Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Malware/Virus eating up all C drive space


  • This topic is locked This topic is locked
55 replies to this topic

#1 apurvgupta

apurvgupta

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 22 May 2014 - 12:37 PM

Hi, i have been facing problem of normal program's .exe files being detected as virus by Malwarebytes antimalware and also C drive space shrinking more and more. Please help!!

 

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 10.0.9200.16521  BrowserJavaVersion: 11.5.2
Run by inteli3 at 21:19:22 on 2014-05-22
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.3575.967 [GMT 5.5:30]
.
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Windows\system32\taskhost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\BlueStacks\HD-LogRotatorService.exe
C:\Windows\system32\CNAB4RPK.EXE
C:\Windows\Explorer.EXE
C:\Program Files\Hotspot Shield\bin\cmw_srv.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\Hotspot Shield\bin\hsswd.exe
C:\Windows\system32\inetsrv\inetinfo.exe
C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\System32\StikyNot.exe
C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe
C:\Program Files\Malwarebytes Anti-Malware\mbam.exe
C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\BlueStacks\HD-Service.exe
C:\Program Files\BlueStacks\HD-Network.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\nutsrv4.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\BlueStacks\HD-BlockDevice.exe
C:\Windows\system32\conhost.exe
C:\Program Files\BlueStacks\HD-SharedFolder.exe
C:\Windows\system32\conhost.exe
C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\system32\AUDIODG.EXE
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Program Files\Logitech\SetPointP\LogiAppBroker.exe
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\system32\svchost.exe -k ftpsvc
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mStart Page = about:blank
BHO: IDM integration (IDMIEHlprObj Class): {0055C089-8582-441B-A0BF-17B458C2A3A8} - c:\program files\internet download manager\IDMIECC.dll
BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft office\office15\OCHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre8\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - c:\program files\logitech\setpointp\SetPointSmooth.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office15\URLREDIR.DLL
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - c:\program files\microsoft office\office15\GROOVEEX.DLL
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre8\bin\jp2ssv.dll
uRun: [HydraVisionDesktopManager] "c:\program files\ati technologies\hydravision\HydraDM.exe"
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Internet Audience Measuring System] c:\program files\imrb\iam\IAM.exe                                                                                                                                                                                                                                        
uRun: [BitTorrent] "c:\users\inteli3\appdata\roaming\bittorrent\BitTorrent.exe"  /MINIMIZED
uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe
uRun: [WSHelperSetup.exe] c:\program files\common files\wondershare\wondershare helper compact\WSHelper.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [amd_dc_opt] c:\program files\amd\dual-core optimizer\amd_dc_opt.exe
mRun: [NuTCSetupEnviron] c:\progra~1\rational\ration~1\nutcroot\bin\ncoeenv.exe
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\x86\CLIStart.exe" MSRun
mRun: [WSHelperSetup.exe] c:\program files\common files\wondershare\wondershare helper compact\WSHelper.exe
mRun: [Wondershare Helper Compact.exe] c:\program files\common files\wondershare\wondershare helper compact\WSHelper.exe
StartupFolder: c:\users\inteli3\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\inteli3\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\canonl~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\CNAB4LAK.EXE
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - d:\progra~1\micros~1\office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - d:\progra~1\micros~1\office15\ONBttnIE.dll/105
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-001021-0002-0021-ABCDEFFEDCBC} - <orphaned>
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office15\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft office\office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office15\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
LSP: %SystemRoot%\system32\nutafun4.dll
LSP: %windir%\system32\vsocklib.dll
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
TCP: Interfaces\{19510A76-7AC7-4EE2-8194-5D9715C23281} : DHCPNameServer = 8.8.8.8
TCP: Interfaces\{F762D964-0189-491F-B0E0-B7B52820E04D} : NameServer = 59.179.243.70,203.94.243.70,192.168.1.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office15\MSOXMLMF.DLL
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\belarcadvisor\system\BAVoilaX.dll
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - c:\program files\microsoft office\office15\MSOSB.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\34.0.1847.131\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\inteli3\appdata\roaming\mozilla\firefox\profiles\nj11o7yi.default-1372255369387\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\progra~1\micros~3\office15\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.24.7\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre8\bin\dtplugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre8\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.30214.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll
FF - plugin: c:\program files\nokia\nokia suite\npNokiaSuiteEnabler.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1211151.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_13_0_0_214.dll
FF - plugin: d:\program files\google\picasa3\npPicasa3.dll
FF - plugin: d:\program files\itunes\mozilla plugins\npitunes.dll
.
============= SERVICES / DRIVERS ===============
.
R0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2013-4-11 61296]
R1 AppleCharger;AppleCharger;c:\windows\system32\drivers\AppleCharger.sys [2013-1-31 18544]
R1 HssDRV6;Hotspot Shield Routing Driver 6;c:\windows\system32\drivers\hssdrv6.sys [2013-12-14 39624]
R1 networx;networx;c:\windows\system32\drivers\networx.sys [2013-7-11 52728]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2014-4-18 208896]
R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files\bluestacks\HD-Service.exe [2013-4-11 393032]
R2 BstHdDrv;BlueStacks Hypervisor;c:\program files\bluestacks\HD-Hypervisor-x86.sys [2013-4-11 63816]
R2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files\bluestacks\HD-LogRotatorService.exe [2013-4-11 384840]
R2 ftpsvc;Microsoft FTP Service;c:\windows\system32\svchost.exe -k ftpsvc [2009-7-14 20992]
R2 hshld;Hotspot Shield Service;c:\program files\hotspot shield\bin\cmw_srv.exe [2014-3-25 977704]
R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\hotspot shield\bin\hsswd.exe [2014-3-25 555304]
R2 IDMWFP;IDMWFP;c:\windows\system32\drivers\idmwfp.sys [2014-5-15 108000]
R2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes anti-malware\mbamscheduler.exe [2014-4-20 1809720]
R2 MBAMService;MBAMService;c:\program files\malwarebytes anti-malware\mbamservice.exe [2014-4-20 857912]
R2 MsDtsServer;SQL Server Integration Services;c:\program files\microsoft sql server\90\dts\binn\MsDtsSrvr.exe [2005-10-14 199384]
R2 NuTCRACKERService;NuTCRACKER Service;c:\windows\system32\nutsrv4.exe [2013-2-17 277272]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2014\TuneUpUtilitiesService32.exe [2013-8-29 1740600]
R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2013-1-31 2655768]
R2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);c:\windows\system32\drivers\vstor2-mntapi10-shared.sys [2011-7-12 22768]
R3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys [2013-4-12 32896]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2013-12-19 77824]
R3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\drivers\BthAvrcp.sys [2009-8-13 22528]
R3 DbusAudio;DbusAudio;c:\windows\system32\drivers\DbusAudio.sys [2013-5-12 23608]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2013-1-31 69232]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-2-7 23256]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-4-20 107736]
R3 MEI;Intel® Management Engine Interface;c:\windows\system32\drivers\HECI.sys [2013-1-31 41088]
R3 taphss6;Anchorfree HSS VPN Adapter;c:\windows\system32\drivers\taphss6.sys [2013-6-21 37064]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2014\TuneUpUtilitiesDriver32.sys [2013-8-21 12320]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2012-7-9 104912]
S3 androidusb;Google Device Driver;c:\windows\system32\drivers\wsadb.sys [2014-1-11 34720]
S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 BthMtpEnum;Bluetooth MTP Device Enumerator;c:\windows\system32\drivers\BthMtpEnum.sys [2009-7-14 51200]
S3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2011-4-12 62464]
S3 GSService;GSService;c:\windows\system32\GSService.exe [2013-5-10 249856]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2009-10-26 25088]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-4-20 51416]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2013-1-23 137600]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2013-1-23 8576]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-12-14 14848]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2013-10-3 27192]
S3 RwDrv;RwDrv;c:\windows\system32\drivers\RwDrv.sys [2013-5-16 19240]
S3 SMServer;SMServer;c:\windows\system32\snmvtsvc.exe [2013-5-12 244224]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\Synth3dVsc.sys [2011-4-12 77184]
S3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2012-12-14 24064]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-12-14 49664]
S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-12-14 27136]
S3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2011-4-12 112640]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\razer\razer game booster\driver\WinRing0.sys [2013-5-16 14416]
S3 WMSVC;Web Management Service;c:\windows\system32\inetsrv\WMSvc.exe [2009-7-14 9728]
S4 BRSptSvc;BitRaider Mini-Support Service;c:\programdata\bitraider\BRSptSvc.exe [2013-5-4 938776]
S4 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\common files\magix services\database\bin\FABS.exe [2011-5-24 2206572]
S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\common files\magix services\database\bin\fbserver.exe [2011-4-26 3069317]
S4 KinoniRemoteDesktop;Kinoni Remote Desktop;c:\program files\kinoni\remote desktop\service.exe [2013-3-27 405953]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-23 47128]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
S4 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2013-4-15 3289208]
S4 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-10-23 172192]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]
S4 TeamViewer8;TeamViewer 8;c:\program files\teamviewer\version8\TeamViewer_Service.exe [2013-3-30 5087584]
S4 VMUSBArbService;VMware USB Arbitration Service;c:\program files\common files\vmware\usb\vmware-usbarbitrator.exe [2012-8-1 719512]
S4 VMwareHostd;VMware Workstation Server;d:\program files\vmware\vmware-hostd.exe [2012-8-15 15680000]
.
=============== File Associations ===============
.
ShellExec: dreamweaver.exe: Open="c:\program files\adobe\adobe dreamweaver cs6\dreamweaver.exe", "%1"
ShellExec: Opera.exe: open="c:\program files\opera\Launcher.exe" "%1"
.
=============== Created Last 30 ================
.
2014-05-21 17:02:04    --------    d-sh--w-    C:\$RECYCLE.BIN
2014-05-21 16:46:27    98816    ----a-w-    c:\windows\sed.exe
2014-05-21 16:46:27    256000    ----a-w-    c:\windows\PEV.exe
2014-05-21 16:46:27    208896    ----a-w-    c:\windows\MBR.exe
2014-05-15 11:45:39    108000    ----a-w-    c:\windows\system32\drivers\idmwfp.sys
2014-05-13 16:07:55    --------    d-----w-    c:\users\inteli3\appdata\roaming\.purple
2014-05-13 16:07:35    --------    d-----w-    c:\program files\Pidgin
2014-05-09 16:42:39    --------    d-----w-    c:\program files\lclefphm
2014-05-09 16:29:41    --------    d-----w-    c:\program files\Wondershare
2014-05-08 13:48:42    227704    ----a-w-    c:\program files\mozilla firefox\plugins\nppdf32.dll
2014-05-08 13:48:42    227704    ----a-w-    c:\program files\internet explorer\plugins\nppdf32.dll
2014-05-03 09:41:56    --------    d-----w-    c:\users\inteli3\appdata\roaming\library_dir
2014-05-03 09:38:18    --------    d-----w-    c:\users\inteli3\appdata\roaming\Raptr
2014-05-03 09:38:18    --------    d-----w-    c:\program files\Raptr
2014-05-03 09:36:52    --------    d-----w-    c:\program files\AMD AVT
2014-05-03 09:26:22    --------    d-----w-    C:\AMD
.
==================== Find3M  ====================
.
2014-05-22 15:12:16    107736    ----a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-18 11:06:06    70832    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-18 11:06:06    692400    ----a-w-    c:\windows\system32\FlashPlayerApp.exe
2014-04-20 07:37:30    16400    ----a-w-    c:\windows\system32\drivers\LNonPnP.sys
2014-04-19 16:39:56    96680    ----a-w-    c:\windows\system32\WindowsAccessBridge.dll
2014-04-18 02:43:04    71704    ----a-w-    c:\windows\system32\atimpc32.dll
2014-04-18 02:43:04    71704    ----a-w-    c:\windows\system32\amdpcom32.dll
2014-04-18 02:42:58    126336    ----a-w-    c:\windows\system32\atiuxpag.dll
2014-04-18 02:42:56    99520    ----a-w-    c:\windows\system32\atiu9pag.dll
2014-04-18 02:42:52    1117184    ----a-w-    c:\windows\system32\aticfx32.dll
2014-04-18 02:42:42    8866928    ----a-w-    c:\windows\system32\atidxx32.dll
2014-04-18 02:42:38    6796592    ----a-w-    c:\windows\system32\atiumdva.dll
2014-04-18 02:42:34    6799688    ----a-w-    c:\windows\system32\atiumdag.dll
2014-04-18 02:39:04    247520    ----a-w-    c:\windows\system32\drivers\amdacpksd.sys
2014-04-18 02:35:20    13515264    ----a-w-    c:\windows\system32\drivers\atikmdag.sys
2014-04-18 02:23:02    200704    ----a-w-    c:\windows\system32\clinfo.exe
2014-04-18 02:22:48    83456    ----a-w-    c:\windows\system32\OpenVideo.dll
2014-04-18 02:22:38    73216    ----a-w-    c:\windows\system32\OVDecode.dll
2014-04-18 02:19:54    24107520    ----a-w-    c:\windows\system32\amdocl.dll
2014-04-18 02:17:24    58880    ----a-w-    c:\windows\system32\OpenCL.dll
2014-04-18 02:13:10    113664    ----a-w-    c:\windows\system32\mantle32.dll
2014-04-18 01:58:32    4358656    ----a-w-    c:\windows\system32\amdmantle32.dll
2014-04-18 01:51:44    23409152    ----a-w-    c:\windows\system32\atioglxx.dll
2014-04-18 01:46:34    368128    ----a-w-    c:\windows\system32\atiapfxx.exe
2014-04-18 01:46:24    52224    ----a-w-    c:\windows\system32\aticalrt.dll
2014-04-18 01:46:18    49152    ----a-w-    c:\windows\system32\aticalcl.dll
2014-04-18 01:45:46    85504    ----a-w-    c:\windows\system32\mantleaxl32.dll
2014-04-18 01:42:52    14302208    ----a-w-    c:\windows\system32\aticaldd.dll
2014-04-18 01:33:02    37888    ----a-w-    c:\windows\system32\amdmmcl.dll
2014-04-18 01:30:14    442368    ----a-w-    c:\windows\system32\atidemgy.dll
2014-04-18 01:29:58    30720    ----a-w-    c:\windows\system32\atimuixx.dll
2014-04-18 01:29:40    491520    ----a-w-    c:\windows\system32\atieclxx.exe
2014-04-18 01:29:16    208896    ----a-w-    c:\windows\system32\atiesrxx.exe
2014-04-18 01:28:24    164352    ----a-w-    c:\windows\system32\atitmmxx.dll
2014-04-18 01:21:26    616960    ----a-w-    c:\windows\system32\coinst_14.100.dll
2014-04-18 01:08:56    848896    ----a-w-    c:\windows\system32\atiadlxx.dll
2014-04-18 01:07:46    69632    ----a-w-    c:\windows\system32\atiglpxx.dll
2014-04-18 01:07:20    133632    ----a-w-    c:\windows\system32\atigktxx.dll
2014-04-18 01:06:30    512000    ----a-w-    c:\windows\system32\drivers\atikmpag.sys
2014-04-18 01:04:24    43520    ----a-w-    c:\windows\system32\drivers\ati2erec.dll
2014-04-17 16:58:30    38912    ----a-w-    c:\windows\system32\kdbsdk32.dll
2014-04-03 04:21:14    51416    ----a-w-    c:\windows\system32\drivers\mwac.sys
2014-04-03 04:21:00    73432    ----a-w-    c:\windows\system32\drivers\mbamchameleon.sys
2014-04-03 04:20:56    23256    ----a-w-    c:\windows\system32\drivers\mbam.sys
2014-03-11 20:07:42    4550656    ----a-w-    c:\windows\system32\GPhotos.scr
.
============= FINISH: 21:20:00.65 ===============
 

Attached Files


Edited by apurvgupta, 22 May 2014 - 01:29 PM.


BC AdBot (Login to Remove)

 


#2 HelpBot

HelpBot

    Bleepin' Binary Bot


  • Bots
  • 12,633 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:26 PM

Posted 27 May 2014 - 12:40 PM

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

step1.gif In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/535197 <<< CLICK THIS LINK



If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

step2.gifIf you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

  • If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  • A new DDS log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
    • Please do this even if you have previously posted logs for us.
    • If you were unable to produce the logs originally please try once more.
    • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    • If you are unsure about any of these characteristics just post what you can and we will guide you.
  • Please tell us if you have your original Windows CD/DVD available.
  • Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

  • Download DDS by sUBs from the following link if you no longer have it available and save it to your destop.

    DDS.com Download Link
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  • Notepad will open with the results.
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control can be found HERE.

