhngdbnoookogelabohpglmd [2015-01-15]

CHR Extension: (Weather Underground) - C:\Users\Lonnie\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjejbgheonogbpfkkjigbmahaljipoej [2014-12-28]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 CLPSLauncher; C:\Program Files\Common Files\COMODO\launcher_service.exe [70864 2015-01-30] (Comodo Security Solutions, Inc.)

R2 CmdAgent; C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe [5868440 2015-02-04] (COMODO)

S3 cmdvirth; C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe [1664216 2015-02-04] (COMODO)

R2 DragonUpdater; C:\Program Files\Comodo\Dragon\dragon_updater.exe [2370240 2014-12-28] (Comodo Security Solutions, Inc.)

R2 FsUsbExService; C:\Windows\system32\FsUsbExService.Exe [233472 2013-10-29] (Teruten) [File not signed]

R2 GeekBuddyRSP; C:\Program Files\Common Files\COMODO\GeekBuddyRSP.exe [2327248 2015-01-30] (Comodo Security Solutions, Inc.)

R2 Kodak AiO Network Discovery Service; C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe [395640 2014-05-06] (Eastman Kodak Company)

R2 Kodak AiO Status Monitor Service; C:\Program Files\Kodak\AiO\StatusMonitor\EKPrinterSDK.exe [780152 2013-12-11] (Eastman Kodak Company)

R2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1871160 2014-11-21] (Malwarebytes Corporation)

R2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [969016 2014-11-21] (Malwarebytes Corporation)

R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1370912 2013-11-29] (NVIDIA Corporation)

R2 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe [14657824 2013-11-29] (NVIDIA Corporation)

S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-26] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 CFRMD; C:\Windows\System32\DRIVERS\CFRMD.sys [35064 2014-06-26] (Windows ® Win 7 DDK provider)

R1 cmderd; C:\Windows\System32\DRIVERS\cmderd.sys [17088 2015-01-30] (COMODO)

R1 cmdGuard; C:\Windows\System32\DRIVERS\cmdguard.sys [618072 2015-01-30] (COMODO)

R1 cmdHlp; C:\Windows\System32\DRIVERS\cmdhlp.sys [41248 2015-01-30] (COMODO)

R3 FsUsbExDisk; C:\Windows\system32\FsUsbExDisk.SYS [37344 2013-10-29] () [File not signed]

R1 inspect; C:\Windows\System32\DRIVERS\inspect.sys [91200 2015-01-30] (COMODO)

R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-11-21] (Malwarebytes Corporation)

R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [114904 2015-02-04] (Malwarebytes Corporation)

R3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2014-11-21] (Malwarebytes Corporation)

R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [34080 2013-10-30] (NVIDIA Corporation)

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)

==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-03 09:02 - 2015-02-03 09:03 - 00159072 _____ () C:\Windows\Minidump\020315-185641-01.dmp

2015-02-03 09:02 - 2015-02-03 09:02 - 00000000 ____D () C:\Windows\Minidump

2015-02-03 09:01 - 2015-02-03 09:01 - 290540326 _____ () C:\Windows\MEMORY.DMP

2015-02-03 08:57 - 2015-02-03 08:57 - 00000344 _____ () C:\Users\Lonnie\Desktop\fixlist.txt

2015-02-03 08:54 - 2015-02-03 08:54 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-LONNIE-PC-Windows-7-Home-Premium-(32-bit).dat

2015-02-03 08:52 - 2015-02-03 08:52 - 00002181 _____ () C:\Users\Lonnie\Desktop\Tweaking.com - Registry Backup.lnk

2015-02-03 08:52 - 2015-02-03 08:52 - 00000000 ____D () C:\Users\Lonnie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Tweaking.com

2015-02-03 08:52 - 2015-02-03 08:52 - 00000000 ____D () C:\RegBackup

2015-02-03 08:52 - 2015-02-03 08:52 - 00000000 ____D () C:\Program Files\Tweaking.com

2015-02-03 08:51 - 2015-02-03 08:51 - 04803888 _____ () C:\Users\Lonnie\Downloads\tweaking.com_registry_backup_setup.exe

2015-02-02 06:49 - 2015-02-02 06:49 - 00005250 _____ () C:\Users\Lonnie\AppData\Local\recently-used.xbel

