Feel

Done! Dock gick det inte att köra ComboFix /Uinstall. Hittade inte sökvägen?

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-03-2014 Ran by Robin&Erica at 2014-03-11 14:07:58 Run:3 Running from C:\Users\Robin&Erica\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\53026d8d-56011cdd C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\16b9da2c-687bf214 C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\1449f3bd-12ef89aa C:\Users\Robin&Erica\Documents\APNSetup.exe ***************** C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\53026d8d-56011cdd => Moved successfully. C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\16b9da2c-687bf214 => Moved successfully. C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\1449f3bd-12ef89aa => Moved successfully. C:\Users\Robin&Erica\Documents\APNSetup.exe => Moved successfully. ==== End of Fixlog ====

Tack för den utmärkta hjälpen! Datorn verkar fungera bra, men jag kommer nog att fixa ett antivirusprogram. Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 10-03-2014 Ran by Robin&Erica at 2014-03-10 19:37:38 Run:2 Running from C:\Users\Robin&Erica\Desktop Boot Mode: Normal ============================================== Content of fixlist: ***************** C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\53026d8d-56011cdd multiple threatsC:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\16b9da2c-687bf214 a variant of Java/Exploit.CVE-2012-1723.Z trojanC:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\1449f3bd-12ef89aa Java/Exploit.CVE-2012-0507.BR trojanC:\Users\Robin&Erica\Documents\APNSetup.exe a variant of Win32/Bundled.Toolbar.Ask.E potentially unsafe application ***************** "C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\53026d8d-56011cdd multiple threatsC:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\16b9da2c-687bf214 a variant of Java/Exploit.CVE-2012-1723.Z trojanC:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\1449f3bd-12ef89aa Java/Exploit.CVE-2012-0507.BR trojanC:\Users\Robin&Erica\Documents\APNSetup.exe a variant of Win32/Bundled.Toolbar.Ask.E potentially unsafe application" => File/Directory not found. ==== End of Fixlog ====

C:\da.bat BAT/Agent.NGP trojan C:\AdwCleaner\Quarantine\C\Program Files (x86)\Common Files\DVDVideoSoft\TB\DVDVideoSoftTB.exe.vir a variant of Win32/Toolbar.Conduit.B potentially unwanted application C:\AdwCleaner\Quarantine\C\Program Files (x86)\uTorrentControl2\ldrtbuTor.dll.vir a variant of Win32/Toolbar.Conduit.P potentially unwanted application C:\AdwCleaner\Quarantine\C\Program Files (x86)\uTorrentControl2\prxtbuTor.dll.vir Win32/Toolbar.Conduit.O potentially unwanted application C:\AdwCleaner\Quarantine\C\Program Files (x86)\uTorrentControl2\tbuTor.dll.vir a variant of Win32/Toolbar.Conduit.B potentially unwanted application C:\AdwCleaner\Quarantine\C\Program Files (x86)\uTorrentControl2\uTorrentControl2ToolbarHelper.exe.vir Win32/Toolbar.Conduit.Q potentially unwanted application C:\AdwCleaner\Quarantine\C\ProgramData\Tarma Installer\{C049526F-B3EB-4151-9B11-B11F00F53A96}\_Setupx.dll.vir a variant of Win32/Adware.Yontoo.B application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\Local\Conduit\CT3072253\uTorrentControl2AutoUpdateHelper.exe.vir Win32/Toolbar.Conduit.F potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\hk64tbuTo0.dll.vir a variant of Win64/Toolbar.Conduit.B potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\hktbuTo0.dll.vir a variant of Win32/Toolbar.Conduit.X potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\ldrtbuTo0.dll.vir a variant of Win32/Toolbar.Conduit.P potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\ldrtbuTo2.dll.vir a variant of Win32/Toolbar.Conduit.P potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\ldrtbuTor.dll.vir a variant of Win32/Toolbar.Conduit.P potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\tbuTo0.dll.vir a variant of Win32/Toolbar.Conduit.X potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\tbuTo1.dll.vir Win32/Toolbar.Conduit.Y potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\tbuTo2.dll.vir a variant of Win32/Toolbar.Conduit.B potentially unwanted application C:\AdwCleaner\Quarantine\C\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2\tbuTor.dll.vir a variant of Win32/Toolbar.Conduit.B potentially unwanted application C:\FRST\Quarantine\o03e7tf.zvv07-03-2014_08-34-53 Win64/Reveton.A trojan C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\13\53026d8d-56011cdd multiple threats C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\44\16b9da2c-687bf214 a variant of Java/Exploit.CVE-2012-1723.Z trojan C:\Users\Robin&Erica\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\1449f3bd-12ef89aa Java/Exploit.CVE-2012-0507.BR trojan C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Vector\Vector.Magic.Desktop.Edition.v1.14.Incl.rar Win32/Keygen.DW potentially unsafe application C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Vector\Vector.Magic.Desktop.Edition.v1.14.Incl.Keygen-FFF\KEYGEN.exe Win32/Keygen.DW potentially unsafe application C:\Users\Robin&Erica\Desktop\Blandat\Spel\Nedladdat\uTorrentfiler\Settlers 7\Novemberförsök\The.Settlers.7_Paths.to.a.Kingdom[pcgame-Multi7].iso a variant of Win32/Packed.VMProtect.AAA trojan C:\Users\Robin&Erica\Documents\APNSetup.exe a variant of Win32/Bundled.Toolbar.Ask.E potentially unsafe application