As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

#3 apurvgupta

apurvgupta
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 28 May 2014 - 10:01 AM

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 10.0.9200.16521  BrowserJavaVersion: 11.5.2
Run by inteli3 at 19:48:56 on 2014-05-28
Microsoft Windows 7 Ultimate   6.1.7601.1.1252.1.1033.18.3575.1318 [GMT 5.5:30]
.
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ================
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\atiesrxx.exe
C:\Windows\system32\atieclxx.exe
C:\Windows\System32\spoolsv.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\BlueStacks\HD-LogRotatorService.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\CNAB4RPK.EXE
C:\Windows\system32\inetsrv\inetinfo.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Users\inteli3\AppData\Roaming\BitTorrent\BitTorrent.exe
C:\Windows\System32\StikyNot.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe
C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\BlueStacks\HD-Service.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\nutsrv4.exe
C:\Program Files\BlueStacks\HD-Network.exe
C:\Windows\system32\conhost.exe
C:\Program Files\BlueStacks\HD-BlockDevice.exe
C:\Windows\system32\conhost.exe
C:\Program Files\BlueStacks\HD-SharedFolder.exe
C:\Windows\system32\conhost.exe
C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Microsoft Office\Office15\MsoSync.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\NirSoft\DownTester\DownTester.exe
C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
C:\Windows\system32\taskmgr.exe
C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\system32\svchost.exe -k ftpsvc
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\svchost.exe -k iissvcs
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
mStart Page = about:blank
mWinlogon: Userinit = c:\windows\system32\userinit.exe,c:\program files\lclefphm\qidqpsqa.exe
BHO: IDM integration (IDMIEHlprObj Class): {0055C089-8582-441B-A0BF-17B458C2A3A8} - c:\program files\internet download manager\IDMIECC.dll
BHO: Lync Browser Helper: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft office\office15\OCHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre8\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Logitech SetPoint: {AF949550-9094-4807-95EC-D1C317803333} - c:\program files\logitech\setpointp\SetPointSmooth.dll
BHO: Office Document Cache Handler: {B4F3A835-0E21-4959-BA22-42B3008E02FF} - c:\program files\microsoft office\office15\URLREDIR.DLL
BHO: Microsoft SkyDrive Pro Browser Helper: {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - c:\program files\microsoft office\office15\GROOVEEX.DLL
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre8\bin\jp2ssv.dll
uRun: [HydraVisionDesktopManager] "c:\program files\ati technologies\hydravision\HydraDM.exe"
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [Internet Audience Measuring System] c:\program files\imrb\iam\IAM.exe                                                                                                                                                                                                                                        
uRun: [BitTorrent] "c:\users\inteli3\appdata\roaming\bittorrent\BitTorrent.exe"  /MINIMIZED
uRun: [RESTART_STICKY_NOTES] c:\windows\system32\StikyNot.exe
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [amd_dc_opt] c:\program files\amd\dual-core optimizer\amd_dc_opt.exe
mRun: [SwitchBoard] c:\program files\common files\adobe\switchboard\SwitchBoard.exe
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\x86\CLIStart.exe" MSRun
StartupFolder: c:\users\inteli3\appdata\roaming\micros~1\windows\startm~1\programs\startup\dropbox.lnk - c:\users\inteli3\appdata\roaming\dropbox\bin\Dropbox.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\canonl~1.lnk - c:\windows\system32\spool\drivers\w32x86\3\CNAB4LAK.EXE
uPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - d:\progra~1\micros~1\office15\EXCEL.EXE/3000
IE: Se&nd to OneNote - d:\progra~1\micros~1\office15\ONBttnIE.dll/105
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-001021-0002-0021-ABCDEFFEDCBC} - <orphaned>
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\program files\microsoft office\office15\ONBttnIE.dll
IE: {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - c:\program files\microsoft office\office15\OCHelper.dll
IE: {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - {FFFDC614-B694-4AE6-AB38-5D6374584B52} - c:\program files\microsoft office\office15\ONBttnIELinkedNotes.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
LSP: %SystemRoot%\system32\nutafun4.dll
LSP: %windir%\system32\vsocklib.dll
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
TCP: Interfaces\{19510A76-7AC7-4EE2-8194-5D9715C23281} : DHCPNameServer = 8.8.8.8
TCP: Interfaces\{F762D964-0189-491F-B0E0-B7B52820E04D} : NameServer = 59.179.243.70,203.94.243.70,192.168.1.1
Filter: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - c:\program files\common files\microsoft shared\office15\MSOXMLMF.DLL
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\belarcadvisor\system\BAVoilaX.dll
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - c:\program files\microsoft office\office15\MSOSB.DLL
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\common files\skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
mASetup: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "c:\program files\google\chrome\application\34.0.1847.131\installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\inteli3\appdata\roaming\mozilla\firefox\profiles\nj11o7yi.default-1372255369387\
FF - prefs.js: browser.startup.homepage - hxxps://www.google.com/
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\progra~1\micros~3\office15\NPSPWRAP.DLL
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\google\update\1.3.24.7\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre8\bin\dtplugin\npdeployJava1.dll
FF - plugin: c:\program files\java\jre8\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.30214.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll
FF - plugin: c:\program files\nokia\nokia suite\npNokiaSuiteEnabler.dll
FF - plugin: c:\windows\system32\adobe\director\np32dsw_1211151.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_13_0_0_214.dll
FF - plugin: d:\program files\google\picasa3\npPicasa3.dll
FF - plugin: d:\program files\itunes\mozilla plugins\npitunes.dll
.
============= SERVICES / DRIVERS ===============
.
R0 vsock;vSockets Driver;c:\windows\system32\drivers\vsock.sys [2013-4-11 61296]
R1 AppleCharger;AppleCharger;c:\windows\system32\drivers\AppleCharger.sys [2013-1-31 18544]
R1 networx;networx;c:\windows\system32\drivers\networx.sys [2013-7-11 52728]
R2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2014-4-18 208896]
R2 BstHdAndroidSvc;BlueStacks Android Service;c:\program files\bluestacks\HD-Service.exe [2013-4-11 393032]
R2 BstHdDrv;BlueStacks Hypervisor;c:\program files\bluestacks\HD-Hypervisor-x86.sys [2013-4-11 63816]
R2 BstHdLogRotatorSvc;BlueStacks Log Rotator Service;c:\program files\bluestacks\HD-LogRotatorService.exe [2013-4-11 384840]
R2 ftpsvc;Microsoft FTP Service;c:\windows\system32\svchost.exe -k ftpsvc [2009-7-14 20992]
R2 IDMWFP;IDMWFP;c:\windows\system32\drivers\idmwfp.sys [2014-5-15 108000]
R2 MsDtsServer;SQL Server Integration Services;c:\program files\microsoft sql server\90\dts\binn\MsDtsSrvr.exe [2005-10-14 199384]
R2 NuTCRACKERService;NuTCRACKER Service;c:\windows\system32\nutsrv4.exe [2013-2-17 277272]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\tuneup utilities 2014\TuneUpUtilitiesService32.exe [2013-8-29 1740600]
R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\intel\intel® management engine components\uns\UNS.exe [2013-1-31 2655768]
R2 vstor2-mntapi10-shared;Vstor2 MntApi 1.0 Driver (shared);c:\windows\system32\drivers\vstor2-mntapi10-shared.sys [2011-7-12 22768]
R3 anvsnddrv;AnvSoft Virtual Sound Device;c:\windows\system32\drivers\anvsnddrv.sys [2013-4-12 32896]
R3 AtiHDAudioService;AMD Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2013-12-19 77824]
R3 BthAvrcp;Bluetooth AVRCP Profile;c:\windows\system32\drivers\BthAvrcp.sys [2009-8-13 22528]
R3 DbusAudio;DbusAudio;c:\windows\system32\drivers\DbusAudio.sys [2013-5-12 23608]
R3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\drivers\L1C62x86.sys [2013-1-31 69232]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2013-2-7 23256]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\MBAMSwissArmy.sys [2014-4-20 107736]
R3 MEI;Intel® Management Engine Interface;c:\windows\system32\drivers\HECI.sys [2013-1-31 41088]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\tuneup utilities 2014\TuneUpUtilitiesDriver32.sys [2013-8-21 12320]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2012-7-9 104912]
S2 MBAMScheduler;MBAMScheduler;c:\program files\malwarebytes anti-malware\mbamscheduler.exe [2014-4-20 1809720]
S2 MBAMService;MBAMService;c:\program files\malwarebytes anti-malware\mbamservice.exe [2014-4-20 857912]
S3 androidusb;Google Device Driver;c:\windows\system32\drivers\wsadb.sys [2014-1-11 34720]
S3 AppleChargerSrv;AppleChargerSrv;system32\AppleChargerSrv.exe --> system32\AppleChargerSrv.exe [?]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-14 229888]
S3 BthMtpEnum;Bluetooth MTP Device Enumerator;c:\windows\system32\drivers\BthMtpEnum.sys [2009-7-14 51200]
S3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2011-4-12 62464]
S3 GSService;GSService;c:\windows\system32\GSService.exe [2013-5-10 249856]
S3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [2009-10-26 25088]
S3 MBAMWebAccessControl;MBAMWebAccessControl;c:\windows\system32\drivers\mwac.sys [2014-4-20 51416]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [2013-1-23 137600]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [2013-1-23 8576]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-12-14 14848]
S3 Revoflt;Revoflt;c:\windows\system32\drivers\revoflt.sys [2013-10-3 27192]
S3 RwDrv;RwDrv;c:\windows\system32\drivers\RwDrv.sys [2013-5-16 19240]
S3 SMServer;SMServer;c:\windows\system32\snmvtsvc.exe [2013-5-12 244224]
S3 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2010-2-19 517096]
S3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\Synth3dVsc.sys [2011-4-12 77184]
S3 terminpt;Microsoft Remote Desktop Input Driver;c:\windows\system32\drivers\terminpt.sys [2012-12-14 24064]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2012-12-14 49664]
S3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2012-12-14 27136]
S3 tsusbhub;tsusbhub;c:\windows\system32\drivers\tsusbhub.sys [2011-4-12 112640]
S3 WinRing0_1_2_0;WinRing0_1_2_0;c:\program files\razer\razer game booster\driver\WinRing0.sys [2013-5-16 14416]
S3 WMSVC;Web Management Service;c:\windows\system32\inetsrv\WMSvc.exe [2009-7-14 9728]
S4 BRSptSvc;BitRaider Mini-Support Service;c:\programdata\bitraider\BRSptSvc.exe [2013-5-4 938776]
S4 Fabs;FABS - Helping agent for MAGIX media database;c:\program files\common files\magix services\database\bin\FABS.exe [2011-5-24 1840128]
S4 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\common files\magix services\database\bin\fbserver.exe [2011-4-26 2702848]
S4 KinoniRemoteDesktop;Kinoni Remote Desktop;c:\program files\kinoni\remote desktop\service.exe [2013-3-27 405896]
S4 MSSQLServerADHelper100;SQL Active Directory Helper Service;c:\program files\microsoft sql server\100\shared\sqladhlp.exe [2009-7-23 47128]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]
S4 RsFx0103;RsFx0103 Driver;c:\windows\system32\drivers\RsFx0103.sys [2009-3-30 239336]
S4 Skype C2C Service;Skype C2C Service;c:\programdata\skype\toolbars\skype c2c service\c2c_service.exe [2013-4-15 3289208]
S4 SkypeUpdate;Skype Updater;c:\program files\skype\updater\Updater.exe [2013-10-23 172192]
S4 SQLAgent$SQLEXPRESS;SQL Server Agent (SQLEXPRESS);c:\program files\microsoft sql server\mssql10.sqlexpress\mssql\binn\SQLAGENT.EXE [2009-3-30 366936]
S4 TeamViewer8;TeamViewer 8;c:\program files\teamviewer\version8\TeamViewer_Service.exe [2013-3-30 5087584]
S4 VMUSBArbService;VMware USB Arbitration Service;c:\program files\common files\vmware\usb\vmware-usbarbitrator.exe [2012-8-1 719512]
S4 VMwareHostd;VMware Workstation Server;d:\program files\vmware\vmware-hostd.exe [2012-8-15 15680000]
.
=============== File Associations ===============
.
ShellExec: Opera.exe: open="c:\program files\opera\Launcher.exe" "%1"
.
=============== Created Last 30 ================
.
2014-05-27 15:51:26    --------    d-----w-    c:\program files\HitmanPro
2014-05-27 15:51:00    --------    d-----w-    c:\programdata\HitmanPro
2014-05-27 15:34:24    --------    d-----w-    c:\windows\snack
2014-05-27 15:31:54    26624    ----a-w-    c:\windows\system32\TrueSight.sys
2014-05-27 14:26:58    107736    ----a-w-    c:\windows\system32\drivers\48230029.sys
2014-05-25 09:06:11    --------    d-----w-    c:\program files\ESET
2014-05-25 08:58:11    --------    d-----w-    c:\programdata\Spybot - Search & Destroy
2014-05-21 17:02:04    --------    d-sh--w-    C:\$RECYCLE.BIN
2014-05-21 16:46:27    98816    ----a-w-    c:\windows\sed.exe
2014-05-21 16:46:27    256000    ----a-w-    c:\windows\PEV.exe
2014-05-21 16:46:27    208896    ----a-w-    c:\windows\MBR.exe
2014-05-15 11:45:39    108000    ----a-w-    c:\windows\system32\drivers\idmwfp.sys
2014-05-13 16:07:55    --------    d-----w-    c:\users\inteli3\appdata\roaming\.purple
2014-05-13 16:07:35    --------    d-----w-    c:\program files\Pidgin
2014-05-09 16:42:39    --------    d-----w-    c:\program files\lclefphm
2014-05-09 16:29:41    --------    d-----w-    c:\program files\Wondershare
2014-05-08 13:48:42    227704    ----a-w-    c:\program files\mozilla firefox\plugins\nppdf32.dll
2014-05-08 13:48:42    227704    ----a-w-    c:\program files\internet explorer\plugins\nppdf32.dll
2014-05-03 09:41:56    --------    d-----w-    c:\users\inteli3\appdata\roaming\library_dir
2014-05-03 09:38:18    --------    d-----w-    c:\users\inteli3\appdata\roaming\Raptr
2014-05-03 09:38:18    --------    d-----w-    c:\program files\Raptr
2014-05-03 09:36:52    --------    d-----w-    c:\program files\AMD AVT
2014-05-03 09:26:22    --------    d-----w-    C:\AMD
.
==================== Find3M  ====================
.
2014-05-28 14:03:31    107736    ----a-w-    c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-05-18 11:06:06    70832    ----a-w-    c:\windows\system32\FlashPlayerCPLApp.cpl
2014-05-18 11:06:06    692400    ----a-w-    c:\windows\system32\FlashPlayerApp.exe
2014-04-20 07:37:30    16400    ----a-w-    c:\windows\system32\drivers\LNonPnP.sys
2014-04-19 16:39:56    96680    ----a-w-    c:\windows\system32\WindowsAccessBridge.dll
2014-04-18 02:43:04    71704    ----a-w-    c:\windows\system32\atimpc32.dll
2014-04-18 02:43:04    71704    ----a-w-    c:\windows\system32\amdpcom32.dll
2014-04-18 02:42:58    126336    ----a-w-    c:\windows\system32\atiuxpag.dll
2014-04-18 02:42:56    99520    ----a-w-    c:\windows\system32\atiu9pag.dll
2014-04-18 02:42:52    1117184    ----a-w-    c:\windows\system32\aticfx32.dll
2014-04-18 02:42:42    8866928    ----a-w-    c:\windows\system32\atidxx32.dll
2014-04-18 02:42:38    6796592    ----a-w-    c:\windows\system32\atiumdva.dll
2014-04-18 02:42:34    6799688    ----a-w-    c:\windows\system32\atiumdag.dll
2014-04-18 02:39:04    247520    ----a-w-    c:\windows\system32\drivers\amdacpksd.sys
2014-04-18 02:35:20    13515264    ----a-w-    c:\windows\system32\drivers\atikmdag.sys
2014-04-18 02:23:02    200704    ----a-w-    c:\windows\system32\clinfo.exe
2014-04-18 02:22:48    83456    ----a-w-    c:\windows\system32\OpenVideo.dll
2014-04-18 02:22:38    73216    ----a-w-    c:\windows\system32\OVDecode.dll
2014-04-18 02:19:54    24107520    ----a-w-    c:\windows\system32\amdocl.dll
2014-04-18 02:17:24    58880    ----a-w-    c:\windows\system32\OpenCL.dll
2014-04-18 02:13:10    113664    ----a-w-    c:\windows\system32\mantle32.dll
2014-04-18 01:58:32    4358656    ----a-w-    c:\windows\system32\amdmantle32.dll
2014-04-18 01:51:44    23409152    ----a-w-    c:\windows\system32\atioglxx.dll
2014-04-18 01:46:34    368128    ----a-w-    c:\windows\system32\atiapfxx.exe
2014-04-18 01:46:24    52224    ----a-w-    c:\windows\system32\aticalrt.dll
2014-04-18 01:46:18    49152    ----a-w-    c:\windows\system32\aticalcl.dll
2014-04-18 01:45:46    85504    ----a-w-    c:\windows\system32\mantleaxl32.dll
2014-04-18 01:42:52    14302208    ----a-w-    c:\windows\system32\aticaldd.dll
2014-04-18 01:33:02    37888    ----a-w-    c:\windows\system32\amdmmcl.dll
2014-04-18 01:30:14    442368    ----a-w-    c:\windows\system32\atidemgy.dll
2014-04-18 01:29:58    30720    ----a-w-    c:\windows\system32\atimuixx.dll
2014-04-18 01:29:40    491520    ----a-w-    c:\windows\system32\atieclxx.exe
2014-04-18 01:29:16    208896    ----a-w-    c:\windows\system32\atiesrxx.exe
2014-04-18 01:28:24    164352    ----a-w-    c:\windows\system32\atitmmxx.dll
2014-04-18 01:21:26    616960    ----a-w-    c:\windows\system32\coinst_14.100.dll
2014-04-18 01:08:56    848896    ----a-w-    c:\windows\system32\atiadlxx.dll
2014-04-18 01:07:46    69632    ----a-w-    c:\windows\system32\atiglpxx.dll
2014-04-18 01:07:20    133632    ----a-w-    c:\windows\system32\atigktxx.dll
2014-04-18 01:06:30    512000    ----a-w-    c:\windows\system32\drivers\atikmpag.sys
2014-04-18 01:04:24    43520    ----a-w-    c:\windows\system32\drivers\ati2erec.dll
2014-04-17 16:58:30    38912    ----a-w-    c:\windows\system32\kdbsdk32.dll
2014-04-03 04:21:14    51416    ----a-w-    c:\windows\system32\drivers\mwac.sys
2014-04-03 04:21:00    73432    ----a-w-    c:\windows\system32\drivers\mbamchameleon.sys
2014-04-03 04:20:56    23256    ----a-w-    c:\windows\system32\drivers\mbam.sys
2014-03-11 20:07:42    4550656    ----a-w-    c:\windows\system32\GPhotos.scr
.
============= FINISH: 19:49:36.35 ===============
 



#4 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,640 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:11:26 AM

Posted 29 May 2014 - 08:54 AM

Greetings apurvgupta and :welcome: to BleepingComputer's Virus/Trojan/Spyware/Malware Removal forum.