2015-02-01 18:40 - 2015-02-01 18:45 - 242776064 _____ () C:\Users\Lonnie\Downloads\unicorn-6.2.1.91.iso

2015-01-31 18:56 - 2015-02-04 08:30 - 00004474 _____ () C:\Windows\system32\Drivers\fvstore.dat

2015-01-31 18:55 - 2015-01-31 18:55 - 00852573 _____ () C:\Users\Lonnie\Desktop\SecurityCheck.exe

2015-01-31 07:48 - 2015-01-31 07:48 - 02347384 _____ (ESET) C:\Users\Lonnie\Downloads\esetsmartinstaller_enu.exe

2015-01-31 07:48 - 2015-01-31 07:48 - 00000000 ____D () C:\Program Files\ESET

2015-01-31 07:46 - 2015-01-31 07:46 - 00074951 _____ () C:\Users\Lonnie\Desktop\MBAM.txt

2015-01-31 06:51 - 2015-02-04 08:35 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys

2015-01-31 06:50 - 2015-01-31 07:13 - 00001060 _____ () C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk

2015-01-31 06:50 - 2015-01-31 07:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware

2015-01-31 06:50 - 2015-01-31 07:13 - 00000000 ____D () C:\Program Files\Malwarebytes Anti-Malware

2015-01-31 06:50 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys

2015-01-31 06:50 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys

2015-01-31 06:50 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys

2015-01-31 06:49 - 2015-01-31 06:49 - 20447072 _____ (Malwarebytes Corporation ) C:\Users\Lonnie\Desktop\mbam-setup-2.0.4.1028.exe

2015-01-30 07:38 - 2015-01-30 07:38 - 00000000 ____D () C:\Program Files\Common Files\COMODO

2015-01-30 06:20 - 2015-01-30 06:20 - 00000000 ____D () C:\Program Files\Mozilla Firefox

2015-01-30 05:51 - 2015-02-04 09:22 - 01474832 _____ () C:\Windows\system32\Drivers\sfi.dat

2015-01-30 05:51 - 2015-02-04 08:26 - 00001985 _____ () C:\Users\Public\Desktop\COMODO Internet Security.lnk

2015-01-30 05:50 - 2015-01-30 05:50 - 00000000 ____D () C:\ProgramData\Shared Space

2015-01-30 05:48 - 2015-01-30 07:38 - 00002013 _____ () C:\Users\Public\Desktop\GeekBuddy.lnk

2015-01-30 05:48 - 2015-01-30 05:48 - 00000000 ____D () C:\ProgramData\Comodo Downloader

2015-01-30 05:45 - 2015-01-30 05:46 - 226075384 _____ (COMODO) C:\Users\Lonnie\Downloads\cispremium_installer_6100_08.exe

2015-01-29 23:13 - 2015-02-01 13:47 - 00022928 _____ () C:\Users\Lonnie\Desktop\Addition.txt

2015-01-29 23:12 - 2015-02-04 09:23 - 00018204 _____ () C:\Users\Lonnie\Desktop\FRST.txt

2015-01-29 23:00 - 2015-01-29 23:03 - 00000000 ____D () C:\AdwCleaner

2015-01-29 22:59 - 2015-01-29 22:59 - 02194432 _____ () C:\Users\Lonnie\Desktop\AdwCleaner.exe

2015-01-29 22:56 - 2015-01-29 22:56 - 00003785 _____ () C:\Users\Lonnie\Desktop\JRT.txt

2015-01-29 22:54 - 2015-01-29 22:54 - 01707939 _____ (Thisisu) C:\Users\Lonnie\Desktop\JRT.exe

2015-01-29 22:54 - 2015-01-29 22:54 - 00000000 ____D () C:\Windows\ERUNT

2015-01-29 22:46 - 2015-01-31 06:47 - 00000000 ____D () C:\Users\Lonnie\Desktop\FRST-OlderVersion

2015-01-29 10:44 - 2015-01-29 10:44 - 00045516 _____ () C:\Windows\system32\.crusader

2015-01-29 10:28 - 2015-01-29 22:48 - 00000000 ____D () C:\Program Files\HitmanPro