2014-03-09 01:45 - 2013-08-02 02:50 - 00274944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KernelBase.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-file-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processthreads-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-sysinfo-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-synch-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-misc-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localregistry-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-localization-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-processenvironment-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-namedpipe-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-memory-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-libraryloader-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-interlocked-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-heap-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-string-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-rtlsupport-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-profile-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-io-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-handle-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-errorhandling-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-delayload-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-debug-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-datetime-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-console-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:09 - 00338432 _____ (Microsoft Corporation) C:\Windows\system32\conhost.exe 2014-03-09 01:45 - 2013-08-02 01:59 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe 2014-03-09 01:45 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-security-base-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-threadpool-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-xstate-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-core-util-l1-1-0.dll 2014-03-09 01:45 - 2013-07-25 10:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL 2014-03-09 01:45 - 2013-07-25 09:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL 2014-03-09 01:45 - 2013-07-12 11:41 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbcir.sys 2014-03-09 01:45 - 2013-07-09 06:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll 2014-03-09 01:45 - 2013-07-09 05:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll 2014-03-09 01:45 - 2013-07-03 05:40 - 00042496 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbscan.sys 2014-03-09 01:45 - 2013-07-03 05:05 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidclass.sys 2014-03-09 01:45 - 2013-07-03 05:05 - 00032896 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\hidparse.sys 2014-03-09 01:45 - 2013-06-25 23:55 - 00785624 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\Wdf01000.sys 2014-03-09 01:45 - 2013-02-12 05:12 - 00019968 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usb8023.sys 2014-03-09 01:45 - 2012-11-28 23:56 - 00054376 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WdfLdr.sys 2014-03-09 01:45 - 2012-11-28 23:56 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\Wdfres.dll 2014-03-09 01:45 - 2012-11-28 23:56 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_Kernel_01011_Inbox_Critical.Wdf 2014-03-09 01:45 - 2012-11-01 06:43 - 02002432 _____ (Microsoft Corporation) C:\Windows\system32\msxml6.dll 2014-03-09 01:45 - 2012-11-01 05:47 - 01389568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml6.dll 2014-03-09 01:45 - 2012-10-03 18:44 - 00303104 _____ (Microsoft Corporation) C:\Windows\system32\nlasvc.dll 2014-03-09 01:45 - 2012-10-03 18:44 - 00246272 _____ (Microsoft Corporation) C:\Windows\system32\netcorehc.dll 2014-03-09 01:45 - 2012-10-03 18:44 - 00216576 _____ (Microsoft Corporation) C:\Windows\system32\ncsi.dll 2014-03-09 01:45 - 2012-10-03 18:44 - 00070656 _____ (Microsoft Corporation) C:\Windows\system32\nlaapi.dll 2014-03-09 01:45 - 2012-10-03 18:44 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\netevent.dll 2014-03-09 01:45 - 2012-10-03 18:42 - 00569344 _____ (Microsoft Corporation) C:\Windows\system32\iphlpsvc.dll 2014-03-09 01:45 - 2012-10-03 17:42 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netcorehc.dll 2014-03-09 01:45 - 2012-10-03 17:42 - 00156672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncsi.dll 2014-03-09 01:45 - 2012-10-03 17:42 - 00018944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netevent.dll 2014-03-09 01:45 - 2012-10-03 17:07 - 00045568 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpipreg.sys 2014-03-09 01:45 - 2012-08-22 19:12 - 00950128 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ndis.sys 2014-03-09 01:45 - 2012-07-04 21:26 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\RNDISMP.sys 2014-03-09 01:45 - 2012-01-13 08:12 - 00052224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nlaapi.dll 2014-03-09 01:44 - 2013-09-08 03:27 - 00327168 _____ (Microsoft Corporation) C:\Windows\system32\mswsock.dll 2014-03-09 01:44 - 2013-09-08 03:03 - 00231424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mswsock.dll 2014-03-09 01:44 - 2013-07-04 13:57 - 00259584 _____ (Microsoft Corporation) C:\Windows\system32\WebClnt.dll 2014-03-09 01:44 - 2013-07-04 13:50 - 00102400 _____ (Microsoft Corporation) C:\Windows\system32\davclnt.dll 2014-03-09 01:44 - 2013-07-04 12:57 - 00205824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WebClnt.dll 2014-03-09 01:44 - 2013-07-04 12:51 - 00081920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\davclnt.dll 2014-03-09 01:44 - 2013-07-04 11:11 - 00140800 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mrxdav.sys 2014-03-09 01:44 - 2013-06-15 05:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys 2014-03-09 01:44 - 2013-06-04 07:00 - 00624128 _____ (Microsoft Corporation) C:\Windows\system32\qedit.dll 2014-03-09 01:44 - 2013-06-04 05:53 - 00509440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qedit.dll 2014-03-09 01:44 - 2012-12-07 14:20 - 00441856 _____ (Microsoft Corporation) C:\Windows\system32\Wpc.dll 2014-03-09 01:44 - 2012-12-07 14:15 - 02746368 _____ (Microsoft Corporation) C:\Windows\system32\gameux.dll 2014-03-09 01:44 - 2012-12-07 13:26 - 00308736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\Wpc.dll 2014-03-09 01:44 - 2012-12-07 13:20 - 02576384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gameux.dll 2014-03-09 01:44 - 2012-12-07 12:20 - 00045568 _____ (Microsoft) C:\Windows\system32\oflc-nz.rs 2014-03-09 01:44 - 2012-12-07 12:20 - 00044544 _____ (Microsoft) C:\Windows\system32\pegibbfc.rs 2014-03-09 01:44 - 2012-12-07 12:20 - 00043520 _____ (Microsoft) C:\Windows\system32\csrr.rs 2014-03-09 01:44 - 2012-12-07 12:20 - 00030720 _____ (Microsoft) C:\Windows\system32\usk.rs 2014-03-09 01:44 - 2012-12-07 12:20 - 00023552 _____ (Microsoft) C:\Windows\system32\oflc.rs 2014-03-09 01:44 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-pt.rs 2014-03-09 01:44 - 2012-12-07 12:20 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi-fi.rs 2014-03-09 01:44 - 2012-12-07 12:19 - 00055296 _____ (Microsoft) C:\Windows\system32\cero.rs 2014-03-09 01:44 - 2012-12-07 12:19 - 00051712 _____ (Microsoft) C:\Windows\system32\esrb.rs 2014-03-09 01:44 - 2012-12-07 12:19 - 00046592 _____ (Microsoft) C:\Windows\system32\fpb.rs 2014-03-09 01:44 - 2012-12-07 12:19 - 00040960 _____ (Microsoft) C:\Windows\system32\cob-au.rs 2014-03-09 01:44 - 2012-12-07 12:19 - 00021504 _____ (Microsoft) C:\Windows\system32\grb.rs 2014-03-09 01:44 - 2012-12-07 12:19 - 00020480 _____ (Microsoft) C:\Windows\system32\pegi.rs 2014-03-09 01:44 - 2012-12-07 12:19 - 00015360 _____ (Microsoft) C:\Windows\system32\djctq.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00055296 _____ (Microsoft) C:\Windows\SysWOW64\cero.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00051712 _____ (Microsoft) C:\Windows\SysWOW64\esrb.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00046592 _____ (Microsoft) C:\Windows\SysWOW64\fpb.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00045568 _____ (Microsoft) C:\Windows\SysWOW64\oflc-nz.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00044544 _____ (Microsoft) C:\Windows\SysWOW64\pegibbfc.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00043520 _____ (Microsoft) C:\Windows\SysWOW64\csrr.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00040960 _____ (Microsoft) C:\Windows\SysWOW64\cob-au.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00030720 _____ (Microsoft) C:\Windows\SysWOW64\usk.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00023552 _____ (Microsoft) C:\Windows\SysWOW64\oflc.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00021504 _____ (Microsoft) C:\Windows\SysWOW64\grb.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-pt.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi-fi.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00020480 _____ (Microsoft) C:\Windows\SysWOW64\pegi.rs 2014-03-09 01:44 - 2012-12-07 11:46 - 00015360 _____ (Microsoft) C:\Windows\SysWOW64\djctq.rs 2014-03-09 01:44 - 2012-11-22 06:44 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\usp10.dll 2014-03-09 01:44 - 2012-11-22 05:45 - 00626688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\usp10.dll 2014-03-09 01:44 - 2012-11-02 06:59 - 00478208 _____ (Microsoft Corporation) C:\Windows\system32\dpnet.dll 2014-03-09 01:44 - 2012-11-02 06:11 - 00376832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dpnet.dll 2014-03-09 01:44 - 2012-08-21 22:01 - 00245760 _____ (Microsoft Corporation) C:\Windows\system32\OxpsConverter.exe 2014-03-09 01:43 - 2013-11-26 12:40 - 00376768 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\netio.sys 2014-03-09 01:43 - 2013-11-26 11:32 - 03156480 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys 2014-03-09 01:43 - 2013-09-08 03:30 - 01903552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys 2014-03-09 01:43 - 2013-08-29 03:17 - 05549504 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe 2014-03-09 01:43 - 2013-08-29 03:16 - 01732032 _____ (Microsoft Corporation) C:\Windows\system32\ntdll.dll 2014-03-09 01:43 - 2013-08-29 03:16 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\tdh.dll 2014-03-09 01:43 - 2013-08-29 03:16 - 00243712 _____ (Microsoft Corporation) C:\Windows\system32\wow64.dll 2014-03-09 01:43 - 2013-08-29 03:13 - 00878080 _____ (Microsoft Corporation) C:\Windows\system32\advapi32.dll 2014-03-09 01:43 - 2013-08-29 02:51 - 03969472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe 2014-03-09 01:43 - 2013-08-29 02:51 - 03914176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe 2014-03-09 01:43 - 2013-08-29 02:50 - 01292192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntdll.dll 2014-03-09 01:43 - 2013-08-29 02:50 - 00619520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdh.dll 2014-03-09 01:43 - 2013-08-29 02:50 - 00005120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wow32.dll 2014-03-09 01:43 - 2013-08-29 02:48 - 00640512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\advapi32.dll 2014-03-09 01:43 - 2013-08-29 01:49 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\setup16.exe 2014-03-09 01:43 - 2013-08-29 01:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntvdm64.dll 2014-03-09 01:43 - 2013-08-29 01:49 - 00007680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\instnm.exe 2014-03-09 01:43 - 2013-08-29 01:49 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\user.exe 2014-03-09 01:43 - 2012-11-30 06:45 - 00362496 _____ (Microsoft Corporation) C:\Windows\system32\wow64win.dll 2014-03-09 01:43 - 2012-11-30 06:45 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\wow64cpu.dll 2014-03-09 01:43 - 2012-11-30 06:43 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\ntvdm64.dll 2014-03-09 01:43 - 2012-08-11 01:56 - 00715776 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll 2014-03-09 01:43 - 2012-08-11 00:56 - 00542208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll 2014-03-09 01:42 - 2013-07-26 03:24 - 14172672 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll 2014-03-09 01:42 - 2013-07-26 03:24 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\shdocvw.dll 2014-03-09 01:42 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll 2014-03-09 01:42 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shdocvw.dll 2014-03-09 01:42 - 2013-04-26 06:51 - 00751104 _____ (Microsoft Corporation) C:\Windows\system32\win32spl.dll 2014-03-09 01:42 - 2013-04-26 05:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\win32spl.dll 2014-03-09 01:42 - 2012-09-25 23:47 - 00078336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\synceng.dll 2014-03-09 01:42 - 2012-09-25 23:46 - 00095744 _____ (Microsoft Corporation) C:\Windows\system32\synceng.dll 2014-03-09 01:41 - 2013-10-12 03:32 - 00150016 _____ (Microsoft Corporation) C:\Windows\system32\wshom.ocx 2014-03-09 01:41 - 2013-10-12 03:31 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\scrrun.dll 2014-03-09 01:41 - 2013-10-12 03:04 - 00121856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wshom.ocx 2014-03-09 01:41 - 2013-10-12 03:03 - 00163840 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scrrun.dll 2014-03-09 01:41 - 2013-10-12 02:33 - 00168960 _____ (Microsoft Corporation) C:\Windows\system32\wscript.exe 2014-03-09 01:41 - 2013-10-12 02:33 - 00156160 _____ (Microsoft Corporation) C:\Windows\system32\cscript.exe 2014-03-09 01:41 - 2013-10-12 02:15 - 00141824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wscript.exe 2014-03-09 01:41 - 2013-10-12 02:15 - 00126976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cscript.exe 2014-03-09 01:41 - 2013-10-03 03:23 - 00404480 _____ (Microsoft Corporation) C:\Windows\system32\gdi32.dll 2014-03-09 01:41 - 2013-10-03 03:00 - 00311808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\gdi32.dll 2014-03-09 01:41 - 2013-07-20 11:33 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll 2014-03-09 01:41 - 2013-07-20 11:33 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll 2014-03-09 01:41 - 2013-05-13 06:50 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\certenc.dll 2014-03-09 01:41 - 2013-05-13 04:43 - 01192448 _____ (Microsoft Corporation) C:\Windows\system32\certutil.exe 2014-03-09 01:41 - 2013-05-13 04:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certutil.exe 2014-03-09 01:41 - 2013-05-13 04:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certenc.dll 2014-03-09 01:41 - 2013-05-10 06:49 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\cryptdlg.dll 2014-03-09 01:41 - 2013-05-10 04:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptdlg.dll 2014-03-09 01:41 - 2013-01-24 07:01 - 00223752 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\fvevol.sys 2014-03-09 01:41 - 2013-01-03 07:00 - 00288088 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\FWPKCLNT.SYS 2014-03-09 01:41 - 2012-11-23 04:13 - 00068608 _____ (Microsoft Corporation) C:\Windows\system32\taskhost.exe 2014-03-09 01:41 - 2012-07-04 23:16 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\netapi32.dll 2014-03-09 01:41 - 2012-07-04 23:13 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\browser.dll 2014-03-09 01:41 - 2012-07-04 23:13 - 00059392 _____ (Microsoft Corporation) C:\Windows\system32\browcli.dll 2014-03-09 01:41 - 2012-07-04 22:16 - 00057344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\netapi32.dll 2014-03-09 01:41 - 2012-07-04 22:14 - 00041984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\browcli.dll 2014-03-09 01:41 - 2012-05-14 06:26 - 00956928 _____ (Microsoft Corporation) C:\Windows\system32\localspl.dll 2014-03-09 01:41 - 2012-05-05 09:36 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll 2014-03-09 01:41 - 2012-05-05 08:46 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll 2014-03-09 01:40 - 2013-10-12 03:30 - 00830464 _____ (Microsoft Corporation) C:\Windows\system32\nshwfp.dll 2014-03-09 01:40 - 2013-10-12 03:29 - 00859648 _____ (Microsoft Corporation) C:\Windows\system32\IKEEXT.DLL 2014-03-09 01:40 - 2013-10-12 03:29 - 00324096 _____ (Microsoft Corporation) C:\Windows\system32\FWPUCLNT.DLL 2014-03-09 01:40 - 2013-10-12 03:03 - 00656896 _____ (Microsoft Corporation) C:\Windows\SysWOW64\nshwfp.dll 2014-03-09 01:40 - 2013-10-12 03:01 - 00216576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FWPUCLNT.DLL 2014-03-09 01:40 - 2013-08-01 13:09 - 00983488 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgkrnl.sys 2014-03-09 01:40 - 2013-04-10 07:01 - 00265064 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\dxgmms1.sys 2014-03-09 01:40 - 2011-02-03 12:25 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\cdd.dll 2014-03-09 01:30 - 2013-08-28 02:12 - 00461312 _____ (Microsoft Corporation) C:\Windows\system32\scavengeui.dll 2014-03-08 23:44 - 2014-03-09 16:18 - 00000000 ____D () C:\AdwCleaner 2014-03-08 20:40 - 2014-03-08 20:40 - 00024911 _____ () C:\ComboFix.txt 2014-03-08 20:07 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe 2014-03-08 20:07 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe 2014-03-08 20:07 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe 2014-03-08 20:07 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe 2014-03-08 20:07 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe 2014-03-08 20:07 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe 2014-03-08 20:07 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe 2014-03-08 20:07 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe 2014-03-08 19:58 - 2014-03-08 20:40 - 00000000 ____D () C:\Qoobox 2014-03-08 19:57 - 2014-03-08 20:39 - 00000000 ____D () C:\Windows\erdnt 2014-03-08 15:06 - 2014-03-08 15:08 - 00000000 ____D () C:\Users\Robin&Erica\Desktop\Alla mappar 2014-03-07 08:48 - 2014-03-09 16:43 - 00000000 ____D () C:\FRST 2014-03-07 08:41 - 2014-03-06 23:28 - 02156544 _____ (Farbar) C:\Users\Robin&Erica\Desktop\FRST64.exe 2014-03-07 00:41 - 2014-03-07 08:38 - 00000356 _____ () C:\Windows\Tasks\HPCeeScheduleForRobin&Erica.job 2014-03-07 00:41 - 2014-03-07 00:41 - 00003246 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForRobin&Erica 2014-03-07 00:19 - 2014-03-07 00:19 - 00000000 _____ () C:\autoexec.bat 2014-03-07 00:18 - 2014-03-07 00:18 - 00000000 ____D () C:\Program Files\Enigma Software Group 2014-03-07 00:17 - 2014-03-07 09:06 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP 2014-02-21 16:05 - 2014-02-21 16:05 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\{D4025C2E-5316-47A3-916A-5A731C550710} 2014-02-08 18:54 - 2014-02-08 18:54 - 09237763 _____ () C:\Users\Robin&Erica\Downloads\Pics_copy.apk 2014-02-08 17:50 - 2014-02-08 17:50 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (2).jnlp 2014-02-08 17:38 - 2014-02-08 17:38 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (1).jnlp 2014-02-08 17:30 - 2014-02-08 17:30 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks.jnlp 2014-02-08 17:08 - 2014-03-07 08:42 - 00000000 ____D () C:\Users\Robin&Erica\Downloads\Gammalt 2014-02-08 16:07 - 2014-02-08 16:49 - 00000000 ____D () C:\Users\Robin&Erica\.appinventor ==================== One Month Modified Files and Folders ======= 2014-03-09 16:43 - 2014-03-09 16:43 - 00010911 _____ () C:\Users\Robin&Erica\Desktop\FRST.txt 2014-03-09 16:43 - 2014-03-07 08:48 - 00000000 ____D () C:\FRST 2014-03-09 16:28 - 2009-07-14 05:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-09 16:28 - 2009-07-14 05:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-09 16:25 - 2010-05-28 18:31 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\Spotify 2014-03-09 16:23 - 2012-07-09 17:23 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\Dropbox 2014-03-09 16:19 - 2012-07-09 10:45 - 00001000 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-09 16:19 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-09 16:19 - 2009-07-14 05:51 - 00042809 _____ () C:\Windows\setupact.log 2014-03-09 16:18 - 2014-03-08 23:44 - 00000000 ____D () C:\AdwCleaner 2014-03-09 16:18 - 2013-11-08 12:31 - 00001028 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000UA.job 2014-03-09 16:18 - 2012-07-09 10:45 - 00001004 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-09 16:18 - 2010-02-10 21:52 - 01579053 _____ () C:\Windows\WindowsUpdate.log 2014-03-09 15:46 - 2012-08-16 05:58 - 00000868 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-09 15:12 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache 2014-03-09 14:38 - 2010-05-28 10:09 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\CrashDumps 2014-03-09 12:27 - 2010-01-11 20:17 - 00711140 _____ () C:\Windows\system32\perfh01D.dat 2014-03-09 12:27 - 2010-01-11 20:17 - 00160574 _____ () C:\Windows\system32\perfc01D.dat 2014-03-09 12:27 - 2009-07-14 06:13 - 01713644 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-09 12:22 - 2010-05-27 13:51 - 00001423 _____ () C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk 2014-03-09 12:19 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions 2014-03-09 10:30 - 2014-03-09 04:44 - 00018902 _____ () C:\Windows\IE11_main.log 2014-03-09 10:26 - 2014-03-09 10:26 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-09 10:26 - 2014-03-09 10:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-09 10:26 - 2014-03-09 10:26 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-09 10:26 - 2014-03-09 10:26 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-09 10:26 - 2014-03-09 10:26 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2014-03-09 10:26 - 2014-03-09 10:26 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2014-03-09 10:26 - 2014-03-09 10:26 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-03-09 10:26 - 2014-03-09 10:26 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2014-03-09 10:26 - 2014-03-09 10:26 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-03-09 10:26 - 2014-03-09 10:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2014-03-09 10:26 - 2014-03-09 10:26 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-09 10:23 - 2012-08-02 13:58 - 04931577 _____ () C:\Windows\{00000001-00000000-00000000-00001102-00000004-20051102}.CDF 2014-03-09 09:14 - 2010-11-25 09:08 - 00000000 ____D () C:\ProgramData\Skype 2014-03-09 09:12 - 2010-05-27 13:53 - 00000000 ___RD () C:\Users\Robin&Erica\Desktop\Robin 2014-03-09 06:06 - 2010-05-27 13:51 - 00000000 ___RD () C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup 2014-03-09 06:06 - 2010-05-27 13:51 - 00000000 ___RD () C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools 2014-03-09 06:06 - 2009-07-14 06:09 - 00000000 ____D () C:\Windows\System32\Tasks\WPD 2014-03-09 05:59 - 2009-07-14 05:45 - 04997192 _____ () C:\Windows\system32\FNTCACHE.DAT 2014-03-09 05:58 - 2013-04-18 12:40 - 00000000 ____D () C:\Program Files\Microsoft Silverlight 2014-03-09 05:58 - 2013-04-18 12:40 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight 2014-03-09 05:58 - 2010-05-28 17:13 - 00265446 _____ () C:\Windows\PFRO.log 2014-03-09 05:54 - 2009-07-14 08:45 - 00000000 ____D () C:\Program Files\Windows Journal 2014-03-09 05:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files\Windows Defender 2014-03-09 05:54 - 2009-07-14 06:32 - 00000000 ____D () C:\Program Files (x86)\Windows Defender 2014-03-09 05:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\zh-HK 2014-03-09 05:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\tr-TR 2014-03-09 05:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\zh-HK 2014-03-09 05:54 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\tr-TR 2014-03-09 05:28 - 2009-07-14 03:34 - 00000499 _____ () C:\Windows\win.ini 2014-03-09 05:24 - 2014-03-09 05:20 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-09 05:13 - 2011-03-30 13:36 - 01688278 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI 2014-03-09 04:11 - 2014-03-09 03:56 - 00012528 _____ () C:\Windows\IE10_main.log 2014-03-09 03:59 - 2014-03-09 03:59 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-03-09 03:34 - 2010-05-27 13:48 - 00000000 ____D () C:\Program Files (x86)\Microsoft Works 2014-03-09 00:18 - 2013-11-08 12:31 - 00000976 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000Core.job 2014-03-08 21:14 - 2014-01-27 21:36 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware 2014-03-08 20:40 - 2014-03-08 20:40 - 00024911 _____ () C:\ComboFix.txt 2014-03-08 20:40 - 2014-03-08 19:58 - 00000000 ____D () C:\Qoobox 2014-03-08 20:40 - 2009-07-14 04:20 - 00000000 __RHD () C:\Users\Default 2014-03-08 20:39 - 2014-03-08 19:57 - 00000000 ____D () C:\Windows\erdnt 2014-03-08 20:33 - 2009-07-14 03:34 - 00000215 _____ () C:\Windows\system.ini 2014-03-08 20:26 - 2011-10-01 10:18 - 00000000 ____D () C:\Program Files (x86)\QuickTime 2014-03-08 20:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system 2014-03-08 20:00 - 2012-07-31 23:34 - 00000000 ____D () C:\ProgramData\avg9 2014-03-08 19:57 - 2012-08-09 09:14 - 04931577 _____ () C:\Windows\{00000001-00000000-00000000-00001102-00000004-20051102}.BAK 2014-03-08 15:08 - 2014-03-08 15:06 - 00000000 ____D () C:\Users\Robin&Erica\Desktop\Alla mappar 2014-03-07 09:06 - 2014-03-07 00:17 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP 2014-03-07 09:02 - 2012-01-11 10:34 - 00000000 __SHD () C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f} 2014-03-07 08:42 - 2014-02-08 17:08 - 00000000 ____D () C:\Users\Robin&Erica\Downloads\Gammalt 2014-03-07 08:42 - 2012-01-02 23:02 - 00000000 ____D () C:\Windows\system32\Macromed 2014-03-07 08:42 - 2010-10-15 11:55 - 00000000 ____D () C:\Users\Public\Documents\Pinnacle 2014-03-07 08:42 - 2010-07-28 08:43 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\vlc 2014-03-07 08:42 - 2010-05-28 20:50 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\uTorrent 2014-03-07 08:42 - 2010-01-11 11:38 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2014-03-07 08:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2014-03-07 08:38 - 2014-03-07 00:41 - 00000356 _____ () C:\Windows\Tasks\HPCeeScheduleForRobin&Erica.job 2014-03-07 08:18 - 2014-01-28 06:10 - 00000000 ____D () C:\ProgramData\Recovery 2014-03-07 00:47 - 2012-08-16 05:58 - 00003806 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-07 00:46 - 2012-05-18 07:03 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-07 00:46 - 2012-01-02 23:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-07 00:41 - 2014-03-07 00:41 - 00003246 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForRobin&Erica 2014-03-07 00:37 - 2010-05-28 09:02 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-03-07 00:36 - 2011-11-10 11:24 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-03-07 00:19 - 2014-03-07 00:19 - 00000000 _____ () C:\autoexec.bat 2014-03-07 00:18 - 2014-03-07 00:18 - 00000000 ____D () C:\Program Files\Enigma Software Group 2014-03-07 00:13 - 2013-11-08 12:31 - 00004038 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000UA 2014-03-07 00:13 - 2013-11-08 12:31 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000Core 2014-03-07 00:13 - 2012-07-09 10:45 - 00004008 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-07 00:13 - 2012-07-09 10:45 - 00003756 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-03-07 00:10 - 2010-05-27 13:43 - 00000000 ____D () C:\Users\Robin&Erica 2014-03-06 23:28 - 2014-03-07 08:41 - 02156544 _____ (Farbar) C:\Users\Robin&Erica\Desktop\FRST64.exe 2014-03-03 19:22 - 2010-05-28 18:31 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\Spotify 2014-02-23 23:16 - 2010-06-30 16:47 - 08501248 ___SH () C:\Users\Robin&Erica\Desktop\Thumbs.db 2014-02-21 17:27 - 2011-03-31 16:13 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\Pinnacle 2014-02-21 16:05 - 2014-02-21 16:05 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\{D4025C2E-5316-47A3-916A-5A731C550710} 2014-02-08 18:54 - 2014-02-08 18:54 - 09237763 _____ () C:\Users\Robin&Erica\Downloads\Pics_copy.apk 2014-02-08 17:50 - 2014-02-08 17:50 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (2).jnlp 2014-02-08 17:38 - 2014-02-08 17:38 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (1).jnlp 2014-02-08 17:30 - 2014-02-08 17:30 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks.jnlp 2014-02-08 16:49 - 2014-02-08 16:07 - 00000000 ____D () C:\Users\Robin&Erica\.appinventor Files to move or delete: ==================== C:\Users\Robin&Erica\jagex_cl_runescape_LIVE.dat C:\Users\Robin&Erica\jagex_runescape_preferences.dat C:\Users\Robin&Erica\jagex_runescape_preferences2.dat C:\Users\Robin&Erica\jagex__preferences3.dat Some content of TEMP: ==================== C:\Users\Robin&Erica\AppData\Local\Temp\ntdll_dump.dll C:\Users\Robin&Erica\AppData\Local\Temp\Quarantine.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-03-08 21:03 ==================== End Of Log ============================