My name is Oh My! and I am here to help you! Now that we are "friends" please call me Gary.

If you would allow me to call you by your first name I would prefer to do that. :thumbup2:

===================================================

Ground Rules:
  • First, I would like to inform you that most of us here at Bleeping Computer offer our expert assistance out of the goodness of our hearts. Please try to match our commitment to you with your patience toward us. If this was easy we would never have met. :)
  • Please do not run any tools or take any steps other than those I will provide for you while we work on your computer together. I need to be certain about the state of your computer in order to provide appropriate and effective steps for you to take. Most often "well intentioned" (and usually panic driven!) independent efforts can make things much worse for both of us. If at any point you would prefer to take your own steps please let me know, I will not be offended. I would be happy to focus on the many others who are waiting in line for assistance.
  • Please perform all steps in the order they are listed in each set of instructions. Some steps may be a bit complicated. If things are not clear, be sure to stop and let me know. We need to work on this together with confidence.
  • Please copy and paste all logs into your post unless directed otherwise. Please do not re-run any programs I suggest. If you encounter problems simply stop and tell me.
  • When you post your reply, use the Replytopic.jpg button instead.
  • In the upper right hand corner of the topic you will see the Followtopic.jpg button. Click on this then choose Immediate E-Mail notification and then Proceed and you will be sent an email once I have posted a response.
  • If you do not reply to your topic after 5 days we assume it has been abandoned and I will close it.
  • When your computer is clean I will alert you of such. I will also provide for you detailed information about how you can combat future infections.
  • I would like to remind you to make no further changes to your computer unless I direct you to do so.
  • Now let's get started :thumbup2:
===================================================

Now that I am assisting you, you can expect that I will be very responsive to your situation. If you are able, I would request you check this thread at least once per day so that we can try to resolve your issues effectively and efficiently. If you are going to be delayed please be considerate and post that information so that I know you are still with me. Unfortunately, there are many people waiting to be assisted and not enough of us at BleepingComputer to go around. I appreciate your understanding and diligence.

Thank you for your patience thus far. While I review our situation please run the below for me.

===================================================

Farbar Recovery Scan Tool (FRST)

--------------------
  • Download Farbar Recover Scan Tool for either 32 bit or 64 bit systems and save it to your desktop
  • If you are unsure if you have 32 bit or 64 bit simply download and try one. If that doesn't run properly the other one should
  • Double click the icon
  • Click Yes to the disclaimer
  • Make sure the Addition.txt box is checked
  • Click Scan and allow the program to run
  • Click OK on the Scan complete screen, then OK on the Addition.txt pop up screen
  • 2 Notepad documents should now be open on your desktop.
  • Please copy and paste the contents of both in your reply
===================================================

System Summary Information

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time
  • Type msinfo32 and press Enter
  • Left click on System Summary
  • Click File, Save, and name the file Summary
  • Zip and attach the file to your reply
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • FRST results
  • Addition log
  • System Summary Information

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#5 apurvgupta

apurvgupta
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 29 May 2014 - 09:41 AM

Hi Gary, many thanks for your response to my problem.  :) . I will be glad if u call me by my first name- Apurv ;) Here is the information that is required:

 

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:25-05-2014 02
Ran by inteli3 (administrator) on INTELI3PC on 29-05-2014 20:04:00
Running from D:\Downloads\Programs
Platform: Microsoft Windows 7 Ultimate  Service Pack 1 (X86) OS Language: English(US)
Internet Explorer Version 10
Boot Mode: Normal

The only official download link for FRST:
Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(CANON INC.) C:\Windows\System32\CNAB4RPK.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Windows\System32\inetsrv\inetinfo.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
() C:\Program Files\Unlocker\UnlockerAssistant.exe
(AMD) C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\StikyNot.exe
(Logitech, Inc.) C:\Program Files\Common Files\Logishrd\KHAL3\KHALMNPR.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe
(Microsoft Corporation) C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(DataFocus, Inc.) C:\Windows\System32\nutsrv4.exe
(TuneUp Software) C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesApp32.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\plugin-container.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Adobe Systems, Inc.) C:\Windows\System32\Macromed\Flash\FlashPlayerPlugin_13_0_0_214.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Intel\Intel® Management Engine Components\UNS\UNS.exe
(Microsoft Corporation) C:\Windows\System32\taskmgr.exe
(Microsoft Corporation) C:\Windows\System32\audiodg.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IDMan.exe
(Tonec Inc.) C:\Program Files\Internet Download Manager\IEMonitor.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [10082920 2011-06-07] (Realtek Semiconductor)
HKLM\...\Run: [amd_dc_opt] => C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe [446932 2008-07-22] (AMD)
HKLM\...\Run: [SwitchBoard] => C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [517096 2010-02-19] (Adobe Systems Incorporated)
HKLM\...\Run: [EvtMgr6] => C:\Program Files\Logitech\SetPointP\SetPoint.exe [2296600 2013-08-01] (Logitech, Inc.)
HKLM\...\Run: [UnlockerAssistant] => C:\Program Files\Unlocker\UnlockerAssistant.exe [17408 2010-07-05] ()
HKLM\...\Run: [Adobe ARM] => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-12-21] (Adobe Systems Incorporated)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\x86\CLIStart.exe [748256 2014-04-17] (Advanced Micro Devices, Inc.)
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\lclefphm\qidqpsqa.exe
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\...\Run: [HydraVisionDesktopManager] => C:\Program Files\ATI Technologies\HydraVision\HydraDM.exe [389120 2013-03-28] (AMD)
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\...\Run: [Internet Audience Measuring System] => C:\Program Files\IMRB\IAM\IAM.exe [1336832 2013-04-12] (IMRB International)
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\...\Run: [BitTorrent] => C:\Users\inteli3\AppData\Roaming\BitTorrent\BitTorrent.exe [1303136 2014-01-25] (BitTorrent Inc.)
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\...\Run: [RESTART_STICKY_NOTES] => C:\Windows\System32\StikyNot.exe [354304 2009-07-14] (Microsoft Corporation)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Canon LBP2900 Status Window.lnk
ShortcutTarget: Canon LBP2900 Status Window.lnk -> C:\Windows\System32\spool\drivers\w32x86\3\CNAB4LAK.EXE (CANON INC.)
Startup: C:\Users\inteli3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
ShortcutTarget: Dropbox.lnk -> C:\Users\inteli3\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0x48DB290FDC14CE01
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-US
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
BHO: IDM integration (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (Internet Download Manager, Tonec Inc.)
BHO: Lync Browser Helper - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll (Microsoft Corporation)
BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre8\bin\ssv.dll (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
BHO: Skype Browser Helper - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
BHO: Logitech SetPoint - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)
BHO: Office Document Cache Handler - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office\Office15\URLREDIR.DLL (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\Program Files\Microsoft Office\Office15\GROOVEEX.DLL (Microsoft Corporation)
BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre8\bin\jp2ssv.dll (Oracle Corporation)
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\BelarcAdvisor\System\BAVoilaX.dll (Belarc, Inc.)
Handler: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL (Microsoft Corporation)
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
Winsock: Catalog5 07 C:\Program Files\Bonjour\mdnsNSP.dll [121704] (Apple Inc.)
Winsock: Catalog9 12 %SystemRoot%\system32\nutafun4.dll [127156] (DataFocus, Inc.)
Winsock: Catalog9 13 %SystemRoot%\system32\nutafun4.dll [127156] (DataFocus, Inc.)
Tcpip\..\Interfaces\{F762D964-0189-491F-B0E0-B7B52820E04D}: [NameServer]59.179.243.70,203.94.243.70,192.168.1.1

FireFox:
========
FF ProfilePath: C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387
FF Homepage: https://www.google.com/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll ()
FF Plugin: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw_1211151.dll (Adobe Systems, Inc.)
FF Plugin: @Apple.com/iTunes,version=1.0 - D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin: @google.com/npPicasa3,version=3.0.0 - D:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.5.2 - C:\Program Files\Java\jre8\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.5.2 - C:\Program Files\Java\jre8\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin: @microsoft.com/Lync,version=15.0 - C:\Program Files\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 - C:\PROGRA~1\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin: @nokia.com/EnablerPlugin - C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
FF Plugin: @tools.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.7\npGoogleUpdate3.dll (Google Inc.)
FF Plugin: @videolan.org/vlc,version=2.1.0 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: @videolan.org/vlc,version=2.1.2 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin: Adobe Reader - C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF Extension: YouTube Unblocker - C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\Extensions\youtubeunblocker@unblocker.yt [2014-04-19]
FF Extension: Auto Refresh - C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\Extensions\autorefresh@plugin.xpi [2014-05-25]
FF Extension: YouTube Center - C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\Extensions\jid1-cwbvBTE216jjpg@jetpack.xpi [2013-12-09]
FF Extension: {3e5e0ed1-241f-43fd-aed0-3345caf34d0c} - C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\Extensions\{3e5e0ed1-241f-43fd-aed0-3345caf34d0c}.xpi [2013-10-31]
FF Extension: Web Install Updater Free - C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\Extensions\{cff8524e-1f88-476a-9eb0-a1696c3c8de4}.xpi [2013-11-06]
FF Extension: Adblock Plus - C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013-06-26]
FF Extension: Greasemonkey - C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi [2013-07-28]
FF Extension: Theme Font &amp; Size Changer - C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\Extensions\{f69e22c7-bc50-414a-9269-0f5c344cd94c}.xpi [2013-11-29]
FF Extension: Hotspot Shield Helper (Please allow this installation) - C:\Program Files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com [2014-05-10]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-05-10]
FF Extension: Skype Click to Call - C:\Program Files\Mozilla Firefox\browser\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2014-05-10]
FF HKLM\...\Firefox\Extensions: [{F003DA68-8256-4b37-A6C4-350FA04494DF}] - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt
FF Extension: Logitech SetPoint - C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013-08-12]
FF HKLM\...\Firefox\Extensions: [ffpwdman@bitdefender.com] - D:\Program Files\Bitdefender\Bitdefender\ffpwdman\
FF HKCU\...\Firefox\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\inteli3\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\inteli3\AppData\Roaming\IDM\idmmzcc5 [2014-05-17]
FF HKCU\...\SeaMonkey\Extensions: [mozilla_cc@internetdownloadmanager.com] - C:\Users\inteli3\AppData\Roaming\IDM\idmmzcc5
FF Extension: IDM CC - C:\Users\inteli3\AppData\Roaming\IDM\idmmzcc5 [2014-05-17]

Chrome:
=======
CHR HomePage: hxxp://www.google.com/
CHR StartupUrls: "https://mail.google.com/mail/ca/u/0/?shva=1#inbox", "hxxp://www.technicalypto.com/2010/02/thoughtworks-mass-rovers-coding-problem.html", "hxxp://united-coders.com/christian-harms/snow-is-falling-code-puzzle/", "hxxp://crack-coding-interview.blogspot.in/2012/07/crack-thoughtworks.html", "hxxp://blog.kriskemper.com/2009/03/20/some-tips-on-the-thoughtworks-interview-process/", "https://www.google.co.in/?gws_rd=cr#sclient=psy-ab&q=thoughtworks+coding+answers&oq=thoughtworks+answers&gs_l=hp.3.1.0i22i30l4.1874.10966.0.12765.32.26.5.0.0.0.335.6084.0j3j20j3.26.0....0...1c.1.23.psy-ab..7.25.5331.iByH4R3fVxE&pbx=1&fp=280afe038fdc735e&biw=1920&bih=945&bav=on.2,or.r_cp.r_qf.&cad=b&bvm=pv.xjs.s.en_US.jOYpRJj4zMA.O%2Cpv.xjs.s.en_US.jOYpRJj4zMA.O", "hxxp://www.scribd.com/doc/67457315/Thought-Works-Placement-Paper"
CHR DefaultSearchKeyword: google.co.in
CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\PepperFlash\pepflashplayer.dll ()
CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\ppGoogleNaClPluginChrome.dll ()
CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\34.0.1847.131\pdf.dll ()
CHR Plugin: (Adobe Acrobat) - C:\Program Files\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Microsoft Office 2013) - C:\Program Files\Mozilla Firefox\plugins\npMeetingJoinPluginOC.dll (Microsoft Corporation)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll (Apple Inc.)
CHR Plugin: (QuickTime Plug-in 7.7.4) - C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll (Apple Inc.)
CHR Plugin: (Microsoft Office 2013) - C:\PROGRA~1\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll No File
CHR Plugin: (Java™ Platform SE 7 U25) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
CHR Plugin: (Silverlight Plug-In) - C:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll No File
CHR Plugin: (Nokia Suite Enabler Plugin) - C:\Program Files\Nokia\Nokia Suite\npNokiaSuiteEnabler.dll ( )
CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
CHR Plugin: (Shockwave for Director) - C:\Windows\system32\Adobe\Director\np32dsw_1202122.dll No File
CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
CHR Plugin: (Java Deployment Toolkit 7.0.250.16) - C:\Windows\system32\npDeployJava1.dll No File
CHR Plugin: (Picasa) - D:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
CHR Plugin: (iTunes Application Detector) - D:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
CHR Extension: (Easy Auto Refresh) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\aabcgdmkeabbnleenpncegpcngjpnjkc [2014-05-25]
CHR Extension: (Google Docs) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2013-07-02]
CHR Extension: (Google Drive) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2013-07-02]
CHR Extension: (Kaboom) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\beahobhgpojnjfdjglaehfhdanaioode [2014-04-19]
CHR Extension: (YouTube) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-07-02]
CHR Extension: (Google Search) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-07-02]
CHR Extension: (Logitech Smooth Scrolling) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\dkpejdfnpdkhifgbancbammdijojoffk [2013-07-20]
CHR Extension: (APK Downloader) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdpglblnnaocjhfenhockgamhoogihfi [2013-09-09]
CHR Extension: (IDM Integration Module) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\jeaohhlajejodfjadcponpnjgkiikocn [2013-08-07]
CHR Extension: (Skype Click to Call) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl [2013-08-30]
CHR Extension: (Google Wallet) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-08-23]
CHR Extension: (YouTube Unblocker) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\npnkeeiehehhefofiekoflfedgehcdhl [2013-07-18]
CHR Extension: (Gmail) - C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-07-02]
CHR HKLM\...\Chrome\Extension: [jeaohhlajejodfjadcponpnjgkiikocn] - C:\Program Files\Internet Download Manager\IDMGCExt.crx [2014-05-15]
CHR HKLM\...\Chrome\Extension: [lifbcibllhkdhoafpjfnlhfpfgnpldfl] - C:\Program Files\Skype\Toolbars\Skype for Chromium\skype_chrome_extension.crx [2013-10-09]
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION

========================== Services (Whitelisted) =================

S3 AppleChargerSrv; C:\Windows\System32\AppleChargerSrv.exe [31272 2010-04-06] ()
S4 BRSptSvc; C:\ProgramData\BitRaider\BRSptSvc.exe [938776 2013-05-04] (BitRaider, LLC)
S2 BstHdAndroidSvc; C:\Program Files\BlueStacks\HD-Service.exe [393032 2013-04-11] (BlueStack Systems, Inc.)
S2 BstHdLogRotatorSvc; C:\Program Files\BlueStacks\HD-LogRotatorService.exe [384840 2013-04-11] (BlueStack Systems, Inc.)
S4 Fabs; C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe [1840128 2011-05-24] (MAGIX AG)
S4 FirebirdServerMAGIXInstance; C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe [2702848 2011-04-26] (MAGIX®)
S3 FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [1044816 2013-11-26] (Flexera Software, Inc.)
R2 ftpsvc; C:\Windows\system32\inetsrv\ftpsvc.dll [309760 2010-11-21] (Microsoft Corporation)
S3 GSService; C:\Windows\system32\GSService.exe [249856 2012-01-23] ()
R2 IISADMIN; C:\Windows\system32\inetsrv\inetinfo.exe [13824 2009-07-14] (Microsoft Corporation)
S4 KinoniRemoteDesktop; C:\Program Files\Kinoni\Remote Desktop\service.exe [405896 2013-03-27] ()
S2 MBAMScheduler; C:\Program Files\Malwarebytes Anti-Malware\mbamscheduler.exe [1809720 2014-04-03] (Malwarebytes Corporation)
S2 MBAMService; C:\Program Files\Malwarebytes Anti-Malware\mbamservice.exe [857912 2014-04-03] (Malwarebytes Corporation)
R2 MsDtsServer; C:\Program Files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [199384 2005-10-14] (Microsoft Corporation)
S4 msftesql; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe [92880 2005-08-26] (Microsoft Corporation)
S4 MSSQLSERVER; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [28768528 2005-10-14] (Microsoft Corporation)
S4 MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe [45272 2005-10-14] (Microsoft Corporation)
R2 MSSQLServerOLAPService; C:\Program Files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe [14557912 2005-10-14] (Microsoft Corporation)
S4 msvsmon80; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2799808 2005-09-23] (Microsoft Corporation)
R2 NuTCRACKERService; C:\Windows\system32\nutsrv4.exe [277272 2001-01-02] (DataFocus, Inc.)
S4 Skype C2C Service; C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [3289208 2013-04-15] (Skype Technologies S.A.)
S3 SMServer; C:\Windows\system32\snmvtsvc.exe [244224 2012-01-23] (SMServer)
S4 SQLSERVERAGENT; C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\SQLAGENT90.EXE [318680 2005-10-14] (Microsoft Corporation)
R2 TuneUp.UtilitiesSvc; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesService32.exe [1740600 2013-08-29] (TuneUp Software)
S4 VMAuthdService; D:\Program Files\Vmware\vmware-authd.exe [79872 2012-08-15] (VMware, Inc.)
S4 VMnetDHCP; C:\Windows\system32\vmnetdhcp.exe [357016 2012-08-15] (VMware, Inc.)
S4 VMUSBArbService; C:\Program Files\Common Files\VMware\USB\vmware-usbarbitrator.exe [719512 2012-08-01] (VMware, Inc.)
S4 VMware NAT Service; C:\Windows\system32\vmnat.exe [435864 2012-08-15] (VMware, Inc.)
S4 VMwareHostd; D:\Program Files\Vmware\vmware-hostd.exe [15680000 2012-08-15] ()

==================== Drivers (Whitelisted) ====================

S3 androidusb; C:\Windows\System32\Drivers\wsadb.sys [34720 2014-01-11] (Google Inc)
R1 AppleCharger; C:\Windows\System32\DRIVERS\AppleCharger.sys [18544 2011-01-10] ()
R2 BstHdDrv; C:\Program Files\BlueStacks\HD-Hypervisor-x86.sys [63816 2013-04-11] (BlueStack Systems)
R3 BthAvrcp; C:\Windows\System32\DRIVERS\BthAvrcp.sys [22528 2009-08-13] (CSR, plc)
S3 BthMtpEnum; C:\Windows\System32\DRIVERS\BthMtpEnum.sys [51200 2009-07-14] (Microsoft Corporation)
R3 DbusAudio; C:\Windows\System32\drivers\DbusAudio.sys [23608 2012-01-24] (Windows ® Win 7 DDK provider)
S3 gdrv; C:\Windows\gdrv.sys [17488 2013-05-16] (Windows ® 2000 DDK provider)
R0 giveio; C:\Windows\System32\giveio.sys [5248 1996-04-04] ()
R2 hcmon; C:\Windows\system32\drivers\hcmon.sys [41496 2012-08-01] (VMware, Inc.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2014-04-03] (Malwarebytes Corporation)
R3 MBAMSwissArmy; C:\Windows\system32\drivers\MBAMSwissArmy.sys [107736 2014-05-29] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51416 2014-04-03] (Malwarebytes Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [41088 2010-09-21] (Intel Corporation)
R1 networx; C:\Windows\System32\drivers\networx.sys [52728 2013-01-25] (NetFilterSDK.com)
S3 RwDrv; C:\Windows\system32\Drivers\RwDrv.sys [19240 2013-05-16] ()
R0 speedfan; C:\Windows\System32\speedfan.sys [24184 2012-12-30] (Almico Software)
U3 TrueSight; C:\Windows\system32\TrueSight.sys [26624 2014-05-27] ()
R3 TuneUpUtilitiesDrv; C:\Program Files\TuneUp Utilities 2014\TuneUpUtilitiesDriver32.sys [12320 2013-08-21] (TuneUp Software)
R3 VMnetAdapter; C:\Windows\System32\DRIVERS\vmnetadapter.sys [16664 2012-08-15] (VMware, Inc.)
R2 VMnetBridge; C:\Windows\System32\DRIVERS\vmnetbridge.sys [37016 2012-08-15] (VMware, Inc.)
R2 VMnetuserif; C:\Windows\system32\drivers\vmnetuserif.sys [25752 2012-08-15] (VMware, Inc.)
R2 VMparport; C:\Windows\system32\Drivers\VMparport.sys [23832 2012-08-15] (VMware, Inc.)
S3 vmusb; C:\Windows\System32\Drivers\vmusb.sys [31280 2012-08-01] (VMware, Inc.)
R2 vmx86; C:\Windows\system32\Drivers\vmx86.sys [61848 2012-08-15] (VMware, Inc.)
R0 vsock; C:\Windows\System32\drivers\vsock.sys [61296 2012-07-06] (VMware, Inc.)
R2 vstor2-mntapi10-shared; C:\Windows\System32\drivers\vstor2-mntapi10-shared.sys [22768 2011-07-12] (VMware, Inc.)
S3 WinRing0_1_2_0; C:\Program Files\Razer\Razer Game Booster\Driver\WinRing0.sys [14416 2012-08-01] (OpenLibSys.org)
S3 BRDriver; \??\C:\programdata\bitraider\BRDriver.sys [X]
S3 catchme; \??\C:\Users\inteli3\AppData\Local\Temp\catchme.sys [X]
S1 pbfhsdpm; \??\C:\Windows\system32\drivers\pbfhsdpm.sys [X]
S3 taphss6; system32\DRIVERS\taphss6.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-05-29 20:03 - 2014-05-29 20:04 - 00000000 ____D () C:\FRST
2014-05-27 21:21 - 2014-05-27 21:40 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-27 21:21 - 2014-05-27 21:21 - 00000000 ____D () C:\Program Files\HitmanPro
2014-05-27 21:16 - 2014-05-27 21:16 - 00064109 _____ () C:\Users\inteli3\Desktop\RKreport[0]_S_05272014_211651.txt
2014-05-27 21:13 - 2014-05-27 21:13 - 00064076 _____ () C:\Users\inteli3\Desktop\RKreport[0]_S_05272014_211335.txt
2014-05-27 21:09 - 2014-05-27 21:13 - 00019240 _____ () C:\Windows\system32\Drivers\RwDrv.sys.bak
2014-05-27 21:09 - 2014-05-27 21:09 - 00064038 _____ () C:\Users\inteli3\Desktop\RKreport[0]_S_05272014_210924.txt
2014-05-27 21:07 - 2014-05-27 21:07 - 00064005 _____ () C:\Users\inteli3\Desktop\RKreport[0]_D_05272014_210740.txt
2014-05-27 21:04 - 2014-05-27 21:04 - 00064517 _____ () C:\Users\inteli3\Desktop\RKreport[0]_S_05272014_210438.txt
2014-05-27 21:04 - 2014-05-27 21:04 - 00019240 _____ () C:\Windows\system32\Drivers\RwDrv.sys.dump
2014-05-27 21:04 - 2014-05-27 21:04 - 00000000 ____D () C:\Windows\snack
2014-05-27 21:01 - 2014-05-27 21:07 - 00000000 ____D () C:\Users\inteli3\Desktop\RK_Quarantine
2014-05-27 21:01 - 2014-05-27 21:01 - 00026624 _____ () C:\Windows\system32\TrueSight.sys
2014-05-27 19:56 - 2014-05-27 20:39 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-05-25 14:36 - 2014-05-25 14:36 - 00000000 ____D () C:\Program Files\ESET
2014-05-25 14:28 - 2014-05-25 14:28 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-25 14:17 - 2014-05-04 17:14 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-22 21:20 - 2014-05-28 19:49 - 00031413 _____ () C:\Users\inteli3\Desktop\attach.txt
2014-05-22 21:20 - 2014-05-28 19:49 - 00022153 _____ () C:\Users\inteli3\Desktop\dds.txt
2014-05-21 22:31 - 2014-05-21 22:31 - 00025380 _____ () C:\ComboFix.txt
2014-05-21 22:16 - 2014-05-21 22:31 - 00000000 ____D () C:\Qoobox
2014-05-21 22:16 - 2014-05-21 22:29 - 00000000 ____D () C:\Windows\erdnt
2014-05-21 22:16 - 2011-06-26 12:15 - 00256000 _____ () C:\Windows\PEV.exe
2014-05-21 22:16 - 2010-11-07 22:50 - 00208896 _____ () C:\Windows\MBR.exe
2014-05-21 22:16 - 2009-04-20 10:26 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-05-21 22:16 - 2000-08-31 05:30 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-05-21 22:16 - 2000-08-31 05:30 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-05-21 22:16 - 2000-08-31 05:30 - 00098816 _____ () C:\Windows\sed.exe
2014-05-21 22:16 - 2000-08-31 05:30 - 00080412 _____ () C:\Windows\grep.exe
2014-05-21 22:16 - 2000-08-31 05:30 - 00068096 _____ () C:\Windows\zip.exe
2014-05-21 21:59 - 2014-05-28 19:31 - 00005840 _____ () C:\Windows\PFRO.log
2014-05-21 20:57 - 2014-05-21 20:57 - 00002760 _____ () C:\Users\inteli3\Desktop\Rkill.txt
2014-05-21 20:57 - 2014-05-21 20:57 - 00000000 ____D () C:\Users\inteli3\Desktop\rkill
2014-05-19 20:37 - 2014-05-29 19:40 - 00000784 _____ () C:\Windows\setupact.log
2014-05-19 20:37 - 2014-05-19 20:37 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-15 17:15 - 2013-11-28 05:54 - 00108000 _____ (Tonec Inc.) C:\Windows\system32\Drivers\idmwfp.sys
2014-05-13 21:37 - 2014-05-13 21:48 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\.purple
2014-05-13 21:37 - 2014-05-13 21:37 - 00000953 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pidgin.lnk
2014-05-13 21:37 - 2014-05-13 21:37 - 00000941 _____ () C:\Users\Public\Desktop\Pidgin.lnk
2014-05-13 21:37 - 2014-05-13 21:37 - 00000000 ____D () C:\Program Files\Pidgin
2014-05-11 18:44 - 2014-05-12 20:01 - 00001975 _____ () C:\Users\inteli3\Desktop\Google Chrome.lnk
2014-05-11 16:13 - 2014-05-29 19:40 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-11 16:13 - 2014-05-11 16:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-10 12:32 - 2014-05-11 17:55 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-09 22:12 - 2014-05-25 15:24 - 00000000 ____D () C:\Program Files\lclefphm
2014-05-09 21:59 - 2014-05-09 21:59 - 00001205 _____ () C:\Users\Public\Desktop\Wondershare MobileTrans.lnk
2014-05-09 21:59 - 2014-05-09 21:59 - 00000000 ____D () C:\Program Files\Wondershare
2014-05-03 15:12 - 2014-05-03 15:12 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-05-03 15:12 - 2014-05-03 15:12 - 00000000 ____D () C:\ProgramData\ATI
2014-05-03 15:11 - 2014-05-03 15:11 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\library_dir
2014-05-03 15:08 - 2014-05-03 15:15 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\Raptr
2014-05-03 15:08 - 2014-05-03 15:11 - 00000000 ____D () C:\Program Files\Raptr
2014-05-03 15:06 - 2014-05-03 15:06 - 00054322 _____ () C:\Windows\system32\CCCInstall_201405031506421212.log
2014-05-03 15:06 - 2014-05-03 15:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-03 15:06 - 2014-05-03 15:06 - 00000000 ____D () C:\Program Files\AMD AVT
2014-05-03 14:56 - 2014-05-03 14:56 - 00000000 ____D () C:\AMD