2015-01-29 10:28 - 2015-01-29 10:44 - 00000000 ____D () C:\ProgramData\HitmanPro

2015-01-29 10:27 - 2015-01-29 10:28 - 10285456 _____ (SurfRight B.V.) C:\Users\Lonnie\Downloads\HitmanPro.exe

2015-01-29 10:06 - 2015-01-29 10:06 - 02998656 _____ (Enigma Software Group USA, LLC.) C:\Users\Lonnie\Downloads\SpyHunter-Installer.exe

2015-01-29 09:20 - 2015-01-29 09:20 - 00000000 ____D () C:\themes

2015-01-29 09:20 - 2015-01-29 09:20 - 00000000 ____D () C:\cis

2015-01-29 09:20 - 2013-11-21 07:49 - 04814552 _____ (COMODO) C:\cmdinstall.exe

2015-01-29 09:20 - 2013-09-24 05:53 - 03360984 _____ (Terra Informatica Software, Inc.) C:\cmdhtml.dll

2015-01-29 09:20 - 2013-09-24 05:53 - 00281816 _____ (Igor Pavlov) C:\7za.dll

2015-01-29 08:21 - 2015-01-29 09:21 - 00000674 _____ () C:\Windows\system32\{7995330B-E01F-4645-B702-53481E7CB778}.cmdfile

2015-01-29 08:21 - 2015-01-29 09:20 - 00001123 __RSH () C:\Windows\system32\{1606DC18-9578-4cbd-8312-8E9868F06A1D}.conf

2015-01-29 08:06 - 2015-01-29 08:06 - 00353699 _____ () C:\Users\Lonnie\Documents\CisReport_x86_v8.0.0.4344_20150129-080558.zip

2015-01-28 10:34 - 2015-01-28 10:36 - 00000045 _____ () C:\Users\Lonnie\Documents\Indiana TID number.txt

2015-01-26 21:23 - 2015-01-26 21:23 - 00000000 ____D () C:\Users\Lonnie\Documents\Empire Earth II

2015-01-26 21:14 - 2015-01-26 21:15 - 00000000 ____D () C:\Program Files\GameSpy Arcade

2015-01-26 21:14 - 2015-01-26 21:14 - 00000000 ____D () C:\Users\Lonnie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\GameSpy Arcade

2015-01-26 21:14 - 2015-01-26 21:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GameSpy Arcade

2015-01-26 09:23 - 2015-01-26 09:23 - 01120768 _____ (Farbar) C:\Users\Lonnie\Downloads\FRST (1).exe

2015-01-26 08:35 - 2015-01-26 08:36 - 04176437 _____ () C:\Users\Lonnie\Downloads\tdsskiller.zip

2015-01-26 08:30 - 2015-01-26 09:28 - 00038221 _____ () C:\Users\Lonnie\Downloads\Addition.txt

2015-01-26 08:28 - 2015-02-04 09:22 - 00000000 ____D () C:\FRST

2015-01-26 08:28 - 2015-01-26 09:28 - 00039281 _____ () C:\Users\Lonnie\Downloads\FRST.txt

2015-01-26 08:27 - 2015-01-31 06:47 - 01122304 _____ (Farbar) C:\Users\Lonnie\Desktop\FRST.exe

2015-01-24 21:55 - 2015-01-24 21:55 - 00056322 _____ () C:\Users\Lonnie\Desktop\Extras.Txt

2015-01-24 21:53 - 2015-01-24 21:53 - 00106122 _____ () C:\Users\Lonnie\Desktop\OTL.Txt

2015-01-24 21:38 - 2015-01-24 21:38 - 00602112 _____ (OldTimer Tools) C:\Users\Lonnie\Desktop\OTL (1).exe

2015-01-24 21:37 - 2015-01-24 21:37 - 00602112 _____ (OldTimer Tools) C:\Users\Lonnie\Downloads\OTL.exe

2015-01-24 07:43 - 2015-01-24 07:43 - 00000000 ____D () C:\Users\Lonnie\AppData\Roaming\dvdcss

2015-01-23 11:40 - 2015-01-24 07:30 - 00000000 ____D () C:\Users\Lonnie\Desktop\Body work

2015-01-23 09:20 - 2015-01-23 09:24 - 00000010 _____ () C:\Users\Lonnie\Documents\New Text Document (2).txt