Fick dela upp FRST på två: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-03-2014 Ran by Robin&Erica (administrator) on STATIONÄRA on 09-03-2014 16:43:44 Running from C:\Users\Robin&Erica\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: Swedish Internet Explorer Version 11 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Copyright 2012 SAMSUNG) C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe (Copyright 2012 SAMSUNG) C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Seagate Technology LLC) C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe (Hewlett-Packard Company) c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Microsoft Corporation) c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Microsoft Corporation) c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (Spotify Ltd) C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd) C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\spotify.exe (Technology Nexus AB) C:\Program Files (x86)\Personal\bin\Personal.exe (Dropbox, Inc.) C:\Users\Robin&Erica\AppData\Roaming\Dropbox\bin\Dropbox.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe (Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe (Creative Technology Ltd) C:\Windows\SysWOW64\CtHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [PC-Doctor for Windows localizer] - C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-17] (PC-Doctor, Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated) HKLM-x32\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM-x32\...\Run: [HP Remote Solution] - C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-25] (Hewlett-Packard) HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS) HKLM-x32\...\Run: [CarboniteSetupLite] - C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe [318096 2009-08-04] (Carbonite, Inc.) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [AsioThk32Reg] - REGSVR32.EXE /S CTASIO.DLL HKLM-x32\...\Run: [CTHelper] - CTHELPER.EXE HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM-x32\...\Runonce: [AvgUninstallURL] - cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAC0AQQBaAEoAQgBFAC0ARwBLAEQATQBEAC0AUwA3AEQAQgBBAC0ATgBXAE0AQgBQAC0ARQBWAEwATABEAA"&"inst=NwA2AC0AMQA2ADUAOAA4ADcANgAwADIANQAtAEQARABUACsAMAAtAFMAVAA5ADAAQQBQAFAAKwAxAC0AUABMACsAOQAtAE4AMQBEACsAMQAtAEMASQBEACsAMQAtAEkAQQBWAEEAKwA2AC0ASQBMAEwASQBEACsAMQAyADEAMgAzADYAMAA0ADYAMgAtAEkAQQBWAFIAKwA1AC0ASQBBAFYAUgBUAEUAKwAxAA"&"prod=92"&"ver=9.0.914 [X] Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe view=DOCKVIEW HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [spotify Web Helper] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-16] (Spotify Ltd) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [spotify] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Spotify.exe [6118400 2014-01-16] (Spotify Ltd) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Policies\system: [DisableChangePassword] 0 Startup: C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Robin&Erica\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www8.idrottonline.se/default.aspx?id=16523 HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM-x32 - @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Users\Robin&Erica\Documents\FMV6\msdxm.ocx (Microsoft Corporation) Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File DPF: HKLM-x32 {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} https://webmail.soderhamn.se/dwa85W.cab DPF: HKLM-x32 {37306766-31CE-4C1C-8578-E22672C09B93} http://www.fujidirekt.se/asp/_upload/activex/Uploader8.cab?v=8066 DPF: HKLM-x32 {5220B524-B61D-4980-862F-72E1A843B9FA} https://webmail.soderhamn.se/dwa85W.cab DPF: HKLM-x32 {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://www.fujidirekt.se/aurigma/ImageUploader5.cab DPF: HKLM-x32 {B1953AD6-C50E-11D3-B020-00A0C9251384} http://www.o2c.de/download/o2cplayer.cab DPF: HKLM-x32 {CEF002D2-5A9F-4656-AA41-85DA2534ACBD} https://webmail.soderhamn.se/dwa85W.cab DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.13.0.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\Users\Robin&Erica\Documents\FMV6\msdxm.ocx (Microsoft Corporation) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-01-11] (EasyBits Software Corp.) Winsock: Catalog5 01 C:\Windows\SysWOW64\mswsock.dll [231424] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Winsock: Catalog5-x64 01 %SystemRoot%\System32\mswsock.dll [327168] (Microsoft Corporation) ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @se.nexus/Personal - C:\Program Files (x86)\Personal\bin\np_prsnl.dll (Technology Nexus AB) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robin&Erica\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robin&Erica\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR Extension: (Google Wallet) - C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-01] ==================== Services (Whitelisted) ================= R2 AllShare Play Service; C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe [662752 2012-12-20] (Copyright 2012 SAMSUNG) R2 FreeAgentGoNext Service; C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe [189736 2009-09-25] (Seagate Technology LLC) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MSSQL$MAMUT; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation) R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X] ==================== Drivers (Whitelisted) ==================== R0 Achernar; C:\Windows\System32\Drivers\Achernar.sys [34104 2011-10-01] (NewSoft Technology Corporation) S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2012-07-10] () R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2010-06-03] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S3 Serial; C:\Windows\system32\DRIVERS\serial.sys [94208 2009-07-14] (Brother Industries Ltd.) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-05-29] () S3 SynasUSB; C:\Windows\SysWow64\drivers\SynUSB64.sys [21888 2004-08-31] (Syncrosoft GmbH) S3 synusb64; C:\Windows\System32\DRIVERS\synusb64.sys [30352 2011-12-14] (Steinberg Media Technologies GmbH) S3 synusb64; C:\Windows\SysWOW64\DRIVERS\synusb64.sys [21888 2004-08-31] (Syncrosoft GmbH) S3 Tdsshbecr; C:\Windows\System32\DRIVERS\shbecr.sys [50176 2008-09-22] (Todos Data System AB) U3 a80llavw; C:\Windows\System32\Drivers\a80llavw.sys [0 ] (Microsoft Corporation) U5 AppMgmt; C:\Windows\system32\svchost.exe [27136 2009-07-14] (Microsoft Corporation) S3 catchme; \??\C:\ComboFix\catchme.sys [X] S3 esgiguard; \??\C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [X] U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-09 16:43 - 2014-03-09 16:43 - 00010911 _____ () C:\Users\Robin&Erica\Desktop\FRST.txt 2014-03-09 10:30 - 2013-10-14 18:00 - 00028368 _____ (Microsoft Corporation) C:\Windows\system32\IEUDINIT.EXE 2014-03-09 10:26 - 2014-03-09 10:26 - 23212032 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 17142784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 12995584 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 11220992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 05765120 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 04240384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 02764288 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb 2014-03-09 10:26 - 2014-03-09 10:26 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb 2014-03-09 10:26 - 2014-03-09 10:26 - 02332160 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 02166272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01993728 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl 2014-03-09 10:26 - 2014-03-09 10:26 - 01926656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl 2014-03-09 10:26 - 2014-03-09 10:26 - 01818112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01394176 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01228800 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01156608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00942592 _____ (Microsoft Corporation) C:\Windows\system32\jsIntl.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00817664 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00774144 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00708608 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00703488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00645120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsIntl.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00616104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dat 2014-03-09 10:26 - 2014-03-09 10:26 - 00616104 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat 2014-03-09 10:26 - 2014-03-09 10:26 - 00610304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00574976 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00553472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00548352 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00523776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00440832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00413696 _____ (Microsoft Corporation) C:\Windows\system32\html.iec 2014-03-09 10:26 - 2014-03-09 10:26 - 00367104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00337408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec 2014-03-09 10:26 - 2014-03-09 10:26 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00263376 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00247808 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00244736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00238288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\url.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00235008 _____ (Microsoft Corporation) C:\Windows\system32\elshyph.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00233472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00218624 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00208384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\webcheck.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00194048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\elshyph.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00182272 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msls31.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00167424 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00151552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iexpress.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00147968 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00143872 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wextract.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00131072 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00127488 _____ (Microsoft Corporation) C:\Windows\SysWOW64\occache.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00116736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iepeers.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00111616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\IEAdvpack.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00105984 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00101376 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00090112 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00086016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00086016 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00083456 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inseng.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx 2014-03-09 10:26 - 2014-03-09 10:26 - 00074240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SetIEInstalledDate.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00069120 _____ (Microsoft Corporation) C:\Windows\SysWOW64\icardie.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tdc.ocx 2014-03-09 10:26 - 2014-03-09 10:26 - 00062464 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00056832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\pngfilt.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00052224 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmler.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00048128 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00040448 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00036352 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imgutil.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00034816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00024576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\licmgr10.dll 2014-03-09 10:26 - 2014-03-09 10:26 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00013312 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00013312 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00012800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe 2014-03-09 10:26 - 2014-03-09 10:26 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll 2014-03-09 05:26 - 2013-05-10 06:56 - 14631424 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll 2014-03-09 05:26 - 2013-05-10 06:56 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL 2014-03-09 05:26 - 2013-05-10 05:56 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL 2014-03-09 05:26 - 2013-05-10 05:56 - 11410432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll 2014-03-09 05:20 - 2014-03-09 05:20 - 00000000 ____D () C:\Windows\system32\MRT 2014-03-09 04:44 - 2014-03-09 10:30 - 00018902 _____ () C:\Windows\IE11_main.log 2014-03-09 03:59 - 2014-03-09 03:59 - 03928064 _____ (Microsoft Corporation) C:\Windows\system32\d2d1.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 03419136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d2d1.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 02776576 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 02284544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01988096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01682432 _____ (Microsoft Corporation) C:\Windows\system32\XpsPrint.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01643520 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01424384 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01247744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01238528 _____ (Microsoft Corporation) C:\Windows\system32\d3d10.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01230336 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01175552 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01158144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsPrint.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 01080832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00648192 _____ (Microsoft Corporation) C:\Windows\system32\d3d10level9.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00604160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10level9.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00522752 _____ (Microsoft Corporation) C:\Windows\system32\XpsGdiConverter.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00364544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\XpsGdiConverter.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00363008 _____ (Microsoft Corporation) C:\Windows\system32\dxgi.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00333312 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1core.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\d3d10core.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00293376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxgi.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00249856 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1core.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00245248 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecsExt.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00221184 _____ (Microsoft Corporation) C:\Windows\system32\UIAnimation.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10core.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00207872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecsExt.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00194560 _____ (Microsoft Corporation) C:\Windows\system32\d3d10_1.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00187392 _____ (Microsoft Corporation) C:\Windows\SysWOW64\UIAnimation.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00161792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10_1.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00010752 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00010752 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00009728 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00009728 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00005632 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shlwapi-l2-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00005632 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-ole32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-user32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-user32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-advapi32-l2-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-version-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-version-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00002560 ____H (Microsoft Corporation) C:\Windows\SysWOW64\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-03-09 03:59 - 2014-03-09 03:59 - 00002560 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dll 2014-03-09 03:56 - 2014-03-09 04:11 - 00012528 _____ () C:\Windows\IE10_main.log 2014-03-09 03:18 - 2012-07-26 04:08 - 00744448 _____ (Microsoft Corporation) C:\Windows\system32\WUDFx.dll 2014-03-09 03:18 - 2012-07-26 04:08 - 00229888 _____ (Microsoft Corporation) C:\Windows\system32\WUDFHost.exe 2014-03-09 03:18 - 2012-07-26 04:08 - 00194048 _____ (Microsoft Corporation) C:\Windows\system32\WUDFPlatform.dll 2014-03-09 03:18 - 2012-07-26 04:08 - 00084992 _____ (Microsoft Corporation) C:\Windows\system32\WUDFSvc.dll 2014-03-09 03:18 - 2012-07-26 04:08 - 00045056 _____ (Microsoft Corporation) C:\Windows\system32\WUDFCoinstaller.dll 2014-03-09 03:18 - 2012-07-26 03:26 - 00198656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFRd.sys 2014-03-09 03:18 - 2012-07-26 03:26 - 00087040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\WUDFPf.sys 2014-03-09 03:18 - 2012-06-02 15:57 - 00000003 _____ () C:\Windows\system32\Drivers\MsftWdf_User_01_11_00_Inbox_Critical.Wdf 2014-03-09 01:48 - 2013-10-30 03:32 - 00335360 _____ (Microsoft Corporation) C:\Windows\system32\msieftp.dll 2014-03-09 01:48 - 2013-10-30 03:19 - 00301568 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msieftp.dll 2014-03-09 01:48 - 2013-07-04 13:50 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\comctl32.dll 2014-03-09 01:48 - 2013-07-04 12:50 - 00530432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\comctl32.dll 2014-03-09 01:48 - 2013-02-15 07:08 - 00044032 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll 2014-03-09 01:48 - 2013-02-15 07:06 - 03717632 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll 2014-03-09 01:48 - 2013-02-15 07:02 - 00158720 _____ (Microsoft Corporation) C:\Windows\system32\aaclient.dll 2014-03-09 01:48 - 2013-02-15 05:37 - 03217408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll 2014-03-09 01:48 - 2013-02-15 05:34 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll 2014-03-09 01:48 - 2013-02-15 04:25 - 00036864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll 2014-03-09 01:48 - 2012-10-09 19:17 - 00226816 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcore6.dll 2014-03-09 01:48 - 2012-10-09 19:17 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\dhcpcsvc6.dll 2014-03-09 01:48 - 2012-10-09 18:40 - 00193536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcore6.dll 2014-03-09 01:48 - 2012-10-09 18:40 - 00044032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dhcpcsvc6.dll 2014-03-09 01:47 - 2014-01-01 00:05 - 00420008 _____ () C:\Windows\SysWOW64\locale.nls 2014-03-09 01:47 - 2014-01-01 00:04 - 00420008 _____ () C:\Windows\system32\locale.nls 2014-03-09 01:47 - 2013-10-05 21:25 - 01474048 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll 2014-03-09 01:47 - 2013-10-05 20:57 - 01168384 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll 2014-03-09 01:47 - 2013-07-09 06:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll 2014-03-09 01:47 - 2013-07-09 06:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll 2014-03-09 01:47 - 2013-07-09 06:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll 2014-03-09 01:47 - 2013-07-09 05:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll 2014-03-09 01:47 - 2013-07-09 05:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll 2014-03-09 01:47 - 2013-07-09 05:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll 2014-03-09 01:47 - 2013-04-12 15:45 - 01656680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ntfs.sys 2014-03-09 01:47 - 2013-03-19 06:53 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\wwansvc.dll 2014-03-09 01:47 - 2013-03-19 06:53 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\wwanprotdim.dll 2014-03-09 01:47 - 2013-02-27 07:02 - 00111448 _____ (Microsoft Corporation) C:\Windows\system32\consent.exe 2014-03-09 01:47 - 2013-02-27 06:47 - 00070144 _____ (Microsoft Corporation) C:\Windows\system32\appinfo.dll 2014-03-09 01:46 - 2013-12-06 03:30 - 01882112 _____ (Microsoft Corporation) C:\Windows\system32\msxml3.dll 2014-03-09 01:46 - 2013-12-06 03:30 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\msxml3r.dll 2014-03-09 01:46 - 2013-12-06 03:02 - 01237504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3.dll 2014-03-09 01:46 - 2013-12-06 03:02 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msxml3r.dll 2014-03-09 01:46 - 2013-12-04 03:27 - 00488448 _____ (Microsoft Corporation) C:\Windows\system32\secproc.dll 2014-03-09 01:46 - 2013-12-04 03:27 - 00485888 _____ (Microsoft Corporation) C:\Windows\system32\secproc_isv.dll 2014-03-09 01:46 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp_isv.dll 2014-03-09 01:46 - 2013-12-04 03:27 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\secproc_ssp.dll 2014-03-09 01:46 - 2013-12-04 03:26 - 00528384 _____ (Microsoft Corporation) C:\Windows\system32\msdrm.dll 2014-03-09 01:46 - 2013-12-04 03:16 - 00658432 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_isv.exe 2014-03-09 01:46 - 2013-12-04 03:16 - 00626176 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate.exe 2014-03-09 01:46 - 2013-12-04 03:16 - 00553984 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp.exe 2014-03-09 01:46 - 2013-12-04 03:16 - 00552960 _____ (Microsoft Corporation) C:\Windows\system32\RMActivate_ssp_isv.exe 2014-03-09 01:46 - 2013-12-04 03:03 - 00428032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc.dll 2014-03-09 01:46 - 2013-12-04 03:03 - 00423936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_isv.dll 2014-03-09 01:46 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp_isv.dll 2014-03-09 01:46 - 2013-12-04 03:03 - 00087040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secproc_ssp.dll 2014-03-09 01:46 - 2013-12-04 03:02 - 00390144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdrm.dll 2014-03-09 01:46 - 2013-12-04 02:54 - 00594944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_isv.exe 2014-03-09 01:46 - 2013-12-04 02:54 - 00572416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate.exe 2014-03-09 01:46 - 2013-12-04 02:54 - 00510976 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp.exe 2014-03-09 01:46 - 2013-12-04 02:54 - 00508928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2014-03-09 01:46 - 2013-11-27 02:41 - 00343040 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbhub.sys 2014-03-09 01:46 - 2013-11-27 02:41 - 00325120 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbport.sys 2014-03-09 01:46 - 2013-11-27 02:41 - 00099840 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbccgp.sys 2014-03-09 01:46 - 2013-11-27 02:41 - 00053248 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbehci.sys 2014-03-09 01:46 - 2013-11-27 02:41 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbuhci.sys 2014-03-09 01:46 - 2013-11-27 02:41 - 00025600 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbohci.sys 2014-03-09 01:46 - 2013-11-27 02:41 - 00007808 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\usbd.sys 2014-03-09 01:46 - 2013-11-12 03:23 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll 2014-03-09 01:46 - 2013-11-12 03:07 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll 2014-03-09 01:46 - 2013-10-19 03:18 - 00081408 _____ (Microsoft Corporation) C:\Windows\system32\imagehlp.dll 2014-03-09 01:46 - 2013-10-19 02:36 - 00159232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\imagehlp.dll 2014-03-09 01:46 - 2013-10-04 03:28 - 00190464 _____ (Microsoft Corporation) C:\Windows\system32\SmartcardCredentialProvider.dll 2014-03-09 01:46 - 2013-10-04 03:25 - 00197120 _____ (Microsoft Corporation) C:\Windows\system32\credui.dll 2014-03-09 01:46 - 2013-10-04 03:24 - 01930752 _____ (Microsoft Corporation) C:\Windows\system32\authui.dll 2014-03-09 01:46 - 2013-10-04 03:16 - 00116736 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\drmk.sys 2014-03-09 01:46 - 2013-10-04 02:58 - 00152576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\SmartcardCredentialProvider.dll 2014-03-09 01:46 - 2013-10-04 02:56 - 01796096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\authui.dll 2014-03-09 01:46 - 2013-10-04 02:56 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credui.dll 2014-03-09 01:46 - 2013-10-04 02:36 - 00230400 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\portcls.sys 2014-03-09 01:46 - 2013-09-28 02:09 - 00497152 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\afd.sys 2014-03-09 01:46 - 2013-09-25 03:26 - 00154560 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys 2014-03-09 01:46 - 2013-09-25 03:26 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys 2014-03-09 01:46 - 2013-09-25 03:23 - 00135680 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll 2014-03-09 01:46 - 2013-09-25 03:23 - 00028672 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll 2014-03-09 01:46 - 2013-09-25 03:23 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll 2014-03-09 01:46 - 2013-09-25 03:22 - 00340992 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll 2014-03-09 01:46 - 2013-09-25 03:21 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll 2014-03-09 01:46 - 2013-09-25 03:21 - 00307200 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll 2014-03-09 01:46 - 2013-09-25 02:58 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll 2014-03-09 01:46 - 2013-09-25 02:57 - 00247808 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll 2014-03-09 01:46 - 2013-09-25 02:57 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll 2014-03-09 01:46 - 2013-09-25 02:56 - 00220160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll 2014-03-09 01:46 - 2013-09-25 02:03 - 00030720 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe 2014-03-09 01:46 - 2013-08-05 03:25 - 00155584 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ataport.sys 2014-03-09 01:46 - 2013-07-04 13:18 - 00458712 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys 2014-03-09 01:46 - 2013-06-06 06:50 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll 2014-03-09 01:46 - 2013-06-06 06:49 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll 2014-03-09 01:46 - 2013-06-06 06:49 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll 2014-03-09 01:46 - 2013-06-06 06:47 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll 2014-03-09 01:46 - 2013-06-06 05:57 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll 2014-03-09 01:46 - 2013-06-06 05:51 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll 2014-03-09 01:46 - 2013-06-06 05:50 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll 2014-03-09 01:46 - 2013-06-06 04:30 - 00368128 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll 2014-03-09 01:46 - 2013-06-06 04:01 - 00295424 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll 2014-03-09 01:46 - 2013-06-06 04:01 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll 2014-03-09 01:46 - 2013-04-26 00:30 - 01505280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d11.dll 2014-03-09 01:46 - 2013-03-31 23:52 - 01887232 _____ (Microsoft Corporation) C:\Windows\system32\d3d11.dll 2014-03-09 01:45 - 2013-08-02 03:14 - 00215040 _____ (Microsoft Corporation) C:\Windows\system32\winsrv.dll 2014-03-09 01:45 - 2013-08-02 03:13 - 01161216 _____ (Microsoft Corporation) C:\Windows\system32\kernel32.dll 2014-03-09 01:45 - 2013-08-02 03:13 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\KernelBase.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00006144 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-security-base-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00005120 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-file-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-threadpool-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00004608 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processthreads-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-sysinfo-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-synch-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localregistry-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00004096 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-localization-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-rtlsupport-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-processenvironment-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-namedpipe-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-misc-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-memory-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-libraryloader-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003584 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-heap-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-xstate-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-util-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-string-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-profile-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-io-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-interlocked-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-handle-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-fibers-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-errorhandling-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-delayload-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-debug-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-datetime-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 03:12 - 00003072 ____H (Microsoft Corporation) C:\Windows\system32\api-ms-win-core-console-l1-1-0.dll 2014-03-09 01:45 - 2013-08-02 02:50 - 01114112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kernel32.dll