==================== One Month Modified Files and Folders =======

2014-05-29 20:04 - 2014-05-29 20:03 - 00000000 ____D () C:\FRST
2014-05-29 19:59 - 2013-01-31 21:13 - 01984763 _____ () C:\Windows\WindowsUpdate.log
2014-05-29 19:48 - 2009-07-14 10:04 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-05-29 19:48 - 2009-07-14 10:04 - 00026352 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-05-29 19:44 - 2014-03-30 18:34 - 00000000 ___RD () C:\Users\inteli3\Dropbox
2014-05-29 19:42 - 2013-02-01 20:42 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\Dropbox
2014-05-29 19:42 - 2009-07-14 08:07 - 00000000 ____D () C:\Windows\system32\inetsrv
2014-05-29 19:41 - 2014-04-20 13:42 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-05-29 19:41 - 2013-02-01 20:35 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\BitTorrent
2014-05-29 19:40 - 2014-05-19 20:37 - 00000784 _____ () C:\Windows\setupact.log
2014-05-29 19:40 - 2014-05-11 16:13 - 00000884 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-05-29 19:40 - 2009-07-14 10:23 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-05-29 06:45 - 2013-02-01 19:30 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\DMCache
2014-05-28 19:49 - 2014-05-22 21:20 - 00031413 _____ () C:\Users\inteli3\Desktop\attach.txt
2014-05-28 19:49 - 2014-05-22 21:20 - 00022153 _____ () C:\Users\inteli3\Desktop\dds.txt
2014-05-28 19:31 - 2014-05-21 21:59 - 00005840 _____ () C:\Windows\PFRO.log
2014-05-27 22:43 - 2014-04-19 22:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
2014-05-27 22:43 - 2013-02-09 19:57 - 00002685 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-05-27 22:43 - 2013-02-09 19:57 - 00000000 ____D () C:\ProgramData\Skype
2014-05-27 21:40 - 2014-05-27 21:21 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-05-27 21:21 - 2014-05-27 21:21 - 00000000 ____D () C:\Program Files\HitmanPro
2014-05-27 21:16 - 2014-05-27 21:16 - 00064109 _____ () C:\Users\inteli3\Desktop\RKreport[0]_S_05272014_211651.txt
2014-05-27 21:13 - 2014-05-27 21:13 - 00064076 _____ () C:\Users\inteli3\Desktop\RKreport[0]_S_05272014_211335.txt
2014-05-27 21:13 - 2014-05-27 21:09 - 00019240 _____ () C:\Windows\system32\Drivers\RwDrv.sys.bak
2014-05-27 21:12 - 2013-02-01 19:30 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\IDM
2014-05-27 21:09 - 2014-05-27 21:09 - 00064038 _____ () C:\Users\inteli3\Desktop\RKreport[0]_S_05272014_210924.txt
2014-05-27 21:07 - 2014-05-27 21:07 - 00064005 _____ () C:\Users\inteli3\Desktop\RKreport[0]_D_05272014_210740.txt
2014-05-27 21:07 - 2014-05-27 21:01 - 00000000 ____D () C:\Users\inteli3\Desktop\RK_Quarantine
2014-05-27 21:04 - 2014-05-27 21:04 - 00064517 _____ () C:\Users\inteli3\Desktop\RKreport[0]_S_05272014_210438.txt
2014-05-27 21:04 - 2014-05-27 21:04 - 00019240 _____ () C:\Windows\system32\Drivers\RwDrv.sys.dump
2014-05-27 21:04 - 2014-05-27 21:04 - 00000000 ____D () C:\Windows\snack
2014-05-27 21:01 - 2014-05-27 21:01 - 00026624 _____ () C:\Windows\system32\TrueSight.sys
2014-05-27 20:43 - 2010-11-21 02:31 - 01098138 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-05-27 20:39 - 2014-05-27 19:56 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\48230029.sys
2014-05-25 21:54 - 2013-02-21 20:42 - 00000775 _____ () C:\Users\inteli3\Desktop\Brrips to dded.txt
2014-05-25 15:24 - 2014-05-09 22:12 - 00000000 ____D () C:\Program Files\lclefphm
2014-05-25 15:24 - 2013-09-07 12:56 - 00000000 ____D () C:\Program Files\Attribute Changer
2014-05-25 15:24 - 2013-05-12 01:57 - 00000000 ____D () C:\Program Files\DRMBuster
2014-05-25 15:24 - 2013-03-31 15:48 - 00000000 ____D () C:\Program Files\Unlocker
2014-05-25 15:24 - 2013-02-26 19:46 - 00000000 ____D () C:\Program Files\MPC-HC
2014-05-25 15:24 - 2013-02-03 13:32 - 00000000 ____D () C:\Program Files\MagicISO
2014-05-25 15:24 - 2013-02-03 13:28 - 00000000 ____D () C:\Program Files\MagicDisc
2014-05-25 15:24 - 2013-02-01 20:42 - 00000000 ____D () C:\Program Files\Notepad++
2014-05-25 15:24 - 2013-02-01 20:08 - 00000000 ____D () C:\Program Files\foobar2000
2014-05-25 15:24 - 2013-02-01 19:30 - 00000000 ____D () C:\Program Files\Internet Download Manager
2014-05-25 14:36 - 2014-05-25 14:36 - 00000000 ____D () C:\Program Files\ESET
2014-05-25 14:28 - 2014-05-25 14:28 - 00000000 ____D () C:\ProgramData\Spybot - Search & Destroy
2014-05-25 11:20 - 2013-06-23 13:30 - 00000000 ____D () C:\Program Files\QuickTime
2014-05-23 22:11 - 2013-02-01 19:40 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\vlc
2014-05-23 21:34 - 2009-07-14 10:22 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2014-05-23 20:08 - 2013-02-01 20:08 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\foobar2000
2014-05-23 19:42 - 2013-03-14 19:14 - 00000000 ____D () C:\Program Files\MiniLyrics
2014-05-22 23:04 - 2013-02-01 21:43 - 00000000 ____D () C:\Program Files\Adobe
2014-05-21 22:31 - 2014-05-21 22:31 - 00025380 _____ () C:\ComboFix.txt
2014-05-21 22:31 - 2014-05-21 22:16 - 00000000 ____D () C:\Qoobox
2014-05-21 22:31 - 2009-07-14 08:07 - 00000000 __RHD () C:\Users\Default
2014-05-21 22:31 - 2009-07-14 08:07 - 00000000 ___RD () C:\Users\Public
2014-05-21 22:29 - 2014-05-21 22:16 - 00000000 ____D () C:\Windows\erdnt
2014-05-21 22:26 - 2009-07-14 07:34 - 00000215 _____ () C:\Windows\system.ini
2014-05-21 21:59 - 2009-07-14 08:07 - 00000000 ____D () C:\Windows\Vss
2014-05-21 20:57 - 2014-05-21 20:57 - 00002760 _____ () C:\Users\inteli3\Desktop\Rkill.txt
2014-05-21 20:57 - 2014-05-21 20:57 - 00000000 ____D () C:\Users\inteli3\Desktop\rkill
2014-05-19 21:53 - 2013-01-31 21:20 - 00000000 ____D () C:\Users\inteli3
2014-05-19 20:37 - 2014-05-19 20:37 - 00000000 _____ () C:\Windows\setuperr.log
2014-05-18 21:45 - 2013-11-18 14:39 - 00003129 _____ () C:\Users\inteli3\Desktop\Shortcut to SecureDownloadManager.exe.lnk
2014-05-18 21:31 - 2013-02-10 00:24 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\FileZilla
2014-05-18 16:36 - 2013-02-01 19:29 - 00692400 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2014-05-18 16:36 - 2013-02-01 19:29 - 00070832 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2014-05-18 10:53 - 2013-04-07 12:46 - 00000000 ____D () C:\Dev-Cpp
2014-05-18 10:00 - 2013-02-01 20:26 - 00000000 ____D () C:\Program Files\Opera
2014-05-18 10:00 - 2009-07-14 10:23 - 00032656 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-05-17 21:40 - 2013-11-11 22:57 - 00000983 _____ () C:\Users\inteli3\Desktop\Internet Download Manager.lnk
2014-05-17 21:34 - 2013-02-01 21:43 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2014-05-17 21:33 - 2013-04-11 21:59 - 00000000 ____D () C:\Program Files\Speccy
2014-05-17 21:09 - 2013-02-08 21:01 - 00000000 ____D () C:\Program Files\7-Zip
2014-05-17 20:05 - 2013-03-14 19:14 - 00000000 ____D () C:\Lyrics
2014-05-17 20:04 - 2013-03-14 19:14 - 00001025 _____ () C:\Users\Public\Desktop\MiniLyrics.lnk
2014-05-17 20:04 - 2013-03-14 19:14 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MiniLyrics
2014-05-17 19:59 - 2013-03-14 19:14 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\MiniLyrics
2014-05-17 09:00 - 2013-02-01 20:45 - 00001024 _____ () C:\Users\inteli3\Desktop\Dropbox.lnk
2014-05-17 09:00 - 2013-02-01 20:43 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Dropbox
2014-05-16 20:02 - 2013-04-17 23:56 - 00000000 ____D () C:\Program Files\BlueStacks
2014-05-13 21:48 - 2014-05-13 21:37 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\.purple
2014-05-13 21:37 - 2014-05-13 21:37 - 00000953 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Pidgin.lnk
2014-05-13 21:37 - 2014-05-13 21:37 - 00000941 _____ () C:\Users\Public\Desktop\Pidgin.lnk
2014-05-13 21:37 - 2014-05-13 21:37 - 00000000 ____D () C:\Program Files\Pidgin
2014-05-12 21:58 - 2013-02-01 20:09 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Picasa 3
2014-05-12 20:33 - 2013-02-14 16:59 - 00000000 ____D () C:\UniScan
2014-05-12 20:01 - 2014-05-11 18:44 - 00001975 _____ () C:\Users\inteli3\Desktop\Google Chrome.lnk
2014-05-11 17:55 - 2014-05-10 12:32 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2014-05-11 16:13 - 2014-05-11 16:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome
2014-05-11 16:13 - 2013-02-01 20:09 - 00000000 ____D () C:\Program Files\Google
2014-05-09 23:38 - 2013-11-26 13:29 - 00000000 ____D () C:\Users\inteli3\AppData\Local\Autodesk
2014-05-09 23:38 - 2013-11-26 13:18 - 00000000 ____D () C:\Program Files\Common Files\Autodesk Shared
2014-05-09 23:36 - 2013-11-26 13:23 - 00000000 ____D () C:\Program Files\Autodesk
2014-05-09 23:36 - 2013-11-26 13:22 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Autodesk
2014-05-09 22:31 - 2013-08-22 12:38 - 00000000 ____D () C:\Users\inteli3\Documents\Wondershare
2014-05-09 22:00 - 2009-07-14 08:07 - 00000000 ____D () C:\Windows\Microsoft.NET
2014-05-09 21:59 - 2014-05-09 21:59 - 00001205 _____ () C:\Users\Public\Desktop\Wondershare MobileTrans.lnk
2014-05-09 21:59 - 2014-05-09 21:59 - 00000000 ____D () C:\Program Files\Wondershare
2014-05-09 21:59 - 2013-08-22 12:29 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\Wondershare
2014-05-09 21:59 - 2013-08-22 12:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wondershare
2014-05-04 17:14 - 2014-05-25 14:17 - 90547776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-05-03 15:15 - 2014-05-03 15:08 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\Raptr
2014-05-03 15:12 - 2014-05-03 15:12 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\AMD Gaming Evolved
2014-05-03 15:12 - 2014-05-03 15:12 - 00000000 ____D () C:\ProgramData\ATI
2014-05-03 15:11 - 2014-05-03 15:11 - 00000000 ____D () C:\Users\inteli3\AppData\Roaming\library_dir
2014-05-03 15:11 - 2014-05-03 15:08 - 00000000 ____D () C:\Program Files\Raptr
2014-05-03 15:06 - 2014-05-03 15:06 - 00054322 _____ () C:\Windows\system32\CCCInstall_201405031506421212.log
2014-05-03 15:06 - 2014-05-03 15:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD Catalyst Control Center
2014-05-03 15:06 - 2014-05-03 15:06 - 00000000 ____D () C:\Program Files\AMD AVT
2014-05-03 15:06 - 2013-01-31 21:39 - 00000000 ____D () C:\ProgramData\AMD
2014-05-03 15:06 - 2013-01-31 21:38 - 00000000 ____D () C:\Program Files\ATI Technologies
2014-05-03 14:56 - 2014-05-03 14:56 - 00000000 ____D () C:\AMD
2014-05-01 19:37 - 2013-07-23 14:48 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
2014-04-30 20:10 - 2013-07-23 14:48 - 00001121 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
2014-04-30 20:10 - 2013-07-23 14:48 - 00001109 _____ () C:\Users\Public\Desktop\Mozilla Firefox.lnk
2014-04-29 20:38 - 2013-05-31 16:42 - 00000600 _____ () C:\Users\inteli3\PUTTY.RND

Files to move or delete:
====================
C:\Users\inteli3\AppData\Roaming\Camdata.ini
C:\Users\inteli3\AppData\Roaming\CamLayout.ini
C:\Users\inteli3\AppData\Roaming\CamShapes.ini


Some content of TEMP:
====================
C:\Users\inteli3\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpkdugld.dll
C:\Users\inteli3\AppData\Local\Temp\ntdll_dump.dll


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\system32\winlogon.exe => MD5 is legit
C:\Windows\system32\wininit.exe => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\services.exe => MD5 is legit
C:\Windows\system32\User32.dll => MD5 is legit
C:\Windows\system32\userinit.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit
C:\Windows\system32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-05-29 00:01

==================== End Of Log ============================

 

 

Additional scan result of Farbar Recovery Scan Tool (x86) Version:25-05-2014 02
Ran by inteli3 at 2014-05-29 20:04:20
Running from D:\Downloads\Programs
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