2015-01-23 09:15 - 2015-01-23 09:15 - 00347816 _____ (Microsoft Corporation) C:\Users\Lonnie\Downloads\MicrosoftFixit.HomeGroup.Run.exe

2015-01-22 20:23 - 2015-01-25 00:23 - 18126512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerInstaller.exe

2015-01-13 14:18 - 2015-01-13 14:18 - 03971512 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe

2015-01-13 14:18 - 2015-01-13 14:18 - 03916728 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe

2015-01-13 14:18 - 2015-01-13 14:18 - 00242688 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll

2015-01-13 14:18 - 2015-01-13 14:18 - 00164864 _____ (Microsoft Corporation) C:\Windows\system32\profsvc.dll

2015-01-13 14:18 - 2015-01-13 14:18 - 00116224 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys

2015-01-13 14:18 - 2015-01-13 14:18 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe

2015-01-13 11:31 - 2015-01-13 11:31 - 00000000 ____D () C:\Users\Lonnie\Documents\01-13-2015

2015-01-11 06:19 - 2015-01-11 06:19 - 00000000 ____D () C:\Users\Lonnie\AppData\Roaming\Apple Computer

2015-01-06 08:42 - 2015-01-06 08:42 - 00000000 ____D () C:\Users\Lonnie\Documents\01-06-2015

2015-01-05 09:40 - 2015-01-05 09:47 - 00000000 ____D () C:\Users\Lonnie\Documents\01-05-2015

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-02-04 09:23 - 2014-12-28 09:17 - 00000886 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job

2015-02-04 09:23 - 2013-11-21 08:59 - 00000830 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job

2015-02-04 09:22 - 2014-12-28 09:17 - 00000882 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job

2015-02-04 08:40 - 2009-07-13 23:34 - 00022592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

2015-02-04 08:40 - 2009-07-13 23:34 - 00022592 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

2015-02-04 08:37 - 2013-11-20 12:05 - 01309978 _____ () C:\Windows\WindowsUpdate.log

2015-02-04 08:36 - 2014-06-04 09:55 - 00000995 _____ () C:\Users\Lonnie\Desktop\magicJack.lnk

2015-02-04 08:36 - 2014-06-04 09:55 - 00000981 _____ () C:\Users\Lonnie\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\magicJack.lnk

2015-02-04 08:36 - 2014-05-28 21:36 - 00000000 ____D () C:\Users\Lonnie\AppData\Roaming\mjusbsp

2015-02-04 08:32 - 2013-11-23 09:01 - 00000000 ____D () C:\ProgramData\NVIDIA

2015-02-04 08:32 - 2013-11-21 10:31 - 00435310 _____ () C:\Windows\PFRO.log

2015-02-04 08:32 - 2013-11-20 09:30 - 00000000 ____D () C:\ProgramData\Kodak

2015-02-04 08:32 - 2009-07-13 23:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT

2015-02-04 08:32 - 2009-07-13 23:39 - 00068023 _____ () C:\Windows\setupact.log

2015-02-03 09:03 - 2013-11-20 09:25 - 00000000 ____D () C:\Users\Lonnie

2015-02-02 06:49 - 2013-11-20 09:43 - 00000000 ____D () C:\Users\Lonnie\.gimp-2.8

2015-02-01 19:59 - 2013-11-23 09:26 - 00000000 ____D () C:\Users\Lonnie\AppData\Local\Firestorm

2015-01-31 07:38 - 2014-08-26 10:04 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service

2015-01-31 06:50 - 2013-12-01 09:26 - 00000000 ____D () C:\ProgramData\Malwarebytes

2015-01-30 09:40 - 2013-11-20 09:54 - 00000000 ____D () C:\Users\Lonnie\AppData\Local\gtk-2.0

2015-01-30 09:24 - 2014-09-13 19:09 - 00000000 ____D () C:\Users\Lonnie\AppData\Roaming\vlc

2015-01-30 07:38 - 2013-11-20 10:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Comodo

2015-01-30 07:27 - 2014-12-09 00:20 - 00618072 _____ (COMODO) C:\Windows\system32\Drivers\cmdguard.sys