# AdwCleaner v3.020 - Report created 09/03/2014 at 16:17:53 # Updated 27/02/2014 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Robin&Erica - STATIONÄRA # Running from : C:\Users\Robin&Erica\Desktop\Robin\Datarensning\adwcleaner.exe # Option : Clean ***** [ Services ] ***** ***** [ Files / Folders ] ***** Folder Deleted : C:\ProgramData\apn Folder Deleted : C:\ProgramData\boost_interprocess Folder Deleted : C:\ProgramData\Tarma Installer Folder Deleted : C:\Program Files (x86)\Conduit Folder Deleted : C:\Program Files (x86)\uTorrentControl2 Folder Deleted : C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Folder Deleted : C:\Users\Robin&Erica\AppData\Local\Conduit Folder Deleted : C:\Users\Robin&Erica\AppData\Local\eSupport.com Folder Deleted : C:\Users\Robin&Erica\AppData\LocalLow\Conduit Folder Deleted : C:\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2 Folder Deleted : C:\Users\Robin&Erica\AppData\Roaming\dvdvideosoftiehelpers Folder Deleted : C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com Folder Deleted : C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc File Deleted : C:\Users\Robin&Erica\AppData\Roaming\Mozilla\Firefox\Profiles\0\user.js File Deleted : C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage File Deleted : C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage-journal ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf Key Deleted : HKCU\Software\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc Key Deleted : HKLM\SOFTWARE\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc Key Deleted : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com Key Deleted : HKLM\SOFTWARE\Classes\speedupmypc Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASAPI32 Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASMANCS Key Deleted : HKLM\SOFTWARE\14919ea49a8f3b4aa3cf1058d9a64cec Key Deleted : HKLM\SOFTWARE\Classes\Toolbar.CT3072253 Key Deleted : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Deleted : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{C4C4F1F4-3074-4CB6-9FB8-0A64273166F0} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{42B08134-24AF-4551-8A54-10C5174117FC} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{94CAEAED-255E-4D47-A4C4-ADF8844B1E03} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Deleted : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Deleted : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Deleted : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}] Key Deleted : [x64] HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Deleted : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Deleted : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Deleted : HKCU\Software\Conduit Key Deleted : HKCU\Software\IGearSettings Key Deleted : HKCU\Software\AppDataLow\Toolbar Key Deleted : HKCU\Software\AppDataLow\Software\Conduit Key Deleted : HKCU\Software\AppDataLow\Software\SmartBar Key Deleted : HKCU\Software\AppDataLow\Software\uTorrentControl2 Key Deleted : HKLM\Software\Conduit Key Deleted : HKLM\Software\dt soft\daemon tools toolbar Key Deleted : HKLM\Software\Uniblue Key Deleted : HKLM\Software\uTorrentControl2 Key Deleted : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl2 Toolbar ***** [ Browsers ] ***** -\\ Internet Explorer v11.0.9600.16428 -\\ Mozilla Firefox v [ File : C:\Users\Robin&Erica\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js ] -\\ Google Chrome v33.0.1750.146 [ File : C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [9557 octets] - [08/03/2014 23:44:11] AdwCleaner[R1].txt - [9416 octets] - [09/03/2014 14:38:30] AdwCleaner[s0].txt - [8328 octets] - [09/03/2014 16:17:53] ########## EOF - C:\AdwCleaner\AdwCleaner[s0].txt - [8388 octets] ##########

Här kommer den sista: # AdwCleaner v3.020 - Report created 08/03/2014 at 23:44:11 # Updated 27/02/2014 by Xplode # Operating System : Windows 7 Home Premium Service Pack 1 (64 bits) # Username : Robin&Erica - STATIONÄRA # Running from : C:\Users\Robin&Erica\Desktop\adwcleaner.exe # Option : Scan ***** [ Services ] ***** ***** [ Files / Folders ] ***** File Found : C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage File Found : C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Local Storage\hxxp_facebook.conduitapps.com_0.localstorage-journal File Found : C:\Users\Robin&Erica\AppData\Roaming\Mozilla\Firefox\Profiles\0\user.js Folder Found : C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc Folder Found C:\Program Files (x86)\Common Files\DVDVideoSoft\TB Folder Found C:\Program Files (x86)\Conduit Folder Found C:\Program Files (x86)\uTorrentControl2 Folder Found C:\ProgramData\apn Folder Found C:\ProgramData\boost_interprocess Folder Found C:\ProgramData\Tarma Installer Folder Found C:\Users\Robin&Erica\AppData\Local\Conduit Folder Found C:\Users\Robin&Erica\AppData\Local\eSupport.com Folder Found C:\Users\Robin&Erica\AppData\LocalLow\Conduit Folder Found C:\Users\Robin&Erica\AppData\LocalLow\uTorrentControl2 Folder Found C:\Users\Robin&Erica\AppData\Roaming\dvdvideosoftiehelpers Folder Found C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TornTV.com ***** [ Shortcuts ] ***** ***** [ Registry ] ***** Key Found : HKCU\Software\AppDataLow\Software\Conduit Key Found : HKCU\Software\AppDataLow\Software\SmartBar Key Found : HKCU\Software\AppDataLow\Software\uTorrentControl2 Key Found : HKCU\Software\AppDataLow\Toolbar Key Found : HKCU\Software\Conduit Key Found : HKCU\Software\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc Key Found : HKCU\Software\IGearSettings Key Found : HKCU\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage\conduit.com Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE} Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Key Found : [x64] HKCU\Software\Conduit Key Found : [x64] HKCU\Software\IGearSettings Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Key Found : [x64] HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Found : HKLM\SOFTWARE\14919ea49a8f3b4aa3cf1058d9a64cec Key Found : HKLM\SOFTWARE\Classes\AppID\{0A18A436-2A7A-49F3-A488-30538A2F6323} Key Found : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826} Key Found : HKLM\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C} Key Found : HKLM\SOFTWARE\Classes\CLSID\{007EFBDF-8A5D-4930-97CC-A4B437CBA777} Key Found : HKLM\SOFTWARE\Classes\CLSID\{1AA60054-57D9-4F99-9A55-D0FBFBE7ECD3} Key Found : HKLM\SOFTWARE\Classes\CLSID\{3BF72F68-72D8-461D-A884-329D936C5581} Key Found : HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : HKLM\SOFTWARE\Classes\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Found : HKLM\SOFTWARE\Classes\CLSID\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Found : HKLM\SOFTWARE\Classes\CLSID\{78E9D883-93CD-4072-BEF3-38EE581E2839} Key Found : HKLM\SOFTWARE\Classes\CLSID\{80922EE0-8A76-46AE-95D5-BD3C3FE0708D} Key Found : HKLM\SOFTWARE\Classes\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F} Key Found : HKLM\SOFTWARE\Classes\CLSID\{CC5AD34C-6F10-4CB3-B74A-C2DD4D5060A3} Key Found : HKLM\SOFTWARE\Classes\CLSID\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955} Key Found : HKLM\SOFTWARE\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Key Found : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : HKLM\SOFTWARE\Classes\speedupmypc Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT3072253 Key Found : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Key Found : HKLM\SOFTWARE\Classes\TypeLib\{C4C4F1F4-3074-4CB6-9FB8-0A64273166F0} Key Found : HKLM\Software\Conduit Key Found : HKLM\Software\dt soft\daemon tools toolbar Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\jbpkiefagocgkmemidfngdkamloieekf Key Found : HKLM\SOFTWARE\Google\Chrome\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{42B08134-24AF-4551-8A54-10C5174117FC} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{94CAEAED-255E-4D47-A4C4-ADF8844B1E03} Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B} Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ApnSetup_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskInstallChecker-1_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\AskPIP_FF__RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\ClickPotatoLiteSA_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASAPI32 Key Found : HKLM\SOFTWARE\Microsoft\Tracing\HPSF_Tasks_RASMANCS Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{687578B9-7132-4A7A-80E4-30EE31099E03} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{D4AAF2A6-F6D1-49A5-BA1A-B20735DF1955} Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrentControl2 Toolbar Key Found : HKLM\Software\Uniblue Key Found : HKLM\Software\uTorrentControl2 Key Found : [x64] HKLM\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Key Found : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Key Found : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Found : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Found : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}] Value Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{687578B9-7132-4A7A-80E4-30EE31099E03}] ***** [ Browsers ] ***** -\\ Internet Explorer v8.0.7601.17514 -\\ Mozilla Firefox v [ File : C:\Users\Robin&Erica\AppData\Roaming\Mozilla\Firefox\Profiles\0\prefs.js ] -\\ Google Chrome v33.0.1750.146 [ File : C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\preferences ] ************************* AdwCleaner[R0].txt - [9385 octets] - [08/03/2014 23:44:11] ########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [9445 octets] ##########

Loggen från MBAM: Malwarebytes Anti-Malware 1.75.0.1300 www.malwarebytes.org Databasversion: v2014.03.08.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 8.0.7601.17514 Robin&Erica :: STATIONÄRA [administratör] 2014-03-08 21:15:17 MBAM-log-2014-03-08 (23-42-09).txt Skanningstyp: Fullständig skanning (C:\|D:\|E:\|G:\|H:\|I:\|J:\|K:\|L:\|) Aktiverade skanningsalternativ: Minne | Start | Register | Filsystem | Heuristik/Extra | Heuristik/Shuriken | PUP | PUM Inaktiverade skanningsalternativ: P2P Antal skannade objekt: 557501 Förfluten tid: 1 timme(ar), 53 minut(er), 53 sekund(er) Upptäckta minnesprocesser: 0 (Inga skadliga poster hittades) Upptäckta minnesmoduler: 0 (Inga skadliga poster hittades) Upptäckta registernycklar: 0 (Inga skadliga poster hittades) Upptäckta registervärden: 0 (Inga skadliga poster hittades) Upptäckta registerdataposter: 0 (Inga skadliga poster hittades) Upptäckta mappar: 0 (Inga skadliga poster hittades) Upptäckta filer: 2 C:\FRST\Quarantine\ft7e30o.cpp07-03-2014_08-34-53 (Trojan.FakeMS) -> Ingen åtgärd. C:\Users\Robin&Erica\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZUVXK7VI\flashplayer11_7r101902_325_win[1].exe (Trojan.Miuref.gen) -> Ingen åtgärd. (klar)

Anteckningar från Rougekiller: RogueKiller V8.8.10 _x64_ [Feb 28 2014] by Adlice Software mail : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Robin&Erica [Admin rights] Mode : Scan -- Date : 03/08/2014 20:47:08 | ARK || FAK || MBR | ¤¤¤ Bad processes : 1 ¤¤¤ [sUSP PATH] FreeAgentService.exe -- C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe [7] -> KILLED [TermProc] ¤¤¤ Registry Entries : 6 ¤¤¤ [HJ POL][PUM] HKLM\[...]\System : DisableRegistryTools (0) -> FOUND [HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : DisableRegistryTools (0) -> FOUND [HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK][PUM] HKCU\[...]\ClassicStartMenu : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND [HJ DESK][PUM] HKCU\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK][PUM] HKCU\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND ¤¤¤ Scheduled tasks : 0 ¤¤¤ ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Browser Addons : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 localhost ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST3500418AS ATA Device +++++ --- User --- [MBR] d7f611973bbc724fab30f76591c1eb98 [bSP] f14f1a5d9d731d6b26dde4437c5977d6 : Windows Vista/7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 463578 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 949614592 | Size: 13260 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[0]_S_03082014_204708.txt >>