7-Zip 9.22beta (HKLM\...\7-Zip) (Version:  - )
Adobe AIR (HKLM\...\Adobe AIR) (Version: 3.7.0.1860 - Adobe Systems Incorporated)
Adobe AIR (Version: 3.7.0.1860 - Adobe Systems Incorporated) Hidden
Adobe Flash Player 11 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 11.8.800.94 - Adobe Systems Incorporated)
Adobe Flash Player 13 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 13.0.0.214 - Adobe Systems Incorporated)
Adobe Help Manager (HKLM\...\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1) (Version: 4.0.244 - Adobe Systems Incorporated)
Adobe Help Manager (Version: 4.0.244 - Adobe Systems Incorporated) Hidden
Adobe Reader XI (11.0.07) (HKLM\...\{AC76BA86-7AD7-1033-7B44-AB0000000001}) (Version: 11.0.07 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.1.151 - Adobe Systems, Inc.)
AMD Accelerated Video Transcoding (Version: 13.30.100.40417 - Advanced Micro Devices, Inc.) Hidden
AMD APP SDK Runtime (Version: 10.0.1084.4 - Advanced Micro Devices Inc.) Hidden
AMD Catalyst Control Center (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
AMD Catalyst Install Manager (HKLM\...\{DC7723BE-A2BB-58A0-4820-5630F9B82198}) (Version: 8.0.916.0 - Advanced Micro Devices, Inc.)
AMD Drag and Drop Transcoding (Version: 2.00.0000 - Advanced Micro Devices, Inc.) Hidden
AMD Media Foundation Decoders (Version: 1.0.81206.1620 - Advanced Micro Devices, Inc.) Hidden
AMD Wireless Display v3.0 (Version: 1.0.0.15 - Advanced Micro Devices, Inc.) Hidden
Any Video Converter 5 5.0.3 (HKLM\...\Any Video Converter 5_is1) (Version:  - Any-Video-Converter.com)
Any Video Converter Ultimate 4.6.0 (HKLM\...\Any Video Converter Ultimate_is1) (Version:  - Any-Video-Converter.com)
Apache Tomcat 7.0.34 (HKLM\...\nbi-tomcat-7.0.34.0.0) (Version:  - )
APK Downloader 1.5.1 (HKLM\...\APK Downloader) (Version: 1.5.1 - Evozi)
Apple Application Support (HKLM\...\{5D09C772-ECB3-442B-9CC6-B4341C78FDC2}) (Version: 2.3.4 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{E14ADE0E-75F3-4A46-87E5-26692DD626EC}) (Version: 6.1.0.13 - Apple Inc.)
Apple Software Update (HKLM\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Application Profiles (HKLM\...\{148971EC-8755-A666-D384-8F2E9E8B0DC8}) (Version: 2.0.4854.34117 - Advanced Micro Devices, Inc.)
Application Profiles (HKLM\...\{EBBE64F6-7E23-5857-891F-045560AECC7F}) (Version: 2.0.4674.34053 - Advanced Micro Devices, Inc.)
Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver (HKLM\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 1.0.2.43 - Atheros Communications Inc.)
Attribute Changer 7.10e (HKLM\...\{27263813-8BDE-4CD2-84D3-02536743428A}_is1) (Version: 7.10e - Romain Petges)
Audio File Cutter 3.42 (HKLM\...\Audio File Cutter_is1) (Version:  - Naturpic Software)
Autodesk Backburner 2013.0.0 (HKLM\...\{3D347E6D-5A03-4342-B5BA-6A771885F379}) (Version: 2013.0.0 - Autodesk, Inc.)
Autodesk FBX Plug-in 2013.1 - Maya 2013 (HKLM\...\Autodesk FBX Plug-in 2013.1 - Maya 2013) (Version:  - Autodesk)
Autodesk Maya 2013 32-bit (HKLM\...\Autodesk Maya 2013 32-bit) (Version: 15.0.0.0 - Autodesk)
Autodesk Maya 2013 32-bit (Version: 15.0.0.0 - Autodesk) Hidden
AVS Audio Editor 7.1 (HKLM\...\AVS Audio Editor_is1) (Version:  - Online Media Technologies Ltd.)
AVS Update Manager 1.0 (HKLM\...\AVS Update Manager_is1) (Version:  - Online Media Technologies Ltd.)
AVS4YOU Software Navigator 1.4 (HKLM\...\AVS4YOU Software Navigator_is1) (Version:  - Online Media Technologies Ltd.)
Batman: Arkham City™ GOTY (HKLM\...\GFWL_{57520FA0-DF38-46A1-8046-3B1000008500}) (Version: 1.0.0000.133 - WB Games)
Batman: Arkham City™ GOTY (Version: 1.0.0000.133 - WB Games) Hidden
Belarc Advisor 8.3 (HKLM\...\Belarc Advisor) (Version: 8.3.2.0 - Belarc Inc.)
BitRaider Web Client (HKLM\...\BitRaider Web Client) (Version: 1.1.6.1 - BitRaider, LLC)
BitTorrent (HKCU\...\BitTorrent) (Version: 7.8.2.30489 - BitTorrent Inc.)
BlueStacks App Player (HKLM\...\BlueStacks App Player) (Version: 0.7.11.879 - BlueStack Systems, Inc.)
BlueStacks Notification Center (HKLM\...\{4F8B7A0C-2BC7-4094-B75E-C17B881C8EC9}) (Version: 0.7.11.879 - BlueStack Systems, Inc.)
Bonjour (HKLM\...\{79155F2B-9895-49D7-8612-D92580E0DE5B}) (Version: 3.0.0.10 - Apple Inc.)
CamStudio version 2.7 (HKLM\...\{04B83666-3A62-452B-85D3-70F8117F2329}_is1) (Version: 2.7 - CamStudio Open Source)
Canon LBP2900 (HKLM\...\Canon LBP2900) (Version:  - )
Catalyst Control Center - Branding (Version: 1.00.0000 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Graphics Previews Common (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center InstallProxy (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
Catalyst Control Center Localization All (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Standard (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Chinese Traditional (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Czech (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Danish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Dutch (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help English (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Finnish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help French (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help German (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Greek (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Hungarian (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Italian (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Japanese (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Korean (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Norwegian (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Polish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Portuguese (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Russian (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Spanish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Swedish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Thai (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
CCC Help Turkish (Version: 2014.0417.2225.38446 - Advanced Micro Devices, Inc.) Hidden
ccc-utility (Version: 2014.0417.2226.38446 - Advanced Micro Devices, Inc.) Hidden
CCleaner (HKLM\...\CCleaner) (Version: 4.12 - Piriform)
Cisco Packet Tracer 5.3.2 (HKLM\...\Cisco Packet Tracer 5.3.2_is1) (Version:  - Cisco Systems, Inc.)
CodeBlocks (HKCU\...\CodeBlocks) (Version: 12.11 - The Code::Blocks Team)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version:  - Valve)
CPUID CPU-Z 1.69 (HKLM\...\CPUID CPU-Z_is1) (Version:  - )
CPUID HWMonitor 1.20 (HKLM\...\CPUID HWMonitor_is1) (Version:  - )
Crystal Reports for Visual Studio (Version: 12.51.0.240 - SAP) Hidden
CrystalDiskInfo 5.0.5 (HKLM\...\CrystalDiskInfo_is1) (Version: 5.0.5 - Crystal Dew World)
dBpoweramp Dalet Codec (HKLM\...\dBpoweramp Dalet Codec) (Version: Release 5 - Illustrate)
dBpoweramp DSP Effects (HKLM\...\dBpoweramp DSP Effects) (Version: Release 9 - Illustrate)
dBpoweramp mp3 (Fraunhofer IIS) Codec (HKLM\...\dBpoweramp mp3 (Fraunhofer IIS) Codec) (Version: Release 2a (v4.0.3) - Illustrate)
dBpoweramp Music Converter (HKLM\...\dBpoweramp Music Converter) (Version: Release 14.4 - Illustrate)
dBPoweramp tooLame MP2 codec (HKLM\...\dBPoweramp tooLame MP2 codec) (Version:  - )
dBpoweramp Wave64 Codec (HKLM\...\dBpoweramp Wave64 Codec) (Version:  - )
Dev-C++ 5 beta 9 release (4.9.9.2) (HKLM\...\Dev-C++) (Version:  - )
Dotfuscator Software Services - Community Edition (HKLM\...\{41B31ABE-5A6E-498A-8F28-3BA3B8779A41}) (Version: 5.0.2300.0 - PreEmptive Solutions)
DRMBuster 4.3.3 (HKLM\...\DRMBuster_is1) (Version: 4.3.3 - Ramka Ltd.)
Dropbox (HKCU\...\Dropbox) (Version: 2.6.33 - Dropbox, Inc.)
Dual-Core Optimizer (HKLM\...\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}) (Version: 1.1.4.0169 - AMD)
eReg (Version: 1.20.138.34 - Logitech, Inc.) Hidden
ESET Online Scanner v3 (HKLM\...\ESET Online Scanner) (Version:  - )
Face_Wizard B10.1230.01 (HKLM\...\{E76FCE6B-9999-4250-8C75-B2DA4AD41268}) (Version: 1.00.0000 - Gigabyte)
FarCry 3 version 5.1 (HKLM\...\{B810D852-DFD6-FC3-89A5-CC4D47756DAF}_is1) (Version: 5.1 - Black_Box)
FIFA 13 version 5.1 (HKLM\...\{B810D852-DFD6-FIFA13-89A5-CC4D47756DAF}_is1) (Version: 5.1 - Black_Box)
FileHippo.com Update Checker (HKLM\...\FileHippo.com) (Version:  - )
FileZilla Client 3.8.0 (HKLM\...\FileZilla Client) (Version: 3.8.0 - Tim Kosse)
Firebird SQL Server - MAGIX Edition (HKLM\...\{6C5F8503-55D2-4398-858C-362B7A7AF51C}) (Version: 2.1.31.0 - MAGIX AG)
FlyteDownloadManager version 1.2.3.0 (HKLM\...\FlyteDownloadManager_is1) (Version: 1.2.3.0 - )
Folder Size 2.9.0.0 (HKLM\...\{2DFA85ED-588F-4CE3-A175-29E52C3804A8}_is1) (Version: 2.9.0.0 - MindGems, Inc.)
foobar2000 v1.3.2 (HKLM\...\foobar2000) (Version: 1.3.2 - Peter Pawlowski)
Genymotion version 1.1.0 (HKLM\...\{6D180286-D4DF-40EF-9227-923B9C07C08A}_is1) (Version: 1.1.0 - Genymobile)
GlassFish Server Open Source Edition 4.0 (HKLM\...\nbi-glassfish-mod-4.0.0.89.0) (Version:  - )
Google Chrome (HKLM\...\Google Chrome) (Version: 34.0.1847.131 - Google Inc.)
Google Update Helper (Version: 1.3.24.7 - Google Inc.) Hidden
Hard Disk Sentinel PRO (HKLM\...\Hard Disk Sentinel_is1) (Version:  - HDS)
HD Tune Pro 5.00 (HKLM\...\HD Tune Pro_is1) (Version:  - EFD Software)
HydraVision (Version: 4.2.252.0 - Advanced Micro Devices, Inc.) Hidden
IAM version 2.3 (HKLM\...\Internet Audience Measuring System_is1) (Version: 2.3 - IMRB International)
Icaros 2.2.2 (HKLM\...\Icaros_is1) (Version: 2.2.2.0 - Tabibito Technology)
Intel® Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel® Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1118 - Intel Corporation)
Internet Download Manager (HKLM\...\Internet Download Manager) (Version:  - Tonec Inc.)
iTunes (HKLM\...\{268278CF-FB69-4D98-B70E-BFEC1CDCA225}) (Version: 11.0.2.26 - Apple Inc.)
Java 7 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217045FF}) (Version: 7.0.450 - Oracle)
Java 8 Update 5 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218005FF}) (Version: 8.0.50 - Oracle Corporation)
Java Auto Updater (Version: 2.8.05.13 - Oracle, Inc.) Hidden
Java SE Development Kit 7 Update 25 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0170250}) (Version: 1.7.0.250 - Oracle)
Java™ SE Development Kit 7 Update 3 (HKLM\...\{32A3A4F4-B792-11D6-A78A-00B0D0170030}) (Version: 1.7.0.30 - Oracle)
JavaFX 2.0.3 (HKLM\...\{1111706F-666A-4037-7777-203328764D10}) (Version: 2.0.3 - Oracle Corporation)
JavaFX 2.0.3 SDK (HKLM\...\{2222706F-666A-4037-7777-203328764D10}) (Version: 2.0.3 - Oracle Corporation)
Junkies Client ULTIMATE Version 25.0.0.6 (HKLM\...\{DF64A9F4-94D8-46B4-AF68-DD584CD6DD49}_is1) (Version:  - planetcss.com, Inc.)
Kinoni Remote Desktop 1.16 (HKLM\...\Kinoni Remote Desktop) (Version: 1.16 - Kinoni)
Kundli Chakra 2012 Professional (HKLM\...\Kundli Chakra 2012 Professional_is1) (Version:  - Horizon aarc)
Kundli for Windows (Professional Edition) (HKLM\...\Kundli for Windows (Professional Edition)) (Version:  - )
Logitech SetPoint 6.61 (HKLM\...\sp6) (Version: 6.61.15 - Logitech)
Mad Riders version 1.02 (HKLM\...\{75D84EF7-0D8C-4e70-MADRIDERS-7B42A5D4E0EB}_is1) (Version: 1.02 - Black_Box)
MagicDisc 2.7.106 (HKLM\...\MagicDisc 2.7.106) (Version:  - )
MAGIX Audio Cleaning Lab 2013 (HKLM\...\MAGIX_{E9DDC5F7-A1A2-4CDA-9D4B-26C859C37C88}) (Version: 19.0.0.10 - MAGIX AG)
MAGIX Audio Cleaning Lab 2013 (Version: 19.0.0.10 - MAGIX AG) Hidden
MAGIX Content and Soundpools (HKLM\...\MAGIX_GlobalContent) (Version: 1.0.0.0 - MAGIX AG)
MAGIX Music Maker 2013 Premium (HKLM\...\MAGIX_{D3C4E671-523F-417B-9E5F-44B575C2F470}) (Version: 19.0.3.47 - MAGIX AG)
MAGIX Music Maker 2013 Premium (Version: 19.0.3.47 - MAGIX AG) Hidden
MAGIX Music Maker 2013 Premium Update (Version: 19.0.5.57 - MAGIX AG) Hidden
MAGIX Music Maker 2013 Trial Soundpools (Version: 1.0.0.0 - MAGIX AG) Hidden
MAGIX Speed burnR (MSI) (HKLM\...\MAGIX_{157F34BF-86BC-4DCE-BB97-DA306712BD81}) (Version: 7.0.1.27 - MAGIX AG)
MAGIX Speed burnR (MSI) (Version: 7.0.1.27 - MAGIX AG) Hidden
Malwarebytes Anti-Malware version 2.0.1.1004 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.1.1004 - Malwarebytes Corporation)
Max Payne 3 version 1.02 (HKLM\...\{75D84EF7-0D8C-4e70-MAXP3-7B42A5D4E0EB}_is1) (Version: 1.02 - Black_Box)
MediaInfo 0.7.64 (HKLM\...\MediaInfo) (Version: 0.7.64 - MediaArea.net)
Microsoft .NET Framework 4 Multi-Targeting Pack (HKLM\...\{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50709 - Microsoft Corporation)
Microsoft .NET Framework 4.5 (Version: 4.5.50709 - Microsoft Corporation) Hidden
Microsoft Access MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Access Setup Metadata MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6012.5000 - Microsoft Corporation) Hidden
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools (HKLM\...\{40416836-56CC-4C0E-A6AF-5C34BADCE483}) (Version: 2.0.50217.0 - Microsoft Corporation)
Microsoft ASP.NET MVC 2 (HKLM\...\{1803A630-3C38-4D2B-9B9A-0CB37243539C}) (Version: 2.0.50217.0 - Microsoft Corporation)
Microsoft DCF MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Excel MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Games for Windows - LIVE Redistributable (HKLM\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Groove MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Help Viewer 1.0 (HKLM\...\Microsoft Help Viewer 1.0) (Version: 1.0.30319 - Microsoft Corporation)
Microsoft Help Viewer 1.0 (Version: 1.0.30319 - Microsoft Corporation) Hidden
Microsoft InfoPath MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Lync MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office 2003 Web Components (HKLM\...\{90A40409-6000-11D3-8CFE-0150048383C9}) (Version: 11.0.6558.0 - Microsoft Corporation)
Microsoft Office OSM MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office OSM UX MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2013 (HKLM\...\Office15.PROPLUS) (Version: 15.0.4420.1017 - Microsoft Corporation)
Microsoft Office Professional Plus 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - English (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Proofing Tools 2013 - Español (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Office Shared Setup Metadata MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft OneNote MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Outlook MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft PowerPoint MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Publisher MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft Report Viewer Redistributable 2005 (HKLM\...\Microsoft Report Viewer Redistributable 2005) (Version:  - Microsoft Corporation)
Microsoft Report Viewer Redistributable 2005 (Version: 8.0.50727.42 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30214.0 - Microsoft Corporation)
Microsoft Silverlight 3 SDK (HKLM\...\{2012098D-EEE9-4769-8DD3-B038050854D4}) (Version: 3.0.40818.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2015.0811 - Microsoft Corporation)
Microsoft SQL Server 2005 (HKLM\...\Microsoft SQL Server 2005) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2005 (Version: 9.00.1399.06 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Analysis Services (Version: 9.00.1399.06 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Backward compatibility (HKLM\...\{96327C3C-96BE-4C7A-A6F7-A71635E5949A}) (Version: 8.05.1054 - Microsoft Corporation)
Microsoft SQL Server 2005 Books Online (English) (HKLM\...\{0B43A744-B1B8-4089-9BD1-9D41C7EC0AA3}) (Version: 9.00.1399.06 - Microsoft Corporation)
Microsoft SQL Server 2005 Integration Services (Version: 9.00.1399.06 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Notification Services (Version: 9.00.1399.06 - Microsoft Corporation) Hidden
Microsoft SQL Server 2005 Tools (Version: 9.00.1399.06 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 (HKLM\...\Microsoft SQL Server 10 Release) (Version:  - Microsoft Corporation)
Microsoft SQL Server 2008 (Version:  - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Browser (HKLM\...\{C688457E-03FD-4941-923B-A27F4D42A7DD}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Common Files (Version: 10.0.1600.22 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Common Files (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Database Engine Services (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Database Engine Shared (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Native Client (HKLM\...\{4F44B5AE-82A6-4A8A-A3E3-E24D489728E3}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Data-Tier Application Framework (HKLM\...\{0DDCEC37-369C-484B-B16D-B4413FD42FB9}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Data-Tier Application Project (HKLM\...\{E5AE9031-79A5-4627-9641-BEFA82819B08}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Management Objects (HKLM\...\{4E968D9C-21A7-4915-B698-F7AEB913541D}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server 2008 R2 Transact-SQL Language Service (HKLM\...\{78C3657E-742C-40B1-9F53-E5A921D40F17}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server 2008 RsFx Driver (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
Microsoft SQL Server 2008 Setup Support Files  (HKLM\...\{D441BD04-E548-4F8E-97A4-1B66135BAAA8}) (Version: 10.1.2731.0 - Microsoft Corporation)
Microsoft SQL Server 2008 Setup Support Files RC0 (English) (HKLM\...\{7D3F6746-94DE-4E1F-94F9-933B68EB68C4}) (Version: 10.0.1442.32 - Microsoft Corporation)
Microsoft SQL Server Compact 3.5 SP2 ENU (HKLM\...\{3A9FC03D-C685-4831-94CF-4EDFD3749497}) (Version: 3.5.8080.0 - Microsoft Corporation)
Microsoft SQL Server Database Publishing Wizard 1.4 (HKLM\...\{ACE28263-76A4-4BF5-B6F4-8BD719595969}) (Version: 10.1.2512.8 - Microsoft Corporation)
Microsoft SQL Server Native Client (HKLM\...\{BF251EAF-8697-4E89-BF09-C998F97BBC40}) (Version: 9.00.1399.06 - Microsoft Corporation)
Microsoft SQL Server Setup Support Files (English) (HKLM\...\{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}) (Version: 9.00.1399.06 - Microsoft Corporation)
Microsoft SQL Server System CLR Types (HKLM\...\{2A2F3AE8-246A-4252-BB26-1BEB45627074}) (Version: 10.50.1447.4 - Microsoft Corporation)
Microsoft SQL Server VSS Writer (HKLM\...\{B857D868-F8B0-43EE-BC2B-D9E5ED21F237}) (Version: 10.1.2531.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 SP1 (x86) (HKLM\...\{C6DD625F-4B61-4561-8286-87CA0275CEA1}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework SDK v1.0 SP1 (HKLM\...\{97CE8B73-AA5A-4987-A1BE-50DD1A187478}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 SP1 (x86) (HKLM\...\{F990B526-8F7C-46E0-B1F1-6C893A8B478F}) (Version: 1.0.3010.0 - Microsoft Corporation)
Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) (HKLM\...\{DC3D6AFB-78B4-489F-81D7-30B66E0C2417}) (Version: 2.0.3010.0 - Microsoft Corporation)
Microsoft Team Foundation Server 2010 Object Model - ENU (HKLM\...\Microsoft Team Foundation Server 2010 Object Model - ENU) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Team Foundation Server 2010 Object Model - ENU (Version: 10.0.30319 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version:  - )
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319 (HKLM\...\{6A86554B-8928-30E4-A53C-D7337689134D}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 (HKLM\...\{22154f09-719a-4619-bb71-5b3356999fbf}) (Version: 11.0.50727.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 (HKLM\...\{8e70e4e1-06d7-470b-9f74-a51bef21088e}) (Version: 11.0.51106.1 - Microsoft Corporation)
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 (Version: 11.0.50727 - Microsoft Corporation) Hidden
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 (Version: 11.0.51106 - Microsoft Corporation) Hidden
Microsoft Visual F# 2.0 Runtime (HKLM\...\{729A3000-BC8A-3B74-BA5D-5068FE12D70C}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2005 Premier Partner Edition - ENU (HKLM\...\{C25EF637-BE7A-4761-9B45-9069989C319F}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools (HKLM\...\{14DD7530-CCD2-3798-B37D-3839ED6A441C}) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Office Developer Tools (x86) (Version: 10.0.30319 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Professional - ENU (HKLM\...\Microsoft Visual Studio 2010 Professional - ENU) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Professional - ENU (Version: 10.0.30319 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 SharePoint Developer Tools (Version: 10.0.30319 - Microsoft Corporation) Hidden
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x86)) (Version: 10.0.30319 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x86) (Version: 10.0.30319 - Microsoft Corporation) Hidden
Microsoft Visual Studio Macro Tools (HKLM\...\Microsoft Visual Studio Macro Tools) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual Studio Macro Tools (Version: 9.0.30729 - Microsoft Corporation) Hidden
Microsoft Word MUI (English) 2013 (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
Microsoft_VC100_CRT_SP1_x86 (Version: 10.0.40219.1 - Nokia) Hidden
Microsoft_VC80_CRT_x86 (Version: 8.0.50727.4053 - Adobe) Hidden
Microsoft_VC90_CRT_x86 (Version: 1.00.0000 - Adobe) Hidden
MiniLyrics (HKLM\...\MiniLyrics) (Version: 7.6.44 - Crintsoft) <==== ATTENTION
MKS Platform Components 7.x (HKLM\...\MKS Platform Components 7.x) (Version:  - )
Mozilla Firefox 29.0 (x86 en-US) (HKLM\...\Mozilla Firefox 29.0 (x86 en-US)) (Version: 29.0 - Mozilla)
Mozilla Firefox 29.0.1 (x86 en-US) (HKCU\...\Mozilla Firefox 29.0.1 (x86 en-US)) (Version: 29.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mp3tag v2.56 (HKLM\...\Mp3tag) (Version: v2.56 - Florian Heidenreich)
MPC-HC 1.6.4.6052 (HKLM\...\{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1) (Version: 1.6.4.6052 - MPC-HC Team)
MSVC80_x86_v2 (Version: 1.0.3.0 - Nokia) Hidden
MSVC90_x86 (Version: 1.0.1.2 - Nokia) Hidden
MSXML 4.0 SP3 Parser (HKLM\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
NetBeans IDE 7.3.1 (HKLM\...\nbi-nb-base-7.3.1.0.201306052037) (Version: 7.3.1 - NetBeans.org)
NetWorx 5.2.8 (HKLM\...\NetWorx_is1) (Version:  - Softperfect Research)
NirSoft DownTester (HKLM\...\NirSoft DownTester) (Version:  - )
NirSoft VideoCacheView (HKLM\...\NirSoft VideoCacheView) (Version:  - )
Nokia Connectivity Cable Driver (HKLM\...\{29373274-977E-413C-A4DE-DC0F8E80C429}) (Version: 7.1.172.0 - Nokia)
Nokia Suite (HKLM\...\Nokia Suite) (Version: 3.8.30.0 - Nokia)
Nokia Suite (Version: 3.8.30.0 - Nokia) Hidden
Notepad++ (HKLM\...\Notepad++) (Version: 6.5.5 - Notepad++ Team)
ON_OFF Charge B11.0110.1 (HKLM\...\{3DECD372-76A1-4483-BF10-B547790A3261}) (Version: 1.00.0001 - GIGABYTE)
Opera Stable 21.0.1432.67 (HKLM\...\Opera 21.0.1432.67) (Version: 21.0.1432.67 - Opera Software ASA)
Oracle VM VirtualBox 4.2.16 (HKLM\...\{3B2A7E23-AC7E-46BB-B725-65C555F8FFC5}) (Version: 4.2.16 - Oracle Corporation)
Outils de vérification linguistique 2013 de Microsoft Office - Français (Version: 15.0.4420.1017 - Microsoft Corporation) Hidden
PC Connectivity Solution (HKLM\...\{6D01D1B1-17BD-4F10-BB11-F08F0C47D42B}) (Version: 12.0.109.0 - Nokia)
PDF Settings CS6 (Version: 11.0 - Adobe Systems Incorporated) Hidden
Picasa 3 (HKLM\...\Picasa 3) (Version: 3.9 - Google, Inc.)
Pidgin (HKLM\...\Pidgin) (Version: 2.10.9 - )
Q-Share Ver.1.2 (HKLM\...\{F308B531-AB20-4A79-8F5E-83071FE5BE60}) (Version: 1.2 - GIGABYTE)
QuickTime (HKLM\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Rainmeter (HKLM\...\Rainmeter) (Version: 2.5 r1842 - )
Raptr (HKLM\...\Raptr) (Version:  - )
Rational Rose Enterprise Edition (HKLM\...\Rose98i) (Version:  - )
Razer Game Booster (HKLM\...\Razer Game Booster_is1) (Version: 3.6 - Razer USA Ltd)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6387 - Realtek Semiconductor Corp.)
Revo Uninstaller Pro 2.5.8 (HKLM\...\Revo Uninstaller Pro_is1) (Version: 2.5.8 - )
Rockstar Games Social Club (HKLM\...\Rockstar Games Social Club) (Version: 1.0.9.5 - Rockstar Games)
Samsung_MonSetup (HKLM\...\{8EA79DBF-D637-448A-89D6-410A087A4493}) (Version: 1.00.0000 - Samsung)
Secure Download Manager (HKLM\...\{E040B65B-8683-4228-8C33-D44A141E40EA}) (Version: 3.1.60 - Kivuto Solutions Inc.)
Service Pack 1 for SQL Server 2008 (KB968369) (HKLM\...\KB968369) (Version: 10.1.2531.0 - Microsoft Corporation)
Shark007 Advanced Codecs (HKLM\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 4.1.7 - Shark007)
Simpo PDF to PowerPoint 1.3.1.0 (HKLM\...\Simpo PDF to PowerPoint_is1) (Version: 1.3.1.0 - Simpo Technologies)
Skype Click to Call (HKLM\...\{B6CF2967-C81E-40C0-9815-C05774FEF120}) (Version: 6.13.13771 - Skype Technologies S.A.)
Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
Speccy (HKLM\...\Speccy) (Version: 1.26 - Piriform)
SpeedFan (remove only) (HKLM\...\SpeedFan) (Version:  - )
Sql Server Customer Experience Improvement Program (Version: 10.1.2531.0 - Microsoft Corporation) Hidden
SQLXML4 (HKLM\...\{8C62A94B-4AB6-485F-A111-93056684D340}) (Version: 9.00.1399.06 - Microsoft Corporation)
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Street Fighter X Tekken version 1.16 (HKLM\...\{3430FA5-AF68-4A2D-A7D4-891000008200}_is1) (Version: 1.16 - Black Box)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
System Requirements Lab CYRI (HKLM\...\{E77DA909-3532-4C95-AFEB-06310E88462A}) (Version: 6.0.3.0 - Husdawg, LLC)
TagScanner 5.1.637 (HKLM\...\TagScanner_is1) (Version:  - Sergey Serkov)
TeamViewer 8 (HKLM\...\TeamViewer 8) (Version: 8.0.22298 - TeamViewer)
Technitium MAC Address Changer v6.0.3 (HKLM\...\TMACv6.0) (Version: 6.0.3 - Technitium)
TechPowerUp GPU-Z (HKLM\...\TechPowerUp GPU-Z) (Version:  - TechPowerUp)
Text-To-Speech-Runtime (HKLM\...\{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}) (Version: 1.0.0.0 - Magix Development GmbH)
The Amazing Spider-Man (HKLM\...\The Amazing Spider-Man_is1) (Version:  - )
tools-freebsd (Version: 9.2.0.812388 - VMware, Inc.) Hidden
tools-linux (Version: 9.2.0.812388 - VMware, Inc.) Hidden
tools-netware (Version: 9.2.0.812388 - VMware, Inc.) Hidden
tools-solaris (Version: 9.2.0.812388 - VMware, Inc.) Hidden
tools-windows (Version: 9.2.0.812388 - VMware, Inc.) Hidden
tools-winPre2k (Version: 9.2.0.812388 - VMware, Inc.) Hidden
TuneUp Utilities 2014 (en-US) (Version: 14.0.1000.88 - TuneUp Software) Hidden
TuneUp Utilities 2014 (HKLM\...\TuneUp Utilities 2014) (Version: 14.0.1000.88 - TuneUp Software)
TuneUp Utilities 2014 (Version: 14.0.1000.88 - TuneUp Software) Hidden
TurboC++ 3.0.7.7c (HKLM\...\TurboC++) (Version: 3.0.7.7c - NeutroNVegetOStrikeR.DbZ)
Unlocker 1.9.2 (HKLM\...\Unlocker) (Version: 1.9.2 - Cedrick Collomb)
USB Game Controller (HKLM\...\{95CC887F-91B2-45E9-AE29-0D51995192CB}) (Version: 2005.05.26 - )
USB Vibration Joystick (HKLM\...\{4999B2F1-3E74-409A-B8B5-E94448AA9EA6}) (Version: 2007.08.17 - )
ViPER4Windows version 1.0.5 (HKLM\...\{1A0B530D-277E-4735-8A36-65DCF7E157CB}_is1) (Version: 1.0.5 - ViPERs Audio, Inc)
Virtua Tennis 4™ (HKLM\...\GFWL_{53450FA2-E900-456E-9715-501000008200}) (Version: 1.0.0000.130 - SEGA)
Virtua Tennis 4™ (Version: 1.0.0000.130 - SEGA) Hidden
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 ENU (HKLM\...\{112C23F2-C036-4D40-BED4-0CB47BF5555C}) (Version: 4.0.8080.0 - Microsoft Corporation)
VLC media player 2.1.2 (HKLM\...\VLC media player) (Version: 2.1.2 - VideoLAN)
VMware Workstation (HKLM\...\VMware_Workstation) (Version: 9.0.0 - VMware, Inc)
VMware Workstation (Version: 9.0.0 - VMware, Inc.) Hidden
Web Deployment Tool (HKLM\...\{0F37D969-1260-419E-B308-EF7D29ABDE20}) (Version: 1.1.0618 - Microsoft Corporation)
Weka 3.6.9 (HKLM\...\Weka 3.6.9) (Version: 3.6.9 - Machine Learning Group, University of Waikato, Hamilton, NZ)
Who Is On My Wifi version 2.1.5 (HKLM\...\{010D45A1-093D-4534-8147-4E10E80F81CC}_is1) (Version: 2.1.5 - IO3O LLC)
Windows 7 USB/DVD Download Tool (HKLM\...\{F92064F6-BDE8-46FC-A19F-4E12D311BE3A}) (Version: 1.0.30 - Microsoft Corporation)
Windows Driver Package - Nokia pccsmcfd “LegacyDriver”  (05/31/2012 7.1.2.0) (HKLM\...\17D063A0A9F5D5A225B76B1D9BCB5ADBE85C8382) (Version: 05/31/2012 7.1.2.0 - Nokia)
Windows Live ID Sign-in Assistant (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinPDFEditor V2.0.1 (HKLM\...\WinPDFEditor_is1) (Version:  - http://www.WinPDFEditor.com)
WinRAR 4.20 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
Wondershare MobileGo for Android ( Version 4.0.0 ) (HKLM\...\{1E04C795-7359-4E05-8A0E-5644F777AA08}_is1) (Version: 4.0.0 - Wondershare)
Wondershare MobileTrans ( Version 4.4.0 ) (HKLM\...\{18CDCEAA-A9E4-4A4C-AC0E-C15E87C30EA5}_is1) (Version: 4.4.0 - Wondershare)