2015-01-30 07:27 - 2014-12-09 00:20 - 00386768 _____ (COMODO) C:\Windows\system32\guard32.dll

2015-01-30 07:27 - 2014-12-09 00:20 - 00286424 _____ (COMODO) C:\Windows\system32\cmdvrt32.dll

2015-01-30 07:27 - 2014-12-09 00:20 - 00091200 _____ (COMODO) C:\Windows\system32\Drivers\inspect.sys

2015-01-30 07:27 - 2014-12-09 00:20 - 00041248 _____ (COMODO) C:\Windows\system32\Drivers\cmdhlp.sys

2015-01-30 07:27 - 2014-12-09 00:20 - 00040664 _____ (COMODO) C:\Windows\system32\cmdkbd32.dll

2015-01-30 07:27 - 2014-12-09 00:20 - 00033520 _____ (COMODO) C:\Windows\system32\cmdcsr.dll

2015-01-30 07:27 - 2014-12-09 00:20 - 00017088 _____ (COMODO) C:\Windows\system32\Drivers\cmderd.sys

2015-01-30 05:51 - 2013-11-20 10:59 - 00000000 ____D () C:\ProgramData\COMODO

2015-01-30 05:49 - 2013-11-20 10:58 - 00000000 ____D () C:\Program Files\Comodo

2015-01-30 04:25 - 2014-12-28 09:18 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

2015-01-29 10:54 - 2009-07-13 21:37 - 00000000 ____D () C:\Windows\system32\NDF

2015-01-29 09:35 - 2013-09-27 05:28 - 00000000 ___HD () C:\VTRoot

2015-01-29 09:08 - 2013-11-21 23:05 - 00000000 ____D () C:\Users\Lonnie\AppData\Roaming\Azureus

2015-01-26 21:19 - 2013-11-21 09:50 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information

2015-01-25 00:23 - 2013-11-21 08:59 - 00701616 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe

2015-01-25 00:23 - 2013-11-21 08:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl

2015-01-23 09:25 - 2009-07-13 21:37 - 00000000 __RHD () C:\Users\Public\Libraries

2015-01-19 07:41 - 2013-11-20 09:54 - 00000000 ____D () C:\Windows\system32\MRT

2015-01-19 07:28 - 2013-11-20 09:54 - 110348472 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe

2015-01-16 11:16 - 2014-12-03 09:12 - 00000000 ____D () C:\Program Files\Mozilla Thunderbird

2015-01-11 09:16 - 2015-01-04 08:16 - 00000000 ____D () C:\Program Files\QuickTime

2015-01-11 09:16 - 2009-07-13 21:37 - 00000000 ____D () C:\Windows\system32\wfp

2015-01-11 09:16 - 2009-07-13 21:37 - 00000000 ____D () C:\Windows\registration

==================== Files in the root of some directories =======

2014-01-19 10:14 - 2014-01-19 10:14 - 0000000 _____ () C:\Users\Lonnie\AppData\Roaming\SharedSettings.ccs

2014-01-19 10:15 - 2014-01-19 10:15 - 0067992 _____ () C:\Users\Lonnie\AppData\Local\jkffplbl

2014-01-19 10:16 - 2014-01-19 10:16 - 0012326 _____ () C:\Users\Lonnie\AppData\Local\pavttpqp

2015-02-02 06:49 - 2015-02-02 06:49 - 0005250 _____ () C:\Users\Lonnie\AppData\Local\recently-used.xbel

Some content of TEMP:

====================

C:\Users\Lonnie\AppData\Local\Temp\HitmanPro.exe

C:\Users\Lonnie\AppData\Local\Temp\Quarantine.exe

C:\Users\Lonnie\AppData\Local\Temp\sqlite3.dll

==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed

C:\Windows\system32\winlogon.exe => File is digitally signed

C:\Windows\system32\wininit.exe => File is digitally signed

C:\Windows\system32\svchost.exe => File is digitally signed

C:\Windows\system32\services.exe => File is digitally signed

C:\Windows\system32\User32.dll => File is digitally signed

C:\Windows\system32\userinit.exe => File is digitally signed

C:\Windows\system32\rpcss.dll => File is digitally signed

C:\Windows\system32\Drivers\volsnap.sys => File is digitally signedScan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 31-01-2015