Är som sagt mycket tacksam för din hjälp! Här är anteckningarna från ComboFix: ComboFix 14-03-05.01 - Robin&Erica 2014-03-08 20:10:08.1.2 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.46.1053.18.4061.2574 [GMT 1:00] Körs från: c:\users\Robin&Erica\Desktop\ComboFix.exe SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((((((((((((((((((( Andra raderingar )))))))))))))))))))))))))))))))))))))))))))))))) . . C:\install.exe c:\program files (x86)\QuickTime\QTTask.exe c:\program files (x86)\WinZip Driver Updater c:\program files (x86)\WinZip Driver Updater\Chinese_rcp.ini c:\program files (x86)\WinZip Driver Updater\Danish_rcp.ini c:\program files (x86)\WinZip Driver Updater\difxapi.dll c:\program files (x86)\WinZip Driver Updater\difxapi64.dll c:\program files (x86)\WinZip Driver Updater\Dutch_rcp.ini c:\program files (x86)\WinZip Driver Updater\eng_rcp.ini c:\program files (x86)\WinZip Driver Updater\Finnish_rcp_fi.ini c:\program files (x86)\WinZip Driver Updater\French_rcp.ini c:\program files (x86)\WinZip Driver Updater\German_rcp.ini c:\program files (x86)\WinZip Driver Updater\install_left.bmp c:\program files (x86)\WinZip Driver Updater\isxdl.dll c:\program files (x86)\WinZip Driver Updater\Italian_rcp.ini c:\program files (x86)\WinZip Driver Updater\Japanese_rcp.ini c:\program files (x86)\WinZip Driver Updater\Norwegian_rcp.ini c:\program files (x86)\WinZip Driver Updater\Portuguese_rcp.ini c:\program files (x86)\WinZip Driver Updater\russian_rcp_ru.ini c:\program files (x86)\WinZip Driver Updater\Spanish_rcp.ini c:\program files (x86)\WinZip Driver Updater\Swedish_rcp.ini c:\program files (x86)\WinZip Driver Updater\unins000.dat c:\program files (x86)\WinZip Driver Updater\unins000.exe c:\program files (x86)\WinZip Driver Updater\unins000.msg c:\program files (x86)\WinZip Driver Updater\unrar.dll c:\program files (x86)\WinZip Driver Updater\updater\amd64Helper\difxapi.dll c:\program files (x86)\WinZip Driver Updater\updater\amd64Helper\DriverUpdateHelper64.exe c:\program files (x86)\WinZip Driver Updater\updater\amd64Helper\DriverUpdateHelper64.manifest c:\program files (x86)\WinZip Driver Updater\updater\extract\7z.dll c:\program files (x86)\WinZip Driver Updater\updater\extract\7z.exe c:\program files (x86)\WinZip Driver Updater\updater\extract\copying.txt c:\program files (x86)\WinZip Driver Updater\updater\extract\History.txt c:\program files (x86)\WinZip Driver Updater\updater\extract\license.txt c:\program files (x86)\WinZip Driver Updater\updater\extract\readme.txt c:\program files (x86)\WinZip Driver Updater\WDUUninstall.exe c:\program files (x86)\WinZip Driver Updater\winzipdu.exe c:\users\Robin&Erica\AppData\Local\Microsoft\Windows\Temporary Internet Files\lookinglink_iels c:\windows\system\Pncrt.dll c:\windows\Tasks\WinZipDriverUpdater_UPDATES.job . . (((((((((((((((((((((((( Filer skapade från 2014-02-08 till 2014-03-08 )))))))))))))))))))))))))))))) . . 2014-03-08 19:26 . 2014-03-08 19:26 -------- d-----w- c:\users\Default\AppData\Local\temp 2014-03-07 07:48 . 2014-03-07 07:44 -------- d-----w- C:\FRST 2014-03-06 23:18 . 2014-03-06 23:18 -------- d-----w- c:\program files\Enigma Software Group 2014-03-06 23:17 . 2014-03-07 08:06 -------- d-----w- c:\windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP 2014-03-06 23:17 . 2014-03-06 23:17 -------- d-----w- c:\program files (x86)\Common Files\Wise Installation Wizard 2014-02-08 15:07 . 2014-02-08 15:49 -------- d-----w- c:\users\Robin&Erica\.appinventor . . . (((((((((((((((((((((((((((((((((((((((( Find3M Rapport ))))))))))))))))))))))))))))))))))))))))))))))))))) . 2014-03-06 23:46 . 2012-05-18 06:03 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2014-03-06 23:46 . 2012-01-02 22:02 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2013-12-18 20:09 . 2014-01-22 19:54 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll . . (((((((((((((((((((((((((((((((((( Startpunkter i registret ))))))))))))))))))))))))))))))))))))))))))))))) . . *Not* tomma poster & legitima standardposter visas inte. REGEDIT4 . [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{687578b9-7132-4a7a-80e4-30ee31099e03}"= "c:\program files (x86)\uTorrentControl2\prxtbuTor.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{687578b9-7132-4a7a-80e4-30ee31099e03}] 2011-05-09 09:49 176936 ----a-w- c:\program files (x86)\uTorrentControl2\prxtbuTor.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar] "{687578b9-7132-4a7a-80e4-30ee31099e03}"= "c:\program files (x86)\uTorrentControl2\prxtbuTor.dll" [2011-05-09 176936] . [HKEY_CLASSES_ROOT\clsid\{687578b9-7132-4a7a-80e4-30ee31099e03}] . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Robin&Erica\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Robin&Erica\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 131248 ----a-w- c:\users\Robin&Erica\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "HPADVISOR"="c:\program files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-09-29 1685048] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584] "Spotify Web Helper"="c:\users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyWebHelper.exe" [2014-01-16 1171968] "Spotify"="c:\users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Spotify.exe" [2014-01-16 6118400] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe" [2008-11-20 62768] "HP Remote Solution"="c:\program files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe" [2009-08-25 656896] "Easybits Recovery"="c:\program files (x86)\EasyBits For Kids\ezRecover.exe" [2009-09-02 60464] "CarboniteSetupLite"="c:\program files (x86)\Carbonite\CarbonitePreinstaller.exe" [2009-08-04 318096] "HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2010-03-12 49208] "AsioThk32Reg"="CTASIO.DLL" [2010-03-18 47104] "CTHelper"="CTHELPER.EXE" [2010-03-18 19456] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904] "SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce] "AvgUninstallURL"="start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OQBBAC0AQQBaAEoAQgBFAC0ARwBLAEQATQBEAC0AUwA3AEQAQgBBAC0ATgBXAE0AQgBQAC0ARQBWAEwATABEAA&inst=NwA2AC0AMQA2ADUAOAA4ADcANgAwADIANQAtAEQARABUACsAMAAtAFMAVAA5ADAAQQBQAFAAKwAxAC0AUABMACsAOQAtAE4AMQBEACsAMQAtAEMASQBEACsAMQAtAEkAQQBWAEEAKwA2AC0ASQBMAEwASQBEACsAMQAyADEAMgAzADYAMAA0ADYAMgAtAEkAQQBWAFIAKwA1AC0ASQBBAFYAUgBUAEUAKwAxAA∏=92&ver=9.0.914" [?] . c:\users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ Dropbox.lnk - c:\users\Robin&Erica\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328] . c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\ BankID säkerhetsprogram.lnk - c:\program files (x86)\Personal\bin\Personal.exe [2013-4-18 1359224] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) "EnableVirtualization"= 0 (0x0) "HideFastUserSwitching"= 0 (0x0) . [hkey_local_machine\software\Wow6432Node\microsoft\windows\currentversion\explorer\ShellExecuteHooks] . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x] R2 HP Support Assistant Service;HP Support Assistant Service;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe;c:\program files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe [x] R3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.SYS;c:\windows\SYSNATIVE\drivers\COMMONFX.SYS [x] R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe;c:\program files (x86)\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [x] R3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.SYS;c:\windows\SYSNATIVE\drivers\CTAUDFX.SYS [x] R3 CTERFXFX.SYS;CTERFXFX.SYS;c:\windows\System32\drivers\CTERFXFX.SYS;c:\windows\SYSNATIVE\drivers\CTERFXFX.SYS [x] R3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.SYS;c:\windows\SYSNATIVE\drivers\CTERFXFX.SYS [x] R3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.SYS;c:\windows\SYSNATIVE\drivers\CTSBLFX.SYS [x] R3 DrvAgent64;DrvAgent64;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS;c:\windows\SysWOW64\Drivers\DrvAgent64.SYS [x] R3 esgiguard;esgiguard;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys;c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [x] R3 hwdatacard;Huawei DataCard USB Modem and USB Serial;c:\windows\system32\DRIVERS\ewusbmdm.sys;c:\windows\SYSNATIVE\DRIVERS\ewusbmdm.sys [x] R3 ivusb;Initio Driver for USB Default Controller;c:\windows\system32\DRIVERS\ivusb.sys;c:\windows\SYSNATIVE\DRIVERS\ivusb.sys [x] R3 SynasUSB;SynasUSB;sysWOW64\drivers\SynUSB64.sys;sysWOW64\drivers\SynUSB64.sys [x] R3 synusb64;eLicenser;c:\windows\system32\DRIVERS\synusb64.sys;c:\windows\SYSNATIVE\DRIVERS\synusb64.sys [x] R3 Tdsshbecr;Handelsbanken card reader;c:\windows\system32\DRIVERS\shbecr.sys;c:\windows\SYSNATIVE\DRIVERS\shbecr.sys [x] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x] R3 WatAdminSvc;Aktiveringsteknologier för Windows-tjänst;c:\windows\system32\Wat\WatAdminSvc.exe;c:\windows\SYSNATIVE\Wat\WatAdminSvc.exe [x] S0 Achernar;Achernar - SCSI Command Filter Drivers;c:\windows\system32\Drivers\Achernar.sys;c:\windows\SYSNATIVE\Drivers\Achernar.sys [x] S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys;c:\windows\SYSNATIVE\Drivers\sptd.sys [x] S2 AllShare Play Service;AllShare Play Service;c:\program files\Samsung\AllShare Play\AllShare Play Service.exe;c:\program files\Samsung\AllShare Play\AllShare Play Service.exe [x] S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x] S2 FreeAgentGoNext Service;Seagate Service;c:\users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe;c:\users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe [x] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [x] S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [x] S2 MSSQL$MAMUT;SQL Server (MAMUT);c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe;c:\program files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [x] S2 NAUpdate;Nero Update;c:\program files (x86)\Nero\Update\NASvc.exe;c:\program files (x86)\Nero\Update\NASvc.exe [x] S3 COMMONFX.SYS;COMMONFX.SYS;c:\windows\System32\drivers\COMMONFX.SYS;c:\windows\SYSNATIVE\drivers\COMMONFX.SYS [x] S3 CTAUDFX.SYS;CTAUDFX.SYS;c:\windows\System32\drivers\CTAUDFX.SYS;c:\windows\SYSNATIVE\drivers\CTAUDFX.SYS [x] S3 CTSBLFX.SYS;CTSBLFX.SYS;c:\windows\System32\drivers\CTSBLFX.SYS;c:\windows\SYSNATIVE\drivers\CTSBLFX.SYS [x] S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x] . . HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ezSharedSvc . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}] 2014-03-07 04:19 1150280 ----a-w- c:\program files (x86)\Google\Chrome\Application\33.0.1750.146\Installer\chrmstp.exe . Innehåll i mappen 'Schemalagda aktiviteter': . 2014-03-08 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-18 23:47] . 2014-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-09 09:45] . 2014-03-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files (x86)\Google\Update\GoogleUpdate.exe [2012-07-09 09:45] . 2014-03-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000Core.job - c:\users\Robin&Erica\AppData\Local\Google\Update\GoogleUpdate.exe [2013-11-08 12:30] . 2014-03-08 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000UA.job - c:\users\Robin&Erica\AppData\Local\Google\Update\GoogleUpdate.exe [2013-11-08 12:30] . 2014-03-07 c:\windows\Tasks\HPCeeScheduleForRobin&Erica.job - c:\program files (x86)\Hewlett-Packard\HP Ceement\HPCEE.exe [2009-10-07 03:22] . 2014-01-31 c:\windows\Tasks\PCDRScheduledMaintenance.job - c:\program files\PC-Doctor for Windows\pcdrcui.exe [2009-09-18 07:11] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1] @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Robin&Erica\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2] @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Robin&Erica\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3] @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Robin&Erica\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4] @="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}" [HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}] 2013-09-10 23:54 164016 ----a-w- c:\users\Robin&Erica\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PC-Doctor for Windows localizer"="c:\program files\PC-Doctor for Windows\localizer.exe" [2009-09-17 95728] "AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-10-16 162328] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-10-16 386584] "Persistence"="c:\windows\system32\igfxpers.exe" [2010-10-16 415256] . ------- Extra genomsökning ------- . uStart Page = hxxp://www8.idrottonline.se/default.aspx?id=16523 uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: E&xportera till Microsoft Excel - c:\users\ROBIN&~1\Desktop\Blandat\Program\INSTAL~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 IE: Free YouTube to Mp3 Converter - c:\users\Robin&Erica\AppData\Roaming\DVDVideoSoftIEHelpers\youtubetomp3.htm IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html IE: {{B4B52284-A248-4c51-9F7C-F0A0C67FCC9D} - c:\users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\PartyPoker\PartyCasino\RunApp.exe TCP: DhcpNameServer = 192.168.1.1 DPF: {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} - hxxps://webmail.soderhamn.se/dwa85W.cab DPF: {37306766-31CE-4C1C-8578-E22672C09B93} - hxxp://www.fujidirekt.se/asp/_upload/activex/Uploader8.cab?v=8066 DPF: {5220B524-B61D-4980-862F-72E1A843B9FA} - hxxps://webmail.soderhamn.se/dwa85W.cab DPF: {B1953AD6-C50E-11D3-B020-00A0C9251384} - hxxp://www.o2c.de/download/o2cplayer.cab DPF: {CEF002D2-5A9F-4656-AA41-85DA2534ACBD} - hxxps://webmail.soderhamn.se/dwa85W.cab . - - - - FÖRÄLDRALÖSA POSTER SOM TAGITS BORT - - - - . Wow6432Node-HKCU-Run-AdobeBridge - (no file) Wow6432Node-HKCU-Run-EA Core - c:\program files (x86)\Electronic Arts\EADM\Core.exe Wow6432Node-HKCU-Run-RESTART_STICKY_NOTES - c:\windows\System32\StikyNot.exe Wow6432Node-HKCU-Run-QuickTime Task - c:\program files (x86)\QuickTime\QTTask.exe Wow6432Node-HKLM-Run-<NO NAME> - (no file) Wow6432Node-HKLM-Run-QuickTime Task - c:\program files (x86)\QuickTime\QTTask.exe Wow6432Node-HKLM-Run-HF_G_Jul - c:\program files (x86)\AVG Secure Search\HF_G_Jul.exe WebBrowser-{687578B9-7132-4A7A-80E4-30EE31099E03} - (no file) AddRemove-EasyBits Magic Desktop - c:\windows\system32\ezMDUninstall.exe AddRemove-Vector Magic - c:\users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Vector\Vector\Vector Magic\Uninstall.exe AddRemove-{9854A5C4-5BE5-46E2-A989-352DD8B37E20}_is1 - c:\program files (x86)\WinZip Driver Updater\unins000.exe AddRemove-{EE202411-2C26-49E8-9784-1BC1DBF7DE96} - c:\program files (x86)\InstallShield Installation Information\{EE202411-2C26-49E8-9784-1BC1DBF7DE96}\setup.exe . . . --------------------- LÅSTA REGISTERNYCKLAR --------------------- . [HKEY_USERS\S-1-5-21-2160987881-4071915104-1257501379-1000\Software\SecuROM\License information*] "datasecu"=hex:64,48,97,27,ea,3d,f4,9a,07,2b,5b,78,84,40,2d,fb,e3,56,55,56,eb, 93,fa,5c,4a,a2,98,e5,f6,26,db,e1,65,d6,a3,e0,b2,65,af,e5,5f,50,fb,83,62,b1,\ "rkeysecu"=hex:f7,d5,cc,a4,90,64,55,a9,e3,85,e4,65,b6,34,96,4f . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_12_0_0_70_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="FlashBroker" "LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe,-101" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation] "Enabled"=dword:00000001 . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_12_0_0_70_ActiveX.exe" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Shockwave Flash Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus] @="0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID] @="ShockwaveFlash.ShockwaveFlash.12" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="ShockwaveFlash.ShockwaveFlash" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}] @Denied: (A 2) (Everyone) @="Macromedia Flash Factory Object" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx" "ThreadingModel"="Apartment" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID] @="FlashFactory.FlashFactory.1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32] @="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_12_0_0_70.ocx, 1" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib] @="{D27CDB6B-AE6D-11cf-96B8-444553540000}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version] @="1.0" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID] @="FlashFactory.FlashFactory" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}] @Denied: (A 2) (Everyone) @="IFlashBroker5" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32] @="{00020424-0000-0000-C000-000000000046}" . [HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib] @="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}" "Version"="1.0" . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings] @Denied: (A) (Users) @Denied: (A) (Everyone) @Allowed: (B 1 2 3 4 5) (S-1-5-20) "BlindDial"=dword:00000000 . [HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . ------------------------ Andra processer som körs ------------------------ . c:\program files (x86)\Creative\Shared Files\CTAudSvc.exe c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe c:\program files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe . ************************************************************************** . Sluttid: 2014-03-08 20:40:53 - datorn startades om. ComboFix-quarantined-files.txt 2014-03-08 19:40 . Före genomsökningen: 42 267 295 744 byte ledigt Efter genomsökningen: 52 506 759 168 byte ledigt . - - End Of File - - 74F1AEA0F405A00AC3BD52159148407D B1E2F0BEC4BDB61397F19ADC6ED5E8C0

Och här är den sista anteckningen: RogueKiller V8.8.10 _x64_ [Feb 28 2014] by Adlice Software mail : http://www.adlice.com/contact/ Feedback : http://forum.adlice.com Website : http://www.adlice.com/softwares/roguekiller/ Blog : http://www.adlice.com Operating System : Windows 7 (6.1.7601 Service Pack 1) 64 bits version Started in : Normal mode User : Robin&Erica [Admin rights] Mode : Scan -- Date : 03/07/2014 08:52:58 | ARK || FAK || MBR | ¤¤¤ Bad processes : 4 ¤¤¤ [sUSP PATH][DLL] explorer.exe -- C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\WinRar\rarext64.dll [x] -> UNLOADED [sUSP PATH] FreeAgentService.exe -- C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe [7] -> KILLED [TermProc] [sUSP PATH] DTLite.exe -- C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Deamon Tools\DAEMON Tools Lite\DTLite.exe [7] -> KILLED [TermProc] [sUSP PATH] stxmenumgr.exe -- C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\FreeAgent Status\stxmenumgr.exe [7] -> KILLED [TermProc] ¤¤¤ Registry Entries : 13 ¤¤¤ [RUN][sUSP PATH] HKCU\[...]\Run : DAEMON Tools Lite ("C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Deamon Tools\DAEMON Tools Lite\DTLite.exe" -autorun [7]) -> FOUND [RUN][sUSP PATH] HKUS\S-1-5-21-2160987881-4071915104-1257501379-1000\[...]\Run : DAEMON Tools Lite ("C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Deamon Tools\DAEMON Tools Lite\DTLite.exe" -autorun [7]) -> FOUND [RUN][sUSP PATH] HKLM\[...]\Wow6432Node\[...]\Run : MaxMenuMgr ("C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\FreeAgent Status\StxMenuMgr.exe" [7]) -> FOUND [HJ POL][PUM] HKCU\[...]\System : DisableTaskMgr (0) -> FOUND [HJ POL][PUM] HKLM\[...]\System : EnableLUA (0) -> FOUND [HJ POL][PUM] HKLM\[...]\Wow6432Node\[...]\System : EnableLUA (0) -> FOUND [HJ SECU][PUM] HKLM\[...]\Security Center : AntiVirusDisableNotify (1) -> FOUND [HJ SECU][PUM] HKLM\[...]\Security Center : FirewallDisableNotify (1) -> FOUND [HJ SECU][PUM] HKLM\[...]\Security Center : UpdatesDisableNotify (1) -> FOUND [HJ SMENU][PUM] HKCU\[...]\Advanced : Start_TrackProgs (0) -> FOUND [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {59031a47-3f72-44a7-89c5-5595fe6b30ee} (1) -> FOUND [HJ DESK][PUM] HKLM\[...]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND [HJ INPROC][ZeroAccess] HKCR\[...]\InprocServer32 : (C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\n. [x]) -> FOUND ¤¤¤ Scheduled tasks : 1 ¤¤¤ [V2][ROGUE ST] 4772 : wscript.exe - C:\Users\ROBIN&~1\AppData\Local\Temp\launchie.vbs //B -> FOUND ¤¤¤ Startup Entries : 0 ¤¤¤ ¤¤¤ Web browsers : 0 ¤¤¤ ¤¤¤ Browser Addons : 0 ¤¤¤ ¤¤¤ Particular Files / Folders: ¤¤¤ [ZeroAccess][File] @ : C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\@ [-] --> FOUND [ZeroAccess][File] @ : C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\@ [-] --> FOUND [ZeroAccess][Folder] U : C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\U [-] --> FOUND [ZeroAccess][Folder] U : C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\U [-] --> FOUND [ZeroAccess][Folder] L : C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\L [-] --> FOUND [ZeroAccess][Folder] L : C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\L [-] --> FOUND [ZeroAccess][File] Desktop.ini : C:\Windows\assembly\GAC_32\Desktop.ini [-] --> FOUND [ZeroAccess][File] Desktop.ini : C:\Windows\assembly\GAC_64\Desktop.ini [-] --> FOUND ¤¤¤ Driver : [NOT LOADED 0x0] ¤¤¤ ¤¤¤ External Hives: ¤¤¤ ¤¤¤ Infection : ZeroAccess ¤¤¤ ¤¤¤ HOSTS File: ¤¤¤ --> %SystemRoot%\System32\drivers\etc\hosts 127.0.0.1 static3.cdn.ubi.com 127.0.0.1 ubisoft-orbit.s3.amazonaws.com 127.0.0.1 onlineconfigservice.ubi.com 127.0.0.1 orbitservice.ubi.com 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com ¤¤¤ MBR Check: ¤¤¤ +++++ PhysicalDrive0: (\\.\PHYSICALDRIVE0 @ IDE) ST3500418AS ATA Device +++++ --- User --- [MBR] d7f611973bbc724fab30f76591c1eb98 [bSP] f14f1a5d9d731d6b26dde4437c5977d6 : Windows Vista/7/8 MBR Code Partition table: 0 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 2048 | Size: 100 Mo 1 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 206848 | Size: 463578 Mo 2 - [XXXXXX] NTFS (0x07) [VISIBLE] Offset (sectors): 949614592 | Size: 13260 Mo User = LL1 ... OK! User = LL2 ... OK! Finished : << RKreport[0]_S_03072014_085258.txt >>