==================== Restore Points  =========================

28-05-2014 17:09:04 Scheduled Checkpoint

==================== Hosts content: ==========================

2009-07-14 07:34 - 2014-05-21 22:26 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

Task: {0D9AAED4-AE2F-43FB-8B09-7791434AA355} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2014-03-18] (Oracle Corporation)
Task: {20599FD3-9050-48D5-AE84-2DFDAF22657F} - System32\Tasks\Microsoft Office 15 Sync Maintenance for inteli3pc-inteli3 inteli3pc => C:\Program Files\Microsoft Office\Office15\MsoSync.exe [2012-10-01] (Microsoft Corporation)
Task: {36BDCD79-181B-400F-A2C1-0139BF6FF042} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-05-11] (Google Inc.)
Task: {6193147D-3242-4396-BE52-DE5972436E0F} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {9395564F-40D2-4E6A-B36D-F0756BFC74AC} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2014-03-19] (Piriform Ltd)
Task: {A6B50965-62F8-476E-98C0-7834982D4196} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn => C:\Program Files\Microsoft Office\Office15\msoia.exe [2012-10-01] (Microsoft Corporation)
Task: {A7A2EC12-4B93-434D-A4E4-A06E1849F66E} - System32\Tasks\TuneUpUtilities_Task_BkGndMaintenance2013 => C:\Program Files\TuneUp Utilities 2014\OneClick.exe [2013-08-29] (TuneUp Software)
Task: {D0A37E29-B72F-4F78-9762-4C695E30D4C4} - System32\Tasks\Modem reboot => D:\modem reboot\RebootBatch.bat [2013-04-08] ()
Task: {ED3B38F6-4671-48A4-8753-2812FD65D460} - System32\Tasks\Microsoft\Office\Office 15 Subscription Heartbeat => C:\Program Files\Common Files\Microsoft Shared\Office15\OLicenseHeartbeat.exe [2012-10-01] (Microsoft Corporation)
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2010-07-05 03:02 - 2010-07-05 03:02 - 00004608 ____N () C:\Program Files\Unlocker\UnlockerHook.dll
2012-10-01 20:33 - 2012-10-01 20:33 - 06522480 ____N () C:\Program Files\Microsoft Office\Office15\1033\GrooveIntlResource.dll
2014-03-28 15:05 - 2014-03-28 15:05 - 00093696 ____N () C:\Program Files\FileZilla FTP Client\fzshellext.dll
2010-07-05 01:21 - 2010-07-05 01:21 - 00017408 ____N () C:\Program Files\Unlocker\UnlockerAssistant.exe
2014-05-10 12:32 - 2014-05-10 12:32 - 03839088 ____N () C:\Program Files\Mozilla Firefox\mozjs.dll
2013-08-29 12:08 - 2013-08-29 12:08 - 00501560 ____N () C:\Program Files\TuneUp Utilities 2014\avgreplibx.dll
2014-05-18 16:36 - 2014-05-18 16:36 - 16361136 _____ () C:\Windows\system32\Macromed\Flash\NPSWF32_13_0_0_214.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939
AlternateDataStreams: C:\ProgramData\TEMP:BF3D62E7

==================== Safe Mode (whitelisted) ===================


==================== EXE Association (whitelisted) =============



HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\exefile: "%1" %* <===== ATTENTION!

==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: BitTorrent => "C:\Users\inteli3\AppData\Roaming\BitTorrent\BitTorrent.exe"  /MINIMIZED
MSCONFIG\startupreg: NetWorx => "C:\Program Files\NetWorx\networx.exe" /auto

==================== Faulty Device Manager Devices =============

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

Name: Bluetooth Peripheral Device
Description: Bluetooth Peripheral Device
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/29/2014 07:41:55 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/28/2014 07:33:22 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/27/2014 08:37:32 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/27/2014 07:56:32 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/26/2014 09:03:08 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/26/2014 07:39:14 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/25/2014 09:43:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDTray.exe, version: 2.0.9.127, time stamp: 0x4ff41db8
Faulting module name: rtl150.bpl, version: 15.0.3953.35171, time stamp: 0x4cca139f
Exception code: 0xc0000005
Fault offset: 0x0000c106
Faulting process id: 0x9c0
Faulting application start time: 0xSDTray.exe0
Faulting application path: SDTray.exe1
Faulting module path: SDTray.exe2
Report Id: SDTray.exe3

Error: (05/25/2014 09:43:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Faulting application name: SDTray.exe, version: 2.0.9.127, time stamp: 0x4ff41db8
Faulting module name: ATL.DLL_unloaded, version: 0.0.0.0, time stamp: 0x4a5bd97a
Exception code: 0xc0000005
Fault offset: 0x74002301
Faulting process id: 0x9c0
Faulting application start time: 0xSDTray.exe0
Faulting application path: SDTray.exe1
Faulting module path: SDTray.exe2
Report Id: SDTray.exe3

Error: (05/25/2014 09:42:38 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.

Error: (05/25/2014 03:27:32 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: Event filter with query "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" could not be reactivated in namespace "//./root/CIMV2" because of error 0x80041003. Events cannot be delivered through this filter until the problem is corrected.


System errors:
=============
Error: (05/29/2014 07:45:43 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The BlueStacks Log Rotator Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (05/29/2014 07:45:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The MBAMService service terminated unexpectedly.  It has done this 1 time(s).

Error: (05/29/2014 07:45:02 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The MBAMScheduler service terminated unexpectedly.  It has done this 1 time(s).

Error: (05/28/2014 08:48:36 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The BlueStacks Log Rotator Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (05/28/2014 08:48:31 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (05/28/2014 07:47:37 PM) (Source: volsnap) (EventID: 36) (User: )
Description: The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.

Error: (05/28/2014 07:34:47 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The MBAMScheduler service terminated unexpectedly.  It has done this 1 time(s).

Error: (05/28/2014 07:34:44 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The MBAMService service terminated unexpectedly.  It has done this 1 time(s).

Error: (05/27/2014 11:01:07 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Adobe Acrobat Update Service service terminated unexpectedly.  It has done this 1 time(s).

Error: (05/27/2014 09:42:18 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: The Hotspot Shield Monitoring Service service terminated unexpectedly.  It has done this 1 time(s).


Microsoft Office Sessions:
=========================
Error: (05/29/2014 07:41:55 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/28/2014 07:33:22 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 08:37:32 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/27/2014 07:56:32 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2014 09:03:08 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2014 07:39:14 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/25/2014 09:43:50 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDTray.exe2.0.9.1274ff41db8rtl150.bpl15.0.3953.351714cca139fc00000050000c1069c001cf783416e53d33C:\Program Files\Spybot - Search & Destroy 2\SDTray.exeC:\Program Files\Spybot - Search & Destroy 2\rtl150.bpl8e6ad459-e427-11e3-a314-000d1801118c

Error: (05/25/2014 09:43:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: SDTray.exe2.0.9.1274ff41db8ATL.DLL_unloaded0.0.0.04a5bd97ac0000005740023019c001cf783416e53d33C:\Program Files\Spybot - Search & Destroy 2\SDTray.exeATL.DLL73ec6ff5-e427-11e3-a314-000d1801118c

Error: (05/25/2014 09:42:38 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/25/2014 03:27:32 PM) (Source: Microsoft-Windows-WMI) (EventID: 10) (User: NT AUTHORITY)
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


==================== Memory info ===========================

Percentage of memory in use: 44%
Total physical RAM: 3575.3 MB
Available physical RAM: 1989.2 MB
Total Pagefile: 7148.9 MB
Available Pagefile: 5080.25 MB
Total Virtual: 2047.88 MB
Available Virtual: 1885.13 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:42.74 GB) (Free:3.69 GB) NTFS
Drive d: () (Fixed) (Total:888.67 GB) (Free:90.31 GB) NTFS
Drive e: (After 10+2) (CDROM) (Total:0.01 GB) (Free:0 GB) CDFS
Drive g: () (Fixed) (Total:298.09 GB) (Free:94.6 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: AC619681)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=43 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=889 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 298 GB) (Disk ID: D88ED88E)
Partition 1: (Not Active) - (Size=298 GB) - (Type=07 NTFS)

==================== End Of Log ============================

Attached Files


Edited by apurvgupta, 29 May 2014 - 09:47 AM.


#6 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,640 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:11:26 AM

Posted 29 May 2014 - 11:45 AM

Greetings Apurv,

The first thing we need to do is copy and paste FRST from D:\Downloads\Programs to your desktop.

Looks like you have wrestled with this quite a bit already. There is more work for us to do. First want to caution you about a couple of programs on your computer.

Please consider and do these things.

===================================================

Spybot S&D No Longer Recommended

--------------------

MVPS.org is no longer recommending Spybot S&D due to poor testing results. (scroll down on the web site and read under Freeware Antispyware Products)

I strongly recommend uninstalling Spybot Search & Destroy. The presence of this program can make cleaning your computer more difficult.

If you choose to uninstall please go to Start, Control Panel, Add/Remove Programs (or Programs and Features) and uninstall the program.

===================================================

P2P Warning

--------------------

Going over your logs I noticed that you have Bit Torrent installed. It is pretty much certain that if you continue to use P2P programs, you will get infected again.
  • Avoid gaming sites, pirated software, cracking tools, keygens, and peer-to-peer (P2P) file sharing programs.
  • They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites.
  • Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and malicious Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users.
  • The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications.
I would recommend that you uninstall Bit Torrent, however that choice is up to you. If you choose to remove the program, you can do so via Start > Control Panel > Add/Remove Programs.

If you are still leaning toward using this program, please take a look at this information about Ransomware which can be delivered via P2P file transfers. The newest variation of Ransomware can make it impossible to recover the files this malicious software encrypts. In other words, you will probably lose most if not all of your valuable information, including pictures. In addition it has recently been reported that P2P downloads may be tracked resulting in your IP address being monitored by copyright authorities. .

If you wish to keep it, please do not use it until we are completely done and your machine is determined to be clean and updated.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\lclefphm\qidqpsqa.exe
C:\Program Files\lclefphm
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S1 pbfhsdpm; \??\C:\Windows\system32\drivers\pbfhsdpm.sys [X]
C:\Windows\system32\drivers\pbfhsdpm.sys
C:\Users\inteli3\AppData\Roaming\Camdata.ini
C:\Users\inteli3\AppData\Roaming\CamLayout.ini
C:\Users\inteli3\AppData\Roaming\CamShapes.ini
C:\Users\inteli3\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpkdugld.dll
C:\Users\inteli3\AppData\Local\Temp\ntdll_dump.dll
AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939
AlternateDataStreams: C:\ProgramData\TEMP:BF3D62E7
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\exefile: "%1" %* <===== ATTENTION!
Reboot:
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
===================================================

AdwCleaner by Xplode - Delete Adware

-------------------
  • Please download AdwCleaner by Xplode onto your desktop.
  • Close all open programs and internet browser
  • Double click on AdwCleaner.exe, select OK, then Run
  • Click on Scan
  • Upon completion click Report
  • Review the entries and uncheck any items you would like to keep on your computer (leaving an item checked will cause its deletion)
  • Click Clean to remove the items still checked
  • Click OK twice to reboot your computer
  • Copy and paste the contents of the text file on your desktop upon reboot in your reply
  • You can also find the logfile at C:\AdwCleaner\AdwCleaner.txt
===================================================

Junkware Removal Tool by thisisu

-------------------
  • Please download Junkware Removal Tool and save it to your desktop.
  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  • Right-mouse click JRT.exe and select Run as administrator (Windows XP double click the icon)
  • Please allow the program time to run
  • Once completed a Notepad document will open on your desktop
  • Copy and paste the contents in your reply
===================================================

screen317's Security Check

--------------------
  • Please download screen317's Security Check to your desktop
  • Double-click icon to launch the program
  • Click OK
  • Select Run Note: If you receive an error message attempt to run the program in Safe Mode
  • Press any key to start the program
  • Allow the program to run
  • A Notepad document will open on your desktop. Please copy and paste the contents in your reply
===================================================

Please download and run Microsoft Fix it 50688 to fix a non-malware related technical issue with Windows.

===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Fixlog
  • AdwCleaner log
  • Junkware log
  • Security check log
  • Did the Microsoft fix seem to work properly?
  • How is your computer running now?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#7 apurvgupta

apurvgupta
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 30 May 2014 - 11:35 PM

HI Gary, here is the information required:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:25-05-2014 02
Ran by inteli3 at 2014-05-31 09:30:07 Run:1
Running from C:\Users\inteli3\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\lclefphm\qidqpsqa.exe
C:\Program Files\lclefphm
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S1 pbfhsdpm; \??\C:\Windows\system32\drivers\pbfhsdpm.sys [X]
C:\Windows\system32\drivers\pbfhsdpm.sys
C:\Users\inteli3\AppData\Roaming\Camdata.ini
C:\Users\inteli3\AppData\Roaming\CamLayout.ini
C:\Users\inteli3\AppData\Roaming\CamShapes.ini
C:\Users\inteli3\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpkdugld.dll
C:\Users\inteli3\AppData\Local\Temp\ntdll_dump.dll
AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939
AlternateDataStreams: C:\ProgramData\TEMP:BF3D62E7
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\exefile: "%1" %* <===== ATTENTION!
Reboot:
*****************

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => Value was restored successfully.

"C:\Program Files\lclefphm" directory move:
 

 

 

ADW log-

 

# AdwCleaner v3.211 - Report created 31/05/2014 at 09:54:24
# Updated 26/05/2014 by Xplode
# Operating System : Windows 7 Ultimate Service Pack 1 (32 bits)
# Username : inteli3 - INTELI3PC
# Running from : C:\Users\inteli3\Desktop\AdwCleaner.exe
# Option : Clean

***** [ Services ] *****


***** [ Files / Folders ] *****

Folder Deleted : C:\Windows\system32\hotspot shield
Folder Deleted : C:\Users\inteli3\AppData\Local\Temp\hotspot shield
Folder Deleted : C:\Program Files\Mozilla Firefox\Extensions\afurladvisor@anchorfree.com

***** [ Shortcuts ] *****


***** [ Registry ] *****

Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\bi_client_RASAPI32
Key Deleted : HKLM\SOFTWARE\Microsoft\Tracing\bi_client_RASMANCS
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{35B8892D-C3FB-4D88-990D-31DB2EBD72BD}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A43DE495-3D00-47D4-9D2C-303115707939}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{A1CCCE0D-AE21-42A2-BE58-8E6109410995}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{CD4D7B0F-45C6-4bb2-A1E7-54D1754E7FC5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{813A22E0-3E2B-4188-9BDA-ECA9878B8D48}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{BCFF5F55-6F44-11D2-86F8-00104B265ED5}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3}
Key Deleted : HKCU\Software\anchorfree
Key Deleted : HKCU\Software\APN PIP
Key Deleted : HKCU\Software\Conduit
Key Deleted : HKCU\Software\AppDataLow\Software
Key Deleted : HKLM\Software\PIP
Key Deleted : HKLM\Software\Software

***** [ Browsers ] *****

-\\ Internet Explorer v10.0.9200.16521


-\\ Mozilla Firefox v29.0 (en-US)

[ File : C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\0jwbjxfn.test\prefs.js ]


[ File : C:\Users\inteli3\AppData\Roaming\Mozilla\Firefox\Profiles\nj11o7yi.default-1372255369387\prefs.js ]


-\\ Google Chrome v

[ File : C:\Users\inteli3\AppData\Local\Google\Chrome\User Data\Default\preferences ]

Deleted [Search Provider] : hxxp://search.aol.com/aol/search?query={searchTerms}
Deleted [Search Provider] : hxxp://www.ask.com/web?q={searchTerms}
Deleted [Startup_urls] : hxxps://mail.google.com/mail/ca/u/0/?shva=1#inbox

*************************

AdwCleaner[R0].txt - [2732 octets] - [31/05/2014 09:52:48]
AdwCleaner[S0].txt - [2692 octets] - [31/05/2014 09:54:24]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [2752 octets] ##########
 

 

 

 

 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.4 (04.06.2014:1)
OS: Windows 7 Ultimate x86
Ran by inteli3 on 31-05-2014 at 10:02:02.68
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\inteli3\AppData\Roaming\mozilla\firefox\profiles\nj11o7yi.default-1372255369387\minidumps [135 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 31-05-2014 at 10:03:30.30
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 

 Results of screen317's Security Check version 0.99.83  
 Windows 7 Service Pack 1 x86 (UAC is enabled)  
 Internet Explorer 10 Out of date!
``````````````Antivirus/Firewall Check:``````````````
 Windows Security Center service is not running! This report may not be accurate!
 Windows Firewall Enabled!  
 Windows Firewall Disabled!  
 WMI entry may not exist for antivirus; attempting automatic update.
`````````Anti-malware/Other Utilities Check:`````````
 TuneUp Utilities 2014   
 TuneUp Utilities 2014 (en-US)  
 TuneUp Utilities 2014   
 CCleaner     
 JavaFX 2.0.3    
 JavaFX 2.0.3 SDK   
 Java 7 Update 45  
 Java 8 Update 5  
 Java™ SE Development Kit 7 Update 3
 Java SE Development Kit 7 Update 25
 Java version out of Date!
 Adobe Flash Player     13.0.0.214  
 Adobe Reader XI  
 Mozilla Firefox (29.0)
 Google Chrome 34.0.1847.131  
````````Process Check: objlist.exe by Laurent````````  
`````````````````System Health check`````````````````
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
 

 

 

 

Microsoft Fix it does seems to run properly and was processed successfully. :thumbup2:

 

 

Computer seems to be running normal as usual, but running the MS Windows malicious software removal tool as well as malwarebytes antimalware , still shows some exe files and dll files as viruses which seems to be normal programs for me. :/


Edited by apurvgupta, 31 May 2014 - 12:15 AM.


#8 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,640 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:11:26 AM

Posted 31 May 2014 - 08:52 AM

Greetings Apurv,

Did you copy the entire fixlog report? It isn't complete, or the fix did not work properly.
Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#9 apurvgupta

apurvgupta
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 31 May 2014 - 09:02 AM

Hello Gary, i did copy the entire fixlog report, anyways i ran it again just now and it got updated and ran the fix again, system got rebooted, here is the log again:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:30-05-2014
Ran by inteli3 at 2014-05-31 19:23:56 Run:2
Running from C:\Users\inteli3\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
HKLM\...\Winlogon: [Userinit] C:\Windows\system32\userinit.exe,C:\Program Files\lclefphm\qidqpsqa.exe
C:\Program Files\lclefphm
CHR HKLM\SOFTWARE\Policies\Google: Policy restriction <======= ATTENTION
S1 pbfhsdpm; \??\C:\Windows\system32\drivers\pbfhsdpm.sys [X]
C:\Windows\system32\drivers\pbfhsdpm.sys
C:\Users\inteli3\AppData\Roaming\Camdata.ini
C:\Users\inteli3\AppData\Roaming\CamLayout.ini
C:\Users\inteli3\AppData\Roaming\CamShapes.ini
C:\Users\inteli3\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpkdugld.dll
C:\Users\inteli3\AppData\Local\Temp\ntdll_dump.dll
AlternateDataStreams: C:\ProgramData\TEMP:A1EDB939
AlternateDataStreams: C:\ProgramData\TEMP:BF3D62E7
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\.exe: exefile => "%1" %* <===== ATTENTION!
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\exefile: "%1" %* <===== ATTENTION!
Reboot:
*****************

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Userinit => Value was restored successfully.

"C:\Program Files\lclefphm" directory move:

Could not move "C:\Program Files\lclefphm\qidqpsqa.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files\lclefphm" directory. => Scheduled to move on reboot.

HKLM\SOFTWARE\Policies\Google => Key deleted successfully.
pbfhsdpm => Service deleted successfully.
"C:\Windows\system32\drivers\pbfhsdpm.sys" => File/Directory not found.
C:\Users\inteli3\AppData\Roaming\Camdata.ini => Moved successfully.
C:\Users\inteli3\AppData\Roaming\CamLayout.ini => Moved successfully.
C:\Users\inteli3\AppData\Roaming\CamShapes.ini => Moved successfully.
"C:\Users\inteli3\AppData\Local\Temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpkdugld.dll" => File/Directory not found.
C:\Users\inteli3\AppData\Local\Temp\ntdll_dump.dll => Moved successfully.
C:\ProgramData\TEMP => ":A1EDB939" ADS removed successfully.
C:\ProgramData\TEMP => ":BF3D62E7" ADS removed successfully.
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\exefile => Key deleted successfully.
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\.exe => Key deleted successfully.
HKU\S-1-5-21-2318313728-2082358343-1595649249-1000\Software\Classes\exefile => Key not found.

=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-05-31 19:26:43)<=

"C:\Program Files\lclefphm\qidqpsqa.exe" => File could not move.
"C:\Program Files\lclefphm" => Directory could not move.

==== End of Fixlog ====



#10 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,640 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:11:26 AM

Posted 31 May 2014 - 09:11 AM

Thank you. It appears the fix did not work the first time but did this time, with 2 exceptions. I am going to be away from my computer for at least 8 hours and what we need to do as a follow up is not a quick post sort of thing.  We need to deal with these entries:

"C:\Program Files\lclefphm\qidqpsqa.exe" => File could not move.
"C:\Program Files\lclefphm" => Directory could not move.

 

As soon as I return we will be right back at it but you may be sleeping!


Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#11 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,640 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:11:26 AM

Posted 31 May 2014 - 07:38 PM

Thank you for your patience,

Please do this.

===================================================

GrantPerms by Farbar

--------------------
  • Download Grantperms (32 bit systems) or Grantperms64 (64 bit systems) and save it to your desktop
  • Unzip the file and launch the program
  • Copy and paste the following in the edit box:

C:\Program Files\lclefphm

  • Click Unlock. When it is done click OK
  • Click List Permissions and copy/paste the results of the Perms.txt document.
  • A copy of Perms.txt will be saved in the same directory the tool is run.
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Perms.txt

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#12 apurvgupta

apurvgupta
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 31 May 2014 - 11:06 PM

Many thanks Gary for the help uptill now :)  , here is the Perms.txt content:

 

 

GrantPerms by Farbar
Ran by inteli3 (administrator) at 2014-06-01 09:35:17

===============================================
\\?\C:\Program Files\lclefphm

   Owner: BUILTIN\Administrators

   DACL(P)(AI):
   BUILTIN\Administrators   FULL   ALLOW   (CI)(OI)
   NT AUTHORITY\SYSTEM   FULL   ALLOW   (CI)(OI)
   BUILTIN\Users   READ/EXECUTE   ALLOW   (CI)(OI)
 



#13 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,640 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:11:26 AM

Posted 01 June 2014 - 09:56 AM

Very good, now let's try to delete that entry. Please do this.

===================================================

Farbar's Recovery Scan Tool - Run Fix in Normal or Safe Mode

--------------------
  • Press the windows key Windows_Logo_key.gif + r on your keyboard at the same time. Type in notepad and press Enter
  • Please copy and paste the contents of the below code box into the open notepad and save it to your desktop (<<<Important) as fixlist.txt
C:\Program Files\lclefphm
  • Launch FRST and press the Fix button just once and wait, the program will automatically launch fixlist.txt.
  • The tool will create a log on the desktop called Fixlog.txt. Please copy and paste the contents of the file in your reply.
  • Reboot your computer and check the performance
===================================================

Things I would like to see in your next reply. Please be sure to copy and paste any requested log information unless you are asked to attach it. :thumbsup2:
  • Fixlog
  • How is your computer running?

Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."

#14 apurvgupta

apurvgupta
  • Topic Starter

  • Members
  • 32 posts
  • OFFLINE
  •  
  • Local time:11:56 PM

Posted 01 June 2014 - 10:07 AM

Hello, i ran the FRST tool and there seems to be no changes as far as the state of the computer goes, here is the log:

 

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version:01-06-2014 01
Ran by inteli3 at 2014-06-01 20:33:05 Run:3
Running from C:\Users\inteli3\Desktop
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Program Files\lclefphm
*****************


"C:\Program Files\lclefphm" directory move:

Could not move "C:\Program Files\lclefphm\qidqpsqa.exe" => Scheduled to move on reboot.
Could not move "C:\Program Files\lclefphm" directory. => Scheduled to move on reboot.


=> Result of Scheduled Files to move (Boot Mode: Normal) (Date&Time: 2014-06-01 20:34:49)<=

"C:\Program Files\lclefphm\qidqpsqa.exe" => File could not move.
"C:\Program Files\lclefphm" => Directory could not move.

==== End of Fixlog ====



#15 Oh My!

Oh My!

    Adware and Spyware and Malware.....


  • Malware Response Instructor
  • 36,640 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:California
  • Local time:11:26 AM

Posted 01 June 2014 - 02:31 PM

Looks like a file doesn't want to cooperated. Please rerun GrantPerms again putting the following in the Edit box:

C:\Program Files\lclefphm\qidqpsqa.exe

 

Post the log.


Gary
 
If I do not reply within 24 hours please send me a Personal Message.

"Lord, to whom would we go? You have the words that give eternal life. We believe, and we know you are the Holy One of God."




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users