Andra svaret: Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-03-2014 Ran by Robin&Erica (administrator) on STATIONÄRA on 07-03-2014 08:42:28 Running from C:\Users\Robin&Erica\Desktop Windows 7 Home Premium Service Pack 1 (X64) OS Language: Swedish Internet Explorer Version 8 Boot Mode: Normal The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Processes (Whitelisted) ================= (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgchsva.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe (Creative Technology Ltd) C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe (Copyright 2012 SAMSUNG) C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe (Copyright 2012 SAMSUNG) C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe (Enigma Software Group USA, LLC.) C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe (AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40STB.EXE (SEIKO EPSON CORPORATION) C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (Microsoft Corporation) C:\Windows\SysWOW64\svchost.exe (Seagate Technology LLC) C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe (Hewlett-Packard Company) c:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Microsoft Corporation) c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe (Malwarebytes Corporation) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Microsoft Corporation) c:\Program Files (x86)\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe (Intel Corporation) C:\Windows\System32\hkcmd.exe (Intel Corporation) C:\Windows\System32\igfxpers.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe (Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe (DT Soft Ltd) C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Deamon Tools\DAEMON Tools Lite\DTLite.exe (Spotify Ltd) C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyWebHelper.exe (Spotify Ltd) C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\spotify.exe (Microsoft Corporation) C:\Windows\System32\StikyNot.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe (Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe (Seagate LLC) C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\FreeAgent Status\stxmenumgr.exe (Technology Nexus AB) C:\Program Files (x86)\Personal\bin\Personal.exe (Hewlett-Packard) C:\Program Files (x86)\hp\HP Software Update\hpwuschd2.exe (Microsoft Corporation) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe (Dropbox, Inc.) C:\Users\Robin&Erica\AppData\Roaming\Dropbox\bin\Dropbox.exe (Creative Technology Ltd) C:\Windows\SysWOW64\CtHelper.exe (Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe (Hewlett-Packard Company) C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe (Nero AG) C:\Program Files (x86)\Nero\Update\NASvc.exe () C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyHelper.exe ==================== Registry (Whitelisted) ================== HKLM\...\Run: [PC-Doctor for Windows localizer] - C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-17] (PC-Doctor, Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-06] (Adobe Systems Incorporated) HKLM-x32\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM-x32\...\Run: [HP Remote Solution] - C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-25] (Hewlett-Packard) HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS) HKLM-x32\...\Run: [CarboniteSetupLite] - C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe [318096 2009-08-04] (Carbonite, Inc.) HKLM-x32\...\Run: [MaxMenuMgr] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\FreeAgent Status\StxMenuMgr.exe [185640 2009-09-25] (Seagate LLC) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [413696 2009-05-26] (Apple Inc.) HKLM-x32\...\Run: [HF_G_Jul] - "C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe" /DoAction HKLM-x32\...\Run: [AsioThk32Reg] - REGSVR32.EXE /S CTASIO.DLL HKLM-x32\...\Run: [CTHelper] - CTHELPER.EXE HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-02-25] (Hewlett-Packard) Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [DAEMON Tools Lite] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Deamon Tools\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [AdobeBridge] - [X] HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [spotify Web Helper] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-16] (Spotify Ltd) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [EA Core] - "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [spotify] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Spotify.exe [6118400 2014-01-16] (Spotify Ltd) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-14] (Microsoft Corporation) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Run: [Google Update] - C:\Users\Robin&Erica\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-10-11] (Google Inc.) HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Policies\system: [DisableLockWorkstation] 0 HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\Policies\system: [DisableChangePassword] 0 HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\MountPoints2: {0504e2a1-ad4b-11e1-a779-e0cb4e403094} - M:\LaunchU3.exe -a HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\MountPoints2: {319d03cb-6d79-11df-80dd-e0cb4e403094} - K:\RunGame.exe HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\MountPoints2: {3665ef6b-6fe5-11df-80c5-e0cb4e403094} - F:\Startme.exe HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\MountPoints2: {97019181-1685-11df-a40b-806e6f6e6963} - E:\autorun.exe HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\MountPoints2: {b37ef913-6af9-11df-80ed-e0cb4e403094} - J:\Autorun.exe HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\MountPoints2: {cbd306f0-69c3-11df-b735-e0cb4e403094} - J:\AutoRun.exe HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...\MountPoints2: {cbd306f6-69c3-11df-b735-e0cb4e403094} - L:\AutoRun.exe HKU\S-1-5-21-2160987881-4071915104-1257501379-1000\...0c966feabec1\InprocServer32: [Default-shell32] C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\n. ATTENTION! ====> ZeroAccess/Alureon? AppInit_DLLs: avgrssta.dll => C:\Windows\system32\avgrssta.dll [13048 2012-07-31] (AVG Technologies CZ, s.r.o.) Startup: C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> C:\Users\Robin&Erica\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) ==================== Internet (Whitelisted) ==================== HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www8.idrottonline.se/default.aspx?id=16523 HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCON/11 HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCON/11 HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.uk.msn.com/HPCON/11 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.uk.msn.com/HPCON/11 HKLM\Software\Wow6432Node\Microsoft\Internet Explorer\Main,Start Page = http://g.uk.msn.com/HPCON/11 URLSearchHook: HKLM-x32 - uTorrentControl2 Toolbar - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.) URLSearchHook: HKCU - uTorrentControl2 Toolbar - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.) StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = SearchScopes: HKLM-x32 - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 SearchScopes: HKCU - DefaultScope {AFDBDDAA-5D3F-42EE-B79C-185A7020515B} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 SearchScopes: HKCU - {95B7759C-8C7F-4BF1-B163-73684A933233} URL = http://isearch.avg.com/search?cid={BB8464B5-8339-4792-A5E8-59A880F1D2BC}&mid=9e0355bb9c9747d08498318208a4d967-16f83961b8d290676fe3e9c36fa5e82d2174a897〈=en&ds=AVG&pr=pr&d=2012-06-26 11:28:01&v=11.1.0.7&sap=dsp&q={searchTerms} SearchScopes: HKCU - {afdbddaa-5d3f-42ee-b79c-185a7020515b} URL = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3072253 BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssiea.dll (AVG Technologies CZ, s.r.o.) BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPluginx64.dll (Hewlett-Packard) BHO-x32: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) BHO-x32: uTorrentControl2 Toolbar - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.) BHO-x32: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) BHO-x32: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) BHO-x32: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) BHO-x32: HP Network Check Helper - {E76FD755-C1BA-4DCB-9F13-99BD91223ADE} - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPNetworkCheck\HPNetworkCheckPlugin.dll (Hewlett-Packard) Toolbar: HKLM-x32 - @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\Users\Robin&Erica\Documents\FMV6\msdxm.ocx (Microsoft Corporation) Toolbar: HKLM-x32 - uTorrentControl2 Toolbar - {687578b9-7132-4a7a-80e4-30ee31099e03} - C:\Program Files (x86)\uTorrentControl2\prxtbuTor.dll (Conduit Ltd.) Toolbar: HKCU - No Name - {D4027C7F-154A-4066-A1AD-4243D8127440} - No File Toolbar: HKCU - No Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File Toolbar: HKCU - No Name - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No File Toolbar: HKCU - No Name - {687578B9-7132-4A7A-80E4-30EE31099E03} - No File DPF: HKLM-x32 {0F2AAAE3-7E9E-4B64-AB5D-1CA24C6ACB9C} https://webmail.soderhamn.se/dwa85W.cab DPF: HKLM-x32 {5220B524-B61D-4980-862F-72E1A843B9FA} https://webmail.soderhamn.se/dwa85W.cab DPF: HKLM-x32 {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} http://www.fujidirekt.se/aurigma/ImageUploader5.cab DPF: HKLM-x32 {B1953AD6-C50E-11D3-B020-00A0C9251384} http://www.o2c.de/download/o2cplayer.cab DPF: HKLM-x32 {CEF002D2-5A9F-4656-AA41-85DA2534ACBD} https://webmail.soderhamn.se/dwa85W.cab DPF: HKLM-x32 {CF84DAC5-A4F5-419E-A0BA-C01FFD71112F} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_intel_4.5.13.0.cab DPF: HKLM-x32 {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgppa.dll (AVG Technologies CZ, s.r.o.) Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - No File Handler-x32: http\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: http\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: https\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) Handler-x32: msdaipp\0x00000001 - {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: msdaipp\oledb - {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) Handler-x32: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\Users\Robin&Erica\Documents\FMV6\msdxm.ocx (Microsoft Corporation) Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - No File ShellExecuteHooks-x32: EasyBits ShellExecute Hook - {E54729E8-BB3D-4270-9D49-7389EA579090} - C:\Windows\SysWOW64\ezUPBHook.dll [52272 2010-01-11] (EasyBits Software Corp.) Winsock: Catalog5 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Winsock: Catalog5 07 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll" Winsock: Catalog5-x64 01 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\system32\NLAapi.dll" Winsock: Catalog5-x64 07 mswsock.dll File Not found () ATTENTION: The LibraryPath should be "%SystemRoot%\System32\mswsock.dll" Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt Tcpip\Parameters: [DhcpNameServer] 192.168.1.1 FireFox: ======== FF Plugin: @microsoft.com/GENUINE - disabled No File FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @canon.com/MycameraPlugin - C:\Program Files (x86)\Canon\ZoomBrowser EX\Program\NPCIG.dll (CANON INC.) FF Plugin-x32: @Google.com/GoogleEarthPlugin - C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF Plugin-x32: @java.com/DTPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF Plugin-x32: @java.com/JavaPlugin,version=10.51.2 - C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF Plugin-x32: @microsoft.com/GENUINE - disabled No File FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF Plugin-x32: @se.nexus/Personal - C:\Program Files (x86)\Personal\bin\np_prsnl.dll (Technology Nexus AB) FF Plugin-x32: @tools.google.com/Google Update;version=3 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: @tools.google.com/Google Update;version=9 - C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=3 - C:\Users\Robin&Erica\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: @tools.google.com/Google Update;version=9 - C:\Users\Robin&Erica\AppData\Local\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF Plugin HKCU: ubisoft.com/uplaypc - C:\Program Files (x86)\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft) Chrome: ======= CHR HomePage: hxxp://www.google.com/ CHR Extension: (Google Wallet) - C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-01] CHR Extension: (uTorrentControl2) - C:\Users\Robin&Erica\AppData\Local\Google\Chrome\User Data\Default\Extensions\pacgpkgadgmibnhpdidcnfafllnmeomc [2012-09-20] CHR HKCU\...\Chrome\Extension: [pacgpkgadgmibnhpdidcnfafllnmeomc] - C:\Users\Robin&Erica\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx [2012-07-15] CHR HKLM-x32\...\Chrome\Extension: [jbpkiefagocgkmemidfngdkamloieekf] - C:\Program Files (x86)\TornTV.com\torn11.crx [2012-07-15] CHR HKLM-x32\...\Chrome\Extension: [pacgpkgadgmibnhpdidcnfafllnmeomc] - C:\Users\Robin&Erica\AppData\Local\CRE\pacgpkgadgmibnhpdidcnfafllnmeomc.crx [2012-07-15] ==================== Services (Whitelisted) ================= R2 AllShare Play Service; C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe [662752 2012-12-20] (Copyright 2012 SAMSUNG) R2 avg9wd; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [308136 2012-08-01] (AVG Technologies CZ, s.r.o.) R2 FreeAgentGoNext Service; C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe [189736 2009-09-25] (Seagate Technology LLC) R2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) R2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) R2 MSSQL$MAMUT; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation) R2 SpyHunter 4 Service; C:\Program Files\Enigma Software Group\SpyHunter\SH4Service.exe [1025408 2014-01-09] (Enigma Software Group USA, LLC.) R2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X] ==================== Drivers (Whitelisted) ==================== R0 Achernar; C:\Windows\System32\Drivers\Achernar.sys [34104 2011-10-01] (NewSoft Technology Corporation) S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2012-07-10] () R1 AvgLdx64; C:\Windows\System32\Drivers\avgldx64.sys [282976 2013-01-15] (AVG Technologies CZ, s.r.o.) R1 AvgMfx64; C:\Windows\System32\Drivers\avgmfx64.sys [35664 2012-07-31] (AVG Technologies CZ, s.r.o.) R0 AvgRkx64; C:\Windows\System32\Drivers\avgrkx64.sys [56008 2012-07-31] (AVG Technologies CZ, s.r.o.) R1 AvgTdiA; C:\Windows\System32\Drivers\avgtdia.sys [317520 2012-07-31] (AVG Technologies CZ, s.r.o.) R3 esgiguard; C:\Program Files\Enigma Software Group\SpyHunter\esgiguard.sys [14872 2014-01-07] () S3 EsgScanner; C:\Windows\System32\DRIVERS\EsgScanner.sys [22704 2012-06-22] () R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2010-06-03] () R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) R0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-05-29] () S3 SynasUSB; C:\Windows\SysWow64\drivers\SynUSB64.sys [21888 2004-08-31] (Syncrosoft GmbH) S3 synusb64; C:\Windows\System32\DRIVERS\synusb64.sys [30352 2011-12-14] (Steinberg Media Technologies GmbH) S3 synusb64; C:\Windows\SysWOW64\DRIVERS\synusb64.sys [21888 2004-08-31] (Syncrosoft GmbH) S3 Tdsshbecr; C:\Windows\System32\DRIVERS\shbecr.sys [50176 2008-09-22] (Todos Data System AB) U3 artnwxa5; C:\Windows\System32\Drivers\artnwxa5.sys [0 ] (Microsoft Corporation) U5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-14] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-07 08:48 - 2014-03-07 08:42 - 00000000 ____D () C:\FRST 2014-03-07 08:42 - 2014-03-07 08:42 - 00023133 _____ () C:\Users\Robin&Erica\Desktop\FRST.txt 2014-03-07 08:41 - 2014-03-06 23:28 - 02156544 _____ (Farbar) C:\Users\Robin&Erica\Desktop\FRST64.exe 2014-03-07 00:41 - 2014-03-07 08:38 - 00000356 _____ () C:\Windows\Tasks\HPCeeScheduleForRobin&Erica.job 2014-03-07 00:41 - 2014-03-07 00:41 - 00003246 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForRobin&Erica 2014-03-07 00:19 - 2014-03-07 00:19 - 00000000 _____ () C:\autoexec.bat 2014-03-07 00:18 - 2014-03-07 00:18 - 00003370 _____ () C:\Windows\System32\Tasks\SpyHunter4Startup 2014-03-07 00:18 - 2014-03-07 00:18 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter 2014-03-07 00:18 - 2014-03-07 00:18 - 00000000 ____D () C:\sh4ldr 2014-03-07 00:18 - 2014-03-07 00:18 - 00000000 ____D () C:\Program Files\Enigma Software Group 2014-03-07 00:18 - 2012-06-22 11:01 - 00022704 _____ () C:\Windows\system32\Drivers\EsgScanner.sys 2014-03-07 00:17 - 2014-03-07 00:18 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP 2014-03-06 21:04 - 2014-03-06 22:04 - 00000000 ____D () C:\Users\Robin&Erica\Desktop\Huset bilder 2014-02-21 16:05 - 2014-02-21 16:05 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\{D4025C2E-5316-47A3-916A-5A731C550710} 2014-02-08 18:54 - 2014-02-08 18:54 - 09237763 _____ () C:\Users\Robin&Erica\Downloads\Pics_copy.apk 2014-02-08 17:50 - 2014-02-08 17:50 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (2).jnlp 2014-02-08 17:38 - 2014-02-08 17:38 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (1).jnlp 2014-02-08 17:30 - 2014-02-08 17:30 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks.jnlp 2014-02-08 17:08 - 2014-03-07 08:42 - 00000000 ____D () C:\Users\Robin&Erica\Downloads\Gammalt 2014-02-08 16:07 - 2014-02-08 16:49 - 00000000 ____D () C:\Users\Robin&Erica\.appinventor ==================== One Month Modified Files and Folders ======= 2014-03-07 08:42 - 2014-03-07 08:48 - 00000000 ____D () C:\FRST 2014-03-07 08:42 - 2014-03-07 08:42 - 00023133 _____ () C:\Users\Robin&Erica\Desktop\FRST.txt 2014-03-07 08:42 - 2014-02-08 17:08 - 00000000 ____D () C:\Users\Robin&Erica\Downloads\Gammalt 2014-03-07 08:42 - 2012-01-02 23:02 - 00000000 ____D () C:\Windows\system32\Macromed 2014-03-07 08:42 - 2010-10-15 11:55 - 00000000 ____D () C:\Users\Public\Documents\Pinnacle 2014-03-07 08:42 - 2010-07-28 08:43 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\vlc 2014-03-07 08:42 - 2010-05-28 20:50 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\uTorrent 2014-03-07 08:42 - 2010-05-27 13:53 - 00000000 ___RD () C:\Users\Robin&Erica\Desktop\Robin 2014-03-07 08:42 - 2010-05-27 13:53 - 00000000 ___RD () C:\Users\Robin&Erica\Desktop\Erica j 2014-03-07 08:42 - 2010-05-27 13:53 - 00000000 ___RD () C:\Users\Robin&Erica\Desktop\Erica 2014-03-07 08:42 - 2010-01-11 11:38 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2014-03-07 08:42 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration 2014-03-07 08:41 - 2012-07-09 17:23 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\Dropbox 2014-03-07 08:41 - 2010-05-28 18:31 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\Spotify 2014-03-07 08:38 - 2014-03-07 00:41 - 00000356 _____ () C:\Windows\Tasks\HPCeeScheduleForRobin&Erica.job 2014-03-07 08:38 - 2012-07-09 10:45 - 00001000 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job 2014-03-07 08:38 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT 2014-03-07 08:38 - 2009-07-14 05:51 - 00042529 _____ () C:\Windows\setupact.log 2014-03-07 08:28 - 2012-08-09 09:14 - 04931577 _____ () C:\Windows\{00000001-00000000-00000000-00001102-00000004-20051102}.BAK 2014-03-07 08:28 - 2012-08-02 13:58 - 04931577 _____ () C:\Windows\{00000001-00000000-00000000-00001102-00000004-20051102}.CDF 2014-03-07 08:18 - 2014-01-28 06:10 - 00000000 ____D () C:\ProgramData\Recovery 2014-03-07 08:18 - 2013-11-08 12:31 - 00001028 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000UA.job 2014-03-07 08:18 - 2012-07-09 10:45 - 00001004 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job 2014-03-07 07:46 - 2012-08-16 05:58 - 00000868 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job 2014-03-07 00:47 - 2012-08-16 05:58 - 00003806 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater 2014-03-07 00:46 - 2012-05-18 07:03 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe 2014-03-07 00:46 - 2012-01-02 23:02 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl 2014-03-07 00:41 - 2014-03-07 00:41 - 00003246 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForRobin&Erica 2014-03-07 00:37 - 2010-05-28 09:02 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log 2014-03-07 00:36 - 2011-11-10 11:24 - 00000000 _____ () C:\Windows\system32\HP_ActiveX_Patch_NOT_DETECTED.txt 2014-03-07 00:19 - 2014-03-07 00:19 - 00000000 _____ () C:\autoexec.bat 2014-03-07 00:18 - 2014-03-07 00:18 - 00003370 _____ () C:\Windows\System32\Tasks\SpyHunter4Startup 2014-03-07 00:18 - 2014-03-07 00:18 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter 2014-03-07 00:18 - 2014-03-07 00:18 - 00000000 ____D () C:\sh4ldr 2014-03-07 00:18 - 2014-03-07 00:18 - 00000000 ____D () C:\Program Files\Enigma Software Group 2014-03-07 00:18 - 2014-03-07 00:17 - 00000000 ____D () C:\Windows\ACF5FE1B377240688B872D2A6EFD0A05.TMP 2014-03-07 00:18 - 2013-11-08 12:31 - 00000976 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000Core.job 2014-03-07 00:18 - 2010-01-11 20:17 - 00709044 _____ () C:\Windows\system32\perfh01D.dat 2014-03-07 00:18 - 2010-01-11 20:17 - 00159480 _____ () C:\Windows\system32\perfc01D.dat 2014-03-07 00:18 - 2009-07-14 06:13 - 01707194 _____ () C:\Windows\system32\PerfStringBackup.INI 2014-03-07 00:18 - 2009-07-14 05:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 2014-03-07 00:18 - 2009-07-14 05:45 - 00015792 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 2014-03-07 00:13 - 2013-11-08 12:31 - 00004038 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000UA 2014-03-07 00:13 - 2013-11-08 12:31 - 00003642 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-2160987881-4071915104-1257501379-1000Core 2014-03-07 00:13 - 2012-07-09 10:45 - 00004008 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA 2014-03-07 00:13 - 2012-07-09 10:45 - 00003756 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore 2014-03-07 00:10 - 2010-05-27 13:43 - 00000000 ____D () C:\Users\Robin&Erica 2014-03-06 23:28 - 2014-03-07 08:41 - 02156544 _____ (Farbar) C:\Users\Robin&Erica\Desktop\FRST64.exe 2014-03-06 22:04 - 2014-03-06 21:04 - 00000000 ____D () C:\Users\Robin&Erica\Desktop\Huset bilder 2014-03-03 19:22 - 2010-05-28 18:31 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\Spotify 2014-02-23 23:16 - 2010-06-30 16:47 - 08501248 ___SH () C:\Users\Robin&Erica\Desktop\Thumbs.db 2014-02-21 17:43 - 2010-05-28 10:09 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\CrashDumps 2014-02-21 17:27 - 2011-03-31 16:13 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\Pinnacle 2014-02-21 16:05 - 2014-02-21 16:05 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\{D4025C2E-5316-47A3-916A-5A731C550710} 2014-02-13 17:53 - 2012-11-22 17:24 - 00000000 ____D () C:\ProgramData\boost_interprocess 2014-02-08 18:54 - 2014-02-08 18:54 - 09237763 _____ () C:\Users\Robin&Erica\Downloads\Pics_copy.apk 2014-02-08 17:50 - 2014-02-08 17:50 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (2).jnlp 2014-02-08 17:38 - 2014-02-08 17:38 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (1).jnlp 2014-02-08 17:30 - 2014-02-08 17:30 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks.jnlp 2014-02-08 16:49 - 2014-02-08 16:07 - 00000000 ____D () C:\Users\Robin&Erica\.appinventor ZeroAccess: C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f} C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\@ C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\U\00000004.@ C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\L\00000004.@ ZeroAccess: C:\Windows\assembly\GAC_32\Desktop.ini ZeroAccess: C:\Windows\assembly\GAC_64\Desktop.ini ZeroAccess: C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f} C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\@ Files to move or delete: ==================== C:\Users\Robin&Erica\jagex_cl_runescape_LIVE.dat C:\Users\Robin&Erica\jagex_runescape_preferences.dat C:\Users\Robin&Erica\jagex_runescape_preferences2.dat C:\Users\Robin&Erica\jagex__preferences3.dat Some content of TEMP: ==================== C:\Users\Robin&Erica\AppData\Local\Temp\aoe3-112-english.exe C:\Users\Robin&Erica\AppData\Local\Temp\aoe3x-104-english.exe C:\Users\Robin&Erica\AppData\Local\Temp\AutoRun.exe C:\Users\Robin&Erica\AppData\Local\Temp\AutoRunGUI.dll C:\Users\Robin&Erica\AppData\Local\Temp\avguidx.dll C:\Users\Robin&Erica\AppData\Local\Temp\BackupSetup.exe C:\Users\Robin&Erica\AppData\Local\Temp\CmdLineExt.dll C:\Users\Robin&Erica\AppData\Local\Temp\CmdLineExt02.dll C:\Users\Robin&Erica\AppData\Local\Temp\CommonInstaller.exe C:\Users\Robin&Erica\AppData\Local\Temp\DataCard_Setup64.exe C:\Users\Robin&Erica\AppData\Local\Temp\dwa85res_sv.dll C:\Users\Robin&Erica\AppData\Local\Temp\EAD228D.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD2BB1.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD2BB2.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD387D.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD39F3.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD57C.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD5DC8.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD6F74.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD70CB.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD7609.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD8111.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD8B9B.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADA69A.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADAF8F.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADB3E3.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADB3E4.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADBA97.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADC1C8.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADC35D.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADC570.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADC705.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADCB97.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADFB20.exe C:\Users\Robin&Erica\AppData\Local\Temp\eauninstall.exe C:\Users\Robin&Erica\AppData\Local\Temp\EBU893D.exe C:\Users\Robin&Erica\AppData\Local\Temp\EBU8A46.DLL C:\Users\Robin&Erica\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE C:\Users\Robin&Erica\AppData\Local\Temp\fileutil.dll C:\Users\Robin&Erica\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe C:\Users\Robin&Erica\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Robin&Erica\AppData\Local\Temp\i4jdel0.exe C:\Users\Robin&Erica\AppData\Local\Temp\iGearedHelper.dll C:\Users\Robin&Erica\AppData\Local\Temp\InstallFlashPlayer.exe C:\Users\Robin&Erica\AppData\Local\Temp\InstMsiA.exe C:\Users\Robin&Erica\AppData\Local\Temp\InstMsiW.exe C:\Users\Robin&Erica\AppData\Local\Temp\jfxmotjc.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\Robin&Erica\AppData\Local\Temp\K-Lite_Codec_Pack_Basic.exe C:\Users\Robin&Erica\AppData\Local\Temp\MachineIdCreator.exe C:\Users\Robin&Erica\AppData\Local\Temp\mamut business software.exe C:\Users\Robin&Erica\AppData\Local\Temp\oi_{4D30FCBB-BB27-43A8-8464-75AACB54269F}.exe C:\Users\Robin&Erica\AppData\Local\Temp\pcsetup_si.exe C:\Users\Robin&Erica\AppData\Local\Temp\pPokerSetup.exe C:\Users\Robin&Erica\AppData\Local\Temp\ptuC4A_tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\ResetDevice.exe C:\Users\Robin&Erica\AppData\Local\Temp\Resource.exe C:\Users\Robin&Erica\AppData\Local\Temp\setup.exe C:\Users\Robin&Erica\AppData\Local\Temp\SHSetup.exe C:\Users\Robin&Erica\AppData\Local\Temp\SimCity 4 Deluxe_uninst.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp46257.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp49905.exe.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp53904.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp54931.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp58915.exe C:\Users\Robin&Erica\AppData\Local\Temp\SpotifyUpgrader.exe C:\Users\Robin&Erica\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll C:\Users\Robin&Erica\AppData\Local\Temp\SRLDetectionLibrary4768899139401856696.dll C:\Users\Robin&Erica\AppData\Local\Temp\standalonepatcher.exe C:\Users\Robin&Erica\AppData\Local\Temp\standalonepatcherX.exe C:\Users\Robin&Erica\AppData\Local\Temp\TB_8FA1.exe C:\Users\Robin&Erica\AppData\Local\Temp\ToolbarInstaller.exe C:\Users\Robin&Erica\AppData\Local\Temp\ubi379E.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\ubi903F.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\UNINSTALL.EXE C:\Users\Robin&Erica\AppData\Local\Temp\UninstallEADM.dll C:\Users\Robin&Erica\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Robin&Erica\AppData\Local\Temp\UninstallHPTCA.exe C:\Users\Robin&Erica\AppData\Local\Temp\utt4074.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\uttB8CF.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\uttEAF3.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\vnu4DB3.tmp.EXE C:\Users\Robin&Erica\AppData\Local\Temp\vnuB461.tmp.EXE C:\Users\Robin&Erica\AppData\Local\Temp\YontooSetup-Silent.exe C:\Users\Robin&Erica\AppData\Local\Temp\_is60C0.exe C:\Users\Robin&Erica\AppData\Local\Temp\_isC246.exe C:\Users\Robin&Erica\AppData\Local\Temp\_unps.exe ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit LastRegBack: 2014-01-28 00:33 ==================== End Of Log ============================ Addition.txt

Otroligt bra service här måste jag säga! Här kommer mina anteckningar: Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 06-03-2014 Ran by SYSTEM at 2014-03-07 08:34:52 Run:1 Running from G:\ Boot Mode: Recovery ============================================== Content of fixlist: ***************** HKLM\...\Run: [AS2014] - C:\ProgramData\ngXgVarl\ngXgVarl.exe HKLM\...\Winlogon: [userinit] userinit.exe,C:\ProgramData\ngXgVarl\ngXgVarl.exe -sm, HKU\Robin&Erica\...\Run: [Vitoiw] - C:\Users\Robin&Erica\AppData\Roaming\Giyl\udyv.exe S2 Update lookinglink; "C:\Program Files (x86)\lookinglink\updatelookinglink.exe" [X] 2014-03-06 14:02 - 2014-03-06 14:33 - 95027928 ____T () C:\ProgramData\o03e7tf.fee 2014-03-06 14:02 - 2014-03-06 14:02 - 00333040 ____T (Microsoft Corporation) C:\ProgramData\o03e7tf.zvv 2014-03-06 14:02 - 2014-03-06 14:02 - 00142377 _____ (Microsoft Corporation) C:\ProgramData\ft7e30o.cpp ***************** HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\AS2014 => Value deleted successfully. HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => Value was restored successfully. HKU\Robin&Erica\Software\Microsoft\Windows\CurrentVersion\Run\\Vitoiw => Value deleted successfully. Update lookinglink => Service deleted successfully. C:\ProgramData\o03e7tf.fee => Moved successfully. C:\ProgramData\o03e7tf.zvv => Moved successfully. C:\ProgramData\ft7e30o.cpp => Moved successfully. ==== End of Fixlog ====

Hej! Jag har läst om detta och gjort som ni sagt till många andra. Jag har sparat denna textfil efter min scanning: Sjukt tacksam för hjälp!! Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 06-03-2014 Ran by SYSTEM on MININT-8ALJC2S on 06-03-2014 23:48:25 Running from K:\ Windows 7 Home Premium (X64) OS Language: Danish Internet Explorer Version 8 Boot Mode: Recovery The current controlset is ControlSet001 ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log. The only official download link for FRST: Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ Download link from any site other than Bleeping Computer is unpermitted or outdated. See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/ ==================== Registry (Whitelisted) ================== HKLM\...\Run: [PC-Doctor for Windows localizer] - C:\Program Files\PC-Doctor for Windows\localizer.exe [95728 2009-09-16] (PC-Doctor, Inc.) HKLM\...\Run: [AdobeAAMUpdater-1.0] - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe [500208 2010-03-05] (Adobe Systems Incorporated) HKLM\...\Run: [AS2014] - C:\ProgramData\ngXgVarl\ngXgVarl.exe HKLM-x32\...\Run: [hpsysdrv] - c:\program files (x86)\hewlett-packard\HP odometer\hpsysdrv.exe [62768 2008-11-20] (Hewlett-Packard) HKLM-x32\...\Run: [HP Remote Solution] - C:\Program Files (x86)\Hewlett-Packard\HP Remote Solution\HP_Remote_Solution.exe [656896 2009-08-24] (Hewlett-Packard) HKLM-x32\...\Run: [Easybits Recovery] - C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe [60464 2009-09-02] (EasyBits Software AS) HKLM-x32\...\Run: [CarboniteSetupLite] - C:\Program Files (x86)\Carbonite\CarbonitePreinstaller.exe [318096 2009-08-04] (Carbonite, Inc.) HKLM-x32\...\Run: [MaxMenuMgr] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\FreeAgent Status\StxMenuMgr.exe [185640 2009-09-25] (Seagate LLC) HKLM-x32\...\Run: [HP Software Update] - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe [49208 2010-03-12] (Hewlett-Packard) HKLM-x32\...\Run: [] - [X] HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [413696 2009-05-26] (Apple Inc.) HKLM-x32\...\Run: [HF_G_Jul] - "C:\Program Files (x86)\AVG Secure Search\HF_G_Jul.exe" /DoAction HKLM-x32\...\Run: [AsioThk32Reg] - REGSVR32.EXE /S CTASIO.DLL HKLM-x32\...\Run: [CTHelper] - CTHELPER.EXE HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated) HKLM-x32\...\Run: [sunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation) HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-01-28] (Hewlett-Packard) HKLM\...\RunOnce: [*Restore] - C:\Windows\system32\rstrui.exe /RUNONCE [296960 2010-11-20] (Microsoft Corporation) HKLM\...\Winlogon: [userinit] userinit.exe,C:\ProgramData\ngXgVarl\ngXgVarl.exe -sm, Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation) HKU\Default\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard) HKU\Default User\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard) HKU\Robin&Erica\...\Run: [HPADVISOR] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\HPAdvisor.exe [1685048 2009-09-29] (Hewlett-Packard) HKU\Robin&Erica\...\Run: [DAEMON Tools Lite] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Deamon Tools\DAEMON Tools Lite\DTLite.exe [357696 2010-04-01] (DT Soft Ltd) HKU\Robin&Erica\...\Run: [AdobeBridge] - [X] HKU\Robin&Erica\...\Run: [spotify Web Helper] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Data\SpotifyWebHelper.exe [1171968 2014-01-15] (Spotify Ltd) HKU\Robin&Erica\...\Run: [EA Core] - "C:\Program Files (x86)\Electronic Arts\EADM\Core.exe" -silent HKU\Robin&Erica\...\Run: [Vitoiw] - C:\Users\Robin&Erica\AppData\Roaming\Giyl\udyv.exe HKU\Robin&Erica\...\Run: [spotify] - C:\Users\Robin&Erica\Desktop\Blandat\Program\Nedladdade program\Installationsfiler\Spotify\Spotify.exe [6118400 2014-01-15] (Spotify Ltd) HKU\Robin&Erica\...\Run: [RESTART_STICKY_NOTES] - C:\Windows\System32\StikyNot.exe [427520 2009-07-13] (Microsoft Corporation) HKU\Robin&Erica\...\Run: [Google Update] - C:\Users\Robin&Erica\AppData\Local\Google\Update\GoogleUpdate.exe [116648 2013-10-11] (Google Inc.) HKU\Robin&Erica\...\Policies\system: [DisableLockWorkstation] 0 HKU\Robin&Erica\...\Policies\system: [DisableChangePassword] 0 AppInit_DLLs: avgrssta.dll => C:\Windows\system32\avgrssta.dll [13048 2012-07-31] (AVG Technologies CZ, s.r.o.) Startup: C:\Users\Robin&Erica\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk ShortcutTarget: Dropbox.lnk -> (No File) ==================== Services (Whitelisted) ================= S2 AllShare Play Service; C:\Program Files\Samsung\AllShare Play\AllShare Play Service.exe [662752 2012-12-20] (Copyright 2012 SAMSUNG) S2 avg9wd; C:\Program Files (x86)\AVG\AVG9\avgwdsvc.exe [308136 2012-07-31] (AVG Technologies CZ, s.r.o.) S2 FreeAgentGoNext Service; C:\Users\Robin&Erica\Desktop\Blandat\Program\Installerade program\Extern hårddisk 880 gb\Seagate manager\Sync\FreeAgentService.exe [189736 2009-09-25] (Seagate Technology LLC) S2 MBAMScheduler; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [418376 2013-04-04] (Malwarebytes Corporation) S2 MBAMService; C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [701512 2013-04-04] (Malwarebytes Corporation) S2 MSSQL$MAMUT; c:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [29293408 2010-12-10] (Microsoft Corporation) S2 ezSharedSvc; C:\Windows\System32\ezsvc7.dll [X] S2 Update lookinglink; "C:\Program Files (x86)\lookinglink\updatelookinglink.exe" [X] ==================== Drivers (Whitelisted) ==================== S0 Achernar; C:\Windows\System32\Drivers\Achernar.sys [34104 2011-10-01] (NewSoft Technology Corporation) S2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [303616 2012-07-10] () S1 AvgLdx64; C:\Windows\System32\Drivers\avgldx64.sys [282976 2013-01-15] (AVG Technologies CZ, s.r.o.) S1 AvgMfx64; C:\Windows\System32\Drivers\avgmfx64.sys [35664 2012-07-31] (AVG Technologies CZ, s.r.o.) S0 AvgRkx64; C:\Windows\System32\Drivers\avgrkx64.sys [56008 2012-07-31] (AVG Technologies CZ, s.r.o.) S1 AvgTdiA; C:\Windows\System32\Drivers\avgtdia.sys [317520 2012-07-31] (AVG Technologies CZ, s.r.o.) S2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [42696 2010-06-03] () S3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25928 2013-04-04] (Malwarebytes Corporation) S0 sptd; C:\Windows\System32\Drivers\sptd.sys [834544 2010-05-29] (Duplex Secure Ltd.) S3 SynasUSB; C:\Windows\SysWow64\drivers\SynUSB64.sys [21888 2004-08-31] (Syncrosoft GmbH) S3 synusb64; C:\Windows\System32\DRIVERS\synusb64.sys [30352 2011-12-14] (Steinberg Media Technologies GmbH) S3 synusb64; C:\Windows\SysWOW64\DRIVERS\synusb64.sys [21888 2004-08-31] (Syncrosoft GmbH) S3 Tdsshbecr; C:\Windows\System32\DRIVERS\shbecr.sys [50176 2008-09-22] (Todos Data System AB) S5 VWiFiFlt; C:\Windows\System32\Drivers\VWiFiFlt.sys [59904 2009-07-13] (Microsoft Corporation) ==================== NetSvcs (Whitelisted) =================== ==================== One Month Created Files and Folders ======== 2014-03-06 23:48 - 2014-03-06 23:48 - 00000000 ____D () C:\FRST 2014-03-06 14:02 - 2014-03-06 14:33 - 95027928 ____T () C:\ProgramData\o03e7tf.fee 2014-03-06 14:02 - 2014-03-06 14:02 - 00333040 ____T (Microsoft Corporation) C:\ProgramData\o03e7tf.zvv 2014-03-06 14:02 - 2014-03-06 14:02 - 00142377 _____ (Microsoft Corporation) C:\ProgramData\ft7e30o.cpp 2014-03-06 12:04 - 2014-03-06 13:04 - 00000000 ____D () C:\Users\Robin&Erica\Desktop\Huset bilder 2014-02-21 07:05 - 2014-02-21 07:05 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\{D4025C2E-5316-47A3-916A-5A731C550710} 2014-02-08 09:54 - 2014-02-08 09:54 - 09237763 _____ () C:\Users\Robin&Erica\Downloads\Pics_copy.apk 2014-02-08 08:50 - 2014-02-08 08:50 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (2).jnlp 2014-02-08 08:38 - 2014-02-08 08:38 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (1).jnlp 2014-02-08 08:30 - 2014-02-08 08:30 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks.jnlp 2014-02-08 08:08 - 2014-03-06 23:42 - 00000000 ____D () C:\Users\Robin&Erica\Downloads\Gammalt 2014-02-08 07:07 - 2014-02-08 07:49 - 00000000 ____D () C:\Users\Robin&Erica\.appinventor ==================== One Month Modified Files and Folders ======= 2014-03-06 23:48 - 2014-03-06 23:48 - 00000000 ____D () C:\FRST 2014-03-06 23:42 - 2014-02-08 08:08 - 00000000 ____D () C:\Users\Robin&Erica\Downloads\Gammalt 2014-03-06 23:42 - 2012-01-02 14:02 - 00000000 ____D () C:\Windows\System32\Macromed 2014-03-06 23:42 - 2010-10-15 02:55 - 00000000 ____D () C:\Users\Public\Documents\Pinnacle 2014-03-06 23:42 - 2010-07-27 23:43 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\vlc 2014-03-06 23:42 - 2010-05-28 11:50 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Roaming\uTorrent 2014-03-06 23:42 - 2010-05-27 04:53 - 00000000 ___RD () C:\Users\Robin&Erica\Desktop\Robin 2014-03-06 23:42 - 2010-05-27 04:53 - 00000000 ___RD () C:\Users\Robin&Erica\Desktop\Erica j 2014-03-06 23:42 - 2010-05-27 04:53 - 00000000 ___RD () C:\Users\Robin&Erica\Desktop\Erica 2014-03-06 23:42 - 2010-05-27 04:43 - 00000000 ____D () C:\users\Robin&Erica 2014-03-06 23:42 - 2010-01-11 02:38 - 00000000 ____D () C:\Windows\SysWOW64\Macromed 2014-03-06 23:42 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\registration 2014-03-06 23:18 - 2014-01-27 21:10 - 00000000 ____D () C:\ProgramData\Recovery 2014-03-06 14:33 - 2014-03-06 14:02 - 95027928 ____T () C:\ProgramData\o03e7tf.fee 2014-03-06 14:02 - 2014-03-06 14:02 - 00333040 ____T (Microsoft Corporation) C:\ProgramData\o03e7tf.zvv 2014-03-06 14:02 - 2014-03-06 14:02 - 00142377 _____ (Microsoft Corporation) C:\ProgramData\ft7e30o.cpp 2014-03-06 13:04 - 2014-03-06 12:04 - 00000000 ____D () C:\Users\Robin&Erica\Desktop\Huset bilder 2014-03-03 10:22 - 2010-05-28 09:31 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\Spotify 2014-02-23 14:16 - 2010-06-30 07:47 - 08501248 ___SH () C:\Users\Robin&Erica\Desktop\Thumbs.db 2014-02-21 08:43 - 2010-05-28 01:09 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\CrashDumps 2014-02-21 08:27 - 2011-03-31 07:13 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\Pinnacle 2014-02-21 07:05 - 2014-02-21 07:05 - 00000000 ____D () C:\Users\Robin&Erica\AppData\Local\{D4025C2E-5316-47A3-916A-5A731C550710} 2014-02-13 08:53 - 2012-11-22 08:24 - 00000000 ____D () C:\ProgramData\boost_interprocess 2014-02-08 09:54 - 2014-02-08 09:54 - 09237763 _____ () C:\Users\Robin&Erica\Downloads\Pics_copy.apk 2014-02-08 08:50 - 2014-02-08 08:50 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (2).jnlp 2014-02-08 08:38 - 2014-02-08 08:38 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks (1).jnlp 2014-02-08 08:30 - 2014-02-08 08:30 - 00001104 _____ () C:\Users\Robin&Erica\Downloads\AppInventorForAndroidCodeblocks.jnlp 2014-02-08 07:49 - 2014-02-08 07:07 - 00000000 ____D () C:\Users\Robin&Erica\.appinventor ZeroAccess: C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f} C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\@ C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\U\00000004.@ C:\Windows\Installer\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\L\00000004.@ ZeroAccess: C:\Windows\assembly\GAC_32\Desktop.ini ZeroAccess: C:\Windows\assembly\GAC_64\Desktop.ini ZeroAccess: C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f} C:\Users\Robin&Erica\AppData\Local\{53d27660-bbfa-46ef-bd75-646a6e3be19f}\@ Files to move or delete: ==================== C:\ProgramData\o03e7tf.fee C:\ProgramData\o03e7tf.zvv C:\Users\Robin&Erica\jagex_cl_runescape_LIVE.dat C:\Users\Robin&Erica\jagex_runescape_preferences.dat C:\Users\Robin&Erica\jagex_runescape_preferences2.dat C:\Users\Robin&Erica\jagex__preferences3.dat Some content of TEMP: ==================== C:\Users\Robin&Erica\AppData\Local\Temp\aoe3-112-english.exe C:\Users\Robin&Erica\AppData\Local\Temp\aoe3x-104-english.exe C:\Users\Robin&Erica\AppData\Local\Temp\AutoRun.exe C:\Users\Robin&Erica\AppData\Local\Temp\AutoRunGUI.dll C:\Users\Robin&Erica\AppData\Local\Temp\avguidx.dll C:\Users\Robin&Erica\AppData\Local\Temp\BackupSetup.exe C:\Users\Robin&Erica\AppData\Local\Temp\CmdLineExt.dll C:\Users\Robin&Erica\AppData\Local\Temp\CmdLineExt02.dll C:\Users\Robin&Erica\AppData\Local\Temp\CommonInstaller.exe C:\Users\Robin&Erica\AppData\Local\Temp\DataCard_Setup64.exe C:\Users\Robin&Erica\AppData\Local\Temp\dwa85res_sv.dll C:\Users\Robin&Erica\AppData\Local\Temp\EAD228D.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD2BB1.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD2BB2.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD387D.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD39F3.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD57C.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD5DC8.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD6F74.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD70CB.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD7609.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD8111.exe C:\Users\Robin&Erica\AppData\Local\Temp\EAD8B9B.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADA69A.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADAF8F.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADB3E3.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADB3E4.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADBA97.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADC1C8.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADC35D.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADC570.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADC705.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADCB97.exe C:\Users\Robin&Erica\AppData\Local\Temp\EADFB20.exe C:\Users\Robin&Erica\AppData\Local\Temp\eauninstall.exe C:\Users\Robin&Erica\AppData\Local\Temp\EBU893D.exe C:\Users\Robin&Erica\AppData\Local\Temp\EBU8A46.DLL C:\Users\Robin&Erica\AppData\Local\Temp\EpsonInkjetDriverDownloader.EXE C:\Users\Robin&Erica\AppData\Local\Temp\fileutil.dll C:\Users\Robin&Erica\AppData\Local\Temp\GoogleToolbarInstaller_en32_signed.exe C:\Users\Robin&Erica\AppData\Local\Temp\HPHelpUpdater.exe C:\Users\Robin&Erica\AppData\Local\Temp\i4jdel0.exe C:\Users\Robin&Erica\AppData\Local\Temp\iGearedHelper.dll C:\Users\Robin&Erica\AppData\Local\Temp\InstallFlashPlayer.exe C:\Users\Robin&Erica\AppData\Local\Temp\InstMsiA.exe C:\Users\Robin&Erica\AppData\Local\Temp\InstMsiW.exe C:\Users\Robin&Erica\AppData\Local\Temp\jfxmotjc.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u23-windows-i586-iftw-rv.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u24-windows-i586-iftw-rv.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u26-windows-i586-iftw-rv.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u29-windows-i586-iftw-rv.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u35-windows-i586-iftw.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-6u37-windows-i586-iftw.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-7u15-windows-i586-iftw.exe C:\Users\Robin&Erica\AppData\Local\Temp\jre-7u17-windows-i586-iftw.exe C:\Users\Robin&Erica\AppData\Local\Temp\K-Lite_Codec_Pack_Basic.exe C:\Users\Robin&Erica\AppData\Local\Temp\MachineIdCreator.exe C:\Users\Robin&Erica\AppData\Local\Temp\mamut business software.exe C:\Users\Robin&Erica\AppData\Local\Temp\oi_{4D30FCBB-BB27-43A8-8464-75AACB54269F}.exe C:\Users\Robin&Erica\AppData\Local\Temp\pcsetup_si.exe C:\Users\Robin&Erica\AppData\Local\Temp\pPokerSetup.exe C:\Users\Robin&Erica\AppData\Local\Temp\ptuC4A_tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\ResetDevice.exe C:\Users\Robin&Erica\AppData\Local\Temp\Resource.exe C:\Users\Robin&Erica\AppData\Local\Temp\setup.exe C:\Users\Robin&Erica\AppData\Local\Temp\SimCity 4 Deluxe_uninst.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp46257.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp49905.exe.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp53904.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp54931.exe C:\Users\Robin&Erica\AppData\Local\Temp\sp58915.exe C:\Users\Robin&Erica\AppData\Local\Temp\SpotifyUpgrader.exe C:\Users\Robin&Erica\AppData\Local\Temp\sqlite-3.7.2-sqlitejdbc.dll C:\Users\Robin&Erica\AppData\Local\Temp\SRLDetectionLibrary4768899139401856696.dll C:\Users\Robin&Erica\AppData\Local\Temp\standalonepatcher.exe C:\Users\Robin&Erica\AppData\Local\Temp\standalonepatcherX.exe C:\Users\Robin&Erica\AppData\Local\Temp\TB_8FA1.exe C:\Users\Robin&Erica\AppData\Local\Temp\ToolbarInstaller.exe C:\Users\Robin&Erica\AppData\Local\Temp\ubi379E.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\ubi903F.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\UNINSTALL.EXE C:\Users\Robin&Erica\AppData\Local\Temp\UninstallEADM.dll C:\Users\Robin&Erica\AppData\Local\Temp\UninstallHPSA.exe C:\Users\Robin&Erica\AppData\Local\Temp\UninstallHPTCA.exe C:\Users\Robin&Erica\AppData\Local\Temp\utt4074.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\uttB8CF.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\uttEAF3.tmp.exe C:\Users\Robin&Erica\AppData\Local\Temp\vnu4DB3.tmp.EXE C:\Users\Robin&Erica\AppData\Local\Temp\vnuB461.tmp.EXE C:\Users\Robin&Erica\AppData\Local\Temp\YontooSetup-Silent.exe C:\Users\Robin&Erica\AppData\Local\Temp\_is60C0.exe C:\Users\Robin&Erica\AppData\Local\Temp\_isC246.exe C:\Users\Robin&Erica\AppData\Local\Temp\_unps.exe ==================== Known DLLs (Whitelisted) ================ ==================== Bamital & volsnap Check ================= C:\Windows\System32\winlogon.exe => MD5 is legit C:\Windows\System32\wininit.exe => MD5 is legit C:\Windows\SysWOW64\wininit.exe => MD5 is legit C:\Windows\explorer.exe => MD5 is legit C:\Windows\SysWOW64\explorer.exe => MD5 is legit C:\Windows\System32\svchost.exe => MD5 is legit C:\Windows\SysWOW64\svchost.exe => MD5 is legit C:\Windows\System32\services.exe => MD5 is legit C:\Windows\System32\User32.dll => MD5 is legit C:\Windows\SysWOW64\User32.dll => MD5 is legit C:\Windows\System32\userinit.exe => MD5 is legit C:\Windows\SysWOW64\userinit.exe => MD5 is legit C:\Windows\System32\rpcss.dll => MD5 is legit C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit ==================== EXE ASSOCIATION ===================== HKLM\...\.exe: exefile => OK HKLM\...\exefile\DefaultIcon: %1 => OK HKLM\...\exefile\open\command: "%1" %* => OK ==================== Restore Points ========================= Restore point made on: 2014-01-29 11:29:38 Restore point made on: 2014-02-02 07:13:24 ==================== Memory info =========================== Percentage of memory in use: 19% Total physical RAM: 4061.24 MB Available physical RAM: 3272.85 MB Total Pagefile: 4059.39 MB Available Pagefile: 3265.51 MB Total Virtual: 8192 MB Available Virtual: 8191.88 MB ==================== Drives ================================ Drive c: (HP) (Fixed) (Total:452.71 GB) (Free:40.11 GB) NTFS Drive e: (FACTORY_IMAGE) (Fixed) (Total:12.95 GB) (Free:1.42 GB) NTFS ==>[system with boot components (obtained from reading drive)] Drive f: (WGR614v7) (CDROM) (Total:0.03 GB) (Free:0 GB) CDFS Drive k: () (Removable) (Total:0.95 GB) (Free:0.91 GB) FAT32 Drive x: (Boot) (Fixed) (Total:0.08 GB) (Free:0.07 GB) NTFS Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[system with boot components (obtained from reading drive)] ==================== MBR & Partition Table ================== ======================================================== Disk: 0 (Size: 466 GB) (Disk ID: 1549F232) Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS) Partition 2: (Not Active) - (Size=453 GB) - (Type=07 NTFS) Partition 3: (Not Active) - (Size=13 GB) - (Type=07 NTFS) ======================================================== Disk: 5 (Size: 983 MB) (Disk ID: 00000000) Partition: GPT Partition Type. LastRegBack: 2014-01-27 15:33 ==================== End Of Log ============================